Function at 0x140003818
Capabilities:
Create device object
Print debug messages

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, rcx
xor ebx, ebx
mov r12b, bl
mov byte [rax - 0x58], bl
lea r9, [rax + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
mov rax, qword [0x14000a350]
call rax
test eax, eax
jns 0x140003bb4
mov eax, dword [rsp + 0xa8]
add eax, 8
mov dword [rsp + 0xa8], eax
mov edx, eax
shl rdx, 3
mov r14d, 0x6e654653
mov r8d, r14d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140003892
mov eax, 0xc000009a
jmp 0x140003bb4
mov r8d, dword [rsp + 0xa8]
shl r8d, 3
lea r9, [rsp + 0xa8]
mov rdx, rdi
mov rcx, qword [r13 + 8]
mov rax, qword [0x14000a350]
call rax
mov esi, eax
test eax, eax
jns 0x1400038cf
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x140003bb4
lea rdx, [0x14000a3c0]
lea rcx, [rsp + 0x50]
call fcn.140005038
test eax, eax
jns 0x140003915
cmp dword [rsp + 0xa8], ebx
jbe 0x140003904
mov ecx, ebx
mov rcx, qword [rdi + rcx*8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
inc ebx
cmp ebx, dword [rsp + 0xa8]
jb 0x1400038ed
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140003ba6
mov esi, ebx
mov dword [rsp + 0xb0], esi
cmp esi, dword [rsp + 0xa8]
jae 0x140003b8f
mov rax, qword [rsp + 0x50]
mov word [rax], bx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xb8], rbx
mov r14d, esi
mov rcx, qword [rdi + r14*8]
cmp rcx, r13
je 0x140003b38
mov eax, dword [r13 + 0x48]
cmp dword [rcx + 0x48], eax
jne 0x140003b38
xor edx, edx
call fcn.1400048e4
test al, al
jne 0x140003b38
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi + r14*8]
call fcn.14000482c
test eax, eax
js 0x140003b38
mov rax, qword [rsp + 0x50]
cmp word [rax], bx
ja 0x140003b38
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + r14*8]
mov rax, qword [0x14000a368]
call rax
test eax, eax
jns 0x1400039b0
mov qword [rsp + 0x48], rbx
jmp 0x140003b38
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call fcn.140004968
test eax, eax
js 0x140003a34
cmp byte [rsp + 0xa0], bl
je 0x140003a34
mov eax, dword [0x14000a398]
test al, 0x20
jne 0x140003a34
lea rdx, [0x14000a3c0]
mov rcx, qword [rsp + 0x48]
call fcn.14000e274
mov r15, rax
mov ecx, dword [0x14000a398]
test cl, 1
je 0x140003a17
lea r8, [0x14000a030]
test rax, rax
cmovne r8, rax
mov rdx, qword [rsp + 0x48]
lea rcx, [0x140007000]
call sub.ntoskrnl.exe_DbgPrint
test r15, r15
je 0x140003b38
lea rdx, [0x14000a3c0]
mov rcx, r15
call fcn.1400050d4
jmp 0x140003b38
mov rax, qword [rdi + r14*8]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], ebx
mov r9d, dword [rax + 0x48]
xor r8d, r8d
lea edx, [r8 + 0x3c]
mov rcx, qword [0x14000a388]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x140003b30
mov rax, qword [rsp + 0xb8]
mov r15, qword [rax + 0x40]
mov dword [r15 + 0x38], ebx
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0xb8]
mov rcx, r15
call fcn.140005690
mov rax, qword [rsp + 0x50]
mov word [rax], bx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.14000e320
test eax, eax
js 0x140003b38
lea rcx, [r15 + 0x28]
mov r8d, 0x6e764653
mov rdx, qword [rsp + 0x50]
call fcn.14000e1ac
test eax, eax
js 0x140003b38
lea rcx, [0x14000b600]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov r12b, 1
mov byte [rsp + 0x40], r12b
mov rcx, qword [rdi + r14*8]
xor edx, edx
call fcn.1400048e4
test al, al
jne 0x140003b38
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rdi + r14*8]
call fcn.140003308
test eax, eax
js 0x140003b38
lea rcx, [0x14000b600]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov r12b, bl
mov byte [rsp + 0x40], bl
mov eax, dword [0x14000a398]
test al, 0x40
je 0x140003b30
mov rdx, r15
mov rcx, qword [rsp + 0xb8]
call fcn.14000e2a4
mov qword [rsp + 0xb8], rbx
test r12b, r12b
je 0x140003b4a
lea rcx, [0x14000b600]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003b5a
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x140003b7e
mov rcx, qword [rcx + 0x40]
call fcn.1400050a0
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov rcx, qword [rdi + r14*8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
inc esi
jmp 0x140003917
lea rdx, [0x14000a3c0]
mov rcx, qword [rsp + 0x50]
call fcn.1400050d4
mov r14d, 0x6e654653
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret