Function at 0x27f30
Capabilities:
Create device object
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
mov word [rsp + 0x40], r12w
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov word [r11 - 0x78], r12w
mov qword [r11 - 0x76], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov qword [r11 + 0x18], r12
mov qword [0x0002f210], rcx
movabs r13, 0xaaaaaaaaaaaaaaab
mov rax, r13
mul rcx
mov rcx, rdx
shr rcx, 1
mov r9, rcx
mov r10, rcx
mov r14d, 0xf789
cmove r10, r14
mov r15d, 0x8790
shr r9, 1
cmove r9, r15
mov esi, 0x7987988
test rcx, rcx
cmove rcx, rsi
movabs rax, 0xea0ea0ea0ea0ea0f
mul r10
mov r8, rdx
shr r8, 6
imul r8, r8, 0x46
lea rax, [r9 + r9*2]
shr rax, 1
add r8, rax
shr rcx, 3
add r8, rcx
sub r8, r10
cmove r8, r9
lea rcx, [r9 + r10]
movabs r9, 0x5c9882b931057263
mov rax, r9
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x2f
sub rcx, rax
sub r8, rcx
mov rax, r9
mul r10
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x2f
sub r8, rax
add r8, r10
shl r8, 3
lea edx, [r12 + 0x65]
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
movabs r10, 0x5c9882b931057263
jmp 0x2809f
mov rax, r13
mul rdi
mov r9, rdx
shr r9, 1
mov rcx, r9
mov r8, r9
cmove r8, r14
shr rcx, 1
cmove rcx, r15
test r9, r9
cmove r9, rsi
shr r9, 5
mov rax, rcx
or rax, 7
add r9, rax
sub r9, r8
add r9, 0x17
cmove r9, rcx
add rcx, r8
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x2f
sub rcx, rax
lea r8, [r8 + r8*2]
sub r8, rcx
add r8, r9
shl r8, 5
mov edx, 0x66
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x28146
call fcn.00018c50
mov esi, eax
test eax, eax
js 0x283e2
mov eax, dword [0x0002f224]
cmp eax, 4
jb 0x28165
cmp eax, 6
jbe 0x28174
cmp eax, 0xa
je 0x28174
mov esi, 0xc00000bb
jmp 0x283e6
mov rax, r13
mul rbx
mov rcx, rdx
shr rcx, 1
mov r9, rcx
mov r10, rcx
cmove r10, r14
shr r9, 1
cmove r9, r15
test rcx, rcx
mov eax, 0x7987988
cmove rcx, rax
movabs rax, 0x2492492492492493
mul r10
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
add rax, r9
imul rax, r10
lea rdx, [rax + rax*2]
shr rcx, 5
add rdx, rcx
cmove rdx, r9
mov r8, r10
shr r8, 1
or r8, r9
lea rax, [r10 + 7]
imul r8, rax
add r8, rdx
shl r8, 5
mov edx, 0x73
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x2820e
call fcn.000194b0
lea rcx, [0x0002eec0]
call fcn.00024520
test rbx, rbx
je 0x2823a
cmp word [rbx], 0
je 0x2823a
mov rcx, rbx
call fcn.000286c0
mov rcx, rbx
call fcn.00028750
lea r8, [0x00027180]
lea rax, [rdi + 0x70]
mov ecx, 3
nop word [rax + rax]
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
add rax, 0x40
mov qword [rax - 0x28], r8
mov qword [rax - 0x20], r8
mov qword [rax - 0x18], r8
mov qword [rax - 0x10], r8
mov qword [rax - 8], r8
dec rcx
jne 0x28250
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], r8
lea rax, [0x000271b0]
mov qword [rdi + 0x70], rax
lea rax, [0x00027270]
mov qword [rdi + 0xe0], rax
lea rax, [0x00027210]
mov qword [rdi + 0xf0], rax
lea rdx, [0x000122b0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xe0]
mov qword [rsp + 0x30], r11
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, eax
test eax, eax
js 0x283e2
mov rax, qword [rsp + 0xe0]
or dword [rax + 0x30], 4
lea rdx, [0x00012310]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
test eax, eax
jns 0x28341
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x283e2
mov rax, qword [rsp + 0xe0]
mov qword [0x0002f218], rax
call fcn.000285a0
mov esi, eax
test eax, eax
js 0x283e2
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
xor r8d, r8d
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlWalkFrameChain]
mov ecx, 2
call fcn.00026880
lea rcx, [0x0002ee00]
call fcn.0001efc0
mov rdx, rbx
mov rcx, rdi
call fcn.0001ccb0
mov rcx, rdi
call fcn.00022400
mov rcx, rdi
call fcn.0001b620
call fcn.00025c70
test rbx, rbx
je 0x283d7
cmp word [rbx], 0
je 0x283d7
mov rcx, rbx
call fcn.00028800
mov rdx, rbx
mov rcx, rdi
call fcn.00028b90
test esi, esi
jns 0x283f2
mov rcx, qword [0x0002f210]
call fcn.00028410
mov eax, esi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret