Function at 0x140004ab0
Capabilities:
Resolve function by parsing pe exports
Send tcp data via wfp api

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x14000b888]
mov ebx, ecx
mov edx, dword [r8 + 0xc]
add rdx, 0x10
cmp rbx, rdx
jae 0x140004ad3
xor eax, eax
jmp 0x140004ba7
mov ecx, dword [r8]
cmp ecx, 0x11
jg 0x140004b52
je 0x140004b4e
cmp ecx, 2
jl 0x140004acc
cmp ecx, 3
jle 0x140004b41
cmp ecx, 5
jle 0x140004acc
cmp ecx, 7
jle 0x140004b34
cmp ecx, 9
jle 0x140004acc
cmp ecx, 0xb
jle 0x140004b27
cmp ecx, 0xd
jle 0x140004acc
cmp ecx, 0xf
jle 0x140004b1a
cmp ecx, 0x10
jne 0x140004acc
mov dl, 1
lea rcx, [r8 + 0x10]
call fcn.14000694c
jmp 0x140004ba5
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x1400061a4
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x140005438
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x140005fec
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x140004ea4
xor edx, edx
jmp 0x140004b0c
sub ecx, 0x12
je 0x140004ba0
dec ecx
je 0x140004b93
sub ecx, 2
je 0x140004b86
dec ecx
je 0x140004b79
dec ecx
jne 0x140004acc
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x140006128
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x1400064a4
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x1400062d8
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x140004d68
call fcn.140006ed0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 4]
call fcn.140007368
mov rbx, rax
test rax, rax
je 0x140004e86
cmp byte [rax + 0x120], 0
mov ebp, 0x10
je 0x140004e7c
mov eax, dword [rdi + 0x10]
cmp word [rbx + 0x3c], 2
lea rcx, [rbx + 0x5a]
mov dword [rbx + 0x34], eax
lea eax, [rbp + 0xc]
lea rdx, [rdi + 0x37]
cmove eax, ebp
movsxd r8, eax
call fcn.140008800
test eax, eax
je 0x140004e5e
mov rdx, qword [rbx + 0xf0]
mov rcx, qword [rbx + 0xe8]
lea rax, [rbx + 0xf8]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call sub.fwpkclnt.sys_FwpsAcquireWritableLayerDataPointer0
test eax, eax
jne 0x140004e5e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rdi + 0x37]
xor r8d, r8d
mov qword [rcx + 0x80], rax
mov rax, qword [rdi + 0x3f]
mov qword [rcx + 0x88], rax
mov rax, qword [rdi + 0x47]
mov qword [rcx + 0x90], rax
mov eax, dword [rdi + 0x4f]
mov dword [rcx + 0x98], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rdi + 0x14]
mov dword [rax + 0x108], ecx
mov rcx, qword [rbx + 0x128]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x120], rcx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rbx + 0xe8]
call sub.fwpkclnt.sys_FwpsApplyModifiedLayerData0
mov cl, byte [rbx + 0x34]
and cl, 1
neg cl
sbb ecx, ecx
add ecx, 0x1002
mov dword [rbx + 0xf8], ecx
mov rcx, rbx
call fcn.1400076b0
mov rcx, rbx
call fcn.1400078a0
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
mov rcx, qword [rcx + 4]
mov r12d, esi
mov r14d, esi
mov qword [rax + 0x10], rsi
mov r13d, esi
mov dword [rsp + 0xa0], esi
call fcn.140007368
mov rbx, rax
test rax, rax
je 0x140005411
lea rbp, [rax + 0x138]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rbx + 0x30], sil
je 0x140004f18
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400078a0
xor eax, eax
jmp 0x140005418
cmp dword [rdi + 0xc], esi
jbe 0x140004f3b
mov ecx, dword [rdi]
cmp ecx, 3
jne 0x140004f2d
cmp byte [rbx + 0xde], sil
jne 0x140004efe
cmp ecx, 2
jne 0x140004f3b
cmp byte [rbx + 0xdf], sil
jne 0x140004efe
cmp byte [rbx + 0xdb], sil
jne 0x1400053fe
mov ecx, dword [rdi]
cmp ecx, 3
jne 0x140004f5c
cmp byte [rbx + 0xdc], sil
jne 0x1400053fe
cmp ecx, 2
jne 0x140004f6e
cmp byte [rbx + 0xdd], sil
jne 0x1400053fe
mov r15b, byte [rbx + 0xe0]
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [rdi + 0xc], esi
jne 0x140005061
inc dword [0x14000b9d4]
lea rcx, [0x14000b9c0]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov rsi, rax
test rax, rax
jne 0x140004fcf
mov edx, dword [0x14000b9ec]
mov r8d, dword [0x14000b9e8]
mov ecx, dword [0x14000b9e4]
inc dword [0x14000b9d8]
call qword [0x14000b9f0]
mov rsi, rax
test rax, rax
je 0x140005409
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rdi], 3
jne 0x140004fe6
mov byte [rbx + 0xdc], 1
jmp 0x140004fed
mov byte [rbx + 0xdd], 1
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rax, qword [rbx + 0x10]
lea rcx, [0x14000b558]
mov qword [rsi + 0x10], rax
mov eax, dword [rdi]
mov dword [rsi + 0x18], eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [0x14000ba48]
mov bpl, al
lea rax, [0x14000ba40]
mov qword [rsi + 8], rdx
mov qword [rsi], rax
cmp qword [rdx], rax
je 0x140005036
mov ecx, 3
int 0x29
mov qword [rdx], rsi
lea rcx, [0x14000ba50]
xor r8d, r8d
xor edx, edx
mov qword [0x14000ba48], rsi
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueDpc]
mov dl, bpl
lea rcx, [0x14000b558]
jmp 0x140005403
inc dword [0x14000b8d4]
lea rcx, [0x14000b8c0]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov rsi, rax
test rax, rax
jne 0x1400050a7
mov edx, dword [0x14000b8ec]
mov r8d, dword [0x14000b8e8]
mov ecx, dword [0x14000b8e4]
inc dword [0x14000b8d8]
call qword [0x14000b8f0]
mov rsi, rax
test rax, rax
je 0x14000537f
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x14000513f
mov edx, eax
xor ecx, ecx
mov r8d, 0x43544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rax, rax
je 0x14000537f
mov r8d, dword [rdi + 0xc]
lea rdx, [rdi + 0x10]
mov rcx, rax
call fcn.1400089c0
mov edx, dword [rdi + 0xc]
and qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov r14, rax
test rax, rax
je 0x14000537f
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov ecx, dword [rdi + 0xc]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, qword [0x14000b320]
xor edx, edx
xor r8d, r8d
mov r9, r14
and dword [rsp + 0x20], edx
call sub.fwpkclnt.sys_FwpsAllocateNetBufferAndNetBufferList0
test eax, eax
js 0x14000537f
mov ecx, dword [rdi]
neg r15b
mov r13d, 0x10000
sbb eax, eax
mov r15d, 0x11
and eax, 0x40000
or eax, r13d
cmp ecx, 3
cmove r15d, eax
cmp dword [rdi + 0xc], 0
jne 0x14000517a
cmp ecx, 3
mov eax, 4
mov edx, 0x80000
cmove eax, edx
or r15d, eax
mov rax, qword [rdi + 4]
mov rcx, rbx
mov qword [rsi], rax
mov eax, dword [rdi]
mov qword [rsi + 0x10], r14
mov dword [rsi + 8], eax
mov qword [rsi + 0x18], rbx
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0x20], eax
call fcn.140006f88
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rdi + 0xc], 0
mov dl, al
jne 0x1400051c2
cmp dword [rdi], 3
jne 0x1400051bb
mov byte [rbx + 0xdc], 1
jmp 0x1400051c2
mov byte [rbx + 0xdd], 1
cmp dword [rdi], 3
mov eax, dword [rdi + 0xc]
jne 0x1400051e9
add dword [rbx + 0xd0], eax
cmp dword [rbx + 0xd0], r13d
jbe 0x1400051e0
mov byte [rbx + 0xde], 1
mov r13d, dword [rbx + 0x8c]
jmp 0x140005209
add dword [rbx + 0xd4], eax
cmp dword [rbx + 0xd4], 0x100000
jbe 0x140005202
mov byte [rbx + 0xdf], 1
mov r13d, dword [rbx + 0x90]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov eax, dword [rdi + 0xc]
mov r9, qword [rbx + 0x80]
mov qword [rsp + 0x50], rsi
lea rcx, [0x140006380]
xor r8d, r8d
mov qword [rsp + 0x48], rcx
mov rcx, qword [0x14000b308]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
xor edx, edx
mov qword [rsp + 0x38], rax
movzx eax, word [rbx + 0x88]
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], r13d
call sub.fwpkclnt.sys_FwpsStreamInjectAsync0
mov r15d, eax
test eax, eax
js 0x1400052a4
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
cmp dword [rdi], 3
lea edx, [r9 + 5]
je 0x140005284
lea edx, [r9 + 4]
call fcn.140005a54
mov r13d, dword [rdi + 0xc]
add r13d, 0x10
cmp qword [rsp + 0xa8], 0
jne 0x14000531b
mov r15d, 0xc0000001
jmp 0x14000531b
cmp eax, 0xc0000225
je 0x140005313
mov r8d, dword [rbx + 0x8c]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r8d, dword [rbx + 0x90]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r8d, dword [rbx + 0xa0]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r8d, dword [rbx + 0x98]
movzx edx, word [rbx + 0x88]
mov rcx, qword [rbx + 0x80]
call sub.fwpkclnt.sys_FwpsFlowRemoveContext0
mov r13d, dword [rsp + 0xa0]
test r15d, r15d
jns 0x1400053f1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rdi], 3
mov dl, al
jne 0x140005352
mov ecx, dword [rdi + 0xc]
sub dword [rbx + 0xd0], ecx
cmp dword [rbx + 0xd0], 0x10000
ja 0x14000536e
mov byte [rbx + 0xde], 0
jmp 0x14000536e
mov eax, dword [rdi + 0xc]
sub dword [rbx + 0xd4], eax
cmp dword [rbx + 0xd4], 0x100000
ja 0x14000536e
mov byte [rbx + 0xdf], 0
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400078a0
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140005391
call sub.fwpkclnt.sys_FwpsFreeNetBufferList0
test r14, r14
je 0x14000539f
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test r12, r12
je 0x1400053af
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rsi, rsi
je 0x1400053f1
inc dword [0x14000b8dc]
lea rcx, [0x14000b8c0]
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x14000b8d0]
jb 0x1400053e1
inc dword [0x14000b8e0]
mov rcx, rsi
call qword [0x14000b8f8]
jmp 0x1400053f1
lea rcx, [0x14000b8c0]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
mov rcx, rbx
call fcn.1400078a0
mov eax, r13d
jmp 0x140005418
mov dl, al
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400078a0
mov eax, dword [rdi + 0xc]
add rax, 0x10
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov eax, dword [rcx + 0xc]
xor ebx, ebx
mov r14, rcx
mov qword [rbp + 7], rbx
mov r13d, ebx
mov qword [rbp + 0x7f], rbx
mov r15d, ebx
mov dword [rbp + 0x77], ebx
cmp eax, 0x25
jae 0x140005478
add rax, 0x10
jmp 0x140005a39
mov rcx, qword [rcx + 4]
call fcn.140007f04
mov rdi, rax
test rax, rax
jne 0x14000548f
mov eax, dword [r14 + 0xc]
jmp 0x14000546f
lea r12, [rax + 0xa8]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rdi + 0x20], bl
je 0x1400054b9
mov dl, al
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400081f8
jmp 0x140005489
mov ecx, dword [r14]
cmp ecx, 0xb
jne 0x1400054c9
cmp byte [rdi + 0x90], bl
jne 0x1400054d6
cmp ecx, 0xa
jne 0x1400054e6
cmp byte [rdi + 0x91], bl
je 0x1400054e6
mov dl, al
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x140005a2f
mov dl, al
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
call fcn.140007d0c
mov rsi, rax
test rax, rax
je 0x1400059a3
mov rax, qword [r14 + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [r14 + 0x18]
mov qword [rsi + 0x18], rax
mov rax, qword [r14 + 0x20]
mov qword [rsi + 0x20], rax
mov eax, dword [r14 + 0x28]
mov dword [rsi + 0x28], eax
mov eax, dword [r14 + 0x30]
add eax, 0x24
cmp dword [r14 + 0xc], eax
jb 0x1400059a3
mov rax, qword [r14 + 0x34]
mov r13d, 0x44
mov qword [rsi + 0x2c], rax
mov rax, qword [r14 + 0x3c]
mov dword [rbp + 0x6f], r13d
mov qword [rsi + 0x34], rax
mov rax, qword [r14 + 0x44]
mov qword [rsi + 0x3c], rax
mov rax, qword [r14 + 0x4c]
mov qword [rsi + 0x44], rax
mov eax, eax
test eax, eax
je 0x1400055ae
mov edx, eax
movsxd rax, dword [r14 + 0x30]
sub rax, 0x20
cmp rdx, rax
ja 0x140005a0a
xor ecx, ecx
mov r8d, 0x44554c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi + 0x50], rax
test rax, rax
je 0x140005a0a
mov r8d, dword [rsi + 0x44]
lea rdx, [r14 + 0x54]
mov rcx, rax
call fcn.1400089c0
mov eax, dword [rsi + 0x44]
add eax, r13d
mov r13d, eax
mov dword [rbp + 0x6f], eax
jmp 0x1400055b2
mov qword [rsi + 0x50], rbx
movzx r13d, word [r14 + 0xc]
sub r13w, word [rbp + 0x6f]
mov word [rbp + 0x67], r13w
je 0x140005a0a
movzx eax, r13w
lea rcx, [0x14000b940]
mov dword [rsi + 0x5c], eax
inc dword [0x14000b954]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov r15, rax
test rax, rax
jne 0x14000560b
mov edx, dword [0x14000b96c]
mov r8d, dword [0x14000b968]
mov ecx, dword [0x14000b964]
inc dword [0x14000b958]
call qword [0x14000b970]
mov r15, rax
test r15, r15
je 0x140005a0a
movzx edx, r13w
xor ecx, ecx
mov r8d, 0x43554c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [rbp + 7], rax
test rax, rax
je 0x140005a0a
mov edx, dword [rbp + 0x6f]
movzx r8d, r13w
add rdx, 0x10
add rdx, r14
call fcn.1400089c0
mov rcx, qword [rbp + 7]
xor r9d, r9d
xor r8d, r8d
movzx edx, r13w
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x140005a05
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov r9, qword [rbp + 0x6f]
mov rcx, qword [0x14000b320]
lea rax, [rbp + 0x7f]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
movzx eax, r13w
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call sub.fwpkclnt.sys_FwpsAllocateNetBufferAndNetBufferList0
test eax, eax
js 0x14000599f
mov rax, qword [rbp + 0x7f]
mov rcx, rdi
mov rax, qword [rax + 8]
mov qword [rbp + 0xf], rax
mov rax, qword [r14 + 4]
mov qword [r15], rax
mov eax, dword [r14]
mov qword [r15 + 0x18], rdi
mov dword [r15 + 8], eax
mov rax, qword [rbp + 0x6f]
mov qword [r15 + 0x20], rsi
mov qword [r15 + 0x10], rax
call fcn.140007bc4
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [r14], 0xb
mov dl, al
mov eax, dword [rsi + 0x5c]
jne 0x14000570c
add dword [rdi + 0x88], eax
cmp dword [rdi + 0x88], 0xc8000
jbe 0x140005725
mov byte [rdi + 0x90], 1
jmp 0x140005725
add dword [rdi + 0x8c], eax
cmp dword [rdi + 0x8c], 0xc8000
jbe 0x140005725
mov byte [rdi + 0x91], 1
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [r14], 0xb
jne 0x140005823
xor edx, edx
lea rcx, [rsi + 0x70]
lea r8d, [rdx + 0x20]
call fcn.1400086e0
mov rcx, qword [rbp + 0xf]
mov r9d, 2
lea edx, [r9 + 6]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
movzx ecx, r13b
mov rdx, rax
mov eax, 2
shl cx, 8
cmp word [rdi + 0x2c], ax
movzx eax, word [rsi + 0x12]
mov word [rdx + 6], bx
mov word [rdx + 2], ax
movzx eax, byte [rbp + 0x68]
jne 0x140005791
or cx, ax
lea rax, [rsi + 0x14]
jmp 0x140005798
or cx, ax
lea rax, [rsi + 0x18]
mov word [rdx + 4], cx
mov r8, qword [rsi + 0x30]
mov qword [rsp + 0x48], r15
lea rcx, [rsi + 0x70]
xor r9d, r9d
xor edx, edx
mov qword [rcx], rax
mov eax, dword [rsi + 0x38]
mov dword [rsi + 0x78], eax
mov rax, qword [rsi + 0x50]
mov qword [rsi + 0x80], rax
mov eax, dword [rsi + 0x44]
mov dword [rsi + 0x88], eax
lea rax, [0x140006500]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x30], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x14000b310]
call sub.fwpkclnt.sys_FwpsInjectTransportSendAsync0
mov r13d, eax
test eax, eax
js 0x140005819
mov eax, dword [r14 + 0xc]
mov rsi, rbx
mov qword [rbp + 0x7f], rbx
add eax, 0x10
mov dword [rbp + 0x77], eax
mov edx, 0xd
jmp 0x140005930
mov rcx, qword [rbp + 0xf]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 + 6]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
movzx ecx, r13b
mov rdx, rax
mov eax, 2
shl cx, 8
cmp word [rdi + 0x2c], ax
movzx eax, word [rsi + 0x12]
mov word [rdx + 6], bx
mov word [rdx], ax
movzx eax, byte [rbp + 0x68]
jne 0x140005874
or cx, ax
lea r9, [rsi + 0x14]
mov word [rdx + 4], cx
lea rcx, [rdi + 0x32]
jmp 0x140005883
or cx, ax
lea r9, [rsi + 0x18]
mov word [rdx + 4], cx
lea rcx, [rdi + 0x36]
movzx eax, word [rdi + 0x4a]
movzx r8d, word [rdi + 0x2c]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x7f]
xor edx, edx
call sub.fwpkclnt.sys_FwpsConstructIpHeaderForTransportPacket0
test eax, eax
js 0x14000599f
mov rcx, qword [0x14000b310]
mov qword [rsp + 0x50], r15
lea rax, [0x140006500]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov eax, dword [rsi + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x3c]
xor edx, edx
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x28], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x20], ax
call sub.fwpkclnt.sys_FwpsInjectTransportReceiveAsync0
mov r13d, eax
test eax, eax
js 0x14000592b
mov eax, dword [r14 + 0xc]
mov rsi, rbx
mov qword [rbp + 0x7f], rbx
add eax, 0x10
mov dword [rbp + 0x77], eax
mov edx, 0xc
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
call fcn.140005be4
test r13d, r13d
jns 0x140005a2c
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [r14], 0xb
mov dl, al
mov eax, dword [rsi + 0x5c]
jne 0x140005976
sub dword [rdi + 0x88], eax
cmp dword [rdi + 0x88], 0xc8000
ja 0x14000598e
mov byte [rdi + 0x90], bl
jmp 0x14000598e
sub dword [rdi + 0x8c], eax
cmp dword [rdi + 0x8c], 0xc8000
ja 0x14000598e
mov byte [rdi + 0x91], bl
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400081f8
mov r13, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400059b1
call sub.fwpkclnt.sys_FwpsFreeNetBufferList0
test r13, r13
je 0x1400059bf
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov rax, qword [rbp + 7]
test rax, rax
je 0x1400059d3
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r15, r15
je 0x140005a1f
inc dword [0x14000b95c]
lea rcx, [0x14000b940]
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x14000b950]
jb 0x140005a0f
inc dword [0x14000b960]
mov rcx, r15
call qword [0x14000b978]
jmp 0x140005a1f
mov r13, rax
jmp 0x1400059a3
mov r13, rbx
jmp 0x1400059a3
lea rcx, [0x14000b940]
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
test rsi, rsi
je 0x140005a2c
mov rcx, rsi
call fcn.140007fc8
mov ebx, dword [rbp + 0x77]
mov rcx, rdi
call fcn.1400081f8
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 4]
call fcn.140007368
mov rbx, rax
test rax, rax
je 0x140006110
lea rdi, [rax + 0x138]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [rsi]
mov r8b, al
sub edx, 6
je 0x1400060ea
dec edx
jne 0x1400060f7
mov ecx, dword [rbx + 0x34]
test cl, 2
je 0x1400060f7
test cl, 4
je 0x1400060f7
and ecx, 0xfffffffb
xor esi, esi
mov dword [rbx + 0x34], ecx
lea rcx, [rbx + 0xb8]
mov rax, qword [rcx]
jmp 0x140006067
mov rax, qword [rax]
inc esi
cmp rax, rcx
jne 0x140006062
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x140006094
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 2]
call fcn.140005a54
dec rsi
jne 0x14000607c
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rdx, [rbx + 0xa8]
xor esi, esi
mov rcx, qword [rdx]
jmp 0x1400060b0
mov rcx, qword [rcx]
inc esi
cmp rcx, rdx
jne 0x1400060ab
mov dl, al
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x1400060dc
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 3]
call fcn.140005a54
dec rsi
jne 0x1400060c4
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8b, al
jmp 0x1400060f7
mov eax, dword [rbx + 0x34]
test al, 2
je 0x1400060f7
or eax, 4
mov dword [rbx + 0x34], eax
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400078a0
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 4]
call fcn.140007368
mov rdi, rax
test rax, rax
je 0x14000618c
lea rsi, [rax + 0x138]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rbx + 0x20], 1
jne 0x140006174
cmp dword [rbx + 0x24], 4
jne 0x140006174
cmp dword [rbx + 0x28], 0
setne dl
mov byte [rdi + 0xe0], dl
mov dl, al
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400078a0
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 4]
call fcn.140007f04
mov rbx, rax
test rax, rax
je 0x1400062c2
lea rdi, [rax + 0xa8]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [rsi]
mov r8b, al
sub edx, 0xe
je 0x14000629c
dec edx
jne 0x1400062a9
mov ecx, dword [rbx + 0x24]
test cl, 2
je 0x1400062a9
test cl, 4
je 0x1400062a9
and ecx, 0xfffffffb
xor esi, esi
mov dword [rbx + 0x24], ecx
lea rcx, [rbx + 0x70]
mov rax, qword [rcx]
jmp 0x14000621c
mov rax, qword [rax]
inc esi
cmp rax, rcx
jne 0x140006217
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x140006249
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 0xa]
call fcn.140005be4
dec rsi
jne 0x140006231
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rdx, [rbx + 0x60]
xor esi, esi
mov rcx, qword [rdx]
jmp 0x140006262
mov rcx, qword [rcx]
inc esi
cmp rcx, rdx
jne 0x14000625d
mov dl, al
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test esi, esi
jle 0x14000628e
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 0xb]
call fcn.140005be4
dec rsi
jne 0x140006276
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8b, al
jmp 0x1400062a9
mov eax, dword [rbx + 0x24]
test al, 2
je 0x1400062a9
or eax, 4
mov dword [rbx + 0x24], eax
mov dl, r8b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400081f8
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 4]
xor edi, edi
call fcn.140007368
mov rbx, rax
test rax, rax
je 0x140006368
lea rsi, [rax + 0x138]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov dl, al
cmp byte [rbx + 0x30], dil
jne 0x140006355
mov eax, dword [rbx + 0x34]
test al, 2
je 0x140006355
mov dword [rbx + 0x130], 1
cmp dword [rbx + 0xcc], edi
jne 0x140006355
cmp dword [rbx + 0xc8], edi
jne 0x140006355
cmp dword [rbx + 0xd0], edi
jne 0x140006355
cmp dword [rbx + 0xd4], edi
jne 0x140006355
mov dword [rbx + 0x34], edi
mov dword [rbx + 0x130], 2
mov edi, 0x10
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rbx
call fcn.1400078a0
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 4]
call fcn.140007f04
mov rdi, rax
test rax, rax
je 0x1400064ee
lea rbx, [rax + 0xa8]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, rbx
mov byte [rdi + 0x92], 1
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.1400081f8
mov eax, 0x10
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret