Function at 0x1400067c0
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rdx, [0x14000f1c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [0x140013678]
mov edx, 0x1f01ff
lea r8, [0x140013680]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
js 0x1400068ea
mov rcx, qword [0x140013678]
mov eax, dword [rcx + 0x30]
test al, al
jns 0x140006825
btr eax, 7
mov bl, 1
mov dword [rcx + 0x30], eax
mov rcx, qword [0x140013678]
jmp 0x140006827
xor bl, bl
mov r9d, dword [rcx + 0x48]
lea rax, [0x140013670]
mov qword [rsp + 0x30], rax
lea r8, [0x140012e00]
mov eax, dword [rcx + 0x34]
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x140006873
mov rcx, qword [0x140013680]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xorps xmm0, xmm0
movdqu xmmword [0x140013670], xmm0
jmp 0x1400068ea
mov rdx, qword [0x140013678]
mov rcx, qword [0x140013670]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov qword [0x140013678], rax
test rax, rax
jne 0x1400068ba
mov rcx, qword [0x140013680]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [0x140013670]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xorps xmm0, xmm0
movdqu xmmword [0x140013670], xmm0
jmp 0x1400068ea
mov eax, dword [rax + 0x30]
mov rcx, qword [0x140013670]
and eax, 0x14
or dword [rcx + 0x30], eax
mov rax, qword [0x140013670]
and dword [rax + 0x30], 0xffffff7f
test bl, bl
je 0x1400068ea
mov rax, qword [0x140013678]
or dword [rax + 0x30], 0x80
lea rdx, [0x14000f1e0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [0x140013690]
mov edx, 0x1f01ff
lea r8, [0x140013698]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
js 0x140006a1d
mov rcx, qword [0x140013690]
mov eax, dword [rcx + 0x30]
test al, al
jns 0x140006942
btr eax, 7
mov bl, 1
mov dword [rcx + 0x30], eax
mov rcx, qword [0x140013690]
jmp 0x140006944
xor bl, bl
mov r9d, dword [rcx + 0x48]
lea rax, [0x140013688]
mov qword [rsp + 0x30], rax
lea r8, [0x140013010]
mov eax, dword [rcx + 0x34]
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x14000699b
mov rcx, qword [0x140013698]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [0x140013688], xmm0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rdx, qword [0x140013690]
mov rcx, qword [0x140013688]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov qword [0x140013690], rax
test rax, rax
jne 0x1400069ed
mov rcx, qword [0x140013698]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [0x140013688]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [0x140013688], xmm0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rax + 0x30]
mov rcx, qword [0x140013688]
and eax, 0x14
or dword [rcx + 0x30], eax
mov rax, qword [0x140013688]
and dword [rax + 0x30], 0xffffff7f
test bl, bl
je 0x140006a1d
mov rax, qword [0x140013690]
or dword [rax + 0x30], 0x80
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret