Function at 0x15264
Capabilities:
Create device object
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x228], esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1846a
mov dword [ebp - 0x210], ebx
mov dword [0x1a468], ebx
mov byte [0x1a220], bl
mov byte [0x1a760], bl
call fcn.00011006
test al, al
je 0x152d2
mov byte [0x1a762], 1
mov eax, 0x1a758
push ebx
mov dword [0x1a75c], eax
mov dword [0x1a758], eax
mov eax, 0x1a750
push 0x1511e
push 0x1a240
mov dword [0x1a754], eax
mov dword [0x1a750], eax
mov dword [0x1a46c], ebx
call dword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
push ebx
mov eax, 0x1a6d8
push 1
push 0x1a4c0
mov dword [0x1a224], ebx
mov dword [0x1a6dc], eax
mov dword [0x1a6d8], eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
push ebx
push 0x14c04
push ebx
push ebx
push ebx
push 0x1fffff
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jl 0x1536a
push ebx
push 0x1a77c
push ebx
push ebx
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, dword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
push ebx
push 0x51544c46
push 0x20
push ebx
push ebx
push ebx
push 0x1a470
call edi
push ebx
push 0x49554c46
push 0x18
push ebx
push ebx
push ebx
push 0x1a6e8
call edi
mov byte [ebp - 0x224], bl
xor eax, eax
lea edi, [ebp - 0x223]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
mov edi, 0x33544c46
push edi
push esi
call dword [sym.imp.NDIS.SYS_NdisAllocateGenericObject]
mov dword [0x1a774], eax
cmp eax, ebx
jne 0x153c9
mov edi, 0xc0000017
jmp 0x155c8
push 0x10
pop ecx
mov word [ebp - 0x222], cx
lea ecx, [ebp - 0x224]
push ecx
push eax
mov byte [ebp - 0x224], 0x80
mov byte [ebp - 0x223], 1
mov byte [ebp - 0x21f], 1
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], edi
call dword [sym.imp.NDIS.SYS_NdisAllocateNetBufferListPool]
mov dword [0x1a778], eax
cmp eax, ebx
je 0x153bf
push 0x1a764
push 1
push ebx
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov edi, eax
cmp edi, ebx
jl 0x155c8
push 0x1a768
push 2
push ebx
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov edi, eax
cmp edi, ebx
jl 0x155c8
push 0x1a76c
push 4
push 2
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov edi, eax
cmp edi, ebx
jl 0x155c8
push 0x1a770
push 4
push 0x17
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov edi, eax
cmp edi, ebx
jl 0x155c8
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx]
shr eax, 1
dec eax
js 0x154d9
mov edx, dword [ecx + 4]
lea ecx, [edx + eax*2]
movzx edi, word [ecx]
cmp di, 0x5c
je 0x15492
cmp di, 0x2f
je 0x15492
dec eax
dec ecx
dec ecx
cmp eax, ebx
jge 0x1547a
jmp 0x154d9
inc eax
jmp 0x154bc
cmp cx, 0x2e
je 0x154c5
cmp dword [ebp - 0x210], 0x104
jge 0x154c5
mov esi, dword [ebp - 0x210]
inc eax
inc dword [ebp - 0x210]
mov word [ebp + esi*2 - 0x20c], cx
movzx ecx, word [edx + eax*2]
cmp cx, bx
jne 0x15495
mov eax, dword [ebp - 0x210]
xor ecx, ecx
mov word [ebp + eax*2 - 0x20c], cx
cmp eax, ebx
jne 0x154e3
mov edi, 0xc0000001
jmp 0x155c8
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
xor eax, eax
mov word [0x1a260], ax
mov word [0x1a210], ax
push 0x1844c
mov eax, 0x208
mov esi, 0x1a210
push esi
mov dword [0x1a214], 0x1a260
mov word [0x1a212], ax
call edi
lea eax, [ebp - 0x20c]
push eax
push esi
call edi
xor eax, eax
mov word [0x1a4d0], ax
mov word [0x1a6e0], ax
push 0x18426
mov eax, 0x208
push 0x1a6e0
mov dword [0x1a6e4], 0x1a4d0
mov word [0x1a6e2], ax
call edi
lea eax, [ebp - 0x20c]
push eax
push 0x1a6e0
call edi
push 0x1a468
push ebx
push 0x100
push 0x22
push esi
push ebx
push dword [ebp - 0x228]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
cmp edi, ebx
jl 0x155c8
mov eax, dword [0x1a468]
and dword [eax + 0x1c], 0xffffff7f
push esi
push 0x1a6e0
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
cmp edi, ebx
jge 0x155b3
push dword [0x1a468]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [0x1a468], ebx
jmp 0x155c8
mov eax, dword [0x1a468]
and dword [eax + 0x1c], 0xffffff7f
mov eax, dword [0x1a468]
or dword [eax + 0x1c], 0x10
cmp edi, ebx
mov byte [0x1a760], 1
jge 0x155d8
call fcn.00012af6
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00017e51
leave
ret 8