joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004d10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0x2c0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004d6f
lfence
mov eax, dword [rsp + 0x30]
jmp 0x140004eab
mov qword [rsp + 0x40], 0x2c0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
lea rcx, section..data
call fcn.140005d60
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004dcf
jmp 0x140004e7b
mov rax, qword [rsp + 0x38]
add rax, 0x190
mov qword [rsp + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xb0]
add rax, 8
mov dword [rsp + 0x20], 0
mov r9d, 0x104
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.140005d60
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004e25
jmp 0x140004e7b
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax + 4]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], 0x2c0
lea rcx, [rsp + 0x70]
call fcn.140005340
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004ea7
cmp qword [rsp + 0x38], 0
je 0x140004ea7
mov r9d, 0x4000
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret
Function at 0x140005b10
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov dword [rsp + 0x50], 0
lea rdx, [0x14000d240]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x140011b30]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x68]
call qword [0x14000f208]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140005bb4
lfence
mov edx, dword [rsp + 0x50]
lea rcx, [0x14000d270]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x50]
jmp 0x140005c36
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x140005bc8
jmp 0x140005c1f
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x70]
lea rcx, [0x1400046e0]
xchg qword [rax], rcx
mov rax, rcx
mov ecx, 0x10
imul rcx, rcx, 0
lea rdx, [0x140013c50]
mov qword [rdx + rcx], rax
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x140013c50]
mov byte [rcx + rax + 8], 1
lea rcx, [0x14000d2b0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140005c27
mov dword [rsp + 0x50], 0xc00000bb
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x50]
add rsp, 0x88
ret

Function at 0x140005c40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp dword [rsp + 0x90], 0
je 0x140005c82
cmp dword [rsp + 0x90], 1
je 0x140005c82
lea rcx, [0x14000d5d0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140005d57
cmp dword [rsp + 0x90], 0
jne 0x140005cc3
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x80], rax
jbe 0x140005cab
cmp qword [rsp + 0x80], 0xffffffffffffffff
jb 0x140005cc3
lea rcx, [0x14000d720]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140005d57
cmp dword [rsp + 0x90], 1
jne 0x140005cff
cmp qword [rsp + 0x80], 0
jbe 0x140005cec
movabs rax, 0x7fffffffffffffff
cmp qword [rsp + 0x80], rax
jb 0x140005cff
lea rcx, [0x14000d750]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140005d57
mov rax, qword [0x140011b40]
mov qword [rsp + 0x40], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], 0
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x80]
mov r8, rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x48]
call qword [0x14000f208]
add rsp, 0x68
ret
Function at 0x14000b490
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0
je 0x14000b4e9
mov rax, qword [rsp + 0x470]
movabs rcx, 0x8000000000000000
cmp qword [rax], rcx
jbe 0x14000b4e9
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0xffffffffffffffff
jb 0x14000b4f0
xor eax, eax
jmp 0x14000b5f4
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x470]
mov rdx, qword [rax]
lea rcx, [0x140016cc0]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectIDEx]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x14000b52a
xor eax, eax
jmp 0x14000b5f4
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0
je 0x14000b563
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
test eax, eax
je 0x14000b563
mov rax, qword [rsp + 0x38]
movabs rcx, 0x8000000000000000
cmp qword [rax + 8], rcx
jbe 0x14000b563
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jb 0x14000b56a
xor eax, eax
jmp 0x14000b5f4
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.1400011e0
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x40]
call fcn.140002a00
movzx eax, al
test eax, eax
je 0x14000b5e5
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov byte [rsp + 0x30], al
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lea rdx, [rsp + 0x48]
lea rcx, [0x14000d2d0]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 0xc0000022
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_CmCallbackReleaseKeyObjectIDEx]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x468
ret
Function at 0x14000b610
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x470]
movabs rcx, 0x8000000000000000
cmp qword [rax], rcx
jbe 0x14000b65b
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0xffffffffffffffff
jb 0x14000b662
xor eax, eax
jmp 0x14000b7a7
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x470]
mov rdx, qword [rax]
lea rcx, [0x140016cc0]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectIDEx]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x14000b69c
xor eax, eax
jmp 0x14000b7a7
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0
je 0x14000b6d5
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
test eax, eax
je 0x14000b6d5
mov rax, qword [rsp + 0x38]
movabs rcx, 0x8000000000000000
cmp qword [rax + 8], rcx
jbe 0x14000b6d5
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jb 0x14000b6dc
xor eax, eax
jmp 0x14000b7a7
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.1400011e0
mov rax, qword [rsp + 0x470]
mov rax, qword [rax + 8]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x470]
mov rcx, qword [rcx + 8]
mov r8, rax
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x246]
call fcn.1400011a0
mov dword [rsp + 0x44], 1
lea rcx, [rsp + 0x40]
call fcn.140002a00
movzx eax, al
test eax, eax
je 0x14000b798
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov byte [rsp + 0x30], al
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lea r8, [rsp + 0x246]
lea rdx, [rsp + 0x48]
lea rcx, [0x14000d2f0]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 0xc0000022
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_CmCallbackReleaseKeyObjectIDEx]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x468
ret
Function at 0x14000b7c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0
je 0x14000b819
mov rax, qword [rsp + 0x470]
movabs rcx, 0x8000000000000000
cmp qword [rax], rcx
jbe 0x14000b819
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0xffffffffffffffff
jb 0x14000b820
xor eax, eax
jmp 0x14000b924
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x470]
mov rdx, qword [rax]
lea rcx, [0x140016cc0]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectIDEx]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x14000b85a
xor eax, eax
jmp 0x14000b924
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0
je 0x14000b893
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
test eax, eax
je 0x14000b893
mov rax, qword [rsp + 0x38]
movabs rcx, 0x8000000000000000
cmp qword [rax + 8], rcx
jbe 0x14000b893
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jb 0x14000b89a
xor eax, eax
jmp 0x14000b924
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.1400011e0
mov dword [rsp + 0x44], 2
lea rcx, [rsp + 0x40]
call fcn.140002a00
movzx eax, al
test eax, eax
je 0x14000b915
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov byte [rsp + 0x30], al
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lea rdx, [rsp + 0x48]
lea rcx, [0x14000d320]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 0xc0000225
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_CmCallbackReleaseKeyObjectIDEx]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x468
ret
Function at 0x14000b940
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x478
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x480]
movabs rcx, 0x8000000000000000
cmp qword [rax], rcx
jbe 0x14000b98b
mov rax, qword [rsp + 0x480]
cmp qword [rax], 0xffffffffffffffff
jb 0x14000b992
xor eax, eax
jmp 0x14000bb35
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rax, qword [rsp + 0x480]
mov rdx, qword [rax]
lea rcx, [0x140016cc0]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectIDEx]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x14000b9cc
xor eax, eax
jmp 0x14000bb35
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
je 0x14000ba05
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x14000ba05
mov rax, qword [rsp + 0x40]
movabs rcx, 0x8000000000000000
cmp qword [rax + 8], rcx
jbe 0x14000ba05
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0xffffffffffffffff
jb 0x14000ba0c
xor eax, eax
jmp 0x14000bb35
mov dword [rsp + 0x54], 3
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x58]
call fcn.1400011e0
mov dword [rsp + 0x34], 0
jmp 0x14000ba50
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x480]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x34], eax
jae 0x14000bb26
lfence
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x18
mov rcx, qword [rsp + 0x480]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov ecx, dword [rsp + 0x34]
imul rcx, rcx, 0x18
mov rdx, qword [rsp + 0x480]
mov rdx, qword [rdx + 8]
mov rcx, qword [rdx + rcx]
mov r8, rax
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x256]
call fcn.1400011a0
lea rcx, [rsp + 0x50]
call fcn.140002a00
movzx eax, al
test eax, eax
je 0x14000bb0e
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov byte [rsp + 0x30], al
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lea r8, [rsp + 0x256]
lea rdx, [rsp + 0x58]
lea rcx, [0x14000d380]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x38], 0xc0000225
jmp 0x14000bb26
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rsp + rax + 0x256], cx
jmp 0x14000ba46
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_CmCallbackReleaseKeyObjectIDEx]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x478
ret
Function at 0x14000bb50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x470]
movabs rcx, 0x8000000000000000
cmp qword [rax], rcx
jbe 0x14000bb9b
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0xffffffffffffffff
jb 0x14000bba2
xor eax, eax
jmp 0x14000bce7
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x470]
mov rdx, qword [rax]
lea rcx, [0x140016cc0]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectIDEx]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x14000bbdc
xor eax, eax
jmp 0x14000bce7
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0
je 0x14000bc15
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
test eax, eax
je 0x14000bc15
mov rax, qword [rsp + 0x38]
movabs rcx, 0x8000000000000000
cmp qword [rax + 8], rcx
jbe 0x14000bc15
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jb 0x14000bc1c
xor eax, eax
jmp 0x14000bce7
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.1400011e0
mov rax, qword [rsp + 0x470]
mov rax, qword [rax + 8]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x470]
mov rcx, qword [rcx + 8]
mov r8, rax
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x246]
call fcn.1400011a0
mov dword [rsp + 0x44], 3
lea rcx, [rsp + 0x40]
call fcn.140002a00
movzx eax, al
test eax, eax
je 0x14000bcd8
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov byte [rsp + 0x30], al
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lea r8, [rsp + 0x246]
lea rdx, [rsp + 0x48]
lea rcx, [0x14000d350]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 0xc0000225
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_CmCallbackReleaseKeyObjectIDEx]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x468
ret
Function at 0x14000bd00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x470]
movabs rcx, 0x8000000000000000
cmp qword [rax], rcx
jbe 0x14000bd4b
mov rax, qword [rsp + 0x470]
cmp qword [rax], 0xffffffffffffffff
jb 0x14000bd52
xor eax, eax
jmp 0x14000be97
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x470]
mov rdx, qword [rax]
lea rcx, [0x140016cc0]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectIDEx]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x14000bd8c
xor eax, eax
jmp 0x14000be97
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0
je 0x14000bdc5
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
test eax, eax
je 0x14000bdc5
mov rax, qword [rsp + 0x38]
movabs rcx, 0x8000000000000000
cmp qword [rax + 8], rcx
jbe 0x14000bdc5
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jb 0x14000bdcc
xor eax, eax
jmp 0x14000be97
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x48]
call fcn.1400011e0
mov rax, qword [rsp + 0x470]
mov rax, qword [rax + 8]
movzx eax, word [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x470]
mov rcx, qword [rcx + 8]
mov r8, rax
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x246]
call fcn.1400011a0
mov dword [rsp + 0x44], 1
lea rcx, [rsp + 0x40]
call fcn.140002a00
movzx eax, al
test eax, eax
je 0x14000be88
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov byte [rsp + 0x30], al
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lea r8, [rsp + 0x246]
lea rdx, [rsp + 0x48]
lea rcx, [0x14000d3b0]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 0xc0000022
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_CmCallbackReleaseKeyObjectIDEx]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x468
ret
Function at 0x14000cc20
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax]
call fcn.14000d040
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x14000cc62
lfence
mov eax, dword [rsp + 0x24]
jmp 0x14000ccfa
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 4]
shl eax, 4
mov rcx, qword [rsp + 0x50]
movzx ecx, byte [rcx + 5]
or eax, ecx
mov byte [rsp + 0x20], al
call fcn.140004150
mov eax, eax
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x20]
mov byte [rax], cl
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 4]
and al, 7
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 2]
and cl, 0xf8
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 2], al
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 5]
and al, 0xf
shl al, 4
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 2]
and cl, 0xf
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 2], al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x14000cd00
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x78
mov dword [rsp + 0x20], 0
lea rdx, [0x140012f90]
lea rcx, [rsp + 0x30]
call fcn.140001220
mov ecx, dword [rsp + 0x80]
call fcn.1400035a0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14000cd55
mov dword [rsp + 0x38], 0xc0000001
lea rcx, [rsp + 0x30]
call fcn.140001260
mov eax, dword [rsp + 0x38]
jmp 0x14000ce4f
call fcn.1400031e0
mov dword [rsp + 0x24], eax
call fcn.140003980
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x24], 0xc0000001
je 0x14000cd7b
cmp dword [rsp + 0x28], 0xc0000001
jne 0x14000cd96
mov dword [rsp + 0x3c], 0xc0000001
lea rcx, [rsp + 0x30]
call fcn.140001260
mov eax, dword [rsp + 0x3c]
jmp 0x14000ce4f
mov ecx, 4
call fcn.14000d040
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x14000cdd4
lfence
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x30]
call fcn.140001260
mov eax, dword [rsp + 0x40]
jmp 0x14000ce4f
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.1400014d0
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x30]
call fcn.140001260
mov eax, dword [rsp + 0x44]
add rsp, 0x78
ret
Function at 0x2fc5041c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc5052a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc504bc2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc527108]
test eax, eax
je 0x2fc504c5a
lea rax, [0x2fc5270e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc527110]
mov qword [rbp - 8], rax
jmp 0x2fc504c3e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc504c32
cmp qword [rbp - 0x10], 0
je 0x2fc504c32
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc504bf8
lea rax, [0x2fc5270e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc504c5b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc504d60
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc504d88
mov eax, 0
jmp 0x2fc504dd6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc504db1
mov eax, 0
jmp 0x2fc504dd6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc504dd1
mov eax, 0
jmp 0x2fc504dd6
mov eax, 1
add rsp, 0x20
pop rbp
ret