Function at 0x18008
Capabilities:
Create device object

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
xor r14d, r14d
xor eax, eax
mov rbx, rcx
lea rcx, [r11 - 0x50]
mov rbp, rdx
mov r12b, 0x41
mov r13b, 0x61
mov word [rsp + 0x50], r14w
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov dword [r11 + 8], r14d
mov dword [r11 + 0x18], r14d
mov dword [r11 + 0x20], r14d
mov esi, r14d
mov qword [r11 - 0x50], r14
mov qword [rsp + 0x68], r14
call fcn.000116ac
lea rcx, [rsp + 0x68]
call fcn.000116f4
lea rcx, [rsp + 0x68]
call fcn.0001173c
lea rcx, [rsp + 0x68]
call fcn.00011784
lea rdx, [0x00015d10]
lea rcx, [rsp + 0x50]
mov qword [0x00015aa0], rdx
lea rdx, [0x000185c0]
mov dword [0x00015aa8], 0x1170d8
mov qword [0x00015cb0], rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.000114e8
lea r15d, [r14 + 1]
cmp eax, r14d
jl 0x184a7
mov eax, dword [rsp + 0x100]
cmp eax, 3
je 0x180f2
cmp eax, r15d
je 0x180f7
cmp eax, r14d
jne 0x184a7
cmp eax, r15d
jne 0x18135
lea rdx, [0x000185d0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.000114e8
cmp eax, r14d
jl 0x184a7
cmp dword [rsp + 0x110], r15d
jne 0x184a7
lea rdx, [0x000185e0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.000114e8
cmp eax, r14d
jl 0x1816e
bt dword [rsp + 0x118], 0x1f
cmovb esi, r15d
xor eax, eax
lea rdx, [0x00013a10]
lea rcx, [rsp + 0x80]
lea edi, [rax + 8]
mov word [rsp + 0x80], r14w
mov dword [rsp + 0x4c], r14d
mov qword [rsp + 0x82], rax
mov dword [rsp + 0x8a], eax
mov word [rsp + 0x8e], ax
mov dword [rsp + 0x48], edi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
cmp rax, r14
je 0x181f1
lea rdx, [rsp + 0x48]
lea ecx, [rdi + 0x5f]
xor r9d, r9d
mov r8d, edi
call rax
cmp eax, r14d
jl 0x181f1
bt dword [rsp + 0x4c], 0xa
jb 0x184a7
bt dword [rsp + 0x4c], 0xc
jb 0x184a7
mov r8d, 0x4ec4ec4f
mov dil, 0x19
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov eax, r8d
mul ecx
shr edx, 3
mov al, 0x1a
imul dl
sub cl, al
add r12b, cl
mov ecx, r14d
lea eax, [r12 - 0x61]
cmp al, dil
lea eax, [r12 - 0x41]
cmovbe ecx, r15d
cmp al, dil
cmovbe ecx, r15d
cmp ecx, r14d
je 0x181fa
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov eax, r8d
mul ecx
shr edx, 3
mov al, 0x1a
imul dl
sub cl, al
add r13b, cl
mov ecx, r14d
lea eax, [r13 - 0x61]
cmp al, dil
lea eax, [r13 - 0x41]
cmovbe ecx, r15d
cmp al, dil
cmovbe ecx, r15d
cmp ecx, r14d
je 0x18242
mov rcx, r14
lea rdi, [0x00010000]
lea r8, [0x00015ab0]
mov edx, 2
movzx eax, word [rcx + rdi + 0x85f0]
mov word [rcx + r8], ax
add rcx, rdx
cmp ax, r14w
jne 0x1829e
mov rcx, r14
lea r8, [0x00015bb0]
movzx eax, word [rcx + rdi + 0x8610]
mov word [rcx + r8], ax
add rcx, rdx
cmp ax, r14w
jne 0x182be
mov word [0x00015cb8], r14w
movzx eax, word [rbp + 2]
mov r8d, 0x656e6f42
add ax, dx
mov ecx, r15d
movzx edx, ax
mov word [0x00015cba], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x00015cc0], rax
cmp rax, r14
jne 0x18312
mov eax, 0xc000009a
jmp 0x18523
lea rcx, [0x00015cb8]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
call fcn.00011018
mov rdi, qword [rbx + 0x28]
xor ecx, ecx
call fcn.0001277c
mov r11, rax
cmp rax, r14
je 0x1837f
mov rcx, qword [rdi]
cmp rcx, rdi
je 0x1836a
cmp r11, qword [rcx + 0x30]
jne 0x1835e
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x30]
jb 0x1835e
mov eax, dword [rcx + 0x40]
add rax, qword [rcx + 0x30]
cmp rdx, rax
jb 0x18363
mov rcx, qword [rcx]
jmp 0x1833d
mov qword [0x00015d30], rdx
cmp qword [0x00015d30], r14
je 0x1837f
lea rcx, [0x00015aa0]
call fcn.00011c50
cmp esi, r14d
je 0x1838e
mov eax, 0xc0360006
jmp 0x18523
lea rdx, [0x00015ab0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
mov edi, 0x22
mov qword [rsp + 0x30], rdx
lea r8, [rsp + 0x70]
mov r9d, edi
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r14d
jge 0x18444
cmp eax, 0x40000000
je 0x183e6
cmp eax, 0xc0000035
jne 0x18523
movzx eax, r12b
lea rdx, [0x00015ab0]
lea rcx, [rsp + 0x70]
mov word [0x00015ac0], ax
movzx eax, r13b
mov word [0x00015ac2], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x30], rdx
lea r8, [rsp + 0x70]
mov r9d, edi
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x28], r14b
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r14d
jl 0x18523
lea rdx, [0x00015bb0]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, r14d
jge 0x184a7
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, r14d
mov edi, eax
jge 0x184a7
mov rcx, qword [rbx + 8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, edi
jmp 0x18523
lea rax, [0x00011420]
lea rdi, [rbx + 0x70]
mov ecx, 0x1b
rep stosq qword [rdi], rax
lea rax, [0x00011448]
lea rdx, [0x00013b50]
lea rcx, [rsp + 0xb0]
mov qword [rbx + 0x68], rax
mov dword [rsp + 0x40], r14d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov rcx, rbp
call fcn.000114e8
cmp eax, r14d
jl 0x18521
cmp dword [rsp + 0x40], r15d
jne 0x18521
lea rcx, [0x00013390]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
movzx ecx, byte [0x00015d11]
cmp eax, r14d
cmovge ecx, r15d
mov byte [0x00015d11], cl
xor eax, eax
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00018544
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x18008