Function at 0x60d23
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x4f984]
test eax, eax
mov ecx, 0xbb40
je 0x60d3a
cmp eax, ecx
jne 0x60d5a
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x4f984
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x4f984], eax
je 0x62959
not eax
mov dword [section..data], eax
pop ebp
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call sub.TDI.SYS_TdiInitialize
call fcn.0005faef
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.00062426
test eax, eax
jl 0x6100c
push ebx
push edi
call fcn.0005f5fd
test eax, eax
mov dword [ebp + 8], eax
jl 0x62e2e
mov dword [0x50080], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [0x50090], eax
push 0x6101e
lea eax, [ebp - 8]
push eax
call ebx
push 0x61036
lea eax, [ebp - 0x10]
push eax
call ebx
mov edi, dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
push 0x50084
push 0
push 0x100
push 0x12
lea eax, [ebp - 8]
push eax
push 0
push esi
call edi
test eax, eax
mov dword [ebp + 8], eax
jl 0x61011
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
mov dword [ebp + 8], eax
jl 0x61011
push 0x61056
lea eax, [ebp - 8]
push eax
call ebx
push 0x50088
push 0
push 0x100
push 0x12
lea eax, [ebp - 8]
push eax
push 0
push esi
call edi
test eax, eax
mov dword [ebp + 8], eax
jl 0x61011
push 0x6106e
lea eax, [ebp - 8]
push eax
call ebx
push 0x5008c
push 0
push 0x100
push 0x12
lea eax, [ebp - 8]
push eax
push 0
push esi
call edi
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp + 8], eax
jl 0x62de7
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], 0x3ea58
push 0x1c
pop ecx
mov eax, 0x164f9
lea edi, [esi + 0x38]
rep stosd dword es:[edi], eax
mov dword [esi + 0x74], fcn.00016718
mov eax, dword [0x50084]
or dword [eax + 0x1c], 0x10
mov eax, dword [0x50088]
or dword [eax + 0x1c], 0x10
mov eax, dword [0x5008c]
or dword [eax + 0x1c], 0x10
call fcn.0002842f
test al, al
jne 0x60eef
push dword [0x51720]
call fcn.000610e1
test eax, eax
mov dword [ebp + 8], eax
jl 0x62e2e
push dword [0x50084]
call fcn.000610e1
test eax, eax
mov dword [ebp + 8], eax
jl 0x62e2e
push dword [0x59d80]
call fcn.000610e1
test eax, eax
mov dword [ebp + 8], eax
jl 0x62e2e
call fcn.00062771
test eax, eax
mov dword [ebp + 8], eax
jl 0x62e2e
call fcn.0005f5c4
call fcn.00062126
cmp eax, 1
jne 0x62e14
call fcn.0005fa19
push 0x6108a
lea eax, [ebp - 8]
push eax
call ebx
push 0x59da4
lea eax, [ebp - 8]
push eax
call sub.TDI.SYS_TdiRegisterDeviceObject
push 0x610a2
lea eax, [ebp - 8]
push eax
call ebx
push 0x59da0
lea eax, [ebp - 8]
push eax
call sub.TDI.SYS_TdiRegisterDeviceObject
push 0x610ba
lea eax, [ebp - 8]
push eax
call ebx
push 0x59d9c
lea eax, [ebp - 8]
push eax
call sub.TDI.SYS_TdiRegisterDeviceObject
push 0x59de0
call fcn.00029810
test eax, eax
jl 0x6101a
push 8
pop ecx
mov ebx, 0x59dc0
push 0x50050
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push ebx
push 1
push edi
push edi
mov dword [0x59dc8], 0x48ca3
mov dword [0x59dd8], 0x48cc5
call dword [0x59df4]
test eax, eax
jl 0x62dfe
push 0x50054
push edi
push ebx
push 2
push edi
push 1
mov dword [0x59dc8], 0x48c5f
mov dword [0x59dd8], 0x48c81
call dword [0x59df4]
test eax, eax
jl 0x62e09
push dword [ebp + 0xc]
push esi
call fcn.000293ad
cmp eax, edi
jl 0x6100a
push 0x210001
push dword [0x50084]
mov dword [0x54984], edi
call dword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
call fcn.0005f983
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8
push 0
push 0
jmp 0x62de9
xor edi, edi
jmp 0x60fdf
mov eax, ecx
mov dword [0x4f984], eax
jmp 0x60d5a
push eax
push eax
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0xc0001004
push esi
call sub.TDI.SYS_CTELogEvent
jmp 0x62e2e
mov dword [0x50050], edi
jmp 0x60fb1
mov dword [0x50054], edi
jmp 0x60fdf
xor eax, eax
push eax
push eax
push eax
push eax
push 1
push 0xc0001081
push esi
call sub.TDI.SYS_CTELogEvent
mov dword [ebp + 8], 0xc0000001
mov eax, dword [0x50084]
test eax, eax
mov edi, dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
je 0x62e40
push eax
call edi
mov eax, dword [0x50088]
test eax, eax
je 0x62e4c
push eax
call edi
mov eax, dword [0x5008c]
test eax, eax
je 0x62e58
push eax
call edi
add esi, 0x38
push 0x1c
pop ecx
mov eax, fcn.00059e85
mov edi, esi
rep stosd dword es:[edi], eax
cmp dword [0x59d7c], 0
je 0x62e75
call fcn.00048ce7
mov eax, dword [ebp + 8]
jmp 0x6100a