joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400239f4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor edi, edi
mov dword [rbp - 0x20], 0x52534d42
mov rbx, rcx
mov qword [rbp - 0x18], rdi
lea r9, [rbp + 0x28]
lea rdx, [rbp - 0x20]
lea r8d, [rdi + 0x14]
lea r15d, [rdi + 1]
mov dword [rbp + 0x28], r8d
lea ecx, [rdi + 0x4c]
mov dword [rbp - 0x1c], r15d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000023
jne 0x140023ba9
mov r14d, dword [rbp - 0x14]
mov r8d, 0x7668704b
mov ecx, r15d
lea eax, [r14 + 0x14]
mov edx, eax
mov dword [rbp + 0x28], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x140023ba9
movups xmm0, xmmword [rbp - 0x20]
lea r9, [rbp + 0x28]
lea ecx, [rdi + 0x4c]
movups xmmword [rax], xmm0
mov edx, dword [rbp - 0x10]
mov dword [rax + 0x10], edx
mov rdx, rax
mov dword [rax + 0xc], r14d
mov r8d, dword [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x140023b96
mov eax, dword [rsi + 0x14]
lea rcx, [rsi + 0x18]
add rcx, rax
lea r8, [rsi + 0x18]
cmp r8, rcx
jae 0x140023b96
movzx eax, byte [r8 + 1]
cmp al, 4
jb 0x140023b96
cmp byte [r8], r15b
jne 0x140023acd
cmp al, 0x19
jae 0x140023aeb
add rax, r8
jmp 0x140023ae0
cmp byte [rax], dil
jne 0x140023add
cmp byte [rax + 1], dil
je 0x140023ae5
add rax, r15
cmp rax, rcx
jb 0x140023ad2
lea r8, [rax + 2]
jmp 0x140023aae
mov r9d, 8
mov r10b, r15b
add r8, r9
mov r11b, r15b
mov r14, rdi
test r10b, r10b
jne 0x140023b07
test r11b, r11b
je 0x140023b3a
mov dl, byte [r14 + r8]
mov ecx, edi
add r14, r15
movzx eax, r10b
test dl, dl
cmove ecx, eax
cmp dl, 0xff
mov r10b, cl
movzx eax, r11b
mov ecx, edi
cmove ecx, eax
mov r11b, cl
cmp r14, 0x10
jl 0x140023afd
test r10b, r10b
jne 0x140023b96
test cl, cl
jne 0x140023b96
mov al, byte [r8 + 3]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 2]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 1]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 5]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 4]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 7]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 6]
mov byte [rbx], al
add rbx, r15
mov al, byte [r9 + r8]
add r9, r15
mov byte [rbx], al
add rbx, r15
cmp r9, 0x10
jl 0x140023b81
mov dil, r15b
mov edx, 0x7668704b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, dil
jmp 0x140023bab
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140023da0
Capabilities:
Get file attributes
Hash data via bcrypt
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
and qword [rbp + 0x7f], 0
mov rdi, rcx
lea rcx, [rbp - 0x29]
mov r15, r8
mov r12, rdx
call fcn.1400251c8
mov ebx, eax
test eax, eax
js 0x140023f46
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x39]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
and qword [rbp + 0xf], 0
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov qword [rbp + 0x17], rdi
mov edx, 0x120089
mov edi, 1
mov dword [rbp + 7], 0x30
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x200
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140023f46
mov rcx, qword [rbp + 0x7f]
lea r9d, [rdi + 0x17]
lea r8, [rbp - 0x11]
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140023f46
mov rax, qword [rbp - 9]
test rax, rax
jg 0x140023e88
mov ebx, 0xc0000001
jmp 0x140023f46
cmp rax, 0x8000000
jle 0x140023e9a
mov ebx, 0xc0000904
jmp 0x140023f46
mov edx, 0x2000
mov r8d, 0x7668704b
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x140023ebf
mov ebx, 0xc000009a
jmp 0x140023f46
mov edi, dword [rbp - 9]
test edi, edi
je 0x140023f27
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 0x39]
mov esi, 0x2000
cmp edi, esi
cmovb esi, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140023f38
cmp dword [rbp - 0x31], esi
jne 0x140023f7c
mov rcx, qword [rbp - 0x21]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call sub.ksecdd.sys_BCryptHashData
mov ebx, eax
test eax, eax
js 0x140023f38
sub edi, esi
jne 0x140023ec6
mov r8, r15
lea rcx, [rbp - 0x29]
mov rdx, r12
call fcn.1400250c8
mov ebx, eax
mov edx, 0x7668704b
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140023f55
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rbp - 0x29]
call fcn.14002517c
lea r11, [rsp + 0xd0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ebx, 0xc00000e5
jmp 0x140023f38
Function at 0x140024010
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and dword [rax - 0x78], 0
lea r9, [rbp - 9]
and qword [rax - 0x80], 0
mov rdi, r8
and qword [rbp + 0x67], 0
lea r8, [rbp + 0x1f]
and qword [rbp + 0x27], 0
mov rsi, rdx
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
mov edx, 0x120089
mov dword [rsp + 0x30], 1
mov qword [rbp + 0x2f], rcx
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x30
mov dword [rbp + 0x37], 0x200
movdqu xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140024146
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 7]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140024146
mov rax, qword [rbp + 0xf]
test rax, rax
jg 0x1400240db
mov ebx, 0xc0000001
jmp 0x140024146
cmp rax, 0x20000
jle 0x1400240ea
mov ebx, 0xc0000904
jmp 0x140024146
mov dword [rdi], eax
mov ecx, 1
mov r8d, dword [str.sboxS]
mov edx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
jne 0x140024112
mov ebx, 0xc000009a
jmp 0x140024146
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov eax, dword [rdi]
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x67]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140024155
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140024d7c
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
and qword [rax - 0x30], 0
mov r14, rcx
lea rcx, [rax - 0x28]
mov esi, r9d
mov rbp, r8
mov edi, edx
call fcn.1400251c8
mov ebx, eax
test eax, eax
js 0x140024e0d
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, edi
mov rdx, r14
call sub.ksecdd.sys_BCryptHashData
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400250c8
mov rdi, qword [rsp + 0x28]
mov ebx, eax
test eax, eax
js 0x140024dfa
mov edx, dword [rsp + 0x20]
mov r9d, esi
mov r8, rbp
mov rcx, rdi
call fcn.140024fe8
mov ebx, eax
test rdi, rdi
je 0x140024e0d
mov edx, 0x7668704b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140025818
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp qword [0x140033a48], 0
je 0x140025836
mov al, 1
jmp 0x1400259ef
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x48]
call fcn.140028ec0
xor r8d, r8d
mov dword [rsp + 0x50], 1
lea rax, [0x140033a48]
xor ecx, ecx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor dil, dil
xor bl, bl
lea edx, [r8 + 0xa]
call sub.fwpkclnt.sys_FwpmEngineOpen0
mov edx, 0x10
test eax, eax
js 0x140025983
mov rcx, qword [0x140033a48]
xor edx, edx
call sub.fwpkclnt.sys_FwpmTransactionBegin0
mov edx, 0x20
test eax, eax
js 0x140025983
mov dil, 1
call fcn.140025d10
mov edx, 0x30
test eax, eax
js 0x140025983
lea r9, [0x140033a60]
lea r8, [0x140033a50]
lea rdx, [0x14002e1b8]
lea rcx, [0x14002f278]
call fcn.140025ba8
mov edx, 0x41
test eax, eax
js 0x140025983
lea r9, [0x140033a68]
mov bl, dil
lea r8, [0x140033a54]
lea rdx, [0x14002e1d8]
lea rcx, [0x14002f288]
call fcn.140025ba8
mov edx, 0x42
test eax, eax
js 0x140025983
lea r9, [0x140033a70]
lea r8, [0x140033a58]
lea rdx, [0x14002e178]
lea rcx, [0x14002f298]
call fcn.140025ba8
mov edx, 0x43
test eax, eax
js 0x140025983
lea r9, [0x140033a78]
lea r8, [0x140033a5c]
lea rdx, [0x14002e198]
lea rcx, [0x14002f2a8]
call fcn.140025ba8
mov edx, 0x44
test eax, eax
js 0x140025983
mov rcx, qword [0x140033a48]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov edx, 0x50
test eax, eax
js 0x140025983
lea rcx, [0x14002c540]
call sub.ntoskrnl.exe_DbgPrint
mov al, bl
jmp 0x1400259ef
mov r8d, eax
lea rcx, [0x14002c500]
call sub.ntoskrnl.exe_DbgPrint
cmp dil, 1
jne 0x1400259a4
mov rcx, qword [0x140033a48]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
test bl, bl
je 0x1400259d4
mov ecx, dword [0x140033a50]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a54]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a58]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a5c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140033a48]
test rcx, rcx
je 0x1400259ed
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140033a48], 0
xor al, al
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140025a00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp byte [0x140033a30], 0
jne 0x140025ad6
mov edx, 0x80
mov byte [0x140033a30], 1
lea rcx, [0x140033a80]
call fcn.1400108c0
lea rcx, [0x14002c480]
call sub.ntoskrnl.exe_DbgPrint
mov dl, 1
lea rcx, [0x140033a38]
call fcn.1400152dc
test al, al
jne 0x140025a4e
xor al, al
jmp 0x140025ad8
mov rcx, qword [0x1400335c8]
lea r9, [0x140033a40]
xor r8d, r8d
lea rdx, [0x1400261f0]
call sub.fwpkclnt.sys_FwpmBfeStateSubscribeChanges0
test eax, eax
jns 0x140025a91
lea rcx, [0x14002c4a0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x140033a38]
call fcn.140015290
and qword [0x140033a38], 0
jmp 0x140025a47
call sub.fwpkclnt.sys_FwpmBfeStateGet0
cmp eax, 3
jne 0x140025aca
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
mov rcx, qword [0x140033a38]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceSharedLite]
call fcn.140025818
mov rcx, qword [0x140033a38]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x140025ad6
lea rcx, [0x14002c4e0]
call sub.ntoskrnl.exe_DbgPrint
mov al, 1
add rsp, 0x28
ret

Function at 0x140025ba8
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
cmp qword [0x140033a48], 0
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
jne 0x140025be1
mov eax, 0xc0000008
jmp 0x140025cf5
movups xmm0, xmmword [rcx]
mov rcx, qword [0x1400335c8]
lea rax, [0x140026050]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [0x1400261e0]
mov qword [rsp + 0x40], rax
lea rax, [0x1400261d0]
mov qword [rsp + 0x48], rax
movdqu xmmword [rsp + 0x20], xmm0
call sub.fwpkclnt.sys_FwpsCalloutRegister1
test eax, eax
js 0x140025cf5
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call fcn.140028ec0
movups xmm0, xmmword [rbx]
mov rcx, qword [0x140033a48]
lea rax, [0x14002c630]
movups xmm1, xmmword [rdi]
and dword [rsp + 0x70], 0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x14002c650]
xor r8d, r8d
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x140025cf5
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xc8
call fcn.140028ec0
movups xmm0, xmmword [0x14002f268]
and dword [rbp + 0x20], 0
lea rax, [0x14002c6d0]
movups xmm1, xmmword [rbx]
mov rcx, qword [0x140033a48]
lea rdx, [rbp - 0x50]
movdqu xmmword [rbp], xmm0
mov qword [rbp - 0x40], rax
lea rax, [0x14002c6f0]
movups xmm0, xmmword [rdi]
mov r9, rsi
mov qword [rbp - 0x38], rax
xor r8d, r8d
mov dword [rbp + 0x30], 0x5003
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x10], 1
mov byte [rbp + 0x18], 0xf
movdqu xmmword [rbp + 0x34], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140025d74
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [0x140033a48], 0
je 0x140025dd3
mov ecx, dword [0x140033a50]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a54]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a58]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a5c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140033a48]
test rcx, rcx
je 0x140025dc7
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140033a48], 0
lea rcx, [0x14002c570]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret

Function at 0x140037000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ecx, 0x10000
call fcn.14001b94c
mov dl, 1
mov qword [0x1400335f8], rax
lea rcx, [0x1400335e8]
call fcn.1400152dc
xor ebx, ebx
test al, al
je 0x140037072
mov r8d, dword [str.sboxS]
mov edx, 0xe0
mov ecx, dword [0x140033600]
mov byte [0x1400335f0], 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edx, edx
mov qword [0x1400335d8], rax
mov rdi, rax
test rax, rax
jne 0x14003707f
xor r9d, r9d
mov r8d, 0xc000009a
mov ecx, 0xc101045f
call fcn.14001516c
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8d, 0xe0
mov rcx, rdi
call fcn.140028ec0
mov dword [rdi], 0xe0
lea rax, [0x140001ca0]
mov qword [rdi + 0x50], rax
lea rcx, [0x140002450]
mov rax, qword [0x140033ba8]
lea rdx, [0x14003a0c0]
mov qword [rax + 0x50], rdi
mov rax, qword [0x140033ba8]
mov qword [rax + 0x70], rcx
lea rcx, [0x1400023f0]
mov rax, qword [0x140033ba8]
mov qword [rax + 0x100], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140033ba8]
lea rax, [0x1400335c8]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], bl
mov r9d, 0x22
xor edx, edx
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x14003712c
xor r9d, r9d
mov qword [0x1400335c8], rbx
xor edx, edx
mov r8d, eax
jmp 0x140037068
mov rax, qword [0x1400335c8]
lea rdx, [0x140002360]
mov ecx, 0x12340001
btr dword [rax + 0x30], 7
call fcn.140037204
lea rdx, [0x1400024d0]
mov ecx, 0x12340003
call fcn.140037204
lea rdx, [0x140001f60]
mov ecx, 0x12340040
call fcn.140037204
lea rdx, [0x140001eb0]
mov ecx, 0x12340026
call fcn.140037204
lea rdx, [0x140002c00]
mov ecx, 0x12340033
call fcn.140037204
lea rdx, [0x140007020]
mov ecx, 0x12340017
call fcn.140037204
lea rdx, [0x1400026f0]
mov ecx, 0x12340041
call fcn.140037204
lea rdx, [0x140002810]
mov ecx, 0x12340044
call fcn.140037204
lea rdx, [0x140002ac0]
mov ecx, 0x12340046
call fcn.140037204
lea rdx, [fcn.1400021b0]
mov ecx, 0x12340047
call fcn.140037204
mov rcx, qword [0x1400335d0]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140037072
xchg dword [0x140033028], ebx
mov al, 1
jmp 0x140037074
Function at 0x140037658
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov r8, qword [rcx + 0x78]
xor r10d, r10d
mov rbx, rcx
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add r9, rax
test r11d, r11d
je 0x14003769d
mov r8d, dword [r9 + 0xc]
cmp edx, r8d
jb 0x140037691
mov ecx, dword [r9 + 0x10]
add ecx, r8d
cmp edx, ecx
jb 0x1400376a5
add r9, 0x28
inc r10d
cmp r10d, r11d
jb 0x14003767d
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov eax, dword [r9 + 0x14]
add rax, qword [rbx + 0x70]
sub rax, r8
mov ecx, edx
add rax, rcx
jmp 0x14003769f

Function at 0x1400376c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rbx, rcx
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
js 0x14003770e
cmp dword [rsp + 0x24], 6
ja 0x1400376fa
jne 0x14003770e
cmp dword [rsp + 0x28], 2
jb 0x14003770e
mov dword [0x140033600], 0x200
mov dword [0x140033604], 0x40000000
mov qword [0x140033ba8], rbx
lea rcx, [0x140033b90]
and qword [rbx + 0x68], 0
mov rdx, qword [str.86900]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call fcn.1400378f4
mov bl, al
test al, al
je 0x140037894
call fcn.14000ebf4
mov qword [0x140033700], rax
test rax, rax
jne 0x140037767
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010450
call fcn.140014f9c
call fcn.140006fac
jmp 0x14003789d
call fcn.140007160
mov bl, al
test al, al
je 0x140037894
mov rdx, qword [rdi + 8]
mov r8b, 1
mov rcx, qword [0x140033700]
call fcn.14001522c
mov qword [0x140033ba0], rax
test rax, rax
je 0x14003775d
call fcn.140007454
mov rcx, rdi
call fcn.140037a44
mov bl, al
test al, al
je 0x140037894
call fcn.140023420
call fcn.140038874
mov bl, al
test al, al
je 0x140037894
call fcn.14003728c
mov bl, al
test al, al
je 0x140037894
call fcn.140037620
mov bl, al
test al, al
je 0x140037894
call fcn.14003908c
mov bl, al
test al, al
je 0x140037894
call fcn.14001caa4
mov bl, al
test al, al
je 0x140037894
mov edx, 0xd
lea rcx, [0x14003a170]
call fcn.14000710c
cmp dword [0x1400336f0], 6
mov qword [0x1400336e0], rax
jb 0x140037835
mov edx, 0x11
lea rcx, [0x14003a180]
call fcn.14000710c
mov qword [0x1400336e8], rax
call fcn.140039e3c
mov bl, al
test al, al
je 0x140037894
call fcn.1400389fc
mov bl, al
test al, al
je 0x140037894
call fcn.140039c20
mov bl, al
test al, al
je 0x140037894
call fcn.140037d78
mov bl, al
test al, al
je 0x140037894
call fcn.140038624
mov bl, al
test al, al
je 0x140037894
call fcn.140038178
mov bl, al
test al, al
je 0x140037894
call fcn.140037f1c
mov bl, al
test al, al
je 0x140037894
call fcn.140037000
mov bl, al
test al, al
je 0x140037894
call fcn.140039fbc
mov bl, al
call fcn.140006fac
test bl, bl
jne 0x1400378c4
mov rdx, qword [0x140033178]
xor r8d, r8d
mov ecx, 0xc101044f
call fcn.140014f9c
mov rcx, qword [0x140033ba8]
call fcn.1400073c0
mov eax, 0xc0000001
jmp 0x1400378e1
mov rdx, qword [0x140033178]
xor r8d, r8d
mov ecx, 0x4101044d
mov byte [0x140033190], 0
call fcn.140014f9c
xor eax, eax
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x1400378f4
Capabilities:
Check os version

Disassembly:
sub rsp, 0xb8
call fcn.1400233e8
xor r9d, r9d
mov byte [0x1400336f8], al
lea r8, [0x1400336f4]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r9d, dword [rsp + 0xc8]
mov eax, 6
mov ecx, dword [rsp + 0xc0]
cmp r9d, eax
ja 0x14003794e
jne 0x140037a04
cmp ecx, 1
jb 0x140037a04
cmp r9d, 0xa
jne 0x140037963
mov dword [0x1400336f0], 8
jmp 0x140037a00
cmp r9d, eax
jne 0x1400379d7
cmp ecx, 3
jne 0x140037985
cmp dword [0x1400336f4], 0x2580
jb 0x1400379f7
mov dword [0x1400336f0], 7
jmp 0x140037a00
cmp ecx, 2
jne 0x14003799e
cmp dword [0x1400336f4], 0x23f0
jb 0x1400379f7
mov dword [0x1400336f0], eax
jmp 0x140037a00
cmp ecx, 1
jne 0x1400379bb
cmp dword [0x1400336f4], 0x1db0
jb 0x1400379f7
mov dword [0x1400336f0], 5
jmp 0x140037a00
test ecx, ecx
jne 0x1400379f7
cmp dword [0x1400336f4], 0x1770
jb 0x1400379f7
mov dword [0x1400336f0], 4
jmp 0x1400379f7
cmp ecx, 2
jne 0x1400379e8
mov dword [0x1400336f0], 3
jmp 0x140037a00
cmp ecx, 1
jne 0x1400379f7
mov dword [0x1400336f0], 2
cmp dword [0x1400336f0], 0
je 0x140037a04
mov al, 1
jmp 0x140037a3c
mov eax, dword [0x1400336f4]
lea r8, [0x14003a110]
mov dword [rsp + 0x28], eax
mov edx, 0x80
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x30]
call fcn.140003a30
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov ecx, 0xc1010451
call fcn.140014f9c
xor al, al
add rsp, 0xb8
ret
Function at 0x140037e18
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
sub rsp, 0x28
xorps xmm0, xmm0
lea rcx, [0x140033788]
xor eax, eax
mov dl, 1
movups xmmword [0x140033770], xmm0
mov qword [0x140033780], rax
call fcn.1400152dc
test al, al
je 0x140037e78
mov rcx, qword [0x140033ba8]
lea r8, [0x140033768]
lea rdx, section.INITDATA
call sub.FLTMGR.SYS_FltRegisterFilter
test eax, eax
jns 0x140037e7f
mov edx, 0x81
mov r9, qword [0x140033208]
mov r8d, eax
mov ecx, 0xc1010456
call fcn.14001516c
xor al, al
add rsp, 0x28
ret
mov rcx, qword [0x140033768]
call sub.FLTMGR.SYS_FltStartFiltering
test eax, eax
jns 0x140037e96
mov edx, 0x82
jmp 0x140037e64
lea rdx, [0x140009a70]
lea rcx, [0x14003a1b0]
call fcn.140039bf4
test al, al
je 0x140037e78
lea rdx, [0x140009a70]
lea rcx, [0x14003a1c0]
call fcn.140039bf4
test al, al
je 0x140037e78
lea rdx, [0x140009a70]
lea rcx, [0x14003a1e0]
call fcn.140039bf4
test al, al
je 0x140037e78
lea rdx, [0x140009a70]
lea rcx, [0x14003a200]
call fcn.140039bf4
test al, al
je 0x140037e78
lea rdx, [0x140009190]
mov ecx, 0x12340049
call fcn.140037204
lea rdx, [0x140009940]
mov ecx, 0x1234004a
call fcn.140037204
mov al, 1
jmp 0x140037e7a
Function at 0x140039d98
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rcx, [0x14003aa70]
call fcn.14001e3c8
mov rbx, rax
test rax, rax
je 0x140039e32
mov rcx, qword gs:[0x188]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsReferenceImpersonationToken]
mov rdi, rax
mov rcx, 0xfffffffffffffffe
mov rax, qword [rbx + 0x18]
call qword [0x14002d688]
test eax, eax
js 0x140039e0e
mov rcx, qword gs:[0x188]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsReferenceImpersonationToken]
mov qword [0x140033990], rax
mov rcx, qword gs:[0x188]
mov rdx, rdi
mov eax, dword [rsp + 0x30]
mov r9b, byte [rsp + 0x60]
mov r8b, byte [rsp + 0x68]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_PsImpersonateClient]
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x140039fbc
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, [0x140033a80]
call fcn.14001076c
and qword [0x140033ac0], 0
lea rax, [0x140025640]
mov qword [0x140033a98], rax
lea rdx, [0x14003aba0]
lea rax, [0x1400256e0]
mov byte [0x140033a31], 1
xor r9d, r9d
mov qword [0x140033aa0], rax
xor r8d, r8d
xor ecx, ecx
call fcn.140004160
test al, al
jne 0x14003a018
mov al, 1
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.140025a00