Function at 0x1a360
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rcx + 0x48]
xor r14d, r14d
movsxd r15, r8d
mov rdi, rdx
mov r13, rcx
mov r12, rdx
mov rbx, rdx
mov esi, r15d
cmp byte [0x00025742], r14b
je 0x1a3ad
lea rcx, [0x00020c50]
mov r9, rbp
mov r8d, r15d
call sub.ntoskrnl.exe_DbgPrint
test rbp, rbp
jne 0x1a3b9
xor eax, eax
jmp 0x1a58a
cmp qword [r13 + 0x50], r14
jne 0x1a42b
lea r8, [0x00020ca0]
mov r9d, 5
mov edx, r15d
mov rcx, rdi
call fcn.00018954
cmp eax, 0xffffffff
jne 0x1a3e2
add dword [rbp + 0x10], r15d
jmp 0x1a3f0
mov eax, dword [rbp + 0x10]
mov dword [rbp + 0x10], eax
mov dword [r13 + 0x28], 8
mov rcx, qword [rsp + 0x78]
mov dword [rbp + 0xc], 1
lea rdi, [rcx + r15]
cmp byte [0x00025742], r14b
je 0x1a423
mov rdx, rcx
lea rcx, [0x00020cb0]
mov r9d, r15d
mov r8, rdi
mov qword [rsp + 0x20], rbp
call sub.ntoskrnl.exe_DbgPrint
mov rax, rdi
jmp 0x1a58a
test r15d, r15d
jle 0x1a569
test rbp, rbp
je 0x1a564
mov rdi, qword [r13 + 0x50]
test rdi, rdi
je 0x1a564
or rcx, 0xffffffffffffffff
add rdi, 8
xor eax, eax
repne scasb al, byte [rdi]
inc r14d
not rcx
dec rcx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
cmp byte [0x00025742], al
je 0x1a488
mov dword [rsp + 0x20], ecx
lea rcx, [0x00020d20]
mov r9d, esi
mov r8, rbx
mov edx, r14d
call sub.ntoskrnl.exe_DbgPrint
bt dword [rbp + 0xc], 0xc
movsxd rax, esi
jae 0x1a5a2
mov rcx, rbx
lea rdx, [rax + rbx - 1]
test rbx, rbx
je 0x1a4c9
cmp esi, 2
jl 0x1a4c9
cmp rbx, rdx
jae 0x1a4c9
cmp byte [rcx], 0x2d
jne 0x1a4b8
cmp byte [rcx + 1], 0x2d
je 0x1a4c0
inc rcx
cmp rcx, rdx
jmp 0x1a4ab
sub ebx, ecx
add esi, ebx
mov rbx, rcx
jmp 0x1a4cb
xor ebx, ebx
cmp byte [0x00025742], 0
je 0x1a4e9
lea rcx, [0x00020d90]
mov r9d, esi
mov r8, rbx
mov edx, r14d
call sub.ntoskrnl.exe_DbgPrint
test rbx, rbx
je 0x1a755
lea eax, [rdi + 4]
cmp esi, eax
jl 0x1a74d
mov rcx, qword [r13 + 0x50]
add rbx, 2
movsxd r8, edi
add rcx, 8
mov rdx, rbx
sub esi, 2
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
jne 0x1a71a
movsxd r12, edi
add r12, rbx
cmp byte [r12], 0xd
jne 0x1a727
cmp byte [r12 + 1], 0xa
jne 0x1a727
sub esi, edi
mov dword [r13 + 0x28], 6
cmp byte [0x00025742], al
je 0x1a587
lea rcx, [0x00020e70]
mov r9d, esi
mov r8, r12
mov edx, r14d
call sub.ntoskrnl.exe_DbgPrint
mov rdi, qword [rsp + 0x78]
cmp byte [0x00025742], 0
je 0x1a587
lea rcx, [0x000212c0]
mov r9d, r15d
mov r8, r12
mov rdx, rdi
call sub.ntoskrnl.exe_DbgPrint
mov rax, r12
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x80], esi
mov rdi, rbx
lea rcx, [rax + rbx - 1]
test rbx, rbx
je 0x1a5e2
cmp esi, 2
jl 0x1a5e2
cmp rbx, rcx
jae 0x1a5e2
cmp byte [rdi], 0x2d
jne 0x1a5cb
cmp byte [rdi + 1], 0x2d
je 0x1a5d3
inc rdi
cmp rdi, rcx
jmp 0x1a5be
mov ecx, ebx
sub ecx, edi
add ecx, esi
mov dword [rsp + 0x80], ecx
jmp 0x1a5e4
xor edi, edi
cmp byte [0x00025742], 0
je 0x1a602
lea rcx, [0x00020f60]
mov r9d, esi
mov r8, rbx
mov edx, r14d
call sub.ntoskrnl.exe_DbgPrint
test rdi, rdi
je 0x1a821
mov ecx, dword [rsp + 0x80]
mov eax, edi
sub eax, ebx
add dword [rbp + 0x10], eax
mov rax, qword [rsp + 0x70]
add eax, 4
cmp ecx, eax
jl 0x1a805
lea esi, [rcx - 2]
mov rcx, qword [r13 + 0x50]
lea rbx, [rdi + 2]
mov rdi, qword [rsp + 0x70]
mov rdx, rbx
add rcx, 8
movsxd rax, edi
mov r8, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
jne 0x1a71a
cmp byte [0x00025742], al
je 0x1a686
lea rax, [rbp + 0x18]
lea rcx, [0x000210b0]
mov r9d, esi
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x10]
mov r8, rbx
mov edx, r14d
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x70]
mov al, byte [rcx + rbx]
cmp al, 0xd
jne 0x1a69d
cmp byte [rcx + rbx + 1], 0xa
je 0x1a793
cmp al, 0x2d
jne 0x1a7e9
cmp byte [rcx + rbx + 1], al
jne 0x1a7e9
lea eax, [rdi + 2]
movsxd rcx, eax
mov eax, 0xfffffffe
add rbx, rcx
mov rcx, qword [r13 + 0x48]
sub eax, edi
add esi, eax
mov r12, rbx
test rcx, rcx
je 0x1a6dc
mov rax, qword [rcx]
xor edx, edx
mov qword [r13 + 0x48], rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [r13 + 0x50]
test rcx, rcx
je 0x1a6f4
mov rax, qword [rcx]
xor edx, edx
mov qword [r13 + 0x50], rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x00025742], 0
mov rbp, qword [r13 + 0x48]
je 0x1a71a
lea rcx, [0x000211c0]
mov r9, rbx
mov r8, rbx
mov edx, r14d
mov dword [rsp + 0x20], esi
call sub.ntoskrnl.exe_DbgPrint
test esi, esi
jle 0x1a564
jmp 0x1a434
cmp byte [0x00025742], 0
je 0x1a745
lea rcx, [0x00020ef0]
mov r9d, esi
mov r8, rbx
mov edx, r14d
call sub.ntoskrnl.exe_DbgPrint
xor r12d, r12d
jmp 0x1a564
mov r12, rbx
jmp 0x1a564
mov rdi, qword [rsp + 0x78]
add rdi, r15
lea rax, [rdi - 1]
cmp byte [rax], 0x2d
cmove rdi, rax
cmp byte [0x00025742], 0
je 0x1a423
xor r8d, r8d
lea rcx, [0x00020e00]
mov r9, rdi
mov edx, r14d
mov dword [rsp + 0x20], esi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1a423
mov rcx, qword [r13 + 0x48]
movsxd rax, edi
sub esi, edi
add rbx, rax
mov dword [r13 + 0x28], 6
mov r12, rbx
test rcx, rcx
je 0x1a7be
mov rax, qword [rcx]
xor edx, edx
mov qword [r13 + 0x48], rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x00025742], 0
je 0x1a587
mov r9, rbx
lea rcx, [0x00021140]
mov edx, r14d
mov r8, rbx
mov dword [rsp + 0x20], esi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1a564
xor r12d, r12d
cmp byte [0x00025742], r12b
je 0x1a587
xor r9d, r9d
lea rcx, [0x00021240]
jmp 0x1a7d5
cmp byte [0x00025742], 0
je 0x1a423
mov r8, rbx
lea rcx, [0x00021040]
jmp 0x1a77f
mov rcx, qword [rsp + 0x78]
add rcx, r15
lea rdi, [rcx - 1]
cmp byte [rdi], 0x2d
jne 0x1a83a
lea eax, [rsi - 1]
add dword [rbp + 0x10], eax
jmp 0x1a840
add dword [rbp + 0x10], esi
mov rdi, rcx
cmp byte [0x00025742], 0
je 0x1a423
mov r8, rbx
lea rcx, [0x00020fd0]
jmp 0x1a77f