Function at 0x157f8
Capabilities:
Copy network traffic

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rdx
mov rdi, rcx
xor esi, esi
lea rdx, [rsp + 0x20]
xor r14b, r14b
add rcx, 0x398
xor ebx, ebx
lea r12d, [rsi + 3]
mov byte [rsp + 0x80], r14b
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rbp, [rdi + 0x20]
cmp qword [rbp], rbp
je 0x15954
mov rbx, qword [rbp]
mov rax, qword [rbx]
mov qword [rbp], rax
mov qword [rax + 8], rbp
movzx r12d, word [rbx + 0x22]
and r12d, 1
or r12d, 2
test byte [rdi + 0x64], 4
je 0x15899
cmp r12d, 3
jne 0x15899
cmp byte [rdi + 0xf1], sil
jne 0x15899
cmp byte [rdi + 0xf2], sil
jne 0x15899
mov rax, qword [rbp]
mov qword [rbx + 8], rbp
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [rbp], rbx
xor ebx, ebx
jmp 0x15954
mov rdx, qword [rbx + 0x50]
test rdx, rdx
jne 0x158e2
mov rdx, qword [r13]
mov rax, qword [0x00021298]
sub rax, rdx
cmp rax, 0x10
jae 0x158c0
mov esi, 0xc0000017
jmp 0x15954
mov rcx, qword [0x00021290]
mov dword [rdx + rcx], r12d
mov rax, qword [rdi + 0x40]
mov qword [rdx + rcx + 4], rax
and dword [rdx + rcx + 0xc], esi
lea rax, [rdx + 0x10]
mov qword [r13], rax
jmp 0x15954
mov rax, qword [rbx + 0x60]
mov ecx, 0x2000
test rax, rax
jne 0x159ea
cmp rdx, rcx
ja 0x159ad
mov rcx, qword [r13]
mov rax, qword [0x00021298]
lea r14, [rdx + 0x10]
sub rax, rcx
cmp rax, r14
jb 0x15a1c
mov rdx, qword [0x00021290]
lea r9, [rsp + 0x90]
mov dword [rcx + rdx], r12d
mov rax, qword [rdi + 0x40]
mov qword [rcx + rdx + 4], rax
mov eax, dword [rbx + 0x50]
mov dword [rcx + rdx + 0xc], eax
mov r8, qword [rbx + 0x50]
lea rdx, [rcx + rdx + 0x10]
lea rcx, [rbx + 0x20]
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
add qword [r13], r14
mov r14b, sil
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
test rbx, rbx
je 0x15b26
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x398]
xor r14d, r14d
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp esi, r14d
jl 0x15b06
cmp r12d, 3
jne 0x15a9d
mov eax, dword [rdi + 0xe0]
cmp eax, dword [rbx + 0x50]
jb 0x15a94
sub eax, dword [rbx + 0x50]
mov dword [rdi + 0xe0], eax
jmp 0x15aba
test rax, rax
jne 0x159ea
xor ecx, ecx
mov r8d, 0x44544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x158a2
mov r8, qword [rbx + 0x50]
lea r9, [rsp + 0x90]
lea rcx, [rbx + 0x20]
mov rdx, rax
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
mov ecx, 0x2000
mov rdx, qword [rbx + 0x68]
mov r14, qword [rbx + 0x50]
sub r14, rdx
cmp r14, rcx
cmova r14, rcx
test r14, r14
je 0x15951
mov r8, qword [r13]
mov rax, qword [0x00021298]
lea rcx, [r14 + 0x10]
sub rax, r8
cmp rax, rcx
jae 0x15a2e
mov r14b, byte [rsp + 0x80]
mov esi, 0xc0000017
jmp 0x15954
mov rcx, qword [0x00021290]
mov dword [r8 + rcx], r12d
mov rax, qword [rdi + 0x40]
mov dword [r8 + rcx + 0xc], r14d
mov qword [r8 + rcx + 4], rax
add rdx, qword [rbx + 0x60]
lea rcx, [r8 + rcx + 0x10]
mov r8, r14
call fcn.0001dc00
mov rax, qword [r13]
add qword [rbx + 0x68], r14
mov rcx, qword [rbx + 0x68]
lea rax, [rax + r14 + 0x10]
mov qword [r13], rax
cmp rcx, qword [rbx + 0x50]
jae 0x15951
mov rax, qword [rbp]
mov qword [rbx + 8], rbp
mov r14b, 1
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [rbp], rbx
xor ebx, ebx
jmp 0x15954
mov dword [rdi + 0xe0], r14d
jmp 0x15aba
mov eax, dword [rdi + 0xe4]
cmp eax, dword [rbx + 0x50]
jb 0x15ab3
sub eax, dword [rbx + 0x50]
mov dword [rdi + 0xe4], eax
jmp 0x15aba
mov dword [rdi + 0xe4], r14d
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov rcx, rbx
call fcn.00011fa0
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x398]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp byte [rdi + 0xf0], r14b
je 0x15b19
mov eax, 0x800000
cmp dword [rdi + 0xe4], eax
jae 0x15b19
cmp dword [rdi + 0xfc], eax
jae 0x15b19
mov byte [rdi + 0xf0], r14b
jmp 0x15b19
mov rax, qword [rbp]
mov qword [rbx + 8], rbp
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [rbp], rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
jmp 0x15b3d
test r14b, r14b
je 0x15b3d
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov r8, rdi
mov edx, r12d
call fcn.00014534
mov eax, esi
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret