Function at 0x140002500
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
lea rcx, [0x14000aca8]
call fcn.140001a34
xor esi, esi
test eax, eax
jns 0x140002536
lfence
jmp 0x1400027b7
cmp qword [0x14000ac98], rsi
je 0x14000254f
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac90]
call fcn.140001e00
cmp qword [0x14000ac88], rsi
je 0x140002568
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac80]
call fcn.140001e00
cmp qword [0x14000ac78], rsi
je 0x140002581
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac70]
call fcn.140001e00
cmp qword [0x14000ac68], rsi
je 0x14000259a
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac60]
call fcn.140001e00
cmp qword [0x14000ac58], rsi
je 0x1400025b3
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac50]
call fcn.140001e00
cmp qword [0x14000ac48], rsi
je 0x1400025cc
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac40]
call fcn.140001e00
cmp qword [0x14000ac38], rsi
je 0x1400025e5
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac30]
call fcn.140001e00
cmp qword [0x14000ac28], rsi
je 0x1400025fe
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac20]
call fcn.140001e00
cmp qword [0x14000ac18], rsi
je 0x140002617
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac10]
call fcn.140001e00
cmp qword [0x14000ac08], rsi
je 0x140002630
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac00]
call fcn.140001e00
cmp qword [0x14000abf8], rsi
je 0x140002649
lea rdx, [rbp + 0x18]
lea rcx, [0x14000abf0]
call fcn.140001e00
cmp qword [0x14000abe8], rsi
je 0x140002662
lea rdx, [rbp + 0x18]
lea rcx, [0x14000abe0]
call fcn.140001e00
cmp qword [0x14000abd8], rsi
je 0x14000267b
lea rdx, [rbp + 0x18]
lea rcx, [0x14000abd0]
call fcn.140001e00
cmp qword [0x14000abc8], rsi
je 0x140002694
lea rdx, [rbp + 0x18]
lea rcx, [0x14000abc0]
call fcn.140001e00
cmp qword [0x14000abb8], rsi
je 0x1400026ad
lea rdx, [rbp + 0x18]
lea rcx, [0x14000abb0]
call fcn.140001e00
cmp qword [0x14000aba8], rsi
je 0x1400026c6
lea rdx, [rbp + 0x18]
lea rcx, [0x14000aba0]
call fcn.140001e00
cmp qword [0x14000ab98], rsi
je 0x1400026df
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ab90]
call fcn.140001e00
cmp qword [0x14000ab88], rsi
je 0x1400026f8
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ab80]
call fcn.140001e00
cmp qword [0x14000ab78], rsi
je 0x140002711
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ab70]
call fcn.140001e00
cmp qword [0x14000ab68], rsi
je 0x14000272a
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ab60]
call fcn.140001e00
mov edx, 1
lea rcx, [0x14000aca0]
call fcn.140001a34
mov ebx, eax
test eax, eax
jns 0x14000274d
lfence
mov rcx, qword [0x14000aca8]
jmp 0x1400027b0
xor r8d, r8d
lea rdx, [0x1400027e0]
lea ecx, [r8 + 1]
call fcn.1400013cc
lea r8, [0x140008030]
mov rcx, rdi
lea rdx, [0x140006760]
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
test eax, eax
js 0x14000279a
mov rcx, qword [0x140008030]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
test eax, eax
jns 0x1400027cc
mov rcx, qword [0x140008030]
call sub.FLTMGR.SYS_FltUnregisterFilter
lfence
mov rcx, qword [0x14000aca8]
call fcn.14000196c
mov rcx, qword [0x14000aca0]
call fcn.14000196c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
lfence
mov byte [0x140008028], 1
jmp 0x1400027b7