Function at 0x140002748
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov dword [rsp + 0x30], 0
mov dword [rsp + 0xa8], 0x30
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xc0], 0x200
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x58]
call fcn.1400012b4
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1400027eb
lea rcx, [0x1400071a0]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rax, qword [rsp + 0xf0]
add rax, 0xe8
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xf0]
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.140005c18
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140002837
mov edx, dword [rsp + 0x30]
lea rcx, [0x1400071c0]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rax, qword [rsp + 0xf0]
add rax, 0x50
mov rcx, rax
call fcn.140002460
movzx eax, al
test eax, eax
jne 0x140002974
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x68]
or eax, 0x20
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x68], eax
mov rax, qword [rsp + 0xf0]
add rax, 0xb0
mov rcx, rax
call fcn.1400056e4
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400028a4
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rax, qword [rsp + 0xf0]
add rax, 0x50
mov rcx, rax
call fcn.140004f18
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
call fcn.140001d64
mov rax, qword [rsp + 0xf0]
add rax, 0x50
mov rcx, rax
call fcn.140004f18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.14000247c
jmp 0x140002900
lea rcx, [rsp + 0x38]
call fcn.140001cb4
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.140001c68
movzx eax, al
test eax, eax
je 0x140002974
lea rcx, [rsp + 0x38]
call fcn.140001ca0
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140001d9c
mov rcx, rax
call fcn.1400024b4
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140002972
mov rax, qword [rsp + 0xf0]
add rax, 0xb0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
call fcn.1400054b8
jmp 0x1400028f6
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0x24], 0
jne 0x14000299d
mov rax, qword [rsp + 0xf0]
add rax, 0x50
mov rcx, rax
call fcn.140002460
movzx eax, al
test eax, eax
jne 0x1400029f4
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x68]
or eax, 0x20
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x68], eax
xor edx, edx
lea rcx, [0x1400041a0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1400029f4
mov edx, dword [rsp + 0x30]
lea rcx, [0x1400071f0]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0x2c], 0
je 0x140002a33
lea rcx, [0x140003150]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140002a33
mov edx, dword [rsp + 0x30]
lea rcx, [0x140007220]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 4], 0
jne 0x140002a64
mov rax, qword [rsp + 0xf0]
cmp dword [rax], 0
jne 0x140002a64
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0x10], 0
je 0x140002ab7
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003db0]
mov qword [rcx + rax + 8], rdx
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003930]
mov qword [rcx + rax + 0x10], rdx
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 8], 0
je 0x140002b18
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
mov byte [rcx + rax], 3
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003f40]
mov qword [rcx + rax + 8], rdx
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003a60]
mov qword [rcx + rax + 0x10], rdx
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0xc], 0
je 0x140002b79
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
mov byte [rcx + rax], 4
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003f40]
mov qword [rcx + rax + 8], rdx
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003a60]
mov qword [rcx + rax + 0x10], rdx
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0x10], 0
jne 0x140002ba6
mov rax, qword [rsp + 0xf0]
cmp dword [rax], 0
jne 0x140002ba6
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 4], 0
je 0x140002c4c
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
mov byte [rcx + rax], 6
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140004080]
mov qword [rcx + rax + 8], rdx
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003b40]
mov qword [rcx + rax + 0x10], rdx
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
mov byte [rcx + rax], 0x12
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003c80]
mov qword [rcx + rax + 8], rdx
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
lea rdx, [0x140003670]
mov qword [rcx + rax + 0x10], rdx
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x20
lea rcx, [0x140009080]
mov byte [rcx + rax], 0x80
mov rax, qword [rsp + 0xf0]
add rax, 0x78
mov r8, rax
lea rdx, [0x1400082c0]
mov rcx, qword [rsp + 0xf8]
call sub.FLTMGR.SYS_FltRegisterFilter
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140002ca6
mov edx, dword [rsp + 0x30]
lea rcx, [0x140007250]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rax + 0x78]
call sub.FLTMGR.SYS_FltStartFiltering
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140002cdb
mov edx, dword [rsp + 0x30]
lea rcx, [0x140007270]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rcx, qword [rsp + 0xf0]
call fcn.140002ec8
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140002d0c
mov edx, dword [rsp + 0x30]
lea rcx, [0x140007290]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov eax, 0xc
mov word [rsp + 0x98], ax
mov eax, 0xe
mov word [rsp + 0x9a], ax
lea rax, [0x1400072c0]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xf0]
add rax, 0x90
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0xf8]
lea rdx, [rsp + 0x98]
lea rcx, [0x1400044b0]
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140002d92
mov edx, dword [rsp + 0x30]
lea rcx, [0x1400072d0]
call fcn.14000659c
mov eax, dword [rsp + 0x30]
jmp 0x140002e07
mov rax, qword [rsp + 0xf0]
add rax, 0xe8
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xf0]
mov rdx, qword [rax + 0x78]
mov rcx, qword [rsp + 0x90]
call fcn.140005380
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov rcx, qword [rcx + 0x68]
mov qword [rax + 0xf0], rcx
mov rax, qword [rsp + 0xf8]
mov qword [rax + 0x68], 0
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0xf8], rcx
mov eax, dword [rsp + 0x30]
add rsp, 0xe8
ret