Function at 0x171b0
Capabilities:
Print debug messages
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1c9a8
push 0x1b470
mov eax, dword fs:[0]
push eax
add esp, 0xfffffe4c
mov eax, dword [0x1dc84]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x160], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x158], 0xc0000001
cmp dword [ebp + 8], 0
je 0x17218
cmp dword [ebp + 0xc], 0
je 0x17218
cmp dword [ebp + 0x10], 0
jne 0x17222
mov eax, 0xc0000001
jmp 0x177bf
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1ac]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x150]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jge 0x1726c
mov eax, dword [ebp - 0x158]
jmp 0x177bf
mov dword [ebp - 0x130], 0x18
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x124], 0x240
lea edx, [ebp - 0x150]
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
push 0
push 0
push 0x60
push 1
push 1
push 0x80
push 0
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x130]
push ecx
push 1
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x158]
push ecx
push 0x1bea0
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
cmp dword [ebp - 0x158], 0
jge 0x1730a
mov eax, dword [ebp - 0x158]
jmp 0x177bf
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x140]
push eax
push 0x40
lea ecx, [ebp - 0x1a0]
push ecx
lea edx, [ebp - 0x1b8]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jge 0x17391
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x1bc], edx
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1dc84
call fcn.0001b5cc
add esp, 0xc
mov eax, dword [ebp - 0x1bc]
jmp 0x177bf
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x140], ecx
push 0
lea edx, [ebp - 0x140]
push edx
push 0xf8
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jge 0x17412
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x1c0], ecx
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x1dc84
call fcn.0001b5cc
add esp, 0xc
mov eax, dword [ebp - 0x1c0]
jmp 0x177bf
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1a4], eax
push 0x4c4c43
mov ecx, dword [ebp - 0x1a4]
push ecx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jne 0x1745d
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 0x158], 0xc0000001
jmp 0x17740
mov eax, dword [ebp - 0x1a4]
push eax
push 0
mov ecx, dword [ebp - 0x148]
push ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
movzx edx, word [ebp - 0x112]
imul edx, edx, 0x28
mov dword [ebp - 0x138], edx
push 0x4c4c43
mov eax, dword [ebp - 0x138]
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x174be
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 0x158], 0xc0000001
jmp 0x17740
mov edx, dword [ebp - 0x138]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov ecx, dword [ebp - 0x164]
add ecx, 0xf8
mov dword [ebp - 0x140], ecx
push 0
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x1b8]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jge 0x17559
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
mov edx, dword [ebp - 0x148]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 0x158], 0xc0000001
jmp 0x17740
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x15c], ecx
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], 0
jmp 0x1758b
mov eax, dword [ebp - 0x134]
add eax, 1
mov dword [ebp - 0x134], eax
movzx ecx, word [ebp - 0x112]
cmp dword [ebp - 0x134], ecx
jae 0x176a8
mov edx, dword [ebp - 0x134]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + edx + 0x14]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x134]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x148]
add ecx, dword [eax + edx + 0xc]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x134]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x134]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ecx + edx + 0x10]
cmp edx, dword [esi + eax + 8]
ja 0x1760a
mov eax, dword [ebp - 0x134]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x1c4], edx
jmp 0x17620
mov eax, dword [ebp - 0x134]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + eax + 8]
mov dword [ebp - 0x1c4], edx
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1b0], eax
push 0
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
mov eax, dword [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jge 0x176a3
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 0x158], 0xc0000001
jmp 0x17740
jmp 0x1757c
xor eax, eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
push 0
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0x148]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jge 0x1772a
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 0x158], 0xc0000001
jmp 0x17740
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x148]
mov dword [eax], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1a4]
mov dword [edx], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0001774e
jmp 0x17781
cmp dword [ebp - 0x158], 0
jge 0x177b9
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x160]
xor ecx, ebp
call fcn.0001b3e8
mov esp, ebp
pop ebp
ret 0xc