Function at 0x1b460
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rdi, [0x0001c260]
mov rsi, rdx
mov rbx, rcx
mov rdx, rdi
xor ecx, ecx
mov al, byte [rdx]
inc ecx
inc rdx
test al, al
jne 0x1b481
lea eax, [rcx - 1]
test eax, eax
je 0x1b4ee
mov rax, rdi
movzx ecx, byte [rax]
lea rdx, str.________________________________________________456789:_________
inc rax
cmp byte [rcx + rdx], 0x3f
jbe 0x1b496
sub eax, edi
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax + rax*2 + 1]
mov dword [0x0001eacc], ecx
test ecx, ecx
je 0x1b4ee
movsxd rdx, ecx
mov r8d, 0x32544c46
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rdi
mov rcx, rax
mov qword [0x0001ead0], rax
call fcn.0001b788
mov dword [0x0001eacc], eax
lea rax, [0x0001b190]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
lea r9, [0x0001c110]
mov edx, 0x3f6
mov ecx, 0x7e91
mov r8d, 0x3030
mov dword [rsp + 0x20], 0x6b8d
call fcn.0001b8c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [0x0001eac8], 0
and qword [0x0001ea80], 0
mov rcx, rsi
call fcn.00017a30
test eax, eax
js 0x1b771
lea r9, [0x0001c150]
mov edx, 0xaa2
mov ecx, 0x5f58
mov r8d, 0x7eda
mov dword [rsp + 0x20], 0x11c3
call fcn.0001b8c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f7a0]
lea r8, [0x0001f320]
mov qword [rsp + 0x30], rdx
mov r9d, 0x22
mov rcx, rbx
xor edx, edx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x1b60b
mov rax, qword [0x0001f7a0]
lea rdx, [0x0001f320]
lea rcx, [0x0001f530]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x1b5f2
mov rcx, qword [0x0001f7a0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [0x0001f7a0], 0
jmp 0x1b60b
mov rax, qword [0x0001f7a0]
btr dword [rax + 0x30], 7
mov rax, qword [0x0001f7a0]
or dword [rax + 0x30], 0x10
xor edi, edi
test edi, edi
jns 0x1b61e
mov rcx, rbx
call fcn.0001b220
mov eax, edi
jmp 0x1b771
lea r9, [0x0001c1a0]
mov edx, 0xbdc
mov ecx, 0x6556
mov r8d, 0x51ec
call fcn.0001b8c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f740]
lea rax, [0x0001f748]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f750]
lea r8, [0x0001eae0]
lea rdx, [0x0001bf40]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea rdx, [0x0001f758]
lea rax, [0x0001f760]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f768]
lea r8, [0x0001ecf0]
lea rdx, [0x0001bf60]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea r9, [0x0001c1e0]
mov edx, 0x2eb6
mov ecx, 0x10ad
mov r8d, 0x1c9e
call fcn.0001b8c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f770]
lea rax, [0x0001f778]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f780]
lea r8, [0x0001ef00]
lea rdx, [0x0001bfc0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea rdx, [0x0001f788]
lea rax, [0x0001f790]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f798]
lea r8, [0x0001f110]
lea rdx, [0x0001bfe0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea r9, [0x0001c220]
mov edx, 0x738
mov ecx, 0x3707
mov r8d, 0x4cc6
mov dword [rsp + 0x20], 0x43ff
call fcn.0001b8c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret