Function at 0x1ad78
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
movzx r10d, byte [r8 + 1]
mov rsi, r9
mov rbp, rdx
cmp r10d, 9
mov r12, rcx
jg 0x1af59
je 0x1af4f
xor ebx, ebx
lea edi, [rbx + 1]
cmp r10d, ebx
je 0x1af3a
sub r10d, edi
je 0x1af15
sub r10d, edi
je 0x1ae9f
sub r10d, edi
je 0x1ae98
sub r10d, edi
je 0x1ae83
sub r10d, edi
je 0x1ae6e
sub r10d, edi
je 0x1ae56
sub r10d, edi
je 0x1ae0a
cmp r10d, edi
jne 0x1b060
mov rcx, r9
call fcn.00013d54
jmp 0x1aef3
mov rax, qword [rdx + 0xb8]
cmp dword [rax + 8], 4
jne 0x1b060
mov edx, 0x10
mov r8d, 0x62735556
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
cmp rax, rbx
je 0x1afcb
mov dword [rax], edi
mov rax, qword [rsi]
mov qword [r12 + 8], rax
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
mov qword [rbp + 0x38], r12
jmp 0x1b063
cmp dword [r9 + 0xc], 2
jne 0x1b063
mov eax, dword [r9 + 0x10]
mov dword [r9 + 0xc], eax
jmp 0x1b063
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 2
mov dword [r9 + 0x10], eax
jmp 0x1b063
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 3
mov dword [r9 + 0x10], eax
jmp 0x1b063
cmp dword [r9 + 0xc], 4
jmp 0x1ae5b
cmp byte [r9 + 0x49], bl
je 0x1aefa
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 6
mov dword [r9 + 0x10], eax
mov rax, qword [r9 + 0x20]
cmp rax, rbx
je 0x1aee8
mov rbx, qword [rax + 0x40]
lea rcx, [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rax, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x38]
mov qword [rax], rdx
mov qword [rdx + 8], rax
dec dword [rbx + 0x40]
lea rcx, [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rdx, rsi
mov rcx, r12
call fcn.0001a8b0
mov ebx, eax
jmp 0x1b063
cmp byte [r9 + 0x48], bl
je 0x1b063
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], ebx
mov dword [r9 + 0x10], eax
jmp 0x1b063
cmp dword [r9 + 0x4c], ebx
je 0x1af25
mov ebx, 0xc0000001
jmp 0x1b063
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 4
mov dword [r9 + 0x10], eax
jmp 0x1b063
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0x1c], edi
mov dword [r9 + 0xc], edi
mov dword [r9 + 0x10], eax
jmp 0x1b063
mov rcx, r9
call fcn.0001b094
jmp 0x1aef3
sub r10d, 0xa
je 0x1b060
mov edi, 1
sub r10d, edi
je 0x1b060
sub r10d, edi
je 0x1b006
sub r10d, 5
je 0x1affe
sub r10d, 2
je 0x1aff1
sub r10d, 2
je 0x1afb1
sub r10d, edi
je 0x1af1b
cmp r10d, edi
jne 0x1b060
mov eax, dword [r9 + 0xc]
xor ebx, ebx
mov dword [r9 + 0xc], 5
mov dword [r9 + 0x10], eax
jmp 0x1b063
mov edx, 0x18
mov r8d, 0x62735556
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor ebx, ebx
cmp rax, rbx
jne 0x1afd5
mov ebx, 0xc000009a
jmp 0x1b063
movdqu xmm0, xmmword [0x000111d0]
mov dword [rax + 0x10], 0xf
mov dword [rax + 0x14], ebx
movdqu xmmword [rax], xmm0
mov qword [rbp + 0x38], rax
jmp 0x1b063
mov rcx, r9
call fcn.0001b160
jmp 0x1aef3
xor ebx, ebx
mov byte [r9 + 0x48], bl
jmp 0x1b063
mov rcx, qword [rdx + 0xb8]
xor ebx, ebx
mov edx, dword [rcx + 8]
cmp edx, ebx
je 0x1b01b
mov ebx, dword [rbp + 0x30]
jmp 0x1b063
cmp qword [rbp + 0x38], rbx
jne 0x1b063
mov edx, 0x5c
mov r8d, 0x62735556
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rbx
je 0x1afcb
lea r9, [0x000273e0]
lea r8, [0x00027400]
lea rdx, [0x00027420]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov qword [rbp + 0x38], rdi
jmp 0x1b063
mov ebx, dword [rdx + 0x30]
xor edx, edx
mov rcx, rbp
mov dword [rbp + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret