Function at 0x140004c20
Capabilities:
Resolve function by parsing pe exports
Send tcp data via wfp api

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x14000b890]
mov edx, dword [rcx + 0xc]
add rdx, 0x10
cmp rbx, rdx
jae 0x140004c43
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov edx, dword [rcx]
cmp edx, 0x13
jg 0x140004cd7
je 0x140004ccd
cmp edx, 0xf
jg 0x140004c9e
cmp edx, 0xe
jge 0x140004c94
cmp edx, 2
jl 0x140004c3b
cmp edx, 3
jle 0x140004c8a
cmp edx, 5
jle 0x140004c3b
cmp edx, 7
jle 0x140004c80
lea eax, [rdx - 0xa]
cmp eax, 1
ja 0x140004c3b
add rsp, 0x20
pop rbx
jmp 0x1400055d0
add rsp, 0x20
pop rbx
jmp 0x1400063a0
add rsp, 0x20
pop rbx
jmp 0x14000503c
add rsp, 0x20
pop rbx
jmp 0x140006558
sub edx, 0x10
je 0x140004cba
dec edx
je 0x140004cb2
dec edx
jne 0x140004c3b
call fcn.14000728c
jmp 0x140004cc5
add rcx, 0x10
xor edx, edx
jmp 0x140004cc0
add rcx, 0x10
mov dl, 1
call fcn.140006d08
mov eax, ebx
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp 0x140004f00
sub edx, 0x15
je 0x140004d3c
dec edx
je 0x140004d32
dec edx
je 0x140004d28
dec edx
je 0x140004d10
dec edx
je 0x140004d02
dec edx
jne 0x140004c3b
mov rcx, qword [rcx + 4]
add rsp, 0x20
pop rbx
jmp 0x1400061fc
mov rcx, qword [rcx + 4]
add rsp, 0x20
pop rbx
jmp 0x14000606c
mov ecx, dword [rcx + 4]
call fcn.140007a34
neg al
sbb rcx, rcx
and ecx, 0x10
mov eax, ecx
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp 0x1400064dc
add rsp, 0x20
pop rbx
jmp 0x140006868
add rsp, 0x20
pop rbx
jmp 0x14000668c
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 4]
call fcn.140007790
mov rbx, rax
test rax, rax
je 0x14000501e
cmp byte [rax + 0x130], 0
mov ebp, 0x10
je 0x140005014
mov eax, dword [rdi + 0x10]
cmp word [rbx + 0x3c], 2
lea rcx, [rbx + 0x5a]
mov dword [rbx + 0x34], eax
lea eax, [rbp + 0xc]
lea rdx, [rdi + 0x37]
cmove eax, ebp
movsxd r8, eax
call fcn.140008ca0
test eax, eax
je 0x140004ff6
mov rdx, qword [rbx + 0x100]
mov rcx, qword [rbx + 0xf8]
lea rax, [rbx + 0x108]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call sub.fwpkclnt.sys_FwpsAcquireWritableLayerDataPointer0
test eax, eax
jne 0x140004ff6
mov rcx, qword [rsp + 0x40]
mov rax, qword [rdi + 0x37]
xor r8d, r8d
mov qword [rcx + 0x80], rax
mov rax, qword [rdi + 0x3f]
mov qword [rcx + 0x88], rax
mov rax, qword [rdi + 0x47]
mov qword [rcx + 0x90], rax
mov eax, dword [rdi + 0x4f]
mov dword [rcx + 0x98], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rdi + 0x14]
mov dword [rax + 0x108], ecx
mov rcx, qword [rbx + 0x138]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x120], rcx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rbx + 0xf8]
call sub.fwpkclnt.sys_FwpsApplyModifiedLayerData0
mov cl, byte [rbx + 0x34]
and cl, 1
neg cl
sbb ecx, ecx
add ecx, 0x1002
mov dword [rbx + 0x108], ecx
mov rcx, rbx
call fcn.140007ad8
mov rcx, rbx
call fcn.140007d04
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
mov rcx, qword [rcx + 4]
mov r12d, esi
mov r14d, esi
mov qword [rax + 0x10], rsi
mov r13d, esi
mov dword [rsp + 0xa0], esi
call fcn.140007790
mov rbx, rax
test rax, rax
je 0x1400055a9
lea rbp, [rax + 0x148]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rbx + 0x30], sil
je 0x1400050b0
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.140007d04
xor eax, eax
jmp 0x1400055b0
cmp dword [rdi + 0xc], esi
jbe 0x1400050d3
mov ecx, dword [rdi]
cmp ecx, 3
jne 0x1400050c5
cmp byte [rbx + 0xee], sil
jne 0x140005096
cmp ecx, 2
jne 0x1400050d3
cmp byte [rbx + 0xef], sil
jne 0x140005096
cmp byte [rbx + 0xeb], sil
jne 0x140005596
mov ecx, dword [rdi]
cmp ecx, 3
jne 0x1400050f4
cmp byte [rbx + 0xec], sil
jne 0x140005596
cmp ecx, 2
jne 0x140005106
cmp byte [rbx + 0xed], sil
jne 0x140005596
mov r15b, byte [rbx + 0xf0]
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [rdi + 0xc], esi
jne 0x1400051f9
inc dword [0x14000b9d4]
lea rcx, [0x14000b9c0]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov rsi, rax
test rax, rax
jne 0x140005167
mov edx, dword [0x14000b9ec]
mov r8d, dword [0x14000b9e8]
mov ecx, dword [0x14000b9e4]
inc dword [0x14000b9d8]
call qword [0x14000b9f0]
mov rsi, rax
test rax, rax
je 0x1400055a1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rdi], 3
jne 0x14000517e
mov byte [rbx + 0xec], 1
jmp 0x140005185
mov byte [rbx + 0xed], 1
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rax, qword [rbx + 0x10]
lea rcx, [0x14000b778]
mov qword [rsi + 0x10], rax
mov eax, dword [rdi]
mov dword [rsi + 0x18], eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [0x14000b8a8]
mov bpl, al
lea rax, [0x14000b8a0]
mov qword [rsi + 8], rdx
mov qword [rsi], rax
cmp qword [rdx], rax
je 0x1400051ce
mov ecx, 3
int 0x29
mov qword [rdx], rsi
lea rcx, [0x14000ba40]
xor r8d, r8d
xor edx, edx
mov qword [0x14000b8a8], rsi
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueDpc]
mov dl, bpl
lea rcx, [0x14000b778]
jmp 0x14000559b
inc dword [0x14000b8d4]
lea rcx, [0x14000b8c0]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov rsi, rax
test rax, rax
jne 0x14000523f
mov edx, dword [0x14000b8ec]
mov r8d, dword [0x14000b8e8]
mov ecx, dword [0x14000b8e4]
inc dword [0x14000b8d8]
call qword [0x14000b8f0]
mov rsi, rax
test rax, rax
je 0x140005517
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1400052d7
mov edx, eax
xor ecx, ecx
mov r8d, 0x43544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rax, rax
je 0x140005517
mov r8d, dword [rdi + 0xc]
lea rdx, [rdi + 0x10]
mov rcx, rax
call fcn.140008e40
mov edx, dword [rdi + 0xc]
and qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov r14, rax
test rax, rax
je 0x140005517
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov ecx, dword [rdi + 0xc]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, qword [0x14000b328]
xor edx, edx
xor r8d, r8d
mov r9, r14
and dword [rsp + 0x20], edx
call sub.fwpkclnt.sys_FwpsAllocateNetBufferAndNetBufferList0
test eax, eax
js 0x140005517
mov ecx, dword [rdi]
neg r15b
mov r13d, 0x10000
sbb eax, eax
mov r15d, 0x11
and eax, 0x40000
or eax, r13d
cmp ecx, 3
cmove r15d, eax
cmp dword [rdi + 0xc], 0
jne 0x140005312
cmp ecx, 3
mov eax, 4
mov edx, 0x80000
cmove eax, edx
or r15d, eax
mov rax, qword [rdi + 4]
mov rcx, rbx
mov qword [rsi], rax
mov eax, dword [rdi]
mov qword [rsi + 0x10], r14
mov dword [rsi + 8], eax
mov qword [rsi + 0x18], rbx
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0x20], eax
call fcn.140007344
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rdi + 0xc], 0
mov dl, al
jne 0x14000535a
cmp dword [rdi], 3
jne 0x140005353
mov byte [rbx + 0xec], 1
jmp 0x14000535a
mov byte [rbx + 0xed], 1
cmp dword [rdi], 3
mov eax, dword [rdi + 0xc]
jne 0x140005381
add dword [rbx + 0xe0], eax
cmp dword [rbx + 0xe0], r13d
jbe 0x140005378
mov byte [rbx + 0xee], 1
mov r13d, dword [rbx + 0x8c]
jmp 0x1400053a1
add dword [rbx + 0xe4], eax
cmp dword [rbx + 0xe4], 0x100000
jbe 0x14000539a
mov byte [rbx + 0xef], 1
mov r13d, dword [rbx + 0x90]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov eax, dword [rdi + 0xc]
mov r9, qword [rbx + 0x80]
mov qword [rsp + 0x50], rsi
lea rcx, [0x140006744]
xor r8d, r8d
mov qword [rsp + 0x48], rcx
mov rcx, qword [0x14000b308]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
xor edx, edx
mov qword [rsp + 0x38], rax
movzx eax, word [rbx + 0x88]
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], r13d
call sub.fwpkclnt.sys_FwpsStreamInjectAsync0
mov r15d, eax
test eax, eax
js 0x14000543c
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
cmp dword [rdi], 3
lea edx, [r9 + 5]
je 0x14000541c
lea edx, [r9 + 4]
call fcn.140005bec
mov r13d, dword [rdi + 0xc]
add r13d, 0x10
cmp qword [rsp + 0xa8], 0
jne 0x1400054b3
mov r15d, 0xc0000001
jmp 0x1400054b3
cmp eax, 0xc0000225
je 0x1400054ab
mov r8d, dword [rbx + 0x8c]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r8d, dword [rbx + 0x90]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r8d, dword [rbx + 0xa0]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r8d, dword [rbx + 0x98]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r13d, dword [rsp + 0xa0]
test r15d, r15d
jns 0x140005589
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rdi], 3
mov dl, al
jne 0x1400054ea
mov ecx, dword [rdi + 0xc]
sub dword [rbx + 0xe0], ecx
cmp dword [rbx + 0xe0], 0x10000
ja 0x140005506
mov byte [rbx + 0xee], 0
jmp 0x140005506
mov eax, dword [rdi + 0xc]
sub dword [rbx + 0xe4], eax
cmp dword [rbx + 0xe4], 0x100000
ja 0x140005506
mov byte [rbx + 0xef], 0
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.140007d04
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140005529
call sub.fwpkclnt.sys_FwpsFreeNetBufferList0
test r14, r14
je 0x140005537
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test r12, r12
je 0x140005547
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rsi, rsi
je 0x140005589
inc dword [0x14000b8dc]
lea rcx, [0x14000b8c0]
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x14000b8d0]
jb 0x140005579
inc dword [0x14000b8e0]
mov rcx, rsi
call qword [0x14000b8f8]
jmp 0x140005589
lea rcx, [0x14000b8c0]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
mov rcx, rbx
call fcn.140007d04
mov eax, r13d
jmp 0x1400055b0
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.140007d04
mov eax, dword [rdi + 0xc]
add rax, 0x10
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov eax, dword [rcx + 0xc]
xor ebx, ebx
mov r14, rcx
mov qword [rbp + 7], rbx
mov r13d, ebx
mov qword [rbp + 0x7f], rbx
mov r15d, ebx
mov dword [rbp + 0x77], ebx
cmp eax, 0x25
jae 0x140005610
add rax, 0x10
jmp 0x140005bd1
mov rcx, qword [rcx + 4]
call fcn.1400083b4
mov rdi, rax
test rax, rax
jne 0x140005627
mov eax, dword [r14 + 0xc]
jmp 0x140005607
lea r12, [rax + 0xa8]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rdi + 0x20], bl
je 0x140005651
mov dl, al
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400086a8
jmp 0x140005621
mov ecx, dword [r14]
cmp ecx, 0xb
jne 0x140005661
cmp byte [rdi + 0x90], bl
jne 0x14000566e
cmp ecx, 0xa
jne 0x14000567e
cmp byte [rdi + 0x91], bl
je 0x14000567e
mov dl, al
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x140005bc7
mov dl, al
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
call fcn.1400081bc
mov rsi, rax
test rax, rax
je 0x140005b3b
mov rax, qword [r14 + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [r14 + 0x18]
mov qword [rsi + 0x18], rax
mov rax, qword [r14 + 0x20]
mov qword [rsi + 0x20], rax
mov eax, dword [r14 + 0x28]
mov dword [rsi + 0x28], eax
mov eax, dword [r14 + 0x30]
add eax, 0x24
cmp dword [r14 + 0xc], eax
jb 0x140005b3b
mov rax, qword [r14 + 0x34]
mov r13d, 0x44
mov qword [rsi + 0x2c], rax
mov rax, qword [r14 + 0x3c]
mov dword [rbp + 0x6f], r13d
mov qword [rsi + 0x34], rax
mov rax, qword [r14 + 0x44]
mov qword [rsi + 0x3c], rax
mov rax, qword [r14 + 0x4c]
mov qword [rsi + 0x44], rax
mov eax, eax
test eax, eax
je 0x140005746
mov edx, eax
movsxd rax, dword [r14 + 0x30]
sub rax, 0x20
cmp rdx, rax
ja 0x140005ba2
xor ecx, ecx
mov r8d, 0x44554c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi + 0x50], rax
test rax, rax
je 0x140005ba2
mov r8d, dword [rsi + 0x44]
lea rdx, [r14 + 0x54]
mov rcx, rax
call fcn.140008e40
mov eax, dword [rsi + 0x44]
add eax, r13d
mov r13d, eax
mov dword [rbp + 0x6f], eax
jmp 0x14000574a
mov qword [rsi + 0x50], rbx
movzx r13d, word [r14 + 0xc]
sub r13w, word [rbp + 0x6f]
mov word [rbp + 0x67], r13w
je 0x140005ba2
movzx eax, r13w
lea rcx, [0x14000b940]
mov dword [rsi + 0x5c], eax
inc dword [0x14000b954]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov r15, rax
test rax, rax
jne 0x1400057a3
mov edx, dword [0x14000b96c]
mov r8d, dword [0x14000b968]
mov ecx, dword [0x14000b964]
inc dword [0x14000b958]
call qword [0x14000b970]
mov r15, rax
test r15, r15
je 0x140005ba2
movzx edx, r13w
xor ecx, ecx
mov r8d, 0x43554c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [rbp + 7], rax
test rax, rax
je 0x140005ba2
mov edx, dword [rbp + 0x6f]
movzx r8d, r13w
add rdx, 0x10
add rdx, r14
call fcn.140008e40
mov rcx, qword [rbp + 7]
xor r9d, r9d
xor r8d, r8d
movzx edx, r13w
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x140005b9d
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov r9, qword [rbp + 0x6f]
mov rcx, qword [0x14000b328]
lea rax, [rbp + 0x7f]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
movzx eax, r13w
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call sub.fwpkclnt.sys_FwpsAllocateNetBufferAndNetBufferList0
test eax, eax
js 0x140005b37
mov rax, qword [rbp + 0x7f]
mov rcx, rdi
mov rax, qword [rax + 8]
mov qword [rbp + 0xf], rax
mov rax, qword [r14 + 4]
mov qword [r15], rax
mov eax, dword [r14]
mov qword [r15 + 0x18], rdi
mov dword [r15 + 8], eax
mov rax, qword [rbp + 0x6f]
mov qword [r15 + 0x20], rsi
mov qword [r15 + 0x10], rax
call fcn.140008074
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [r14], 0xb
mov dl, al
mov eax, dword [rsi + 0x5c]
jne 0x1400058a4
add dword [rdi + 0x88], eax
cmp dword [rdi + 0x88], 0xc8000
jbe 0x1400058bd
mov byte [rdi + 0x90], 1
jmp 0x1400058bd
add dword [rdi + 0x8c], eax
cmp dword [rdi + 0x8c], 0xc8000
jbe 0x1400058bd
mov byte [rdi + 0x91], 1
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [r14], 0xb
jne 0x1400059bb
xor edx, edx
lea rcx, [rsi + 0x70]
lea r8d, [rdx + 0x20]
call fcn.140008b90
mov rcx, qword [rbp + 0xf]
mov r9d, 2
lea edx, [r9 + 6]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
movzx ecx, r13b
mov rdx, rax
mov eax, 2
shl cx, 8
cmp word [rdi + 0x2c], ax
movzx eax, word [rsi + 0x12]
mov word [rdx + 6], bx
mov word [rdx + 2], ax
movzx eax, byte [rbp + 0x68]
jne 0x140005929
or cx, ax
lea rax, [rsi + 0x14]
jmp 0x140005930
or cx, ax
lea rax, [rsi + 0x18]
mov word [rdx + 4], cx
mov r8, qword [rsi + 0x30]
mov qword [rsp + 0x48], r15
lea rcx, [rsi + 0x70]
xor r9d, r9d
xor edx, edx
mov qword [rcx], rax
mov eax, dword [rsi + 0x38]
mov dword [rsi + 0x78], eax
mov rax, qword [rsi + 0x50]
mov qword [rsi + 0x80], rax
mov eax, dword [rsi + 0x44]
mov dword [rsi + 0x88], eax
lea rax, [0x1400068c4]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x30], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x14000b318]
call sub.fwpkclnt.sys_FwpsInjectTransportSendAsync0
mov r13d, eax
test eax, eax
js 0x1400059b1
mov eax, dword [r14 + 0xc]
mov rsi, rbx
mov qword [rbp + 0x7f], rbx
add eax, 0x10
mov dword [rbp + 0x77], eax
mov edx, 0xd
jmp 0x140005ac8
mov rcx, qword [rbp + 0xf]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 + 6]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
movzx ecx, r13b
mov rdx, rax
mov eax, 2
shl cx, 8
cmp word [rdi + 0x2c], ax
movzx eax, word [rsi + 0x12]
mov word [rdx + 6], bx
mov word [rdx], ax
movzx eax, byte [rbp + 0x68]
jne 0x140005a0c
or cx, ax
lea r9, [rsi + 0x14]
mov word [rdx + 4], cx
lea rcx, [rdi + 0x32]
jmp 0x140005a1b
or cx, ax
lea r9, [rsi + 0x18]
mov word [rdx + 4], cx
lea rcx, [rdi + 0x36]
movzx eax, word [rdi + 0x4a]
movzx r8d, word [rdi + 0x2c]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x7f]
xor edx, edx
call sub.fwpkclnt.sys_FwpsConstructIpHeaderForTransportPacket0
test eax, eax
js 0x140005b37
mov rcx, qword [0x14000b318]
mov qword [rsp + 0x50], r15
lea rax, [0x1400068c4]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov eax, dword [rsi + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x3c]
xor edx, edx
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x28], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x20], ax
call sub.fwpkclnt.sys_FwpsInjectTransportReceiveAsync0
mov r13d, eax
test eax, eax
js 0x140005ac3
mov eax, dword [r14 + 0xc]
mov rsi, rbx
mov qword [rbp + 0x7f], rbx
add eax, 0x10
mov dword [rbp + 0x77], eax
mov edx, 0xc
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
call fcn.140005dc0
test r13d, r13d
jns 0x140005bc4
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [r14], 0xb
mov dl, al
mov eax, dword [rsi + 0x5c]
jne 0x140005b0e
sub dword [rdi + 0x88], eax
cmp dword [rdi + 0x88], 0xc8000
ja 0x140005b26
mov byte [rdi + 0x90], bl
jmp 0x140005b26
sub dword [rdi + 0x8c], eax
cmp dword [rdi + 0x8c], 0xc8000
ja 0x140005b26
mov byte [rdi + 0x91], bl
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400086a8
mov r13, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005b49
call sub.fwpkclnt.sys_FwpsFreeNetBufferList0
test r13, r13
je 0x140005b57
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov rax, qword [rbp + 7]
test rax, rax
je 0x140005b6b
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r15, r15
je 0x140005bb7
inc dword [0x14000b95c]
lea rcx, [0x14000b940]
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x14000b950]
jb 0x140005ba7
inc dword [0x14000b960]
mov rcx, r15
call qword [0x14000b978]
jmp 0x140005bb7
mov r13, rax
jmp 0x140005b3b
mov r13, rbx
jmp 0x140005b3b
lea rcx, [0x14000b940]
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
test rsi, rsi
je 0x140005bc4
mov rcx, rsi
call fcn.140008478
mov ebx, dword [rbp + 0x77]
mov rcx, rdi
call fcn.1400086a8
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.140007790
mov rdi, rax
test rax, rax
je 0x1400061da
lea rbx, [rax + 0x148]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rcx, [rdi + 0xc8]
mov r9b, al
lea rax, [rbp - 0x10]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x10], rax
jmp 0x1400060f3
mov rdx, qword [rcx]
mov r8, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140006110
cmp qword [r8 + 8], rdx
jne 0x140006110
mov qword [rcx], r8
mov qword [r8 + 8], rcx
mov rax, qword [rbp - 8]
lea r8, [rbp - 0x10]
mov qword [rdx + 8], rax
mov qword [rdx], r8
lea r8, [rbp - 0x10]
cmp qword [rax], r8
jne 0x140006109
mov qword [rax], rdx
mov qword [rbp - 8], rdx
cmp qword [rcx], rcx
jne 0x1400060bb
mov dl, r9b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x1400061bc
mov ecx, 3
int 0x29
mov ecx, 3
int 0x29
mov rax, qword [rbx]
lea rcx, [rbp - 0x10]
cmp qword [rbx + 8], rcx
jne 0x1400061ec
cmp qword [rax + 8], rbx
jne 0x1400061ec
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
bt eax, 0x10
jae 0x14000614e
bts eax, 0x12
mov dword [rbx + 0x18], eax
and qword [rsp + 0x50], 0
mov r9, qword [rdi + 0x80]
mov rcx, qword [0x14000b310]
lea rax, [0x140003650]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0x38], rax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x30], eax
movzx eax, word [rdi + 0x88]
mov word [rsp + 0x28], ax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x20], eax
call sub.fwpkclnt.sys_FwpsStreamInjectAsync0
test eax, eax
jne 0x1400061b4
cmp qword [rbx + 0x50], 0
je 0x1400061b4
and qword [rbx + 0x50], 0
mov rcx, rbx
call fcn.1400078d8
mov rbx, qword [rbp - 0x10]
lea rax, [rbp - 0x10]
cmp rbx, rax
jne 0x140006117
mov rcx, rdi
call fcn.140007d04
mov eax, 0x10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, 3
int 0x29
int3
push rbx
sub rsp, 0x20
call fcn.140007790
mov rbx, rax
test rax, rax
je 0x140006237
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 1]
call fcn.140005bec
mov rcx, rbx
call fcn.140007d04
mov rcx, rbx
call fcn.140007d04
mov eax, 0x10
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 4]
call fcn.140007790
mov rbx, rax
test rax, rax
je 0x1400064c4
lea rdi, [rax + 0x148]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [rsi]
mov r8b, al
sub edx, 6
je 0x14000649e
dec edx
jne 0x1400064ab
mov ecx, dword [rbx + 0x34]
test cl, 2
je 0x1400064ab
test cl, 4
je 0x1400064ab
and ecx, 0xfffffffb
xor esi, esi
mov dword [rbx + 0x34], ecx
lea rcx, [rbx + 0xb8]
mov rax, qword [rcx]
jmp 0x14000641b
mov rax, qword [rax]
inc esi
cmp rax, rcx
jne 0x140006416
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x140006448
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 2]
call fcn.140005bec
dec rsi
jne 0x140006430
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rdx, [rbx + 0xa8]
xor esi, esi
mov rcx, qword [rdx]
jmp 0x140006464
mov rcx, qword [rcx]
inc esi
cmp rcx, rdx
jne 0x14000645f
mov dl, al
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x140006490
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 3]
call fcn.140005bec
dec rsi
jne 0x140006478
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8b, al
jmp 0x1400064ab
mov eax, dword [rbx + 0x34]
test al, 2
je 0x1400064ab
or eax, 4
mov dword [rbx + 0x34], eax
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.140007d04
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 4]
call fcn.140007790
mov rdi, rax
test rax, rax
je 0x140006540
lea rsi, [rax + 0x148]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rbx + 0x20], 1
jne 0x140006528
cmp dword [rbx + 0x24], 4
jne 0x140006528
cmp dword [rbx + 0x28], 0
setne dl
mov byte [rdi + 0xf0], dl
mov dl, al
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.140007d04
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 4]
call fcn.1400083b4
mov rbx, rax
test rax, rax
je 0x140006676
lea rdi, [rax + 0xa8]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [rsi]
mov r8b, al
sub edx, 0xe
je 0x140006650
dec edx
jne 0x14000665d
mov ecx, dword [rbx + 0x24]
test cl, 2
je 0x14000665d
test cl, 4
je 0x14000665d
and ecx, 0xfffffffb
xor esi, esi
mov dword [rbx + 0x24], ecx
lea rcx, [rbx + 0x70]
mov rax, qword [rcx]
jmp 0x1400065d0
mov rax, qword [rax]
inc esi
cmp rax, rcx
jne 0x1400065cb
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x1400065fd
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 0xa]
call fcn.140005dc0
dec rsi
jne 0x1400065e5
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rdx, [rbx + 0x60]
xor esi, esi
mov rcx, qword [rdx]
jmp 0x140006616
mov rcx, qword [rcx]
inc esi
cmp rcx, rdx
jne 0x140006611
mov dl, al
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x140006642
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 0xb]
call fcn.140005dc0
dec rsi
jne 0x14000662a
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8b, al
jmp 0x14000665d
mov eax, dword [rbx + 0x24]
test al, 2
je 0x14000665d
or eax, 4
mov dword [rbx + 0x24], eax
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400086a8
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 4]
xor edi, edi
call fcn.140007790
mov rbx, rax
test rax, rax
je 0x14000672d
lea rsi, [rax + 0x148]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov dl, al
cmp byte [rbx + 0x30], dil
jne 0x14000671a
mov eax, dword [rbx + 0x34]
test al, 2
je 0x14000671a
lea rax, [rbx + 0xa8]
mov dword [rbx + 0x140], 1
cmp qword [rax], rax
jne 0x14000671a
lea rax, [rbx + 0xb8]
cmp qword [rax], rax
jne 0x14000671a
lea rax, [rbx + 0xc8]
cmp qword [rax], rax
jne 0x14000671a
cmp dword [rbx + 0xe0], edi
jne 0x14000671a
cmp dword [rbx + 0xe4], edi
jne 0x14000671a
mov dword [rbx + 0x140], 2
mov edi, 0x10
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.140007d04
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 4]
call fcn.1400083b4
mov rdi, rax
test rax, rax
je 0x1400068b2
lea rbx, [rax + 0xa8]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, rbx
mov byte [rdi + 0x92], 1
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400086a8
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret