Function at 0x180004a50
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x2a8
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x2d0]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2d0]
mov dword [rax], 0
mov eax, dword [rsp + 0x2c0]
mov dword [rsp + 0x298], eax
mov eax, dword [rsp + 0x298]
sub eax, 0x222004
mov dword [rsp + 0x298], eax
cmp dword [rsp + 0x298], 0x74
ja case.0x180004adf.2236421
mov eax, dword [rsp + 0x298]
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x5880]
mov eax, dword [rcx + rax*4 + 0x5808]
add rax, rcx
jmp rax
cmp qword [rsp + 0x2c8], 0
je 0x180004af6
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004b03
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800e5890]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov byte [0x1800e74f4], 0
mov qword [0x1800e7510], 0
lea rax, [0x1800e58c8]
mov qword [rsp + 0x28], rax
lea rax, [0x1800e7510]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x34], eax
xor edx, edx
lea rcx, [0x1800e5890]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [rsp + 0x34], 0
jl 0x180004c10
cmp qword [0x1800e7518], 0
je 0x180004ba2
cmp qword [0x1800e7520], 0
jne 0x180004bbe
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [0x1800e7518], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x1800e7520], rax
jmp 0x180004bfc
mov rdx, qword [0x1800e7520]
mov rcx, qword [0x1800e7518]
call fcn.180004000
movzx eax, al
test eax, eax
je 0x180004bfc
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [0x1800e7518], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x1800e7520], rax
call fcn.180003410
call fcn.1800046c0
mov rcx, qword [0x1800e7510]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [0x1800e74f4], 1
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x180004c3b
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004c48
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 8]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x48], 0
je 0x180004d4c
cmp qword [rsp + 0x40], 0
je 0x180004d4c
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x60], 0
jl 0x180004d3b
cmp qword [rsp + 0x58], 0
je 0x180004d3b
cmp dword [rsp + 0x60], 0
jl 0x180004d3b
cmp qword [rsp + 0x58], 0
je 0x180004d3b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1800044c0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov dword [rsp + 0x34], 0
cmp qword [rsp + 0x2c8], 0
je 0x180004d73
mov eax, dword [rsp + 0x2d8]
cmp rax, 0x118
jae 0x180004d80
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
call fcn.180003330
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x180004e59
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x114], 0x104
jae 0x180004e4c
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x114], 0
jbe 0x180004e4c
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rcx + 4], rax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rcx + 0xc], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x114]
mov rsi, qword [rsp + 0x80]
add rsi, 0x10
mov rdi, qword [rsp + 0x2c8]
add rdi, 0x14
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x114]
mov rax, qword [rsp + 0x2c8]
mov byte [rax + rcx + 0x14], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
mov rcx, qword [rsp + 0x80]
call fcn.1800033d0
jmp 0x1800057f9
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004e6d
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov dword [rsp + 0x88], eax
mov ecx, dword [rsp + 0x88]
call fcn.1800043a0
mov dword [rsp + 0x34], 0
jmp 0x1800057f9
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x2c8]
call fcn.1800043e0
mov dword [rsp + 0x34], 0
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.180006490
mov dword [rsp + 0x34], 0
jmp 0x1800057f9
call fcn.1800064d0
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x180004efd
cmp dword [rsp + 0x30], 8
jae 0x180004f0a
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov dword [0x1800e7528], eax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 4]
mov dword [0x1800e752c], eax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 8]
mov dword [0x1800e7530], eax
mov dword [rsp + 0x34], 0
jmp 0x1800057f9
jmp 0x1800057f9
call fcn.180004760
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x180004f68
mov byte [rsp + 0x29c], 1
jmp 0x180004f70
mov byte [rsp + 0x29c], 0
movzx eax, byte [rsp + 0x29c]
mov byte [0x1800e6e87], al
mov eax, dword [rsp + 0x34]
jmp 0x1800057fd
cmp qword [rsp + 0x2c8], 0
je 0x180004fa1
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004fae
mov dword [rsp + 0x34], 0xc00000bb
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800e5818]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov byte [0x1800e6e86], 0
mov qword [0x1800e7508], 0
lea rax, [0x1800e5888]
mov qword [rsp + 0x28], rax
lea rax, [0x1800e7508]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x34], eax
xor edx, edx
lea rcx, [0x1800e5818]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [rsp + 0x34], 0
jl 0x180005042
mov byte [0x1800e6e86], 1
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x180005061
mov eax, dword [rsp + 0x2d8]
cmp rax, 0x414
jae 0x18000506e
mov dword [rsp + 0x34], 0xc00000bb
jmp 0x1800057f9
lea rcx, [0x1800e5858]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [rsp + 0xa0], al
mov rcx, qword [rsp + 0x2c8]
mov eax, dword [0x1800e74f0]
mov dword [rcx], eax
mov ecx, dword [0x1800e74f0]
shl rcx, 2
mov rdi, qword [rsp + 0x2c8]
add rdi, 4
lea rsi, [0x1800e70e0]
rep movsb byte [rdi], byte [rsi]
mov dword [0x1800e74f0], 0
lea rdi, [0x1800e70e0]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
movzx edx, byte [rsp + 0xa0]
lea rcx, [0x1800e5858]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.1800065c0
mov dword [rsp + 0x34], 0
jmp 0x1800057f9
call fcn.18005e950
jmp 0x1800057f9
call fcn.180004360
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x18000513a
mov eax, dword [rsp + 0x30]
cmp rax, 0x18
je 0x180005147
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
mov rcx, qword [rsp + 0x2c8]
call fcn.18005ed20
mov dword [rsp + 0x34], eax
jmp 0x1800057f9
call fcn.18005f9e0
mov dword [rsp + 0x34], eax
jmp 0x1800057f9
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800a5070]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
cmp qword [rsp + 0x2c8], 0
je 0x180005201
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x180005201
lea rcx, [rsp + 0xb0]
call fcn.180004920
lea rdi, [rsp + 0xb0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
call fcn.180003720
movzx eax, al
test eax, eax
jne 0x1800051f7
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800051ff
mov dword [rsp + 0x34], 0
jmp 0x180005209
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
xor edx, edx
lea rcx, [0x1800a5070]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x1800052a6
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x1800052a6
lea rcx, [rsp + 0xd0]
call fcn.180004920
lea rdi, [rsp + 0xd0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xd0]
call fcn.180003a00
movzx eax, al
test eax, eax
jne 0x18000529c
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800052a4
mov dword [rsp + 0x34], 0
jmp 0x1800052ae
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x18000533c
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x18000533c
lea rcx, [rsp + 0xf0]
call fcn.180004920
lea rdi, [rsp + 0xf0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0xf0]
call fcn.18005f210
movzx eax, al
test eax, eax
jne 0x180005332
mov dword [rsp + 0x34], 0xc0000001
jmp 0x18000533a
mov dword [rsp + 0x34], 0
jmp 0x180005344
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x110]
call fcn.1800010e0
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 4]
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
call fcn.1800013e0
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x128]
call fcn.180001640
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
call fcn.180002100
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov byte [rsp + 0x140], 0
lea rdi, [rsp + 0x141]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
cmp dword [rsp + 0x30], 0
jbe 0x1800054dd
cmp dword [rsp + 0x30], 0x104
jae 0x1800054dd
mov ecx, dword [rsp + 0x30]
lea rdi, [rsp + 0x140]
mov rsi, qword [rsp + 0x2c8]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x140]
call fcn.180001d30
mov dword [rsp + 0x34], 0
jmp 0x1800054e5
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x250]
call fcn.180003cf0
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x18000554a
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
je 0x180005563
lea rcx, str.IOCTL_SUSPENDTHREAD_buf__NULL__len___sizeof_CLIENT_ID_
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
mov rcx, qword [rsp + 0x2c8]
call fcn.18005e5d0
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x18000559f
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
je 0x1800055b8
lea rcx, str.IOCTL_TERMINATETHREAD_buf__NULL__len___sizeof_CLIENT_ID_
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057f9
mov rcx, qword [rsp + 0x2c8]
call fcn.18005e790
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
cmp qword [rsp + 0x2c8], 0
je 0x1800055f4
mov eax, dword [rsp + 0x30]
cmp rax, 0x28
je 0x180005601
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800057de
cmp dword [0x1800e7580], 0
jne 0x18000562c
mov dword [0x1800e7580], 1
call fcn.180002490
lea rdx, [0x1800e6ea0]
mov rcx, qword [0x1800e6e98]
call fcn.180002380
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x258]
cmp qword [rax + 8], 0
je 0x1800057d6
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x10], 0
je 0x1800057d6
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x18], 0
je 0x1800057d6
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x20], 0
je 0x1800057d6
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + 8]
shl rax, 1
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
add rdx, 2
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x278], rax
mov rcx, qword [rsp + 0x260]
add rcx, 2
mov rdi, qword [rsp + 0x278]
xor eax, eax
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x278]
mov rsi, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x260]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + 0x18]
shl rax, 1
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
add rdx, 2
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x260]
add rcx, 2
mov rdi, qword [rsp + 0x290]
xor eax, eax
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x260]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x278]
lea rcx, [rsp + 0x268]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x280]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x268]
mov rcx, qword [rsp + 0x258]
mov rcx, qword [rcx]
call fcn.180002630
xor edx, edx
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x34], 0
jmp 0x1800057de
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004a10
jmp 0x1800057f9
mov dword [rsp + 0x34], 0xc00000bb
mov eax, dword [rsp + 0x34]
add rsp, 0x2a8
pop rdi
pop rsi
ret