Function at 0x1b350
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rax, qword [0x00027100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov ebp, 0x4000
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor r12d, r12d
mov rsi, rax
cmp rax, r12
jne 0x1b3c3
mov eax, dword [0x0002c37c]
cmp eax, r12d
jne 0x1b5cb
mov eax, dword [0x0002c378]
lea rcx, [0x0002b2b8]
mov byte [0x0002c1fd], 1
and eax, 3
mov eax, dword [rcx + rax*4]
jmp 0x1b5cb
mov r13d, 0x38
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, r12
je 0x1b58d
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.00024210
or qword [rdi + 0x10], 0xffffffffffffffff
mov r13d, 2
mov dword [rdi], r13d
neg rdi
cmp rdi, 0xffffffffffffffff
je 0x1b58d
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.00024210
mov rdx, rbx
mov rcx, rsi
call fcn.0001b15c
mov word [rsp + 0x30], r12w
mov byte [rsp + 0x30], r12b
mov byte [rsp + 0x31], 0x35
movzx ecx, word [rsp + 0x30]
mov word [rsp + 0x38], r13w
mov word [rsp + 0x3a], cx
mov ebx, eax
call fcn.0001b014
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov r13d, 0x10
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call fcn.00011538
xor edx, edx
mov rcx, rsi
cmp eax, r12d
mov ebx, eax
jge 0x1b4cb
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rdi
call fcn.000110ec
mov eax, dword [0x0002c37c]
cmp ebx, 0xc0000022
jne 0x1b39b
mov edx, dword [0x0002c378]
cmp eax, r12d
jne 0x1b4be
mov eax, edx
lea rcx, [0x0002b2b8]
mov byte [0x0002c1fd], 1
and eax, 3
mov eax, dword [rcx + rax*4]
inc edx
mov dword [0x0002c378], edx
jmp 0x1b5cb
mov r8, rbp
mov dword [rsp + 0x30], r13d
call fcn.00024210
lea r11, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], r11
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.00011450
mov rcx, rsi
cmp eax, r12d
mov ebp, eax
jge 0x1b550
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rdi
call fcn.000110ec
mov ebx, dword [0x0002c37c]
cmp ebx, r12d
jne 0x1b5c9
mov eax, dword [0x0002c378]
lea rcx, [0x0002b2b8]
mov edx, ebp
and eax, 3
mov byte [0x0002c1fd], 1
mov ebx, dword [rcx + rax*4]
lea rcx, [0x00024bf0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1b5c9
mov edx, eax
call fcn.0001b274
mov ebx, eax
cmp eax, r12d
jne 0x1b583
mov ebx, dword [0x0002c37c]
cmp ebx, r12d
jne 0x1b583
mov eax, dword [0x0002c378]
lea rcx, [0x0002b2b8]
mov byte [0x0002c1fd], 1
and eax, 3
mov ebx, dword [rcx + rax*4]
mov rcx, rdi
call fcn.000110ec
jmp 0x1b5c9
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, dword [0x0002c37c]
cmp ebx, r12d
jne 0x1b5c9
mov eax, dword [0x0002c378]
lea rcx, [0x0002b2b8]
mov byte [0x0002c1fd], 1
and eax, 3
mov ebx, dword [rcx + rax*4]
lea rcx, [0x00024bd0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00022be0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret