Function at 0x407a40
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0x74637673
push 0x400
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test eax, eax
jne 0x407a70
mov eax, 0x94fcae01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.ntoskrnl.exe_DbgPrint]
push str.100A
call ebx
mov ecx, dword [ebp + 0xc]
add esp, 4
call fcn.00403820
call fcn.00408000
push 0x470514
call ebx
add esp, 4
lea eax, [esp + 0x10]
push str.Devicextcvs001
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov esi, dword [ebp + 8]
lea eax, [esp + 0x10]
push 0x4706fc
push 0
push 0
push 0x22
push eax
push 0x28
push esi
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test edi, edi
jns 0x407adf
push edi
push str._IoCreateDevice_error__x_n
call ebx
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4706fc]
push str.DosDevicesxtcvs001
mov eax, dword [eax + 0x28]
mov dword [eax + 0x1c], 0x3e8
lea eax, [esp + 0x1c]
mov dword [esi + 0x38], 0x407f90
mov dword [esi + 0x3c], 0x407f90
mov dword [esi + 0x40], 0x407f90
mov dword [esi + 0x44], 0x407f90
mov dword [esi + 0x48], 0x407f90
mov dword [esi + 0x4c], 0x407f90
mov dword [esi + 0x50], 0x407f90
mov dword [esi + 0x54], 0x407f90
mov dword [esi + 0x58], 0x407f90
mov dword [esi + 0x5c], 0x407f90
mov dword [esi + 0x60], 0x407f90
mov dword [esi + 0x64], 0x407f90
mov dword [esi + 0x68], 0x407f90
mov dword [esi + 0x6c], 0x407f90
mov dword [esi + 0x70], 0x407f90
mov dword [esi + 0x74], 0x407f90
mov dword [esi + 0x78], 0x407f90
mov dword [esi + 0x7c], 0x407f90
mov dword [esi + 0x80], 0x407f90
mov dword [esi + 0x84], 0x407f90
mov dword [esi + 0x88], 0x407f90
mov dword [esi + 0x8c], 0x407f90
mov dword [esi + 0x90], 0x407f90
mov dword [esi + 0x94], 0x407f90
mov dword [esi + 0x98], 0x407f90
mov dword [esi + 0x9c], 0x407f90
mov dword [esi + 0xa0], 0x407f90
push eax
mov dword [esi + 0x74], 0x407ee0
mov dword [esi + 0x70], 0x407d10
mov dword [esi + 0x38], 0x407f20
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
push 3
push 4
push 0x47022c
mov edx, str.IELockHomepage
mov ecx, 0x4701c8
call fcn.00404220
test eax, eax
js 0x407c2f
push 3
push 0x48
push 0x4702c8
mov edx, str.ConfigBackup
mov ecx, str.REGISTRYUSERQMConfigQQDoctorQQDoctorComCfg
call fcn.00404220
call fcn.00405ff0
push 0x470d40
mov dword [0x470d7c], 0x470d78
mov dword [0x470d78], 0x470d78
call dword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
call fcn.00405620
push 0x405440
call dword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
test eax, eax
js 0x407c83
push 0
push 0x405560
call dword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
test eax, eax
jns 0x407c83
push 0x405440
call dword [sym.imp.ntoskrnl.exe_PsRemoveLoadImageNotifyRoutine]
call fcn.00401f80
call fcn.004010e0
call fcn.004073a0
mov edx, dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov eax, dword [edx]
mov dword [0x4706ec], eax
movzx eax, byte [edx + 4]
mov byte [0x4706f0], al
mov eax, 0x4074c0
sub eax, edx
sub eax, 5
mov dword [0x4703dd], eax
push eax
mov eax, cr0
mov dword [0x470d20], eax
and eax, 0xfffeffff
mov cr0, eax
pop eax
mov eax, dword [0x4703dc]
mov dword [edx], eax
movzx eax, byte [0x4703e0]
mov byte [edx + 4], al
push eax
mov eax, dword [0x470d20]
mov cr0, eax
pop eax
mov ecx, esi
call fcn.004070b0
call fcn.00401ca0
push 0x470584
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8