Function at 0x180004a50
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x2a8
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x2d0]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2d0]
mov dword [rax], 0
mov eax, dword [rsp + 0x2c0]
mov dword [rsp + 0x298], eax
mov eax, dword [rsp + 0x298]
sub eax, 0x222004
mov dword [rsp + 0x298], eax
cmp dword [rsp + 0x298], 0x70
ja case.0x180004adf.2236421
mov eax, dword [rsp + 0x298]
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x5818]
mov eax, dword [rcx + rax*4 + 0x57a4]
add rax, rcx
jmp rax
cmp qword [rsp + 0x2c8], 0
je 0x180004af6
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004b03
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18008d890]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov byte [0x18008f4f4], 0
mov qword [0x18008f510], 0
lea rax, [0x18008d8c8]
mov qword [rsp + 0x28], rax
lea rax, [0x18008f510]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x34], eax
xor edx, edx
lea rcx, [0x18008d890]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [rsp + 0x34], 0
jl 0x180004c10
cmp qword [0x18008f518], 0
je 0x180004ba2
cmp qword [0x18008f520], 0
jne 0x180004bbe
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [0x18008f518], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x18008f520], rax
jmp 0x180004bfc
mov rdx, qword [0x18008f520]
mov rcx, qword [0x18008f518]
call fcn.180004000
movzx eax, al
test eax, eax
je 0x180004bfc
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [0x18008f518], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x18008f520], rax
call fcn.180003410
call fcn.1800046c0
mov rcx, qword [0x18008f510]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [0x18008f4f4], 1
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x180004c3b
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004c48
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 8]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x48], 0
je 0x180004d4c
cmp qword [rsp + 0x40], 0
je 0x180004d4c
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x60], 0
jl 0x180004d3b
cmp qword [rsp + 0x58], 0
je 0x180004d3b
cmp dword [rsp + 0x60], 0
jl 0x180004d3b
cmp qword [rsp + 0x58], 0
je 0x180004d3b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1800044c0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov dword [rsp + 0x34], 0
cmp qword [rsp + 0x2c8], 0
je 0x180004d73
mov eax, dword [rsp + 0x2d8]
cmp rax, 0x118
jae 0x180004d80
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005793
call fcn.180003330
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x180004e59
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x114], 0x104
jae 0x180004e4c
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x114], 0
jbe 0x180004e4c
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rcx + 4], rax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rcx + 0xc], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x114]
mov rsi, qword [rsp + 0x80]
add rsi, 0x10
mov rdi, qword [rsp + 0x2c8]
add rdi, 0x14
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x114]
mov rax, qword [rsp + 0x2c8]
mov byte [rax + rcx + 0x14], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
mov rcx, qword [rsp + 0x80]
call fcn.1800033d0
jmp 0x180005793
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004e6d
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov dword [rsp + 0x88], eax
mov ecx, dword [rsp + 0x88]
call fcn.1800043a0
mov dword [rsp + 0x34], 0
jmp 0x180005793
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x2c8]
call fcn.1800043e0
mov dword [rsp + 0x34], 0
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.180006420
mov dword [rsp + 0x34], 0
jmp 0x180005793
call fcn.180006460
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x180004efd
cmp dword [rsp + 0x30], 8
jae 0x180004f0a
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov dword [0x18008f528], eax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 4]
mov dword [0x18008f52c], eax
mov dword [rsp + 0x34], 0
jmp 0x180005793
jmp 0x180005793
call fcn.180004760
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x180004f57
mov byte [rsp + 0x29c], 1
jmp 0x180004f5f
mov byte [rsp + 0x29c], 0
movzx eax, byte [rsp + 0x29c]
mov byte [0x18008ee87], al
mov eax, dword [rsp + 0x34]
jmp 0x180005797
cmp qword [rsp + 0x2c8], 0
je 0x180004f90
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004f9d
mov dword [rsp + 0x34], 0xc00000bb
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18008d818]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov byte [0x18008ee86], 0
mov qword [0x18008f508], 0
lea rax, [0x18008d888]
mov qword [rsp + 0x28], rax
lea rax, [0x18008f508]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x34], eax
xor edx, edx
lea rcx, [0x18008d818]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [rsp + 0x34], 0
jl 0x180005031
mov byte [0x18008ee86], 1
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x180005050
mov eax, dword [rsp + 0x2d8]
cmp rax, 0x414
jae 0x18000505d
mov dword [rsp + 0x34], 0xc00000bb
jmp 0x180005793
lea rcx, [0x18008d858]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [rsp + 0xa0], al
mov rcx, qword [rsp + 0x2c8]
mov eax, dword [0x18008f4f0]
mov dword [rcx], eax
mov ecx, dword [0x18008f4f0]
shl rcx, 2
mov rdi, qword [rsp + 0x2c8]
add rdi, 4
lea rsi, [0x18008f0e0]
rep movsb byte [rdi], byte [rsi]
mov dword [0x18008f4f0], 0
lea rdi, [0x18008f0e0]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
movzx edx, byte [rsp + 0xa0]
lea rcx, [0x18008d858]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.180006550
mov dword [rsp + 0x34], 0
jmp 0x180005793
call fcn.180006c50
jmp 0x180005793
call fcn.180004360
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x180005129
mov eax, dword [rsp + 0x30]
cmp rax, 0x18
je 0x180005136
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005793
mov rcx, qword [rsp + 0x2c8]
call fcn.180007020
mov dword [rsp + 0x34], eax
jmp 0x180005793
call fcn.180007ce0
mov dword [rsp + 0x34], eax
jmp 0x180005793
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18004d070]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
cmp qword [rsp + 0x2c8], 0
je 0x1800051f0
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x1800051f0
lea rcx, [rsp + 0xb0]
call fcn.180004920
lea rdi, [rsp + 0xb0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
call fcn.180003720
movzx eax, al
test eax, eax
jne 0x1800051e6
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800051ee
mov dword [rsp + 0x34], 0
jmp 0x1800051f8
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
xor edx, edx
lea rcx, [0x18004d070]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x180005295
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x180005295
lea rcx, [rsp + 0xd0]
call fcn.180004920
lea rdi, [rsp + 0xd0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xd0]
call fcn.180003a00
movzx eax, al
test eax, eax
jne 0x18000528b
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005293
mov dword [rsp + 0x34], 0
jmp 0x18000529d
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x18000532b
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x18000532b
lea rcx, [rsp + 0xf0]
call fcn.180004920
lea rdi, [rsp + 0xf0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0xf0]
call fcn.180007510
movzx eax, al
test eax, eax
jne 0x180005321
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005329
mov dword [rsp + 0x34], 0
jmp 0x180005333
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x110]
call fcn.1800010e0
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 4]
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
call fcn.1800013e0
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x128]
call fcn.180001640
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
call fcn.180002100
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov byte [rsp + 0x140], 0
lea rdi, [rsp + 0x141]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
cmp dword [rsp + 0x30], 0
jbe 0x1800054cc
cmp dword [rsp + 0x30], 0x104
jae 0x1800054cc
mov ecx, dword [rsp + 0x30]
lea rdi, [rsp + 0x140]
mov rsi, qword [rsp + 0x2c8]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x140]
call fcn.180001d30
mov dword [rsp + 0x34], 0
jmp 0x1800054d4
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x250]
call fcn.180003cf0
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x180005539
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
je 0x180005552
lea rcx, str.IOCTL_SUSPENDTHREAD_buf__NULL__len___sizeof_CLIENT_ID_
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005793
mov rcx, qword [rsp + 0x2c8]
call fcn.180006a90
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
cmp qword [rsp + 0x2c8], 0
je 0x18000558e
mov eax, dword [rsp + 0x30]
cmp rax, 0x28
je 0x18000559b
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005778
cmp dword [0x18008f570], 0
jne 0x1800055c6
mov dword [0x18008f570], 1
call fcn.180002490
lea rdx, [0x18008eea0]
mov rcx, qword [0x18008ee98]
call fcn.180002380
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x258]
cmp qword [rax + 8], 0
je 0x180005770
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x10], 0
je 0x180005770
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x18], 0
je 0x180005770
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x20], 0
je 0x180005770
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + 8]
shl rax, 1
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
add rdx, 2
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x278], rax
mov rcx, qword [rsp + 0x260]
add rcx, 2
mov rdi, qword [rsp + 0x278]
xor eax, eax
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x278]
mov rsi, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x260]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + 0x18]
shl rax, 1
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
add rdx, 2
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x260]
add rcx, 2
mov rdi, qword [rsp + 0x290]
xor eax, eax
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x260]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x278]
lea rcx, [rsp + 0x268]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x280]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x268]
mov rcx, qword [rsp + 0x258]
mov rcx, qword [rcx]
call fcn.180002630
xor edx, edx
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x34], 0
jmp 0x180005778
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x180005793
mov dword [rsp + 0x34], 0xc00000bb
mov eax, dword [rsp + 0x34]
add rsp, 0x2a8
pop rdi
pop rsi
ret