Function at 0x140001060
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0xec8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xeb0], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x2b0]
lea rcx, [0x140001ba0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x2bc]
mov rdi, rax
xor eax, eax
mov ecx, 0x3f4
rep stosb byte [rdi], al
lea rax, [rsp + 0xb0]
lea rcx, [0x140001bb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xbc]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
movzx eax, word [0x140001bc0]
mov word [rsp + 0x6b0], ax
lea rax, [rsp + 0x6b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [0x140001ba0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140001bd0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140001be0]
lea rcx, [0x140001c00]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x30]
lea rcx, [0x140001c10]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x60]
lea rcx, [0x140001c20]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x140001c30]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x88]
lea rcx, [0x140001c40]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
movzx eax, word [rsp + 0x20]
mov r9d, eax
mov r8, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [0x140001c50]
call sub.ntoskrnl.exe_DbgPrint
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
movzx eax, word [rsp + 0x20]
mov r9d, eax
mov r8, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [0x140001c70]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 2
mov word [rsp + 0x20], ax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
movzx eax, word [rsp + 0x20]
mov r9d, eax
mov r8, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [0x140001c90]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 2
mov word [rsp + 0x22], ax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
movzx eax, word [rsp + 0x20]
mov r9d, eax
mov r8, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [0x140001cb0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x140001cd0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rsp + 0x30]
lea rcx, [0x140001ce0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rsp + 0x30]
lea rcx, [0x140001cf0]
call sub.ntoskrnl.exe_DbgPrint
mov r8b, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x14000135b
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
lea rcx, [0x140001d00]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001371
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
lea rcx, [0x140001d10]
call sub.ntoskrnl.exe_DbgPrint
mov r8b, 1
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rdx, [rsp + 0x20]
lea rcx, [0x140001d20]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 0x400
mov word [rsp + 0x52], ax
lea rdx, [rsp + 0x50]
lea rcx, [0x140001d30]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x98]
lea rcx, [0x140001d40]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x6b0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 0x800
mov word [rsp + 0x72], ax
lea rdx, [rsp + 0x70]
lea rcx, [0x140001d50]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rsp + 0x50]
lea rcx, [0x140001d70]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rsp + 0x50]
lea rcx, [0x140001d80]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x70]
lea rcx, [0x140001d90]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 1
add rax, 0xe
shl rax, 1
lea rcx, [0x140001b80]
mov r8d, ecx
mov rdx, rax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400014c5
jmp 0x140001543
mov eax, 1
add rax, 0xe
shl rax, 1
mov qword [rsp + 0x80], rax
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov rcx, qword [rsp + 0x80]
rep stosb byte [rdi], al
mov eax, 1
add rax, 0xe
shl rax, 1
mov word [rsp + 0x42], ax
movzx eax, word [rsp + 0x42]
mov word [rsp + 0x40], ax
mov eax, 1
add rax, 0xe
shl rax, 1
lea rcx, [0x140001db0]
mov rdi, qword [rsp + 0x48]
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x40]
lea rcx, [0x140001dd0]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xeb0]
xor rcx, rsp
call fcn.1400016f0
add rsp, 0xec8
pop rdi
pop rsi
ret