Function at 0x140003000
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x50], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x2a0]
lea rdx, [0x140002070]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x2a0]
lea rdx, [0x140002070]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x2a0]
lea rdx, [0x1400020b0]
mov qword [rcx + rax + 0x70], rdx
mov rax, qword [rsp + 0x2a0]
lea rcx, [0x140002410]
mov qword [rax + 0x68], rcx
lea rdx, [0x140004dd0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000311c
lfence
mov eax, dword [rsp + 0x40]
jmp 0x14000329a
lea rdx, [0x140004d90]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140003160
lfence
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [rsp + 0x40]
jmp 0x14000329a
mov rcx, qword [rsp + 0x2a0]
call fcn.140003f60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140003184
lea rcx, [0x140004e00]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x2a0]
call fcn.140003590
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400031b8
lfence
mov edx, dword [rsp + 0x40]
lea rcx, [0x140004e20]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x40]
jmp 0x14000329a
mov rcx, qword [rsp + 0x2a0]
call fcn.140003820
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400031ec
lfence
mov edx, dword [rsp + 0x40]
lea rcx, [0x140004e50]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x40]
jmp 0x14000329a
mov rax, qword [rsp + 0x2a0]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x48]
cdq
sub eax, edx
sar eax, 1
cdqe
mov r8, rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x50]
lea rcx, [rsp + 0x80]
call sub.ntoskrnl.exe_wcsncpy
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x48]
cdq
sub eax, edx
sar eax, 1
cdqe
shl rax, 1
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0x200
jae 0x14000324b
jmp 0x140003250
call fcn.1400042e8
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov word [rsp + rcx + 0x80], ax
lea rdx, [rsp + 0x80]
lea rcx, [0x140004e80]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rsp + 0x80]
call fcn.140003340
xor r8d, r8d
lea rdx, [0x140001a80]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ntoskrnl.exe_IoRegisterDriverReinitialization]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400042b0
add rsp, 0x290
pop rdi
ret