Function at 0x140001590
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [rcx + 0xe8]
lea rdx, [0x140002080]
mov qword [0x1400040c8], rax
mov rsi, rcx
lea rax, [0x140001830]
xor edi, edi
mov qword [rcx + 0xe8], rax
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x140004fb8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea edx, [rdi + 0x40]
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], dil
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
mov ebx, eax
test eax, eax
jns 0x14000162c
mov edx, eax
lea rcx, [0x1400020b0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x1400017d2
mov rcx, qword [0x140004fb8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [0x1400020f0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0x20]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x10]
mov byte [rsp + 0x28], dil
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov rax, qword [rbp + 0x20]
lea rcx, [0x140002120]
or dword [rax + 0x30], 4
mov rax, qword [rbp + 0x20]
btr dword [rax + 0x30], 7
mov rdx, qword [0x140004fb8]
mov rbx, qword [rdx + 8]
mov r8, rbx
call sub.ntoskrnl.exe_DbgPrint
test rbx, rbx
je 0x1400017b7
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.1400014bc
mov r8, qword [rbp + 0x28]
lea rcx, [0x140002160]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.1400014bc
mov r8, qword [rbp + 0x28]
lea rcx, [0x140002160]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.140001480
mov rdx, qword [rbp + 0x30]
test rdx, rdx
jne 0x14000170c
mov rbx, qword [rbx + 0x10]
inc word [0x1400040c0]
test rbx, rbx
jne 0x1400016c8
mov rax, qword [rbp + 0x20]
mov qword [0x140004fb0], rbx
mov rcx, qword [rax + 0x138]
mov rdi, qword [rcx + 0x28]
mov qword [rcx + 0x28], rdx
mov rax, qword [0x140004fb0]
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x30]
call qword [rax + 8]
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x28]
call fcn.1400014bc
mov r8, qword [rbp + 0x28]
lea rcx, [0x1400021c0]
mov rdx, qword [rbp + 0x20]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoGetAttachedDevice]
mov rdx, rax
lea rcx, [0x1400021e0]
mov rbx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rcx + 0x138]
mov qword [rdx + 0x28], rdi
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov rax, qword [0x1400040c8]
mov qword [rsi + 0xe8], rax
xor eax, eax
jmp 0x1400017d2
lea rcx, [0x140002180]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, 0xc0000225
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret