joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489a0a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0047a470
xor ebx, ebx
cmp dword [0x4c5904], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x489ae0
push 0x4a5308
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x489bc0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x489bc0
push eax
call fcn.0047a402
mov dword [esp], 0x4a52d0
push edi
mov dword [0x4c5904], eax
call esi
push eax
call fcn.0047a402
mov dword [esp], 0x4a52bc
push edi
mov dword [0x4c5908], eax
call esi
push eax
call fcn.0047a402
mov dword [0x4c590c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004762b9
test eax, eax
pop ecx
pop ecx
je 0x489aae
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0047251c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x489ae0
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0047a402
cmp eax, ebx
pop ecx
mov dword [0x4c5914], eax
je 0x489ae0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047a402
pop ecx
mov dword [0x4c5910], eax
mov eax, dword [0x4c5910]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x489b65
cmp dword [0x4c5914], ecx
je 0x489b65
push eax
call fcn.0047a479
push dword [0x4c5914]
mov esi, eax
call fcn.0047a479
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x489b65
cmp edi, ebx
je 0x489b65
call esi
cmp eax, ebx
je 0x489b32
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x489b32
test byte [ebp - 0x18], 1
jne 0x489b65
lea eax, [ebp - 0x10]
push eax
call fcn.004762f0
test eax, eax
pop ecx
je 0x489b4d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0047251c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x489b5c
or dword [ebp + 0x10], 0x200000
jmp 0x489ba0
or dword [ebp + 0x10], 0x40000
jmp 0x489ba0
mov eax, dword [0x4c5908]
cmp eax, dword [ebp - 8]
je 0x489ba0
push eax
call fcn.0047a479
cmp eax, ebx
pop ecx
je 0x489ba0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x489ba0
mov eax, dword [0x4c590c]
cmp eax, dword [ebp - 8]
je 0x489ba0
push eax
call fcn.0047a479
cmp eax, ebx
pop ecx
je 0x489ba0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c5904]
call fcn.0047a479
cmp eax, ebx
pop ecx
je 0x489bc0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x489bc2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x491763
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4bd750]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004916f8
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00475860
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4917b2
cmp dword [ebp - 0x1c], 5
jb 0x4917ca
jmp 0x4917c6
cmp dword [ebp - 0x10], 1
jne 0x4917ca
cmp dword [ebp - 0x1c], 4
ja 0x4917c6
jne 0x4917ca
cmp dword [ebp - 0x18], 0
jbe 0x4917ca
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4a6cec
call fcn.004915cc
test eax, eax
jge 0x4917eb
mov byte [0x4c5bf9], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004716ba
add ebp, 0x78
leave
ret
Function at 0x405f20
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x502034]
xor ecx, esp
mov dword [esp + 0x1c], ecx
cmp byte [eax], 0x26
jne 0x405fc2
add eax, 1
mov ecx, esp
lea edx, [esp + 4]
push ecx
push edx
push 0x4dff6d
push eax
call fcn.00405ff0
add esp, 0x10
cmp eax, 2
jne 0x405fc2
push dword [esp]
push 0
push 0
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test eax, eax
je 0x405fbb
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [esp + 8], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
push ecx
push eax
call fcn.004389a0
add esp, 8
test al, al
je 0x405fd7
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
jmp 0x405fc4
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049fc40
mov eax, ebx
add esp, 0x20
pop esi
pop ebx
ret
push str.Serialised_configuration_data_was_invalid
call fcn.00405390
int3

Function at 0x406150
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [esp + 0x14], 2
jne 0x4061fd
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4061fd
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4061fd
mov edi, eax
mov bl, byte [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push eax
call fcn.004a2420
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
jne 0x4061bf
push 0
push 1
push 0x8002
push dword [0x502004]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x502004]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x406202
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test bl, bl
jne 0x4061fd
push 0
push 0
push 0x8002
push dword [0x502004]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
je 0x4061e8
jmp 0x4061fd
Function at 0x4c661d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c67c0
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4c6795
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4c6795
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4c6744
jg 0x4c6676
test eax, eax
je 0x4c673a
push 1
push 0x1000
call fcn.004b7bc4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4c669c
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4c6731
push 0x8000
push ebx
call fcn.004aefb0
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4c66c8
jg 0x4c66c3
cmp ecx, 0x1000
jb 0x4c66c8
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004bd246
add esp, 0x10
cmp eax, 0xffffffff
je 0x4c670d
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4c66c3
jl 0x4c66f4
test ecx, ecx
jne 0x4c66b5
push dword [ebp - 0xc]
push ebx
call fcn.004aefb0
push esi
call fcn.004b6016
add esp, 0xc
xor edi, edi
jmp 0x4c67a6
cmp byte [edi + 0x24], 0
je 0x4c6724
cmp dword [edi + 0x20], 5
jne 0x4c6724
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4c672f
mov edi, dword [edi + 0x18]
jmp 0x4c6731
xor edi, edi
push esi
call fcn.004b6016
pop ecx
jmp 0x4c67a6
test ecx, ecx
jg 0x4c6706
jl 0x4c6744
test eax, eax
jae 0x4c6706
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c49c0
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4c6767
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4c6706
jmp 0x4c679e
push ebx
call fcn.004bc450
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4c6706
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4c67a6
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4c67a3
mov edi, dword [edi + 0x18]
jmp 0x4c67a6
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c49c0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414e32
Capabilities:
Encode data using xor

Disassembly:
dec eax
sub dh, byte [edx + 0x71c1ed0]
inc eax
test dword [ecx + 0x1b], esi
lodsd eax, dword [esi]
sbb byte [esp + edx*4 - 8], dl
xchg esp, eax
imul esp, dword [ebx + 0x43], 0x54713053
add ecx, ebp
aas
xor esp, dword [ebp + 9]
pop ecx
mov ch, 0x8e
push edx
jnp 0x414e39
sub eax, 0xaac53c89
push ds
pop ebx
mov dword [0xebbe969c], eax
not eax
push edx
dec ecx
pop ebx
xor ch, byte [esi - 0x26]
scasb al, byte es:[edi]
imul ebx, esp, 0x66
iretd
Function at 0xf5ca8c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf5ca96
pushal
call 0xf5ca9c
pop ebp
sub ebp, 0x10
sub ebp, 0xb5ca8c
jmp 0xf5cab2
mov eax, 0xb5ca8c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b0
mov edx, 0xe63ce4b7
xor byte [eax], dl
inc eax
dec ecx
jne 0xf5cac9
jmp 0xf5cadc
cmp al, 0x7a
cmp al, 0x3e
mov esi, dword [edi + 0x7636b7b7]
dec edi
mov bh, 0xb7
mov bh, 0xb4
jp 0xf5cafc
mov cl, 0xb7
mov bh, 0xb7
or eax, 0xb7b7b79f
inc eax
push ebp
mov ah, 0x7f
cmp al, 0x36
mov ebx, 0xb4b7b7b7
jb 0xf5cb3d
rcl dword [ebx - 0x6c4cc1b5], cl
xchg ebx, eax
dec ebx
mov bl, 0x93
cmp dl, bl
xchg ebx, eax
dec ebx
mov bl, 0x93
fbld tbyte [edi - 0x20486910]
retf
cmp al, 0x22
mov ebx, 0x3cb7b7b7
cmp ah, byte [edi + 0x76b7b7b7]
pop esi
mov ch, 0x86
mov ch, 0x34
jne 0xf5cb04
invalid
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x20
push 0
push 0x40f10c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40f110], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40f10c], eax
call fcn.0040b9f0
call fcn.0040b9e0
call fcn.0040b1a5
call fcn.0040b130
call fcn.0040ae70
call fcn.00408fac
call fcn.00408850
call fcn.00407d70
call fcn.00407c70
call fcn.0040793f
call fcn.00406e3e
call fcn.00406868
call fcn.0040640f
call fcn.004053e6
call fcn.00402222
mov dword [0x40f128], 0
push 0
call 0x4010b3
call fcn.0040ba40
push dword [0x40f10c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004021cc
call fcn.004053c3
call fcn.004063f1
call fcn.00406e2d
call fcn.00407932
call fcn.00407c64
call fcn.0040ae90
call fcn.0040b233
call fcn.0040b23f
call fcn.0040b120
ret

Function at 0x40793f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x40f4f4], eax
test eax, eax
je 0x40796d
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40f4f0], eax
lea eax, [ebp - 0x114]
mov dword [0x40f4f8], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4079cf
cmp dword [ebp - 0x104], 1
jne 0x4079a4
and dword [0x40f4f8], 0
jmp 0x4079e7
cmp dword [ebp - 0x104], 2
jne 0x4079cf
cmp dword [ebp - 0x110], 5
jb 0x40799b
jne 0x4079cf
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x40f4f8]
mov dword [0x40f4f8], eax
jmp 0x4079d4
mov eax, dword [0x40f4f8]
test eax, eax
je 0x4079e7
call fcn.00407642
neg eax
sbb eax, eax
and dword [0x40f4f8], eax
mov esp, ebp
pop ebp
ret

Function at 0x408f40
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x408f72
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408f6d
cmp dword [esp + 0xc], esi
je 0x408f89
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x13b60
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov dword [ebp - 8], eax
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 1], al
movzx eax, byte [0x1b22c]
test eax, eax
je 0x13b96
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0xc0000010
jmp 0x13bb0
mov edx, dword [ebp - 8]
mov dword [0x1b228], edx
mov byte [0x1b22c], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov dl, byte [ebp - 1]
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
mov esp, ebp
pop ebp
ret 8

Function at 0x13bf0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
je 0x13d0b
cmp dword [ebp - 0xc], 0x20
jb 0x13d0b
cmp dword [0x1b7d0], 0
jne 0x13c4c
push 0
push 0x640000
push 0x1b7d0
call fcn.000131c0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x13c4c
jmp 0x13c7c
cmp dword [0x1b280], 0
jne 0x13c71
push 0
push 0x40000
push 0x1b280
call fcn.000131c0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x13c71
jmp 0x13c7c
mov dword [ebp - 0x10], 0
xor eax, eax
jne 0x13c27
cmp dword [ebp - 0x10], 0
jge 0x13c98
push 0x1b7d0
call fcn.000133f0
push 0x1b280
call fcn.000133f0
jmp 0x13d0b
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov eax, dword [0x1b7d4]
cdq
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x14]
mov eax, dword [0x1b7e0]
mov dword [edx + 8], eax
mov ecx, dword [0x1b7e4]
mov dword [edx + 0xc], ecx
mov eax, dword [0x1b284]
cdq
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
mov edx, dword [ebp - 0x14]
mov eax, dword [0x1b290]
mov dword [edx + 0x18], eax
mov ecx, dword [0x1b294]
mov dword [edx + 0x1c], ecx
call fcn.00012150
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x20
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x13d2f
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0xc0000001
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc0000001
mov esp, ebp
pop ebp
ret 8
Function at 0x13d40
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
call fcn.00012770
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 1], al
mov dword [0x1b228], 0
mov byte [0x1b22c], 0
mov dl, byte [ebp - 1]
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
call fcn.00013970
call fcn.00011660
call fcn.000116f0
call fcn.00012040
push 0x1b7d0
call fcn.000133f0
push 0x1b280
call fcn.000133f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x14dc0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov byte [ebp - 2], 0
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 1], al
push 0x1b7e8
call fcn.000115c0
movzx eax, al
test eax, eax
jne 0x14e03
push 0x1b7f0
call fcn.000115c0
movzx ecx, al
test ecx, ecx
je 0x14e16
mov dl, byte [ebp - 1]
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
jmp 0x14f05
mov edx, dword [0x1b7e8]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x1b7e8
je 0x14e5a
mov eax, dword [ebp - 8]
sub eax, 0x58
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
add edx, 0x38
xchg dword [edx], ecx
test ecx, ecx
je 0x14e50
mov eax, dword [ebp - 8]
push eax
call fcn.00011bc0
mov byte [ebp - 2], 1
jmp 0x14e5a
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x14e1f
mov dl, byte [ebp - 1]
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x14e75
jmp 0x14f05
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
movsx eax, word [edx + 6]
and eax, 5
je 0x14e92
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x14eac
push 0x20
push 0
push 0
push 1
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x14ed9
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0xc000009a
xor dl, dl
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x14f05
call fcn.00014ca0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], 8
xor dl, dl
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov esp, ebp
pop ebp
ret
Function at 0x14f80
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x14fa4
mov dword [ebp - 8], 0xc000000d
jmp 0x15079
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
movsx eax, word [edx + 6]
and eax, 5
je 0x14fc1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x14fdb
push 0x10
push 0
push 0
push 1
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x14fea
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 8
jae 0x14ff6
mov dword [ebp - 8], 0xc000009a
jmp 0x15079
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 1], al
mov ecx, 0x14f10
mov edx, dword [ebp + 8]
add edx, 0x38
xchg dword [edx], ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
je 0x15033
xor edx, edx
mov eax, dword [ebp + 8]
add eax, 0x38
xchg dword [eax], edx
test edx, edx
je 0x15033
mov dword [ebp - 8], 0xc0000120
jmp 0x15054
mov ecx, dword [ebp + 8]
push ecx
call fcn.000150b0
mov edx, dword [ebp + 8]
add edx, 0x58
push edx
push 0x1b7e8
call fcn.00011620
mov dword [ebp - 8], 0x103
mov dl, byte [ebp - 1]
mov ecx, 0x1b4c4
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
push 0
push 0
push 0x1b298
call dword [sym.imp.ntoskrnl.exe_KeInsertQueueDpc]
xor eax, eax
jne 0x14f8f
cmp dword [ebp - 8], 0x103
je 0x150a0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 0x18], eax
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x167b0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
movsx ecx, word [eax + 6]
and ecx, 5
je 0x167de
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x167f8
push 0x10
push 0
push 0
push 1
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1680a
cmp dword [ebp - 8], 8
jae 0x16826
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0xc000009a
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc000009a
jmp 0x1684e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call fcn.000166b0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
xor dl, dl
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x16f00
Capabilities:
Register network filter via wfp api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3c
push 0
lea eax, [ebp - 0xf4]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0xf8], 0x19690
mov dword [ebp - 0xfc], 0x19650
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0xf4], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0xf0], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0xec], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xcc], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0xc8], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc4], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xdc], 0
push 0
push 0
lea eax, [ebp - 0xf4]
push eax
mov ecx, dword [0x1b948]
push ecx
call sub.fwpkclnt.sys_FwpmCalloutAdd0
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jge 0x16fd5
jmp 0x170f0
push 0x98
push 0
lea edx, [ebp - 0xb8]
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x90], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x8c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x88], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0xa8], 0x19650
mov dword [ebp - 0xa4], 0x19650
mov dword [ebp - 0x60], 0x5003
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x5c], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x58], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x54], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x80], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x7c], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x78], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], 1
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov edx, dword [0x1a51c]
mov dword [ebp - 0x20], edx
mov eax, dword [0x1a520]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x1a524]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x1a528]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
mov byte [ebp - 8], 6
push 0
push 0
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [0x1b948]
push ecx
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jge 0x170e8
jmp 0x170f0
xor edx, edx
jne 0x16f15
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00019104
mov esp, ebp
pop ebp
ret 0xc