Function at 0x140003660
Capabilities:
Copy network traffic

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
lea r15, [rcx + 0x148]
mov rdi, rcx
mov rcx, r15
mov r14, r8
mov ebp, edx
mov esi, r12d
mov ebx, r12d
mov byte [rsp + 0x70], r12b
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea r13d, [r12 + 3]
mov byte [rsp + 0x88], al
mov eax, dword [rdi + 0x34]
test al, 4
je 0x1400036b6
cmp ebp, r13d
je 0x1400038df
cmp ebp, r13d
jne 0x1400036e5
lea rax, [rdi + 0xa8]
mov rcx, qword [rax]
cmp rcx, rax
je 0x1400038df
mov rbx, rcx
mov rcx, qword [rcx]
cmp qword [rbx + 8], rax
jne 0x1400036e0
cmp qword [rcx + 8], rbx
je 0x140003712
mov rcx, r13
int 0x29
lea rax, [rdi + 0xb8]
mov rcx, qword [rax]
cmp rcx, rax
je 0x1400038df
mov rbx, rcx
mov rcx, qword [rcx]
cmp qword [rbx + 8], rax
jne 0x1400038da
cmp qword [rcx + 8], rbx
jne 0x1400038da
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rdx, qword [rbx + 0x48]
test rdx, rdx
jne 0x140003746
mov rdx, qword [r14]
mov rax, qword [0x14000b878]
sub rax, rdx
cmp rax, 0x10
jae 0x140003828
mov esi, 0xc0000017
mov r14b, r12b
jmp 0x1400038e2
mov rax, qword [rbx + 0x58]
mov ecx, 0x2000
test rax, rax
jne 0x1400037ec
cmp rdx, rcx
ja 0x1400037b2
mov rax, qword [0x14000b878]
lea r12, [rdx + 0x10]
mov rdx, qword [r14]
sub rax, rdx
cmp rax, r12
jb 0x140003819
mov rcx, qword [0x14000b870]
lea r9, [rsp + 0x20]
mov dword [rdx + rcx], ebp
mov rax, qword [rdi + 0x10]
add rcx, 0x10
mov qword [rdx + rcx - 0xc], rax
mov eax, dword [rbx + 0x48]
mov dword [rdx + rcx - 4], eax
mov r8, qword [rbx + 0x48]
add rdx, rcx
lea rcx, [rbx + 0x18]
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
add qword [r14], r12
jmp 0x140003844
test rax, rax
jne 0x1400037ec
xor ecx, ecx
mov r8d, 0x44544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x140003722
mov r8, qword [rbx + 0x48]
lea rcx, [rbx + 0x18]
lea r9, [rsp + 0x20]
mov rdx, rax
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
mov ecx, 0x2000
mov rdx, qword [rbx + 0x60]
mov r13, qword [rbx + 0x48]
sub r13, rdx
cmp r13, rcx
cmova r13, rcx
test r13, r13
je 0x140003844
mov r8, qword [r14]
mov rax, qword [0x14000b878]
lea r12, [r13 + 0x10]
sub rax, r8
cmp rax, r12
jae 0x14000384c
mov r14b, byte [rsp + 0x70]
mov esi, 0xc0000017
jmp 0x1400038e2
mov rcx, qword [0x14000b870]
mov dword [rdx + rcx], ebp
mov rax, qword [rdi + 0x10]
mov qword [rdx + rcx + 4], rax
mov dword [rdx + rcx + 0xc], r12d
add qword [r14], 0x10
mov r14b, sil
jmp 0x1400038e2
mov rcx, qword [0x14000b870]
mov dword [r8 + rcx], ebp
mov rax, qword [rdi + 0x10]
mov dword [r8 + rcx + 0xc], r13d
mov qword [r8 + rcx + 4], rax
add rdx, qword [rbx + 0x58]
add rcx, 0x10
add rcx, r8
mov r8, r13
call fcn.140008e40
add qword [rbx + 0x60], r13
add qword [r14], r12
mov rax, qword [rbx + 0x48]
cmp qword [rbx + 0x60], rax
jae 0x140003844
mov r13d, 3
cmp ebp, r13d
jne 0x1400038b0
lea rax, [rdi + 0xa8]
mov rcx, qword [rax]
mov qword [rbx + 8], rax
mov qword [rbx], rcx
cmp qword [rcx + 8], rax
je 0x1400038cc
mov ecx, r13d
int 0x29
lea rax, [rdi + 0xb8]
mov rcx, qword [rax]
mov qword [rbx + 8], rax
mov qword [rbx], rcx
cmp qword [rcx + 8], rax
je 0x1400038cc
mov rcx, r13
int 0x29
mov qword [rcx + 8], rbx
mov qword [rax], rbx
mov r14b, 1
xor ebx, ebx
jmp 0x1400038e2
mov rcx, r13
int 0x29
mov r14b, bl
mov dl, byte [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test rbx, rbx
je 0x1400039d4
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov dl, al
test esi, esi
js 0x140003984
mov ecx, dword [rbx + 0x48]
cmp ebp, 3
jne 0x14000392f
mov eax, dword [rdi + 0xd8]
cmp eax, ecx
jb 0x140003926
sub eax, ecx
mov dword [rdi + 0xd8], eax
jmp 0x14000394a
and dword [rdi + 0xd8], 0
jmp 0x14000394a
mov eax, dword [rdi + 0xdc]
cmp eax, ecx
jb 0x140003943
sub eax, ecx
mov dword [rdi + 0xdc], eax
jmp 0x14000394a
and dword [rdi + 0xdc], 0
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400078d8
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rdi + 0xe8], 0
je 0x140003980
cmp dword [rdi + 0xdc], 0x8000
jae 0x140003980
mov byte [rdi + 0xe8], 0
mov dl, al
jmp 0x1400039c9
cmp ebp, 3
jne 0x1400039a4
add rdi, 0xa8
mov rax, qword [rdi]
mov qword [rbx + 8], rdi
mov qword [rbx], rax
cmp qword [rax + 8], rdi
je 0x1400039c2
mov ecx, ebp
int 0x29
add rdi, 0xb8
mov rax, qword [rdi]
mov qword [rbx + 8], rdi
mov qword [rbx], rax
cmp qword [rax + 8], rdi
je 0x1400039c2
mov ecx, 3
int 0x29
mov qword [rax + 8], rbx
mov qword [rdi], rbx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x1400039ea
test r14b, r14b
je 0x1400039ea
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov r8, rdi
mov edx, ebp
call fcn.140005bec
mov eax, esi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret