Function at 0x11bd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x2c8
mov rax, qword [0x00019100]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov dword [rsp + 0x270], 0xc0000001
mov qword [rsp + 0x260], 0
mov dword [rsp + 0x278], 0
lea rdi, [rsp + 0x280]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov qword [rsp + 0x2a8], 0
lea rdi, [rsp + 0x2b0]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x250], 0
mov qword [rsp + 0x258], 0
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov qword [rsp + 0x268], 0
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x260], rax
jmp 0x11ca9
mov rax, qword [rsp + 0x260]
add rax, 4
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x260], 0x186a0
jae 0x11ef3
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x2b0], 0
cmp qword [rsp + 0x260], 0
jne 0x11d28
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rsp + 0x260]
mov qword [rcx + 0x3a0], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rax + 0x3a8], 0
call fcn.000129d0
mov rdx, rax
mov rax, qword [rsp + 0x2e8]
mov qword [rax + 0x3b0], rdx
jmp 0x11ef3
mov rax, qword [rsp + 0x260]
cmp qword [0x00019128], rax
jne 0x11d49
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [rsp + 0x258], rax
jmp 0x11dc4
lea r9, [rsp + 0x2a8]
lea r8, [rsp + 0x278]
mov edx, 0x10000000
lea rcx, [rsp + 0x250]
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0
jl 0x11edd
mov rdx, qword [rsp + 0x260]
lea rcx, [0x00017200]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x258]
call fcn.00011f80
movzx eax, al
test eax, eax
je 0x11ec1
mov rcx, qword [rsp + 0x258]
call fcn.00012950
mov qword [rsp + 0x268], rax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rsp + 0x260]
mov qword [rcx + 0x3a0], rax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rsp + 0x268]
mov qword [rcx + 0x3a8], rax
mov rax, qword [0x00019158]
mov rdx, qword [rsp + 0x258]
add rdx, rax
lea rcx, [0x00017210]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x260]
call fcn.00012150
mov rdi, qword [rsp + 0x2e8]
lea rsi, [rsp + 0x40]
add rdi, 0xc8
mov ecx, 0x208
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x258]
lea rcx, [0x00017220]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0x2e8]
mov rax, qword [rsp + 0x258]
mov qword [rdx + 0x3b0], rax
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x11ef3
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdi, [rsp + 0x278]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
jmp 0x11c95
mov dword [rsp + 0x270], 0
cmp qword [rsp + 0x260], 0x186a0
jb 0x11f4c
mov rax, qword [rsp + 0x2e8]
mov qword [rax + 0x3b0], 0
mov rax, qword [rsp + 0x2e8]
mov qword [rax + 0x3a8], 0
mov rax, qword [rsp + 0x2f0]
mov qword [rax], 0
mov dword [rsp + 0x270], 0xc0000001
mov eax, dword [rsp + 0x270]
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.00016cc0
add rsp, 0x2c8
pop rdi
pop rsi
ret