Function at 0x27f10
Capabilities:
Create device object
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rbx, rdx
mov rsi, rcx
xor r12d, r12d
mov word [rsp + 0x40], r12w
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov word [r11 - 0x78], r12w
mov qword [r11 - 0x76], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov qword [r11 + 0x18], r12
mov qword [0x0002f210], rcx
movabs r13, 0xaaaaaaaaaaaaaaab
mov rax, r13
mul rcx
mov r8, rdx
shr r8, 1
mov r9, r8
mov r10, r8
mov r14d, 0xf789
cmove r10, r14
mov r15d, 0x8790
shr r9, 1
cmove r9, r15
mov edi, 0x7987988
test r8, r8
cmove r8, rdi
mov rcx, r9
imul rcx, r10
movabs rax, 0xe38e38e38e38e38f
mul rcx
shr rdx, 3
shr r8, 4
lea rax, [r10 + rdx]
lea rcx, [r8 + rax + 7]
test rcx, rcx
cmove rcx, r9
movabs rax, 0x2492492492492493
mul r10
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
sub rcx, rax
sub rcx, r9
lea r8, [rcx + r10 + 7]
shl r8, 4
lea edx, [r12 + 0x65]
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
movabs r8, 0x2492492492492493
jmp 0x28055
mov rax, r13
mul rsi
shr rdx, 1
mov r10, rdx
mov r11, rdx
cmove r11, r14
shr r10, 1
cmove r10, r15
test rdx, rdx
cmove rdx, rdi
shr rdx, 4
add rdx, r10
lea r9, [rdx + r11 - 0x67]
test r9, r9
cmove r9, r10
movabs rax, 0xea0ea0ea0ea0ea0f
mul r11
mov rcx, rdx
shr rcx, 6
imul rcx, rcx, 0x46
mov rax, r8
mul r11
mov r8, r11
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 2
sub r8, rcx
add r8, r9
add r8, r10
add r8, r11
shl r8, 4
mov edx, 0x66
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x28103
call fcn.00018c50
mov edi, eax
test eax, eax
js 0x283b2
mov eax, dword [0x0002f224]
cmp eax, 4
jb 0x28122
cmp eax, 6
jbe 0x28131
cmp eax, 0xa
je 0x28131
mov edi, 0xc00000bb
jmp 0x283b6
mov rax, r13
mul rbx
mov r9, rdx
shr r9, 1
mov r10, r9
mov r11, r9
cmove r11, r14
shr r10, 1
cmove r10, r15
test r9, r9
mov ecx, 0x7987988
cmove r9, rcx
mov rcx, r10
imul rcx, r11
movabs rax, 0xe38e38e38e38e38f
mul rcx
mov rcx, rdx
shr rcx, 3
movabs rax, 0x5c9882b931057263
mul r11
mov rax, r11
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x2f
sub rcx, rax
shr r9, 1
lea rax, [r11 + rcx]
add r9, rax
cmove r9, r10
mov r8, r11
shr r8, 1
or r8, r10
add r8, r9
add r8, r11
lea r8, [r8 + r8 - 0x2e]
mov edx, 0x73
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x281e1
call fcn.000194b0
lea rcx, [0x0002eec0]
call fcn.00024520
test rbx, rbx
je 0x2820d
cmp word [rbx], 0
je 0x2820d
mov rcx, rbx
call fcn.00028690
mov rcx, rbx
call fcn.00028720
lea r8, [0x00027180]
lea rax, [rsi + 0x70]
mov ecx, 3
nop dword [rax]
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
add rax, 0x40
mov qword [rax - 0x28], r8
mov qword [rax - 0x20], r8
mov qword [rax - 0x18], r8
mov qword [rax - 0x10], r8
mov qword [rax - 8], r8
dec rcx
jne 0x28220
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], r8
lea rax, [0x000271b0]
mov qword [rsi + 0x70], rax
lea rax, [0x00027270]
mov qword [rsi + 0xe0], rax
lea rax, [0x00027210]
mov qword [rsi + 0xf0], rax
lea rdx, [0x000122b0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xe0]
mov qword [rsp + 0x30], r11
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x283b2
mov rax, qword [rsp + 0xe0]
or dword [rax + 0x30], 4
lea rdx, [0x00012310]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x28311
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x283b2
mov rax, qword [rsp + 0xe0]
mov qword [0x0002f218], rax
call fcn.00028570
mov edi, eax
test eax, eax
js 0x283b2
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
xor r8d, r8d
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlWalkFrameChain]
mov ecx, 2
call fcn.00026880
lea rcx, [0x0002ee00]
call fcn.0001efc0
mov rdx, rbx
mov rcx, rsi
call fcn.0001ccb0
mov rcx, rsi
call fcn.00022400
mov rcx, rsi
call fcn.0001b620
call fcn.00025c70
test rbx, rbx
je 0x283a7
cmp word [rbx], 0
je 0x283a7
mov rcx, rbx
call fcn.000287d0
mov rdx, rbx
mov rcx, rsi
call fcn.00028b60
test edi, edi
jns 0x283c2
mov rcx, qword [0x0002f210]
call fcn.000283e0
mov eax, edi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret