Function at 0x2541c
Capabilities:
Print debug messages
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x1d0
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x40], ebx
lea r12, [0x00025440]
mov rdx, r12
lea rcx, [0x00025450]
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x0001d288], bl
mov byte [0x0001d1d8], bl
mov qword [0x0001d198], rbx
mov byte [0x0001d1c9], bl
mov byte [0x0001d1d9], bl
mov byte [0x0001d2b8], bl
mov byte [0x0001d299], bl
mov byte [0x0001d250], bl
mov byte [0x0001d191], bl
mov byte [0x0001d298], bl
mov byte [0x0001d2d0], bl
mov byte [0x0001d1c8], bl
mov byte [0x0001d270], bl
mov byte [0x0001d251], bl
mov qword [0x0001d1d0], rbx
mov qword [0x0001d1c0], rbx
mov byte [0x0001d190], bl
mov qword [0x0001d2a8], rbx
mov qword [0x0001d280], rbx
mov qword [0x0001d328], rbx
mov qword [0x0001d2c0], rbx
mov qword [0x0001d290], rbx
mov qword [0x0001d260], rbx
mov qword [0x0001d1b8], rbx
mov qword [0x0001d2b0], rbx
mov qword [0x0001d2c8], rbx
mov qword [0x0001d278], rbx
mov qword [0x0001d248], rbx
mov qword [0x0001d258], rbx
mov qword [0x0001d1b0], rbx
mov qword [0x0001d1a0], rbx
mov qword [0x0001d1a8], rbx
mov dword [rsp + 0xa0], 0x114
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp eax, ebx
jl 0x2533f
mov eax, dword [rsp + 0xa4]
mov dword [0x0001d184], eax
mov eax, dword [rsp + 0xa8]
mov dword [0x0001d180], eax
lea r8, [0x0001d2e8]
lea rdx, [0x0001aee0]
mov rcx, rsi
call sub.FLTMGR.SYS_FltRegisterFilter
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, ebx
jl 0x2533f
mov rdx, r12
lea rcx, [0x00025480]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, str.TvAtRsPtPortNormal
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, str.TvAtRsPtPortIocp
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov qword [0x0001d1d0], rsi
mov edx, 0x1f0001
lea rcx, [rsp + 0x48]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, ebx
jl 0x2533f
mov rdx, r12
lea rcx, [0x000254c0]
call sub.ntoskrnl.exe_DbgPrint
lea esi, [rbx + 0x30]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x68], 0x240
lea rax, [rsp + 0x80]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x38], 1
lea rax, [0x0001f324]
mov qword [rsp + 0x30], rax
lea rax, [0x0001f234]
mov qword [rsp + 0x28], rax
lea rax, [0x0001f1f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [0x0001d2f0]
mov rcx, qword [0x0001d2e8]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, ebx
jl 0x2533f
mov rdx, r12
lea rcx, [0x00025510]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x68], 0x240
lea rax, [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rbx
lea rax, [0x0001f2bc]
mov qword [rsp + 0x28], rax
lea rax, [0x0001f278]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [0x0001d2f8]
mov rcx, qword [0x0001d2e8]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, ebx
jl 0x2533f
mov rdx, r12
lea rcx, [0x00025540]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
lea rcx, [0x00014d00]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
mov rcx, qword [0x0001d2e8]
call sub.FLTMGR.SYS_FltStartFiltering
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, ebx
jl 0x2533f
mov rdx, r12
lea rcx, [0x00025570]
call sub.ntoskrnl.exe_DbgPrint
nop
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x2534e
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
cmp edi, ebx
jge 0x2538c
mov rcx, qword [0x0001d2f0]
cmp rcx, rbx
je 0x25363
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x0001d2f8]
cmp rcx, rbx
je 0x25374
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x0001d2e8]
cmp rcx, rbx
je 0x2538c
call sub.FLTMGR.SYS_FltUnregisterFilter
mov qword [0x0001d2e8], rbx
mov eax, edi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.00017100
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.000253c0
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x25008