Function at 0x140004b90
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
xor edx, edx
lea rcx, [0x140012428]
call fcn.14000b650
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004bf9
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x50], rax
call fcn.140001aa0
movzx eax, al
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x14000cf70]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, dword [rsp + 0x30]
jmp 0x140004e67
mov dword [rsp + 0x34], 0
jmp 0x140004c0d
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
lea rcx, [0x140011298]
cmp qword [rcx + rax*8], 0
je 0x140004c54
mov eax, dword [rsp + 0x34]
lea rcx, [0x140011298]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov rcx, qword [0x140012428]
call fcn.14000afa0
jmp 0x140004c03
xor r8d, r8d
lea rdx, [0x140004ea0]
xor ecx, ecx
call fcn.1400013e0
mov edx, 1
lea rcx, [0x140012420]
call fcn.14000b650
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004cd1
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x60], rax
call fcn.140001aa0
movzx eax, al
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x14000cf70]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140012428]
call fcn.14000b4b0
mov eax, dword [rsp + 0x30]
jmp 0x140004e67
mov dword [rsp + 0x34], 0
jmp 0x140004ce5
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
lea rcx, [0x140011368]
cmp qword [rcx + rax*8], 0
je 0x140004d2c
mov eax, dword [rsp + 0x34]
lea rcx, [0x140011368]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov rcx, qword [0x140012420]
call fcn.14000abd0
jmp 0x140004cdb
xor r8d, r8d
lea rdx, [0x140004e70]
mov ecx, 1
call fcn.1400013e0
lea r8, [0x140012040]
lea rdx, [0x140011300]
mov rcx, qword [rsp + 0x90]
call sub.FLTMGR.SYS_FltRegisterFilter
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x140004dc6
mov rcx, qword [0x140012040]
call sub.FLTMGR.SYS_FltStartFiltering
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004dc4
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x40], rax
call fcn.140001aa0
movzx eax, al
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x14000cfe0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x140012040]
call sub.FLTMGR.SYS_FltUnregisterFilter
jmp 0x140004e01
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x48], rax
call fcn.140001aa0
movzx eax, al
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x14000d040]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
cmp dword [rsp + 0x30], 0
jge 0x140004e26
mov rcx, qword [0x140012428]
call fcn.14000b4b0
mov rcx, qword [0x140012420]
call fcn.14000b4b0
mov eax, dword [rsp + 0x30]
jmp 0x140004e67
mov byte [0x140012038], 1
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x58], rax
call fcn.140001aa0
movzx eax, al
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x14000d0a0]
mov edx, 2
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, dword [rsp + 0x30]
add rsp, 0x88
ret