joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400235b4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
and qword [rbp - 0x19], 0
mov r14d, r9d
mov rdi, r8
mov rsi, rdx
test rcx, rcx
je 0x140023698
test rdx, rdx
je 0x140023698
test r8, r8
je 0x140023698
mov rdx, rcx
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0x17], 0
lea rax, [rbp - 0x11]
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 0xf]
lea rax, [rbp + 0x67]
mov dword [rbp + 0xf], 0x30
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x19]
and dword [rsp + 0x28], 0
xorps xmm0, xmm0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x20006
mov dword [rbp + 0x27], 0x240
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov ebx, eax
test eax, eax
jne 0x140023685
mov rdx, rsi
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x19]
lea r9d, [rbx + 3]
xor r8d, r8d
mov dword [rsp + 0x28], r14d
lea rdx, [rbp - 1]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140023694
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x14002369d
mov eax, 0xc000000d
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140023814
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
or rbp, 0xffffffffffffffff
mov r14, rcx
mov rdi, rbp
xor r15d, r15d
inc rdi
cmp word [rcx + rdi*2], r15w
jne 0x140023839
mov edx, 0x10000
add di, di
mov dword [rsp + 0x48], edx
mov ebx, r15d
jmp 0x14002389c
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rsi
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400238b8
mov eax, ebx
inc ebx
cmp eax, 0x64
jae 0x1400238e4
mov edx, dword [str.sboxS]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [rsp + 0x48]
mov eax, ebx
shl eax, 0xc
add ecx, eax
mov dword [rsp + 0x48], ecx
mov edx, ecx
mov r8d, dword [str.sboxS]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x140023854
jmp 0x1400238f3
test eax, eax
js 0x1400238e4
mov rbx, rsi
cmp word [rbx + 0x38], di
jne 0x1400238d5
mov rdx, qword [rbx + 0x40]
mov rcx, r14
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x1400238e0
mov eax, dword [rbx]
test eax, eax
je 0x1400238e4
add rbx, rax
jmp 0x1400238bf
mov rbp, qword [rbx + 0x50]
mov edx, dword [str.sboxS]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140023990
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call fcn.140023434
test al, al
je 0x1400239e6
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400239e4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov rcx, rax
lea rdx, [0x14002c060]
call sub.ntoskrnl.exe__stricmp
mov rcx, qword [rsp + 0x38]
test eax, eax
sete bl
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400239f4
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140023a23
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsIsProtectedProcess]
mov rcx, qword [rsp + 0x38]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
add rsp, 0x20
pop rbx
ret
Function at 0x140023ab4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor edi, edi
mov dword [rbp - 0x20], 0x52534d42
mov rbx, rcx
mov qword [rbp - 0x18], rdi
lea r9, [rbp + 0x28]
lea rdx, [rbp - 0x20]
lea r8d, [rdi + 0x14]
lea r15d, [rdi + 1]
mov dword [rbp + 0x28], r8d
lea ecx, [rdi + 0x4c]
mov dword [rbp - 0x1c], r15d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000023
jne 0x140023c69
mov r14d, dword [rbp - 0x14]
mov r8d, 0x7668704b
mov ecx, r15d
lea eax, [r14 + 0x14]
mov edx, eax
mov dword [rbp + 0x28], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x140023c69
movups xmm0, xmmword [rbp - 0x20]
lea r9, [rbp + 0x28]
lea ecx, [rdi + 0x4c]
movups xmmword [rax], xmm0
mov edx, dword [rbp - 0x10]
mov dword [rax + 0x10], edx
mov rdx, rax
mov dword [rax + 0xc], r14d
mov r8d, dword [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x140023c56
mov eax, dword [rsi + 0x14]
lea rcx, [rsi + 0x18]
add rcx, rax
lea r8, [rsi + 0x18]
cmp r8, rcx
jae 0x140023c56
movzx eax, byte [r8 + 1]
cmp al, 4
jb 0x140023c56
cmp byte [r8], r15b
jne 0x140023b8d
cmp al, 0x19
jae 0x140023bab
add rax, r8
jmp 0x140023ba0
cmp byte [rax], dil
jne 0x140023b9d
cmp byte [rax + 1], dil
je 0x140023ba5
add rax, r15
cmp rax, rcx
jb 0x140023b92
lea r8, [rax + 2]
jmp 0x140023b6e
mov r9d, 8
mov r10b, r15b
add r8, r9
mov r11b, r15b
mov r14, rdi
test r10b, r10b
jne 0x140023bc7
test r11b, r11b
je 0x140023bfa
mov dl, byte [r14 + r8]
mov ecx, edi
add r14, r15
movzx eax, r10b
test dl, dl
cmove ecx, eax
cmp dl, 0xff
mov r10b, cl
movzx eax, r11b
mov ecx, edi
cmove ecx, eax
mov r11b, cl
cmp r14, 0x10
jl 0x140023bbd
test r10b, r10b
jne 0x140023c56
test cl, cl
jne 0x140023c56
mov al, byte [r8 + 3]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 2]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 1]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 5]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 4]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 7]
mov byte [rbx], al
add rbx, r15
mov al, byte [r8 + 6]
mov byte [rbx], al
add rbx, r15
mov al, byte [r9 + r8]
add r9, r15
mov byte [rbx], al
add rbx, r15
cmp r9, 0x10
jl 0x140023c41
mov dil, r15b
mov edx, 0x7668704b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, dil
jmp 0x140023c6b
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140023e60
Capabilities:
Get file attributes
Hash data via bcrypt
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
and qword [rbp + 0x7f], 0
mov rdi, rcx
lea rcx, [rbp - 0x29]
mov r15, r8
mov r12, rdx
call fcn.14002512c
mov ebx, eax
test eax, eax
js 0x140024006
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x39]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
and qword [rbp + 0xf], 0
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov qword [rbp + 0x17], rdi
mov edx, 0x120089
mov edi, 1
mov dword [rbp + 7], 0x30
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x200
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140024006
mov rcx, qword [rbp + 0x7f]
lea r9d, [rdi + 0x17]
lea r8, [rbp - 0x11]
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140024006
mov rax, qword [rbp - 9]
test rax, rax
jg 0x140023f48
mov ebx, 0xc0000001
jmp 0x140024006
cmp rax, 0x8000000
jle 0x140023f5a
mov ebx, 0xc0000904
jmp 0x140024006
mov edx, 0x2000
mov r8d, 0x7668704b
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x140023f7f
mov ebx, 0xc000009a
jmp 0x140024006
mov edi, dword [rbp - 9]
test edi, edi
je 0x140023fe7
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 0x39]
mov esi, 0x2000
cmp edi, esi
cmovb esi, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140023ff8
cmp dword [rbp - 0x31], esi
jne 0x14002403c
mov rcx, qword [rbp - 0x21]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call sub.ksecdd.sys_BCryptHashData
mov ebx, eax
test eax, eax
js 0x140023ff8
sub edi, esi
jne 0x140023f86
mov r8, r15
lea rcx, [rbp - 0x29]
mov rdx, r12
call fcn.14002502c
mov ebx, eax
mov edx, 0x7668704b
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140024015
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rbp - 0x29]
call fcn.1400250e0
lea r11, [rsp + 0xd0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ebx, 0xc00000e5
jmp 0x140023ff8
Function at 0x1400240d0
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and dword [rax - 0x78], 0
lea r9, [rbp - 9]
and qword [rax - 0x80], 0
mov rdi, r8
and qword [rbp + 0x67], 0
lea r8, [rbp + 0x1f]
and qword [rbp + 0x27], 0
mov rsi, rdx
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
mov edx, 0x120089
mov dword [rsp + 0x30], 1
mov qword [rbp + 0x2f], rcx
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x1f], 0x30
mov dword [rbp + 0x37], 0x200
movdqu xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140024206
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 7]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140024206
mov rax, qword [rbp + 0xf]
test rax, rax
jg 0x14002419b
mov ebx, 0xc0000001
jmp 0x140024206
cmp rax, 0x20000
jle 0x1400241aa
mov ebx, 0xc0000904
jmp 0x140024206
mov dword [rdi], eax
mov ecx, 1
mov r8d, dword [str.sboxS]
mov edx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
jne 0x1400241d2
mov ebx, 0xc000009a
jmp 0x140024206
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov eax, dword [rdi]
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x67]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140024215
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140024e0c
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
xor ebp, ebp
lea rcx, [rax - 0x28]
mov qword [rax - 0x30], rbp
mov edi, edx
call fcn.14002512c
mov ebx, eax
test eax, eax
js 0x140024e7d
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call sub.ksecdd.sys_BCryptHashData
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14002502c
test eax, eax
mov ebx, eax
cmovns ebx, ebp
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140024e7d
mov edx, 0x7668704b
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140025778
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp qword [0x140033a18], 0
je 0x140025796
mov al, 1
jmp 0x14002594f
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x48]
call fcn.140028e40
xor r8d, r8d
mov dword [rsp + 0x50], 1
lea rax, [0x140033a18]
xor ecx, ecx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor dil, dil
xor bl, bl
lea edx, [r8 + 0xa]
call sub.fwpkclnt.sys_FwpmEngineOpen0
mov edx, 0x10
test eax, eax
js 0x1400258e3
mov rcx, qword [0x140033a18]
xor edx, edx
call sub.fwpkclnt.sys_FwpmTransactionBegin0
mov edx, 0x20
test eax, eax
js 0x1400258e3
mov dil, 1
call fcn.140025c70
mov edx, 0x30
test eax, eax
js 0x1400258e3
lea r9, [0x140033a30]
lea r8, [0x140033a20]
lea rdx, [0x14002e1b8]
lea rcx, [0x14002f278]
call fcn.140025b08
mov edx, 0x41
test eax, eax
js 0x1400258e3
lea r9, [0x140033a38]
mov bl, dil
lea r8, [0x140033a24]
lea rdx, [0x14002e1d8]
lea rcx, [0x14002f288]
call fcn.140025b08
mov edx, 0x42
test eax, eax
js 0x1400258e3
lea r9, [0x140033a40]
lea r8, [0x140033a28]
lea rdx, [0x14002e178]
lea rcx, [0x14002f298]
call fcn.140025b08
mov edx, 0x43
test eax, eax
js 0x1400258e3
lea r9, [0x140033a48]
lea r8, [0x140033a2c]
lea rdx, [0x14002e198]
lea rcx, [0x14002f2a8]
call fcn.140025b08
mov edx, 0x44
test eax, eax
js 0x1400258e3
mov rcx, qword [0x140033a18]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov edx, 0x50
test eax, eax
js 0x1400258e3
lea rcx, [0x14002c480]
call sub.ntoskrnl.exe_DbgPrint
mov al, bl
jmp 0x14002594f
mov r8d, eax
lea rcx, [0x14002c440]
call sub.ntoskrnl.exe_DbgPrint
cmp dil, 1
jne 0x140025904
mov rcx, qword [0x140033a18]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
test bl, bl
je 0x140025934
mov ecx, dword [0x140033a20]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a24]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a28]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a2c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140033a18]
test rcx, rcx
je 0x14002594d
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140033a18], 0
xor al, al
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140025960
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp byte [0x140033a00], 0
jne 0x140025a36
mov edx, 0x80
mov byte [0x140033a00], 1
lea rcx, [0x140033a50]
call fcn.140010970
lea rcx, [0x14002c3c0]
call sub.ntoskrnl.exe_DbgPrint
mov dl, 1
lea rcx, [0x140033a08]
call fcn.14001538c
test al, al
jne 0x1400259ae
xor al, al
jmp 0x140025a38
mov rcx, qword [0x140033588]
lea r9, [0x140033a10]
xor r8d, r8d
lea rdx, [0x140026150]
call sub.fwpkclnt.sys_FwpmBfeStateSubscribeChanges0
test eax, eax
jns 0x1400259f1
lea rcx, [0x14002c3e0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x140033a08]
call fcn.140015340
and qword [0x140033a08], 0
jmp 0x1400259a7
call sub.fwpkclnt.sys_FwpmBfeStateGet0
cmp eax, 3
jne 0x140025a2a
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
mov rcx, qword [0x140033a08]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceSharedLite]
call fcn.140025778
mov rcx, qword [0x140033a08]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x140025a36
lea rcx, [0x14002c420]
call sub.ntoskrnl.exe_DbgPrint
mov al, 1
add rsp, 0x28
ret

Function at 0x140025b08
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
cmp qword [0x140033a18], 0
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
jne 0x140025b41
mov eax, 0xc0000008
jmp 0x140025c55
movups xmm0, xmmword [rcx]
mov rcx, qword [0x140033588]
lea rax, [0x140025fb0]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [0x140026140]
mov qword [rsp + 0x40], rax
lea rax, [0x140026130]
mov qword [rsp + 0x48], rax
movdqu xmmword [rsp + 0x20], xmm0
call sub.fwpkclnt.sys_FwpsCalloutRegister1
test eax, eax
js 0x140025c55
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call fcn.140028e40
movups xmm0, xmmword [rbx]
mov rcx, qword [0x140033a18]
lea rax, [0x14002c570]
movups xmm1, xmmword [rdi]
and dword [rsp + 0x70], 0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x14002c590]
xor r8d, r8d
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x140025c55
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xc8
call fcn.140028e40
movups xmm0, xmmword [0x14002f268]
and dword [rbp + 0x20], 0
lea rax, [0x14002c610]
movups xmm1, xmmword [rbx]
mov rcx, qword [0x140033a18]
lea rdx, [rbp - 0x50]
movdqu xmmword [rbp], xmm0
mov qword [rbp - 0x40], rax
lea rax, [0x14002c630]
movups xmm0, xmmword [rdi]
mov r9, rsi
mov qword [rbp - 0x38], rax
xor r8d, r8d
mov dword [rbp + 0x30], 0x5003
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x10], 1
mov byte [rbp + 0x18], 0xf
movdqu xmmword [rbp + 0x34], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140025cd4
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [0x140033a18], 0
je 0x140025d33
mov ecx, dword [0x140033a20]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a24]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a28]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140033a2c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140033a18]
test rcx, rcx
je 0x140025d27
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140033a18], 0
lea rcx, [0x14002c4b0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret

Function at 0x140037000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ecx, 0x10000
call fcn.14001ba0c
mov dl, 1
mov qword [0x1400335b8], rax
lea rcx, [0x1400335a8]
call fcn.14001538c
xor ebx, ebx
test al, al
je 0x140037072
mov r8d, dword [str.sboxS]
mov edx, 0xe0
mov ecx, dword [0x1400335c0]
mov byte [0x1400335b0], 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edx, edx
mov qword [0x140033598], rax
mov rdi, rax
test rax, rax
jne 0x14003707f
xor r9d, r9d
mov r8d, 0xc000009a
mov ecx, 0xc101045f
call fcn.14001521c
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8d, 0xe0
mov rcx, rdi
call fcn.140028e40
mov dword [rdi], 0xe0
lea rax, [0x140001ca0]
mov qword [rdi + 0x50], rax
lea rcx, [0x140002450]
mov rax, qword [0x140033b68]
lea rdx, [0x14003a0c0]
mov qword [rax + 0x50], rdi
mov rax, qword [0x140033b68]
mov qword [rax + 0x70], rcx
lea rcx, [0x1400023f0]
mov rax, qword [0x140033b68]
mov qword [rax + 0x100], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140033b68]
lea rax, [0x140033588]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], bl
mov r9d, 0x22
xor edx, edx
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x14003712c
xor r9d, r9d
mov qword [0x140033588], rbx
xor edx, edx
mov r8d, eax
jmp 0x140037068
mov rax, qword [0x140033588]
lea rdx, [0x140002360]
mov ecx, 0x12340001
btr dword [rax + 0x30], 7
call fcn.140037204
lea rdx, [0x1400024d0]
mov ecx, 0x12340003
call fcn.140037204
lea rdx, [0x140001f60]
mov ecx, 0x12340040
call fcn.140037204
lea rdx, [0x140001eb0]
mov ecx, 0x12340026
call fcn.140037204
lea rdx, [0x140002c10]
mov ecx, 0x12340033
call fcn.140037204
lea rdx, [0x140007030]
mov ecx, 0x12340017
call fcn.140037204
lea rdx, [0x1400026f0]
mov ecx, 0x12340041
call fcn.140037204
lea rdx, [0x140002810]
mov ecx, 0x12340044
call fcn.140037204
lea rdx, [0x140002ad0]
mov ecx, 0x12340046
call fcn.140037204
lea rdx, [fcn.1400021b0]
mov ecx, 0x12340047
call fcn.140037204
mov rcx, qword [0x140033590]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140037072
xchg dword [0x140033028], ebx
mov al, 1
jmp 0x140037074
Function at 0x140037658
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov r8, qword [rcx + 0x78]
xor r10d, r10d
mov rbx, rcx
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add r9, rax
test r11d, r11d
je 0x14003769d
mov r8d, dword [r9 + 0xc]
cmp edx, r8d
jb 0x140037691
mov ecx, dword [r9 + 0x10]
add ecx, r8d
cmp edx, ecx
jb 0x1400376a5
add r9, 0x28
inc r10d
cmp r10d, r11d
jb 0x14003767d
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov eax, dword [r9 + 0x14]
add rax, qword [rbx + 0x70]
sub rax, r8
mov ecx, edx
add rax, rcx
jmp 0x14003769f

Function at 0x1400376c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rbx, rcx
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
js 0x14003770e
cmp dword [rsp + 0x24], 6
ja 0x1400376fa
jne 0x14003770e
cmp dword [rsp + 0x28], 2
jb 0x14003770e
mov dword [0x1400335c0], 0x200
mov dword [0x1400335c4], 0x40000000
mov qword [0x140033b68], rbx
lea rcx, [0x140033b50]
and qword [rbx + 0x68], 0
mov rdx, qword [str.86900]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call fcn.1400378f4
mov bl, al
test al, al
je 0x140037894
call fcn.14000eca4
mov qword [0x1400336c0], rax
test rax, rax
jne 0x140037767
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010450
call fcn.14001504c
call fcn.140006fbc
jmp 0x14003789d
call fcn.140007170
mov bl, al
test al, al
je 0x140037894
mov rdx, qword [rdi + 8]
mov r8b, 1
mov rcx, qword [0x1400336c0]
call fcn.1400152dc
mov qword [0x140033b60], rax
test rax, rax
je 0x14003775d
call fcn.140007464
mov rcx, rdi
call fcn.140037a44
mov bl, al
test al, al
je 0x140037894
call fcn.1400234e0
call fcn.140038874
mov bl, al
test al, al
je 0x140037894
call fcn.14003728c
mov bl, al
test al, al
je 0x140037894
call fcn.140037620
mov bl, al
test al, al
je 0x140037894
call fcn.14003908c
mov bl, al
test al, al
je 0x140037894
call fcn.14001cb64
mov bl, al
test al, al
je 0x140037894
mov edx, 0xd
lea rcx, [0x14003a170]
call fcn.14000711c
cmp dword [0x1400336b0], 6
mov qword [0x1400336a0], rax
jb 0x140037835
mov edx, 0x11
lea rcx, [0x14003a180]
call fcn.14000711c
mov qword [0x1400336a8], rax
call fcn.140039e3c
mov bl, al
test al, al
je 0x140037894
call fcn.1400389fc
mov bl, al
test al, al
je 0x140037894
call fcn.140039c20
mov bl, al
test al, al
je 0x140037894
call fcn.140037d78
mov bl, al
test al, al
je 0x140037894
call fcn.140038624
mov bl, al
test al, al
je 0x140037894
call fcn.140038178
mov bl, al
test al, al
je 0x140037894
call fcn.140037f1c
mov bl, al
test al, al
je 0x140037894
call fcn.140037000
mov bl, al
test al, al
je 0x140037894
call fcn.140039fbc
mov bl, al
call fcn.140006fbc
test bl, bl
jne 0x1400378c4
mov rdx, qword [0x140033178]
xor r8d, r8d
mov ecx, 0xc101044f
call fcn.14001504c
mov rcx, qword [0x140033b68]
call fcn.1400073d0
mov eax, 0xc0000001
jmp 0x1400378e1
mov rdx, qword [0x140033178]
xor r8d, r8d
mov ecx, 0x4101044d
mov byte [0x140033190], 0
call fcn.14001504c
xor eax, eax
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret