Function at 0x2df40
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1253c]
test eax, eax
mov ecx, 0xbb40
je 0x2df57
cmp eax, ecx
jne 0x2df77
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x1253c
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x1253c], eax
je 0x2ec7f
not eax
mov dword [0x12538], eax
pop ebp
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x2e20e
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x127f8
xor ebx, ebx
push ebx
push ebx
push 0x11
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x2e203
push dword [0x127f8]
call sub.ntoskrnl.exe_IoAllocateWorkItem
cmp eax, ebx
mov dword [0x127a0], eax
je 0x2e1fc
push ebx
push ebx
push 0x127c0
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
call fcn.0002e27b
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x2e203
call fcn.0002db85
call fcn.0002e46f
mov eax, dword [0x1277c]
push 0x20
push 0xf2646641
add eax, 0x268
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
cmp eax, ebx
mov dword [0x127fc], eax
je 0x2e1fc
push eax
call dword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
call fcn.0002dd2d
push dword [0x1200c]
push dword [0x1278c]
call fcn.0001e856
mov esi, dword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
xor ecx, ecx
mov cx, word [0x1279c]
mov edi, 0xc2646641
push ecx
push edi
push eax
mov eax, dword [0x127fc]
push ebx
push fcn.0002006f
push 0x1e7c5
add eax, 0x38
push eax
call esi
push dword [0x1200c]
push dword [section..data]
call fcn.0001e856
mov ecx, dword [0x127fc]
cmp eax, dword [ecx + 0x5c]
je 0x2eb90
xor edx, edx
mov dx, word [0x12798]
add ecx, 0x88
push edx
push edi
push eax
push ebx
push fcn.0002006f
push 0x1e7c5
push ecx
call esi
push dword [0x1200c]
push dword [0x12004]
call fcn.0001e856
mov ecx, dword [0x127fc]
cmp eax, dword [ecx + 0xac]
je 0x2eba1
xor edx, edx
mov dx, word [0x12794]
add ecx, 0xd8
push edx
push edi
push eax
push ebx
push fcn.0002006f
push 0x1e7c5
push ecx
call esi
xor eax, eax
mov ax, word [0x12790]
push eax
mov eax, dword [0x127fc]
push edi
push 0x30
push ebx
push 0x200d4
push 0x1ca8d
add eax, 0x128
push eax
call esi
xor eax, eax
mov al, byte [0x12010]
dec al
push ebx
push 0xc6646641
push eax
push 2
push dword [0x12028]
call fcn.0002dcf6
push eax
mov eax, dword [0x127fc]
push ebx
push 0x2a54e
push 0x2a497
add eax, 0x178
push eax
call esi
xor eax, eax
mov ax, word [0x12790]
push eax
mov eax, dword [0x127fc]
push 0xd2646641
push dword [0x1200c]
add eax, 0x1c8
push ebx
push 0x1ec5d
push 0x1ebb7
push eax
call esi
mov eax, dword [0x127fc]
mov dword [eax + 0x218], ebx
call fcn.0002e231
test al, al
je 0x2e1fc
mov edx, dword [ebp + 8]
push 0x1c
lea edi, [edx + 0x38]
pop ecx
mov eax, 0x1bd50
rep stosd dword es:[edi], eax
mov dword [edx + 0x70], fcn.0001b290
mov dword [edx + 0x28], 0x12030
mov dword [edx + 0x34], 0x174a0
mov eax, dword [0x127f8]
or dword [eax + 0x1c], 0x10
mov eax, dword [0x127f8]
mov cl, byte [0x12010]
mov byte [eax + 0x30], cl
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp dword [0x12660], ebx
mov dword [0x127b0], eax
jne 0x2ec74
push 0x2df84
mov dword [0x1257c], ebx
call dword [sym.imp.ntoskrnl.exe_MmPageEntireDriver]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp - 4], 0xc000009a
call fcn.00017375
jmp 0x2ebb2
mov edx, dword [0x1278c]
mov dword [section..data], edx
jmp 0x2e091
mov edx, dword [section..data]
mov dword [0x12004], edx
jmp 0x2e0d4
mov eax, dword [0x1256c]
cmp eax, ebx
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
je 0x2ebcb
push ebx
push eax
call edi
mov dword [0x1256c], ebx
mov eax, dword [0x127fc]
cmp eax, ebx
je 0x2ec40
mov esi, dword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
add eax, 0x38
push eax
call esi
mov eax, dword [0x127fc]
add eax, 0x88
push eax
call esi
mov eax, dword [0x127fc]
add eax, 0xd8
push eax
call esi
mov eax, dword [0x127fc]
add eax, 0x128
push eax
call esi
mov eax, dword [0x127fc]
add eax, 0x178
push eax
call esi
mov eax, dword [0x127fc]
add eax, 0x1c8
push eax
call esi
push dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExDeleteResourceLite]
push 0xf2646641
push dword [0x127fc]
call edi
mov dword [0x127fc], ebx
mov eax, dword [0x127a0]
cmp eax, ebx
je 0x2ec55
push eax
call sub.ntoskrnl.exe_IoFreeWorkItem
mov dword [0x127a0], ebx
mov eax, dword [0x127f8]
cmp eax, ebx
je 0x2e1f2
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [0x127f8], ebx
jmp 0x2e1f2
push ebx
call fcn.0001765c
jmp 0x2e1e1
mov eax, ecx
mov dword [0x1253c], eax
jmp 0x2df77