Function at 0x12e74
Capabilities:
Check os version
Create device object

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x00027100]
xor rax, rsp
mov qword [rsp + 0x190], rax
and qword [rsp + 0x40], 0
mov rbx, rcx
mov rdi, rdx
mov esi, 0x114
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, rsi
call fcn.00024210
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], esi
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x78]
mov dword [0x0002c220], ecx
mov dword [0x0002c224], eax
mov qword [0x0002c208], rbx
call fcn.00022428
lea rcx, [0x0002ef30]
mov r8b, 1
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [rsp + 0x40]
mov r9d, 0x22
mov qword [rsp + 0x30], rdx
lea edx, [r9 - 0x12]
xor r8d, r8d
mov rcx, rbx
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, eax
test eax, eax
jns 0x12f43
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1311b
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x1311b
mov rax, qword [rsp + 0x40]
lea rdi, [rbx + 0x70]
mov rcx, qword [rax + 0x40]
mov dword [rcx], 0x48524445
mov rax, qword [rsp + 0x40]
mov qword [rcx + 8], rax
lea rax, [0x00013148]
mov ecx, 0x1b
rep stosq qword [rdi], rax
lea rax, [fcn.00024324]
mov qword [rbx + 0x68], rax
call fcn.00013788
mov eax, dword [0x0002c220]
and qword [0x0002ef28], 0
and qword [0x0002c248], 0
and qword [0x0002c250], 0
cmp eax, 6
jne 0x12fac
cmp dword [0x0002c224], 2
jae 0x12fae
cmp eax, eax
jbe 0x12fbe
and qword [0x0002ef20], 0
and qword [0x0002c258], 0
mov rcx, rbx
call fcn.00014050
mov rcx, rbx
call fcn.0001eccc
cmp byte [0x0002892d], 0
jne 0x13043
cmp dword [0x0002c7e8], 0
jne 0x13043
mov r8d, dword [0x0002c7f0]
mov edx, dword [0x0002c7f4]
mov ecx, 1
call fcn.00021a64
and dword [0x0002c1f8], 0
lea rdx, [0x00028250]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00028450]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8d, 4
lea r9, [0x0002c1f8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x20], r8d
call fcn.000128b8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
call fcn.00022334
mov edx, 0x20000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
lea rdi, [0x00010000]
mov qword [0x0002c218], rax
mov rax, qword [rsp + 0x40]
btr dword [rax + 0x30], 7
cmp dword [rsp + 0x74], 6
jae 0x130c1
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x130c1
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x130c1
cmp word [rax + 0x18], 0xc
jb 0x130c1
movzx r8d, word [rax + 0x18]
xor edx, edx
call fcn.00024210
mov rdx, qword [rbx + 0x30]
mov rax, qword [rdi + 0x143e0]
mov rcx, qword [rdx + 0x20]
mov qword [rcx], rax
movzx eax, word [rdi + 0x143e8]
mov word [rcx + 8], ax
mov eax, dword [0x0002c220]
cmp eax, 6
jne 0x130d7
cmp dword [0x0002c224], 2
jae 0x130d9
cmp eax, eax
jbe 0x1311b
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x1311b
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1311b
cmp word [rax + 0x18], 0xc
jb 0x1311b
movzx r8d, word [rax + 0x18]
xor edx, edx
call fcn.00024210
mov rdx, qword [rbx + 0x30]
mov rax, qword [rdi + 0x143f0]
mov rcx, qword [rdx + 0x20]
mov qword [rcx], rax
movzx eax, word [rdi + 0x143f8]
mov word [rcx + 8], ax
mov eax, esi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00022be0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret