Function at 0x1681c
Capabilities:
Create device object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov r12d, ecx
xor esi, esi
mov rdi, rdx
repne scasw ax, word [rdi]
mov ebx, 0xc8
mov r13, rdx
not rcx
mov qword [r11 + 0x20], rsi
dec rcx
mov r15, rcx
cmp ecx, ebx
jae 0x16af9
lea r9d, [rsi + 0xb]
cmp dword [r14 + 0x48], r9d
jne 0x16af9
mov rcx, qword [0x000453a8]
lea rax, [r11 + 0x20]
mov edi, 0x1a0
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, edi
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, esi
jl 0x16af9
mov rax, qword [rsp + 0xd8]
mov ecx, dword [r14 + 0x30]
mov r8, rdi
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0xd8]
xor edx, edx
btr dword [rax + 0x30], 7
mov rax, qword [rsp + 0xd8]
and dword [rax + 0x30], 0xffffffbf
mov rcx, qword [rsp + 0xd8]
mov rcx, qword [rcx + 0x40]
call fcn.0001de80
mov rdx, qword [rsp + 0xd8]
mov rdi, qword [rdx + 0x40]
mov edx, r15d
lea rax, [rdi + 0xa]
cmp rdx, 0x7ffffffe
ja 0x1692f
mov r8, r13
sub r8, rax
cmp rdx, rsi
je 0x16926
movzx ecx, word [r8 + rax]
cmp cx, si
je 0x16926
dec rbx
mov word [rax], cx
dec rdx
add rax, 2
cmp rbx, rsi
jne 0x16905
cmp rbx, rsi
jne 0x1692f
sub rax, 2
mov word [rax], si
mov eax, 1
lock xadd dword [0x000271ec], eax
inc eax
lea rcx, [0x00051810]
mov dword [rdi + 0x19c], eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rbx, [0x000517c0]
mov bpl, al
mov rax, qword [rbx]
test rax, rax
je 0x16981
mov rcx, qword [rax + 0x40]
lea r8d, [r15 + 1]
mov rdx, r13
add rcx, 0xa
add r8, r8
call fcn.0001df90
test eax, eax
je 0x169b3
inc esi
add rbx, 8
cmp esi, 0xa
jb 0x1695e
xor r8d, r8d
lea rbx, [0x000517c0]
mov rcx, qword [rsp + 0xd8]
xor eax, eax
lock cmpxchg qword [rbx + r8*8], rcx
je 0x169d6
inc r8d
cmp r8d, 0xa
jb 0x16996
jmp 0x169d9
lea rcx, [0x00051810]
mov dl, bpl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x16af9
mov r12d, r8d
lea rcx, [0x00051810]
mov dl, bpl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp r12d, 0xffffffff
je 0x169c3
lock add dword [0x000453c8], 1
mov rcx, qword [rsp + 0xd8]
mov r8, rdi
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStackSafe]
test eax, eax
jns 0x16a3d
lea rcx, [0x00051810]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
movsxd rcx, r12d
and qword [rbx + rcx*8], 0
lea rcx, [0x00051810]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lock add dword [0x000453c8], 0xffffffff
jmp 0x169c3
xor eax, eax
lea rcx, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0xd0], eax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rdx, qword [rdi]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd0]
mov byte [rsp + 0x30], 1
xor r8d, r8d
mov ecx, 0xb0040
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
test rax, rax
je 0x16af9
mov rcx, qword [rdi]
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x16acd
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov eax, dword [rsp + 0x58]
test eax, eax
js 0x16af9
test byte [rsp + 0xd2], 4
je 0x16ae1
or byte [rdi + 8], 2
jmp 0x16ae5
and byte [rdi + 8], 0xfd
test byte [rsp + 0xd2], 2
je 0x16af5
or byte [rdi + 8], 1
jmp 0x16af9
and byte [rdi + 8], 0xfe
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret