joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400701b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400701f2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140070239
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140070292
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140070250
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400702d3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400813aa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400813ab]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400702a0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140071264
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400712ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400712ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400712ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400712ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400712ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400712b0
xor al, al
add rsp, 0x28
ret
Function at 0x14002c440
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140134368]
cmp word [rax + 2], 1
jl 0x14002c477
movsx rcx, word [rax + 2]
mov rax, qword [rax + 8]
mov rbp, qword [rax + rcx*8 - 8]
jmp 0x14002c479
xor ebp, ebp
mov rbp, qword [rbp]
lea r9, [0x14012cf68]
and dword [rsp + 0x20], 0
lea r8, [0x14012d4f8]
mov rcx, rbp
xor edx, edx
call fcn.1400cbdc8
test rax, rax
je 0x14002c4a5
mov rsi, qword [rbp + 0x40]
jmp 0x14002c4ac
lea rsi, [0x1400f48cb]
or rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14002c4b3
add rbx, 0x10
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14002c4fa
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ecx, dword [rbp + 0xf8]
add dword [0x140134854], ebx
lea eax, [rcx + 1]
mov dword [rbp + 0xf8], eax
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14002c50f
mov dword [rsp + 0x28], ecx
lea rdx, [rdi + 0x10]
mov rcx, r14
mov qword [rsp + 0x20], rsi
lea r9, str.__MIDL_
lea r8, str._s__s_.4d
call fcn.140001318
mov rdx, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp fcn.140027e64

Function at 0x14002c564
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140131c10]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rcx, qword [0x140134380]
lea r9, [0x1401353b0]
xor r12d, r12d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
mov rcx, qword [rcx + 0xc8]
call fcn.1400c7e64
lea r13, [0x1401351a0]
mov r8d, 0x104
mov rdx, r13
lea rcx, [0x1401353b0]
call fcn.14006b0c0
movzx ebp, word [0x140135760]
test bp, bp
jne 0x14002c62d
lea ebp, [r12 + 0x14]
lea esi, [rbp + 0x3c]
mov word [0x140135760], bp
mov ecx, esi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14002c688
mov ebx, dword [0x140134854]
mov r8d, esi
add ebx, esi
mov qword [0x140135758], rax
xor edx, edx
mov dword [0x140134854], ebx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14002c63a
mov rdi, qword [0x140135758]
mov ebx, dword [0x140134854]
movsx rsi, word [0x140135810]
cmp si, bp
jl 0x14002c702
cmp esi, 0x64
jg 0x14002c77d
mov eax, esi
add eax, eax
movsxd rcx, eax
mov eax, 4
mul rcx
mov r15, rax
mov rax, 0xffffffffffffffff
cmovo r15, rax
mov rcx, r15
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14002c6ab
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
invalid
invalid
Function at 0x11008
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x00024100]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx + 0x3b]
lea rcx, [r11 - 0x67]
mov byte [r11 - 0x68], 0
call fcn.0001ce80
and dword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x20019
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
lea rcx, [0x0001d2c0]
mov rdx, rdi
mov ebx, eax
call sub.ntoskrnl.exe_DbgPrint
mov rdx, rdi
test ebx, ebx
jns 0x110b3
lea rcx, [0x0001d2f0]
mov r8d, ebx
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x1116e
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov r8d, 1
mov dword [rsp + 0x20], 0x3c
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
jns 0x11113
lea rcx, [0x0001d330]
mov r8d, eax
mov rdx, rdi
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x110ac
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x84], 4
je 0x1114b
cmp dword [rsp + 0x84], 5
je 0x1114b
mov r8d, dword [rsi]
lea rcx, [0x0001d3a0]
mov rdx, rdi
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000024
jmp 0x1116e
mov eax, dword [rsp + 0x88]
lea rcx, [0x0001d370]
mov rdx, rdi
mov r8d, dword [rsp + rax + 0x80]
mov dword [rsi], r8d
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.0001cca0
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret

Function at 0x11c44
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x70
cmp byte [0x00025742], 0
mov r12b, r8b
mov r8, rcx
je 0x11d18
movzx r9d, word [rdx + 2]
movzx edx, word [rdx]
movzx r10d, byte [r8 + 0x13]
movzx ebx, byte [r8 + 0x11]
movzx edi, byte [r8 + 0x10]
movzx esi, byte [r8 + 0xf]
movzx ebp, byte [r8 + 0xe]
mov word [r11 + 0x20], r9w
mov al, byte [r11 + 0x21]
mov word [r11 + 0x20], dx
mov byte [rsp + 0x60], al
mov al, byte [r11 + 0x21]
movzx r11d, byte [r8 + 0x12]
mov byte [rsp + 0xa9], dl
mov byte [rsp + 0x61], r9b
movzx r9d, byte [r8 + 0xd]
movzx r8d, byte [r8 + 0xc]
mov byte [rsp + 0xa8], al
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0xa8]
test r12b, r12b
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r13, [0x0001d420]
lea rdx, [0x0001d430]
lea rcx, [0x0001d440]
cmovne rdx, r13
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x11d38
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x70
cmp byte [0x00025742], 0
mov r12b, r8b
mov r8, rcx
je 0x11e0c
movzx r9d, word [rdx + 2]
movzx edx, word [rdx]
movzx r10d, byte [r8 + 0x13]
movzx ebx, byte [r8 + 0x11]
movzx edi, byte [r8 + 0x10]
movzx esi, byte [r8 + 0xf]
movzx ebp, byte [r8 + 0xe]
mov word [r11 + 0x20], r9w
mov al, byte [r11 + 0x21]
mov word [r11 + 0x20], dx
mov byte [rsp + 0x60], al
mov al, byte [r11 + 0x21]
movzx r11d, byte [r8 + 0x12]
mov byte [rsp + 0xa9], dl
mov byte [rsp + 0x61], r9b
movzx r9d, byte [r8 + 0xd]
movzx r8d, byte [r8 + 0xc]
mov byte [rsp + 0xa8], al
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0xa8]
test r12b, r12b
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r13, [0x0001d420]
lea rdx, [0x0001d430]
lea rcx, [0x0001d490]
cmovne rdx, r13
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x11e2c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
cmp byte [0x00025742], 0
mov r9, rdx
mov r12b, r8b
mov rdx, rcx
je 0x11ec5
movzx r11d, byte [rcx + 0x13]
movzx ebx, byte [rdx + 0x11]
movzx edi, byte [rdx + 0x10]
movzx esi, byte [rdx + 0xf]
movzx ebp, byte [rdx + 0xe]
movzx eax, byte [r9 + 1]
movzx r10d, byte [r9]
movzx ecx, byte [rcx + 0x12]
movzx r8d, byte [rdx + 0xc]
movzx r9d, byte [rdx + 0xd]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ebx
test r12b, r12b
mov dword [rsp + 0x30], edi
lea r13, [0x0001d420]
lea rdx, [0x0001d430]
lea rcx, [0x0001d4e0]
mov dword [rsp + 0x28], esi
cmovne rdx, r13
mov dword [rsp + 0x20], ebp
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x137dc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x00025742], 0
mov rdi, rcx
je 0x13804
mov edx, dword [0x00024200]
lea rcx, [0x0001e0d0]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x00024200], 0x2710
jb 0x13843
mov rdx, qword [0x00024208]
test rdx, rdx
je 0x13834
mov rbx, qword [rdx + 8]
lea rcx, [0x00024240]
call fcn.00014714
mov rdx, rbx
test rbx, rbx
jne 0x1381c
and dword [0x00024200], 0
and qword [0x00024208], 0
lea rcx, [0x00024240]
call fcn.000146e0
mov rbx, rax
test rax, rax
je 0x138b4
mov ecx, dword [rdi + 4]
call fcn.000181dc
xor edx, edx
mov rcx, rbx
movzx r11d, al
lea r8d, [rdx + 0x30]
mov dword [rdi], r11d
call fcn.0001ce80
lea rcx, [rbx + 0x10]
mov r8d, 0x20
mov rdx, rdi
call fcn.0001cf80
and qword [rbx], 0
mov rax, qword [0x00024208]
mov qword [rbx + 8], rax
mov rax, qword [0x00024208]
test rax, rax
je 0x138a4
mov qword [rax], rbx
inc dword [0x00024200]
mov qword [0x00024208], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x13a20
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov sil, r8b
mov rbx, rcx
mov edi, edx
lea rcx, [rax - 0x24]
lea r8d, [rbp + 0x1c]
xor edx, edx
mov dword [rax - 0x28], ebp
call fcn.0001ce80
cmp byte [0x00025742], bpl
je 0x13a65
lea rcx, [0x0001e110]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, word [rbx + 0x18]
movzx ecx, word [rbx + 0x1a]
mov word [rsp + 0x2a], ax
movzx eax, word [rbx + 0x1e]
mov word [rsp + 0x2e], cx
mov word [rsp + 0x28], ax
cmp cx, bp
je 0x13a93
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x24], eax
mov eax, 2
jmp 0x13a9f
mov eax, dword [rbx + 0x24]
mov dword [rsp + 0x24], eax
mov eax, 1
mov word [rsp + 0x2c], ax
lea ecx, [rdi + 0x2a]
cmp sil, bpl
je 0x13ab3
mov qword [rsp + 0x30], rcx
jmp 0x13ab8
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
call fcn.00013b9c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x13ae0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov edi, r8d
mov rbx, rdx
lea rcx, [rax - 0x24]
lea r8d, [rbp + 0x1c]
xor edx, edx
mov sil, r9b
mov dword [rax - 0x28], ebp
call fcn.0001ce80
cmp byte [0x00025742], bpl
je 0x13b26
lea rcx, [0x0001e130]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, word [rbx + 2]
movzx eax, word [rbx]
mov word [rsp + 0x28], bp
mov word [rsp + 0x2e], cx
mov word [rsp + 0x2a], ax
cmp cx, bp
je 0x13b4f
mov eax, dword [rbx + 8]
mov dword [rsp + 0x24], eax
mov eax, 2
jmp 0x13b5b
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x24], eax
mov eax, 1
mov word [rsp + 0x2c], ax
lea ecx, [rdi + 0x22]
cmp sil, bpl
je 0x13b6f
mov qword [rsp + 0x30], rcx
jmp 0x13b74
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
call fcn.00013b9c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x13b9c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp byte [0x00025742], bl
je 0x13bbf
lea rcx, [0x0001e160]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rdi
call fcn.000138c8
movzx ecx, word [rdi + 8]
call fcn.00015aa8
cmp al, bl
jne 0x13bde
mov rcx, rdi
call fcn.00015b78
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x13bf4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x000242c0]
mov r13d, edx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rbx, qword [0x00024208]
mov byte [0x000242c8], al
test rbx, rbx
je 0x13d31
lea rsi, [r12 + 0x18]
cmp edi, r13d
jae 0x13d2b
cmp qword [rbx + 0x20], 0
mov rbp, qword [rbx + 8]
jne 0x13c5b
cmp qword [rbx + 0x28], 0
je 0x13d1f
mov ecx, edi
lea rdx, [rbx + 0x10]
mov r8d, 0x20
shl rcx, 5
add rcx, r12
call fcn.0001cf80
cmp byte [0x00025742], 0
je 0x13cd1
mov eax, dword [rsi + 4]
movzx ecx, word [rsi - 0xa]
movzx edx, word [rsi - 0xc]
movzx r8d, word [rsi - 0xe]
movzx r9d, word [rsi - 0x10]
mov dword [rsp + 0x58], eax
mov eax, dword [rsi]
mov dword [rsp + 0x50], eax
mov eax, dword [rsi - 4]
mov dword [rsp + 0x48], eax
mov eax, dword [rsi - 8]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov r8d, dword [rsi - 0x18]
mov dword [rsp + 0x20], r9d
mov r9d, dword [rsi - 0x14]
lea rcx, [0x0001e180]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx]
inc edi
add rsi, 0x20
test rcx, rcx
je 0x13ce7
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x13cf6
mov rax, qword [rbx]
mov qword [rcx], rax
cmp qword [0x00024208], rbx
jne 0x13d0a
mov rax, qword [rbx + 8]
mov qword [0x00024208], rax
dec dword [0x00024200]
lea rcx, [0x00024240]
mov rdx, rbx
call fcn.00014714
mov rbx, rbp
test rbp, rbp
jne 0x13c3c
mov al, byte [0x000242c8]
lea rcx, [0x000242c0]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14394
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 4], 4
movsxd rdi, r8d
mov rbx, rdx
mov rsi, rcx
jne 0x14488
cmp edi, 8
jle 0x1455d
cmp byte [rdx], 4
jne 0x1455d
mov edx, 1
cmp byte [rbx + 1], dl
jne 0x1455d
mov dword [rcx], edx
movsx ecx, byte [rbx + 2]
movzx eax, byte [rbx + 3]
mov r8d, 0x100
imul cx, r8w
add cx, ax
xor eax, eax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
mov word [rsi + 0xc], cx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x48], ecx
mov al, byte [rsp + 0x4b]
mov byte [rsp + 0x33], cl
mov byte [rsp + 0x30], al
mov al, byte [rsp + 0x4a]
mov byte [rsp + 0x31], al
mov al, byte [rsp + 0x49]
mov byte [rsp + 0x32], al
mov edx, dword [rsp + 0x30]
mov dword [rsi + 8], edx
test edx, edx
jle 0x1455d
cmp edx, 0xff
jg 0x1455d
mov cl, byte [0x00025742]
test cl, cl
je 0x14457
lea rcx, [0x0001e3a0]
call sub.ntoskrnl.exe_DbgPrint
mov cl, byte [0x00025742]
cmp edi, 0xa
jle 0x14559
cmp byte [rdi + rbx - 1], 0
jne 0x14559
test cl, cl
je 0x14559
lea rdx, [rbx + 9]
lea rcx, [0x0001e3d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14559
cmp dword [rcx + 4], 5
jne 0x1455d
cmp edi, 4
jle 0x1455d
cmp byte [rdx], 5
jne 0x1455d
mov edx, 1
cmp byte [rbx + 1], dl
jne 0x1455d
cmp byte [rbx + 2], 0
jne 0x1455d
cmp byte [rbx + 3], dl
jne 0x14519
cmp edi, 0xa
jl 0x14519
mov dword [rcx], edx
movsx ecx, byte [rbx + 8]
movzx eax, byte [rbx + 9]
mov r8d, 0x100
imul cx, r8w
add cx, ax
xor eax, eax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
mov word [rsi + 0xc], cx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x48], ecx
mov al, byte [rsp + 0x4b]
mov byte [rsp + 0x33], cl
mov byte [rsp + 0x30], al
mov al, byte [rsp + 0x4a]
mov byte [rsp + 0x31], al
mov al, byte [rsp + 0x49]
mov byte [rsp + 0x32], al
mov eax, dword [rsp + 0x30]
mov dword [rsi + 8], eax
jmp 0x1455d
cmp byte [rbx + 3], 3
jne 0x1455d
mov al, byte [rbx + 4]
test al, al
jle 0x1455d
movsx r8d, al
lea eax, [rdi - 5]
lea ecx, [r8 + 2]
cmp ecx, eax
jg 0x1455d
lea eax, [r8 + 5]
mov dword [rsi], edx
mov r8d, 0x100
movsxd rcx, eax
movsx eax, byte [rcx + rbx]
movzx edx, byte [rcx + rbx + 1]
imul ax, r8w
add dx, ax
mov word [rsi + 0xc], dx
and dword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x147b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov al, byte [0x00025742]
xor ebx, ebx
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov rdi, rcx
cmp al, bl
je 0x147fb
lea rcx, [0x0001e400]
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [0x00025742]
cmp byte [0x00025a22], bl
jne 0x14840
cmp byte [0x00025a23], bl
jne 0x14840
cmp dword [0x00024940], ebx
ja 0x14840
cmp al, bl
je 0x14823
lea rcx, [0x0001e420]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov al, byte [rdi + 9]
cmp al, 6
jne 0x14862
mov al, byte [rsp + 0x60]
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], al
call fcn.00015434
jmp 0x14825
cmp al, 0x11
jne 0x14881
mov al, byte [rsp + 0x60]
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], al
call fcn.0001b678
jmp 0x14825
cmp al, 1
jne 0x14823
mov bl, byte [rsp + 0x60]
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], bl
call fcn.00015374
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], bl
call fcn.0001b274
jmp 0x14825
Function at 0x15434
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
lea rcx, [0x000244c0]
mov r12d, r9d
mov r14, r8
mov rbx, rdx
xor r13d, r13d
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov bpl, byte [rsp + 0x70]
mov rdx, rbx
mov r8b, bpl
mov rcx, rsi
mov byte [0x000244c8], al
call fcn.00014e98
mov rdi, rax
test rax, rax
je 0x155d6
mov dl, byte [0x00025742]
test dl, dl
je 0x154ae
lea rcx, [0x0001e8b0]
call sub.ntoskrnl.exe_DbgPrint
mov dl, byte [0x00025742]
mov ecx, dword [rsi + 0xc]
xor eax, eax
lea rsi, [rdi + 0x60]
mov word [rsp + 0x21], ax
mov byte [rsp + 0x23], al
mov dword [rsp + 0x28], ecx
mov al, byte [rsp + 0x2b]
mov byte [rsp + 0x23], cl
mov byte [rsp + 0x20], al
mov al, byte [rsp + 0x2a]
mov byte [rsp + 0x21], al
mov al, byte [rsp + 0x29]
mov byte [rsp + 0x22], al
mov eax, dword [rsp + 0x20]
cmp dword [rdi + 0x38], eax
je 0x154ed
lea rsi, [rdi + 0x40]
mov qword [rsi], r14
mov dword [rsi + 8], r12d
mov byte [rsi + 0xc], bpl
cmp dword [rdi + 0x18], 1
jne 0x155a9
test dl, dl
je 0x15518
mov edx, dword [0x000257c8]
lea rcx, [0x0001e8d0]
call sub.ntoskrnl.exe_DbgPrint
xor r12d, r12d
cmp dword [0x000257c8], r12d
jbe 0x155c0
lea rbp, [0x000259b0]
and qword [rsp + 0x28], 0
mov ebx, dword [rdi + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [rbp]
cmp ebx, dword [rdi + 0x20]
mov r13d, eax
jge 0x15597
lea rcx, [0x00024440]
call fcn.000146e0
cmp byte [0x00025742], 0
mov rbx, rax
je 0x15572
lea rcx, [0x0001e8f0]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
test rbx, rbx
je 0x15597
mov rcx, qword [rsp + 0x28]
mov byte [rbx + 0x18], 1
mov qword [rbx + 0x10], rcx
mov rax, qword [rbp]
mov qword [rbx + 8], rax
mov rax, qword [rdi + 0x28]
mov qword [rbx], rax
mov qword [rdi + 0x28], rbx
inc r12d
add rbp, 8
cmp r12d, dword [0x000257c8]
jb 0x1552f
jmp 0x155c0
cmp dword [rdi + 0x18], 2
je 0x155b5
cmp dword [rdi + 0x18], 3
jne 0x155c0
mov rcx, rdi
call fcn.0001475c
mov r13d, eax
and qword [rsi], 0
and dword [rsi + 8], 0
cmp dword [rdi + 0x18], 3
jne 0x155d6
mov rcx, rdi
call fcn.000148c0
mov dl, byte [0x000244c8]
lea rcx, [0x000244c0]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, r13d
add rsp, 0x30
pop r14
pop r13
pop r12
ret