Function at 0x10001630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10069008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1006bb08], 0
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
je 0x10001682
push 0x6a
push 0x10060d18
push str.__s__d_:__DLL__Port_is_occupied_n
call fcn.10013380
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015557
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.1002f5a3
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [0x1006bb08], eax
mov dword [eax + 8], ecx
push str.RtlInitUnicodeString
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001671
push dword [0x1006bb08]
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.FLTLIB.DLL_FilterConnectCommunicationPort]
mov eax, dword [0x1006bb08]
cmp dword [eax], 0xffffffff
jne 0x100016fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x7c
push 0x10060d7c
push str.__s__d_:__DLL___Cannot_connect_to_filter_communication_port__ws__error__d_n
call fcn.10013620
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015557
mov esp, ebp
pop ebp
ret
push 0x80
push 0x10060d18
push str.__s__d_:__DLL___Connected_to_filter_communication_port_n
call fcn.10013380
mov eax, dword [0x1006bb08]
add esp, 0xc
push 0xa
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ecx, dword [0x1006bb08]
mov dword [ecx + 4], eax
test eax, eax
jne 0x10001764
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x85
push 0x10060d18
push str.__s__d_:__DLL___Error_creating_completion_port_:__d_n
call fcn.10013380
add esp, 0x10
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015557
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push edi
push 0
push 0
push ecx
push 0x10001410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + ebx*4 - 0x2c], eax
test eax, eax
je 0x100018d8
xor esi, esi
nop word [eax + eax]
push 0x2028
call fcn.1002f5a3
mov edi, eax
add esp, 4
test edi, edi
je 0x1000182c
mov eax, dword [0x1006bb08]
lea ecx, [edi + 0x2010]
push ecx
push 0x2010
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push edi
mov dword [ecx + 0x10], 0
push dword [eax]
call dword [sym.imp.FLTLIB.DLL_FilterGetMessage]
cmp eax, 0x800703e5
jne 0x10001821
inc esi
cmp esi, 1
jl 0x10001790
inc ebx
cmp ebx, 0xa
jge 0x100017ec
mov ecx, dword [0x1006bb08]
jmp 0x10001768
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x2c]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x10001843
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xae
push 0x10060d18
push str.__s__d_:__DLL___Failed_to_wait_for_threads_:__x_n
call fcn.10013380
add esp, 0x10
jmp 0x10001843
push edi
call fcn.1002f5ae
add esp, 4
jmp 0x10001843
push 0x99
push 0x10060d18
push str.__s__d_:__DLL__Error_ERROR_NOT_ENOUGH_MEMORY_n
call fcn.10013380
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
nop dword [eax + eax]
mov eax, dword [ebp + esi*4 - 0x2c]
test eax, eax
je 0x10001876
push eax
call edi
test eax, eax
jne 0x10001876
push 0xb8
push 0x10060d18
push str.__s__d_:__DLL___Failed_to_close_handle_n
call fcn.10013380
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x10001850
mov eax, dword [0x1006bb08]
test eax, eax
je 0x100018ab
push dword [eax]
call edi
mov eax, dword [0x1006bb08]
push dword [eax + 4]
call edi
push dword [0x1006bb08]
call fcn.1002f5ae
add esp, 4
mov dword [0x1006bb08], 0
push 0xbf
push 0x10060d18
push str.__s__d_:__DLL___StartFilterCommPort_complete_n
call fcn.10013380
add esp, 0xc
mov eax, 1
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015557
mov esp, ebp
pop ebp
ret
push 0x8f
push 0x10060d18
push str.__s__d_:__DLL___Error_creating_thread_n
call fcn.10013380
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop ebx
pop esi
call fcn.10015557
mov esp, ebp
pop ebp
ret