Function at 0x27f00
Capabilities:
Create device object
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
mov word [rsp + 0x40], r12w
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov word [r11 - 0x78], r12w
mov qword [r11 - 0x76], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov qword [r11 + 0x18], r12
mov qword [0x0002f210], rcx
movabs r13, 0xaaaaaaaaaaaaaaab
mov rax, r13
mul rcx
shr rdx, 1
mov rcx, rdx
mov r9, rdx
mov r14d, 0xf789
cmove r9, r14
mov r15d, 0x8790
shr rcx, 1
cmove rcx, r15
mov esi, 0x7987988
test rdx, rdx
cmove rdx, rsi
mov rax, r9
shr rax, 1
or rax, rcx
shr rdx, 4
add rax, rcx
lea r8, [rdx + rax + 9]
test r8, r8
cmove r8, rcx
sub r8, r9
add r8, 0x17
shl r8, 4
lea rax, [rcx + rcx*2]
shl rax, 3
and rax, 0xfffffffffffffff0
add r8, rax
lea edx, [r12 + 0x66]
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x2800c
mov rax, r13
mul rdi
mov r8, rdx
shr r8, 1
mov r9, r8
mov r10, r8
cmove r10, r14
shr r9, 1
cmove r9, r15
test r8, r8
cmove r8, rsi
mov rcx, r9
imul rcx, r10
movabs rax, 0xe38e38e38e38e38f
mul rcx
shr rdx, 3
shr r8, 5
sub r8, rdx
movabs rax, 0x5c9882b931057263
mul r10
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x2f
sub r8, rax
add r8, r10
cmove r8, r9
sub r9, r10
and r9d, 0xfff
sub r8, r9
movabs rax, 0xea0ea0ea0ea0ea0f
mul r10
shr rdx, 6
imul rdx, rdx, 0x46
sub r8, rdx
add r8, r10
shl r8, 5
mov edx, 0x67
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x280e2
call fcn.00018c50
mov esi, eax
test eax, eax
js 0x28382
mov eax, dword [0x0002f224]
cmp eax, 4
jb 0x28101
cmp eax, 6
jbe 0x28110
cmp eax, 0xa
je 0x28110
mov esi, 0xc00000bb
jmp 0x28386
mov rax, r13
mul rbx
mov r10, rdx
shr r10, 1
mov rdx, r10
mov r9, r10
cmove r9, r14
shr rdx, 1
cmove rdx, r15
test r10, r10
mov eax, 0x7987988
cmove r10, rax
mov r8, rdx
or r8, 7
mov rcx, r9
shr rcx, 1
or rcx, rdx
shr r10, 5
add rcx, r8
add r10, rcx
cmove r10, rdx
add r9, rdx
movabs rax, 0x5c9882b931057263
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x2f
sub r9, rax
sub r8, r9
add r8, r10
shl r8, 5
mov edx, 0x74
lea rcx, [0x000122a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x281ae
call fcn.000194b0
lea rcx, [0x0002eec0]
call fcn.00024520
test rbx, rbx
je 0x281da
cmp word [rbx], 0
je 0x281da
mov rcx, rbx
call fcn.00028660
mov rcx, rbx
call fcn.000286f0
lea r8, [0x00027180]
lea rax, [rdi + 0x70]
mov ecx, 3
nop word [rax + rax]
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
add rax, 0x40
mov qword [rax - 0x28], r8
mov qword [rax - 0x20], r8
mov qword [rax - 0x18], r8
mov qword [rax - 0x10], r8
mov qword [rax - 8], r8
dec rcx
jne 0x281f0
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], r8
lea rax, [0x000271b0]
mov qword [rdi + 0x70], rax
lea rax, [0x00027270]
mov qword [rdi + 0xe0], rax
lea rax, [0x00027210]
mov qword [rdi + 0xf0], rax
lea rdx, [0x000122b0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xe0]
mov qword [rsp + 0x30], r11
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, eax
test eax, eax
js 0x28382
mov rax, qword [rsp + 0xe0]
or dword [rax + 0x30], 4
lea rdx, [0x00012310]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
test eax, eax
jns 0x282e1
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x28382
mov rax, qword [rsp + 0xe0]
mov qword [0x0002f218], rax
call fcn.00028540
mov esi, eax
test eax, eax
js 0x28382
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
xor r8d, r8d
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlWalkFrameChain]
mov ecx, 2
call fcn.00026880
lea rcx, [0x0002ee00]
call fcn.0001efc0
mov rdx, rbx
mov rcx, rdi
call fcn.0001ccb0
mov rcx, rdi
call fcn.00022400
mov rcx, rdi
call fcn.0001b620
call fcn.00025c70
test rbx, rbx
je 0x28377
cmp word [rbx], 0
je 0x28377
mov rcx, rbx
call fcn.000287a0
mov rdx, rbx
mov rcx, rdi
call fcn.00028b30
test esi, esi
jns 0x28392
mov rcx, qword [0x0002f210]
call fcn.000283b0
mov eax, esi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret