Function at 0x136e4
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x118
xor r15d, r15d
mov r12, rdx
mov rsi, rcx
lea eax, [r15 + 4]
mov qword [rsp + 0x40], r15
lea r13d, [r15 + 0x7a]
lea edi, [rax + 0x3d]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x60], eax
movzx r14d, di
mov word [rsp + 0x170], di
mov qword [0x00029d68], rcx
call fcn.000219f0
call fcn.00012eac
movzx ebx, di
lea rdi, [0x00027830]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x58], r15
mov rdx, rdi
mov qword [rsp + 0x48], r15
movzx ebp, r13w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, r15d
lea ecx, [r15 + 1]
cmp r15w, word [0x00027830]
je 0x13785
mov rax, rdi
add rax, 2
add edx, ecx
cmp r15w, word [rax]
jne 0x13779
movsxd rdi, edx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x78]
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, r15d
jge 0x1383d
mov r14d, 1
lea r13, [0x00027830]
mov r12d, 0xffff
lea esi, [r14 + 0x40]
movzx eax, bx
sub ax, si
cmp ax, 0x19
ja 0x1381e
lea eax, [rbp - 0x61]
cmp ax, 0x19
ja 0x1381e
lea rcx, [rsp + 0x78]
mov rdx, r13
mov word [r13 + rdi*2], bx
mov word [r13 + rdi*2 + 2], bp
mov word [r13 + rdi*2 + 4], r15w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x78]
mov edx, 0x80
add bx, r14w
add bp, r12w
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, r15d
jl 0x137c2
mov rsi, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov r14w, word [rsp + 0x170]
mov r13d, 0x7a
mov rcx, qword [rsp + 0x58]
lea rax, [0x00027830]
mov word [rax + rdi*2], r15w
mov word [rax + rdi*2 + 2], r15w
mov word [rax + rdi*2 + 4], r15w
cmp rcx, r15
je 0x13865
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x48]
cmp rax, r15
je 0x138ae
mov rcx, qword [rax + 0x40]
cmp rcx, r15
je 0x13880
cmp dword [rcx], 0x48524445
je 0x138ae
lea rdx, [0x000278b0]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rdx, [0x000234e0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x60]
lea r9, [rsp + 0x178]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x88]
mov rcx, r12
call fcn.000129a8
mov ebp, 1
cmp eax, r15d
jne 0x13925
cmp dword [rsp + 0x178], ebp
je 0x13925
lea r8d, [rbp + 3]
lea r9, [rsp + 0x178]
lea rdx, [rsp + 0x88]
mov rcx, r12
mov dword [rsp + 0x178], ebp
mov dword [rsp + 0x20], r8d
call fcn.000128dc
mov rcx, rsi
call fcn.00012bec
lea rcx, [0x0002cbb0]
mov r8b, bpl
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea r12, [0x00027830]
lea rcx, [rsp + 0x68]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edi, r15d
cmp r15w, word [0x00027830]
je 0x13971
mov rax, r12
add rax, 2
add edi, ebp
cmp r15w, word [rax]
jne 0x13965
mov r9d, 0x22
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea edx, [r9 - 0x12]
mov rcx, rsi
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r15d
mov ebx, eax
movsxd rdi, edi
jge 0x13a3a
mov rcx, qword [rsp + 0x40]
cmp rcx, r15
je 0x139bb
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea eax, [r14 - 0x41]
cmp ax, 0x19
ja 0x13c45
lea eax, [r13 - 0x61]
cmp ax, 0x19
ja 0x13c45
lea rcx, [rsp + 0x68]
mov rdx, r12
mov word [r12 + rdi*2], r14w
mov word [r12 + rdi*2 + 2], r13w
mov word [r12 + rdi*2 + 4], r15w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r9d, 0x22
lea r11, [rsp + 0x40]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r11
lea edx, [r9 - 0x12]
mov rcx, rsi
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
mov eax, 0xffff
add r14w, bp
add r13w, ax
cmp ebx, r15d
jl 0x139ab
mov rax, qword [rsp + 0x40]
lea rdx, [0x000278b0]
mov rcx, qword [rax + 0x40]
mov dword [rcx], 0x48524445
mov rax, qword [rsp + 0x40]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
lea rdi, [rsi + 0x70]
mov ecx, 0x1b
mov ebx, eax
cmp eax, r15d
lea rax, [0x00013c64]
rep stosq qword [rdi], rax
lea rax, [fcn.00013f00]
cmovl ebx, r15d
mov qword [rsi + 0x68], rax
call fcn.000145e4
mov rcx, rsi
mov qword [0x0002cba0], r15
mov qword [0x00029d98], r15
mov qword [0x00029da0], r15
call fcn.00014ef8
mov rcx, rsi
call fcn.0001e72c
cmp byte [0x00028c54], r15b
jne 0x13b4a
cmp dword [0x00029e68], r15d
jne 0x13b4a
mov r8d, dword [0x00029e70]
mov edx, dword [0x00029e74]
mov ecx, ebp
call fcn.00021198
lea rdx, [0x00027930]
lea rcx, [rsp + 0xd8]
mov dword [0x00029d58], r15d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00027b30]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 4
lea r9, [0x00029d58]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xd8]
mov r8d, eax
mov dword [rsp + 0x20], eax
call fcn.000128dc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov qword [rsp + 0x160], r15
lea rcx, [0x0002be78]
xor r8d, r8d
mov edx, ebp
mov dword [0x0002be60], ebp
mov qword [0x0002be68], r15
mov dword [0x0002be70], r15d
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rcx, [0x0002bee0]
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x000216b8]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov edi, 0x1fffff
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x160]
xor r9d, r9d
mov edx, edi
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xb0], 0x200
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb8], r15
mov qword [rsp + 0xc0], r15
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, r15d
jl 0x13c3b
mov rcx, qword [rsp + 0x160]
lea rax, [0x0002bef8]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
btr dword [rcx + 0x30], 7
mov eax, ebx
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret