Function at 0x18005cd70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r14
sub rsp, 0x60
mov rsi, r9
mov r14, r8
mov rbx, rcx
cmp byte [rsp + 0xb8], 1
jne 0x18005cda5
mov eax, 0xc00000bb
jmp 0x18005d17d
test rbx, rbx
jne 0x18005cdb4
mov eax, 0xc00000ef
jmp 0x18005d17d
mov eax, edx
and eax, 0xf000
cmp eax, 0x3000
jne 0x18005d178
cmp dword [rsp + 0xa8], 0
jne 0x18005cdda
mov eax, 0xc00000f4
jmp 0x18005d17d
cmp byte [rsp + 0xb8], 0
jne 0x18005ce01
mov rax, qword [rsp + 0xc0]
cmp eax, 0x10
jbe 0x18005cdfb
mov eax, 0xc00000f7
jmp 0x18005d17d
mov dword [rcx + 0x1f0], eax
test dl, 2
lea r9, [0x18004e220]
mov r12d, 0
cmovne r9, r12
or edx, 8
mov r8d, 0x3600
call fcn.18004f400
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18005d17d
test rsi, rsi
jne 0x18005ce47
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov qword [rbx + 0xa0], rax
jmp 0x18005ce4e
mov qword [rbx + 0xa0], rsi
mov rax, qword [rsp + 0xd0]
mov qword [rbx + 0x130], rax
mov rax, qword [rsp + 0xc8]
mov qword [rbx + 0x128], rax
mov rax, qword [rsp + 0xd8]
mov qword [rbx + 0x138], rax
mov rax, qword [rsp + 0xe0]
mov qword [rbx + 0x140], rax
lea rcx, [rbx + 0x160]
lea r8, str.ProcessingMsgSrw
xor edx, edx
call fcn.180055750
test eax, eax
js 0x18005d03d
lea rcx, [rbx + 0x80]
lea r9, [0x18005c5a0]
mov r8, qword [rbx + 0xa0]
mov rdx, r14
call fcn.18005cbd0
test eax, eax
js 0x18005d03d
lea rsi, [rbx + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x88]
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
mov dword [rsp + 0x44], eax
test eax, eax
je 0x18005cf0b
movzx edi, ax
or edi, 0xe8f00000
mov dword [rsp + 0x30], edi
jmp 0x18005d043
lea rcx, [rbx + 0x148]
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
call qword [0x18009b4d0]
mov dword [rsp + 0x48], eax
test eax, eax
js 0x18005d03d
mov byte [rbx + 0xe4], 0
mov dword [rbx + 0x204], r12d
mov dword [rbx + 0x1f8], r12d
mov dword [rsp + 0x3c], 0x12355321
mov dword [rsp + 0x38], r12d
lea r9, [rbx + 0xe0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsi]
call sub.FLTLIB.DLL_FilterSendMessage
test eax, eax
je 0x18005cf98
movzx edi, ax
or edi, 0xe8f00000
mov dword [rsp + 0x30], edi
jmp 0x18005d043
cmp dword [rsp + 0x38], 4
je 0x18005cfad
mov edi, 0xe8000101
mov dword [rsp + 0x30], edi
jmp 0x18005d043
mov ecx, r12d
mov dword [rsp + 0x34], ecx
cmp ecx, 0x10
jae 0x18005cfc7
mov eax, ecx
mov qword [rbx + rax*8 + 0x170], r12
inc ecx
jmp 0x18005cfb0
mov esi, r12d
mov dword [rsp + 0x34], r12d
nop
cmp esi, dword [rbx + 0x1f0]
jae 0x18005d043
mov r14d, esi
add r14, 0x2e
lea r14, [rbx + r14*8]
test r14, r14
jne 0x18005cfef
mov eax, 0xc00000f1
jmp 0x18005d03d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x18005c5f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
test rax, rax
jne 0x18005d02c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xe8f00000
jge 0x18005d035
jmp 0x18005d03d
mov eax, dword [rsp + 0x40]
mov qword [rsp + 0x50], rax
inc esi
mov dword [rsp + 0x34], esi
jmp 0x18005cfd0
mov edi, eax
mov dword [rsp + 0x30], eax
test edi, edi
jns 0x18005d174
lea rsi, [rbx + 0x88]
cmp qword [rsi], 0
je 0x18005d0a9
test rsi, rsi
je 0x18005d0a9
mov r8, qword [rsi]
test r8, r8
je 0x18005d0a9
cmp byte [0x18009b380], 0
je 0x18005d097
mov r9d, 0x38f
lea rax, str.ptportflt.c
mov qword [rsp + 0x20], rax
mov r8d, 0x46545250
mov rdx, rsi
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18005d0a6
xor edx, edx
mov rcx, qword [0x18009ccf0]
call qword [0x18009b440]
mov qword [rsi], r12
cmp byte [rsp + 0xb8], 1
je 0x18005d13b
mov rcx, qword [rbx + 0x148]
test rcx, rcx
je 0x18005d104
xor edx, edx
call qword [0x18009b4d8]
mov esi, r12d
cmp dword [rbx + 0x1f0], r12d
jbe 0x18005d104
nop word [rax + rax]
mov eax, esi
mov rcx, qword [rbx + rax*8 + 0x170]
test rcx, rcx
je 0x18005d0fa
xor r8d, r8d
xor edx, edx
call qword [0x18009b4e8]
inc esi
cmp esi, dword [rbx + 0x1f0]
jb 0x18005d0e0
mov rcx, qword [rbx + 0x148]
test rcx, rcx
je 0x18005d11d
call qword [0x18009b4c8]
mov qword [rbx + 0x148], r12
mov rcx, qword [rbx + 0xb8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18005d13b
call qword [0x18009b4c8]
mov qword [rbx + 0xb8], r12
lea rcx, [rbx + 0x160]
cmp qword [rcx], 0
je 0x18005d14d
call fcn.180055a50
cmp byte [rbx + 0xe4], 1
jne 0x18005d16c
lea rcx, [rbx + 0x208]
call fcn.18004f050
mov rcx, rbx
call fcn.18004f050
jmp 0x18005d174
mov rcx, rbx
call fcn.18004f4b0
mov eax, edi
jmp 0x18005d17d
mov eax, 0xc00000f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret