Function at 0x1b458
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rdi, [0x0001c250]
mov rsi, rdx
mov rbx, rcx
mov rdx, rdi
xor ecx, ecx
mov al, byte [rdx]
inc ecx
inc rdx
test al, al
jne 0x1b479
lea eax, [rcx - 1]
test eax, eax
je 0x1b4e6
mov rax, rdi
movzx ecx, byte [rax]
lea rdx, str.________________________________________________456789:_________
inc rax
cmp byte [rcx + rdx], 0x3f
jbe 0x1b48e
sub eax, edi
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax + rax*2 + 1]
mov dword [0x0001eacc], ecx
test ecx, ecx
je 0x1b4e6
movsxd rdx, ecx
mov r8d, 0x32544c46
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rdi
mov rcx, rax
mov qword [0x0001ead0], rax
call fcn.0001b778
mov dword [0x0001eacc], eax
lea rax, [0x0001b190]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
lea r8, [0x0001c100]
mov edx, 0x7eef
mov ecx, 0x6032
call fcn.0001b8b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [0x0001eac8], 0
and qword [0x0001ea80], 0
mov rcx, rsi
call fcn.00017a30
test eax, eax
js 0x1b762
mov r9d, 0x28b4
lea r8, [0x0001c140]
mov edx, 0x5818
lea ecx, [r9 - 2]
mov dword [rsp + 0x20], 0x278a
call fcn.0001b8b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f7a0]
lea r8, [0x0001f320]
mov qword [rsp + 0x30], rdx
mov r9d, 0x22
mov rcx, rbx
xor edx, edx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x1b5f4
mov rax, qword [0x0001f7a0]
lea rdx, [0x0001f320]
lea rcx, [0x0001f530]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x1b5db
mov rcx, qword [0x0001f7a0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [0x0001f7a0], 0
jmp 0x1b5f4
mov rax, qword [0x0001f7a0]
btr dword [rax + 0x30], 7
mov rax, qword [0x0001f7a0]
or dword [rax + 0x30], 0x10
xor edi, edi
test edi, edi
jns 0x1b607
mov rcx, rbx
call fcn.0001b220
mov eax, edi
jmp 0x1b762
lea r8, [0x0001c190]
mov r9d, 0x67be
mov edx, 0x28db
mov ecx, 0x598e
mov dword [rsp + 0x20], 0x3971
call fcn.0001b8b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f740]
lea rax, [0x0001f748]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f750]
lea r8, [0x0001eae0]
lea rdx, [0x0001bf30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea rdx, [0x0001f758]
lea rax, [0x0001f760]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f768]
lea r8, [0x0001ecf0]
lea rdx, [0x0001bf50]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea r8, [0x0001c1d0]
mov r9d, 0x35e5
mov edx, 0x14f1
mov ecx, 0xece
mov dword [rsp + 0x20], 0x2eba
call fcn.0001b8b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001f770]
lea rax, [0x0001f778]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f780]
lea r8, [0x0001ef00]
lea rdx, [0x0001bfb0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea rdx, [0x0001f788]
lea rax, [0x0001f790]
mov qword [rsp + 0x28], rdx
lea r9, [0x0001f798]
lea r8, [0x0001f110]
lea rdx, [0x0001bfd0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00017fd4
lea r8, [0x0001c210]
mov r9d, 0x7514
mov edx, 0x4d0c
mov ecx, 0x748c
call fcn.0001b8b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret