joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x4f4df9
push rbp
mov rbp, rsp
sub rsp, 0x118
nop dword [rax]
cmp cl, 0x10
jae 0x4f4de5
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rbx
mov byte [rsp + 0x138], cl
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x108], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x110], rsi
mov rsi, qword [rbx]
mov r8, qword [rdx]
mov qword [rsi], r8
movups xmm0, xmmword [rdx + 8]
movups xmmword [rsi + 8], xmm0
movups xmm0, xmmword [rdx + 0x18]
movups xmmword [rsi + 0x18], xmm0
movups xmm0, xmmword [rdx + 0x28]
movups xmmword [rsi + 0x28], xmm0
movups xmm0, xmmword [rdx + 0x38]
movups xmmword [rsi + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
nop
jmp 0x4f4db3
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
nop
call sym.crypto_internal_nistec._P521Point_.Select
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x4f4dcd
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4f4d62
jmp 0x4f4dd6
add rsp, 0x118
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
nop
call sym.runtime.panicIndex
lea rax, [0x0053c840]
lea rbx, [0x007056e0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax + rax]
jmp sym.crypto_internal_nistec._p521Table_.Select
Function at 0x4f7d20
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x4f7d6d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x4f7e00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x4f7e45
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x4fc980
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fcb95
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x80], rcx
mov rdx, qword [rax + 8]
mov rdx, qword [rdx + 8]
mov r9, qword [rdx + 0x10]
lea r10, [r9 - 1]
test r10, r10
jl 0x4fca10
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx + r9*8 - 8]
mov r9, rdx
shr rdx, 1
or rdx, r9
mov r9, rdx
shr rdx, 2
or rdx, r9
mov r9, rdx
shr rdx, 4
or rdx, r9
mov r9, rdx
shr rdx, 8
or rdx, r9
mov r9, rdx
shr rdx, 0x10
or rdx, r9
mov r9, rdx
shr rdx, 0x20
or rdx, r9
shl r10, 6
bsr rdx, rdx
mov r9, 0xffffffffffffffff
cmove rdx, r9
lea rdx, [rdx + r10]
lea rdx, [rdx + 1]
jmp 0x4fca12
xor edx, edx
lea r9, [rdx + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rdx, [r9 + rdx]
lea rdx, [rdx + 7]
sar rdx, 3
cmp rdi, rdx
je 0x4fcaf7
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x88], rdi
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
movups xmmword [rsp + 0x50], xmm15
xor eax, eax
xor ebx, ebx
mov r8, rsi
mov rsi, rdi
mov rdi, rcx
mov rcx, rbx
call sym.math_big.nat.setBytes
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jle 0x4fcab3
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 8]
mov rcx, qword [rdx + 8]
lea rax, [rsp + 0x40]
mov rbx, rax
call sym.math_big._Int_.Mod
mov rcx, qword [rsp + 0x30]
lea rax, [0x0053c8c0]
mov rbx, rcx
nop dword [rax]
call sym.runtime.makeslice
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x4fcae6
mov qword [rsp + 0x38], rax
mov rbx, rcx
call sym.runtime.memclrNoHeapPointers
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rdx, rcx
xor ebx, ebx
jmp 0x4fcb09
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
add rsp, 0x60
pop rbp
ret
inc rbx
cmp rbx, rdi
jge 0x4fcb17
mov r8, qword [rsi + rbx*8]
xor r9d, r9d
jmp 0x4fcb56
test rcx, rcx
jge 0x4fcb25
xor ecx, ecx
nop
jmp 0x4fcb25
inc rcx
cmp rcx, rdx
jge 0x4fcb35
jae 0x4fcb41
movzx esi, byte [rax + rcx]
test sil, sil
je 0x4fcb22
mov rbx, rdx
mov rcx, rbx
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov rcx, rdx
call sym.runtime.panicIndex
inc r9
shr r8, 8
mov rcx, r10
cmp r9, 8
jge 0x4fcb06
lea r10, [rcx - 1]
test r10, r10
jl 0x4fcb71
cmp rdx, r10
jbe 0x4fcb89
mov byte [rcx + rax - 1], r8b
jmp 0x4fcb4c
test r8b, r8b
je 0x4fcb4c
lea rax, [0x0053c840]
lea rbx, [0x00705540]
call sym.runtime.gopanic
mov rax, r10
mov rcx, rdx
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp sym.crypto_elliptic._nistCurve_go.shape.uint8__.normalizeScalar
Function at 0x140177a14
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140177884

Function at 0x140189070
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1417ef6b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14017b384
xor ebx, ebx
cmp qword [0x1417fd178], rbx
mov rdi, rax
jne 0x140189183
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14018925a
lea rdx, [0x1401fb6e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14018925a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401fb6d8]
mov rcx, rsi
mov qword [0x1417fd178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401fb6c0]
mov rcx, rsi
mov qword [0x1417fd180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1417fd188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1417fd198], rax
test rax, rax
je 0x14018917a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1417fd190], rax
jmp 0x14018918a
mov rax, qword [0x1417fd190]
jmp 0x140189191
mov rax, qword [0x1417fd190]
mov r11, qword [0x1417fd198]
cmp rax, rdi
je 0x1401891f8
cmp r11, rdi
je 0x1401891f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1417fd198]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1401891f8
test rax, rax
je 0x1401891f8
call rsi
test rax, rax
je 0x1401891f2
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1401891f2
test byte [rsp + 0x40], 1
jne 0x1401891f8
bts ebp, 0x15
jmp 0x140189238
mov rcx, qword [0x1417fd180]
cmp rcx, rdi
je 0x140189238
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140189238
call rax
mov rbx, rax
test rax, rax
je 0x140189238
mov rcx, qword [0x1417fd188]
cmp rcx, rdi
je 0x140189238
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140189238
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1417fd178]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14018925a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14018925c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140173730
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1363c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
xor ebx, ebx
mov rdi, rcx
cmp rsi, rbx
je 0x136b3
cmp dword [rdx + 8], 0x20
jb 0x136b3
cmp qword [0x0001c988], rbx
jne 0x1367d
lea rcx, [0x0001c988]
mov edx, 0x640000
call fcn.00012d60
cmp eax, ebx
jl 0x1369b
cmp qword [0x0001c448], rbx
jne 0x136de
lea rcx, [0x0001c448]
mov edx, 0x40000
call fcn.00012d60
cmp eax, ebx
jge 0x136de
lea rcx, [0x0001c988]
call fcn.00012ee0
lea rcx, [0x0001c448]
call fcn.00012ee0
mov eax, 0xc0000001
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], eax
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x0001c990]
mov qword [rsi], rax
mov rax, qword [0x0001c9a0]
mov qword [rsi + 8], rax
mov rax, qword [0x0001c450]
mov qword [rsi + 0x10], rax
mov rax, qword [0x0001c460]
mov qword [rsi + 0x18], rax
call fcn.00011eb8
mov dword [rdi + 0x30], ebx
mov qword [rdi + 0x38], 0x20
jmp 0x136c1
Function at 0x144b8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rbx, rdx
test rcx, rcx
jne 0x144db
mov ebx, 0xc000000d
jmp 0x145ad
test byte [rcx + 0xa], 5
je 0x144e7
mov rax, qword [rcx + 0x18]
jmp 0x14503
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test rax, rax
je 0x145a0
cmp dword [rbx + 8], 8
jb 0x145a0
lea rdx, [rsp + 0x30]
lea rcx, [0x0001c6b8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rax, [0x00014450]
xchg qword [rdi + 0x68], rax
cmp byte [rdi + 0x44], 0
je 0x1454b
xor eax, eax
xchg qword [rdi + 0x68], rax
test rax, rax
je 0x1454b
mov ebx, 0xc0000120
jmp 0x14581
mov rax, qword [rdi + 0xb8]
lea rcx, [rdi + 0xa8]
lea rdx, [0x0001c9a8]
or byte [rax + 3], 1
mov rax, qword [0x0001c9b0]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov ebx, 0x103
mov qword [0x0001c9b0], rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
lea rcx, [0x0001c470]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueDpc]
jmp 0x145a5
mov ebx, 0xc000009a
cmp ebx, 0x103
je 0x145c0
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x15ebc
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
and dword [rax + 0x18], 0
and qword [rax - 0x28], 0
and qword [rax + 0x20], 0
cmp qword [0x0001c3b0], 0
mov rsi, rdx
mov rbx, rcx
jne 0x15f1c
lea rdx, [0x0001a760]
lea rcx, [rax - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x0001c3b0], rax
test rax, rax
jne 0x15f1c
mov eax, 0xc0000001
jmp 0x16032
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x16032
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
test eax, eax
jns 0x15f75
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
jmp 0x16032
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
lea rax, [rsp + 0x80]
lea edx, [r9 + 0x1b]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x0001c3b0]
mov edi, eax
cmp eax, 0xc0000004
jne 0x1600d
mov edx, dword [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x33544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1600d
mov r9d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov r8, rbx
mov edx, 0x1b
mov qword [rsp + 0x20], rax
call qword [0x0001c3b0]
mov edi, eax
test eax, eax
js 0x16002
cmp dword [rsp + 0x80], 0
je 0x16002
mov qword [rsi], rbx
xor edi, edi
jmp 0x1600d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x16020
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x16030
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x16048
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov r12d, dword [rdx + 8]
xor ebx, ebx
mov rsi, rcx
mov qword [rax + 8], rbx
mov ebp, ebx
cmp rdi, rbx
je 0x16146
cmp dword [rdx + 0x10], 4
jb 0x16146
mov ecx, dword [rdi]
lea rdx, [rax + 8]
call fcn.00015ebc
cmp eax, ebx
jl 0x16146
mov r8, qword [rsp + 0x40]
cmp r8, rbx
je 0x16146
mov rdx, qword [r8 + 8]
cmp rdx, rbx
je 0x1613b
cmp word [r8], bx
je 0x1613b
movzx ebp, word [r8]
add ebp, 2
cmp ebp, r12d
jbe 0x160d7
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, 0xc0000017
jmp 0x16146
mov ecx, ebp
shr rcx, 1
je 0x1613b
cmp rcx, 0x7fff
ja 0x1613b
test byte [r8], 1
jne 0x16138
movzx eax, word [r8 + 2]
test al, 1
jne 0x16138
cmp word [r8], ax
ja 0x16138
mov r9d, 0xfffe
cmp ax, r9w
ja 0x16138
movzx r9d, word [r8]
shr r9, 1
sub r9, rcx
sub rdx, rdi
lea rax, [r9 + rcx]
cmp rax, rbx
je 0x1612f
movzx eax, word [rdx + rdi]
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x16115
cmp rcx, rbx
jne 0x16138
sub rdi, 2
mov word [rdi], bx
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, ebp
xor edx, edx
mov dword [rsi + 0x30], ebx
mov qword [rsi + 0x38], rcx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x16a0c
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x58]
call fcn.0001a170
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x80], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001a7a0]
lea r12, [0x0001a7e0]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x16b67
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0xc8
call fcn.0001a170
and dword [rsp + 0x120], 0
lea rax, [rsp + 0x30]
movdqu xmm0, xmmword [rbx]
movdqu xmm5, xmmword [rdi]
mov ebx, 1
lea rcx, [rsp + 0x30]
xor edx, edx
movdqu xmmword [rsp + 0x144], xmm0
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rsp + 0x100], xmm5
lea r8d, [rbx + 0x27]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov dword [rsp + 0x140], 0x5003
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x130], ebx
movdqu xmmword [rsp + 0x110], xmm0
call fcn.0001a170
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x40], 0
movdqu xmm5, xmmword [0x0001b400]
movdqu xmmword [rsp + 0x30], xmm5
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x50], 6
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00019e90
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
ret

Function at 0x16b94
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x58]
call fcn.0001a170
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x50], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001a820]
lea r12, [0x0001a850]
lea rdx, [rsp + 0x30]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x40], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x16cb5
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0xc8
call fcn.0001a170
mov rcx, qword [0x0001ccd8]
and qword [rsp + 0x108], 0
movdqu xmm5, xmmword [rdi]
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rsi]
and dword [rsp + 0xf0], 0
and dword [rsp + 0x100], 0
lea rdx, [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
movdqu xmmword [rsp + 0xd0], xmm5
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0x110], 0x5003
movdqu xmmword [rsp + 0x114], xmm0
movdqu xmmword [rsp + 0xe0], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.00019e90
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x170
pop r12
pop rdi
pop rsi
ret
Function at 0x16ce0
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x58]
call fcn.0001a170
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x80], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001a7a0]
lea r12, [0x0001a7e0]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x16e3b
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0xc8
call fcn.0001a170
and dword [rsp + 0x120], 0
lea rax, [rsp + 0x30]
movdqu xmm0, xmmword [rbx]
movdqu xmm5, xmmword [rdi]
mov ebx, 1
lea rcx, [rsp + 0x30]
xor edx, edx
movdqu xmmword [rsp + 0x144], xmm0
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rsp + 0x100], xmm5
lea r8d, [rbx + 0x27]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov dword [rsp + 0x140], 0x5003
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x130], ebx
movdqu xmmword [rsp + 0x110], xmm0
call fcn.0001a170
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x40], 0
movdqu xmm5, xmmword [0x0001b400]
movdqu xmmword [rsp + 0x30], xmm5
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x50], 0x11
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00019e90
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
ret