Function at 0x1a0d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x19c65], 1
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x19c64], 0
mov edx, dword [ebp - 0x20]
mov dword [edx], 0x2710
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x19c58], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x88], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x19c54], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x4c], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x19c50], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x19c60], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x19c68], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x19c6c], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x19c70], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x19d6c], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x19d58], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x19d68], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x19d60], 0
mov dword [ecx + 0x19d64], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x19d70], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x19d74], 0
push 0x17600
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x98
push ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0
mov edx, dword [ebp - 0x20]
add edx, 0x19c70
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x19c6c
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x19c68
push ecx
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
push 0x70
push 0
mov edx, dword [ebp - 0x20]
add edx, 0x19d78
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x19dfc
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push 0x2000
push 0
mov edx, dword [ebp - 0x20]
add edx, 0x17698
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x4b8
push 0
mov eax, dword [ebp - 0x20]
add eax, 0x19698
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0
push 1
mov ecx, dword [ebp - 0x20]
add ecx, 0x54
push ecx
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov edx, dword [ebp - 0x20]
add edx, 0x78
push edx
call fcn.0001a370
mov eax, dword [ebp - 0x20]
add eax, 0x74
push eax
call fcn.0001a390
mov ecx, dword [ebp - 0x20]
add ecx, 0x80
push ecx
call fcn.0001a390
mov dword [ebp - 0x18], 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x20]
push edx
push 0x19640
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x48
push ecx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
push 0x40
push 0
mov edx, dword [ebp - 0x20]
add edx, 8
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6c
push 0
mov eax, dword [ebp - 0x20]
add eax, 0x19c74
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x19d4c], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x90], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x94], 8
mov dword [ebp - 0x1c], 0
jmp 0x1a347
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x40
jae 0x1a360
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [eax + edx*4 + 0x19b50], 0
jmp 0x1a33e
mov esp, ebp
pop ebp
ret