Function at 0x60c23
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x4f904]
test eax, eax
mov ecx, 0xbb40
je 0x60c3a
cmp eax, ecx
jne 0x60c5a
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x4f904
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x4f904], eax
je 0x62849
not eax
mov dword [section..data], eax
pop ebp
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call sub.TDI.SYS_TdiInitialize
call fcn.0005f9ef
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.00062316
test eax, eax
jl 0x60f0c
push ebx
push edi
call fcn.0005f4fd
test eax, eax
mov dword [ebp + 8], eax
jl 0x62d1e
mov dword [0x50000], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [0x50010], eax
push 0x60f1e
lea eax, [ebp - 8]
push eax
call ebx
push 0x60f36
lea eax, [ebp - 0x10]
push eax
call ebx
mov edi, dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
push 0x50004
push 0
push 0x100
push 0x12
lea eax, [ebp - 8]
push eax
push 0
push esi
call edi
test eax, eax
mov dword [ebp + 8], eax
jl 0x60f11
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
mov dword [ebp + 8], eax
jl 0x60f11
push 0x60f56
lea eax, [ebp - 8]
push eax
call ebx
push 0x50008
push 0
push 0x100
push 0x12
lea eax, [ebp - 8]
push eax
push 0
push esi
call edi
test eax, eax
mov dword [ebp + 8], eax
jl 0x60f11
push 0x60f6e
lea eax, [ebp - 8]
push eax
call ebx
push 0x5000c
push 0
push 0x100
push 0x12
lea eax, [ebp - 8]
push eax
push 0
push esi
call edi
mov dword [ebp + 8], eax
xor eax, eax
cmp dword [ebp + 8], eax
jl 0x62cd7
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], 0x3e9d8
push 0x1c
pop ecx
mov eax, 0x164f9
lea edi, [esi + 0x38]
rep stosd dword es:[edi], eax
mov dword [esi + 0x74], fcn.00016718
mov eax, dword [0x50004]
or dword [eax + 0x1c], 0x10
mov eax, dword [0x50008]
or dword [eax + 0x1c], 0x10
mov eax, dword [0x5000c]
or dword [eax + 0x1c], 0x10
call fcn.0002846f
test al, al
jne 0x60def
push dword [0x516a0]
call fcn.00060fe1
test eax, eax
mov dword [ebp + 8], eax
jl 0x62d1e
push dword [0x50004]
call fcn.00060fe1
test eax, eax
mov dword [ebp + 8], eax
jl 0x62d1e
push dword [0x59d00]
call fcn.00060fe1
test eax, eax
mov dword [ebp + 8], eax
jl 0x62d1e
call fcn.00062661
test eax, eax
mov dword [ebp + 8], eax
jl 0x62d1e
call fcn.0005f4c4
call fcn.00062016
cmp eax, 1
jne 0x62d04
call fcn.0005f919
push 0x60f8a
lea eax, [ebp - 8]
push eax
call ebx
push 0x59d24
lea eax, [ebp - 8]
push eax
call sub.TDI.SYS_TdiRegisterDeviceObject
push 0x60fa2
lea eax, [ebp - 8]
push eax
call ebx
push 0x59d20
lea eax, [ebp - 8]
push eax
call sub.TDI.SYS_TdiRegisterDeviceObject
push 0x60fba
lea eax, [ebp - 8]
push eax
call ebx
push 0x59d1c
lea eax, [ebp - 8]
push eax
call sub.TDI.SYS_TdiRegisterDeviceObject
push 0x59d60
call fcn.00029850
test eax, eax
jl 0x60f1a
push 8
pop ecx
mov ebx, 0x59d40
push 0x4ffd0
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push ebx
push 1
push edi
push edi
mov dword [0x59d48], 0x48c23
mov dword [0x59d58], 0x48c45
call dword [0x59d74]
test eax, eax
jl 0x62cee
push 0x4ffd4
push edi
push ebx
push 2
push edi
push 1
mov dword [0x59d48], 0x48bdf
mov dword [0x59d58], 0x48c01
call dword [0x59d74]
test eax, eax
jl 0x62cf9
push dword [ebp + 0xc]
push esi
call fcn.000293ed
cmp eax, edi
jl 0x60f0a
push 0x210001
push dword [0x50004]
mov dword [0x54904], edi
call dword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
call fcn.0005f883
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8
push 0
push 0
jmp 0x62cd9
xor edi, edi
jmp 0x60edf
mov eax, ecx
mov dword [0x4f904], eax
jmp 0x60c5a
push eax
push eax
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0xc0001004
push esi
call sub.TDI.SYS_CTELogEvent
jmp 0x62d1e
mov dword [0x4ffd0], edi
jmp 0x60eb1
mov dword [0x4ffd4], edi
jmp 0x60edf
xor eax, eax
push eax
push eax
push eax
push eax
push 1
push 0xc0001081
push esi
call sub.TDI.SYS_CTELogEvent
mov dword [ebp + 8], 0xc0000001
mov eax, dword [0x50004]
test eax, eax
mov edi, dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
je 0x62d30
push eax
call edi
mov eax, dword [0x50008]
test eax, eax
je 0x62d3c
push eax
call edi
mov eax, dword [0x5000c]
test eax, eax
je 0x62d48
push eax
call edi
add esi, 0x38
push 0x1c
pop ecx
mov eax, fcn.00059e05
mov edi, esi
rep stosd dword es:[edi], eax
cmp dword [0x59cfc], 0
je 0x62d65
call fcn.00048c67
mov eax, dword [ebp + 8]
jmp 0x60f0a