Function at 0x140006310
Capabilities:
Check os version
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
call sym.VBoxNetFlt.sys_RTR0Init
test eax, eax
js 0x14000638c
xorps xmm0, xmm0
lea rcx, [0x14002e240]
xor eax, eax
movups xmmword [0x14002e240], xmm0
mov qword [0x14002e2c0], rax
movups xmmword [0x14002e250], xmm0
movups xmmword [0x14002e260], xmm0
movups xmmword [0x14002e270], xmm0
movups xmmword [0x14002e280], xmm0
movups xmmword [0x14002e290], xmm0
movups xmmword [0x14002e2a0], xmm0
movups xmmword [0x14002e2b0], xmm0
call fcn.1400012d0
test eax, eax
jns 0x1400063a8
call sym.VBoxNetFlt.sys_RTR0Term
mov ebx, 0xc0000001
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [0x14002e1f8]
xor r8d, r8d
xor edx, edx
movups xmmword [0x14002e1e0], xmm0
movups xmmword [0x14002e1f0], xmm0
movups xmmword [0x14002e200], xmm0
movups xmmword [0x14002e210], xmm0
movups xmmword [0x14002e220], xmm0
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r8d, r8d
lea rcx, [0x14002e210]
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea r14, [0x14002e1e0]
mov dword [rsp + 0x40], 0x30
xor ebp, ebp
mov qword [rsp + 0x30], r14
lea rax, [0x140005010]
mov qword [0x14002e1e8], r14
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x40]
mov qword [0x14002e1e0], r14
mov edx, 0x1fffff
mov qword [rsp + 0x48], rbp
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x58], 0x200
mov qword [rsp + 0x50], rbp
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
jne 0x14000665a
mov rcx, qword [rsp + 0xa0]
lea rax, [0x14002e228]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0xa0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jne 0x14000665a
xor r8d, r8d
lea rcx, [0x14002e1c8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x140004f70]
mov byte [0x14002e1c1], bpl
lea rdx, [0x14002e180]
mov qword [0x14002e190], rax
lea r8, [0x14002e1f0]
mov qword [0x14002e198], rdx
mov rcx, r14
mov byte [0x14002e1c0], 1
mov byte [0x14002e1b8], bpl
call qword [sym.imp.ntoskrnl.exe_ExInterlockedInsertTailList]
xor r8d, r8d
lea edx, [rbp + 1]
lea rcx, [0x14002e210]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xorps xmm0, xmm0
lea edx, [rbp + 1]
xor eax, eax
lea rcx, [0x14002e100]
mov r8b, 1
mov qword [0x14002e170], rax
movups xmmword [0x14002e100], xmm0
movups xmmword [0x14002e110], xmm0
movups xmmword [0x14002e120], xmm0
movups xmmword [0x14002e130], xmm0
movups xmmword [0x14002e140], xmm0
movups xmmword [0x14002e150], xmm0
movups xmmword [0x14002e160], xmm0
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r9d, r9d
lea rdx, [rsp + 0xa8]
xor r8d, r8d
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0xa0], 5
mov eax, 0x80
mov dword [0x14002e130], eax
jne 0x1400065a7
cmp dword [rsp + 0xa8], ebp
mov ecx, 0x480
cmove eax, ecx
mov dword [0x14002e130], eax
lea rax, [0x14002e160]
mov dword [0x14002e134], 0x100
mov r8, rdi
mov qword [0x14002e160], rax
mov rdx, rsi
mov qword [0x14002e168], rax
lea rcx, [0x14002e138]
mov qword [0x14002e150], rbp
call fcn.140003e10
mov ebx, eax
test eax, eax
jne 0x140006623
mov r8, rdi
lea rcx, [0x14002e148]
mov rdx, rsi
call fcn.140002f80
mov ebx, eax
test eax, eax
jne 0x140006617
mov rdx, qword [0x14002e148]
mov rcx, qword [0x14002e138]
call sub.NDIS.SYS_NdisIMAssociateMiniport
xor eax, eax
jmp 0x140006393
lea rcx, [0x14002e138]
call fcn.140003af0
cmp qword [0x14002e228], rbp
je 0x140006661
xor r8d, r8d
lea rcx, [0x14002e1f8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [0x14002e228]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x140006661
mov qword [0x14002e228], rbp
call fcn.140004d20
test eax, eax
js 0x140006391
call fcn.140004dd0
jmp 0x140006391