joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15450
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
xor ebx, ebx
mov rdi, rcx
cmp rsi, rbx
je 0x154c7
cmp dword [rdx + 8], 0x20
jb 0x154c7
cmp qword [0x00021240], rbx
jne 0x15491
lea rcx, [0x00021240]
mov edx, 0x640000
call fcn.000149cc
cmp eax, ebx
jl 0x154af
cmp qword [0x00020c28], rbx
jne 0x154f2
lea rcx, [0x00020c28]
mov edx, 0x40000
call fcn.000149cc
cmp eax, ebx
jge 0x154f2
lea rcx, [0x00021240]
call fcn.00014b4c
lea rcx, [0x00020c28]
call fcn.00014b4c
mov eax, 0xc0000001
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], eax
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x00021248]
mov qword [rsi], rax
mov rax, qword [0x00021258]
mov qword [rsi + 8], rax
mov rax, qword [0x00020c30]
mov qword [rsi + 0x10], rax
mov rax, qword [0x00020c40]
mov qword [rsi + 0x18], rax
call fcn.00012350
mov dword [rdi + 0x30], ebx
mov qword [rdi + 0x38], 0x20
jmp 0x154d5
Function at 0x1654c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rbx, rdx
test rcx, rcx
jne 0x1656f
mov ebx, 0xc000000d
jmp 0x16641
test byte [rcx + 0xa], 5
je 0x1657b
mov rax, qword [rcx + 0x18]
jmp 0x16597
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test rax, rax
je 0x16634
cmp dword [rbx + 8], 8
jb 0x16634
lea rdx, [rsp + 0x30]
lea rcx, [0x00021078]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rax, [0x000164e4]
xchg qword [rdi + 0x68], rax
cmp byte [rdi + 0x44], 0
je 0x165df
xor eax, eax
xchg qword [rdi + 0x68], rax
test rax, rax
je 0x165df
mov ebx, 0xc0000120
jmp 0x16615
mov rax, qword [rdi + 0xb8]
lea rcx, [rdi + 0xa8]
lea rdx, [0x00021260]
or byte [rax + 3], 1
mov rax, qword [0x00021268]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov ebx, 0x103
mov qword [0x00021268], rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
lea rcx, [0x00020c48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x16639
mov ebx, 0xc000009a
cmp ebx, 0x103
je 0x16654
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x18680
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
and dword [rax + 0x18], 0
and qword [rax - 0x28], 0
and qword [rax + 0x20], 0
cmp qword [0x00020c18], 0
mov rsi, rdx
mov rbx, rcx
jne 0x186e0
lea rdx, [0x0001e1c0]
lea rcx, [rax - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x00020c18], rax
test rax, rax
jne 0x186e0
mov eax, 0xc0000001
jmp 0x187f9
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x187f9
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x200
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
test eax, eax
jns 0x1873c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
jmp 0x187f9
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
lea rax, [rsp + 0x80]
lea edx, [r9 + 0x1b]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x00020c18]
mov edi, eax
cmp eax, 0xc0000004
jne 0x187d4
mov edx, dword [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x33544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x187d4
mov r9d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov r8, rbx
mov edx, 0x1b
mov qword [rsp + 0x20], rax
call qword [0x00020c18]
mov edi, eax
test eax, eax
js 0x187c9
cmp dword [rsp + 0x80], 0
je 0x187c9
mov qword [rsi], rbx
xor edi, edi
jmp 0x187d4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x187e7
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x187f7
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x18810
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbx, qword [rcx + 0x18]
mov r12d, dword [rdx + 8]
xor r13d, r13d
mov rsi, rcx
mov qword [rax + 8], r13
mov ebp, r13d
mov edi, r13d
cmp rbx, r13
je 0x18923
cmp dword [rdx + 0x10], 4
jb 0x18923
mov ecx, dword [rbx]
lea rdx, [rax + 8]
call fcn.00018680
cmp eax, r13d
mov edi, eax
jl 0x1891e
mov r8, qword [rsp + 0x40]
cmp r8, r13
je 0x1891e
mov rdx, qword [r8 + 8]
cmp rdx, r13
je 0x18911
cmp word [r8], r13w
je 0x18911
movzx ebp, word [r8]
add ebp, 2
cmp ebp, r12d
jbe 0x188ac
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, 0xc0000017
jmp 0x18923
mov ecx, ebp
shr rcx, 1
je 0x18911
cmp rcx, 0x7fff
ja 0x18911
test byte [r8], 1
jne 0x1890d
movzx eax, word [r8 + 2]
test al, 1
jne 0x1890d
cmp word [r8], ax
ja 0x1890d
mov r9d, 0xfffe
cmp ax, r9w
ja 0x1890d
movzx r9d, word [r8]
shr r9, 1
sub r9, rcx
sub rdx, rbx
lea rax, [r9 + rcx]
cmp rax, r13
je 0x18904
movzx eax, word [rdx + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x188ea
cmp rcx, r13
jne 0x1890d
sub rbx, 2
mov word [rbx], r13w
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x18923
mov edi, 0xc000000d
mov eax, ebp
xor edx, edx
mov rcx, rsi
mov qword [rsi + 0x38], rax
mov dword [rsi + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x18958
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, qword [rcx + 0x18]
xor edi, edi
mov rsi, rcx
cmp rbp, rdi
je 0x189e9
cmp dword [rdx + 8], 0x10
jb 0x189e9
cmp dword [rdx + 0x10], 4
jb 0x189e9
movsxd rbx, dword [rbp]
lea rdx, [rax - 0x28]
lea rcx, [0x00021588]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov rcx, qword [0x000216d0]
mov rdx, rbx
call fcn.000116a8
mov r10, rax
cmp rax, rdi
je 0x189c6
mov rax, qword [rax + 0x30]
mov bl, 1
mov qword [rbp], rax
mov rax, qword [r10 + 0x38]
mov qword [rbp + 8], rax
jmp 0x189c9
mov bl, dil
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
cmp bl, dil
je 0x189e3
mov qword [rsi + 0x38], 0x10
jmp 0x189f2
mov qword [rsi + 0x38], rdi
jmp 0x189ed
mov qword [rcx + 0x38], rdi
mov edi, 0xc000000d
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x18a20
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rcx + 0x18]
mov rdi, rcx
test rsi, rsi
je 0x18aa7
cmp dword [rdx + 0x10], 0x53
jb 0x18aa7
call fcn.00012f8c
mov rbx, rax
test rax, rax
je 0x18aa0
lea rcx, [rax + 0x10]
mov rdx, rsi
mov r8d, 0x53
call fcn.0001dae0
lea rdx, [rsp + 0x20]
lea rcx, [0x00020b40]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov r11, qword [0x00020a38]
lea rax, [0x00020a30]
mov qword [rbx + 8], r11
mov qword [rbx], rax
mov qword [r11], rbx
lea rcx, [rsp + 0x20]
mov qword [0x00020a38], rbx
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor ebx, ebx
jmp 0x18aac
mov ebx, 0xc0000017
jmp 0x18aac
mov ebx, 0xc000000d
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18ad8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x00020b40]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rsi, [0x00020a20]
jmp 0x18b22
mov rax, qword [rcx]
mov qword [0x00020a20], rax
mov qword [rax + 8], rsi
call fcn.00012ff4
mov rcx, qword [0x00020a20]
cmp rcx, rsi
jne 0x18b0f
xor ecx, ecx
lea r10, [0x00020a30]
jmp 0x18bfb
mov rax, qword [rdx]
mov qword [0x00020a30], rax
mov qword [rax + 8], r10
mov rax, qword [0x00020a28]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov qword [0x00020a28], rdx
cmp dword [rdx + 0x10], 6
jne 0x18be3
or ecx, 1
cmp word [rdx + 0x1d], 0x17
mov dword [0x00020b58], ecx
jne 0x18bf2
mov r9, qword [rdx + 0x1f]
xor eax, eax
lea r8, [rsp + 0x38]
mov byte [rsp + 0x47], al
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], 1
cmp r9, qword [r8]
jne 0x18bae
mov r9, qword [rdx + 0x27]
cmp r9, qword [r8 + 8]
je 0x18bb3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18bbc
or ecx, 8
jmp 0x18bec
mov r9, qword [rdx + 0x3f]
lea r8, [rsp + 0x38]
cmp r9, qword [r8]
jne 0x18bd8
mov r9, qword [rdx + 0x47]
cmp r9, qword [r8 + 8]
jne 0x18bd8
xor eax, eax
jmp 0x18bdd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18bf2
jmp 0x18bb7
cmp dword [rdx + 0x10], 0x11
jne 0x18bf2
or ecx, 2
mov dword [0x00020b58], ecx
test byte [rdx + 0x5f], 0x80
je 0x18c01
or ecx, 4
mov dword [0x00020b58], ecx
mov rdx, qword [0x00020a30]
cmp rdx, r10
jne 0x18b3c
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
and dword [rbx + 0x30], 0
and qword [rbx + 0x38], 0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.0001d870
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x18c50
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x18c7b
cmp dword [rdx + 0x10], 0x24a
jb 0x18c7b
mov dl, r8b
call fcn.00013ca0
xor ebx, ebx
jmp 0x18c80
mov ebx, 0xc000000d
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18ca8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x18cd3
cmp dword [rdx + 0x10], 0x25b
jb 0x18cd3
mov dl, r8b
call fcn.000131c4
xor ebx, ebx
jmp 0x18cd8
mov ebx, 0xc000000d
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x19248
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x58]
call fcn.0001dec0
mov rcx, qword [0x000216c8]
and dword [rsp + 0x80], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001e200]
lea r12, [0x0001e240]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x193a3
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0xc8
call fcn.0001dec0
and dword [rsp + 0x120], 0
lea rax, [rsp + 0x30]
movdqu xmm0, xmmword [rbx]
movdqu xmm5, xmmword [rdi]
mov ebx, 1
lea rcx, [rsp + 0x30]
xor edx, edx
movdqu xmmword [rsp + 0x144], xmm0
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rsp + 0x100], xmm5
lea r8d, [rbx + 0x27]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov dword [rsp + 0x140], 0x5003
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x130], ebx
movdqu xmmword [rsp + 0x110], xmm0
call fcn.0001dec0
mov rcx, qword [0x000216c8]
and dword [rsp + 0x40], 0
movdqu xmm5, xmmword [0x0001f500]
movdqu xmmword [rsp + 0x30], xmm5
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x50], 6
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.0001d870
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
ret
Function at 0x193d0
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x58]
call fcn.0001dec0
mov rcx, qword [0x000216c8]
and dword [rsp + 0x50], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001e280]
lea r12, [0x0001e2b0]
lea rdx, [rsp + 0x30]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x40], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x194f1
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0xc8
call fcn.0001dec0
mov rcx, qword [0x000216c8]
and qword [rsp + 0x108], 0
movdqu xmm5, xmmword [rdi]
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rsi]
and dword [rsp + 0xf0], 0
and dword [rsp + 0x100], 0
lea rdx, [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
movdqu xmmword [rsp + 0xd0], xmm5
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0x110], 0x5003
movdqu xmmword [rsp + 0x114], xmm0
movdqu xmmword [rsp + 0xe0], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.0001d870
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x170
pop r12
pop rdi
pop rsi
ret

Function at 0x1951c
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x58]
call fcn.0001dec0
mov rcx, qword [0x000216c8]
and dword [rsp + 0x80], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001e200]
lea r12, [0x0001e240]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x19677
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0xc8
call fcn.0001dec0
and dword [rsp + 0x120], 0
lea rax, [rsp + 0x30]
movdqu xmm0, xmmword [rbx]
movdqu xmm5, xmmword [rdi]
mov ebx, 1
lea rcx, [rsp + 0x30]
xor edx, edx
movdqu xmmword [rsp + 0x144], xmm0
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rsp + 0x100], xmm5
lea r8d, [rbx + 0x27]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov dword [rsp + 0x140], 0x5003
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x130], ebx
movdqu xmmword [rsp + 0x110], xmm0
call fcn.0001dec0
mov rcx, qword [0x000216c8]
and dword [rsp + 0x40], 0
movdqu xmm5, xmmword [0x0001f500]
movdqu xmmword [rsp + 0x30], xmm5
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x50], 0x11
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.0001d870
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
ret
Function at 0x23064
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00023008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00011340
Function at 0x180002b73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10d, ecx
xor ebx, ebx
movsxd rcx, dword [rdx + 0x3c]
mov r12d, r9d
add rcx, rdx
mov r13d, r8d
mov rsi, rdx
mov eax, dword [rcx + r10*8 + 0x88]
add rax, rdx
mov edi, dword [rax + 0x20]
mov ebp, dword [rax + 0x1c]
add rdi, rdx
mov r14d, dword [rax + 0x24]
add rbp, rdx
mov r15d, dword [rax + 0x18]
add r14, rdx
test r15d, r15d
je 0x180002be8
mov edx, dword [rdi]
mov ecx, r12d
add rdx, rsi
call fcn.180002b3b
cmp eax, r13d
je 0x180002c07
inc ebx
add rdi, 4
cmp ebx, r15d
jb 0x180002bcb
xor eax, eax
movzx ecx, word [r14 + rbx*2]
mov eax, dword [rbp + rcx*4]

Function at 0x180002c7f
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov esi, ecx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
jmp 0x180002cb6
mov rcx, qword [rbx + 0x60]
call fcn.180002cd3
cmp esi, eax
je 0x180002ccd
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180002ca6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x180002cbd

Function at 0x180004610
Capabilities:
Decompress data using quicklz

Disassembly:
endbr64
jmp fcn.180033090
Function at 0x140788058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407881df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140788089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078806f
add dl, dl
jne 0x140788096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407880f6
xor eax, eax
add dl, dl
jne 0x1407880a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407881ad
add dl, dl
jne 0x1407880b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407880c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407880d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407880dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407880ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14078807e
mov eax, 1
add dl, dl
jne 0x140788106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140788113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407880fb
sub eax, ebx
mov ebx, 1
jne 0x14078814c
mov ecx, 1
add dl, dl
jne 0x14078812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140788123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140788168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140788175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078815d
cmp eax, 0x7d00
jae 0x14078819b
cmp eax, 0x500
jb 0x140788196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078807e
cmp eax, 0x7f
ja 0x14078819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407881d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14078807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18000104b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x18000d030
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x270
jmp 0x18000d04a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x4e0
jge 0x18000d0dc
mov eax, dword [rsp]
sub eax, 0x270
cdqe
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4 + 4]
and eax, 0x80000000
mov ecx, dword [rsp]
sub ecx, 0x26f
movsxd rcx, ecx
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rdx + rcx*4 + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
and eax, 1
test eax, eax
je 0x18000d0a3
mov dword [rsp + 8], 0x9908b0df
jmp 0x18000d0ab
mov dword [rsp + 8], 0
mov eax, dword [rsp + 4]
shr eax, 1
xor eax, dword [rsp + 8]
mov ecx, dword [rsp]
sub ecx, 0xe3
movsxd rcx, ecx
mov rdx, qword [rsp + 0x20]
xor eax, dword [rdx + rcx*4 + 4]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x20]
mov dword [rdx + rcx*4 + 4], eax
jmp 0x18000d042
add rsp, 0x18
ret
Function at 0x180001442
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x180002fa0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1448
call fcn.180232950
sub rsp, rax
mov qword [rsp + 0x1428], 0xfffffffffffffffe
mov rax, qword [0x18044e0b8]
xor rax, rsp
mov qword [rsp + 0x1438], rax
mov byte [rsp + 0x13f8], 0x20
mov rax, qword [rsp + 0x1450]
mov qword [rsp + 0x13f0], rax
mov rax, qword [rsp + 0x1458]
cmp qword [rsp + 0x13f0], rax
je 0x180003075
mov rax, qword [rsp + 0x13f0]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x13f8]
call sym.OverClocking.dll_OrtSessionOptionsAppendExecutionProviderEx_DML
mov byte [rsp + 0x13f8], al
movzx eax, byte [rsp + 0x13f8]
mov dword [rsp + 0x1430], eax
mov rcx, qword [rsp + 0x13f0]
movzx ecx, byte [rcx]
imul ecx, ecx, 0x8f85
mov eax, ecx
cdq
mov ecx, 0x26c
idiv ecx
mov ecx, dword [rsp + 0x1430]
add ecx, eax
mov eax, ecx
xor eax, 0x46
mov byte [rsp + 0x13f8], al
mov rax, qword [rsp + 0x13f0]
inc rax
mov qword [rsp + 0x13f0], rax
jmp 0x180002fed
lea rdx, [0x180330957]
lea rcx, [rsp + 0x1400]
call fcn.180001005
nop
lea rdx, [rsp + 0x1400]
lea rcx, [rsp + 0x54]
call fcn.1800014d8
nop
lea rcx, [rsp + 0x1400]
call fcn.180001519
lea rcx, [rsp + 0x54]
call fcn.180001244
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.18000118b
mov r8b, 0x78
mov dl, 0xab
lea rcx, [rsp + 0x50]
call fcn.1800010f5
mov dword [rsp + 0x13fc], 0
jmp 0x1800030f8
mov eax, dword [rsp + 0x13fc]
inc eax
mov dword [rsp + 0x13fc], eax
cmp dword [rsp + 0x13fc], 0x1bbc
jge 0x18000312d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180001041
movzx edx, al
movzx ecx, byte [rsp + 0x13f8]
call sym.OverClocking.dll_OrtSessionOptionsAppendExecutionProviderEx_DML
mov byte [rsp + 0x13f8], al
jmp 0x1800030e8
movzx eax, byte [rsp + 0x13f8]
mov rcx, qword [rsp + 0x1438]
xor rcx, rsp
call fcn.180232920
add rsp, 0x1448
ret