Function at 0x402090
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [0x410048], 1
push ebx
push esi
push edi
mov esi, eax
mov dword [esp + 0x10], 0
jg 0x4020c2
push esi
push str._______RegProtectLoopRegValue____Ext_08x._n
push str.RegProtectLoopRegValue____Ext_08x.
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
mov edi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
call edi
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlAssert]
cmp al, 1
jbe 0x4020fa
call edi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push 0
push 0xfc
push str..RegProtect.cpp
push 0x40c8f4
call ebx
test esi, esi
jne 0x402110
push esi
push 0xfe
push str..RegProtect.cpp
push str.FilterExt
call ebx
call edi
test al, al
jne 0x402230
test esi, esi
je 0x40224e
lea ecx, [esp + 0x18]
mov edx, ecx
lea ebx, [esi + 0x28]
mov dword [esp + 0x1c], ecx
mov ecx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
add esi, 0x34
cmp dword [esi], esi
je 0x4021f2
lea ebx, [ebx]
mov edi, dword [esi]
mov ecx, dword [edi]
mov dword [esi], ecx
mov dword [ecx + 4], esi
mov dl, al
mov ecx, ebx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor ebx, ebx
cmp dword [0x410048], 1
jg 0x40218f
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
push eax
mov eax, dword [edi + 0xc]
push ecx
mov ecx, dword [edi + 8]
push edx
push eax
push ecx
push str._CheckOneRegPath____RegPath_ws__KeyName_ws__KeyType_d__KeyValue_p__KeyValueSize_d._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
mov eax, dword [edi + 0x1c]
cmp eax, 1
jne 0x40219e
call fcn.00402290
jmp 0x4021a8
cmp eax, 2
jne 0x4021aa
call fcn.004025a0
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jge 0x4021c9
cmp dword [0x410048], 4
jg 0x4021c9
push ebx
push str.Failed_to_Check_the_Register_path.status0x_08x._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov dword [edi], edx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ebx, dword [esp + 0x14]
cmp dword [esi], esi
jne 0x402150
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
cmp ecx, edx
je 0x402224
mov edi, edi
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
lea edi, [esp + 0x18]
mov dword [edx + 4], edi
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
mov dword [ecx], esi
mov dword [edx], ecx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x18]
mov edx, edi
cmp ecx, edx
jne 0x402200
mov dl, al
mov ecx, ebx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
jmp 0x40224e
cmp dword [0x410048], 4
jg 0x402246
push str.Failed_to_operate_the_register__because_the_function_work_at___PASSIVE_LEVEL_IRQL._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov dword [esp + 0x10], 0xc0000001
cmp dword [0x410048], 1
jg 0x402277
mov esi, dword [esp + 0x10]
push esi
push str._______RegProtectLoopRegValue____status__0x_08x._n
push str.RegProtectLoopRegValue____status__0x_08x.
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret