Function at 0x1457c
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov edi, dword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
add esp, 0xc
mov eax, 0x187f0
push ebx
mov dword [0x187f4], eax
mov dword [0x187f0], eax
mov eax, 0x187e8
push 0x1440c
push 0x18298
mov dword [ebp - 0x210], ebx
mov dword [0x184c0], ebx
mov byte [0x1822c], bl
mov byte [0x187f8], bl
mov dword [0x187ec], eax
mov dword [0x187e8], eax
mov dword [0x184c4], ebx
call edi
push ebx
mov eax, 0x18770
push 0x1441a
push 0x18200
mov dword [0x18774], eax
mov dword [0x18770], eax
call edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
push ebx
mov esi, 0x51544c46
push esi
push 0x18
push ebx
push ebx
push ebx
push 0x18230
call edi
push ebx
push esi
push 0x20
push ebx
push ebx
push ebx
push 0x184c8
call edi
push ebx
push 0x49544c46
push 0x18
push ebx
push ebx
push ebx
push 0x18720
call edi
push ebx
push 0x49554c46
push 0x18
push ebx
push ebx
push ebx
push 0x18780
call edi
mov byte [ebp - 0x224], bl
xor eax, eax
lea edi, [ebp - 0x223]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
mov esi, 0x33544c46
push esi
push dword [ebp - 0x214]
call dword [sym.imp.NDIS.SYS_NdisAllocateGenericObject]
mov dword [0x18804], eax
cmp eax, ebx
jne 0x146ad
mov edi, 0xc0000017
jmp 0x1487c
push 0x10
pop ecx
mov word [ebp - 0x222], cx
lea ecx, [ebp - 0x224]
push ecx
push eax
mov byte [ebp - 0x224], 0x80
mov byte [ebp - 0x223], 1
mov byte [ebp - 0x21f], 1
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], esi
call dword [sym.imp.NDIS.SYS_NdisAllocateNetBufferListPool]
mov dword [0x18808], eax
cmp eax, ebx
je 0x146a3
push 0x187fc
push 1
push ebx
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov edi, eax
cmp edi, ebx
jl 0x1487c
push 0x18800
push 2
push ebx
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov edi, eax
cmp edi, ebx
jl 0x1487c
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx]
shr eax, 1
dec eax
js 0x1478d
mov edx, dword [ecx + 4]
lea ecx, [edx + eax*2]
movzx esi, word [ecx]
cmp si, 0x5c
je 0x14746
cmp si, 0x2f
je 0x14746
dec eax
dec ecx
dec ecx
cmp eax, ebx
jge 0x1472e
jmp 0x1478d
inc eax
jmp 0x14770
cmp cx, 0x2e
je 0x14779
cmp dword [ebp - 0x210], 0x104
jge 0x14779
mov esi, dword [ebp - 0x210]
inc eax
inc dword [ebp - 0x210]
mov word [ebp + esi*2 - 0x20c], cx
movzx ecx, word [edx + eax*2]
cmp cx, bx
jne 0x14749
mov eax, dword [ebp - 0x210]
xor ecx, ecx
mov word [ebp + eax*2 - 0x20c], cx
cmp eax, ebx
jne 0x14797
mov edi, 0xc0000001
jmp 0x1487c
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
xor eax, eax
mov word [0x182b8], ax
mov word [0x18220], ax
push 0x169d6
mov eax, 0x208
mov esi, 0x18220
push esi
mov dword [0x18224], 0x182b8
mov word [0x18222], ax
call edi
lea eax, [ebp - 0x20c]
push eax
push esi
call edi
xor eax, eax
mov word [0x18518], ax
mov word [0x18778], ax
push 0x169b0
mov eax, 0x208
push 0x18778
mov dword [0x1877c], 0x18518
mov word [0x1877a], ax
call edi
lea eax, [ebp - 0x20c]
push eax
push 0x18778
call edi
push 0x184c0
push ebx
push 0x100
push 0x22
push esi
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
cmp edi, ebx
jl 0x1487c
mov eax, dword [0x184c0]
and dword [eax + 0x1c], 0xffffff7f
push esi
push 0x18778
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
cmp edi, ebx
jge 0x14867
push dword [0x184c0]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [0x184c0], ebx
jmp 0x1487c
mov eax, dword [0x184c0]
and dword [eax + 0x1c], 0xffffff7f
mov eax, dword [0x184c0]
or dword [eax + 0x1c], 0x10
cmp edi, ebx
mov byte [0x187f8], 1
jge 0x1488c
call fcn.00012808
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00016354
leave
ret 8