joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024290
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
and qword [rbp - 0x19], 0
mov r14d, r9d
mov rdi, r8
mov rsi, rdx
test rcx, rcx
je 0x140024374
test rdx, rdx
je 0x140024374
test r8, r8
je 0x140024374
mov rdx, rcx
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0x17], 0
lea rax, [rbp - 0x11]
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 0xf]
lea rax, [rbp + 0x67]
mov dword [rbp + 0xf], 0x30
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x19]
and dword [rsp + 0x28], 0
xorps xmm0, xmm0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x20006
mov dword [rbp + 0x27], 0x240
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov ebx, eax
test eax, eax
jne 0x140024361
mov rdx, rsi
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x19]
lea r9d, [rbx + 3]
xor r8d, r8d
mov dword [rsp + 0x28], r14d
lea rdx, [rbp - 1]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140024370
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x140024379
mov eax, 0xc000000d
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400244f0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
or rbp, 0xffffffffffffffff
mov r14, rcx
mov rdi, rbp
xor r15d, r15d
inc rdi
cmp word [rcx + rdi*2], r15w
jne 0x140024515
mov edx, 0x10000
add di, di
mov dword [rsp + 0x48], edx
mov ebx, r15d
jmp 0x140024578
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rsi
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140024594
mov eax, ebx
inc ebx
cmp eax, 0x64
jae 0x1400245c0
mov edx, dword [0x14002e9e0]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [rsp + 0x48]
mov eax, ebx
shl eax, 0xc
add ecx, eax
mov dword [rsp + 0x48], ecx
mov edx, ecx
mov r8d, dword [0x14002e9e0]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x140024530
jmp 0x1400245cf
test eax, eax
js 0x1400245c0
mov rbx, rsi
cmp word [rbx + 0x38], di
jne 0x1400245b1
mov rdx, qword [rbx + 0x40]
mov rcx, r14
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x1400245bc
mov eax, dword [rbx]
test eax, eax
je 0x1400245c0
add rbx, rax
jmp 0x14002459b
mov rbp, qword [rbx + 0x50]
mov edx, dword [0x14002e9e0]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14002466c
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14002469b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsIsProtectedProcess]
mov rcx, qword [rsp + 0x38]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x1400246a4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.140024110
test al, al
je 0x1400246fe
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400246fc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov rcx, rax
mov rdx, rsi
call sub.ntoskrnl.exe__stricmp
mov rcx, qword [rsp + 0x40]
test eax, eax
sete bl
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140024798
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor edi, edi
mov dword [rbp - 0x20], 0x52534d42
mov rbx, rcx
mov qword [rbp - 0x18], rdi
lea r9, [rbp + 0x28]
lea rdx, [rbp - 0x20]
lea r8d, [rdi + 0x14]
lea r15d, [rdi + 1]
mov dword [rbp + 0x28], r8d
lea ecx, [rdi + 0x4c]
mov dword [rbp - 0x1c], r15d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000023
jne 0x14002494d
mov r14d, dword [rbp - 0x14]
mov r8d, 0x7668704b
mov ecx, r15d
lea eax, [r14 + 0x14]
mov edx, eax
mov dword [rbp + 0x28], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x14002494d
movups xmm0, xmmword [rbp - 0x20]
lea r9, [rbp + 0x28]
lea ecx, [rdi + 0x4c]
movups xmmword [rax], xmm0
mov edx, dword [rbp - 0x10]
mov dword [rax + 0x10], edx
mov rdx, rax
mov dword [rax + 0xc], r14d
mov r8d, dword [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x14002493a
mov eax, dword [rsi + 0x14]
lea rcx, [rsi + 0x18]
add rcx, rax
lea r8, [rsi + 0x18]
cmp r8, rcx
jae 0x14002493a
movzx eax, byte [r8 + 1]
cmp al, 4
jb 0x14002493a
cmp byte [r8], r15b
jne 0x140024871
cmp al, 0x19
jae 0x14002488f
add rax, r8
jmp 0x140024884
cmp byte [rax], dil
jne 0x140024881
cmp byte [rax + 1], dil
je 0x140024889
add rax, r15
cmp rax, rcx
jb 0x140024876
lea r8, [rax + 2]
jmp 0x140024852
mov r9d, 8
mov r10b, r15b
add r8, r9
mov r11b, r15b
mov r14, rdi
test r10b, r10b
jne 0x1400248ab
test r11b, r11b
je 0x1400248de
mov dl, byte [r14 + r8]
mov ecx, edi
add r14, r15
movzx eax, r10b
test dl, dl
cmove ecx, eax
cmp dl, 0xff
mov r10b, cl
movzx eax, r11b
mov ecx, edi
cmove ecx, eax
mov r11b, cl
cmp r14, 0x10
jl 0x1400248a1
test r10b, r10b
jne 0x14002493a
test cl, cl
jne 0x14002493a
mov al, byte [r8 + 3]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 2]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 1]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 5]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 4]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 7]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 6]
mov byte [rbx], al
add rbx, r15
mov al, byte [r9 + r8]
add r9, r15
mov byte [rbx], al
add rbx, r15
cmp r9, 0x10
jl 0x140024925
mov dil, r15b
mov edx, 0x7668704b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, dil
jmp 0x14002494f
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140024968
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [rsp + 0x20]
call fcn.140024798
xor r11d, r11d
test al, al
je 0x140024aab
mov r8, qword [0x140034538]
lea rcx, [0x1400349b0]
mov r9d, r11d
lea r10d, [r11 + 4]
movzx edx, byte [rsp + r9 + 0x20]
inc r9
mov eax, edx
and edx, 0xf
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [rcx], ax
movzx eax, word [r8 + rdx*2]
mov word [rcx + 2], ax
add rcx, r10
cmp r9, r10
jl 0x140024998
mov ebx, 0x2d
mov word [rcx], bx
add rcx, 2
lea r9d, [rbx - 0x27]
movzx edx, byte [rsp + r10 + 0x20]
inc r10
mov eax, edx
and edx, 0xf
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [rcx], ax
movzx eax, word [r8 + rdx*2]
mov word [rcx + 2], ax
add rcx, 4
cmp r10, r9
jl 0x1400249d3
mov word [rcx], bx
mov r10d, 8
add rcx, 2
movzx edx, byte [rsp + r9 + 0x20]
inc r9
mov eax, edx
and edx, 0xf
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [rcx], ax
movzx eax, word [r8 + rdx*2]
mov word [rcx + 2], ax
add rcx, 4
cmp r9, r10
jl 0x140024a0c
mov word [rcx], bx
mov r9d, 0xa
add rcx, 2
movzx edx, byte [rsp + r10 + 0x20]
inc r10
mov eax, edx
and edx, 0xf
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [rcx], ax
movzx eax, word [r8 + rdx*2]
mov word [rcx + 2], ax
add rcx, 4
cmp r10, r9
jl 0x140024a45
mov word [rcx], bx
add rcx, 2
movzx edx, byte [rsp + r9 + 0x20]
inc r9
mov eax, edx
and edx, 0xf
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [rcx], ax
lea rcx, [rcx + 4]
movzx eax, word [r8 + rdx*2]
mov word [rcx - 2], ax
cmp r9, 0x10
jl 0x140024a78
mov word [rcx], r11w
jmp 0x140024b01
movaps xmm0, xmmword [0x14002d4d0]
movaps xmm1, xmmword [0x14002d4e0]
movzx eax, word [0x14002d518]
movaps xmmword [0x1400349b0], xmm0
movaps xmm0, xmmword [0x14002d4f0]
movaps xmmword [0x1400349d0], xmm0
movsd xmm0, qword [0x14002d510]
movaps xmmword [0x1400349c0], xmm1
movaps xmm1, xmmword [0x14002d500]
movsd qword [0x1400349f0], xmm0
movaps xmmword [0x1400349e0], xmm1
mov word [0x1400349f8], ax
lea rdx, [0x1400349b0]
lea rcx, [0x14002d520]
add rsp, 0x30
pop rbx
jmp fcn.1400272a8
Function at 0x140024bb0
Capabilities:
Get file attributes
Hash data via bcrypt
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
and qword [rbp + 0x7f], 0
mov rdi, rcx
lea rcx, [rbp - 0x29]
mov r15, r8
mov r12, rdx
call fcn.1400260a8
mov ebx, eax
test eax, eax
js 0x140024d56
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x39]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
and qword [rbp + 0xf], 0
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov qword [rbp + 0x17], rdi
mov edx, 0x120089
mov edi, 1
mov dword [rbp + 7], 0x30
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x200
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140024d56
mov rcx, qword [rbp + 0x7f]
lea r9d, [rdi + 0x17]
lea r8, [rbp - 0x11]
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140024d56
mov rax, qword [rbp - 9]
test rax, rax
jg 0x140024c98
mov ebx, 0xc0000001
jmp 0x140024d56
cmp rax, 0x8000000
jle 0x140024caa
mov ebx, 0xc0000904
jmp 0x140024d56
mov edx, 0x2000
mov r8d, 0x7668704b
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x140024ccf
mov ebx, 0xc000009a
jmp 0x140024d56
mov edi, dword [rbp - 9]
test edi, edi
je 0x140024d37
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 0x39]
mov esi, 0x2000
cmp edi, esi
cmovb esi, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140024d48
cmp dword [rbp - 0x31], esi
jne 0x140024d8c
mov rcx, qword [rbp - 0x21]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call sub.ksecdd.sys_BCryptHashData
mov ebx, eax
test eax, eax
js 0x140024d48
sub edi, esi
jne 0x140024cd6
mov r8, r15
lea rcx, [rbp - 0x29]
mov rdx, r12
call fcn.140025fa8
mov ebx, eax
mov edx, 0x7668704b
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140024d65
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rbp - 0x29]
call fcn.14002605c
lea r11, [rsp + 0xd0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ebx, 0xc00000e5
jmp 0x140024d48
Function at 0x140024e28
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and dword [rax - 0x78], 0
lea r9, [rbp - 9]
and qword [rax - 0x80], 0
mov rdi, r8
and qword [rbp + 0x67], 0
lea r8, [rbp + 0x1f]
and qword [rbp + 0x27], 0
mov rsi, rdx
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
mov edx, 0x120089
mov dword [rsp + 0x30], 1
mov qword [rbp + 0x2f], rcx
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x30
mov dword [rbp + 0x37], 0x200
movdqu xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140024f5e
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 7]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140024f5e
mov rax, qword [rbp + 0xf]
test rax, rax
jg 0x140024ef3
mov ebx, 0xc0000001
jmp 0x140024f5e
cmp rax, 0x20000
jle 0x140024f02
mov ebx, 0xc0000904
jmp 0x140024f5e
mov dword [rdi], eax
mov ecx, 1
mov r8d, dword [0x14002e9e0]
mov edx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
jne 0x140024f2a
mov ebx, 0xc000009a
jmp 0x140024f5e
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov eax, dword [rdi]
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x67]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140024f6d
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140025d7c
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
xor ebp, ebp
lea rcx, [rax - 0x28]
mov qword [rax - 0x30], rbp
mov edi, edx
call fcn.1400260a8
mov ebx, eax
test eax, eax
js 0x140025ded
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call sub.ksecdd.sys_BCryptHashData
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140025fa8
test eax, eax
mov ebx, eax
cmovns ebx, ebp
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140025ded
mov edx, 0x7668704b
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [rsp + 0x30]
call fcn.14002605c
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400266f8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp qword [0x140034a18], 0
je 0x140026716
mov al, 1
jmp 0x1400268cf
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x48]
call fcn.140029dc0
xor r8d, r8d
mov dword [rsp + 0x50], 1
lea rax, [0x140034a18]
xor ecx, ecx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor dil, dil
xor bl, bl
lea edx, [r8 + 0xa]
call sub.fwpkclnt.sys_FwpmEngineOpen0
mov edx, 0x10
test eax, eax
js 0x140026863
mov rcx, qword [0x140034a18]
xor edx, edx
call sub.fwpkclnt.sys_FwpmTransactionBegin0
mov edx, 0x20
test eax, eax
js 0x140026863
mov dil, 1
call fcn.140026bf0
mov edx, 0x30
test eax, eax
js 0x140026863
lea r9, [0x140034a30]
lea r8, [0x140034a20]
lea rdx, [0x14002f208]
lea rcx, [0x1400302c8]
call fcn.140026a88
mov edx, 0x41
test eax, eax
js 0x140026863
lea r9, [0x140034a38]
mov bl, dil
lea r8, [0x140034a24]
lea rdx, [0x14002f228]
lea rcx, [0x1400302d8]
call fcn.140026a88
mov edx, 0x42
test eax, eax
js 0x140026863
lea r9, [0x140034a40]
lea r8, [0x140034a28]
lea rdx, [0x14002f1c8]
lea rcx, [0x1400302e8]
call fcn.140026a88
mov edx, 0x43
test eax, eax
js 0x140026863
lea r9, [0x140034a48]
lea r8, [0x140034a2c]
lea rdx, [0x14002f1e8]
lea rcx, [0x1400302f8]
call fcn.140026a88
mov edx, 0x44
test eax, eax
js 0x140026863
mov rcx, qword [0x140034a18]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov edx, 0x50
test eax, eax
js 0x140026863
lea rcx, [0x14002d600]
call fcn.1400272a8
mov al, bl
jmp 0x1400268cf
mov r8d, eax
lea rcx, [0x14002d5c0]
call fcn.1400272a8
cmp dil, 1
jne 0x140026884
mov rcx, qword [0x140034a18]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
test bl, bl
je 0x1400268b4
mov ecx, dword [0x140034a20]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140034a24]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140034a28]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140034a2c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140034a18]
test rcx, rcx
je 0x1400268cd
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140034a18], 0
xor al, al
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x1400268e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp byte [0x140034a00], 0
jne 0x1400269b6
mov edx, 0x80
mov byte [0x140034a00], 1
lea rcx, [0x140034a50]
call fcn.140010aa0
lea rcx, [0x14002d540]
call fcn.1400272a8
mov dl, 1
lea rcx, [0x140034a08]
call fcn.14001563c
test al, al
jne 0x14002692e
xor al, al
jmp 0x1400269b8
mov rcx, qword [0x140034588]
lea r9, [0x140034a10]
xor r8d, r8d
lea rdx, [0x1400270d0]
call sub.fwpkclnt.sys_FwpmBfeStateSubscribeChanges0
test eax, eax
jns 0x140026971
lea rcx, [0x14002d560]
call fcn.1400272a8
lea rcx, [0x140034a08]
call fcn.1400155f0
and qword [0x140034a08], 0
jmp 0x140026927
call sub.fwpkclnt.sys_FwpmBfeStateGet0
cmp eax, 3
jne 0x1400269aa
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
mov rcx, qword [0x140034a08]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceSharedLite]
call fcn.1400266f8
mov rcx, qword [0x140034a08]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x1400269b6
lea rcx, [0x14002d5a0]
call fcn.1400272a8
mov al, 1
add rsp, 0x28
ret

Function at 0x140026a88
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
cmp qword [0x140034a18], 0
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
jne 0x140026ac1
mov eax, 0xc0000008
jmp 0x140026bd5
movups xmm0, xmmword [rcx]
mov rcx, qword [0x140034588]
lea rax, [0x140026f30]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [0x1400270c0]
mov qword [rsp + 0x40], rax
lea rax, [0x1400270b0]
mov qword [rsp + 0x48], rax
movdqu xmmword [rsp + 0x20], xmm0
call sub.fwpkclnt.sys_FwpsCalloutRegister1
test eax, eax
js 0x140026bd5
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call fcn.140029dc0
movups xmm0, xmmword [rbx]
mov rcx, qword [0x140034a18]
lea rax, [0x14002d6f0]
movups xmm1, xmmword [rdi]
and dword [rsp + 0x70], 0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x14002d710]
xor r8d, r8d
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x140026bd5
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xc8
call fcn.140029dc0
movups xmm0, xmmword [0x1400302b8]
and dword [rbp + 0x20], 0
lea rax, [0x14002d790]
movups xmm1, xmmword [rbx]
mov rcx, qword [0x140034a18]
lea rdx, [rbp - 0x50]
movdqu xmmword [rbp], xmm0
mov qword [rbp - 0x40], rax
lea rax, [0x14002d7b0]
movups xmm0, xmmword [rdi]
mov r9, rsi
mov qword [rbp - 0x38], rax
xor r8d, r8d
mov dword [rbp + 0x30], 0x5003
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x10], 1
mov byte [rbp + 0x18], 0xf
movdqu xmmword [rbp + 0x34], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140026c54
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [0x140034a18], 0
je 0x140026cb3
mov ecx, dword [0x140034a20]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140034a24]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140034a28]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140034a2c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140034a18]
test rcx, rcx
je 0x140026ca7
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140034a18], 0
lea rcx, [0x14002d630]
call fcn.1400272a8
add rsp, 0x28
ret

Function at 0x140038000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ecx, 0x10000
call fcn.14001c1bc
mov dl, 1
mov qword [0x1400345b8], rax
lea rcx, [0x1400345a8]
call fcn.14001563c
xor ebx, ebx
test al, al
je 0x140038072
mov r8d, dword [0x14002e9e0]
mov edx, 0xe0
mov ecx, dword [0x1400345c0]
mov byte [0x1400345b0], 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edx, edx
mov qword [0x140034598], rax
mov rdi, rax
test rax, rax
jne 0x14003807f
xor r9d, r9d
mov r8d, 0xc000009a
mov ecx, 0xc101045f
call fcn.1400154cc
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8d, 0xe0
mov rcx, rdi
call fcn.140029dc0
mov dword [rdi], 0xe0
lea rax, [0x140001d10]
mov qword [rdi + 0x50], rax
lea rcx, [0x1400024c0]
mov rax, qword [0x140034ba8]
lea rdx, [0x14003b110]
mov qword [rax + 0x50], rdi
mov rax, qword [0x140034ba8]
mov qword [rax + 0x70], rcx
lea rcx, [0x140002460]
mov rax, qword [0x140034ba8]
mov qword [rax + 0x100], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140034ba8]
lea rax, [0x140034588]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], bl
mov r9d, 0x22
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x14003812c
xor r9d, r9d
mov qword [0x140034588], rbx
xor edx, edx
mov r8d, eax
jmp 0x140038068
mov rax, qword [0x140034588]
lea rdx, [0x1400023d0]
mov ecx, 0x12340001
btr dword [rax + 0x30], 7
call fcn.140038204
lea rdx, [0x140002540]
mov ecx, 0x12340003
call fcn.140038204
lea rdx, [0x140001fd0]
mov ecx, 0x12340040
call fcn.140038204
lea rdx, [0x140001f20]
mov ecx, 0x12340026
call fcn.140038204
lea rdx, [0x140002ca0]
mov ecx, 0x12340033
call fcn.140038204
lea rdx, [0x1400070b0]
mov ecx, 0x12340017
call fcn.140038204
lea rdx, [0x140002760]
mov ecx, 0x12340041
call fcn.140038204
lea rdx, [0x1400028b0]
mov ecx, 0x12340044
call fcn.140038204
lea rdx, [0x140002b60]
mov ecx, 0x12340046
call fcn.140038204
lea rdx, [fcn.140002220]
mov ecx, 0x12340047
call fcn.140038204
mov rcx, qword [0x140034590]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140038072
xchg dword [0x140034028], ebx
mov al, 1
jmp 0x140038074
Function at 0x140038658
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov r8, qword [rcx + 0x78]
xor r10d, r10d
mov rbx, rcx
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add r9, rax
test r11d, r11d
je 0x14003869d
mov r8d, dword [r9 + 0xc]
cmp edx, r8d
jb 0x140038691
mov ecx, dword [r9 + 0x10]
add ecx, r8d
cmp edx, ecx
jb 0x1400386a5
add r9, 0x28
inc r10d
cmp r10d, r11d
jb 0x14003867d
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov eax, dword [r9 + 0x14]
add rax, qword [rbx + 0x70]
sub rax, r8
mov ecx, edx
add rax, rcx
jmp 0x14003869f