Function at 0x140001490
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x6b8
mov dword [rsp + 0x40], 0xc0000001
mov eax, 0x62
mov word [rsp + 0x68], ax
mov eax, 0x64
mov word [rsp + 0x6a], ax
lea rax, [0x1400039b0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x90], 0x240
lea rax, [rsp + 0x68]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x78]
mov edx, 0xf003f
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jge 0x140001551
mov eax, dword [rsp + 0x40]
jmp 0x1400017be
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rax, [rsp + 0xb0]
lea rcx, [0x140003a20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xfa]
mov rdi, rax
xor eax, eax
mov ecx, 0x1b4
rep stosb byte [rdi], al
mov edx, 8
lea rcx, [rsp + 0xb0]
call fcn.140002858
mov qword [rsp + 0x50], 0
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.140002814
mov dword [0x140005040], eax
mov dword [rsp + 0x20], 4
lea r9, [0x140005040]
mov r8d, 4
lea rdx, [0x140003a70]
lea rcx, [0x1400039b0]
call fcn.1400029ec
lea rax, [rsp + 0x2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea r9, [rsp + 0xb0]
lea r8, [0x140003a90]
mov edx, 0x24
lea rcx, [rsp + 0x2b0]
call fcn.1400017c8
lea rdx, [rsp + 0x2b0]
lea rcx, [0x140005028]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140005038], rax
cmp qword [0x140005038], 0
jne 0x140001666
mov eax, 0xc0000001
jmp 0x1400017be
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [0x140005038]
call fcn.140003600
lea rax, [rsp + 0x4b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea r9, [rsp + 0xb0]
lea r8, [0x140003ab0]
mov edx, 0x24
lea rcx, [rsp + 0x4b0]
call fcn.1400017c8
lea rdx, [rsp + 0x4b0]
mov rcx, qword [0x140005038]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x20], 0xa
lea r9, [rsp + 0xb0]
mov r8d, 1
lea rdx, [0x140003ad0]
lea rcx, [0x1400039b0]
call fcn.1400029ec
lea rax, [0x140005020]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
lea r8, [0x140005028]
xor edx, edx
mov rcx, qword [rsp + 0x6d0]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140001737
mov eax, dword [rsp + 0x40]
jmp 0x1400017be
lea rdx, [0x140005028]
mov rcx, qword [0x140005038]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140001769
mov rcx, qword [0x140005020]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [rsp + 0x40]
jmp 0x1400017be
mov dword [rsp + 0x44], 0
jmp 0x14000177d
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x1b
jg 0x14000179f
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x6d0]
lea rdx, [0x140001380]
mov qword [rcx + rax*8 + 0x70], rdx
jmp 0x140001773
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x6d0]
lea rdx, section..text
mov qword [rcx + rax + 0x70], rdx
xor eax, eax
add rsp, 0x6b8
pop rdi
pop rsi
ret