Function at 0x14fc4
Capabilities:
Create device object
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
cmp dword [0x1d924], 0
je 0x14fda
xor eax, eax
jmp 0x15346
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_sprintf]
push esi
push edi
lea eax, [ebp - 0x78]
push 0x14f42
push eax
call ebx
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push 0xf000f
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x2c], 0x50
mov dword [ebp - 0x30], ecx
call dword [sym.imp.ntoskrnl.exe_ZwCreateDirectoryObject]
test eax, eax
jl 0x15051
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
call dword [sym.imp.ntoskrnl.exe_IoGetConfigurationInformation]
add eax, 0x10
mov ecx, dword [eax]
mov dword [0x1d804], ecx
inc dword [eax]
push dword [0x1d804]
lea eax, [ebp - 0x78]
push 0x14f52
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
push 0x1d924
push 1
push 0x100
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1d8
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
mov dword [ebp - 4], eax
jl 0x15320
mov eax, dword [0x1d924]
mov esi, dword [eax + 0x28]
push 0x1c
pop ecx
mov eax, 0x1e946
lea edi, [esi + 0x100]
rep stosd dword es:[edi], eax
push dword [0x1d804]
lea eax, [ebp - 0x78]
push 0x14f6a
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x10]
push eax
lea edi, [esi + 0x188]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea eax, [ebp - 0x18]
push eax
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
call edi
push dword [0x1d804]
lea eax, [ebp - 0x78]
push 0x14f7e
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x10]
push eax
lea ebx, [esi + 0x190]
push ebx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea eax, [ebp - 0x18]
push eax
push ebx
call edi
mov ebx, dword [ebp + 8]
mov eax, 0x1e97c
mov dword [esi + 0x100], eax
mov dword [esi + 0x108], eax
mov dword [esi + 0x138], 0x1e992
mov dword [esi + 0x13c], 0x14d10
mov dword [esi + 0x158], 0x14ce2
mov dword [esi + 0x16c], 0x1ed18
mov dword [esi + 0x15c], 0x1edb6
mov dword [esi + 0x1a8], 1
mov dword [esi + 0x1ac], 0x1d868
mov dword [esi + 0x1b0], 0x1f602
mov dword [esi + 0x1b4], 0x1f630
mov dword [esi + 0x1b8], 0x1f74e
mov dword [esi + 0x1bc], 0x1f772
mov dword [esi + 0x1c0], 0x15674
mov dword [esi + 0x1c4], 0x1f5ec
call fcn.00014a47
xor edi, edi
push 0x18
push edi
push edi
lea eax, [esi + 0x170]
push 0x674e7652
lea ebx, [esi + 0x1a0]
push eax
mov dword [esi + 0x1a4], edi
mov word [ebx], di
mov word [esi + 0x1a2], di
call dword [sym.imp.ntoskrnl.exe_IoInitializeRemoveLockEx]
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_IoGetAttachedDeviceReference]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
push dword [0x1d924]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
cmp eax, edi
mov dword [esi + 0x198], eax
jne 0x15253
mov dword [ebp - 4], 0xc0000001
jmp 0x15320
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x19c], eax
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x20]
push eax
push edi
push 0x1cc98
push dword [esi + 0x19c]
call dword [sym.imp.ntoskrnl.exe_IoRegisterDeviceInterface]
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x152c8
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_IoSetDeviceInterfaceState]
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x152bc
cmp dword [esi + 0x1a4], edi
je 0x152af
push ebx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 4], eax
jmp 0x152cb
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x152cb
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 4], edi
jl 0x15320
push 0x18
push 0x49a
push 0x14f92
push 0
lea eax, [esi + 0x170]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireRemoveLockEx]
push 0
push 0x1228c
push dword [0x1d924]
call dword [sym.imp.ntoskrnl.exe_IoInitializeTimer]
mov dword [ebp - 4], eax
mov eax, dword [0x1d924]
and byte [eax + 0x1c], 0x7f
add esi, 0x1d0
push esi
call fcn.0001476e
mov eax, dword [0x1d924]
call fcn.00014e4e
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
jge 0x15343
call dword [sym.imp.ntoskrnl.exe_IoGetConfigurationInformation]
add eax, 0x10
dec dword [eax]
call fcn.00014c2a
mov eax, dword [ebp - 4]
leave
ret 8