Function at 0x110c4
Capabilities:
Create device object
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
mov rbp, rcx
mov ecx, 0x1770
mov qword [rax + 0x18], r15
mov rax, qword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov rdi, rdx
mov r12b, r15b
mov r13b, r15b
mov r14b, r15b
mov rbx, r15
cmp word [rax], cx
jae 0x1111c
lea rcx, [0x00092020]
mov edx, 0xc00000bb
mov esi, edx
call sub.ntoskrnl.exe_DbgPrint
jmp 0x114e6
mov rax, qword [sym.imp.ntoskrnl.exe_InitSafeBootMode]
cmp dword [rax], r15d
je 0x11131
lea rcx, [0x00092040]
jmp 0x1110b
mov rax, qword [rbp + 0x28]
lea rdx, [0x00092060]
lea rcx, [rsp + 0x40]
or dword [rax + 0x68], 0x20
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000920d0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xb0]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r11
mov r9d, 0x22
mov edx, 0x86a18
mov rcx, rbp
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ecx, eax
mov esi, eax
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x111aa
mov edx, esi
lea rcx, [0x00092140]
jmp 0x11112
mov rax, qword [rsp + 0xb0]
mov r12b, 1
or dword [rax + 0x30], 4
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rax + 0x40]
cmp rbx, r15
jne 0x111db
lea rcx, [0x00092160]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x114e6
xor edx, edx
mov r8d, 0x86a18
mov rcx, rbx
call fcn.00091d10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ecx, 0xc0000000
mov esi, eax
and eax, ecx
cmp eax, ecx
jne 0x11216
mov edx, esi
lea rcx, [0x00092180]
jmp 0x11112
mov qword [rbx + 0xac], rbp
mov rax, qword [rsp + 0xb0]
mov rdx, rdi
mov qword [rbx + 0xbc], rax
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
mov qword [rbx + 0xb4], rax
mov r13b, 1
call fcn.0001256c
mov ecx, 0xc0000000
mov esi, eax
and eax, ecx
cmp eax, ecx
jne 0x11267
lea rcx, [0x000921b0]
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
mov esi, r15d
mov qword [0x000b5100], rbx
cmp byte [0x000b50f8], r15b
je 0x112e9
cmp qword [0x000be5f0], r15
jne 0x112e9
mov r14d, 0xa0
mov r8d, 0x6c616e41
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [0x000be5f0], rax
cmp rax, r15
je 0x112e9
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.00091d10
lea rcx, [rdi + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
mov rcx, qword [0x000be5f0]
lea rdx, [0x00097b90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x000be5f0]
lea rdx, [0x000921d0]
add rcx, 0x20
call qword [sym.imp.ntoskrnl.exe_RtlCreateUnicodeString]
lea rcx, [0x000921f0]
mov edx, 0xc108145
call fcn.0004505c
mov word [rsp + 0x30], r15w
lea rcx, [0x000b3680]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x49504c41
mov qword [rsp + 0x20], 0x1380
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r15w
lea rcx, [0x000b3700]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x50504c41
mov qword [rsp + 0x20], 0x800
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r15w
lea rcx, [0x000b3580]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x48726150
mov qword [rsp + 0x20], 0x20
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r15w
lea rcx, [0x000b3780]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x74436c46
mov qword [rsp + 0x20], 0x434
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r15w
lea rcx, [0x000b3600]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x674c6552
mov qword [rsp + 0x20], 0x1170
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r15w
lea rcx, [0x000b3800]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x6669624f
mov qword [rsp + 0x20], 0xa84
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
lea rax, [0x000132ec]
mov r14b, 1
mov byte [rbx + 0x862b9], r14b
mov qword [rbp + 0x68], r15
lea rdi, [rbp + 0x70]
mov ecx, 0x1c
xor edx, edx
mov r8d, 0x1800
rep stosq qword [rdi], rax
lea rax, [0x000132ec]
lea rcx, [0x000b3890]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x100], rax
lea rax, [0x00013188]
mov qword [rbp + 0xe0], rax
lea rax, [0x0001332c]
mov qword [rbp + 0x120], rax
lea rax, [0x000132ec]
mov qword [rbp + 0xe8], rax
call fcn.00091d10
mov edx, r15d
lea rax, [0x000b3894]
mov dword [rax], edx
inc edx
add rax, 0x18
cmp edx, 0x100
jl 0x11484
lea rcx, [0x000b5090]
call qword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
call fcn.000115d0
cmp al, r15b
jne 0x114c4
mov rcx, qword [rbx + 0xac]
lea rdx, [0x000116d8]
mov r8, rbx
call qword [sym.imp.ntoskrnl.exe_IoRegisterDriverReinitialization]
jmp 0x114d8
mov rcx, rbx
call fcn.000124c4
cmp eax, r15d
jl 0x114d8
mov byte [rbx + 0x862b8], 1
lea rcx, [0x00092210]
mov edx, esi
call fcn.0004505c
mov ecx, 0xc0000000
mov eax, esi
and eax, ecx
cmp eax, ecx
jne 0x115ad
cmp rbx, r15
je 0x1153b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x1153b
lea r8, [rsp + 0xb8]
xor edx, edx
xor ecx, ecx
mov byte [rbx + 0x862b9], r15b
mov byte [0x000b50f9], 1
mov qword [rsp + 0xb8], 0xfffffffffa0a1f00
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
call fcn.00042f34
cmp r14b, r15b
je 0x1158e
lea rcx, [0x000b3680]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
lea rcx, [0x000b3700]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
lea rcx, [0x000b3580]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
lea rcx, [0x000b3780]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
lea rcx, [0x000b3600]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
lea rcx, [0x000b3800]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
cmp r13b, r15b
je 0x1159e
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
cmp r12b, r15b
je 0x115ad
mov rcx, qword [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret