Function at 0x23868
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x590
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov qword [rsp + 0x110], rdx
mov rcx, qword [rdx + 0xb8]
xor r14d, r14d
mov dword [rsp + 0x48], r14d
mov edi, 0xc0000001
mov dword [rsp + 0x40], edi
mov esi, dword [rcx + 0x10]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x5c], eax
mov r12, qword [rdx + 0x18]
mov eax, dword [rcx + 0x18]
mov ecx, 0x2220a4
cmp eax, ecx
ja 0x2437e
cmp eax, ecx
je 0x2423f
sub eax, 0x222080
je 0x24200
lea ebx, [r14 + 4]
sub eax, ebx
je 0x240f8
sub eax, ebx
je 0x2409c
sub eax, 8
je 0x24035
sub eax, ebx
je 0x23d94
sub eax, ebx
je 0x23c23
sub eax, ebx
je 0x23aae
cmp eax, ebx
jne 0x24a50
mov byte [r11 - 0x220], r14b
lea r15d, [r14 + 0x20]
mov r8, r15
xor edx, edx
lea rcx, [r11 - 0x21f]
call fcn.00028240
mov dword [rsp + 0x68], r14d
lea rax, [r12 + 0x20]
cmp rax, r14
je 0x23961
lea ecx, [rsi - 0x20]
mov r8, rax
lea rdx, [rsp + 0x398]
call fcn.00013e40
mov r8, r15
lea rdx, [rsp + 0x398]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x24a50
mov r14d, 0x104
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r15, rax
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r13, rax
xor ebx, ebx
cmp r15, rbx
je 0x23a85
cmp rax, rbx
je 0x23a85
mov rbx, qword [0x00065e78]
lea rcx, [rbx + 0x220]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov dil, al
lea rcx, [rbx + 0x240]
call fcn.000127f0
mov dl, dil
lea rcx, [rbx + 0x220]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rcx, [r12 + 0x24]
mov qword [rsp + 0x50], rcx
xor ebx, ebx
cmp dword [r12 + 0x20], ebx
jbe 0x23a83
mov r12d, dword [r12 + 0x20]
lea esi, [rbx + 1]
mov eax, ebx
movzx edi, word [rax + rcx]
add ebx, 2
mov r8, r14
xor edx, edx
mov rcx, r15
call fcn.00028240
mov r8, rdi
mov edx, ebx
add rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.000283d0
add ebx, edi
mov rcx, qword [rsp + 0x50]
movzx edi, word [rbx + rcx]
add ebx, 2
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.00028240
mov r8, rdi
mov edx, ebx
add rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.000283d0
add ebx, edi
mov rcx, r13
call fcn.00011074
mov r8d, eax
mov rdx, r15
mov rcx, qword [0x00065e78]
call fcn.000212a4
sub r12, rsi
mov rcx, qword [rsp + 0x50]
jne 0x23a06
xor ebx, ebx
mov edi, ebx
cmp r15, rbx
je 0x23a95
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r13, rbx
je 0x24a50
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0x10
jne 0x24994
mov qword [rsp + 0x50], r14
mov byte [rsp + 0xe8], r14b
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
mov eax, dword [r12 + 8]
cmp eax, r14d
je 0x24994
cmp qword [r12], r14
je 0x24994
mov esi, 1
mov byte [rsp + 0xe8], sil
mov dword [rsp + 0xf8], eax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0xf0], rax
cmp rax, r14
je 0x24994
mov edx, dword [r12 + 8]
mov r8d, esi
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, dword [rsp + 0xf8]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.00028240
mov r8d, dword [r12 + 8]
mov rdx, qword [r12]
mov rcx, qword [rsp + 0xf0]
call fcn.000283d0
lea rdx, [rsp + 0xe8]
mov qword [rsp + 0x30], rdx
lea rax, [0x00023784]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x23c03
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9d, [rsi + 0x2f]
lea r8, [rsp + 0x118]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, dword [rsp + 0x118]
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x23c0e
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0x10
jne 0x24994
mov qword [rsp + 0x68], r14
mov byte [rsp + 0xd0], r14b
xor eax, eax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov eax, dword [r12 + 8]
cmp eax, r14d
je 0x24994
cmp qword [r12], r14
je 0x24994
mov byte [rsp + 0xd0], 2
mov dword [rsp + 0xe0], eax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0xd8], rax
cmp rax, r14
je 0x24994
mov edx, dword [r12 + 8]
lea r8d, [rsi - 0xf]
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, dword [rsp + 0xe0]
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call fcn.00028240
mov r8d, dword [r12 + 8]
mov rdx, qword [r12]
mov rcx, qword [rsp + 0xd8]
call fcn.000283d0
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x30], rdx
lea rax, [0x00023784]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x23d74
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9d, [rsi + 0x20]
lea r8, [rsp + 0x118]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, dword [rsp + 0x118]
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x23d7f
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24a50
mov byte [rsp + 0x3c0], r14b
mov r15d, 0x20
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x3c1]
call fcn.00028240
mov word [rsp + 0x430], r14w
lea r13d, [r15 + 0x1e]
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x432]
call fcn.00028240
mov word [rsp + 0x3f0], r14w
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x3f2]
call fcn.00028240
mov r13d, r14d
lea rax, [r12 + 0x20]
cmp rax, r14
je 0x23e0e
lea ecx, [rsi - 0x20]
mov r8, rax
lea rdx, [rsp + 0x3c0]
call fcn.00013e40
mov r8, r15
lea rdx, [rsp + 0x3c0]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x24a50
mov rcx, qword [0x00065e78]
call fcn.00021754
mov r14d, 0x104
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [rsp + 0x100], rax
xor r8d, r8d
cmp rax, r8
je 0x2402d
lea r9, [r12 + 0x24]
mov qword [rsp + 0x78], r9
cmp dword [r12 + 0x20], r8d
jbe 0x2401f
lea ecx, [rsi - 0x20]
add rcx, 0xfffffffffffffffc
mov qword [rsp + 0x80], rcx
mov eax, dword [r12 + 0x20]
mov qword [rsp + 0x60], rax
lea esi, [r8 + 1]
mov r12d, r13d
cmp r12, rcx
jae 0x24011
mov word [rsp + 0x44], r8w
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x430]
call fcn.00028240
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x3f0]
call fcn.00028240
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.00028240
mov r9, qword [rsp + 0x78]
movzx r8d, word [r12 + r9]
mov word [rsp + 0x58], r8w
add r13d, 2
cmp r14w, r8w
jbe 0x23f0d
movzx r8d, r8w
mov edx, r13d
add rdx, r9
mov rcx, rdi
call fcn.000283d0
mov r9, qword [rsp + 0x78]
mov r8w, word [rsp + 0x58]
movzx r11d, r8w
mov dword [rsp + 0x50], r11d
add r13d, r11d
movzx ecx, word [r13 + r9]
add r13d, 2
movsxd rax, r13d
test ecx, ecx
je 0x24001
lea r12, [rax + r9]
mov r9, rcx
mov qword [rsp + 0x70], rcx
mov r14, qword [rsp + 0x100]
movzx edx, word [rsp + 0x44]
cmp dx, r15w
jae 0x23fc5
movzx r10d, dx
movzx eax, word [r12]
mov word [rsp + 0x68], ax
movzx eax, word [r12 + 2]
mov word [rsp + r10*2 + 0x3f0], ax
add r13d, ebx
add r12, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
movzx eax, r8w
cmp rcx, rax
jne 0x23fcb
mov al, byte [rsp + r10*2 + 0x3f0]
mov byte [rsp + 0x20], al
movzx r9d, word [rsp + 0x68]
mov r8d, r11d
mov rdx, r14
mov rcx, qword [0x00065e78]
call fcn.000213e8
mov dx, word [rsp + 0x44]
mov r8w, word [rsp + 0x58]
mov r9, qword [rsp + 0x70]
mov r11d, dword [rsp + 0x50]
jmp 0x23fcb
add r13d, ebx
add r12, rbx
add dx, si
mov word [rsp + 0x44], dx
sub r9, rsi
mov qword [rsp + 0x70], r9
jne 0x23f47
mov r14d, 0x104
mov rdi, qword [rsp + 0x100]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
jmp 0x24011
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
sub rax, rsi
mov qword [rsp + 0x60], rax
jne 0x23e91
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor r8d, r8d
mov edi, r8d
jmp 0x24a50
cmp esi, ebx
jne 0x24a50
movzx edi, word [r12]
movzx ebx, word [r12 + 2]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov r12, qword [0x00065e78]
mov word [r12 + 0x200], di
mov word [r12 + 0x202], bx
xchg dword [r12 + 0x20c], eax
cmp dword [r12 + 0x208], r14d
jne 0x24095
mov rdx, qword [0x00065ea8]
mov rcx, r12
call fcn.00026cd8
mov esi, 1
xchg dword [r12 + 0x208], esi
xor eax, eax
jmp 0x24a65
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, ebx
jne 0x24994
mov ecx, dword [r12]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov edi, eax
cmp eax, r14d
jl 0x24a50
mov rdx, qword [rsp + 0x80]
mov rcx, qword [0x00065e98]
call fcn.000232a4
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0x40
jne 0x24994
lea edi, [rsi - 0x16]
cmp dword [r12 + 8], edi
jbe 0x24141
mov dword [r12 + 8], edi
mov r8, rdi
lea rdx, [0x00029570]
mov rcx, qword [r12]
call fcn.000283d0
mov ebx, 0x27
cmp dword [r12 + 0x18], ebx
jbe 0x24166
mov dword [r12 + 0x18], ebx
mov r8, rbx
lea rdx, [0x000295a0]
mov rcx, qword [r12 + 0x10]
call fcn.000283d0
mov esi, 0x29
cmp dword [r12 + 0x28], esi
jbe 0x2418b
mov dword [r12 + 0x28], esi
mov r8, rsi
lea rdx, [0x000295d0]
mov rcx, qword [r12 + 0x20]
call fcn.000283d0
mov r13d, 0x26
cmp dword [r12 + 0x38], r13d
jbe 0x241b1
mov dword [r12 + 0x38], r13d
mov r8, r13
lea rdx, [0x00029600]
mov rcx, qword [r12 + 0x30]
call fcn.000283d0
cmp dword [r12 + 0x18], ebx
jne 0x24994
cmp dword [r12 + 8], edi
jne 0x24994
cmp dword [r12 + 0x38], r13d
jne 0x24994
cmp dword [r12 + 0x28], esi
jne 0x24994
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [0x00065e78]
xchg dword [rcx + 0x210], eax
mov edi, r14d
mov dword [rsp + 0x5c], 0x40
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
mov ebx, 4
cmp esi, ebx
jne 0x24994
mov dword [r12], 0x12a06f
mov dword [rsp + 0x5c], ebx
mov edi, r14d
jmp 0x24a50
mov byte [rsp + 0x370], r14b
mov r15d, 0x20
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x371]
call fcn.00028240
mov r13d, r14d
lea rax, [r12 + 0x20]
cmp rax, r14
je 0x2427f
lea ecx, [rsi - 0x20]
mov r8, rax
lea rdx, [rsp + 0x370]
call fcn.00013e40
mov r8, r15
lea rdx, [rsp + 0x370]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x24a50
mov r14d, 0x104
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r15, rax
test rax, rax
je 0x24377
mov rbx, qword [0x00065e78]
lea rcx, [rbx + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov dil, al
lea rcx, [rbx + 0x340]
call fcn.000127f0
mov dl, dil
lea rcx, [rbx + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rdi, [r12 + 0x24]
mov qword [rsp + 0x80], rdi
cmp dword [r12 + 0x20], r13d
jbe 0x2436c
mov r12d, dword [r12 + 0x20]
mov ebx, 4
lea esi, [rbx - 3]
mov eax, r13d
movzx edi, word [rax + rdi]
add r13d, 2
mov r8, r14
xor edx, edx
mov rcx, r15
call fcn.00028240
mov r8, rdi
mov edx, r13d
add rdx, qword [rsp + 0x80]
mov rcx, r15
call fcn.000283d0
add r13d, edi
mov rdi, qword [rsp + 0x80]
mov r9d, dword [r13 + rdi]
add r13d, ebx
mov eax, r13d
add r13d, ebx
mov r8d, dword [rax + rdi]
mov rdx, r15
mov rcx, qword [0x00065e78]
call fcn.000210cc
sub r12, rsi
jne 0x2430d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
jmp 0x24a50
sub eax, 0x2220a8
je 0x2499d
mov ebx, 4
sub eax, ebx
je 0x2481a
sub eax, ebx
je 0x24697
sub eax, ebx
je 0x2452f
sub eax, ebx
je 0x2448c
sub eax, ebx
je 0x24414
cmp eax, ebx
jne 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0xc
jne 0x24994
mov dl, byte [r12]
mov eax, dword [r12 + 4]
mov rcx, qword [0x00065e78]
mov dword [rcx + 0x214], eax
mov byte [rcx + 0x218], dl
mov cl, byte [r12 + 8]
mov rax, qword [0x00065e98]
mov byte [rax + 0x38], cl
mov edi, r14d
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
mov r14d, 0x104
cmp esi, r14d
jne 0x24994
cmp dword [rsp + 0x5c], ebx
jne 0x24994
lea edi, [r14 - 1]
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x471]
call fcn.00028240
lea rcx, [rsp + 0x470]
mov rdx, r12
mov r8, rdi
call fcn.000283d0
lea rcx, [rsp + 0x470]
call fcn.00016e70
mov dword [r12], eax
xor edi, edi
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
mov r8d, 0x20a
cmp esi, r8d
jne 0x24994
mov bl, r14b
lea rcx, [rsp + 0x160]
mov rdx, r12
call fcn.000283d0
mov dl, byte [rsp + 0x160]
mov esi, 1
cmp dl, sil
jne 0x244eb
mov word [rsp + 0x368], r14w
mov bl, sil
jmp 0x24508
cmp dl, r14b
jne 0x24508
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x162]
call fcn.00028240
mov bl, sil
mov edi, r14d
cmp bl, r14b
je 0x24a50
lea rdx, [rsp + 0x162]
mov rcx, qword [0x00065e88]
call fcn.0001d338
mov edi, eax
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0x10
jne 0x24994
mov qword [rsp + 0x70], r14
mov byte [rsp + 0xa0], r14b
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
cmp byte [r12 + 0xc], 3
jne 0x24994
mov byte [rsp + 0xa0], 7
mov eax, dword [r12 + 8]
mov dword [rsp + 0xb0], eax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0xa8], rax
cmp rax, r14
je 0x24994
mov edx, dword [r12 + 8]
lea r8d, [rsi - 0xf]
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, dword [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.00028240
mov r8d, dword [rsp + 0xb0]
mov rdx, qword [r12]
mov rcx, qword [rsp + 0xa8]
call fcn.000283d0
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x30], rdx
lea rax, [0x00023784]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x2467c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9d, [rsi + 0x20]
lea r8, [rsp + 0x118]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, dword [rsp + 0x118]
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x24682
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0x10
jne 0x24994
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x88], r14b
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov eax, dword [r12 + 8]
mov dword [rsp + 0x98], eax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x90], rax
cmp rax, r14
je 0x24994
mov edx, dword [r12 + 8]
mov esi, 1
mov r8d, esi
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call fcn.00028240
mov r8d, dword [rsp + 0x98]
mov rdx, qword [r12]
mov rcx, qword [rsp + 0x90]
call fcn.000283d0
cmp byte [r12 + 0xc], sil
jne 0x2475d
mov byte [rsp + 0x88], 3
jmp 0x24775
movzx eax, byte [rsp + 0x88]
cmp byte [r12 + 0xc], 2
cmove eax, ebx
mov byte [rsp + 0x88], al
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [0x00023784]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x247ff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0x30
lea r8, [rsp + 0x118]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, dword [rsp + 0x118]
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x24805
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24a50
mov rdx, qword gs:[0x188]
mov rcx, qword [0x00065e98]
call fcn.00023320
cmp al, r14b
je 0x24994
cmp esi, 0x10
jne 0x24994
mov qword [rsp + 0x60], r14
mov byte [rsp + 0xb8], r14b
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
lea esi, [rax + 1]
cmp byte [r12 + 0xc], sil
jne 0x24874
mov byte [rsp + 0xb8], 5
jmp 0x24888
cmp byte [r12 + 0xc], 2
jne 0x24994
mov byte [rsp + 0xb8], 6
mov eax, dword [r12 + 8]
mov dword [rsp + 0xc8], eax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0xc0], rax
cmp rax, r14
je 0x24994
mov edx, dword [r12 + 8]
mov r8d, esi
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, dword [rsp + 0xc8]
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call fcn.00028240
mov r8d, dword [r12 + 8]
mov rdx, qword [r12]
mov rcx, qword [rsp + 0xc0]
call fcn.000283d0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x30], rdx
lea rax, [0x00023784]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
mov dword [rsp + 0x40], eax
cmp eax, r14d
jl 0x24979
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0x30
lea r8, [rsp + 0x118]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, dword [rsp + 0x118]
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x2497f
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x24a50
mov edi, dword [rsp + 0x40]
jmp 0x24a50
cmp esi, 0x2a0
jne 0x24a50
mov esi, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
cmp rax, r14
je 0x24a50
mov rdx, r12
lea rcx, [rsp + 0x148]
call qword [fcn.004e696c]
lea rdx, [r12 + 0x20c]
lea rcx, [rsp + 0x100]
call qword [fcn.004e696c]
mov dword [rsp + 0x20], esi
mov r9, rbx
mov r8d, 2
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x148]
call fcn.00015fa4
mov edi, eax
cmp eax, r14d
jl 0x24a45
mov eax, dword [rbx + 8]
cmp dword [r12 + 0x298], eax
jb 0x24a45
mov eax, dword [rbx + 4]
mov dword [r12 + 0x208], eax
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, qword [r12 + 0x290]
call fcn.000283d0
mov edi, r14d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, qword [rsp + 0x110]
mov dword [rdx + 0x30], edi
mov eax, dword [rsp + 0x5c]
mov qword [rdx + 0x38], rax
mov eax, edi
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.000281c0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret