Function at 0x106fa
Capabilities:
Contain obfuscated stackstrings
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
push 0x5c
pop eax
xor edi, edi
mov word [ebp - 0x44], ax
mov word [ebp - 0x42], 0x44
mov word [ebp - 0x40], 0x65
mov word [ebp - 0x3e], 0x76
mov word [ebp - 0x3c], 0x69
mov word [ebp - 0x3a], 0x63
mov word [ebp - 0x38], 0x65
mov word [ebp - 0x36], ax
mov word [ebp - 0x34], 0x6d
mov word [ebp - 0x32], 0x61
mov word [ebp - 0x30], 0x73
mov word [ebp - 0x2e], 0x70
mov word [ebp - 0x2c], 0x69
mov word [ebp - 0x2a], di
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], 0x3f
mov word [ebp - 0x24], 0x3f
mov word [ebp - 0x22], ax
mov word [ebp - 0x20], 0x6d
mov word [ebp - 0x1e], 0x61
mov word [ebp - 0x1c], 0x73
mov word [ebp - 0x1a], 0x70
mov word [ebp - 0x18], 0x69
mov word [ebp - 0x16], di
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x22
lea eax, [ebp - 0xc]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
cmp ecx, edi
jl 0x10835
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
cmp ecx, edi
jge 0x1083c
mov eax, ecx
jmp 0x10910
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x28]
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeSpinLock]
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov dword [esi + 0x10], edi
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov ecx, eax
cmp ecx, edi
jne 0x108bd
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, 0xc000009a
jmp 0x10910
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ebp - 4]
or word [eax + 0x1c], 0x2004
mov eax, dword [ebp - 4]
and byte [eax + 0x1c], 0x7f
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
xor eax, eax
pop edi
pop esi
leave
ret 8