Function at 0x140002620
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
lea rcx, [0x14000b978]
call fcn.140001a74
xor esi, esi
test eax, eax
jns 0x140002656
lfence
jmp 0x1400028d7
cmp qword [0x14000b968], rsi
je 0x14000266f
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b960]
call fcn.140001f20
cmp qword [0x14000b958], rsi
je 0x140002688
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b950]
call fcn.140001f20
cmp qword [0x14000b948], rsi
je 0x1400026a1
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b940]
call fcn.140001f20
cmp qword [0x14000b938], rsi
je 0x1400026ba
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b930]
call fcn.140001f20
cmp qword [0x14000b928], rsi
je 0x1400026d3
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b920]
call fcn.140001f20
cmp qword [0x14000b918], rsi
je 0x1400026ec
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b910]
call fcn.140001f20
cmp qword [0x14000b908], rsi
je 0x140002705
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b900]
call fcn.140001f20
cmp qword [0x14000b8f8], rsi
je 0x14000271e
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8f0]
call fcn.140001f20
cmp qword [0x14000b8e8], rsi
je 0x140002737
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8e0]
call fcn.140001f20
cmp qword [0x14000b8d8], rsi
je 0x140002750
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8d0]
call fcn.140001f20
cmp qword [0x14000b8c8], rsi
je 0x140002769
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8c0]
call fcn.140001f20
cmp qword [0x14000b8b8], rsi
je 0x140002782
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8b0]
call fcn.140001f20
cmp qword [0x14000b8a8], rsi
je 0x14000279b
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8a0]
call fcn.140001f20
cmp qword [0x14000b898], rsi
je 0x1400027b4
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b890]
call fcn.140001f20
cmp qword [0x14000b888], rsi
je 0x1400027cd
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b880]
call fcn.140001f20
cmp qword [0x14000b878], rsi
je 0x1400027e6
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b870]
call fcn.140001f20
cmp qword [0x14000b868], rsi
je 0x1400027ff
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b860]
call fcn.140001f20
cmp qword [0x14000b858], rsi
je 0x140002818
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b850]
call fcn.140001f20
cmp qword [0x14000b848], rsi
je 0x140002831
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b840]
call fcn.140001f20
cmp qword [0x14000b838], rsi
je 0x14000284a
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b830]
call fcn.140001f20
mov edx, 1
lea rcx, [0x14000b970]
call fcn.140001a74
mov ebx, eax
test eax, eax
jns 0x14000286d
lfence
mov rcx, qword [0x14000b978]
jmp 0x1400028d0
xor r8d, r8d
lea rdx, [0x140002900]
lea ecx, [r8 + 1]
call fcn.1400013cc
lea r8, [0x140009030]
mov rcx, rdi
lea rdx, [0x1400077d0]
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
test eax, eax
js 0x1400028ba
mov rcx, qword [0x140009030]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
test eax, eax
jns 0x1400028ec
mov rcx, qword [0x140009030]
call sub.FLTMGR.SYS_FltUnregisterFilter
lfence
mov rcx, qword [0x14000b978]
call fcn.1400019ac
mov rcx, qword [0x14000b970]
call fcn.1400019ac
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
lfence
mov byte [0x140009028], 1
jmp 0x1400028d7