Function at 0x134f8
Capabilities:
Copy network traffic

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdx, qword [r8]
mov r13, rcx
mov rcx, qword [0x0007b4a0]
mov rdx, qword [rdx + 0x38]
mov rdi, r8
mov ebp, 1
xor r8d, r8d
mov rbx, r9
xor esi, esi
mov r12d, ebp
call sub.fwpkclnt.sys_FwpsQueryPacketInjectionState0
cmp eax, ebp
je 0x138e1
cmp eax, 3
je 0x138e1
mov rcx, qword [rdi]
mov rax, qword [r13 + 8]
xor r15d, r15d
bt dword [rcx], 0x10
cmovb r15d, ebp
movzx ebp, word [rax + 0x38]
mov dword [rsp + 0x80], ebp
test rbx, rbx
je 0x1357a
cmp rbx, 2
jne 0x138e1
mov r14d, dword [rcx + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], r8d
test r14d, r14d
je 0x135b7
mov rcx, r14
call fcn.00012184
mov rsi, rax
test rax, rax
je 0x138e1
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8, r14
mov rdx, rax
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
mov r8d, dword [rsp + 0x30]
cmp rbx, 2
jne 0x136ac
mov rbx, qword [rsp + 0x90]
test rsi, rsi
je 0x135e3
mov r9d, r14d
mov r8, rsi
mov rdx, rbx
mov ecx, ebp
mov dword [rsp + 0x20], r15d
call fcn.00013b08
mov rax, qword [rdi]
test byte [rax], 4
jne 0x135f5
bt dword [rax], 0x13
jae 0x136a4
xor r8d, r8d
mov rdx, rbx
mov ecx, ebp
call fcn.00013908
mov ecx, dword [rsp + 0x80]
mov r8d, r12d
mov rdx, rbx
mov rbp, rax
call fcn.00013908
mov ecx, 0xa000
mov rbx, rax
call fcn.00012184
mov r12, rax
mov rax, qword [rdi]
test byte [rax], 4
je 0x1365d
lea rcx, [rbp + 0x160]
xor r8d, r8d
xor edx, edx
mov dword [rbp + 0x178], 1
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
lea rcx, [rbp + 0x148]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rax, qword [rdi]
bt dword [rax], 0x13
jae 0x13694
lea rcx, [rbx + 0x160]
xor r8d, r8d
xor edx, edx
mov dword [rbx + 0x178], 1
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
lea rcx, [rbx + 0x148]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test r12, r12
je 0x136a4
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor r12d, r12d
jmp 0x138d1
test r14d, r14d
je 0x138d1
or rbp, 0xffffffffffffffff
mov ecx, ebp
lea eax, [rbp + 6]
cmp r8d, eax
cmovl ecx, eax
cmp byte [rsi], 0x16
jne 0x136ee
cmp byte [rsi + 1], 3
jl 0x136ee
movzx eax, byte [rsi + 4]
movsx rdx, byte [rsi + 3]
shl rdx, 8
or rdx, rax
lea rax, [rdx - 0x2d]
cmp rax, 0x3fd3
ja 0x136ee
lea ecx, [rdx + 5]
cmp ecx, ebp
je 0x138d1
cmp r8d, ecx
jge 0x13707
mov dword [rdi + 0x20], r12d
mov dword [rdi + 0x10], ecx
jmp 0x138d1
mov edi, 0x104
mov rcx, rdi
call fcn.00012184
mov r9d, edi
xor edx, edx
mov r8, rax
mov rcx, rsi
mov rbx, rax
call fcn.00013f98
mov edx, eax
mov rax, qword [r13 + 8]
mov r13d, dword [rax + 0x28]
test edx, edx
je 0x13742
mov ecx, r13d
mov rdx, rbx
bswap ecx
call fcn.0004f720
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdi, r12
not rcx
cmp rcx, r12
je 0x138a5
mov rcx, rbx
call fcn.00017264
mov rbp, rax
test rax, rax
je 0x138a5
mov ecx, 0x228
call fcn.00012184
mov r12, rax
cmp r13d, dword [rbp + 0x90]
je 0x1378b
mov dword [rax + 0x220], edi
mov r13, qword [rsp + 0x90]
mov r8d, edi
mov edi, dword [rsp + 0x80]
mov ecx, edi
mov rdx, r13
call fcn.00013908
xor r8d, r8d
mov rdx, r13
mov ecx, edi
mov qword [r12 + 0x10], rax
call fcn.00013908
lea rdx, [r12 + 0x18]
mov rcx, rbx
mov qword [r12 + 8], rax
sub rdx, rbx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x137c9
lea rdx, [rbp + 0x50]
lea rcx, [r12 + 0x11c]
sub rcx, rdx
mov al, byte [rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x137e4
lea rcx, [r12 + 0x11c]
call qword [sym.imp.ntoskrnl.exe__strlwr]
mov r9d, r14d
mov r8, rsi
mov rdx, r13
mov ecx, edi
mov dword [rsp + 0x20], r15d
call fcn.00013b08
mov r8d, dword [0x0007b460]
mov edx, 0x14
lea r9d, [rdx - 0x12]
mov rcx, r13
call sub.fwpkclnt.sys_FwpsFlowAssociateContext0
mov r13, qword [0x0007b238]
mov ecx, 0x18
call fcn.00012184
mov rdi, rax
test rax, rax
je 0x1387e
and qword [rdi + 0x10], 0
lea rax, [0x00015258]
mov rcx, r13
mov qword [rdi], rax
mov qword [rdi + 8], r12
call qword [sym.imp.ntoskrnl.exe_IoAllocateWorkItem]
test rax, rax
je 0x1387e
lea rdx, [0x000125d8]
mov r9, rdi
mov r8d, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoQueueWorkItem]
test rbx, rbx
je 0x1388e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rbp
xor r12d, r12d
mov dword [0x0007b4b8], 1
call fcn.0001737c
jmp 0x138d1
test rbx, rbx
je 0x138b5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r8d, dword [0x0007b460]
mov rcx, qword [rsp + 0x90]
mov edx, 0x14
mov r9, rdi
call sub.fwpkclnt.sys_FwpsFlowAssociateContext0
test rsi, rsi
je 0x138e1
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x40]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret