Function at 0x1108f
Capabilities:
Check os version
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 0x13fe4
push 0x13fec
call sub.ntoskrnl.exe_PsGetVersion
mov eax, dword [0x13fec]
or dword [0x13780], 0xffffffff
push 2
pop esi
push 5
pop edx
cmp eax, edx
jne 0x110ec
mov eax, dword [0x13fe4]
cmp eax, esi
jne 0x110d1
mov dword [0x13780], ebx
jmp 0x1112d
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x110e0
mov dword [0x13780], ecx
jmp 0x1112d
cmp eax, ebx
jne 0x11122
mov dword [0x13780], esi
jmp 0x1112d
push 4
pop ecx
cmp eax, ecx
jne 0x11107
cmp dword [0x13fe4], ebx
jne 0x11122
mov dword [0x13780], 3
jmp 0x1112d
cmp eax, 6
jne 0x11122
mov eax, dword [0x13fe4]
cmp eax, ebx
je 0x110d8
cmp eax, 1
jne 0x11122
mov dword [0x13780], edx
jmp 0x1112d
push 0x10fec
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov eax, dword [0x13780]
sub eax, ebx
je 0x1117a
dec eax
je 0x1116e
dec eax
je 0x11162
sub eax, esi
je 0x11156
dec eax
je 0x1114a
xor eax, eax
jmp 0x112f5
mov dword [0x137c0], 0x16c
jmp 0x11184
mov dword [0x137c0], 0x14c
jmp 0x11184
mov dword [0x137c0], 0x1fc
jmp 0x11184
mov dword [0x137c0], 0x174
jmp 0x11184
mov dword [0x137c0], 0x154
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
push 0x11010
lea eax, [ebp - 0xc]
push eax
call esi
push 0x11038
mov edi, 0x137b8
push edi
call esi
push 0x8000202c
push 0x11068
call sub.ntoskrnl.exe_DbgPrint
mov esi, dword [ebp + 8]
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push ebx
push 0x100
push 8
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
jl 0x112f4
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x111f7
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x112f1
mov dword [esi + 0x34], 0x10676
mov dword [esi + 0x38], 0x10c2c
mov dword [esi + 0x40], 0x10c2c
mov dword [esi + 0x70], 0x10cba
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax + 8]
shl ecx, 2
push ecx
push dword [eax]
push ebx
call dword [sym.imp.ntoskrnl.exe_MmCreateMdl]
cmp eax, ebx
mov dword [0x1378c], eax
jne 0x1123b
mov eax, 0xc0000001
jmp 0x112f4
push eax
call dword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov eax, dword [0x1378c]
or byte [eax + 6], 1
push ebx
push dword [0x1378c]
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov dword [0x13790], eax
mov edi, dword [ecx]
mov esi, dword [edx + 1]
mov esi, dword [edi + esi*4]
mov dword [0x1377c], esi
mov ebx, dword [ecx]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
mov edi, dword [esi + 1]
mov edi, dword [ebx + edi*4]
mov dword [0x13784], edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ecx, dword [ecx]
mov ebx, dword [edi + 1]
mov ecx, dword [ecx + ebx*4]
mov dword [0x13fe0], ecx
mov edx, dword [edx + 1]
mov ecx, 0x1083d
lea eax, [eax + edx*4]
xchg dword [eax], ecx
mov edx, dword [0x13790]
mov dword [0x1377c], ecx
mov ecx, dword [esi + 1]
mov eax, 0x10b35
lea ecx, [edx + ecx*4]
xchg dword [ecx], eax
mov edx, dword [0x13790]
mov dword [0x13784], eax
mov ecx, dword [edi + 1]
mov eax, 0x10ed6
lea ecx, [edx + ecx*4]
xchg dword [ecx], eax
push 1
push 1
push 0x137a0
mov dword [0x13fe0], eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8