Function at 0x15ae4
Capabilities:
Create device object

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rbx, rcx
lea rcx, [0x001b5db0]
xor r12d, r12d
mov rbp, rdx
mov qword [rax + 0x10], r12
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
lea rdx, [0x00015ac0]
lea rcx, [rsp + 0x40]
mov qword [rbx + 0x70], rdx
mov qword [rbx + 0x80], rdx
mov qword [rbx + 0x90], rdx
mov qword [rbx + 0x88], rdx
mov qword [rbx + 0xf0], rdx
lea rdx, [0x00019030]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xe8]
lea r9d, [r12 + 0x22]
mov qword [rsp + 0x30], rdx
lea r8, [rsp + 0x40]
lea edx, [r12 + 0x38]
mov rcx, rbx
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r12d
jl 0x15b95
mov rax, qword [rsp + 0xe8]
or dword [rax + 0x30], 4
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov rax, qword [rbx + 0x28]
mov qword [0x001b5f90], rax
cmp word [rax + 0x5a], r12w
je 0x15c64
mov esi, 0x104
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [0x001b5f30], rax
cmp rax, r12
je 0x15bf4
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.00016bc0
mov r9, qword [0x001b5f90]
lea r8, [0x00019090]
mov r9, qword [r9 + 0x60]
mov rdx, rsi
mov rcx, rdi
call fcn.00011008
mov rax, qword [0x001b5f90]
movzx ecx, word [rax + 0x5a]
add ecx, 0x40
movsxd rdx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r12
je 0x15c5d
mov rdi, qword [0x001b5f90]
xor edx, edx
movzx ecx, word [rdi + 0x5a]
add ecx, 0x40
movsxd r8, ecx
mov rcx, rax
call fcn.00016bc0
movzx edx, word [rdi + 0x5a]
mov r9, qword [rdi + 0x60]
add edx, 0x40
lea r8, [0x000190e0]
mov rcx, rsi
movsxd rdx, edx
call fcn.00011008
lea rcx, [0x001b5d88]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x001b5f90]
cmp word [rax + 0x4a], r12w
je 0x15ccd
movzx eax, word [rax + 0x4a]
xor ecx, ecx
add eax, 0x40
movsxd rdx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r12
je 0x15ccd
mov rdi, qword [0x001b5f90]
xor edx, edx
movzx ecx, word [rdi + 0x4a]
add ecx, 0x40
movsxd r8, ecx
mov rcx, rax
call fcn.00016bc0
movzx edx, word [rdi + 0x4a]
mov r9, qword [rdi + 0x60]
add edx, 0x40
lea r8, [0x00019110]
mov rcx, rsi
movsxd rdx, edx
call fcn.00011008
lea rcx, [0x001b5d98]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp word [rbp + 2], r12w
je 0x15d20
movzx edx, word [rbp + 2]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, r12
je 0x15d20
movzx r8d, word [rbp + 2]
xor edx, edx
mov rcx, rax
add r8, 2
call fcn.00016bc0
movzx r8d, word [rbp]
mov rdx, qword [rbp + 8]
mov rcx, rdi
call fcn.00016d60
lea rcx, [0x001b5ec8]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rsi, qword [0x001b5ed0]
mov edi, 0x208
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
cmp rax, r12
je 0x15daa
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00016bc0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rdx, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
mov rcx, rbp
call fcn.00016d60
mov rdx, rsi
cmp word [rsi], r12w
je 0x15d80
add rdx, 2
cmp word [rdx], r12w
jne 0x15d74
jmp 0x15d8a
cmp word [rdx], 0x5c
je 0x15d92
sub rdx, 2
cmp rsi, rdx
jbe 0x15d80
mov rdx, r12
cmp rdx, r12
je 0x15daa
add rdx, 2
je 0x15daa
lea rcx, [0x001b5f08]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0xf0], r12
lea r8d, [rdx + 0x28]
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0x80], r12d
call fcn.00016bc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x00017b00]
lea rdx, [0x00017a80]
repne scasw ax, word [rdi]
lea rdi, [0x000136c0]
mov rax, qword [rdi]
not rcx
mov qword [0x001b5f18], rax
mov eax, dword [rdi + 8]
dec rcx
mov dword [0x001b5f20], eax
movzx eax, word [rdi + 0xc]
add ecx, ecx
mov word [0x001b5f24], ax
mov al, byte [rdi + 0xe]
mov dword [0x001b5f28], ecx
lea rcx, [rsp + 0x50]
mov byte [0x001b5f26], al
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, r12d
jl 0x15ede
lea rdx, [0x000176a0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x60]
call fcn.00011078
cmp al, r12b
jne 0x15ede
lea r8, [0x001b5d80]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallback]
lea rcx, [0x00015890]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
lea rdi, [0x001b5ed8]
mov edx, 0xa8
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rdi], rax
add rdi, 8
mov dword [rax + 0x68], 0x5f5dca8
lea rax, [0x001b5f08]
cmp rdi, rax
jl 0x15ef4
lea rdx, [0x00019150]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x70]
call fcn.00011078
mov rcx, rbx
cmp al, r12b
je 0x15f4b
xor r8d, r8d
xor edx, edx
call fcn.00015a5c
jmp 0x15f5b
lea rdx, [fcn.00015a5c]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_IoRegisterBootDriverReinitialization]
lea rax, [0x000159f8]
mov qword [rbx + 0x68], rax
xor eax, eax
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret