Function at 0x12ec8
Capabilities:
Create device object
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x280
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x62]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], r12w
call fcn.0001a060
lea rcx, [0x0001a590]
mov edi, r12d
mov qword [0x0001c468], r12
mov byte [0x0001c3b8], r12b
mov byte [0x0001cc8b], r12b
call fcn.00011008
movzx ecx, byte [0x0001cc8d]
cmp al, r12b
lea rax, [0x0001ca40]
lea r13d, [r12 + 1]
cmovne ecx, r13d
mov qword [0x0001ca48], rax
mov qword [0x0001ca40], rax
lea rax, [0x0001c9a8]
mov byte [0x0001cc8d], cl
lea rdx, [0x00015d0c]
lea rcx, [0x0001c470]
xor r8d, r8d
mov qword [0x0001c6b8], r12
mov qword [0x0001c9b0], rax
mov qword [0x0001c9a8], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
lea rax, [0x0001c968]
lea rcx, [0x0001c740]
xor r8d, r8d
mov edx, r13d
mov qword [0x0001c440], r12
mov qword [0x0001c970], rax
mov qword [0x0001c968], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x00014a24]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, r12d
jl 0x13028
mov rcx, qword [rsp + 0x50]
lea rax, [0x0001ccd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov word [rsp + 0x30], r12w
lea rcx, [0x0001c6c0]
mov ebx, 0x28
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x51544c46
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r12w
lea rcx, [0x0001c9c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x49554c46
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
xor eax, eax
mov ebx, 0x33544c46
xor r8d, r8d
mov rcx, rbp
mov edx, ebx
mov byte [rsp + 0x40], r12b
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
call qword [sym.imp.NDIS.SYS_NdisAllocateGenericObject]
mov qword [0x0001ccc0], rax
cmp rax, r12
jne 0x130bf
mov ebx, 0xc0000017
jmp 0x1319d
lea rdx, [rsp + 0x40]
mov r15d, 0x10
mov rcx, rax
mov byte [rsp + 0x40], 0x80
mov byte [rsp + 0x41], r13b
mov byte [rsp + 0x45], r13b
mov word [rsp + 0x42], r15w
mov dword [rsp + 0x4c], r12d
mov dword [rsp + 0x48], ebx
call qword [sym.imp.NDIS.SYS_NdisAllocateNetBufferListPool]
mov qword [0x0001ccc8], rax
cmp rax, r12
je 0x130b5
lea r8, [0x0001cca0]
xor ecx, ecx
mov edx, r13d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x1319d
xor ecx, ecx
lea r8, [0x0001cca8]
lea edx, [rcx + 2]
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x1319d
lea ecx, [r15 - 0xe]
lea r8, [0x0001ccb0]
lea edx, [rcx + 2]
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x1319d
lea ecx, [r15 + 7]
lea r8, [0x0001ccb8]
lea edx, [rcx - 0x13]
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x1319d
movzx eax, word [rsi]
shr eax, 1
sub eax, r13d
movsxd rcx, eax
cmp rcx, r12
jl 0x13198
mov r8, qword [rsi + 8]
lea rdx, [r8 + rcx*2]
cmp word [rdx], 0x5c
je 0x131dc
cmp word [rdx], 0x2f
je 0x131dc
sub rcx, r13
sub eax, r13d
sub rdx, 2
cmp rcx, r12
jge 0x1317d
mov ebx, 0xc0000001
cmp ebx, r12d
mov byte [0x0001cc8b], r13b
jge 0x131ae
call fcn.00013454
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.00019d80
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
add eax, r13d
mov rcx, r12
movsxd r9, eax
lea rdx, [r8 + r9*2]
cmp word [rdx], r12w
je 0x1321b
movzx eax, word [r8 + r9*2]
cmp ax, 0x2e
je 0x1321b
cmp rcx, 0x104
jge 0x1321b
add rdx, 2
mov word [rsp + rcx*2 + 0x60], ax
add edi, r13d
mov ax, word [rdx]
add rcx, r13
cmp ax, r12w
jne 0x131f4
movsxd rax, edi
mov word [rsp + rax*2 + 0x60], r12w
cmp edi, r12d
je 0x13198
lea rax, [0x0001c4b0]
lea rdi, [0x0001c398]
lea rdx, [0x0001a600]
mov ebx, 0x208
mov rcx, rdi
mov word [0x0001c4b0], r12w
mov qword [0x0001c3a0], rax
mov word [0x0001c398], r12w
mov word [0x0001c39a], bx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rax, [0x0001c760]
lea rsi, [0x0001c978]
lea rdx, [0x0001a620]
mov rcx, rsi
mov word [0x0001c760], r12w
mov qword [0x0001c980], rax
mov word [0x0001c978], r12w
mov word [0x0001c97a], bx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea r11, [0x0001c468]
mov r9d, 0x22
mov qword [rsp + 0x30], r11
mov r8, rdi
xor edx, edx
mov rcx, rbp
mov byte [rsp + 0x28], r12b
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r12d
mov ebx, eax
jl 0x1319d
mov rax, qword [0x0001c468]
mov rdx, rdi
mov rcx, rsi
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, r12d
mov ebx, eax
jge 0x13336
mov rcx, qword [0x0001c468]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov qword [0x0001c468], r12
jmp 0x1319d
mov rax, qword [0x0001c468]
btr dword [rax + 0x30], 7
mov rax, qword [0x0001c468]
or dword [rax + 0x30], r15d
jmp 0x1319d