Function at 0x14bb8
Capabilities:
Contain obfuscated stackstrings
Create device object
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x62]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], r12w
call fcn.0001dfe0
lea rcx, [0x0001e1f0]
mov edi, r12d
mov qword [0x00020ea8], r12
mov byte [0x00020b9c], r12b
mov byte [0x0002169c], r12b
call fcn.00011008
movzx ecx, byte [0x0002169e]
cmp al, r12b
lea rax, [0x000212b0]
lea r13d, [r12 + 1]
cmovne ecx, r13d
mov qword [0x000212b8], rax
mov qword [0x000212b0], rax
lea rax, [0x000212a0]
mov byte [0x0002169e], cl
lea rcx, [0x00020c88]
xor r8d, r8d
mov edx, r13d
mov qword [0x000210b8], r12
mov qword [0x000212a8], rax
mov qword [0x000212a0], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x00018524]
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
lea ebx, [r12 + 0x1f]
lea r15d, [r12 + 4]
cmp eax, r12d
lea r14d, [r12 + 2]
jl 0x14d0c
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, r15d
mov edx, r14d
mov dword [rsp + 0x48], ebx
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationThread]
mov rcx, qword [rsp + 0x40]
lea rax, [0x000216b0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rax, [0x000211d8]
lea rcx, [0x000211c0]
xor r8d, r8d
mov edx, r13d
mov qword [0x00020c60], r12
mov qword [0x000211e0], rax
mov qword [0x000211d8], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x00016be8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, r12d
jl 0x14db5
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, r15d
mov edx, r14d
mov dword [rsp + 0x48], ebx
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationThread]
mov rcx, qword [rsp + 0x40]
lea rax, [0x00021700]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov word [rsp + 0x30], r12w
lea rcx, [0x00021140]
mov ebx, 0x28
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x51544c46
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r12w
lea rcx, [0x00021200]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x49554c46
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], r12w
lea rcx, [0x000210c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x49494c46
mov qword [rsp + 0x20], 0x18
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
xor eax, eax
mov ebx, 0x33544c46
xor r8d, r8d
mov rcx, rbp
mov edx, ebx
mov byte [rsp + 0x50], r12b
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call qword [sym.imp.NDIS.SYS_NdisAllocateGenericObject]
mov qword [0x000216e8], rax
cmp rax, r12
jne 0x14e78
mov ebx, 0xc0000017
jmp 0x14f8f
mov ecx, 0x10
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x50], 0x80
mov word [rsp + 0x52], cx
mov rcx, rax
mov byte [rsp + 0x51], r13b
mov byte [rsp + 0x55], r13b
mov dword [rsp + 0x5c], r12d
mov dword [rsp + 0x58], ebx
call qword [sym.imp.NDIS.SYS_NdisAllocateNetBufferListPool]
mov qword [0x000216f0], rax
cmp rax, r12
je 0x14e6e
lea r8, [0x000216b8]
xor ecx, ecx
mov edx, r13d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
lea r8, [0x000216c0]
xor ecx, ecx
mov edx, r14d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
lea r8, [0x000216c8]
mov ecx, r14d
mov edx, r15d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
lea r8, [0x000216d0]
mov ecx, 0x17
mov edx, r15d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
lea r8, [0x000216d8]
mov ecx, r14d
mov edx, r15d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
lea r8, [0x000216e0]
mov ecx, 0x17
mov edx, r15d
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
movzx eax, word [rsi]
shr eax, 1
sub eax, r13d
movsxd rcx, eax
cmp rcx, r12
jl 0x14f8a
mov r8, qword [rsi + 8]
lea rdx, [r8 + rcx*2]
cmp word [rdx], 0x5c
je 0x14fcd
cmp word [rdx], 0x2f
je 0x14fcd
sub rcx, r13
sub eax, r13d
sub rdx, r14
cmp rcx, r12
jge 0x14f70
mov ebx, 0xc0000001
cmp ebx, r12d
mov byte [0x0002169c], r13b
jge 0x14fa0
call fcn.00015280
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.0001d990
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
add eax, r13d
mov rcx, r12
movsxd r9, eax
lea rdx, [r8 + r9*2]
cmp word [rdx], r12w
je 0x1500b
movzx eax, word [r8 + r9*2]
cmp ax, 0x2e
je 0x1500b
cmp rcx, 0x104
jge 0x1500b
add rdx, r14
mov word [rsp + rcx*2 + 0x60], ax
add edi, r13d
mov ax, word [rdx]
add rcx, r13
cmp ax, r12w
jne 0x14fe5
movsxd rax, edi
mov word [rsp + rax*2 + 0x60], r12w
cmp edi, r12d
je 0x14f8a
lea rax, [0x00020ca0]
lea rdi, [0x00020c40]
lea rdx, [0x0001e260]
mov ebx, 0x208
mov rcx, rdi
mov word [0x00020ca0], r12w
mov qword [0x00020c48], rax
mov word [0x00020c40], r12w
mov word [0x00020c42], bx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rax, [0x00020eb0]
lea r14, [0x000211e8]
lea rdx, [0x0001e280]
mov rcx, r14
mov word [0x00020eb0], r12w
mov qword [0x000211f0], rax
mov word [0x000211e8], r12w
mov word [0x000211ea], bx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea r11, [0x00020ea8]
mov r9d, 0x22
mov qword [rsp + 0x30], r11
mov r8, rdi
xor edx, edx
mov rcx, rbp
mov byte [rsp + 0x28], r12b
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r12d
mov ebx, eax
jl 0x14f8f
mov rax, qword [0x00020ea8]
mov rdx, rdi
mov rcx, r14
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, r12d
mov ebx, eax
jge 0x15126
mov rcx, qword [0x00020ea8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov qword [0x00020ea8], r12
jmp 0x14f8f
mov rax, qword [0x00020ea8]
lea rdx, [0x0001e1d0]
mov rcx, rsi
btr dword [rax + 0x30], 7
mov rax, qword [0x00020ea8]
or dword [rax + 0x30], 0x10
mov rdi, qword [0x00020ea8]
call fcn.000141a8
cmp eax, r12d
je 0x15162
mov edx, eax
mov rcx, rdi
call fcn.00014280
lea rdx, [0x0001e2b0]
mov rcx, rsi
call fcn.000141a8
mov dword [0x000216f8], eax
jmp 0x14f8f