Function at 0x12228
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0x70
mov rbx, rcx
xor r12d, r12d
lea rdx, [0x000137e0]
lea rcx, [rsp + 0x50]
mov qword [0x00017a08], r12
mov qword [0x00017a00], r12
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x00017a58], rax
cmp rax, r12
jne 0x1227f
mov eax, 0xc0000001
jmp 0x12540
lea rdx, [0x00013820]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x00017a50], rax
cmp rax, r12
je 0x12275
lea rdx, [0x00013860]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
mov r9d, 0x22
mov rcx, rbx
xor edx, edx
mov byte [rsp + 0x28], r12b
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r12d
jl 0x12540
lea rdx, [0x000137b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, r12d
mov edi, eax
jl 0x12349
lea r9, [0x000179c0]
lea rdx, [0x00015110]
mov r8d, 0x2800
mov rcx, rbx
call fcn.00012844
mov qword [0x000179f8], rax
cmp rax, r12
jne 0x1235e
mov edi, 0xc0000001
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, edi
jmp 0x12540
mov rax, qword [rsp + 0x90]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
or dword [rax + 0x30], 4
mov qword [0x00017a08], rax
lea rax, [0x00011e58]
rep stosq qword [rdi], rax
lea rax, [0x00011e90]
mov edx, pe_nt_image_headers64
mov qword [rbx + 0xe0], rax
lea rax, [0x00012180]
xor ecx, ecx
mov r8d, 0x58585255
mov qword [0x00017a00], rbx
mov qword [rbx + 0x68], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rdi, rax
mov qword [0x00017a10], rax
call fcn.000135b0
lea rax, [0x00011008]
mov dword [rdi], pe_nt_image_headers64
mov qword [rdi + 8], rax
lea rax, [0x0001108c]
mov word [rsp + 0x30], r12w
mov qword [rdi + 0x10], rax
lea rax, [0x00011114]
lea rcx, [0x00017940]
mov qword [rdi + 0x18], rax
lea rax, [0x0001119c]
xor r9d, r9d
mov qword [rdi + 0x20], rax
lea rax, [0x000111f8]
xor r8d, r8d
mov qword [rdi + 0x28], rax
lea rax, [0x00011254]
xor edx, edx
mov qword [rdi + 0x30], rax
lea rax, [0x000112e8]
mov dword [rsp + 0x28], 0x58585255
mov qword [rdi + 0x38], rax
lea rax, [0x00011360]
mov qword [rsp + 0x20], 0x810
mov qword [rdi + 0x40], rax
lea rax, [0x000113b0]
mov qword [rdi + 0x48], rax
lea rax, [0x0001140c]
mov qword [rdi + 0x50], rax
lea rax, [0x000114a4]
mov qword [rdi + 0x68], rax
lea rax, [0x000114cc]
mov qword [rdi + 0x70], rax
lea rax, [0x00011528]
mov qword [rdi + 0x80], rax
lea rax, [0x000115a8]
mov qword [rdi + 0x88], rax
lea rax, [0x00011600]
mov qword [rdi + 0x90], rax
lea rax, [0x00011680]
mov qword [rdi + 0x98], rax
lea rax, [0x000116d8]
mov qword [rdi + 0xa0], rax
lea rax, [0x00011784]
mov qword [rdi + 0xa8], rax
lea rax, [0x00011830]
mov qword [rdi + 0xb0], rax
lea rax, [0x00011888]
mov qword [rdi + 0xb8], rax
lea rax, [0x000118e0]
mov qword [rdi + 0xc0], rax
mov qword [rbx + 0x50], rdi
lea rax, [0x00017a40]
mov qword [0x00017a48], rax
mov qword [0x00017a40], rax
mov qword [0x00017a38], r12
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov rcx, qword [0x00017a00]
call fcn.00011f8c
mov rdx, qword [rsp + 0x90]
btr dword [rdx + 0x30], 7
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret