Function at 0x140023e70
Capabilities:
Create device object

Disassembly:
push rbp
push rbx
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
mov rax, qword [0x14003e020]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov eax, dword [rcx + 0x60]
mov r15, r9
mov byte [rbp - 0x29], r8b
mov r14, rdx
mov rbx, rcx
test eax, eax
js 0x1400241e3
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x90], r13
lea r13, [rcx + 0x68]
je 0x140023ec6
mov eax, 0xc0000718
jmp 0x1400241db
test rdx, rdx
jne 0x140023ee2
call fcn.140029710
mov r14, rax
test rax, rax
jne 0x140023ee2
mov eax, 0xc00000e5
jmp 0x1400241db
test r15, r15
je 0x140023ef8
cmp qword [rbx + 0x18], 0
jne 0x140023ef8
mov eax, 0xc0000033
jmp 0x1400241db
mov rcx, qword [rbx + 0x30]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r12
call qword [sym.imp.ntoskrnl.exe_KeClearEvent]
xor esi, esi
mov r8d, 1
lea rax, [rbp - 9]
or rdi, 0xffffffffffffffff
mov qword [rbp - 0x19], rsi
mov word [rbp - 9], si
mov qword [rbp - 0x21], rax
mov dword [rbx + 0x2c], r8d
mov qword [rbp - 0x11], r8
cmp qword [rbx + 0x18], rsi
je 0x140023f81
lea r8d, [rsi + 8]
lea rdx, str.Device_
lea rcx, [rbp - 0x21]
call fcn.140003dd0
mov rdx, qword [rbx + 0x18]
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], si
jne 0x140023f60
lea rcx, [rbp - 0x21]
call fcn.1400064e0
mov r8, qword [rbp - 0x11]
mov rax, qword [rbp - 0x21]
cmp qword [rbp - 0x19], rsi
jne 0x140023f88
or dword [rbx + 0xc], 0x80
cmp r8, 0x11
ja 0x140023ff1
lea rcx, [rbp - 9]
cmp rax, rcx
jne 0x140023fbe
mov ecx, 0x24
call fcn.140022b10
mov r8, qword [rbp - 0x11]
lea rdx, [rbp - 9]
add r8, r8
mov rcx, rax
mov qword [rbp - 0x21], rax
call fcn.140001010
mov rax, qword [rbp - 0x21]
jmp 0x140023fd2
add r8, r8
mov edx, 0x24
mov rcx, rax
call fcn.140022a30
mov qword [rbp - 0x21], rax
cmp qword [rbp - 0x19], 0x11
mov qword [rbp - 0x11], 0x12
jb 0x140023ff1
mov word [rax + 0x20], si
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x19], 0x10
mov r9d, dword [rbx + 8]
mov qword [rbp - 1], rax
movzx eax, word [rbp - 0x19]
add ax, ax
mov qword [rsp + 0x30], r13
lea r8, [rbp - 9]
mov word [rbp - 9], ax
movzx eax, word [rbp - 0x11]
mov edx, 0x10
add ax, ax
mov word [rbp - 7], ax
movzx eax, byte [rbx + 0x14]
mov rcx, qword [r14 + 8]
mov byte [rsp + 0x28], al
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov r12d, eax
test eax, eax
js 0x1400241a9
mov rcx, qword [r13]
mov eax, dword [rbx + 0x10]
or dword [rcx + 0x30], eax
mov rax, qword [r13]
mov rcx, qword [rax + 0x40]
mov dword [rcx], 0x56454442
mov qword [rcx + 8], rbx
test r15, r15
je 0x140024180
lea rsi, [rbx + 0x90]
nop dword [rax]
inc rdi
cmp word [r15 + rdi*2], 0
jne 0x140024070
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call fcn.140003dd0
mov r8, qword [rbp - 0x11]
cmp r8, 0x11
ja 0x1400240f7
mov rcx, qword [rbp - 0x21]
lea rax, [rbp - 9]
cmp rcx, rax
jne 0x1400240c3
mov ecx, 0x24
call fcn.140022b10
mov r8, qword [rbp - 0x11]
lea rdx, [rbp - 9]
add r8, r8
mov rcx, rax
mov qword [rbp - 0x21], rax
call fcn.140001010
jmp 0x1400240d4
add r8, r8
mov edx, 0x24
call fcn.140022a30
mov qword [rbp - 0x21], rax
xor edi, edi
cmp qword [rbp - 0x19], 0x11
mov qword [rbp - 0x11], 0x12
jb 0x1400240f9
mov rax, qword [rbp - 0x21]
mov word [rax + 0x20], di
mov qword [rbp - 0x19], 0x10
jmp 0x1400240f9
xor edi, edi
mov rax, qword [rbp - 0x21]
mov r8b, 1
mov edx, 0x11
mov qword [rbp - 1], rax
movzx eax, word [rbp - 0x19]
mov rcx, rsi
add ax, ax
mov word [rbp - 9], ax
movzx eax, word [rbp - 0x11]
add ax, ax
mov word [rbp - 7], ax
call fcn.1400058f0
mov rax, qword [rsi]
mov qword [rsi + 0x20], rax
movzx eax, word [rsi + 8]
lea rcx, [rsi + 0x18]
add ax, ax
lea rdx, [rbp - 9]
mov word [rcx], ax
movzx eax, word [rsi + 0x10]
add ax, ax
mov word [rcx + 2], ax
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov r12d, eax
test eax, eax
jns 0x14002417e
mov rax, qword [rsi + 0x10]
mov rcx, rdi
test rax, rax
jne 0x140024171
lea rcx, [rax - 1]
mov rcx, rdi
mov qword [rsi + 8], rcx
jmp 0x1400241a9
mov rax, qword [rsi]
mov word [rax + rcx*2], di
mov qword [rsi + 8], rcx
jmp 0x1400241a9
xor esi, esi
cmp byte [rbp - 0x29], 0
je 0x140024196
mov rax, qword [r13]
test rax, rax
je 0x140024196
and dword [rax + 0x30], 0xffffff7f
mov qword [rbx + 0x20], r14
mov rax, qword [r14]
mov rdx, rbx
mov rcx, r14
call qword [rax + 0x18]
mov r12d, esi
mov rcx, qword [rbp - 0x21]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xe0]
test rcx, rcx
je 0x1400241d0
lea rax, [rbp - 9]
cmp rcx, rax
je 0x1400241d0
call fcn.140022b00
mov eax, r12d
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400013e0
add rsp, 0xa8
pop r15
pop r14
pop rbx
pop rbp
ret