Function at 0x166a0
Capabilities:
Create thread

Disassembly:
push 0x2c
push 0x193f8
call fcn.000188dc
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], edi
mov al, byte [0x35398]
cmp al, 1
jne 0x166dd
cmp dword [0x5f7d8], edi
jne 0x166dd
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xc0000001
jmp 0x16955
mov esi, dword [ebp + 8]
cmp esi, edi
je 0x16926
cmp dword [ebp + 0xc], 0x480
jne 0x16926
cmp word [esi], di
je 0x16926
cmp word [esi + 0x256], di
jne 0x16926
test al, al
jne 0x16760
mov byte [0x35398], 1
cmp dword [0x5f7f8], 0x23f0
jae 0x16756
push edi
push 0x15d72
push edi
push edi
push edi
push 0x1f03ff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [ebp - 0x20], eax
cmp eax, edi
jge 0x1674d
mov dword [ebp - 4], 0xfffffffe
jmp 0x16955
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
inc eax
mov ecx, 0x5f7d8
xchg dword [ecx], eax
push esi
lea eax, [ebp - 0x34]
push eax
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call edi
call dword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
push 1
push 0x5fa40
call dword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov ebx, dword [0x5fa78]
mov dword [ebp - 0x28], ebx
cmp ebx, 0x5fa78
je 0x167c5
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x3c]
push eax
call edi
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x167c1
lea eax, [ebx + 8]
push eax
push esi
call fcn.00015c7a
test eax, eax
jne 0x167c1
mov ebx, dword [ebx]
jmp 0x16786
mov byte [ebp - 0x19], 1
cmp byte [ebp - 0x19], 0
je 0x168a0
xor edi, edi
cmp dword [esi + 0x460], edi
je 0x16832
cmp dword [ebx + 0x488], 0xffffffff
jne 0x16805
cmp dword [ebx + 0x48c], 0x7fffffff
jne 0x16805
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
push edi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1689c
mov dword [ebx + 0x470], edi
mov dword [ebx + 0x46c], edi
or dword [ebx + 0x474], 0xffffffff
mov eax, 0x7fffffff
mov dword [ebx + 0x478], eax
or dword [ebx + 0x47c], 0xffffffff
mov dword [ebx + 0x480], eax
jmp 0x1689c
mov eax, dword [esi + 0x468]
mov dword [ebx + 0x470], eax
mov eax, dword [esi + 0x464]
mov dword [ebx + 0x46c], eax
mov eax, dword [esi + 0x46c]
mov dword [ebx + 0x474], eax
mov eax, dword [esi + 0x470]
mov dword [ebx + 0x478], eax
mov eax, dword [esi + 0x474]
mov dword [ebx + 0x47c], eax
mov eax, dword [esi + 0x478]
mov dword [ebx + 0x480], eax
lea edi, [ebx + 8]
mov ecx, 0x96
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
add esi, 0x258
lea edi, [ebx + 0x260]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
push edi
jmp 0x16908
cmp dword [esi + 0x460], 0
jne 0x16913
push 0x490
push 0
call fcn.000104f0
test eax, eax
jne 0x168d3
mov ecx, 0x5fa40
call dword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call dword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov dword [ebp - 0x20], 0xc000009a
jmp 0x1694b
or dword [eax + 0x488], 0xffffffff
mov dword [eax + 0x48c], 0x7fffffff
lea edi, [eax + 8]
mov ecx, 0x120
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x5fa7c]
mov dword [eax], 0x5fa78
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x5fa7c], eax
push 0
push 0
push 0x5f5f0
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov ecx, 0x5fa40
call dword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call dword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x1694b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xc000000d
jmp 0x16955
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00018921
ret 0xc