Function at 0x140003ab4
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x14001c030]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
lea rdi, [rcx + 0x68]
lea r9, [0x140016f60]
or r14, 0xffffffffffffffff
mov rax, r14
xor r13d, r13d
inc rax
cmp word [r9 + rax*2], r13w
jne 0x140003afd
mov rsi, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140003b18
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rax
mov r8, r14
mov rdx, rsi
call fcn.14000307c
cmp rax, r14
jne 0x140003b37
mov eax, 0xc0000034
jmp 0x140003f00
inc rax
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], 7
mov word [rbp - 0x79], r13w
cmp rsi, rax
jb 0x140003f39
sub rsi, rax
mov rbx, r14
cmp rsi, r14
cmovb rbx, rsi
cmp qword [rdi + 0x18], 8
jb 0x140003b6b
mov rdi, qword [rdi]
lea r12, [rdi + rax*2]
cmp rbx, 7
ja 0x140003b96
lfence
mov qword [rbp - 0x69], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r12
lea rcx, [rbp - 0x79]
call fcn.1400169c0
mov word [rbp + rbx - 0x79], r13w
jmp 0x140003bf3
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140003f3f
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x140003e1c
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.140001000
mov rdi, rax
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r12
mov rcx, rax
call fcn.1400169c0
mov word [rbx + rdi], r13w
mov qword [rbp - 0x79], rdi
mov qword [rbp - 0x49], r13
mov ebx, 7
mov qword [rbp - 0x41], rbx
mov word [rbp - 0x59], r13w
lea rdx, [0x140016f70]
mov r8, r14
inc r8
cmp word [rdx + r8*2], r13w
jne 0x140003c0f
lea rcx, [rbp - 0x59]
call fcn.140005a24
nop
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.140002ddc
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140011264
lea r12, [r15 + 0xa0]
cmp r12, rax
je 0x140003c69
lfence
mov rdx, qword [rax]
mov qword [rax], r13
mov rcx, qword [r12]
mov qword [r12], rdx
test rcx, rcx
je 0x140003c69
call fcn.14001343c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003c79
call fcn.14001343c
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140003c94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
call fcn.140001064
mov qword [rbp - 9], r13
mov qword [rbp - 1], rbx
mov word [rbp - 0x19], r13w
mov edi, 0x1000
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x140003ce2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, rdi
jb 0x140003cdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f45
call fcn.14001343c
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], rbx
mov word [rbp - 0x39], r13w
lea rdx, [0x140016f90]
inc r14
cmp word [rdx + r14*2], r13w
jne 0x140003cf6
mov r8, r14
lea rcx, [rbp - 0x39]
call fcn.140005a24
nop
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140002ddc
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140011264
lea rsi, [r15 + 0x98]
cmp rsi, rax
je 0x140003d51
lfence
mov rdx, qword [rax]
mov qword [rax], r13
mov rcx, qword [rsi]
mov qword [rsi], rdx
test rcx, rcx
je 0x140003d51
call fcn.14001343c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003d61
call fcn.14001343c
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140003d7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
call fcn.140001064
mov qword [rbp + 0x17], r13
mov qword [rbp + 0x1f], rbx
mov word [rbp + 7], r13w
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x140003dc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, rdi
jb 0x140003dc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f4b
call fcn.14001343c
lfence
lea rdi, [r15 + 0x90]
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], r13b
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
mov r8, qword [r12]
lea edx, [r9 - 0x1a]
mov rcx, qword [r15 + 0x88]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
js 0x140003ebf
lfence
mov rax, qword [rdi]
cmp qword [rax + 0x40], r13
jne 0x140003e47
mov ebx, 0xc0000141
jmp 0x140003ebf
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003f33
jmp 0x140003bc3
mov rax, qword [r15 + 0x88]
mov rcx, qword [rax + 0x28]
or dword [rcx + 0x68], 0x20
mov rax, qword [rdi]
mov rcx, qword [rax + 0x40]
mov qword [rcx], r15
mov rdx, qword [r12]
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
mov rax, qword [r15 + 0x90]
test ebx, ebx
jns 0x140003e8c
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov qword [r15 + 0x90], r13
jmp 0x140003ebf
btr dword [rax + 0x30], 7
mov rax, qword [rdi]
or dword [rax + 0x30], 0x10
mov ecx, 0x70
mov rax, qword [r15 + 0x88]
lea rdx, [0x140005660]
mov qword [rcx + rax], rdx
add rcx, 8
cmp rcx, 0x148
jle 0x140003e9d
mov ebx, r13d
mov rdx, qword [rbp - 0x61]
cmp rdx, 8
jb 0x140003efb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ef6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f2d
call fcn.14001343c
lfence
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400167f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001344c
int3
call fcn.140001534
int3
call fcn.140002b5c
int3
call fcn.140001554
nop
call fcn.14001344c
nop
call fcn.14001344c
int3