Function at 0x14000a000
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov dword [rsp + 0x40], 0
call fcn.140004a60
cmp dword [0x1400102e0], 0x2800
jae 0x14000a034
mov eax, 0xc0000424
jmp 0x14000a393
mov eax, 0x1e
mov word [rsp + 0x50], ax
mov eax, 0x20
mov word [rsp + 0x52], ax
lea rax, [0x14000e270]
mov qword [rsp + 0x58], rax
mov eax, 0x16
mov word [rsp + 0x60], ax
mov eax, 0x18
mov word [rsp + 0x62], ax
lea rax, [0x14000e290]
mov qword [rsp + 0x68], rax
mov eax, 0x14
mov word [rsp + 0xa8], ax
mov eax, 0x16
mov word [rsp + 0xaa], ax
lea rax, [0x14000e2b0]
mov qword [rsp + 0xb0], rax
mov eax, 0x14
mov word [rsp + 0x70], ax
mov eax, 0x16
mov word [rsp + 0x72], ax
lea rax, [0x14000e2d0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000a11f
lfence
mov edx, dword [rsp + 0x40]
lea rcx, [0x14000e2f0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x40]
jmp 0x14000a393
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000a161
lfence
mov edx, dword [rsp + 0x40]
lea rcx, [0x14000e320]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [rsp + 0x40]
jmp 0x14000a393
movzx eax, byte [0x1400102c0]
test eax, eax
jne 0x14000a2e3
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 3
lea rax, [0x14000a490]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xe8], 3
lea rax, [0x14000a5b0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0
mov eax, 0x100
mov word [rsp + 0x80], ax
mov eax, 2
mov word [rsp + 0x82], ax
mov eax, 0x14
mov word [rsp + 0x88], ax
mov eax, 0x16
mov word [rsp + 0x8a], ax
lea rax, [0x14000e2b0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xa0], rax
lea rdx, [0x1400102e8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000a282
lfence
mov edx, dword [rsp + 0x40]
lea rcx, [0x14000e360]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x40], 0
mov byte [0x1400102c5], 0
mov byte [0x1400102c6], 0
mov qword [rsp + 0x28], 0
lea rax, [0x140016cc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x110]
lea rdx, [rsp + 0x70]
lea rcx, [0x14000a6e0]
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14000a2e1
lfence
mov edx, dword [rsp + 0x40]
lea rcx, [0x14000e3a0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x40], 0
mov byte [0x1400102c4], 0
jmp 0x14000a30a
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x30]
or eax, 4
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x30], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x30]
btr eax, 7
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x30], eax
mov rax, qword [rsp + 0x110]
lea rcx, [0x14000a3a0]
mov qword [rax + 0x68], rcx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x110]
lea rdx, [0x1400073f0]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 2
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x110]
mov rax, qword [r8 + rax + 0x70]
mov qword [rdx + rcx + 0x70], rax
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x110]
lea rdx, [0x140007430]
mov qword [rcx + rax + 0x70], rdx
lea rcx, [0x14000e3e0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x40]
add rsp, 0x108
ret