Function at 0x13278
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
xor r15d, r15d
mov r12, rdx
mov rbp, rcx
lea edi, [r15 + 4]
mov qword [rsp + 0x40], r15
lea r13d, [r15 + 0x7a]
lea esi, [rdi + 0x3d]
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x58], edi
movzx r14d, si
mov word [rsp + 0x190], si
mov qword [0x00026268], rcx
call fcn.0001f740
lea rdx, [0x00025770]
lea rcx, [rsp + 0x120]
mov dword [rsp + 0x48], r15d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000258f0]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x60], edi
call fcn.000129a8
lea edi, [rsi - 0x40]
lea ebx, [rsi + 0x3f]
cmp dword [rsp + 0x48], r15d
je 0x133e0
lea rcx, [0x00024930]
lea rdx, [0x00025770]
mov r8, rbx
mov byte [0x0002625d], dil
call fcn.0001faf0
lea rcx, [0x000249b0]
lea rdx, [0x000257f0]
mov r8, rbx
call fcn.0001faf0
lea rcx, [0x00024a30]
lea rdx, [0x00025870]
mov r8, rbx
call fcn.0001faf0
lea rcx, [0x00024ab0]
lea rdx, [0x000258f0]
mov r8, rbx
call fcn.0001faf0
lea rcx, [0x00024b30]
lea rdx, [0x00025970]
mov r8, rbx
call fcn.0001faf0
lea rcx, [0x00024bb0]
lea rdx, [0x000259f0]
mov r8, rbx
call fcn.0001faf0
lea rcx, [0x00025230]
lea rdx, [0x00025a70]
mov r8, rbx
call fcn.0001faf0
lea rdx, [0x00024830]
lea rcx, [rsp + 0x80]
movzx ebx, si
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x50], r15
movzx esi, r13w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, r15d
cmp r15w, word [0x00024830]
je 0x13426
lea rax, [0x00024830]
add rax, 2
add edx, edi
cmp r15w, word [rax]
jne 0x1341a
movsxd rdi, edx
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x80]
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, r15d
jge 0x134e6
mov r14d, 1
lea rbp, [0x00024830]
mov r13d, 0xffff
lea r12d, [r14 + 0x40]
movzx eax, bx
sub ax, r12w
cmp ax, 0x19
ja 0x134c7
lea eax, [rsi - 0x61]
cmp ax, 0x19
ja 0x134c7
lea rcx, [rsp + 0x80]
mov rdx, rbp
mov word [rbp + rdi*2], bx
mov word [rbp + rdi*2 + 2], si
mov word [rbp + rdi*2 + 4], r15w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x80]
mov edx, 0x80
add bx, r14w
add si, r13w
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, r15d
jl 0x13466
mov rbp, qword [rsp + 0x180]
mov r12, qword [rsp + 0x188]
mov r14w, word [rsp + 0x190]
mov r13d, 0x7a
mov rcx, qword [rsp + 0x68]
lea rax, [0x00024830]
mov word [rax + rdi*2], r15w
mov word [rax + rdi*2 + 2], r15w
mov word [rax + rdi*2 + 4], r15w
cmp rcx, r15
je 0x1350e
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x50]
cmp rax, r15
je 0x13557
mov rcx, qword [rax + 0x40]
cmp rcx, r15
je 0x13529
cmp dword [rcx], 0x48524445
je 0x13557
lea rdx, [0x000248b0]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rdx, [0x00021240]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x58]
lea r9, [rsp + 0x198]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x64]
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.000129a8
mov esi, 1
cmp eax, r15d
jne 0x135ce
cmp dword [rsp + 0x198], esi
je 0x135ce
lea r8d, [rsi + 3]
lea r9, [rsp + 0x198]
lea rdx, [rsp + 0x90]
mov rcx, r12
mov dword [rsp + 0x198], esi
mov dword [rsp + 0x20], r8d
call fcn.000128dc
mov rcx, rbp
call fcn.00012b4c
lea rcx, [0x00028a90]
mov r8b, sil
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea r12, [0x00024830]
lea rcx, [rsp + 0x70]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edi, r15d
cmp r15w, word [0x00024830]
je 0x1361a
mov rax, r12
add rax, 2
add edi, esi
cmp r15w, word [rax]
jne 0x1360e
mov r9d, 0x22
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea edx, [r9 - 0x12]
mov rcx, rbp
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r15d
mov ebx, eax
movsxd rdi, edi
jge 0x136e3
mov rcx, qword [rsp + 0x40]
cmp rcx, r15
je 0x13664
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea eax, [r14 - 0x41]
cmp ax, 0x19
ja 0x138ee
lea eax, [r13 - 0x61]
cmp ax, 0x19
ja 0x138ee
lea rcx, [rsp + 0x70]
mov rdx, r12
mov word [r12 + rdi*2], r14w
mov word [r12 + rdi*2 + 2], r13w
mov word [r12 + rdi*2 + 4], r15w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r9d, 0x22
lea r11, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r11
lea edx, [r9 - 0x12]
mov rcx, rbp
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
mov eax, 0xffff
add r14w, si
add r13w, ax
cmp ebx, r15d
jl 0x13654
mov rax, qword [rsp + 0x40]
lea rdx, [0x000248b0]
mov rcx, qword [rax + 0x40]
mov dword [rcx], 0x48524445
mov rax, qword [rsp + 0x40]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
lea rdi, [rbp + 0x70]
mov ecx, 0x1b
mov ebx, eax
cmp eax, r15d
lea rax, [0x0001390c]
rep stosq qword [rdi], rax
lea rax, [fcn.000211a4]
cmovl ebx, r15d
mov qword [rbp + 0x68], rax
call fcn.00014200
mov rcx, rbp
mov qword [0x00028a80], r15
mov qword [0x00026290], r15
mov qword [0x00026298], r15
call fcn.00014838
mov rcx, rbp
call fcn.0001c718
cmp byte [0x00025bd8], r15b
jne 0x137f3
cmp dword [0x00026348], r15d
jne 0x137f3
mov r8d, dword [0x00026350]
mov edx, dword [0x00026354]
mov ecx, esi
call fcn.0001eef8
lea rdx, [0x00024930]
lea rcx, [rsp + 0x100]
mov dword [0x00026258], r15d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00024b30]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 4
lea r9, [0x00026258]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x100]
mov r8d, eax
mov dword [rsp + 0x20], eax
call fcn.000128dc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov qword [rsp + 0x180], r15
lea rcx, [0x00028358]
xor r8d, r8d
mov edx, esi
mov dword [0x00028340], esi
mov qword [0x00028348], r15
mov dword [0x00028350], r15d
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rcx, [0x000283c0]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x0001f418]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov edi, 0x1fffff
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x180]
xor r9d, r9d
mov edx, edi
mov qword [rsp + 0x20], r15
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], r15
mov dword [rsp + 0xb8], 0x200
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], r15
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, r15d
jl 0x138e4
mov rcx, qword [rsp + 0x180]
lea rax, [0x000283d8]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
btr dword [rcx + 0x30], 7
mov eax, ebx
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret