Function at 0x24970
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor r14d, r14d
mov r15d, edx
mov r12, rcx
mov qword [rsp + 0x30], r14
cmp r8d, 0xb
ja 0x24a09
cmp r8d, 0xa
jae 0x24a1d
cmp r8d, r14d
jbe 0x24a1d
cmp r8d, 2
jbe 0x24a1d
cmp r8d, 5
je 0x249c9
jbe 0x24a1d
cmp r8d, 8
jbe 0x24a1d
cmp r8d, 9
jne 0x24a1d
mov edx, 0x120
xor ecx, ecx
mov r8d, 0x74786e43
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r14
je 0x24a46
mov rcx, rax
mov dword [rax], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsi + 4], 6
jb 0x24a2d
lea rbx, [0x00041110]
lea rdi, [0x0003f598]
jmp 0x24a3b
cmp r8d, 0xc
je 0x249c9
jbe 0x24a1d
cmp r8d, 0xe
jbe 0x24a1d
cmp r8d, 0x10
jbe 0x249c9
lea rbx, [0x00041180]
lea rdi, [0x0003f6e8]
jmp 0x24a54
lea rbx, [0x000410a0]
lea rdi, [0x0003f448]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
jmp 0x24a54
lea rbx, [0x000410a0]
lea rdi, [0x0003f448]
mov rax, qword [rbx + 0x28]
add rax, 0xb0
je 0x24a67
mov rax, qword [rax]
mov dword [rax + 0x10], r15d
mov ebp, 0x68
lea rcx, [rsp + 0x90]
mov rdx, rbx
mov r8, rbp
call fcn.00039320
mov r13, qword [r12 + 8]
mov r8d, 0x74786e43
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r14
je 0x24c54
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call qword [sym.imp.ks.sys_KsAddItemToObjectBag]
mov rcx, rsi
cmp eax, r14d
mov ebx, eax
jge 0x24ac7
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24c19
lea rdx, [rsp + 0x90]
mov r8, rbp
call fcn.00039320
mov r14d, dword [rsp + 0xb0]
test r14d, r14d
je 0x24c36
mov eax, dword [rsp + 0xb4]
mov r8d, 0x74786e43
xor ecx, ecx
imul eax, r14d
mov edx, eax
mov r12d, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
je 0x24c54
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call qword [sym.imp.ks.sys_KsAddItemToObjectBag]
mov rcx, rbp
mov ebx, eax
test eax, eax
jns 0x24b37
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24c0e
mov rdx, qword [rsp + 0xb8]
mov r8, r12
call fcn.00039320
xor ecx, ecx
mov dword [rsp + 0x150], ecx
test r14d, r14d
je 0x24c0a
xor r15d, r15d
mov eax, dword [r15 + rbp + 0x20]
test eax, eax
je 0x24bf0
lea rdx, [rax + rax*2]
xor ecx, ecx
mov r8d, 0x74786e43
shl rdx, 3
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rax, rax
je 0x24c54
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call qword [sym.imp.ks.sys_KsAddItemToObjectBag]
mov ebx, eax
test eax, eax
js 0x24c2e
mov ecx, dword [r15 + rbp + 0x20]
mov rdx, qword [r15 + rbp + 0x28]
lea r8, [rcx + rcx*2]
mov rcx, r12
shl r8, 3
call fcn.00039320
xor r11d, r11d
cmp dword [r15 + rbp + 0x20], r11d
jbe 0x24be4
mov ecx, dword [rsp + 0x148]
lea rax, [r12 + 0x10]
mov dword [rax], ecx
inc r11d
add rax, 0x18
cmp r11d, dword [r15 + rbp + 0x20]
jb 0x24bd4
mov ecx, dword [rsp + 0x150]
mov qword [r15 + rbp + 0x28], r12
add r15d, dword [rsp + 0xb4]
inc ecx
mov dword [rsp + 0x150], ecx
cmp ecx, r14d
jb 0x24b5c
mov qword [rsi + 0x28], rbp
mov r12, qword [rsp + 0x140]
xor r14d, r14d
cmp ebx, r14d
mov eax, ebx
jl 0x24d77
mov r15d, dword [rsp + 0x148]
jmp 0x24c39
mov rcx, r12
jmp 0x24b2a
xor r14d, r14d
mov edx, 0x18
xor ecx, ecx
mov r8d, 0x74786e43
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r14
jne 0x24c5e
mov eax, 0xc0000017
jmp 0x24d77
mov rcx, qword [r12 + 8]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ks.sys_KsAddItemToObjectBag]
cmp eax, r14d
mov ebp, eax
jge 0x24c88
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebp
jmp 0x24d77
mov eax, dword [rdi + 8]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rbx + 8], eax
mov rax, qword [rdi + 0x10]
mov rdx, rsi
mov rcx, r12
mov qword [rbx], rsi
mov qword [rbx + 0x10], rax
call sub.BdaSup.SYS_BdaCreateFilterFactoryEx
cmp eax, r14d
jl 0x24d77
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
call sub.BdaSup.SYS_BdaFilterFactoryUpdateCacheData
cmp eax, r14d
jl 0x24d77
xor eax, eax
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], r14d
mov word [rsp + 0x3c], r14w
mov word [rsp + 0x3e], r14w
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
lea r9, [rsp + 0x140]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
lea rcx, [rsp + 0x70]
mov qword [rdx + 0x10], rax
mov rax, qword [0x0003f308]
lea rdx, [0x0003d158]
mov qword [rcx], rax
mov rax, qword [0x0003f310]
mov r8d, 2
mov qword [rcx + 8], rax
mov rax, qword [0x0003f318]
mov qword [rsp + 0x28], r14
mov qword [rcx + 0x10], rax
mov rcx, qword [r12 + 0x20]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x140], r14d
mov dword [rsp + 0x144], 1
call qword [sym.imp.ks.sys_KsRegisterFilterWithNoKSPins]
mov rbx, qword [rsp + 0x158]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret