Function at 0x15dc8
Capabilities:
Check os version
Create device object

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x170
mov rax, qword [0x0002b100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, rcx
mov qword [0x0186d1b0], rcx
lea rcx, [rsp + 0x40]
mov rsi, rdx
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov r13d, 1
test eax, eax
js 0x15e91
mov ecx, dword [rsp + 0x44]
cmp ecx, 0xb
je 0x15e35
cmp ecx, 0xa
jne 0x15e3e
cmp dword [rsp + 0x4c], 0x55ec
jb 0x15e53
mov byte [0x0186d18d], r13b
jmp 0x15e8c
cmp ecx, 6
jne 0x15e78
mov eax, dword [rsp + 0x48]
cmp eax, 3
jb 0x15e5c
mov byte [0x0186d18f], r13b
mov byte [0x0186d18e], r13b
jmp 0x15e8c
cmp eax, 2
jne 0x15e6a
mov byte [0x0186d1ac], r13b
jmp 0x15e8c
cmp eax, r13d
jne 0x15e8c
mov byte [0x0186d1ad], r13b
jmp 0x15e8c
movzx eax, byte [0x0186d1ae]
cmp ecx, 5
cmovbe eax, r13d
mov byte [0x0186d1ae], al
mov bpl, r13b
jmp 0x15e94
xor bpl, bpl
xor ebx, ebx
mov r15d, pe_nt_image_headers64
movsxd rcx, ebx
call fcn.00012310
mov rdi, rax
test rax, rax
je 0x15ede
xor edx, edx
xor ecx, ecx
cmp byte [rcx + rax], 0
je 0x15ec1
add rcx, r13
add edx, r13d
cmp rcx, r15
jl 0x15eb0
test edx, edx
je 0x15ede
cmp edx, r15d
jae 0x15ede
lea r8, [0x00025540]
mov rcx, rax
call fcn.00011fd4
cmp rax, rdi
je 0x15eeb
add ebx, 4
cmp ebx, 0xffff
jge 0x15ef2
jmp 0x15e9c
mov byte [0x0002c2fd], r13b
mov rcx, rsi
call fcn.000133d0
test bpl, bpl
jne 0x15f09
mov eax, 0xc0000001
jmp 0x1607f
movzx edx, word [rsi]
mov rcx, qword [rsi + 8]
call fcn.00013cac
mov ebp, dword [0x0186cb4c]
test ebp, ebp
je 0x15eff
lea edx, [rbp + 8]
mov r15d, 2
mov edi, 0x400
add dx, dx
mov eax, edi
lea r13, [0x00010000]
movzx ecx, dx
mov word [0x0002c260], dx
add dx, r15w
add rcx, r15
mov rbx, rbp
cmp rcx, rdi
lea rcx, [r13 + 0x185d5f0]
cmova ax, dx
mov qword [0x0002c268], rcx
add rbx, rbx
mov word [0x0002c262], ax
mov rax, qword [0x00025f90]
lea rdx, [0x0186cb60]
mov qword [0x0186d5f0], rax
mov rax, qword [0x00025f98]
add rcx, 0x10
mov r8, rbx
mov qword [0x0186d5f8], rax
call fcn.00024c10
add bp, 0xc
lea rcx, [r13 + 0x185d9f0]
add bp, bp
mov qword [0x0002c278], rcx
lea rdx, [0x0186cb60]
movzx eax, bp
mov word [0x0002c270], bp
add bp, r15w
add rax, r15
mov r8, rbx
cmp rax, rdi
mov rax, qword [0x00025fb0]
mov qword [0x0186d9f0], rax
mov rax, qword [0x00025fb8]
cmova di, bp
mov qword [0x0186d9f8], rax
mov rax, qword [0x00025fc0]
add rcx, 0x18
mov qword [0x0186da00], rax
mov word [0x0002c272], di
call fcn.00024c10
lea r11, [0x0186d1b8]
lea r9d, [r15 + 0x20]
lea r8, [0x0002c260]
mov qword [rsp + 0x30], r11
xor edx, edx
mov rcx, r12
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x15eff
lea rdx, [0x0002c260]
lea rcx, [0x0002c270]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
jns 0x16072
mov rcx, qword [0x0186d1b8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [0x0186d1b8], 0
jmp 0x15eff
mov rdx, rsi
mov rcx, r12
call fcn.00015ca4
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.00024bb0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret