Function at 0x4e964
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x0004eaf0]
lea rcx, [rax - 0x28]
xor ebp, ebp
mov qword [rax + 0x18], rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x30], rdx
lea r12d, [rbp + 1]
lea r9d, [rbp + 8]
lea r8, [rsp + 0x50]
mov edx, 0x240
mov rcx, rbx
mov byte [rsp + 0x28], r12b
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebp
jl 0x4e728
mov rax, qword [rsp + 0x90]
cmp rax, rbp
jne 0x4e3f1
mov eax, 0xc00000e9
jmp 0x4e728
mov rsi, qword [rax + 0x40]
mov qword [0x00032688], rax
lea rax, [0x000128e0]
mov qword [rsi + 0x10], rax
lea rax, [0x000128f0]
lea rdx, [0x0004eb20]
mov qword [rsi + 0x18], rax
lea rax, [0x00011ee8]
lea rcx, [rsp + 0x40]
mov qword [rsi + 0x20], rax
lea rax, [0x00012654]
mov dword [rsi + 8], r12d
mov qword [rsi + 0x28], rax
lea rax, [fcn.00012734]
mov byte [rsi + 0xc0], bpl
mov qword [rsi + 0x30], rax
lea rax, [0x0001140c]
mov byte [rsi + 0x162], bpl
mov qword [rsi + 0x38], rax
lea rax, [fcn.000114a4]
mov byte [rsi + 0x160], bpl
mov qword [rsi + 0x40], rax
lea rax, [fcn.00011540]
mov byte [rsi + 0x161], bpl
mov qword [rsi + 0x48], rax
lea rax, [fcn.000115d8]
mov byte [rsi + 0xe8], bpl
mov qword [rsi + 0x50], rax
lea rax, [fcn.00011680]
mov byte [rsi + 0xe9], bpl
mov qword [rsi + 0x58], rax
lea rax, [fcn.00011c50]
mov byte [rsi + 0x1b0], bpl
mov qword [rsi + 0x60], rax
lea rax, [0x00011e54]
mov byte [rsi + 0x1b1], bpl
mov qword [rsi + 0x68], rax
lea rax, [0x00011d64]
mov byte [rsi + 0x1b2], bpl
mov qword [rsi + 0x70], rax
lea rax, [0x00011174]
mov byte [rsi + 0x1b3], bpl
mov qword [rsi + 0x78], rax
lea rax, [0x00011158]
mov byte [rsi + 0x238], bpl
mov qword [rsi + 0x80], rax
lea rax, [0x00011108]
mov byte [rsi + 0x239], bpl
mov qword [rsi + 0x88], rax
lea rax, [0x000110bc]
mov qword [rsi + 0x1b8], rbp
mov qword [rsi + 0x90], rax
lea rax, [0x0001136c]
mov qword [rsi + 0x98], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, ebp
mov edi, eax
jge 0x4e568
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x4e726
lea rax, [0x00044f40]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
lea rax, [0x00043fdc]
mov rcx, rbx
mov qword [rbx + 0x70], rax
lea rax, [0x00044038]
mov qword [rbx + 0xe0], rax
lea rax, [0x00043e60]
mov qword [rbx + 0x68], rax
call fcn.0004e0ec
cmp eax, ebp
mov edi, eax
jge 0x4e5ba
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
jmp 0x4e555
lea rcx, [0x00030ba0]
mov edx, 0x1420
call fcn.00012924
lea rcx, [0x000117b4]
mov dword [0x00030ba4], r12d
mov qword [0x00031fb0], rbp
mov byte [0x00031fb8], bpl
mov dword [0x00030da8], r12d
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
cmp eax, ebp
mov edi, eax
jl 0x4e5ad
lea rcx, [0x00013268]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
lea rbx, [0x0004e9f0]
cmp eax, ebp
jge 0x4e633
xor edx, edx
mov dword [rsp + 0x28], eax
lea r8, [0x0004eb50]
lea ecx, [rdx + 0x65]
mov r9, rbx
mov dword [rsp + 0x20], 0xca
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov edi, 0x298
lea rcx, [0x00034040]
mov edx, edi
call fcn.00012924
lea rcx, [0x00033d80]
mov edx, edi
call fcn.00012924
mov qword [0x00034020], rbp
mov byte [0x00034028], bpl
call fcn.00011a38
cmp eax, ebp
mov edi, eax
jge 0x4e68e
xor edx, edx
mov dword [rsp + 0x28], eax
lea r8, [0x0004eb90]
lea ecx, [rdx + 0x65]
mov r9, rbx
mov dword [rsp + 0x20], 0xd2
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rsp + 0x90]
lea rdx, str.___
or dword [rcx + 0x30], 0x10
mov rax, qword [rsp + 0x90]
lea rcx, [0x00033d50]
mov dword [rax + 0x98], r12d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00020530]
lea rcx, [0x00033d60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call fcn.00047400
call fcn.00047678
lea rcx, [0x000321c0]
mov r8b, r12b
mov edx, r12d
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rcx, [rsi + 0x198]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
call fcn.0004e744
xor edx, edx
mov dword [rsp + 0x28], eax
lea ecx, [rdx + 0x65]
lea r8, [0x0004ebd0]
mov r9, rbx
mov dword [rsp + 0x20], 0xe0
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0004e908
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x4e370