Function at 0x17aa2
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2a7c0
push 0x2a536
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
push 0x179d0
call sub.ntoskrnl.exe_DbgPrint
mov dword [esp], 0x179d8
call sub.ntoskrnl.exe_DbgPrint
mov dword [esp], 0x179fc
call sub.ntoskrnl.exe_DbgPrint
mov dword [esp], 0x17a00
lea eax, [ebp - 0x23c]
push eax
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call esi
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
push 0x22
lea eax, [ebp - 0x23c]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
jl 0x18009
push 0x17a24
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
cmp esi, ebx
jge 0x17b5f
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, esi
jmp 0x18009
mov dword [ebp - 4], ebx
call fcn.0001989d
mov dword [0x2b8e0], eax
mov dword [0x2c0b8], ebx
mov dword [0x2bba0], ebx
mov dword [0x2c0bc], ebx
mov dword [0x2bb58], ebx
mov dword [0x2bef4], ebx
mov dword [0x2c0c0], ebx
mov dword [0x2b8ec], ebx
mov dword [0x2bc18], ebx
mov dword [0x2bcd8], ebx
mov dword [0x2ba90], ebx
mov dword [0x2bba8], ebx
mov dword [0x2c0b8], ebx
mov dword [0x2bba0], ebx
mov dword [0x2c0bc], ebx
mov dword [0x2c0c0], ebx
mov dword [0x2b8ec], ebx
mov dword [0x2bc18], ebx
mov dword [0x2bcd8], ebx
mov dword [0x2ba90], ebx
mov dword [0x2bf00], ebx
mov dword [0x2bb08], ebx
mov dword [0x2c198], ebx
mov dword [0x2b8e8], ebx
mov dword [0x2befc], ebx
mov dword [0x2bba8], ebx
mov dword [0x2b860], ebx
mov dword [0x2ba94], ebx
mov dword [0x2bd18], ebx
mov dword [0x2bf9c], ebx
mov dword [0x2c018], ebx
mov dword [0x2bd60], ebx
mov dword [0x2bd1c], ebx
mov dword [0x2bd58], ebx
mov dword [0x2ba98], ebx
mov dword [0x2beec], ebx
mov dword [0x2bef0], ebx
mov dword [0x2c01c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0x1a
jge 0x17c66
mov eax, dword [ebp - 0x28]
mov dword [eax*4 + 0x2baa0], 3
inc dword [ebp - 0x28]
jmp 0x17c4d
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0x1a
jge 0x17c7e
mov eax, dword [ebp - 0x28]
mov dword [eax*4 + 0x2b940], ebx
inc dword [ebp - 0x28]
jmp 0x17c69
mov dword [0x2bbd4], ebx
mov dword [0x2bbc4], ebx
mov dword [0x2bbcc], ebx
mov dword [0x2bbd0], ebx
mov dword [0x2bbc0], ebx
mov dword [0x2bbc8], ebx
mov dword [0x2bee8], ebx
mov dword [0x2b520], ebx
mov dword [0x2bf98], ebx
or dword [ebp - 4], 0xffffffff
jmp 0x17cc7
mov dword [ebp - 4], 1
push 0x546b6c42
push 0x38
push ebx
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
call edi
mov dword [0x2bdf8], eax
push eax
mov esi, dword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
call esi
push 0x2b900
call esi
push 0x2c160
call esi
push 0x2bd80
call esi
push 0x2c120
call esi
push 0x2bce0
call esi
push 0x2bc60
call esi
push 0x2bf60
call esi
push 0x2bdc0
call esi
push 0x2bd20
call esi
push 0x2bb20
call esi
push 0x2c080
call esi
push 0x2bb60
call esi
push 0x2c0e0
call esi
push 0x2c1a0
call esi
push 0x2bca0
call esi
push 0x2bc20
call esi
push 0x2bfa0
call esi
push 0x2c040
call esi
push 1
pop eax
mov dword [0x2c020], eax
mov dword [0x2c028], ebx
push ebx
push eax
push 0x2c02c
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
push 0x546b6c42
push 0x38
push ebx
call edi
mov dword [0x2bef8], eax
cmp eax, ebx
jne 0x17db0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x17e82
push eax
call esi
or dword [ebp - 4], 0xffffffff
jmp 0x17dc6
mov dword [ebp - 4], 2
push ebx
push 0x41484b20
push 0xfffc
push ebx
push ebx
push ebx
mov esi, 0x2be00
push esi
mov edi, dword [sym.imp.ntoskrnl.exe_ExInitializePagedLookasideList]
call edi
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocateFromPagedLookasideList]
mov dword [0x2b528], eax
cmp eax, ebx
je 0x17d98
push ebx
push 0x41484b32
push 0x400
push ebx
push ebx
push ebx
push 0x2be80
call edi
mov eax, dword [0x2b528]
mov dword [eax], ebx
mov eax, dword [0x2b528]
mov dword [eax + 4], ebx
mov dword [0x2b50c], 1
or dword [ebp - 4], 0xffffffff
jmp 0x17e3a
push 0x546b6c42
push 0xd00
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [0x2b540], edi
cmp edi, ebx
je 0x17e86
mov ecx, 0x340
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 3
push 0x546b6c42
push 0x114
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [0x2b574], eax
cmp eax, ebx
jne 0x17e90
or dword [ebp - 4], 0xffffffff
mov eax, 0xc000009a
jmp 0x18009
mov dword [eax + 0x10c], 1
mov eax, dword [0x2b574]
mov dword [eax], ebx
mov eax, dword [0x2b574]
mov dword [eax + 4], ebx
mov eax, dword [0x2b574]
or dword [eax + 0x110], 0xffffffff
or dword [ebp - 4], 0xffffffff
jmp 0x17ec8
mov dword [0x2b508], ebx
mov dword [0x2b9a8], 1
mov eax, 0x2b9c4
mov dword [eax - 4], ebx
mov dword [eax], ebx
add eax, 8
cmp eax, 0x2ba94
jl 0x17edd
push 0x546b6c42
push 4
pop esi
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, eax
cmp ecx, ebx
je 0x17f43
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
mov dword [0x2bbc0], ecx
mov dword [0x2bbc4], esi
mov dword [0x2bbc8], ecx
mov dword [0x2bbcc], esi
mov dword [0x2bbd0], ecx
mov dword [0x2bbd4], esi
push 0x546b6c42
push 0xe
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [0x2ba98], eax
cmp eax, ebx
jne 0x17f4d
mov eax, 0xc0000023
jmp 0x18009
push 0xd
push 0x17a50
push eax
call dword [sym.imp.ntoskrnl.exe_strncpy]
add esp, 0xc
mov eax, dword [0x2ba98]
mov byte [eax + 0xd], bl
mov dword [ebp - 4], esi
call fcn.00015190
or dword [ebp - 4], 0xffffffff
jmp 0x17f81
mov dword [ebp - 4], 5
call fcn.0002715e
call fcn.0001f31c
call fcn.00026564
push ebx
push 0x1613e
call sub.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push eax
push 0x17a60
push ebx
push ebx
push ebx
push ebx
push 0x8055047b
call fcn.000106d8
mov dword [ebp - 0x1c], eax
jmp 0x17fc8
or dword [ebp - 4], 0xffffffff
mov ecx, 0x182d8
mov eax, dword [ebp + 8]
mov dword [eax + 0x70], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x34], 0x19726
push 0x17a80
call sub.ntoskrnl.exe_DbgPrint
mov dword [esp], 0x17a88
call sub.ntoskrnl.exe_DbgPrint
mov dword [esp], 0x17aa0
call sub.ntoskrnl.exe_DbgPrint
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8