joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11390
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov dword [rsp + 0x5c], 0xc000000d
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x88]
mov byte [rax], 0
cmp dword [0x00017148], 0
je 0x113db
cmp qword [0x00017140], 0
je 0x113db
mov rax, qword [0x00017140]
cmp dword [rax], 0
jne 0x113e0
jmp 0x115ee
call fcn.00012020
sub eax, dword [0x0001b1a4]
cmp eax, 0xf
jbe 0x11414
mov edx, 1
lea rcx, [0x0001b1a8]
xor eax, eax
lock cmpxchg dword [rcx], edx
test eax, eax
jne 0x11412
lea rcx, [0x000151e0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x11422
cmp dword [0x0001b1a8], 0
jne 0x11422
jmp 0x115ee
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax + 0x19]
mov rax, qword [rsp + 0x80]
movzx eax, word [rax + 0x1b]
lea rax, [rcx + rax + 0x1d]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
add rax, 8
mov dword [rsp + 0x58], eax
mov edx, dword [rsp + 0x58]
mov r8d, 0x63666d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x11484
mov edx, 0x1c0
lea rcx, [0x00015210]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x115ee
mov ecx, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x48]
add rdi, 8
mov rsi, qword [rsp + 0x80]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x44]
mov dword [rdx], eax
mov qword [rsp + 0x50], 0xfffffffffde9f140
mov dword [rsp + 0x40], 0x11
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
lea rdx, [0x0001b17c]
mov rcx, qword [0x0001b16c]
call sub.FLTMGR.SYS_FltSendMessage
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jne 0x11526
mov edx, 1
lea rcx, [0x0001b1a8]
xor eax, eax
lock cmpxchg dword [rcx], edx
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rcx], al
jmp 0x115ce
cmp dword [rsp + 0x5c], 0x102
jne 0x11564
xor edx, edx
lea rcx, [0x0001b1a8]
mov eax, 1
lock cmpxchg dword [rcx], edx
test eax, eax
je 0x11557
mov edx, 0x1e0
lea rcx, [0x00015260]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x88]
mov byte [rax], 0
jmp 0x115ce
cmp dword [rsp + 0x5c], 0xc0000037
jne 0x115a2
xor ecx, ecx
lea rax, [0x0001b1a8]
xchg dword [rax], ecx
xor ecx, ecx
lea rax, [0x0001b1ac]
xchg dword [rax], ecx
mov rax, qword [rsp + 0x88]
mov byte [rax], 0
mov edx, 0x1e9
lea rcx, [0x000152d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x115ce
xor ecx, ecx
lea rax, [0x0001b1a8]
xchg dword [rax], ecx
mov rax, qword [rsp + 0x88]
mov byte [rax], 0
mov r8d, 0x1ef
mov edx, dword [rsp + 0x5c]
lea rcx, [0x00015310]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x63666d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call fcn.00012020
mov ecx, eax
lea rax, [0x0001b1a4]
xchg dword [rax], ecx
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x11730
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov byte [rsp + 0x20], 0
call fcn.00012020
sub eax, dword [0x0001b19c]
cmp eax, 0xa
jae 0x117ad
mov r8d, 0x63666d
mov edx, 0x18
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1179c
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
lea r8, [0x0001b194]
mov rdx, qword [rsp + 0x28]
lea rcx, [0x0001b184]
call qword [sym.imp.ntoskrnl.exe_ExInterlockedInsertTailList]
mov byte [rsp + 0x20], 1
jmp 0x117ad
mov edx, 0x235
lea rcx, [0x00015210]
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x11c50
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x20], 0x1d
cmp qword [rsp + 0x70], 0
jne 0x11ca5
xor r9d, r9d
mov r8d, 0x303
lea rdx, [0x00015360]
lea rcx, [0x00015480]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x28], 0
jmp 0x11cad
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x70]
movzx ecx, word [rax]
mov eax, dword [rsp + 0x20]
lea rax, [rax + rcx + 2]
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x78], 0
je 0x11cdf
mov rax, qword [rsp + 0x78]
movzx ecx, word [rax]
mov eax, dword [rsp + 0x20]
lea rax, [rax + rcx + 2]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
mov r8d, 0x63666d45
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rdx
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x11e06
mov ecx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rdi, qword [rdi]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x58]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x60]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x68]
mov dword [rcx + 0x15], eax
mov rax, qword [rsp + 0x70]
movzx ecx, word [rax]
add rcx, 2
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov word [rax + 0x19], cx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
xor eax, eax
mov word [rcx + 0x1b], ax
mov rax, qword [rsp + 0x70]
movzx ecx, word [rax]
mov rdi, qword [rsp + 0x50]
mov rdi, qword [rdi]
add rdi, 0x1d
mov rsi, qword [rsp + 0x70]
mov rsi, qword [rsi + 8]
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x78], 0
je 0x11de7
mov rax, qword [rsp + 0x78]
movzx ecx, word [rax]
add rcx, 2
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov word [rax + 0x1b], cx
mov rax, qword [rsp + 0x78]
movzx r8d, word [rax]
mov rdi, qword [rsp + 0x50]
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
movzx eax, word [rax + 0x19]
xor edx, edx
mov ecx, 2
div rcx
lea rdi, [rdi + rax*2 + 0x1d]
mov rsi, qword [rsp + 0x78]
mov rsi, qword [rsi + 8]
mov rcx, r8
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rcx], rax
mov byte [rsp + 0x24], 1
jmp 0x11e17
mov edx, 0x31f
lea rcx, [0x00015210]
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [rsp + 0x24]
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x11e30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
jne 0x11e73
xor r9d, r9d
mov r8d, 0x330
lea rdx, [0x00015360]
lea rcx, [0x000153d0]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x24], 0
jmp 0x11e7b
mov dword [rsp + 0x24], 1
cmp qword [rsp + 0x48], 0
jne 0x11eaa
xor r9d, r9d
mov r8d, 0x331
lea rdx, [0x00015360]
lea rcx, [0x000154a0]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x28], 0
jmp 0x11eb2
mov dword [rsp + 0x28], 1
mov r8d, 0x63666d
mov edx, 0x26
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov qword [rax], rdx
mov rax, qword [rsp + 0x48]
cmp qword [rax], 0
je 0x11f31
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
xor eax, eax
mov ecx, 0x26
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rcx], rax
mov byte [rsp + 0x20], 1
jmp 0x11f42
mov edx, 0x33e
lea rcx, [0x00015210]
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x1d850
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x40], 0xc0000001
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call fcn.00011070
movzx eax, al
cmp eax, 1
jle 0x1d8bf
call fcn.00011070
movzx edx, al
lea rcx, [0x0001de60]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x80d
lea rdx, [0x0001de90]
lea rcx, [0x0001df00]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
cmp qword [rsp + 0x78], 0
je 0x1d8db
mov rax, qword [rsp + 0x78]
mov byte [rax], 0
lea rcx, [rsp + 0x30]
call fcn.0001da10
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1d8f9
mov eax, dword [rsp + 0x40]
jmp 0x1d9f7
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x1d90c
mov dword [rsp + 0x44], 0
jmp 0x1d914
mov dword [rsp + 0x44], 1
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call sub.FLTMGR.SYS_FltSetStreamHandleContext
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1d9bb
mov rcx, qword [rsp + 0x30]
call sub.FLTMGR.SYS_FltReleaseContext
cmp dword [rsp + 0x40], 0xc01c0002
je 0x1d96f
mov eax, dword [rsp + 0x40]
jmp 0x1d9f7
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x1d99f
xor r9d, r9d
mov r8d, 0x835
lea rdx, [0x0001de90]
lea rcx, [0x0001e3b0]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x48], 0
jmp 0x1d9a7
mov dword [rsp + 0x48], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], 0
jmp 0x1d9e6
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x1d9e6
cmp qword [rsp + 0x38], 0
je 0x1d9e6
mov rcx, qword [rsp + 0x38]
call sub.FLTMGR.SYS_FltReleaseContext
cmp qword [rsp + 0x78], 0
je 0x1d9e6
mov rax, qword [rsp + 0x78]
mov byte [rax], 1
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x30]
mov qword [rcx], rax
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1da10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call fcn.00011070
movzx eax, al
cmp eax, 1
jle 0x1da69
call fcn.00011070
movzx edx, al
lea rcx, [0x0001de60]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x87c
lea rdx, [0x0001de90]
lea rcx, [0x0001df00]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x21
mov dx, 0x10
mov rcx, qword [0x0001b16c]
call sub.FLTMGR.SYS_FltAllocateContext
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x1da9d
mov eax, dword [rsp + 0x38]
jmp 0x1daf7
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x21
rep stosb byte [rdi], al
call fcn.000110a0
mov rdx, rax
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x19], rdx
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x19], 0
jne 0x1dad9
mov rcx, qword [rsp + 0x30]
call sub.FLTMGR.SYS_FltReleaseContext
mov eax, 0xc000009a
jmp 0x1daf7
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x19]
call qword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
mov qword [rdx], rax
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1db10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov dword [rsp + 0x20], 0xc0000001
call fcn.00011070
movzx eax, al
cmp eax, 1
jle 0x1db6b
call fcn.00011070
movzx edx, al
lea rcx, [0x0001de60]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x8a3
lea rdx, [0x0001de90]
lea rcx, [0x0001df00]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x60]
cmp qword [rax + 8], 0
je 0x1db81
mov rcx, qword [rsp + 0x60]
call fcn.0001dc90
mov ecx, 0xfffe
mov rax, qword [rsp + 0x60]
mov word [rax + 2], cx
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax], cx
mov rcx, qword [rsp + 0x60]
call fcn.0001dbf0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x1dbd0
movzx ecx, word [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rdi, qword [rdi + 8]
mov rsi, qword [rsp + 0x50]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x60]
movzx eax, word [rsp + 0x58]
mov word [rdx], ax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1dbf0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
call fcn.00011070
movzx eax, al
cmp eax, 1
jle 0x1dc37
call fcn.00011070
movzx edx, al
lea rcx, [0x0001de60]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x8cf
lea rdx, [0x0001de90]
lea rcx, [0x0001df00]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x30]
movzx edx, word [rax + 2]
mov r8d, 0x74537843
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r11, rax
mov rax, qword [rsp + 0x30]
mov qword [rax + 8], r11
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0
jne 0x1dc70
mov eax, 0xc000009a
jmp 0x1dc7c
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov word [rax], cx
xor eax, eax
add rsp, 0x28
ret
Function at 0x1dc90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
call fcn.00011070
movzx eax, al
cmp eax, 1
jle 0x1dcd7
call fcn.00011070
movzx edx, al
lea rcx, [0x0001de60]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x8f3
lea rdx, [0x0001de90]
lea rcx, [0x0001df00]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov edx, 0x74537843
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor r11d, r11d
mov rax, qword [rsp + 0x30]
mov word [rax + 2], r11w
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x30]
mov qword [rax + 8], 0
add rsp, 0x28
ret
Function at 0x1f010
Capabilities:
Print debug messages
Register minifilter driver

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x98], 0xc0000001
mov qword [rsp + 0x70], 0
mov eax, 0x32
mov word [rsp + 0x88], ax
mov eax, 0x34
mov word [rsp + 0x8a], ax
lea rax, [0x0001f4b0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x00017120], rax
mov dword [0x0001b19c], 0
mov dword [0x0001b1a0], 0
mov dword [0x0001b1a4], 0
mov dword [0x0001b1a8], 0
mov dword [0x0001b1ac], 0
mov dword [0x00017148], 0
mov qword [0x00017140], 0
lea rcx, [0x0001b194]
call fcn.00011080
lea rcx, [0x0001b184]
call fcn.00011010
lea rdx, [0x0001f4f0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dl, 1
lea rcx, [0x0001915c]
call fcn.000146e0
lea r8, [0x0001b16c]
lea rdx, [0x0001f320]
mov rcx, qword [rsp + 0xb0]
call sub.FLTMGR.SYS_FltRegisterFilter
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jge 0x1f13d
mov edx, dword [rsp + 0x98]
lea rcx, [0x0001f520]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x98]
jmp 0x1f291
mov edx, 0x1f0001
lea rcx, [rsp + 0x70]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jge 0x1f17c
mov edx, dword [rsp + 0x98]
lea rcx, [0x0001f570]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x98]
jmp 0x1f291
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0x240
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x38], 1
lea rax, [0x0001d010]
mov qword [rsp + 0x30], rax
lea rax, [0x0001d700]
mov qword [rsp + 0x28], rax
lea rax, [0x0001d650]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [0x0001b174]
mov rcx, qword [0x0001b16c]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x70]
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
cmp dword [rsp + 0x98], 0
jge 0x1f272
mov edx, dword [rsp + 0x98]
lea rcx, [0x0001f5d0]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x0001b174], 0
je 0x1f248
mov rcx, qword [0x0001b174]
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov qword [0x0001b174], 0
cmp qword [0x0001b16c], 0
je 0x1f269
mov rcx, qword [0x0001b16c]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov qword [0x0001b16c], 0
mov eax, dword [rsp + 0x98]
jmp 0x1f291
mov r9d, 0xc8
mov r8d, 6
mov edx, 1
lea rcx, [0x0001f620]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
add rsp, 0xa8
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0001f2a0
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x1f010
Function at 0x1f2fc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x98], 0xc0000001
mov qword [rsp + 0x70], 0
mov eax, 0x32
mov word [rsp + 0x88], ax
mov eax, 0x34
mov word [rsp + 0x8a], ax
lea rax, [0x0001f4b0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x00017120], rax
mov dword [0x0001b19c], 0
mov dword [0x0001b1a0], 0
mov dword [0x0001b1a4], 0
mov dword [0x0001b1a8], 0
mov dword [0x0001b1ac], 0
mov dword [0x00017148], 0
mov qword [0x00017140], 0
lea rcx, [0x0001b194]
call fcn.00011080
lea rcx, [0x0001b184]
call fcn.00011010
lea rdx, [0x0001f4f0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dl, 1
lea rcx, [0x0001915c]
call fcn.000146e0
lea r8, [0x0001b16c]
lea rdx, [0x0001f320]
mov rcx, qword [rsp + 0xb0]
call sub.FLTMGR.SYS_FltRegisterFilter
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jge 0x1f13d
mov edx, dword [rsp + 0x98]
lea rcx, [0x0001f520]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x98]
jmp 0x1f291
mov edx, 0x1f0001
lea rcx, [rsp + 0x70]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jge 0x1f17c
mov edx, dword [rsp + 0x98]
lea rcx, [0x0001f570]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x98]
jmp 0x1f291
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0x240
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x38], 1
lea rax, [0x0001d010]
mov qword [rsp + 0x30], rax
lea rax, [0x0001d700]
mov qword [rsp + 0x28], rax
lea rax, [0x0001d650]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [0x0001b174]
mov rcx, qword [0x0001b16c]
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x70]
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
cmp dword [rsp + 0x98], 0
jge 0x1f272
mov edx, dword [rsp + 0x98]
lea rcx, [0x0001f5d0]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x0001b174], 0
je 0x1f248
mov rcx, qword [0x0001b174]
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov qword [0x0001b174], 0
cmp qword [0x0001b16c], 0
je 0x1f269
mov rcx, qword [0x0001b16c]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov qword [0x0001b16c], 0
mov eax, dword [rsp + 0x98]
jmp 0x1f291
mov r9d, 0xc8
mov r8d, 6
mov edx, 1
lea rcx, [0x0001f620]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
add rsp, 0xa8
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0001f2a0
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x1f010
Function at 0x140006500
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000632c
Function at 0x1779f08
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1779f12
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1779f3b
pop rbp
sub rbp, 0x33
sub rbp, 0x1379f08
sub rsp, 0x20
jmp 0x1779f5a
mov rax, 0x1379f08
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x5c6663d5
xor byte [rax], dl
inc rax
dec rcx
jne 0x1779f79
jmp 0x1779f90
popfq
pop rsp
cmp al, 0x5e
pop rsp
jmp 0xffffffff9f4d756f
Function at 0x682c13b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x48
lea rax, sym.DLL_Shellcode.dll_shellcode
lea rcx, [rax + 0xfff]
movzx edx, byte [rax + 0xd02]
add rax, 1
xor edx, 0x39
mov byte [rax - 1], dl
cmp rax, rcx
jne 0x682c13c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov rsi, rax
mov r8d, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, 0xffffffff
test rax, rax
mov rbx, rax
je 0x682c1442
lea rax, [rsp + 0x38]
mov rdx, rbx
mov r9d, 0x1000
mov qword [rsp + 0x20], rax
lea r8, sym.DLL_Shellcode.dll_shellcode
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0xfffffffe
test eax, eax
je 0x682c1442
call rbx
mov edx, 1
mov eax, edx
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x682c1450
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x682c1463
mov eax, 1
add rsp, 0x38
ret
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea r8, [sym.DLL_Shellcode.dll_ThreadFunction_void_]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x682c1830
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x682c85e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x682c19b8
mov rax, qword [0x682c85e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x682c187c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x682c1905
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x682c1860
mov rcx, rbx
call fcn.682c24d0
test rax, rax
mov r12, rax
je 0x682c19ed
mov rax, qword [0x682c85e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.682c2600
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x682c85e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x682c19d0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x682c18fe
sub eax, 0x40
and eax, 0xffffffbf
jne 0x682c1960
add dword [0x682c85e4], 1
cmp edi, 8
jae 0x682c1933
test dil, 4
jne 0x682c19a4
test edi, edi
je 0x682c1928
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x682c19bf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x682c1928
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x682c194c
jmp 0x682c1928
add rsi, qword [0x682c85e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x682c18fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.682c2ac0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x682c1928
xor esi, esi
jmp 0x682c1887
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x682c1928
mov rax, qword [0x682c85e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.682c2ac0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.682c2ac0
nop
nop dword [rax]

Function at 0x682c2140
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x682c88c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x682c88a0]
test rbx, rbx
je 0x682c2194
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x682c218b
test rsi, rsi
je 0x682c218b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x682c2170
lea rcx, [0x682c88c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]