Function at 0x140197000
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8d0
mov rax, qword [0x140019a10]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
xor r15d, r15d
mov dword [rsp + 0x44], r15d
mov ebx, 0x800
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140013680
nop
xor r9d, r9d
lea r8, [0x14001afd4]
lea rdx, [0x14001afd0]
lea rcx, [0x14001afcc]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
xorps xmm0, xmm0
movups xmmword [0x140024f60], xmm0
mov ecx, 0x200
mov word [0x140024f62], cx
lea rax, [0x14001a3b0]
mov qword [0x140024f68], rax
movups xmmword [0x140024f40], xmm0
mov word [0x140024f42], cx
lea rax, [0x14001a5b0]
mov qword [0x140024f48], rax
movups xmmword [0x140024f50], xmm0
mov word [0x140024f52], cx
lea rax, [0x14001a7b0]
mov qword [0x140024f58], rax
movups xmmword [0x140024f00], xmm0
mov word [0x140024f02], cx
lea rax, [0x14001a9b0]
mov qword [0x140024f08], rax
movups xmmword [0x140024ee0], xmm0
mov word [0x140024ee2], cx
lea rax, [0x14001abb0]
mov qword [0x140024ee8], rax
movups xmmword [0x140024ef0], xmm0
mov word [0x140024ef2], cx
lea rax, [0x14001adb0]
mov qword [0x140024ef8], rax
movups xmmword [0x140024fc0], xmm0
mov word [0x140024fc2], cx
lea rax, [0x140019db0]
mov qword [0x140024fc8], rax
movups xmmword [0x140024fa0], xmm0
mov word [0x140024fa2], cx
lea rax, [0x140019fb0]
mov qword [0x140024fa8], rax
movups xmmword [0x140024fb0], xmm0
mov word [0x140024fb2], cx
lea rax, [0x14001a1b0]
mov qword [0x140024fb8], rax
mov r14d, r15d
mov dword [rsp + 0x40], r15d
lea r13, [0x140000000]
lea r12d, [r15 + 1]
cmp r14d, 0x1a
jge 0x140197243
movsxd rcx, r14d
lea rsi, [rcx*4]
lea eax, [r14 + 0x41]
mov dword [rsi + r13 + 0x191080], eax
shl rcx, 4
lea rdi, [r13 + 0x1910e8]
add rdi, rcx
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov word [rdi + 2], bx
lea rax, [rsp + 0xc0]
mov qword [rdi + 8], rax
lea rbx, [r13 + 0x190ee0]
add rbx, rcx
lea rdx, [0x140198520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov dword [rsi + r13 + 0x190d34], r15d
mov dword [rsi + r13 + 0x190d9c], r15d
mov dword [rsi + r13 + 0x190e04], r15d
mov dword [rsi + r13 + 0x190e6c], r15d
mov dword [rsi + r13 + 0x190be8], r15d
mov dword [rsi + r13 + 0x190c5c], r15d
mov dword [rsi + r13 + 0x190cc4], r15d
add r14d, r12d
mov dword [rsp + 0x40], r14d
mov ebx, 0x800
jmp 0x14019718b
mov qword [0x140190c50], r15
mov dword [0x140190c58], r15d
mov qword [0x140190d2c], r15
mov qword [0x140190ed4], r15
mov qword [0x14018ab60], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
lea r14, [0x140198520]
cmp esi, 0x400
jge 0x1401972e1
movsxd rax, esi
lea rbx, [rax + rax*2]
mov dword [r13 + rbx*8 + 0x18ab90], r15d
shl rax, 4
lea rdi, [r13 + 0x17ab20]
add rdi, rax
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x18ab80]
lea rcx, [rcx + rbx*8]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov eax, 0x800
mov word [rcx + 2], ax
lea rax, [rsp + 0xc0]
mov qword [rcx + 8], rax
mov r8b, r12b
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197275
mov qword [0x140184b40], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197341
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x184b70], r15d
shl rax, 4
lea rbx, [r13 + 0x176b20]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x184b60]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401972f0
mov qword [0x14017eb20], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401973a1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x17eb50], r15d
shl rax, 4
lea rbx, [r13 + 0x172b20]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x17eb40]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197350
mov qword [0x14014b2c0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197401
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x14b2f0], r15d
shl rax, 4
lea rbx, [r13 + 0xc3000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x14b2e0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401973b0
mov qword [0x1401452a0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197461
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x1452d0], r15d
shl rax, 4
lea rbx, [r13 + 0xc3000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x1452c0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197410
mov qword [0x14012d220], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401974c1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x12d250], r15d
shl rax, 4
lea rbx, [r13 + 0xbf000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x12d240]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197470
mov qword [0x14013f280], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197521
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x13f2b0], r15d
shl rax, 4
lea rbx, [r13 + 0xbb000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x13f2a0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401974d0
mov qword [0x140139260], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197581
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x139290], r15d
shl rax, 4
lea rbx, [r13 + 0xb7000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x139280]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197530
mov qword [0x140133240], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401975e1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x133270], r15d
shl rax, 4
lea rbx, [r13 + 0xb3000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x133260]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197590
mov qword [0x140127200], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197641
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x127230], r15d
shl rax, 4
lea rbx, [r13 + 0xaf000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x127220]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401975f0
mov qword [0x14010f180], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401976a1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x10f1b0], r15d
shl rax, 4
lea rbx, [r13 + 0xab000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x10f1a0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197650
mov qword [0x1401211e0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197701
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x121210], r15d
shl rax, 4
lea rbx, [r13 + 0xa7000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x121200]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401976b0
mov qword [0x14011b1c0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197761
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x11b1f0], r15d
shl rax, 4
lea rbx, [r13 + 0xa3000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x11b1e0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197710
mov qword [0x1401151a0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401977c1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x1151d0], r15d
shl rax, 4
lea rbx, [r13 + 0x9f000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x1151c0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197770
mov qword [0x140109160], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197821
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x109190], r15d
shl rax, 4
lea rbx, [r13 + 0x9b000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x109180]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401977d0
mov qword [0x1400f10e0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197881
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xf1110], r15d
shl rax, 4
lea rbx, [r13 + 0x97000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xf1100]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197830
mov qword [0x140103140], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401978e1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x103170], r15d
shl rax, 4
lea rbx, [r13 + 0x93000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x103160]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197890
mov qword [0x1400fd120], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197941
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xfd150], r15d
shl rax, 4
lea rbx, [r13 + 0x8f000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xfd140]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401978f0
mov qword [0x1400f7100], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x1401979a1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xf7130], r15d
shl rax, 4
lea rbx, [r13 + 0x8b000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xf7120]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197950
mov qword [0x1400eb0c0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197a01
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xeb0f0], r15d
shl rax, 4
lea rbx, [r13 + 0x87000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xeb0e0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x1401979b0
mov qword [0x1400df080], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197a61
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xdf0b0], r15d
shl rax, 4
lea rbx, [r13 + 0x83000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xdf0a0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197a10
mov qword [0x1400e50a0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197ac1
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xe50d0], r15d
shl rax, 4
lea rbx, [r13 + 0x7f000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xe50c0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197a70
mov qword [0x14004c7e0], r15
mov edi, r15d
mov dword [rsp + 0x40], r15d
movsxd rcx, edi
mov rax, rcx
shl rax, 4
lea rsi, [r13 + 0x46fc0]
add rsi, rax
mov rdx, r14
cmp edi, 0x100
jge 0x140197b24
lea rbx, [rcx + rcx*2]
mov dword [r13 + rbx*8 + 0x4c810], r15d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x4c800]
lea rcx, [rcx + rbx*8]
mov r8b, r12b
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add edi, r12d
mov dword [rsp + 0x40], edi
jmp 0x140197ad0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
mov rdx, rsi
lea rcx, [0x140042fb0]
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
mov rdx, rsi
lea rcx, [0x140042fa0]
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov qword [0x14004afc0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x100
jge 0x140197bbf
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x4aff0], r15d
shl rax, 4
lea rbx, [r13 + 0x42fc0]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x4afe0]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197b6e
mov qword [0x140028800], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x100
jge 0x140197c1f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x28830], r15d
shl rax, 4
lea rbx, [r13 + 0x25fe0]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x28820]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197bce
mov qword [0x140026fe0], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x100
jge 0x140197c7f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0x27010], r15d
shl rax, 4
lea rbx, [r13 + 0x24fe0]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x27000]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197c2e
mov qword [0x1400d3040], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197cdf
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xd3070], r15d
shl rax, 4
lea rbx, [r13 + 0x56000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xd3060]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197c8e
mov qword [0x1400cd020], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197d3f
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xcd050], r15d
shl rax, 4
lea rbx, [r13 + 0x52000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xcd040]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197cee
mov qword [0x1400c7000], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197dc8
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xc7030], r15d
shl rax, 4
lea rbx, [r13 + 0x4e000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdi, [rdi*8 + 0xc7020]
add rdi, r13
mov r8b, r12b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rdx, [0x140198d30]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x98]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197d4e
mov ecx, r15d
mov ebx, 0x800
mov dword [rsp + 0x40], ecx
cmp ecx, 0x80
jge 0x140197e50
movsxd rax, ecx
imul r8, rax, 0x98
mov dword [r8 + r13 + 0x3e430], r15d
xorps xmm0, xmm0
movups xmmword [r8 + r13 + 0x3e3a0], xmm0
mov word [r8 + r13 + 0x3e3a2], bx
lea rax, [rsp + 0xc0]
mov qword [r8 + r13 + 0x3e3a8], rax
mov edx, r15d
mov dword [rsp + 0x48], edx
cmp edx, 8
jge 0x140197e4b
movsxd rax, edx
shl rax, 4
add rax, r8
lea r9, [0x14003e3b0]
add rax, r9
movups xmmword [rax], xmm0
mov word [rax + 2], bx
lea r9, [rsp + 0xc0]
mov qword [rax + 8], r9
add edx, r12d
jmp 0x140197e16
add ecx, r12d
jmp 0x140197dd0
mov qword [0x1400d9060], r15
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140197eb0
movsxd rax, esi
lea rdi, [rax + rax*2]
mov dword [r13 + rdi*8 + 0xd9090], r15d
shl rax, 4
lea rbx, [r13 + 0x7b000]
add rbx, rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0xd9080]
lea rcx, [rcx + rdi*8]
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197e5f
mov dword [0x140161f0c], r15d
mov dword [0x140161f08], r15d
mov dword [0x140161f04], r15d
mov dword [0x140161f00], r15d
mov dword [0x1401512ec], r15d
mov dword [0x1401512e8], r15d
mov dword [0x1401512e4], r15d
mov dword [0x1401512e0], r15d
mov esi, r15d
mov dword [rsp + 0x40], r15d
cmp esi, 0x400
jge 0x140198017
movsxd rdi, esi
shl rdi, 4
lea rbx, [r13 + 0x77000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x166b20]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x73000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x16ab20]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x6f000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x16eb20]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x6b000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x155f00]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x67000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x159f00]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [r13 + 0x63000]
add rbx, rdi
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r13 + 0x15df00]
add rcx, rdi
mov r8b, r12b
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
add esi, r12d
mov dword [rsp + 0x40], esi
jmp 0x140197ef0
mov r14d, r15d
mov dword [rsp + 0x40], r15d
cmp r14d, 0x80
jge 0x140198180
movsxd rbx, r14d
mov rsi, rbx
shl rsi, 4
lea rdi, [rsi + 0x62800]
add rdi, r13
lea rdx, [0x140198520]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
imul r12, rbx, 0x98
lea rcx, [r12 + 0x161f20]
add rcx, r13
mov r8b, 1
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rbx, [rsi + 0x62000]
add rbx, r13
lea rdx, [0x140198520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r12 + 0x151300]
add rcx, r13
mov r8b, 1
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
mov dword [rsp + 0x48], r15d
movsxd rax, r14d
imul r13, rax, 0x98
cmp r15d, 8
jge 0x14019814e
lea eax, [r15 + r14*8]
movsxd rsi, eax
shl rsi, 4
lea rax, [0x140000000]
lea rbx, [rax + 0x5e000]
add rbx, rsi
lea rdx, [0x140198520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movsxd rdi, r15d
add rdi, rdi
lea rcx, [rdi*8]
add rcx, r13
lea rax, [0x140161f30]
add rcx, rax
mov r8b, 1
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
lea rax, [0x140000000]
lea rbx, [rax + 0x5a000]
add rbx, rsi
lea rdx, [0x140198520]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [r12 + rdi*8]
lea rax, [0x140151310]
add rcx, rax
mov r8b, 1
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlUpcaseUnicodeString]
inc r15d
jmp 0x14019809f
xor r15d, r15d
lea rax, [0x140000000]
mov dword [rax + r13 + 0x161fb0], r15d
lea r13, [0x140000000]
mov dword [r12 + r13 + 0x151390], r15d
lea r12d, [r15 + 1]
add r14d, r12d
mov dword [rsp + 0x40], r14d
jmp 0x14019801f
mov dword [0x140019d10], r15d
mov qword [0x140019b00], 0x1f4
mov dword [0x140019d14], 0x400
mov rbx, qword [rsp + 0x58]
mov qword [0x140019a60], rbx
lea rax, [0x140019a88]
mov qword [0x140019a90], rax
mov qword [0x140019a88], rax
lea rcx, [0x140019a80]
call qword [sym.imp.ntoskrnl.exe_KeInitializeSpinLock]
mov word [rsp + 0x38], r15w
mov dword [rsp + 0x30], 0x7970534d
mov r9d, 0x200
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExInitializeLookasideListEx]
lea rcx, [0x140198d40]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x140019d20], rax
lea rcx, [0x140198d60]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x140019d28], rax
lea rcx, [0x140198d80]
call sub.FLTMGR.SYS_FltGetRoutineAddress
mov qword [0x140019d30], rax
mov rcx, qword [rsp + 0x60]
call fcn.1401983b8
lea r8, [0x140019a68]
lea rdx, section.INIT_1
mov rcx, rbx
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
mov dword [rsp + 0x44], eax
test eax, eax
js 0x140198355
mov edx, 0x1f0001
lea rcx, [rsp + 0x50]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov ebx, eax
mov dword [rsp + 0x44], eax
test eax, eax
js 0x140198294
xor r9d, r9d
xor r8d, r8d
mov dl, r12b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlSetDaclSecurityDescriptor]
mov ebx, eax
mov dword [rsp + 0x44], eax
test ebx, ebx
js 0x140198355
lea rdx, [0x140198da0]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x80], 0x240
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x38], r12d
lea rax, [0x140193410]
mov qword [rsp + 0x30], rax
lea rax, [0x140193160]
mov qword [rsp + 0x28], rax
lea rax, [0x140193150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [0x140019a70]
mov rcx, qword [0x140019a68]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov ebx, eax
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x50]
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
test ebx, ebx
js 0x140198355
mov rcx, qword [0x140019a68]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
mov dword [rsp + 0x44], eax
test ebx, ebx
jns 0x140198388
mov rcx, qword [0x140019a70]
test rcx, rcx
je 0x14019836a
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x140019a68]
test rcx, rcx
je 0x14019837b
call sub.FLTMGR.SYS_FltUnregisterFilter
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExDeleteLookasideListEx]
mov eax, ebx
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.1400130e0
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret