Function at 0x140195000
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8d0
mov rax, qword [0x140017a10]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
xor r15d, r15d
mov dword [rsp + 0x44], r15d
mov ebx, 0x800
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140010b80
nop
xor r9d, r9d
lea r8, [0x140018fd4]
lea rdx, [0x140018fd0]
lea rcx, [0x140018fcc]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
xorps xmm0, xmm0
movups xmmword [0x140022f60], xmm0
mov ecx, 0x200
mov word [0x140022f62], cx
lea rax, [0x1400183b0]
mov qword [0x140022f68], rax
movups xmmword [0x140022f40], xmm0
mov word [0x140022f42], cx
lea rax, [0x1400185b0]
mov qword [0x140022f48], rax
movups xmmword [0x140022f50], xmm0
mov word [0x140022f52], cx
lea rax, [0x1400187b0]
mov qword [0x140022f58], rax
movups xmmword [0x140022f00], xmm0
mov word [0x140022f02], cx
lea rax, [0x1400189b0]
mov qword [0x140022f08], rax
movups xmmword [0x140022ee0], xmm0
mov word [0x140022ee2], cx
lea rax, [0x140018bb0]
mov qword [0x140022ee8], rax
movups xmmword [0x140022ef0], xmm0
mov word [0x140022ef2], cx
lea rax, [0x140018db0]
mov qword [0x140022ef8], rax
movups xmmword [0x140022fc0], xmm0
mov word [0x140022fc2], cx
lea rax, [0x140017db0]
mov qword [0x140022fc8], rax
movups xmmword [0x140022fa0], xmm0
mov word [0x140022fa2], cx
lea rax, [0x140017fb0]
mov qword [0x140022fa8], rax
movups xmmword [0x140022fb0], xmm0
mov word [0x140022fb2], cx
lea rax, [0x1400181b0]
mov qword [0x140022fb8], rax
mov r14d, r15d
mov dword [rsp + 0x40], r15d
lea r13, [0x140000000]
lea r12d, [r15 + 1]
cmp r14d, 0x1a
jge 0x140195243
movsxd rcx, r14d
lea rsi, [rcx*4]
lea eax, [r14 + 0x41]
mov dword [rsi + r13 + 0x18f080], eax
shl rcx, 4
lea rdi, [r13 + 0x18f0e8]
add rdi, rcx
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov word [rdi + 2], bx
lea rax, [rsp + 0xc0]
mov qword [rdi + 8], rax
lea rbx, [r13 + 0x18eee0]
add rbx, rcx
lea rdx, [0x140196520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov dword [rsi + r13 + 0x18ed34], r15d
mov dword [rsi + r13 + 0x18ed9c], r15d
mov dword [rsi + r13 + 0x18ee04], r15d
mov dword [rsi + r13 + 0x18ee6c], r15d
mov dword [rsi + r13 + 0x18ebe8], r15d
mov dword [rsi + r13 + 0x18ec5c], r15d
mov dword [rsi + r13 + 0x18ecc4], r15d
add r14d, r12d
mov dword [rsp + 0x40], r14d
mov ebx, 0x800
jmp 0x14019518b
mov qword [0x14018ec50], r15
mov dword [0x14018ec58], r15d
mov qword [0x14018ed2c], r15
mov qword [0x14018eed4], r15
mov qword [0x140188b60], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
lea r14, [0x140196520]
cmp esi, 0x400
jge 0x1401952e1
movsxd rax, esi
lea rbx, [rax + rax*2]
mov dword [r13 + rbx*8 + 0x188b90], r15d
shl rax, 4
lea rdi, [r13 + 0x178b20]
add rdi, rax
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x188b80]
lea rcx, [rcx + rbx*8]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov eax, 0x800
mov word [rcx + 2], ax
lea rax, [rsp + 0xc0]
mov qword [rcx + 8], rax
mov r8b, r12b
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195275
mov qword [0x140182b40], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195341
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x182b70], r15d
shl rax, 4
lea rbx, [r13 + 0x174b20]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x182b60]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401952f0
mov qword [0x14017cb20], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401953a1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x17cb50], r15d
shl rax, 4
lea rbx, [r13 + 0x170b20]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x17cb40]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195350
mov qword [0x1401492c0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195401
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x1492f0], r15d
shl rax, 4
lea rbx, [r13 + 0xc1000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x1492e0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401953b0
mov qword [0x1401432a0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195461
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x1432d0], r15d
shl rax, 4
lea rbx, [r13 + 0xc1000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x1432c0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195410
mov qword [0x14012b220], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401954c1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x12b250], r15d
shl rax, 4
lea rbx, [r13 + 0xbd000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x12b240]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195470
mov qword [0x14013d280], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195521
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x13d2b0], r15d
shl rax, 4
lea rbx, [r13 + 0xb9000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x13d2a0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401954d0
mov qword [0x140137260], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195581
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x137290], r15d
shl rax, 4
lea rbx, [r13 + 0xb5000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x137280]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195530
mov qword [0x140131240], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401955e1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x131270], r15d
shl rax, 4
lea rbx, [r13 + 0xb1000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x131260]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195590
mov qword [0x140125200], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195641
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x125230], r15d
shl rax, 4
lea rbx, [r13 + 0xad000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x125220]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401955f0
mov qword [0x14010d180], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401956a1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x10d1b0], r15d
shl rax, 4
lea rbx, [r13 + 0xa9000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x10d1a0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195650
mov qword [0x14011f1e0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195701
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x11f210], r15d
shl rax, 4
lea rbx, [r13 + 0xa5000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x11f200]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401956b0
mov qword [0x1401191c0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195761
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x1191f0], r15d
shl rax, 4
lea rbx, [r13 + 0xa1000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x1191e0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195710
mov qword [0x1401131a0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401957c1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x1131d0], r15d
shl rax, 4
lea rbx, [r13 + 0x9d000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x1131c0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195770
mov qword [0x140107160], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195821
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x107190], r15d
shl rax, 4
lea rbx, [r13 + 0x99000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x107180]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401957d0
mov qword [0x1400ef0e0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195881
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xef110], r15d
shl rax, 4
lea rbx, [r13 + 0x95000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xef100]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195830
mov qword [0x140101140], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401958e1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x101170], r15d
shl rax, 4
lea rbx, [r13 + 0x91000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x101160]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195890
mov qword [0x1400fb120], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195941
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xfb150], r15d
shl rax, 4
lea rbx, [r13 + 0x8d000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xfb140]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401958f0
mov qword [0x1400f5100], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401959a1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xf5130], r15d
shl rax, 4
lea rbx, [r13 + 0x89000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xf5120]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195950
mov qword [0x1400e90c0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195a01
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xe90f0], r15d
shl rax, 4
lea rbx, [r13 + 0x85000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xe90e0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401959b0
mov qword [0x1400dd080], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195a61
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xdd0b0], r15d
shl rax, 4
lea rbx, [r13 + 0x81000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xdd0a0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195a10
mov qword [0x1400e30a0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195ac1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xe30d0], r15d
shl rax, 4
lea rbx, [r13 + 0x7d000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xe30c0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195a70
mov qword [0x14004a7e0], r15
mov edi, r15d
mov dword [rsp + 0x40], r15d
movsxd rcx, edi
mov rax, rcx
shl rax, 4
lea rsi, [r13 + 0x44fc0]
add rsi, rax
mov rdx, r14
cmp edi, 0x100
jge 0x140195b24
lea rbx, [rcx + rcx*2]
mov dword [r13 + rbx*8 + 0x4a810], r15d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x4a800]
lea rcx, [rcx + rbx*8]
mov r8b, r12b
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add edi, r12d
mov dword [rsp + 0x40], edi
jmp 0x140195ad0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
mov rdx, rsi
lea rcx, [0x140040fb0]
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
mov rdx, rsi
lea rcx, [0x140040fa0]
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov qword [0x140048fc0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x100
jge 0x140195bbf
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x48ff0], r15d
shl rax, 4
lea rbx, [r13 + 0x40fc0]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x48fe0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195b6e
mov qword [0x140026800], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x100
jge 0x140195c1f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x26830], r15d
shl rax, 4
lea rbx, [r13 + 0x23fe0]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x26820]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195bce
mov qword [0x140024fe0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x100
jge 0x140195c7f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x25010], r15d
shl rax, 4
lea rbx, [r13 + 0x22fe0]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x25000]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195c2e
mov qword [0x1400d1040], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195cdf
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xd1070], r15d
shl rax, 4
lea rbx, [r13 + 0x54000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xd1060]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195c8e
mov qword [0x1400cb020], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195d3f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xcb050], r15d
shl rax, 4
lea rbx, [r13 + 0x50000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xcb040]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195cee
mov qword [0x1400c5000], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195dc8
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xc5030], r15d
shl rax, 4
lea rbx, [r13 + 0x4c000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xc5020]
add rdi, r13
mov r8b, r12b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140196d30]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x98]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195d4e
mov ecx, r15d
mov ebx, 0x800
mov dword [rsp + 0x40], ecx
cmp ecx, 0x80
jge 0x140195e50
movsxd rax, ecx
imul r8, rax, 0x98
mov dword [r8 + r13 + 0x3c430], r15d
xorps xmm0, xmm0
movups xmmword [r8 + r13 + 0x3c3a0], xmm0
mov word [r8 + r13 + 0x3c3a2], bx
lea rax, [rsp + 0xc0]
mov qword [r8 + r13 + 0x3c3a8], rax
mov edx, r15d
mov dword [rsp + 0x48], edx
cmp edx, 8
jge 0x140195e4b
movsxd rax, edx
shl rax, 4
add rax, r8
lea r9, [0x14003c3b0]
add rax, r9
movups xmmword [rax], xmm0
mov word [rax + 2], bx
lea r9, [rsp + 0xc0]
mov qword [rax + 8], r9
add edx, r12d
jmp 0x140195e16
add ecx, r12d
jmp 0x140195dd0
mov qword [0x1400d7060], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140195eb0
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xd7090], r15d
shl rax, 4
lea rbx, [r13 + 0x79000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xd7080]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195e5f
mov dword [0x14015ff0c], r15d
mov dword [0x14015ff08], r15d
mov dword [0x14015ff04], r15d
mov dword [0x14015ff00], r15d
mov dword [0x14014f2ec], r15d
mov dword [0x14014f2e8], r15d
mov dword [0x14014f2e4], r15d
mov dword [0x14014f2e0], r15d
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140196017
movsxd rdi, esi
shl rdi, 4
lea rbx, [r13 + 0x75000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x164b20]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x71000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x168b20]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x6d000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x16cb20]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x69000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x153f00]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x65000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x157f00]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x61000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x15bf00]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140195ef0
mov r14d, r15d
mov dword [rsp + 0x40], r15d
cmp r14d, 0x80
jge 0x140196180
movsxd rbx, r14d
mov rsi, rbx
shl rsi, 4
lea rdi, [rsi + 0x60800]
add rdi, r13
lea rdx, [0x140196520]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
imul r12, rbx, 0x98
lea rcx, [r12 + 0x15ff20]
add rcx, r13
mov r8b, 1
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [rsi + 0x60000]
add rbx, r13
lea rdx, [0x140196520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r12 + 0x14f300]
add rcx, r13
mov r8b, 1
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov dword [rsp + 0x48], r15d
movsxd rax, r14d
imul r13, rax, 0x98
cmp r15d, 8
jge 0x14019614e
lea eax, [r15 + r14*8]
movsxd rsi, eax
shl rsi, 4
lea rax, [0x140000000]
lea rbx, [rax + 0x5c000]
add rbx, rsi
lea rdx, [0x140196520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movsxd rdi, r15d
add rdi, rdi
lea rcx, [rdi*8]
add rcx, r13
lea rax, [0x14015ff30]
add rcx, rax
mov r8b, 1
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rax, [0x140000000]
lea rbx, [rax + 0x58000]
add rbx, rsi
lea rdx, [0x140196520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r12 + rdi*8]
lea rax, [0x14014f310]
add rcx, rax
mov r8b, 1
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
inc r15d
jmp 0x14019609f
xor r15d, r15d
lea rax, [0x140000000]
mov dword [rax + r13 + 0x15ffb0], r15d
lea r13, [0x140000000]
mov dword [r12 + r13 + 0x14f390], r15d
lea r12d, [r15 + 1]
add r14d, r12d
mov dword [rsp + 0x40], r14d
jmp 0x14019601f
mov dword [0x140017d10], r15d
mov qword [0x140017b00], 0x1f4
mov dword [0x140017d14], 0x400
mov rbx, qword [rsp + 0x58]
mov qword [0x140017a60], rbx
lea rax, [0x140017a88]
mov qword [0x140017a90], rax
mov qword [0x140017a88], rax
lea rcx, [0x140017a80]
call qword [sym.imp.ntoskrnl.exe_KeInitializeSpinLock]
mov word [rsp + 0x38], r15w
mov dword [rsp + 0x30], 0x7970534d
mov r9d, 0x200
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140017aa0]
call qword [sym.imp.ntoskrnl.exe_ExInitializeLookasideListEx]
lea rcx, [0x140196d40]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x140017d20], rax
lea rcx, [0x140196d60]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x140017d28], rax
lea rcx, [0x140196d80]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x140017d30], rax
mov rcx, qword [rsp + 0x60]
call fcn.1401963b8
lea r8, [0x140017a68]
lea rdx, [0x140198040]
mov rcx, rbx
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
mov dword [rsp + 0x44], eax
test eax, eax
js 0x140196355
mov edx, 0x1f0001
lea rcx, [rsp + 0x50]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov ebx, eax
mov dword [rsp + 0x44], eax
test eax, eax
js 0x140196294
xor r9d, r9d
xor r8d, r8d
mov dl, r12b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlSetDaclSecurityDescriptor]
mov ebx, eax
mov dword [rsp + 0x44], eax
test ebx, ebx
js 0x140196355
lea rdx, [0x140196da0]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x80], 0x240
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x38], r12d
lea rax, [0x140191410]
mov qword [rsp + 0x30], rax
lea rax, [0x140191160]
mov qword [rsp + 0x28], rax
lea rax, [0x140191150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [0x140017a70]
mov rcx, qword [0x140017a68]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov ebx, eax
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x50]
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
test ebx, ebx
js 0x140196355
mov rcx, qword [0x140017a68]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
mov dword [rsp + 0x44], eax
test ebx, ebx
jns 0x140196388
mov rcx, qword [0x140017a70]
test rcx, rcx
je 0x14019636a
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x140017a68]
test rcx, rcx
je 0x14019637b
call sub.FLTMGR.SYS_FltUnregisterFilter
lea rcx, [0x140017aa0]
call qword [sym.imp.ntoskrnl.exe_ExDeleteLookasideListEx]
mov eax, ebx
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.1400105f0
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret