joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d948
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d978
xor eax, eax
jmp 0x14000da3b
mov rbp, rbx
cmp word [rax], si
je 0x14000d99d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d984
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d980
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d868
movsxd r14, eax
test eax, eax
jne 0x14000d9db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d971
mov rcx, r14
call fcn.14000a0fc
mov rdi, rax
test rax, rax
jne 0x14000d9f4
xor ecx, ecx
call fcn.140009484
jmp 0x14000d9d0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d868
test eax, eax
jne 0x14000da25
mov rcx, rdi
call fcn.140009484
jmp 0x14000da2f
xor ecx, ecx
call fcn.140009484
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140011d5c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140011d72
mov al, 1
jmp 0x140011dd2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140011d83
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140011dd0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000e268
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011dd0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140011dd0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140011dd0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140011dd2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140012e10
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000c938
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140012e9a
cmp byte [rbp - 0x21], r15b
je 0x140012e95
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012ed0
call fcn.1400096d4
test eax, eax
jne 0x140012ebc
cmp byte [rbp - 0x21], r15b
je 0x140012eb4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012ed0
cmp byte [rbp - 0x21], r15b
je 0x140012ecd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000bf18
test eax, eax
jne 0x140012f70
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000c938
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140012f0f
cmp byte [rbp - 0x21], r15b
je 0x140012f44
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140012f44
call fcn.1400096d4
test eax, eax
jne 0x140012f30
cmp byte [rbp - 0x21], r15b
je 0x140012f29
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140012f44
cmp byte [rbp - 0x21], r15b
je 0x140012f41
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000bf18
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140012f70
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140012f73
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140012f81
mov rcx, rdi
call fcn.140009484
cmp byte [rbp + 0x3f], r15b
je 0x140012f90
mov rcx, qword [rbp + 0x27]
call fcn.140009484
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140015500
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015528
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015528
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x100dce470
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100dce47d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100dce48d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100dce475
lea eax, [rcx + 1]
jmp 0x100dce49b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100dce4ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100dce494
sub eax, 3
jb 0x100dce4ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100dce51d
sar eax, 1
movsxd rbp, eax
jb 0x100dce504
jmp 0x100dce4dc
add ebx, ebx
jne 0x100dce4da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100dce504
inc ecx
add ebx, ebx
jne 0x100dce4ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100dce504
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100dce4fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100dce4ec
add ecx, 2
jmp 0x100dce509
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100dce432
jmp 0x100dce47d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x5a5f30
mov dl, 0x52
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x100dce569
cmp rsi, rcx
jae 0x100dce571
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x100dce550
cmp al, 0x8f
ja 0x100dce550
cmp byte [rsi - 2], 0xf
je 0x100dce556
sub al, 0xe8
cmp al, 1
ja 0x100dce53a
cmp rsi, rcx
jae 0x100dce571
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x100dce540
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x100dce571
lodsb al, byte [rsi]
jmp 0x100dce550
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xdca000]
mov eax, dword [rdi]
or eax, eax
je 0x100dce5ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xde05f8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100dce57e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100dce5c8
mov qword [rbx], rax
add rbx, 8
jmp 0x100dce59e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100dce651], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100dce651
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100dce641
sub rsp, 0xffffffffffffff80
jmp 0x100003460
Function at 0x135ac
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
xor ebx, ebx
mov rdi, rcx
cmp rsi, rbx
je 0x13623
cmp dword [rdx + 8], 0x20
jb 0x13623
cmp qword [0x0001c988], rbx
jne 0x135ed
lea rcx, [0x0001c988]
mov edx, 0x640000
call fcn.00012cdc
cmp eax, ebx
jl 0x1360b
cmp qword [0x0001c448], rbx
jne 0x1364e
lea rcx, [0x0001c448]
mov edx, 0x40000
call fcn.00012cdc
cmp eax, ebx
jge 0x1364e
lea rcx, [0x0001c988]
call fcn.00012e5c
lea rcx, [0x0001c448]
call fcn.00012e5c
mov eax, 0xc0000001
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], eax
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x0001c990]
mov qword [rsi], rax
mov rax, qword [0x0001c9a0]
mov qword [rsi + 8], rax
mov rax, qword [0x0001c450]
mov qword [rsi + 0x10], rax
mov rax, qword [0x0001c460]
mov qword [rsi + 0x18], rax
call fcn.00011eb8
mov dword [rdi + 0x30], ebx
mov qword [rdi + 0x38], 0x20
jmp 0x13631
Function at 0x1441c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rbx, rdx
test rcx, rcx
jne 0x1443f
mov ebx, 0xc000000d
jmp 0x14511
test byte [rcx + 0xa], 5
je 0x1444b
mov rax, qword [rcx + 0x18]
jmp 0x14467
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test rax, rax
je 0x14504
cmp dword [rbx + 8], 8
jb 0x14504
lea rdx, [rsp + 0x30]
lea rcx, [0x0001c6b8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rax, [0x000143b4]
xchg qword [rdi + 0x68], rax
cmp byte [rdi + 0x44], 0
je 0x144af
xor eax, eax
xchg qword [rdi + 0x68], rax
test rax, rax
je 0x144af
mov ebx, 0xc0000120
jmp 0x144e5
mov rax, qword [rdi + 0xb8]
lea rcx, [rdi + 0xa8]
lea rdx, [0x0001c9a8]
or byte [rax + 3], 1
mov rax, qword [0x0001c9b0]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov ebx, 0x103
mov qword [0x0001c9b0], rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
lea rcx, [0x0001c470]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueDpc]
jmp 0x14509
mov ebx, 0xc000009a
cmp ebx, 0x103
je 0x14524
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x15e14
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
and dword [rax + 0x18], 0
and qword [rax - 0x28], 0
and qword [rax + 0x20], 0
cmp qword [0x0001c3b0], 0
mov rsi, rdx
mov rbx, rcx
jne 0x15e74
lea rdx, [0x0001a650]
lea rcx, [rax - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x0001c3b0], rax
test rax, rax
jne 0x15e74
mov eax, 0xc0000001
jmp 0x15f8a
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x15f8a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
test eax, eax
jns 0x15ecd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
jmp 0x15f8a
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
lea rax, [rsp + 0x80]
lea edx, [r9 + 0x1b]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x0001c3b0]
mov edi, eax
cmp eax, 0xc0000004
jne 0x15f65
mov edx, dword [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x33544c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x15f65
mov r9d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov r8, rbx
mov edx, 0x1b
mov qword [rsp + 0x20], rax
call qword [0x0001c3b0]
mov edi, eax
test eax, eax
js 0x15f5a
cmp dword [rsp + 0x80], 0
je 0x15f5a
mov qword [rsi], rbx
xor edi, edi
jmp 0x15f65
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x15f78
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x15f88
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x15fa0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov r12d, dword [rdx + 8]
xor ebx, ebx
mov rsi, rcx
mov qword [rax + 8], rbx
mov ebp, ebx
cmp rdi, rbx
je 0x1609e
cmp dword [rdx + 0x10], 4
jb 0x1609e
mov ecx, dword [rdi]
lea rdx, [rax + 8]
call fcn.00015e14
cmp eax, ebx
jl 0x1609e
mov r8, qword [rsp + 0x40]
cmp r8, rbx
je 0x1609e
mov rdx, qword [r8 + 8]
cmp rdx, rbx
je 0x16093
cmp word [r8], bx
je 0x16093
movzx ebp, word [r8]
add ebp, 2
cmp ebp, r12d
jbe 0x1602f
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, 0xc0000017
jmp 0x1609e
mov ecx, ebp
shr rcx, 1
je 0x16093
cmp rcx, 0x7fff
ja 0x16093
test byte [r8], 1
jne 0x16090
movzx eax, word [r8 + 2]
test al, 1
jne 0x16090
cmp word [r8], ax
ja 0x16090
mov r9d, 0xfffe
cmp ax, r9w
ja 0x16090
movzx r9d, word [r8]
shr r9, 1
sub r9, rcx
sub rdx, rdi
lea rax, [r9 + rcx]
cmp rax, rbx
je 0x16087
movzx eax, word [rdx + rdi]
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x1606d
cmp rcx, rbx
jne 0x16090
sub rdi, 2
mov word [rdi], bx
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, ebp
xor edx, edx
mov dword [rsi + 0x30], ebx
mov qword [rsi + 0x38], rcx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x16964
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x58]
call fcn.0001a060
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x80], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001a690]
lea r12, [0x0001a6d0]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x16abf
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0xc8
call fcn.0001a060
and dword [rsp + 0x120], 0
lea rax, [rsp + 0x30]
movdqu xmm0, xmmword [rbx]
movdqu xmm5, xmmword [rdi]
mov ebx, 1
lea rcx, [rsp + 0x30]
xor edx, edx
movdqu xmmword [rsp + 0x144], xmm0
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rsp + 0x100], xmm5
lea r8d, [rbx + 0x27]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov dword [rsp + 0x140], 0x5003
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x130], ebx
movdqu xmmword [rsp + 0x110], xmm0
call fcn.0001a060
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x40], 0
movdqu xmm5, xmmword [0x0001b400]
movdqu xmmword [rsp + 0x30], xmm5
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x50], 6
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00019d80
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
ret

Function at 0x16aec
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x58]
call fcn.0001a060
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x50], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001a710]
lea r12, [0x0001a740]
lea rdx, [rsp + 0x30]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x40], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x16c0d
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0xc8
call fcn.0001a060
mov rcx, qword [0x0001ccd8]
and qword [rsp + 0x108], 0
movdqu xmm5, xmmword [rdi]
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rsi]
and dword [rsp + 0xf0], 0
and dword [rsp + 0x100], 0
lea rdx, [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
movdqu xmmword [rsp + 0xd0], xmm5
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0x110], 0x5003
movdqu xmmword [rsp + 0x114], xmm0
movdqu xmmword [rsp + 0xe0], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.00019d80
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x170
pop r12
pop rdi
pop rsi
ret
Function at 0x16c38
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x58]
call fcn.0001a060
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x80], 0
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [rdi]
lea r11, [0x0001a690]
lea r12, [0x0001a6d0]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r12
xor r9d, r9d
movdqu xmm1, xmmword [rsp + 0x20]
xor r8d, r8d
movdqu xmmword [rsp + 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x16d93
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0xc8
call fcn.0001a060
and dword [rsp + 0x120], 0
lea rax, [rsp + 0x30]
movdqu xmm0, xmmword [rbx]
movdqu xmm5, xmmword [rdi]
mov ebx, 1
lea rcx, [rsp + 0x30]
xor edx, edx
movdqu xmmword [rsp + 0x144], xmm0
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rsp + 0x100], xmm5
lea r8d, [rbx + 0x27]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov dword [rsp + 0x140], 0x5003
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x130], ebx
movdqu xmmword [rsp + 0x110], xmm0
call fcn.0001a060
mov rcx, qword [0x0001ccd8]
and dword [rsp + 0x40], 0
movdqu xmm5, xmmword [0x0001b400]
movdqu xmmword [rsp + 0x30], xmm5
lea rdx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x50], 0x11
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00019d80
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
ret
Function at 0x140002ce0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1401267f4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400830c8
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1401267f4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140002e70
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140002e8c
cmp rcx, r8
jl 0x140002e7f
mov qword [rdx + 0x80], rcx
test dword [0x14011e338], 1
je 0x140002ebb
cmp byte [rsp + 0xd0], 0
je 0x140002ebb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400029e0
mov rsp, r8
jmp rax