Function at 0x140004f48
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, rdx
mov rdi, rcx
mov rcx, rax
lea rdx, [0x14000d160]
call fcn.140005294
mov esi, eax
test eax, eax
jns 0x140004fb1
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x14000d170]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000521f
xor edx, edx
lea rcx, [0x140016550]
call fcn.14000a848
mov esi, eax
test eax, eax
js 0x140004f72
xor r8d, r8d
lea rdx, [0x140005260]
xor ecx, ecx
call fcn.140002a20
mov edx, 1
lea rcx, [0x140016548]
call fcn.14000a848
mov esi, eax
test eax, eax
jns 0x140005033
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x14000d170]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140016550]
jmp 0x14000521a
xor r8d, r8d
lea rdx, [0x140005240]
lea ecx, [r8 + 1]
call fcn.140002a20
mov edx, 4
lea rcx, [0x140016540]
call fcn.14000a848
mov esi, eax
test eax, eax
jns 0x1400050af
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x14000d170]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140016550]
call fcn.14000a780
mov rcx, qword [0x140016548]
jmp 0x14000521a
mov rax, qword [str.DsArk64.sys]
xor ebx, ebx
jmp 0x1400050ee
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140016540]
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rdx, [rsp + 0x40]
call fcn.14000a3e8
inc ebx
lea rcx, str.DsArk64.sys
mov rax, qword [rcx + rbx*8]
test rax, rax
jne 0x1400050ba
xor r8d, r8d
lea rdx, [0x140005280]
lea ecx, [rax + 7]
call fcn.140002a20
lea r8, [0x140016098]
mov rcx, rdi
lea rdx, [0x1400114d0]
call sub.FLTMGR.SYS_FltRegisterFilter
mov esi, eax
test eax, eax
js 0x1400051be
mov rcx, qword [0x140016098]
call sub.FLTMGR.SYS_FltStartFiltering
mov esi, eax
lfence
test eax, eax
jns 0x14000517f
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x14000d1f0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140016098]
call sub.FLTMGR.SYS_FltUnregisterFilter
jmp 0x1400051f8
mov byte [0x140016090], 1
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
movzx r9d, dil
mov qword [rsp + 0x28], rbx
lea r8, [0x14000d2d0]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000521f
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x14000d260]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lfence
mov rcx, qword [0x140016550]
call fcn.14000a780
mov rcx, qword [0x140016548]
call fcn.14000a780
mov rcx, qword [0x140016540]
call fcn.14000a780
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret