Function at 0x140005e50
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rdx, [0x14000f140]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [0x140013648]
mov edx, 0x1f01ff
lea r8, [0x140013650]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
js 0x140005f7a
mov rcx, qword [0x140013648]
mov eax, dword [rcx + 0x30]
test al, al
jns 0x140005eb5
btr eax, 7
mov bl, 1
mov dword [rcx + 0x30], eax
mov rcx, qword [0x140013648]
jmp 0x140005eb7
xor bl, bl
mov r9d, dword [rcx + 0x48]
lea rax, [0x140013640]
mov qword [rsp + 0x30], rax
lea r8, [0x1400129e0]
mov eax, dword [rcx + 0x34]
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x140005f03
mov rcx, qword [0x140013650]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xorps xmm0, xmm0
movdqu xmmword [0x140013640], xmm0
jmp 0x140005f7a
mov rdx, qword [0x140013648]
mov rcx, qword [0x140013640]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov qword [0x140013648], rax
test rax, rax
jne 0x140005f4a
mov rcx, qword [0x140013650]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [0x140013640]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xorps xmm0, xmm0
movdqu xmmword [0x140013640], xmm0
jmp 0x140005f7a
mov eax, dword [rax + 0x30]
mov rcx, qword [0x140013640]
and eax, 0x14
or dword [rcx + 0x30], eax
mov rax, qword [0x140013640]
and dword [rax + 0x30], 0xffffff7f
test bl, bl
je 0x140005f7a
mov rax, qword [0x140013648]
or dword [rax + 0x30], 0x80
lea rdx, [0x14000f160]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [0x140013660]
mov edx, 0x1f01ff
lea r8, [0x140013668]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
js 0x1400060ad
mov rcx, qword [0x140013660]
mov eax, dword [rcx + 0x30]
test al, al
jns 0x140005fd2
btr eax, 7
mov bl, 1
mov dword [rcx + 0x30], eax
mov rcx, qword [0x140013660]
jmp 0x140005fd4
xor bl, bl
mov r9d, dword [rcx + 0x48]
lea rax, [0x140013658]
mov qword [rsp + 0x30], rax
lea r8, [0x140012bf0]
mov eax, dword [rcx + 0x34]
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x14000602b
mov rcx, qword [0x140013668]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [0x140013658], xmm0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rdx, qword [0x140013660]
mov rcx, qword [0x140013658]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov qword [0x140013660], rax
test rax, rax
jne 0x14000607d
mov rcx, qword [0x140013668]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [0x140013658]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [0x140013658], xmm0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rax + 0x30]
mov rcx, qword [0x140013658]
and eax, 0x14
or dword [rcx + 0x30], eax
mov rax, qword [0x140013658]
and dword [rax + 0x30], 0xffffff7f
test bl, bl
je 0x1400060ad
mov rax, qword [0x140013660]
or dword [rax + 0x30], 0x80
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret