Function at 0x1400015d0
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
and qword [rbp + 0x90], 0
lea rax, [0x1400015b0]
mov qword [rcx + 0x70], rax
lea rdx, [0x1400053f0]
lea rax, [0x1400015b0]
mov rdi, rcx
mov qword [rcx + 0x80], rax
xorps xmm0, xmm0
lea rax, [0x140001370]
xorps xmm1, xmm1
mov qword [rcx + 0xe0], rax
lea rax, [0x140001890]
mov qword [rcx + 0x68], rax
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm1
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0x90]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x140001870
lea rdx, [0x140005320]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x1400016b4
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x14000186e
xor edx, edx
mov dword [rsp + 0x60], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x64]
call fcn.140004ec0
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov edx, 0x50
xor ecx, ecx
mov r8d, 0x74616731
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [0x140008718], rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000186e
mov ecx, dword [rsp + 0x64]
mov rax, qword [0x140008718]
shl ecx, 4
or ecx, dword [rsp + 0x68]
shl ecx, 4
mov dword [rax + 8], ecx
mov rcx, qword [0x140008718]
mov eax, dword [rsp + 0x6c]
mov dword [rcx + 4], eax
mov rdx, qword [0x140008718]
mov ecx, dword [rdx + 8]
cmp ecx, 0x611
ja 0x140001745
mov eax, 0x448
jmp 0x1400017c0
mov eax, 0x620
cmp ecx, eax
ja 0x140001755
mov eax, 0x590
jmp 0x1400017c0
cmp ecx, 0x630
ja 0x140001764
mov eax, 0x5d8
jmp 0x1400017c0
mov ecx, dword [rdx + 4]
cmp ecx, 0x2800
ja 0x140001776
mov eax, 0x608
jmp 0x1400017c0
cmp ecx, 0x295a
ja 0x140001785
mov eax, 0x610
jmp 0x1400017c0
cmp ecx, 0x3839
jbe 0x1400017c0
cmp ecx, 0x4563
ja 0x14000179c
mov eax, 0x628
jmp 0x1400017c0
cmp ecx, 0x49a2
ja 0x1400017ab
mov eax, 0x658
jmp 0x1400017c0
cmp ecx, 0x49b1
mov eax, 0x7d8
mov r8d, 0x698
cmovbe eax, r8d
mov dword [rdx], eax
mov rcx, qword [rdi + 0x28]
call fcn.1400022b0
test eax, eax
js 0x14000186e
mov rcx, qword [0x140008718]
mov rcx, qword [rcx + 0x10]
call fcn.140001d74
mov rcx, rax
call fcn.140004104
test eax, eax
js 0x14000186e
mov rcx, qword [0x140008718]
add rcx, 0x20
call fcn.140001c6c
test eax, eax
js 0x14000186e
and qword [0x140008708], 0
lea rcx, [0x1400086b0]
xor edx, edx
lea r8d, [rdx + 0x50]
call fcn.140004ec0
xorps xmm0, xmm0
mov ecx, 0x18
movups xmmword [0x140008690], xmm0
movups xmmword [0x1400086a0], xmm0
call fcn.140002574
mov ecx, 0x18
mov qword [0x140008708], rax
call fcn.140002574
mov ecx, 0x40
mov qword [0x140008700], rax
call fcn.140002574
mov qword [0x140008710], rax
mov rcx, qword [rdi + 0x28]
add rcx, 0x48
call fcn.1400026bc
mov eax, ebx
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret