Function at 0x140011060
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov rsi, rcx
lea rcx, [0x14001d560]
lea r12d, [rbx + 1]
lea r8d, [rbx + 0x64]
mov edx, 0x208
mov r9d, r12d
mov qword [rbp + 0x30], rbx
call fcn.140005330
mov rcx, rax
mov qword [0x14002fbe8], rax
call fcn.1400057d0
lea r14, [0x140020260]
lea r15, [0x140020270]
test eax, eax
jns 0x1400110e5
lea rax, [0x14001d570]
lea r8d, [rbx + 0x19]
lea ecx, [rbx + 7]
mov qword [rsp + 0x28], rax
mov r9, r14
mov rdx, r15
mov dword [rsp + 0x20], 0xc0000001
call fcn.14000944c
mov rax, qword [0x14002fbe8]
mov r8d, 0x1e
mov r9, r14
mov qword [rsp + 0x30], rax
lea rax, [0x140020280]
lea ecx, [r8 - 0x1b]
mov qword [rsp + 0x28], rax
mov rdx, r15
mov qword [rsp + 0x20], rbx
call fcn.14000944c
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsDriverVerifying]
mov dword [0x14002fc10], eax
test eax, eax
je 0x14001114f
lea rax, [0x1400202a0]
mov r9, r14
mov r8d, 0x28
mov qword [rsp + 0x28], rax
mov rdx, r15
mov ecx, r12d
mov qword [rsp + 0x20], rbx
call fcn.14000944c
mov ecx, dword [0x14002fbe4]
dec ecx
je 0x140011178
cmp ecx, 2
jne 0x14001119a
lea rdx, [0x140020340]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400203b0]
jmp 0x140011190
lea rdx, [0x1400202c0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140020300]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x14001147c]
mov r9d, 0x22
lea rdi, [rsi + 0x70]
mov ecx, 0x1c
lea r8, [rbp - 0x20]
lea edx, [r9 - 0x12]
rep stosq qword [rdi], rax
lea rax, [0x14001049c]
mov rcx, rsi
mov qword [rsi + 0x70], rax
mov qword [rsi + 0x80], rax
lea rax, [0x1400104bc]
mov qword [rsi + 0xe0], rax
lea rax, [0x140011384]
mov qword [rsi + 0x68], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x14001132c
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14001132c
mov rcx, qword [rcx + 0x40]
xor eax, eax
lea rdx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
mov rax, qword [0x14002fc08]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x30]
lea rcx, [rbp - 0x10]
or dword [rax + 0x30], 4
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x98], ebx
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
setns al
test al, al
jne 0x14001128b
mov r8d, 0x6f
lea rax, [0x140020440]
mov r9, r14
mov qword [rsp + 0x28], rax
lea ecx, [r8 - 0x68]
mov rdx, r15
mov dword [rsp + 0x20], 0xc0000001
call fcn.14000944c
jmp 0x14001135a
mov rax, qword [rbp + 0x30]
btr dword [rax + 0x30], 7
mov ecx, dword [0x14002fbe4]
dec ecx
je 0x1400112c7
cmp ecx, 2
jne 0x14001131c
call fcn.140009b40
call fcn.140014344
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x30], rax
mov r8d, 0xa7
lea rax, [0x140020490]
jmp 0x140011304
call fcn.14000a848
mov qword [0x14006b5b0], rbx
call fcn.140009b40
call fcn.140011890
call fcn.14001503c
call fcn.140013774
call fcn.14000e4f0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov r8d, 0x99
mov qword [rsp + 0x30], rax
lea rax, [0x140020460]
mov qword [rsp + 0x28], rax
mov r9, r14
mov rdx, r15
mov ecx, r12d
mov qword [rsp + 0x20], rbx
call fcn.14000944c
mov rax, qword [rbp + 0x30]
mov ebx, r12d
mov qword [0x14002fc00], rax
jmp 0x140011369
lea rcx, [rbp - 0x20]
mov r8d, 0x58
mov r9, r14
mov qword [rsp + 0x30], rcx
lea rcx, [0x140020410]
mov rdx, r15
mov qword [rsp + 0x28], rcx
lea ecx, [r8 - 0x51]
mov dword [rsp + 0x20], eax
call fcn.14000944c
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140011369
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret