Function at 0x10916
Capabilities:
Contain obfuscated stackstrings
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
push 0x5c
pop eax
xor edi, edi
mov word [ebp - 0x4c], ax
mov word [ebp - 0x4a], 0x44
mov word [ebp - 0x48], 0x65
mov word [ebp - 0x46], 0x76
mov word [ebp - 0x44], 0x69
mov word [ebp - 0x42], 0x63
mov word [ebp - 0x40], 0x65
mov word [ebp - 0x3e], ax
mov word [ebp - 0x3c], 0x6d
mov word [ebp - 0x3a], 0x61
mov word [ebp - 0x38], 0x73
mov word [ebp - 0x36], 0x70
mov word [ebp - 0x34], 0x69
mov word [ebp - 0x32], di
mov word [ebp - 0x30], ax
mov word [ebp - 0x2e], 0x3f
mov word [ebp - 0x2c], 0x3f
mov word [ebp - 0x2a], ax
mov word [ebp - 0x28], 0x6d
mov word [ebp - 0x26], 0x61
mov word [ebp - 0x24], 0x73
mov word [ebp - 0x22], 0x70
mov word [ebp - 0x20], 0x69
mov word [ebp - 0x1e], di
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1f01ff
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
cmp ecx, edi
jge 0x10a02
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, ecx
jmp 0x10c03
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0xb
lea eax, [ebp - 0x14]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
cmp esi, edi
jge 0x10a83
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
jmp 0x10c02
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
cmp esi, edi
jl 0x10a73
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x28]
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeSpinLock]
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov dword [esi + 0x10], edi
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov ecx, eax
cmp ecx, edi
jne 0x10b5d
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, 0xc000009a
jmp 0x10c02
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ecx + 0x2c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 4]
and byte [eax + 0x1c], 0x7f
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
and edx, 0x14
or dword [eax + 0x1c], edx
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, dword [ecx + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
xor eax, eax
pop esi
pop edi
leave
ret 0xc