Function at 0x140001210
Capabilities:
Create device object
Delete file
Print debug messages

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x1e0
mov rax, qword [rcx + 0x28]
lea r9, [r11 - 0x148]
xor ebp, ebp
mov qword [r11 - 0x178], 0x30
mov qword [rsp + 0x70], rbp
lea r8, [r11 - 0x178]
mov dword [rsp + 0x68], 0x100
xorps xmm0, xmm0
mov qword [rsp + 0x60], rbp
add rax, 0x48
mov dword [rsp + 0x58], ebp
mov rdi, rcx
mov dword [rsp + 0x50], ebp
lea rcx, [r11 + 8]
mov qword [rsp + 0x48], rbp
mov edx, 0x110000
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov qword [r11 - 0x160], 0x240
mov qword [r11 - 0x170], rbp
mov qword [r11 - 0x168], rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
movups xmmword [rsp + 0xb0], xmm0
mov qword [r11 + 8], rbp
movdqu xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
test eax, eax
js 0x140001368
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rsp + 0x210]
mov rcx, qword [rsp + 0x200]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x110000
mov qword [rsp + 0x28], rax
mov r8, qword [r8]
mov dword [rsp + 0x20], 0x656c6946
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
xor edx, edx
test eax, eax
jns 0x14000131f
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
jmp 0x140001368
mov rax, qword [rsp + 0x210]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], rbp
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
mov rcx, qword [rsp + 0x210]
movzx ebx, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x200]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
test bl, bl
je 0x140001368
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov rcx, qword [rax]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
movabs rcx, 0x1d9ef433a0e4000
cmp rax, rcx
nop
nop
nop
nop
nop
nop
lea rax, [0x1400011e0]
mov edx, 0x20
mov qword [rdi + 0x70], rax
xor ecx, ecx
mov qword [rdi + 0x80], rax
lea rax, [0x140001eb0]
mov qword [rdi + 0xe0], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x140005038], rax
mov rbx, rax
test rax, rax
je 0x140001632
lea rcx, [0x1400039c0]
mov qword [rsp + 0x208], rsi
call fcn.140001820
mov esi, eax
call fcn.140001bf0
test rax, rax
je 0x140001401
cmp rsi, qword [rax + 0x10]
ja 0x140001401
mov rax, qword [rax]
movsxd rcx, dword [rax + rsi*4]
sar rcx, 4
add rcx, rax
jmp 0x140001404
mov rcx, rbp
mov qword [rbx + 8], rcx
lea rcx, [0x1400039e0]
call fcn.140001820
mov esi, eax
call fcn.140001bf0
test rax, rax
je 0x140001436
cmp rsi, qword [rax + 0x10]
ja 0x140001436
mov rax, qword [rax]
movsxd rcx, dword [rax + rsi*4]
sar rcx, 4
add rcx, rax
jmp 0x140001439
mov rcx, rbp
mov qword [rbx], rcx
xor edx, edx
lea rcx, [rsp + 0xc4]
mov r8d, 0x118
call fcn.140003840
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov eax, dword [rsp + 0xcc]
mov rsi, qword [rsp + 0x208]
mov dword [rbx + 0x14], eax
cmp eax, 0x3fab
ja 0x14000159b
je 0x1400014bf
cmp eax, 0x2800
ja 0x140001575
je 0x1400014bf
sub eax, 0x1db0
je 0x140001562
sub eax, 1
je 0x140001562
sub eax, 0x63f
je 0x1400014bf
cmp eax, 0x190
je 0x1400014bf
mov dword [rbx + 0x10], 0x388
mov dword [rbx + 0x1c], 0x74
mov dword [rbx + 0x18], 0x232
lea rdx, [0x140003aa0]
lea rcx, [0x140005060]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x140005040]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [0x140005060]
mov byte [rsp + 0x28], bpl
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x140001637
lea rdx, [0x140003ad0]
lea rcx, [0x140005050]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140005060]
lea rcx, [0x140005050]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x1400015dc
mov rcx, qword [0x140005040]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
add rsp, 0x1e0
pop rdi
pop rbp
pop rbx
ret
mov dword [rbx + 0x18], 0x1f6
mov dword [rbx + 0x1c], 0x100
jmp 0x1400014cd
cmp eax, 0x295a
je 0x1400014bf
cmp eax, 0x3839
je 0x1400014bf
cmp eax, 0x3ad7
jne 0x1400014b8
jmp 0x1400014bf
cmp eax, 0x4a60
ja 0x1400014b8
sub eax, 0x42ee
je 0x1400015d0
sub eax, 0x275
je 0x1400015d0
sub eax, 0x257
je 0x1400015c4
cmp eax, 1
jne 0x1400014b8
mov dword [rbx + 0x10], 0x280
jmp 0x1400014bf
mov dword [rbx + 0x10], 0x278
jmp 0x1400014bf
call fcn.140002d00
test eax, eax
jns 0x1400015f1
lea rcx, [0x140003b00]
call sub.ntoskrnl.exe_DbgPrint
call fcn.140002a30
test eax, eax
jns 0x140001606
lea rcx, [0x140003b30]
call sub.ntoskrnl.exe_DbgPrint
call fcn.140003260
mov r8, rdi
mov qword [0x140005020], rax
lea rdx, [0x140001100]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoRegisterDriverReinitialization]
xor eax, eax
add rsp, 0x1e0
pop rdi
pop rbp
pop rbx
ret
mov eax, 0xc0000001
add rsp, 0x1e0
pop rdi
pop rbp
pop rbx
ret