Function at 0x22cf0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x00047100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor ebp, ebp
lea rcx, [0x0004c920]
lea esi, [rbp + 0x30]
mov qword [r11 - 0x70], rbp
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x60], rbp
mov dword [rsp + 0x68], 0x200
mov qword [r11 - 0x58], rbp
mov qword [r11 - 0x48], rbp
mov qword [r11 - 0x40], rbp
call fcn.00023240
cmp eax, ebp
jne 0x230bc
lea r8d, [rbp + 0x20]
lea rdx, [0x00048900]
lea rcx, [0x0004c938]
call fcn.0002489c
lea rcx, [0x0004c920]
call fcn.000235e8
xor eax, eax
or r12, 0xffffffffffffffff
lea rdi, str._____BEGIN_DH_PARAMETERS_____MIGHAoGBAKHqsQk2uy9n0fn0QW6xtPmPD5Hc5LupavUKRyAK6U7T7AznJfvqIwSnxT0_kxc2V1rOEN9k3m4DycPkAMfFjW1E2O1FrOedqHTMcLf72d5LPC5tApgcG3TKfMlDxen9kg7HiQySrT9jsW5VQ2PNUKQDcoOQrz0S1W76D83phrAgEC_____END_DH_PARAMETERS_____
mov rcx, r12
mov edx, 0x620
repne scasb al, byte [rdi]
lea rdi, str._____BEGIN_CERTIFICATE_____MIIDPjCCAqegAwIBAgIBBDANBgkqhkiG9w0BAQUFADBtMQswCQYDVQQGEwJDTjEQMA4GA1UECBMHQmVpSmluZzEQMA4GA1UEBxMHQmVpSmluZzEOMAwGA1UEChMFQmFpZHUxFDASBgNVBAsMCyouQmFpZHUuY29tMRQwEgYDVQQDDAsqLkJhaWR1LmNvbTAeFw0xNjA1MjUwNzMzMDBaFw0zNTA1MjUwNzMzMDBaMG0xCzAJBgNVBAYTAkNOMRAwDgYDVQQIEwdCZWlKaW5nMRAwDgYDVQQHEwdCZWlKaW5nMQ4wDAYDVQQKEwVCYWlkdTEUMBIGA1UECwwLKi5CYWlkdS5jb20xFDASBgNVBAMMCyouQmFpZHUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTkHgKYXhbN_01mfX86CpEU201kanptxArIPo2wbjzi83fKlfHydeF8Kkm6lwlW9Gvnx8FCEadGPKtKWng2zfS8X34NWscqahTsDPGaSX8tDoAh_dW7isd8T4X2ZpSV0_zwQAObViX3JqBHDSRRD1cbcDXR0ObBL4LcAt_zZlwIDAQABo4HtMIHqMAwGA1UdEwEB_wQCMAAwHQYDVR0OBBYEFE5Gl3vghov4HG4Cmme2foWm14MIGXBgNVHSMEgY8wgYyAFKn22PLU7S81xfBZUFBlpuGtZIUnoXGkbzBtMQswCQYDVQQGEwJDTjEQMA4GA1UECBMHQmVpSmluZzEQMA4GA1UEBxMHQmVpSmluZzEOMAwGA1UEChMFQmFpZHUxFDASBgNVBAsMCyouQmFpZHUuY29tMRQwEgYDVQQDDAsqLkJhaWR1LmNvbYIBATAOBgNVHQ8BAf8EBAMCBaAwEQYJYIZIAYb4QgEBBAQDAgZAMA0GCSqGSIb3DQEBBQUAA4GBACpWIYKpOtv2xnXdcc_zj34fNSQJG8ot966XPJSzVr2_fAFVcRmXnE7ZmaHccNnwXhu09Hj1K5QOWUuPUUFODPIaa3CHXw80Zu2ogJShd74DnTgEnTkEQTm_hG4AH_Nt12otpn6QH7hvUm50jSk6GC4uvWrDvZPk10khNTd_____END_CERTIFICATE_____
mov r8d, 0x53534c4d
not rcx
dec rcx
mov qword [0x0004c8b0], rcx
mov rcx, r12
repne scasb al, byte [rdi]
lea rdi, str._____BEGIN_RSA_PRIVATE_KEY_____MIICXQIBAAKBgQDTkHgKYXhbN_01mfX86CpEU201kanptxArIPo2wbjzi83fKlfHydeF8Kkm6lwlW9Gvnx8FCEadGPKtKWng2zfS8X34NWscqahTsDPGaSX8tDoAh_dW7isd8T4X2ZpSV0_zwQAObViX3JqBHDSRRD1cbcDXR0ObBL4LcAt_zZlwIDAQABAoGACeNLqPiLlYjYIsJOkipBzQURA62sGbPTwXYOqDhsZwNA86_w3pA_L8eegkEAN1HUpJLMkKQENA9ShqvQvjaHRQao6G2De2k0Ac482afhXN3x9WnztvCEKs9eB87any4NT_ckvIU3Vipleltq5EgwEO4imcSoq2RfP4qCNzU0ECQQDyc2DN0OyUbdR_p11dihKwlPQ9wcflbiwwCm8GE2ocxohW6bl0atKaJoJu5umXVjHDoxyh5oRdswAh_egccvAhAkEA32M3AfnkAAkSadec2OWyM9FQ2VH1yYzbVon_WT4xUV39kdEbGU5KYI4fl7E8AmcnXRfcNVK4sNzEa8FTytwJBAN7lOfsd91JiQrl1Sb3EQXh8CKt6Kud_yToFbZqdYLHBx_h3edtQlfvIKaQBwIE0ah3dKGajwc9O0HFvtPnu2ECQEIOAW8JKH1GPm_jGM_ADA83EwEZysN43U4hkZkRbOpQX2eorTfsOpnmkrPzbAKapP_MH8XXnDwvlTAOcB0MCQQDeeISRIU389WbOoQBcYugJpsqNZsAuhdMeHgHauK0DqGBAMTrQLWuoP2t9NalN47hhhAppKrTdzzv6O0L8Avn_____END_RSA_PRIVATE_KEY_____
not rcx
dec rcx
mov qword [0x0004c8b8], rcx
mov rcx, r12
repne scasb al, byte [rdi]
lea rdi, str._____BEGIN_CERTIFICATE_____MIICazCCAdSgAwIBAgIJAONRvXAsCAomMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkZSMRYwFAYDVQQKDA1Pcnl4IEVtYmVkZGVkMR4wHAYDVQQDDBVPcnl4IEVtYmVkZGVkIFRlc3QgQ0EwHhcNMTMwNTIyMTcyMDAyWhcNMTgwNTIyMTcyMDAyWjBFMQswCQYDVQQGEwJGUjEWMBQGA1UECgwNT3J5eCBFbWJlZGRlZDEeMBwGA1UEAwwVT3J5eCBFbWJlZGRlZCBUZXN0IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRPPavULW7NVwl0QD5gFW48YyPf0deoxk7OopkAzefcWb18TNlFeuGk4HVocZmvVZZ0XR5h6u8V_6ZZDyIz7PXLBXoMnnogObBtSdRbLQ9pTppyOShrK01kTmurIWl7gJ_XePF13jD2Y4rh_HxmRebUaQldqb2IJC3uEeQGhwIDAQABo2MwYTAdBgNVHQ4EFgQUBaRLmV7ns94EkvkitRySVcAE94AwHwYDVR0jBBgwFoAUBaRLmV7ns94EkvkitRySVcAE94AwDwYDVR0TAQH_BAUwAwEB_zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAacQfmER31pBbi3lcZAy2DUst0zloDNcKlOBjKlNZ8eYPXo1bgMvhyA4CFusSMQlwzsof5Pui0sr3YpIHSzPYEY62vFpOwc7eyn2YGClCX2LRbGQiLlOH17L5DKniLB4CS3cf4Q3dQ3SmJgI3j1KoBNz_WllSp1ca3yEA9RgI_____END_CERTIFICATE__________BEGIN_CERTIFICATE_____MIIDKjCCAuqgAwIBAgIJAOXe1V4R3YMAkGByqGSM44BAMwRTELMAkGA1UEBhMCRlIxFjAUBgNVBAoMDU9yeXggRW1iZWRkZWQxHjAcBgNVBAMMFU9yeXggRW1iZWRkZWQgVGVzdCBDQTAeFw0xMzA1MjIxNzIxMzBaFw0xODA1MjIxNzIxMzBaMEUxCzAJBgNVBAYTAkZSMRYwFAYDVQQKDA1Pcnl4IEVtYmVkZGVkMR4wHAYDVQQDDBVPcnl4IEVtYmVkZGVkIFRlc3QgQ0EwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEA58BmPiMOYyjSNe2vDxHXXzmRsMVxe4lVhgWKskKJOT7tGgUIFy_OVLTfT2RINxTo5JEPNWYFQsD7tntr1FMb3u9gHmBvctorl0OCx5Klm19rWiCbeWB8wsDtSfT4BRZdmnqHEOjbOaJqBKOsxZvi0anfyGWAihe5PDyMzq8CFQCyLDK8zRlJaN9s0U9_gdnGVztLwKBgQDU4DUIFc5y0yupuRHu5gnbYe6b4ZooWclwF7CI_gQW9DncoBezGui14Wdqmx_3CrYwAwKfI08oJAPOxNNti77rmTRjePMpxa2DcEifUru0At48jiiTcgXh_gx9V0h0JoXKGQQGMnD1ncP4AD7MBnB2V6HaLc69Fn0iqg9ZJdMAOBhQACgYEAi7OgBf6fM9ER3IAb2RVMbCrXWZAO8mdbBzai626TsDQedfQVm66dZxDCc39j7ApbtKW2b8UtRHW_0WTVObyEdbBKAEGUt9i9gx9vcZ_slH5AKK3jqY11LyK6K75OZ6B6cVYur_Lvjw5UzF5E2Fik5kvWHUN9g4Ui2mS_naMOjYzBhMB0GA1UdDgQWBBRdepugy0kJT1YBT5umE1R0PXLqZzAfBgNVHSMEGDAWgBRdepugy0kJT1YBT5umE1R0PXLqZzAPBgNVHRMBAf8EBTADAQH_MA4GA1UdDwEB_wQEAwIBBjAJBgcqhkjOOAQDAy8AMCwCFCK5JaWpGbhyXtwM5rWFNbRbDvJRAhQZ_ufjeHrR0qp7sFAWleKxizUfA_____END_CERTIFICATE__________BEGIN_CERTIFICATE_____MIIB4zCCAYmgAwIBAgIJAK1HWgKR6ZD4MAkGByqGSM49BAEwRTELMAkGA1UEBhMCRlIxFjAUBgNVBAoMDU9yeXggRW1iZWRkZWQxHjAcBgNVBAMMFU9yeXggRW1iZWRkZWQgVGVzdCBDQTAeFw0xNDAyMjQyMTAzMjlaFw0xOTAyMjQyMTAzMjlaMEUxCzAJBgNVBAYTAkZSMRYwFAYDVQQKDA1Pcnl4IEVtYmVkZGVkMR4wHAYDVQQDDBVPcnl4IEVtYmVkZGVkIFRlc3QgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAScnEZAjcIT6M8Zo6_FqpIMeIp9n_1Bg93laOozNMMy_9I8yD2PBhrAp5ZPcDcvmyP0anhZJB6kPwVbFWeNRSfo2MwYTAdBgNVHQ4EFgQU6gM_oVAeh8UKHbfl8VgC91ZW2NcwHwYDVR0jBBgwFoAU6gM_oVAeh8UKHbfl8VgC91ZW2NcwDwYDVR0TAQH_BAUwAwEB_zAOBgNVHQ8BAf8EBAMCAQYwCQYHKoZIzj0EAQNJADBGAiEAgq9NA8vWGIUpn9dBYy5OmGccoTFuKsfRzxqgMOFwfMCIQDdwfVKK3Yd0Ohf7T0bhtDahXPTyOwfD1qJmMk0QmTK9w_____END_CERTIFICATE_____
not rcx
dec rcx
mov qword [0x0004c8c0], rcx
mov rcx, r12
repne scasb al, byte [rdi]
not rcx
dec rcx
mov qword [0x0004c8c8], rcx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rbp
jne 0x22e04
mov rdi, rbp
jmp 0x22e37
xor edx, edx
mov r8d, 0x610
mov rcx, rax
call fcn.0003bc80
mov rcx, rdi
call fcn.00024718
cmp eax, ebp
jne 0x22e30
mov edx, 0x53534c4d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x22dff
mov dword [rdi + 8], 0x10
mov qword [0x0004c8d0], rdi
cmp rdi, rbp
je 0x230b0
mov edx, 0x40
xor ecx, ecx
mov r8d, 0x72647268
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rbp
je 0x23067
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x38]
call fcn.0003bc80
mov dword [rbx], 1
mov qword [rbx + 0x10], r12
neg rbx
cmp rbx, r12
je 0x23067
mov eax, 2
mov rdi, rbx
mov dword [rsp + 0x84], ebp
neg rdi
mov word [rsp + 0x80], ax
mov eax, 0xe7df
mov word [rsp + 0x82], ax
cmp byte [rdi + 4], bpl
jne 0x22ec9
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.000111f0
jmp 0x22ecc
mov eax, r12d
cmp eax, ebp
jge 0x22edd
mov rcx, rbx
call fcn.000112b4
jmp 0x2305a
cmp byte [rdi + 4], bpl
je 0x22fe2
cmp byte [rdi + 5], bpl
jne 0x22fe2
cmp dword [rdi], 1
jne 0x2305a
cmp byte [rdi + 6], bpl
jne 0x23038
cmp qword [rdi + 0x20], rbp
jne 0x22f50
mov r8d, 0x72647268
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rdi + 0x20], rax
cmp rax, rbp
je 0x2305a
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call fcn.0003bc80
mov rdx, qword [rdi + 0x20]
xor r8d, r8d
mov qword [rdx], r12
mov rcx, qword [rdi + 0x20]
xor edx, edx
add rcx, 0x10
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rdx, [0x0003bec0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rdi + 0x20]
mov r8b, byte [rdi + 8]
lea rax, [rdx + 8]
lea rcx, [rsp + 0x80]
mov r9, rdx
mov qword [rsp + 0x20], rax
call fcn.000119b8
mov rcx, qword [rdi + 0x20]
cmp eax, ebp
mov esi, eax
jge 0x22f9d
mov qword [rcx + 8], rbp
mov rcx, qword [rdi + 0x20]
mov qword [rcx], r12
jmp 0x22fe5
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rcx + 8]
call fcn.00011c1c
cmp eax, ebp
mov esi, eax
jge 0x22fdc
mov rcx, qword [rdi + 0x20]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 0x20]
mov qword [rdx + 8], rbp
mov rcx, qword [rdi + 0x20]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rdx, qword [rdi + 0x20]
mov qword [rdx], r12
jmp 0x22fe5
mov byte [rdi + 6], 1
jmp 0x23038
mov esi, r12d
cmp esi, ebp
jl 0x2305a
jmp 0x23038
inc dword [0x0004c8ac]
mov qword [rsp + 0x30], rax
lea rax, [0x000228e0]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov edx, 0x1fffff
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebp
jl 0x23033
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x23033
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x48], rbp
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, rbx
mov dword [rsp + 0x40], 0x10
call fcn.00011028
cmp rax, rbp
jge 0x22feb
cmp rbx, rbp
jl 0x23067
mov rcx, rbx
call fcn.000112b4
mov rdi, qword [0x0004c8d0]
cmp rdi, rbp
je 0x230b0
mov rcx, qword [rdi]
cmp rcx, rbp
je 0x23089
mov edx, 0x53534c4d
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rdi], rbp
mov eax, dword [rdi + 8]
xor edx, edx
mov rcx, rdi
lea r8, [rax + rax*2]
shl r8, 5
add r8, 0x10
call fcn.0003bc80
mov edx, 0x53534c4d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [0x0004c920]
call fcn.00023320
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0003a660
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret