Function at 0x140003978
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, rdx
mov rdi, rcx
mov rcx, rax
lea rdx, [0x14000b960]
call fcn.140003ce4
mov esi, eax
test eax, eax
jns 0x1400039e6
lfence
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, al
lea r8, [0x14000b970]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140003c70
xor edx, edx
lea rcx, [0x140013530]
call fcn.140009608
mov esi, eax
test eax, eax
js 0x1400039a2
xor r8d, r8d
lea rdx, [0x140003cb0]
xor ecx, ecx
call fcn.1400011e4
mov edx, 1
lea rcx, [0x140013528]
call fcn.140009608
mov esi, eax
test eax, eax
jns 0x140003a6d
lfence
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, al
lea r8, [0x14000b970]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140013530]
jmp 0x140003c6b
xor r8d, r8d
lea rdx, [0x140003c90]
lea ecx, [r8 + 1]
call fcn.1400011e4
mov edx, 4
lea rcx, [0x140013520]
call fcn.140009608
mov esi, eax
test eax, eax
jns 0x140003aee
lfence
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, al
lea r8, [0x14000b970]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140013530]
call fcn.140009540
mov rcx, qword [0x140013528]
jmp 0x140003c6b
mov rax, qword [str.DsArk64.sys]
xor ebx, ebx
jmp 0x140003b2d
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140013520]
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rdx, [rsp + 0x40]
call fcn.1400091c0
inc ebx
lea rcx, str.DsArk64.sys
mov rax, qword [rcx + rbx*8]
test rax, rax
jne 0x140003af9
xor r8d, r8d
lea rdx, [0x140003cd0]
lea ecx, [rax + 7]
call fcn.1400011e4
lea r8, [0x140013090]
mov rcx, rdi
lea rdx, [0x1400104d0]
call sub.FLTMGR.SYS_FltRegisterFilter
mov esi, eax
test eax, eax
js 0x140003c0a
mov rcx, qword [0x140013090]
call sub.FLTMGR.SYS_FltStartFiltering
mov esi, eax
lfence
test eax, eax
jns 0x140003bc6
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, al
lea r8, [0x14000b9f0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140013090]
call sub.FLTMGR.SYS_FltUnregisterFilter
jmp 0x140003c49
mov byte [0x140013088], 1
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov edx, 2
mov qword [rsp + 0x28], rdi
movzx r9d, al
lea r8, [0x14000bad0]
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140003c70
lfence
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
xor edx, edx
mov dword [rsp + 0x30], esi
movzx r9d, al
lea r8, [0x14000ba60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lfence
mov rcx, qword [0x140013530]
call fcn.140009540
mov rcx, qword [0x140013528]
call fcn.140009540
mov rcx, qword [0x140013520]
call fcn.140009540
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret