Function at 0x140017130
Capabilities:
Resolve function by parsing pe exports
Stop service
Unload minifilter driver

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x90
mov rax, qword [0x1400a2060]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov qword [rsp + 0x38], 0
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rsp + 0x30]
mov rcx, rax
lea edx, [r8 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1400171c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14001718b
movzx eax, ax
or eax, 0x80070000
cmp eax, 0x800703f0
jne 0x1400171c1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400171c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400171c3
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x14001759f
mov rbx, qword [rsp + 0x30]
mov rax, rbx
mov qword [rsp + 0x88], rdi
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140017244
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeLoadDriverPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140017244
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x44], rax
mov rcx, rbx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
setne dil
jmp 0x140017247
xor dil, dil
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001725a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], r12
test dil, dil
jne 0x1400172ca
mov rcx, qword [str.h__n_]
lea r12, str.h__n_
cmp rcx, r12
je 0x14001729b
test byte [rcx + 0x1c], 0x80
je 0x14001729b
cmp byte [rcx + 0x19], 2
jb 0x14001729b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008f668]
mov edx, 0xc
call fcn.140005090
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], 6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
mov dword [r14 + 4], eax
mov dword [r14], 0
mov qword [r14 + 8], rcx
jmp 0x140017500
mov rdi, qword [rsi]
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0x78], r13
mov r13, qword [rsi + 8]
mov qword [rsp + 0x70], r15
xor r15d, r15d
cmp rdi, r13
je 0x1400174d8
lea r12, str.h__n_
mov esi, 0x80000000
lea r11, [0x14008f7c0]
mov rcx, qword [str.h__n_]
cmp rcx, r12
je 0x140017343
test byte [rcx + 0x1c], 0x80
je 0x140017343
cmp byte [rcx + 0x19], 4
jb 0x140017343
cmp qword [rdi + 0x18], 8
mov r9, rdi
jb 0x140017327
mov r9, qword [rdi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008f668]
mov edx, 0xd
call fcn.1400050c0
lea r11, [0x14008f7c0]
mov r10, qword [rdi + 0x18]
mov r9, rdi
cmp r10, 8
jb 0x140017353
mov r9, qword [rdi]
cmp qword [rdi + 0x10], 6
jne 0x140017394
movzx ecx, word [r9]
mov edx, 0x6d
mov r8d, 6
mov rax, r11
cmp cx, dx
jb 0x140017394
sub r9, r11
cmp cx, dx
ja 0x140017394
cmp r8, 1
je 0x1400173bf
movzx ecx, word [rax + r9 + 2]
add rax, 2
dec r8
movzx edx, word [rax]
cmp cx, dx
jae 0x140017377
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140017446
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
xor esi, esi
jmp 0x1400174a7
mov rcx, rdi
cmp r10, 8
jb 0x1400173cb
mov rcx, qword [rdi]
call qword [sym.imp.FLTLIB.DLL_FilterUnload]
mov ebx, eax
lea ecx, [rax + rsi]
test esi, ecx
jne 0x1400174c8
cmp eax, 0x801f0013
je 0x1400174c8
mov rcx, qword [str.h__n_]
cmp rcx, r12
je 0x140017425
test byte [rcx + 0x1c], 0x80
je 0x140017425
cmp byte [rcx + 0x19], 2
jb 0x140017425
cmp qword [rdi + 0x18], 8
jb 0x14001740b
mov rdi, qword [rdi]
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov qword [rsp + 0x28], rdi
mov r9d, ebx
mov dword [rsp + 0x20], ebx
call fcn.1400165f0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], 2
mov rax, qword [rsp + 0x38]
mov dword [r14], r15d
mov dword [r14 + 4], ebx
jmp 0x1400174ea
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140017453
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14001747d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400174a7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebx, ebx
jne 0x1400174ba
lea edx, [rbp - 0x424]
test edx, 0xfffffffd
jne 0x14001752c
test rsi, rsi
je 0x1400174c3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 0x80000000
inc r15d
add rdi, 0x20
cmp rdi, r13
jne 0x1400172fb
mov dword [r14], r15d
mov dword [r14 + 4], 0
mov rax, qword [0x14008f3e0]
mov qword [r14 + 8], rax
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0xc0]
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
mov rax, r14
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004c7f0
add rsp, 0x90
pop r14
pop rsi
pop rbx
ret
mov rcx, qword [str.h__n_]
cmp rcx, r12
je 0x140017568
test byte [rcx + 0x1c], 0x80
je 0x140017568
cmp byte [rcx + 0x19], 2
jb 0x140017568
cmp qword [rdi + 0x18], 8
jb 0x14001754e
mov rdi, qword [rdi]
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov qword [rsp + 0x28], rdi
mov r9d, ebp
mov dword [rsp + 0x20], ebp
call fcn.1400165f0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], 6
mov rax, qword [rsp + 0x38]
mov dword [r14], r15d
mov dword [r14 + 4], ebp
mov qword [r14 + 8], rax
test rsi, rsi
je 0x1400174ee
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400174ee
mov rcx, qword [rsp + 0xa8]
mov r9d, eax
call fcn.140016210
int3