Function at 0x1b458
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rdi, [0x0001c250]
mov rsi, rdx
mov rbx, rcx
mov rdx, rdi
xor ecx, ecx
mov al, byte [rdx]
inc ecx
inc rdx
test al, al
jne 0x1b479
lea eax, [rcx - 1]
test eax, eax
je 0x1b4e6
mov rax, rdi
movzx ecx, byte [rax]
lea rdx, str.________________________________________________456789:_________
inc rax
cmp byte [rcx + rdx], 0x3f
jbe 0x1b48e
sub eax, edi
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax + rax*2 + 1]
mov dword [0x0001eacc], ecx
test ecx, ecx
je 0x1b4e6
movsxd rdx, ecx
mov r8d, 0x32544c46
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rdi
mov rcx, rax
mov qword [0x0001ead0], rax
call fcn.0001b77c
mov dword [0x0001eacc], eax
lea rax, [0x0001b190]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
lea r8, [0x0001c100]
mov r9d, 0x5aed
mov ecx, 0x7f30
mov edx, 0x702f
mov dword [rsp + 0x20], 0x55ec
call fcn.0001b8b4
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [0x0001eac8], 0
and qword [0x0001ea80], 0
mov rcx, rsi
call fcn.00017a30
test eax, eax
js 0x1b763
lea r8, [0x0001c140]
mov r9d, 0x7826
mov edx, 0xf48
mov ecx, 0x7dc7
mov dword [rsp + 0x20], 0x1f6e
call fcn.0001b8b4
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f7a0]
lea r8, [0x0001f320]
mov qword [rsp + 0x30], rdx
mov r9d, 0x22
mov rcx, rbx
xor edx, edx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x1b603
mov rax, qword [0x0001f7a0]
lea rdx, [0x0001f320]
lea rcx, [0x0001f530]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x1b5ea
mov rcx, qword [0x0001f7a0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [0x0001f7a0], 0
jmp 0x1b603
mov rax, qword [0x0001f7a0]
btr dword [rax + 0x30], 7
mov rax, qword [0x0001f7a0]
or dword [rax + 0x30], 0x10
xor edi, edi
test edi, edi
jns 0x1b616
mov rcx, rbx
call fcn.0001b220
mov eax, edi
jmp 0x1b763
lea r8, [0x0001c190]
mov edx, 0x6883
mov ecx, 0x3923
call fcn.0001b8b4
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f740]
lea rax, [0x0001f748]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f750]
lea r8, [0x0001eae0]
lea rdx, [0x0001bf30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea rdx, [0x0001f758]
lea rax, [0x0001f760]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f768]
lea r8, [0x0001ecf0]
lea rdx, [0x0001bf50]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea r8, [0x0001c1d0]
mov r9d, 0x2dc
mov edx, 0x6d4
mov ecx, 0x761e
mov dword [rsp + 0x20], 0x4b57
call fcn.0001b8b4
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f770]
lea rax, [0x0001f778]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f780]
lea r8, [0x0001ef00]
lea rdx, [0x0001bfb0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea rdx, [0x0001f788]
lea rax, [0x0001f790]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f798]
lea r8, [0x0001f110]
lea rdx, [0x0001bfd0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea r8, [0x0001c210]
mov r9d, 0x5aba
mov edx, 0x273a
mov ecx, 0x3898
call fcn.0001b8b4
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret