Function at 0x140003588
Capabilities:
Copy network traffic

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
lea r15, [rcx + 0x138]
mov rdi, rcx
mov rcx, r15
mov r14, r8
mov ebp, edx
mov esi, r12d
mov ebx, r12d
mov byte [rsp + 0x70], r12b
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea r13d, [r12 + 3]
mov byte [rsp + 0x88], al
mov eax, dword [rdi + 0x34]
test al, 4
jne 0x140003802
cmp ebp, r13d
jne 0x140003608
lea rax, [rdi + 0xa8]
mov rcx, qword [rax]
cmp rcx, rax
je 0x140003802
mov rbx, rcx
mov rcx, qword [rcx]
cmp qword [rbx + 8], rax
jne 0x140003603
cmp qword [rcx + 8], rbx
je 0x140003635
mov rcx, r13
int 0x29
lea rax, [rdi + 0xb8]
mov rcx, qword [rax]
cmp rcx, rax
je 0x140003802
mov rbx, rcx
mov rcx, qword [rcx]
cmp qword [rbx + 8], rax
jne 0x1400037fd
cmp qword [rcx + 8], rbx
jne 0x1400037fd
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rdx, qword [rbx + 0x40]
test rdx, rdx
jne 0x140003669
mov rdx, qword [r14]
mov rax, qword [0x14000b870]
sub rax, rdx
cmp rax, 0x10
jae 0x14000374b
mov esi, 0xc0000017
mov r14b, r12b
jmp 0x140003805
mov rax, qword [rbx + 0x50]
mov ecx, 0x2000
test rax, rax
jne 0x14000370f
cmp rdx, rcx
ja 0x1400036d5
mov rax, qword [0x14000b870]
lea r12, [rdx + 0x10]
mov rdx, qword [r14]
sub rax, rdx
cmp rax, r12
jb 0x14000373c
mov rcx, qword [0x14000b868]
lea r9, [rsp + 0x20]
mov dword [rdx + rcx], ebp
mov rax, qword [rdi + 0x10]
add rcx, 0x10
mov qword [rdx + rcx - 0xc], rax
mov eax, dword [rbx + 0x40]
mov dword [rdx + rcx - 4], eax
mov r8, qword [rbx + 0x40]
add rdx, rcx
lea rcx, [rbx + 0x10]
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
add qword [r14], r12
jmp 0x140003767
test rax, rax
jne 0x14000370f
xor ecx, ecx
mov r8d, 0x44544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x140003645
mov r8, qword [rbx + 0x40]
lea rcx, [rbx + 0x10]
lea r9, [rsp + 0x20]
mov rdx, rax
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
mov ecx, 0x2000
mov rdx, qword [rbx + 0x58]
mov r13, qword [rbx + 0x40]
sub r13, rdx
cmp r13, rcx
cmova r13, rcx
test r13, r13
je 0x140003767
mov r8, qword [r14]
mov rax, qword [0x14000b870]
lea r12, [r13 + 0x10]
sub rax, r8
cmp rax, r12
jae 0x14000376f
mov r14b, byte [rsp + 0x70]
mov esi, 0xc0000017
jmp 0x140003805
mov rcx, qword [0x14000b868]
mov dword [rdx + rcx], ebp
mov rax, qword [rdi + 0x10]
mov qword [rdx + rcx + 4], rax
mov dword [rdx + rcx + 0xc], r12d
add qword [r14], 0x10
mov r14b, sil
jmp 0x140003805
mov rcx, qword [0x14000b868]
mov dword [r8 + rcx], ebp
mov rax, qword [rdi + 0x10]
mov dword [r8 + rcx + 0xc], r13d
mov qword [r8 + rcx + 4], rax
add rdx, qword [rbx + 0x50]
add rcx, 0x10
add rcx, r8
mov r8, r13
call fcn.1400089c0
add qword [rbx + 0x58], r13
add qword [r14], r12
mov rax, qword [rbx + 0x40]
cmp qword [rbx + 0x58], rax
jae 0x140003767
mov r13d, 3
cmp ebp, r13d
jne 0x1400037d3
lea rax, [rdi + 0xa8]
mov rcx, qword [rax]
mov qword [rbx + 8], rax
mov qword [rbx], rcx
cmp qword [rcx + 8], rax
je 0x1400037ef
mov ecx, r13d
int 0x29
lea rax, [rdi + 0xb8]
mov rcx, qword [rax]
mov qword [rbx + 8], rax
mov qword [rbx], rcx
cmp qword [rcx + 8], rax
je 0x1400037ef
mov rcx, r13
int 0x29
mov qword [rcx + 8], rbx
mov qword [rax], rbx
mov r14b, 1
xor ebx, ebx
jmp 0x140003805
mov rcx, r13
int 0x29
mov r14b, bl
mov dl, byte [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test rbx, rbx
je 0x1400038f7
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov dl, al
test esi, esi
js 0x1400038a7
mov ecx, dword [rbx + 0x40]
cmp ebp, 3
jne 0x140003852
mov eax, dword [rdi + 0xc8]
cmp eax, ecx
jb 0x140003849
sub eax, ecx
mov dword [rdi + 0xc8], eax
jmp 0x14000386d
and dword [rdi + 0xc8], 0
jmp 0x14000386d
mov eax, dword [rdi + 0xcc]
cmp eax, ecx
jb 0x140003866
sub eax, ecx
mov dword [rdi + 0xcc], eax
jmp 0x14000386d
and dword [rdi + 0xcc], 0
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400074b0
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rdi + 0xd8], 0
je 0x1400038a3
cmp dword [rdi + 0xcc], 0xa000
jae 0x1400038a3
mov byte [rdi + 0xd8], 0
mov dl, al
jmp 0x1400038ec
cmp ebp, 3
jne 0x1400038c7
add rdi, 0xa8
mov rax, qword [rdi]
mov qword [rbx + 8], rdi
mov qword [rbx], rax
cmp qword [rax + 8], rdi
je 0x1400038e5
mov ecx, ebp
int 0x29
add rdi, 0xb8
mov rax, qword [rdi]
mov qword [rbx + 8], rdi
mov qword [rbx], rax
cmp qword [rax + 8], rdi
je 0x1400038e5
mov ecx, 3
int 0x29
mov qword [rax + 8], rbx
mov qword [rdi], rbx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x14000390d
test r14b, r14b
je 0x14000390d
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov r8, rdi
mov edx, ebp
call fcn.140005a54
mov eax, esi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret