Function at 0x13988
Capabilities:
Copy network traffic

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov r13, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
add rcx, 0x140
mov esi, r14d
mov rbx, r14
mov byte [rsp + 0x80], r14b
lea r12d, [r14 + 3]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rbp, [rdi + 0x20]
cmp qword [rbp], rbp
je 0x13a2b
mov rbx, qword [rbp]
mov rax, qword [rbx]
mov qword [rbp], rax
mov qword [rax + 8], rbp
movzx r12d, word [rbx + 0x22]
and r12d, 1
or r12d, 2
test byte [rdi + 0x64], 4
je 0x13a87
cmp r12d, 3
jne 0x13a87
cmp byte [rdi + 0xed], r14b
jne 0x13a87
cmp byte [rdi + 0xee], r14b
jne 0x13a87
mov rax, qword [rbp]
mov qword [rbx + 8], rbp
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [rbp], rbx
mov rbx, r14
mov r13b, bl
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor r14d, r14d
cmp rbx, r14
je 0x13cb6
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x140]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp esi, r14d
jl 0x13c96
cmp r12d, 3
jne 0x13c36
mov eax, dword [rdi + 0xdc]
cmp eax, dword [rbx + 0x50]
jb 0x13c2d
sub eax, dword [rbx + 0x50]
mov dword [rdi + 0xdc], eax
jmp 0x13c53
mov rdx, qword [rbx + 0x50]
cmp rdx, r14
jne 0x13ab5
mov rdx, qword [r13]
mov rax, qword [0x0001c9a0]
sub rax, rdx
cmp rax, 0x10
jae 0x13ba2
mov esi, 0xc0000017
mov r13b, r14b
jmp 0x13a2e
mov rax, qword [rbx + 0x60]
mov ecx, 0x2000
cmp rax, r14
jne 0x13b62
cmp rdx, rcx
ja 0x13b25
mov rcx, qword [r13]
mov rax, qword [0x0001c9a0]
lea r14, [rdx + 0x10]
sub rax, rcx
cmp rax, r14
jb 0x13b90
mov rdx, qword [0x0001c998]
lea r9, [rsp + 0x90]
mov dword [rcx + rdx], r12d
mov rax, qword [rdi + 0x40]
mov qword [rcx + rdx + 4], rax
mov eax, dword [rbx + 0x50]
mov dword [rcx + rdx + 0xc], eax
mov r8, qword [rbx + 0x50]
lea rdx, [rcx + rdx + 0x10]
lea rcx, [rbx + 0x20]
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
add qword [r13], r14
jmp 0x13bc3
cmp rax, r14
jne 0x13b62
xor ecx, ecx
mov r8d, 0x44544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x60], rax
cmp rax, r14
je 0x13a90
mov r8, qword [rbx + 0x50]
lea r9, [rsp + 0x90]
lea rcx, [rbx + 0x20]
mov rdx, rax
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
mov ecx, 0x2000
mov rdx, qword [rbx + 0x68]
mov r14, qword [rbx + 0x50]
sub r14, rdx
cmp r14, rcx
cmova r14, rcx
test r14, r14
je 0x13bc3
mov r8, qword [r13]
mov rax, qword [0x0001c9a0]
lea rcx, [r14 + 0x10]
sub rax, r8
cmp rax, rcx
jae 0x13bcb
mov r13b, byte [rsp + 0x80]
mov esi, 0xc0000017
jmp 0x13a2e
mov rcx, qword [0x0001c998]
mov dword [rdx + rcx], r12d
mov rax, qword [rdi + 0x40]
mov qword [rdx + rcx + 4], rax
lea rax, [rdx + 0x10]
mov dword [rdx + rcx + 0xc], r14d
mov qword [r13], rax
mov r13b, sil
jmp 0x13a2e
mov rcx, qword [0x0001c998]
mov dword [r8 + rcx], r12d
mov rax, qword [rdi + 0x40]
mov dword [r8 + rcx + 0xc], r14d
mov qword [r8 + rcx + 4], rax
add rdx, qword [rbx + 0x60]
lea rcx, [r8 + rcx + 0x10]
mov r8, r14
call fcn.0001a200
mov rax, qword [r13]
add qword [rbx + 0x68], r14
mov rcx, qword [rbx + 0x68]
lea rax, [rax + r14 + 0x10]
mov qword [r13], rax
cmp rcx, qword [rbx + 0x50]
jae 0x13bc3
mov rax, qword [rbp]
mov qword [rbx + 8], rbp
mov r13b, 1
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [rbp], rbx
xor ebx, ebx
jmp 0x13a2e
mov dword [rdi + 0xdc], r14d
jmp 0x13c53
mov eax, dword [rdi + 0xe0]
cmp eax, dword [rbx + 0x50]
jb 0x13c4c
sub eax, dword [rbx + 0x50]
mov dword [rdi + 0xe0], eax
jmp 0x13c53
mov dword [rdi + 0xe0], r14d
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov rcx, rbx
call fcn.00011cf8
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x140]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp byte [rdi + 0xec], r14b
je 0x13ca9
cmp dword [rdi + 0xe0], 0x8000
jae 0x13ca9
mov byte [rdi + 0xec], r14b
jmp 0x13ca9
mov rax, qword [rbp]
mov qword [rbx + 8], rbp
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [rbp], rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
jmp 0x13ccd
cmp r13b, r14b
je 0x13ccd
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov r8, rdi
mov edx, r12d
call fcn.000129a0
mov eax, esi
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret