Function at 0x140178acc
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xaa0
mov rax, qword [0x14001acb0]
xor rax, rsp
mov qword [rsp + 0xa90], rax
mov r12, rdx
mov r15, rcx
xor r13d, r13d
mov word [r11 - 0x838], r13w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [r11 - 0x836]
call fcn.140014fe0
mov byte [rsp + 0x190], r13b
mov dword [rsp + 0x194], r13d
lea rcx, [0x1400111fc]
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x1a0], r13
xor eax, eax
mov qword [rsp + 0x1a8], rax
mov byte [rsp + 0x1b0], 6
mov dword [rsp + 0x1b4], r13d
mov qword [rsp + 0x1b8], rcx
mov qword [rsp + 0x1c0], r13
mov qword [rsp + 0x1c8], rax
mov byte [rsp + 0x1d0], 3
mov dword [rsp + 0x1d4], r13d
mov qword [rsp + 0x1d8], rcx
mov qword [rsp + 0x1e0], r13
mov qword [rsp + 0x1e8], rax
mov byte [rsp + 0x1f0], 4
mov dword [rsp + 0x1f4], r13d
mov qword [rsp + 0x1f8], rcx
lea rax, [0x1400106bc]
mov qword [rsp + 0x200], rax
xor eax, eax
mov qword [rsp + 0x208], rax
mov byte [rsp + 0x210], 0xc
mov dword [rsp + 0x214], r13d
mov qword [rsp + 0x218], rcx
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], rax
mov byte [rsp + 0x230], 0x15
mov dword [rsp + 0x234], r13d
mov qword [rsp + 0x238], rcx
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x248], rax
mov byte [rsp + 0x250], 9
mov dword [rsp + 0x254], r13d
mov qword [rsp + 0x258], rcx
mov qword [rsp + 0x260], r13
mov qword [rsp + 0x268], rax
mov byte [rsp + 0x270], 0x80
xor edx, edx
lea r8d, [r13 + 0x1c]
lea rcx, [rsp + 0x274]
call fcn.140014fe0
mov dword [rsp + 0x120], 2
lea rax, [0x14000f364]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 1
mov dword [rsp + 0x138], 0x63497843
xor eax, eax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov eax, 0xffff
mov word [rsp + 0x158], ax
xor edx, edx
lea r8d, [r13 + 0x36]
lea rcx, [rsp + 0x15a]
call fcn.140014fe0
mov qword [rsp + 0x70], 0x2020068
lea rax, [rsp + 0x120]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x80], rax
lea rax, [0x14017319c]
mov qword [rsp + 0x88], rax
lea rax, [0x140173008]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], r13
lea rax, [0x140173144]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0xc0], r13
lea rax, [0x14001066c]
mov qword [rsp + 0xc8], rax
xor eax, eax
mov qword [rsp + 0xd0], rax
call fcn.14000ec08
mov byte [0x14001a100], al
xor r9d, r9d
lea r8, [0x14001c2d8]
lea rdx, [0x14001c2d4]
lea rcx, [0x14001c2d0]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov dword [0x140026218], 0x2000000
lea rax, [0x14001b6b0]
mov qword [0x140026220], rax
mov dword [0x1400261f8], 0x2000000
lea rax, [0x14001b8b0]
mov qword [0x140026200], rax
mov dword [0x140026208], 0x2000000
lea rax, [0x14001bab0]
mov qword [0x140026210], rax
mov dword [0x1400261b8], 0x2000000
lea rax, [0x14001bcb0]
mov qword [0x1400261c0], rax
mov dword [0x140026198], 0x2000000
lea rax, [0x14001beb0]
mov qword [0x1400261a0], rax
mov dword [0x1400261a8], 0x2000000
lea rax, [0x14001c0b0]
mov qword [0x1400261b0], rax
mov dword [0x140026278], 0x2000000
lea rax, [0x14001b0b0]
mov qword [0x140026280], rax
mov dword [0x140026258], 0x2000000
lea rax, [0x14001b2b0]
mov qword [0x140026260], rax
mov dword [0x140026268], 0x2000000
lea rax, [0x14001b4b0]
mov qword [0x140026270], rax
mov r14d, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [0x140000000]
cmp r14d, 0x1a
jge 0x140177473
movsxd rdi, r14d
mov rsi, rdi
lea eax, [r14 + 0x41]
mov dword [rcx + rdi*4 + 0x171340], eax
shl rdi, 4
lea rbx, [rcx + 0x1711a0]
add rbx, rdi
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x140000000]
lea rdi, [rdi + 0x1713a8]
add rdi, rax
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rcx, [0x140000000]
mov dword [rcx + rsi*4 + 0x170ff4], r13d
mov dword [rcx + rsi*4 + 0x17105c], r13d
mov dword [rcx + rsi*4 + 0x1710c4], r13d
mov dword [rcx + rsi*4 + 0x17112c], r13d
mov dword [rcx + rsi*4 + 0x170ea8], r13d
mov dword [rcx + rsi*4 + 0x170f1c], r13d
mov dword [rcx + rsi*4 + 0x170f84], r13d
inc r14d
mov dword [rsp + 0x40], r14d
jmp 0x1401773ae
mov qword [0x140170f10], r13
mov dword [0x140170f18], r13d
mov qword [0x140170fec], r13
mov qword [0x140171194], r13
mov qword [0x14016ae20], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
lea r14, [0x140000000]
cmp esi, 0x400
jge 0x14017751c
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x16ae50], r13d
shl rax, 4
lea rbx, [r14 + 0x15ade0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x16ae40]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401774a5
mov qword [0x140164e00], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x1401775a2
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x164e30], r13d
shl rax, 4
lea rbx, [r14 + 0x156de0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x164e20]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x14017752b
mov qword [0x14015ede0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177628
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x15ee10], r13d
shl rax, 4
lea rbx, [r14 + 0x152de0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x15ee00]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401775b1
mov qword [0x14012b580], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x1401776ae
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x12b5b0], r13d
shl rax, 4
lea rbx, [r14 + 0xa32c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x12b5a0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177637
mov qword [0x140125560], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177734
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x125590], r13d
shl rax, 4
lea rbx, [r14 + 0xa32c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x125580]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401776bd
mov qword [0x14010d4e0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x1401777ba
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x10d510], r13d
shl rax, 4
lea rbx, [r14 + 0x9f2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x10d500]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177743
mov qword [0x14011f540], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177840
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x11f570], r13d
shl rax, 4
lea rbx, [r14 + 0x9b2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x11f560]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401777c9
mov qword [0x140119520], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x1401778c6
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x119550], r13d
shl rax, 4
lea rbx, [r14 + 0x972c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x119540]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x14017784f
mov qword [0x140113500], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x14017794c
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x113530], r13d
shl rax, 4
lea rbx, [r14 + 0x932c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x113520]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401778d5
mov qword [0x1401074c0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x1401779d2
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x1074f0], r13d
shl rax, 4
lea rbx, [r14 + 0x8f2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x1074e0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x14017795b
mov qword [0x1400ef440], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177a58
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xef470], r13d
shl rax, 4
lea rbx, [r14 + 0x8b2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xef460]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401779e1
mov qword [0x1401014a0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177ade
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x1014d0], r13d
shl rax, 4
lea rbx, [r14 + 0x872c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x1014c0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177a67
mov qword [0x1400fb480], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177b64
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xfb4b0], r13d
shl rax, 4
lea rbx, [r14 + 0x832c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xfb4a0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177aed
mov qword [0x1400f5460], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177bea
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xf5490], r13d
shl rax, 4
lea rbx, [r14 + 0x7f2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xf5480]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177b73
mov qword [0x1400e9420], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177c70
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xe9450], r13d
shl rax, 4
lea rbx, [r14 + 0x7b2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xe9440]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177bf9
mov qword [0x1400d13a0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177cf6
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xd13d0], r13d
shl rax, 4
lea rbx, [r14 + 0x772c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xd13c0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177c7f
mov qword [0x1400e3400], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177d7c
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xe3430], r13d
shl rax, 4
lea rbx, [r14 + 0x732c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xe3420]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177d05
mov qword [0x1400dd3e0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177e02
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xdd410], r13d
shl rax, 4
lea rbx, [r14 + 0x6f2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xdd400]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177d8b
mov qword [0x1400d73c0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177e88
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xd73f0], r13d
shl rax, 4
lea rbx, [r14 + 0x6b2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xd73e0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177e11
mov qword [0x1400cb380], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177f0e
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xcb3b0], r13d
shl rax, 4
lea rbx, [r14 + 0x672c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xcb3a0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177e97
mov qword [0x1400bf340], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140177f94
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xbf370], r13d
shl rax, 4
lea rbx, [r14 + 0x632c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xbf360]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177f1d
mov qword [0x1400c5360], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x14017801a
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xc5390], r13d
shl rax, 4
lea rbx, [r14 + 0x5f2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xc5380]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140177fa3
mov qword [0x14004daa0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
movsxd rax, esi
lea rbx, [r14 + 0x48280]
lea rdx, [0x140178b00]
cmp esi, 0x100
jge 0x1401780a0
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x4dad0], r13d
shl rax, 4
add rbx, rax
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x4dac0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140178029
shl rax, 4
add rbx, rax
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
mov rdx, rbx
lea rcx, [0x140044270]
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
lea rcx, [0x140044270]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
mov rdx, rbx
lea rcx, [0x140044260]
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
lea rcx, [0x140044260]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov qword [0x14004c280], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x100
jge 0x1401781b4
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x4c2b0], r13d
shl rax, 4
lea rbx, [r14 + 0x44280]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x4c2a0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x14017813d
mov qword [0x140029ac0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x100
jge 0x14017823a
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x29af0], r13d
shl rax, 4
lea rbx, [r14 + 0x272a0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x29ae0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401781c3
mov qword [0x1400282a0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x100
jge 0x1401782c0
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0x282d0], r13d
shl rax, 4
lea rbx, [r14 + 0x262a0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0x282c0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140178249
mov qword [0x1400b3300], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140178346
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xb3330], r13d
shl rax, 4
lea rbx, [r14 + 0x572c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xb3320]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401782cf
mov qword [0x1400ad2e0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x1401783cc
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xad310], r13d
shl rax, 4
lea rbx, [r14 + 0x532c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xad300]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x140178355
mov qword [0x1400a72c0], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x140178452
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xa72f0], r13d
shl rax, 4
lea rbx, [r14 + 0x4f2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xa72e0]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401783db
mov ecx, r13d
mov dword [rsp + 0x40], ecx
cmp ecx, 0x80
jge 0x1401784c9
movsxd r8, ecx
imul r8, r8, 0x98
mov dword [r8 + r14 + 0x3f6f0], r13d
mov dword [r8 + r14 + 0x3f660], 0x8000000
lea rax, [rsp + 0x290]
mov qword [r8 + r14 + 0x3f668], rax
mov edx, r13d
mov dword [rsp + 0x5c], edx
cmp edx, 8
jge 0x1401784c5
movsxd rax, edx
shl rax, 4
add rax, r8
lea r9, [0x14003f670]
add rax, r9
mov dword [rax], 0x8000000
lea r9, [rsp + 0x290]
mov qword [rax + 8], r9
inc edx
jmp 0x140178492
inc ecx
jmp 0x140178455
mov qword [0x1400b9320], r13
mov esi, r13d
mov dword [rsp + 0x40], r13d
cmp esi, 0x400
jge 0x14017854f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r14 + rdi*8 + 0xb9350], r13d
shl rax, 4
lea rbx, [r14 + 0x5b2c0]
add rbx, rax
lea rdx, [0x140178b00]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xb9340]
add rdi, r14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140179310]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
inc esi
mov dword [rsp + 0x40], esi
jmp 0x1401784d8
mov dword [0x1401421cc], r13d
mov dword [0x1401421c8], r13d
mov dword [0x1401421c4], r13d
mov dword [0x1401421c0], r13d
mov dword [0x1401315ac], r13d
mov dword [0x1401315a8], r13d
mov dword [0x1401315a4], r13d
mov dword [0x1401315a0], r13d
mov ecx, r13d
mov dword [rsp + 0x40], ecx
cmp ecx, 0x400
jge 0x140178650
movsxd rax, ecx
shl rax, 4
mov dword [rax + r14 + 0x146de0], 0x8000000
lea rdx, [rsp + 0x290]
mov qword [rax + r14 + 0x146de8], rdx
mov dword [rax + r14 + 0x14ade0], 0x8000000
lea rdx, [rsp + 0x290]
mov qword [rax + r14 + 0x14ade8], rdx
mov dword [rax + r14 + 0x14ede0], 0x8000000
lea rdx, [rsp + 0x290]
mov qword [rax + r14 + 0x14ede8], rdx
mov dword [rax + r14 + 0x1361c0], 0x8000000
lea rdx, [rsp + 0x290]
mov qword [rax + r14 + 0x1361c8], rdx
mov dword [rax + r14 + 0x13a1c0], 0x8000000
lea rdx, [rsp + 0x290]
mov qword [rax + r14 + 0x13a1c8], rdx
mov dword [rax + r14 + 0x13e1c0], 0x8000000
lea rdx, [rsp + 0x290]
mov qword [rax + r14 + 0x13e1c8], rdx
inc ecx
jmp 0x14017858a
mov r8d, r13d
mov dword [rsp + 0x40], r13d
cmp r8d, 0x80
jge 0x14017871e
movsxd rdx, r8d
imul rdx, rdx, 0x98
mov dword [rdx + r14 + 0x1421e0], 0x8000000
lea rax, [rsp + 0x290]
mov qword [rdx + r14 + 0x1421e8], rax
mov dword [rdx + r14 + 0x1315c0], 0x8000000
lea rax, [rsp + 0x290]
mov qword [rdx + r14 + 0x1315c8], rax
mov r9d, r13d
mov dword [rsp + 0x5c], r13d
cmp r9d, 8
jge 0x140178701
movsxd rcx, r9d
shl rcx, 4
add rcx, rdx
mov dword [rcx + r14 + 0x1421f0], 0x8000000
lea rax, [rsp + 0x290]
mov qword [rcx + r14 + 0x1421f8], rax
mov dword [rcx + r14 + 0x1315d0], 0x8000000
lea rax, [rsp + 0x290]
mov qword [rcx + r14 + 0x1315d8], rax
inc r9d
mov dword [rsp + 0x5c], r9d
jmp 0x1401786af
mov dword [rdx + r14 + 0x142270], r13d
mov dword [rdx + r14 + 0x131650], r13d
inc r8d
mov dword [rsp + 0x40], r8d
jmp 0x140178658
mov dword [0x14001b010], r13d
mov qword [0x14001ae00], 0x1f4
mov dword [0x14001b014], 0x400
mov qword [0x14001ad40], r15
lea rax, [0x14001ad68]
mov qword [0x14001ad70], rax
mov qword [0x14001ad68], rax
mov qword [0x14001ad60], r13
mov word [rsp + 0x30], r13w
mov dword [rsp + 0x28], 0x7970534d
mov qword [rsp + 0x20], 0x200
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001ad80]
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
lea rcx, [0x140179320]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x14001b020], rax
lea rcx, [0x140179340]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x14001b028], rax
lea rcx, [0x140179360]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x14001b030], rax
mov rcx, r12
call fcn.140178958
lea r8, [0x14001ad48]
lea rdx, [rsp + 0x70]
mov rcx, r15
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
mov dword [rsp + 0x58], eax
test eax, eax
js 0x1401788ee
mov edx, 0x1f0001
lea rcx, [rsp + 0x60]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov ebx, eax
mov dword [rsp + 0x58], eax
test eax, eax
js 0x14017881e
xor r9d, r9d
xor r8d, r8d
mov dl, 1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlSetDaclSecurityDescriptor]
mov ebx, eax
mov dword [rsp + 0x58], eax
test ebx, ebx
js 0x1401788ee
lea rdx, [0x140179380]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xe0], 0x30
mov qword [rsp + 0xe8], r13
mov dword [rsp + 0xf8], 0x240
lea rax, [rsp + 0x110]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], r13
mov dword [rsp + 0x38], 1
lea rax, [0x140173424]
mov qword [rsp + 0x30], rax
lea rax, [0x140173180]
mov qword [rsp + 0x28], rax
lea rax, [0x140173170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0xe0]
lea rdx, [0x14001ad50]
mov rcx, qword [0x14001ad48]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [rsp + 0x60]
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
test ebx, ebx
js 0x1401788ee
mov rcx, qword [0x14001ad48]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
mov dword [rsp + 0x58], eax
test ebx, ebx
jns 0x140178921
mov rcx, qword [0x14001ad50]
test rcx, rcx
je 0x140178903
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x14001ad48]
test rcx, rcx
je 0x140178914
call sub.FLTMGR.SYS_FltUnregisterFilter
lea rcx, [0x14001ad80]
call qword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
mov eax, ebx
mov rcx, qword [rsp + 0xa90]
xor rcx, rsp
call fcn.140014ae0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140178a64
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140177008