Function at 0x140001730
Capabilities:
Create device object
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x1f8
mov rax, qword [0x14001c050]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x48], 0
mov dword [0x140025fc0], 0
mov dword [0x140025fbc], 0
call fcn.140001000
mov word [rsp + 0x70], ax
call fcn.140001004
mov word [rsp + 0x74], ax
call fcn.140001008
mov word [rsp + 0x78], ax
call fcn.14000100c
mov word [rsp + 0x7c], ax
call fcn.140001010
mov word [rsp + 0x80], ax
call fcn.140001014
mov word [rsp + 0x84], ax
lea rax, [rsp + 0x170]
mov qword [rsp + 0xb0], rax
xor eax, eax
mov word [rsp + 0xa8], ax
mov eax, 0x64
mov word [rsp + 0xaa], ax
cmp qword [rsp + 0x218], 0
je 0x140001b45
mov dword [rsp + 0xd0], 0x30
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0xe8], 0x200
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
lea r8, [rsp + 0xd0]
mov edx, 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001b39
mov r8d, 0x534442
mov edx, 0x74
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [rsp + 0x58], rax
mov r8d, 0x32534442
mov edx, 0x74
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [0x14001c0e0], rax
mov r8d, 0x53455042
mov edx, 0x74
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [rsp + 0x60], rax
mov r8d, 0x32455042
mov edx, 0x74
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x88], rax
mov rax, qword [0x14001c0e0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa0], rax
lea rdx, [0x140015100]
lea rcx, [rsp + 0x100]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140015110]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140015120]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140015130]
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [rsp + 0x40], 0
jne 0x1400019ac
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x74
mov r9, qword [rsp + 0x88]
mov r8d, 2
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1400019ea
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x74
mov r9, qword [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001a28
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x74
mov r9, qword [rsp + 0x98]
mov r8d, 2
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001a66
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x74
mov r9, qword [rsp + 0xa0]
mov r8d, 2
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001ae2
mov rax, qword [rsp + 0x88]
add rax, 0xc
mov rdx, rax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rsp + 0x90]
add rax, 0xc
mov rdx, rax
lea rcx, [0x140024d40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rsp + 0x98]
add rax, 0xc
mov rdx, rax
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rsp + 0xa0]
add rax, 0xc
mov rdx, rax
lea rcx, [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x140001b37
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
jmp 0x140001fc2
jmp 0x140001b43
mov eax, 0xc0000001
jmp 0x140001fc2
jmp 0x140001b4f
mov dword [0x140025ffc], 1
mov dword [rsp + 0x40], 0
cmp dword [0x140025ffc], 0
jne 0x140001c79
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [rsp + 0xc0]
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140001bf9
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [0x14001c0e0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp qword [rsp + 0x48], 0
je 0x140001bf0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x40]
jmp 0x140001fc2
lea rdx, [rsp + 0xc0]
lea rcx, [0x140024d40]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140001c79
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [0x14001c0e0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp qword [rsp + 0x48], 0
je 0x140001c70
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x40]
jmp 0x140001fc2
mov rax, qword [rsp + 0x210]
lea rcx, [0x140001fe0]
mov qword [rax + 0x68], rcx
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x210]
lea rdx, [0x1400016a0]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x210]
lea rdx, [0x140001650]
mov qword [rcx + rax + 0x70], rdx
cmp dword [0x140025ffc], 0
je 0x140001cee
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x210]
lea rdx, [0x1400090a0]
mov qword [rcx + rax + 0x70], rdx
jmp 0x140001d0b
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x210]
lea rdx, [fcn.140005be0]
mov qword [rcx + rax + 0x70], rdx
mov byte [0x140025af8], 0
lea rcx, [0x140025a80]
call qword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
mov byte [0x140025ae8], 0
mov byte [0x1400255b0], 0
mov qword [0x140025fb0], 0
mov dword [0x140025ff8], 8
mov qword [0x140025ff0], 0x200000
movabs rax, 0xfffff6fffffffff8
mov qword [0x140025fe0], rax
movabs rax, 0xfffff6fb7ffffff8
mov qword [0x140025fe8], rax
lea rcx, [0x140015140]
call sub.ntoskrnl.exe_DbgPrint
call fcn.1400031a0
lea rcx, [0x140015160]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rsp + 0x58], 0
je 0x140001daa
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x60], 0
je 0x140001dc8
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x60], 0
cmp qword [rsp + 0x68], 0
je 0x140001de6
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x68], 0
cmp qword [rsp + 0x48], 0
je 0x140001e02
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x160]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
xor eax, eax
xor ecx, ecx
cpuid
lea rdi, [rsp + 0x160]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov eax, 4
imul rax, rax, 1
mov edx, dword [rsp + rax + 0x160]
lea rcx, [0x140015190]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 4
imul rax, rax, 1
cmp dword [rsp + rax + 0x160], 0x756e6547
jne 0x140001f37
mov eax, 1
xor ecx, ecx
cpuid
lea rdi, [rsp + 0x160]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov eax, 4
imul rax, rax, 0
mov eax, dword [rsp + rax + 0x160]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
and eax, 0xf
mov dword [0x140025fd8], eax
mov eax, dword [rsp + 0x44]
shr eax, 4
and eax, 0xf
mov dword [0x140025fd4], eax
mov eax, dword [rsp + 0x44]
shr eax, 8
and eax, 0xf
mov dword [0x140025fd0], eax
mov eax, dword [rsp + 0x44]
shr eax, 0xc
and eax, 3
mov dword [0x140025fcc], eax
mov eax, dword [rsp + 0x44]
shr eax, 0x10
and eax, 0xf
mov dword [0x140025fc8], eax
mov eax, dword [rsp + 0x44]
shr eax, 0x14
and eax, 0xff
mov dword [0x140025fc4], eax
mov eax, dword [0x140025fc8]
shl eax, 4
mov ecx, dword [0x140025fd4]
add ecx, eax
mov eax, ecx
mov dword [0x140025fd4], eax
mov eax, dword [0x140025fc4]
shl eax, 4
mov ecx, dword [0x140025fd0]
add ecx, eax
mov eax, ecx
mov dword [0x140025fd0], eax
mov ecx, 1
call fcn.1400118f0
call fcn.140011440
jmp 0x140001f6c
lea rcx, [0x1400151b0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 4
imul rax, rax, 1
cmp dword [rsp + rax + 0x160], 0x68747541
jne 0x140001f6c
lea rcx, [0x1400151d0]
call sub.ntoskrnl.exe_DbgPrint
xor ecx, ecx
call fcn.1400118f0
lea rdx, [0x1400151e0]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x14001c748], rax
lea rdx, [0x140015210]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x14001c740], rax
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140014890
add rsp, 0x1f8
pop rdi
pop rbx
ret