Function at 0x1583c
Capabilities:
Create device object

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rbx, rcx
lea rcx, [0x0020f1d0]
xor r12d, r12d
mov rbp, rdx
mov qword [rax + 0x10], r12
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
lea rdx, [0x00015818]
lea rcx, [rsp + 0x40]
mov qword [rbx + 0x70], rdx
mov qword [rbx + 0x80], rdx
mov qword [rbx + 0x90], rdx
mov qword [rbx + 0x88], rdx
mov qword [rbx + 0xf0], rdx
lea rdx, [0x00018c40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xe8]
lea r9d, [r12 + 0x22]
mov qword [rsp + 0x30], rdx
lea r8, [rsp + 0x40]
lea edx, [r12 + 0x38]
mov rcx, rbx
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r12d
jl 0x158ed
mov rax, qword [rsp + 0xe8]
or dword [rax + 0x30], 4
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov rax, qword [rbx + 0x28]
mov qword [0x0020f3b0], rax
cmp word [rax + 0x5a], r12w
je 0x159bc
mov esi, 0x104
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [0x0020f350], rax
cmp rax, r12
je 0x1594c
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.00016910
mov r9, qword [0x0020f3b0]
lea r8, [0x00018ca0]
mov r9, qword [r9 + 0x60]
mov rdx, rsi
mov rcx, rdi
call fcn.00011008
mov rax, qword [0x0020f3b0]
movzx ecx, word [rax + 0x5a]
add ecx, 0x40
movsxd rdx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r12
je 0x159b5
mov rdi, qword [0x0020f3b0]
xor edx, edx
movzx ecx, word [rdi + 0x5a]
add ecx, 0x40
movsxd r8, ecx
mov rcx, rax
call fcn.00016910
movzx edx, word [rdi + 0x5a]
mov r9, qword [rdi + 0x60]
add edx, 0x40
lea r8, [0x00018cf0]
mov rcx, rsi
movsxd rdx, edx
call fcn.00011008
lea rcx, [0x0020f1a8]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0020f3b0]
cmp word [rax + 0x4a], r12w
je 0x15a25
movzx eax, word [rax + 0x4a]
xor ecx, ecx
add eax, 0x40
movsxd rdx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r12
je 0x15a25
mov rdi, qword [0x0020f3b0]
xor edx, edx
movzx ecx, word [rdi + 0x4a]
add ecx, 0x40
movsxd r8, ecx
mov rcx, rax
call fcn.00016910
movzx edx, word [rdi + 0x4a]
mov r9, qword [rdi + 0x60]
add edx, 0x40
lea r8, [0x00018d20]
mov rcx, rsi
movsxd rdx, edx
call fcn.00011008
lea rcx, [0x0020f1b8]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp word [rbp + 2], r12w
je 0x15a78
movzx edx, word [rbp + 2]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, r12
je 0x15a78
movzx r8d, word [rbp + 2]
xor edx, edx
mov rcx, rax
add r8, 2
call fcn.00016910
movzx r8d, word [rbp]
mov rdx, qword [rbp + 8]
mov rcx, rdi
call fcn.00016ab0
lea rcx, [0x0020f2e8]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rsi, qword [0x0020f2f0]
mov edi, 0x208
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
cmp rax, r12
je 0x15b02
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00016910
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rdx, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
mov rcx, rbp
call fcn.00016ab0
mov rdx, rsi
cmp word [rsi], r12w
je 0x15ad8
add rdx, 2
cmp word [rdx], r12w
jne 0x15acc
jmp 0x15ae2
cmp word [rdx], 0x5c
je 0x15aea
sub rdx, 2
cmp rsi, rdx
jbe 0x15ad8
mov rdx, r12
cmp rdx, r12
je 0x15b02
add rdx, 2
je 0x15b02
lea rcx, [0x0020f328]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0xf0], r12
lea r8d, [rdx + 0x28]
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0x80], r12d
call fcn.00016910
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x00017710]
lea rdx, [0x00017690]
repne scasw ax, word [rdi]
lea rdi, [0x00013418]
mov rax, qword [rdi]
not rcx
mov qword [0x0020f338], rax
mov eax, dword [rdi + 8]
dec rcx
mov dword [0x0020f340], eax
movzx eax, word [rdi + 0xc]
add ecx, ecx
mov word [0x0020f344], ax
mov al, byte [rdi + 0xe]
mov dword [0x0020f348], ecx
lea rcx, [rsp + 0x50]
mov byte [0x0020f346], al
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, r12d
jl 0x15c36
lea rdx, [0x000172b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x60]
call fcn.00011078
cmp al, r12b
jne 0x15c36
lea r8, [0x0020f1a0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallback]
lea rcx, [0x000155e8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
lea rdi, [0x0020f2f8]
mov edx, 0xa8
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rdi], rax
add rdi, 8
mov dword [rax + 0x68], 0x5f5dca8
lea rax, [0x0020f328]
cmp rdi, rax
jl 0x15c4c
lea rdx, [0x00018d60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x70]
call fcn.00011078
mov rcx, rbx
cmp al, r12b
je 0x15ca3
xor r8d, r8d
xor edx, edx
call fcn.000157b4
jmp 0x15cb3
lea rdx, [fcn.000157b4]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_IoRegisterBootDriverReinitialization]
lea rax, [0x00015750]
mov qword [rbx + 0x68], rax
xor eax, eax
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret