Function at 0x140002500
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
lea rcx, [0x140009ca8]
call fcn.140001a34
xor esi, esi
test eax, eax
jns 0x140002536
lfence
jmp 0x1400027b7
cmp qword [0x140009c98], rsi
je 0x14000254f
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c90]
call fcn.140001e00
cmp qword [0x140009c88], rsi
je 0x140002568
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c80]
call fcn.140001e00
cmp qword [0x140009c78], rsi
je 0x140002581
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c70]
call fcn.140001e00
cmp qword [0x140009c68], rsi
je 0x14000259a
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c60]
call fcn.140001e00
cmp qword [0x140009c58], rsi
je 0x1400025b3
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c50]
call fcn.140001e00
cmp qword [0x140009c48], rsi
je 0x1400025cc
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c40]
call fcn.140001e00
cmp qword [0x140009c38], rsi
je 0x1400025e5
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c30]
call fcn.140001e00
cmp qword [0x140009c28], rsi
je 0x1400025fe
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c20]
call fcn.140001e00
cmp qword [0x140009c18], rsi
je 0x140002617
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c10]
call fcn.140001e00
cmp qword [0x140009c08], rsi
je 0x140002630
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c00]
call fcn.140001e00
cmp qword [0x140009bf8], rsi
je 0x140002649
lea rdx, [rbp + 0x18]
lea rcx, [0x140009bf0]
call fcn.140001e00
cmp qword [0x140009be8], rsi
je 0x140002662
lea rdx, [rbp + 0x18]
lea rcx, [0x140009be0]
call fcn.140001e00
cmp qword [0x140009bd8], rsi
je 0x14000267b
lea rdx, [rbp + 0x18]
lea rcx, [0x140009bd0]
call fcn.140001e00
cmp qword [0x140009bc8], rsi
je 0x140002694
lea rdx, [rbp + 0x18]
lea rcx, [0x140009bc0]
call fcn.140001e00
cmp qword [0x140009bb8], rsi
je 0x1400026ad
lea rdx, [rbp + 0x18]
lea rcx, [0x140009bb0]
call fcn.140001e00
cmp qword [0x140009ba8], rsi
je 0x1400026c6
lea rdx, [rbp + 0x18]
lea rcx, [0x140009ba0]
call fcn.140001e00
cmp qword [0x140009b98], rsi
je 0x1400026df
lea rdx, [rbp + 0x18]
lea rcx, [0x140009b90]
call fcn.140001e00
cmp qword [0x140009b88], rsi
je 0x1400026f8
lea rdx, [rbp + 0x18]
lea rcx, [0x140009b80]
call fcn.140001e00
cmp qword [0x140009b78], rsi
je 0x140002711
lea rdx, [rbp + 0x18]
lea rcx, [0x140009b70]
call fcn.140001e00
cmp qword [0x140009b68], rsi
je 0x14000272a
lea rdx, [rbp + 0x18]
lea rcx, [0x140009b60]
call fcn.140001e00
mov edx, 1
lea rcx, [0x140009ca0]
call fcn.140001a34
mov ebx, eax
test eax, eax
jns 0x14000274d
lfence
mov rcx, qword [0x140009ca8]
jmp 0x1400027b0
xor r8d, r8d
lea rdx, [0x1400027e0]
lea ecx, [r8 + 1]
call fcn.1400013cc
lea r8, [0x140007030]
mov rcx, rdi
lea rdx, [0x140006740]
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
test eax, eax
js 0x14000279a
mov rcx, qword [0x140007030]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
test eax, eax
jns 0x1400027cc
mov rcx, qword [0x140007030]
call sub.FLTMGR.SYS_FltUnregisterFilter
lfence
mov rcx, qword [0x140009ca8]
call fcn.14000196c
mov rcx, qword [0x140009ca0]
call fcn.14000196c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
lfence
mov byte [0x140007028], 1
jmp 0x1400027b7