joyce8/EMBER2024-capa huggingface dataset:
Function at 0x112b8
Capabilities:
Attach user process memory
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rdi, rdx
xor bl, bl
mov byte [rsp + 0xa0], bl
xor r14d, r14d
lea rax, [0x00016f70]
mov qword [r11 + 0x20], rax
lea rax, [0x00016f90]
mov qword [r11 - 0x60], rax
xor esi, esi
mov qword [r11 - 0x68], rsi
lea rdx, [r11 - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x11316
mov bl, 1
mov byte [rsp + 0xa0], bl
jmp 0x1137a
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
je 0x11330
mov bl, 1
mov byte [rsp + 0xa0], bl
jmp 0x1137a
mov ecx, 0x10b
cmp word [rax + 0x18], cx
jne 0x11341
mov r14d, dword [rax + 0x50]
jmp 0x11350
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x11350
mov r14d, dword [rax + 0x50]
mov r12d, r14d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1137a
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.00016ab0
nop
test rsi, rsi
jne 0x1138d
mov bl, 1
mov byte [rsp + 0xa0], bl
jmp 0x11428
xor r12d, r12d
xor r13d, r13d
mov r8, qword [rsp + r13*8 + 0xa8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
mov edx, r14d
mov rcx, rsi
call fcn.000111bc
test al, al
jne 0x1140f
inc r12d
inc r13
cmp r12d, 1
jb 0x11393
xor r12d, r12d
xor r13d, r13d
mov r8, qword [rsp + r13*8 + 0x28]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
lea r9d, [rcx + rcx - 2]
mov edx, r14d
mov rcx, rsi
call fcn.000111bc
test al, al
jne 0x11404
inc r12d
inc r13
cmp r12d, 1
jb 0x113ce
jmp 0x11428
mov bl, 1
mov byte [rsp + 0xa0], bl
jmp 0x11428
mov bl, 1
mov byte [rsp + 0xa0], bl
jmp 0x11428
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x11442
test rsi, rsi
je 0x11452
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
jmp 0x11458
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x11500
Capabilities:
Get file attributes
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
xor ebp, ebp
xor eax, eax
mov rbx, rcx
mov rdi, rdx
mov dword [rsp + 0x5c], eax
lea rcx, [r11 - 0x2c]
lea r8d, [rbp + 0x14]
xor edx, edx
mov dword [rsp + 0x58], ebp
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x48], rbp
mov qword [r11 - 0x38], rax
mov dword [r11 + 0x20], ebp
mov dword [r11 + 0x24], eax
mov dword [rsp + 0x68], ebp
call fcn.00016910
lea esi, [rbp + 0x68]
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x30], esi
lea r9d, [rsi + 0x18]
mov r8d, 0x1f01ff
mov rdx, rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebp
call fcn.00011474
cmp eax, ebp
mov ebx, eax
jl 0x116a1
mov dword [rsp + 0x30], esi
lea esi, [rbp + 5]
lea rcx, [rsp + 0x50]
lea r9d, [rsi + 0x7b]
mov r8d, 0x1f01ff
mov rdx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.00011474
cmp eax, ebp
mov ebx, eax
jl 0x116a1
mov rcx, qword [rsp + 0xb0]
lea r9d, [rbp + 0x18]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, ebp
mov ebx, eax
jl 0x116a1
mov esi, dword [rsp + 0x70]
cmp esi, ebp
je 0x116a1
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, rbp
jne 0x11604
mov ebx, 0xc000009a
jmp 0x11691
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.00016910
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, ebp
mov ebx, eax
jl 0x11691
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
cmp eax, ebp
cmovge ebx, ebp
cmp rdi, rbp
je 0x116a1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x116b1
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0xb0]
cmp rcx, rbp
je 0x116c4
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x116e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x88
xor esi, esi
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], esi
mov dword [rax + 0x18], esi
mov dword [rax + 8], esi
lea eax, [rsi + 0xa]
mov edi, esi
mov word [rsp + 0x40], ax
lea eax, [rsi + 0xc]
lea ebp, [rsi + 0x30]
mov word [rsp + 0x42], ax
lea rax, [0x00016fc0]
mov qword [rsp + 0x48], rax
jmp 0x11737
mov ecx, 0x1f4
call fcn.000163b0
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, esi
jl 0x11728
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, esi
jge 0x117e3
xor eax, eax
jmp 0x118d3
mov ebp, 0x400
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
cmp rax, rsi
je 0x118b0
mov r8, rbp
xor edx, edx
mov rcx, rax
mov dword [rsp + 0xc0], esi
call fcn.00016910
mov rcx, qword [rsp + 0xc8]
lea r11, [rsp + 0xc0]
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], r11
mov r8d, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov rcx, qword [rsp + 0xc8]
mov r9d, 4
xor r8d, r8d
cmp eax, esi
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
jge 0x1187f
lea edi, [r9 - 3]
lea rax, [rsp + 0xb0]
mov dword [rsp + 0xb0], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
jmp 0x118a5
mov eax, dword [rbx + 0xc]
inc eax
mov dword [rsp + 0xb0], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, dword [rsp + 0xb0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rsi
je 0x118d1
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
add rsp, 0x88
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x11984
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xc0
and dword [rsp + 0x60], 0
and qword [r11 + 8], 0
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x64], eax
lea r8d, [rax + 0x28]
lea rcx, [r11 - 0x38]
xor edx, edx
mov qword [r11 - 0x60], rax
call fcn.00016910
xor edi, edi
lea rcx, [rsp + 0x74]
and dword [rsp + 0x70], edi
lea r8d, [rdi + 0x14]
xor edx, edx
call fcn.00016910
and dword [rsp + 0x50], edi
and qword [rsp + 0x48], rdi
and qword [rsp + 0x90], rdi
and qword [rsp + 0xa8], rdi
and qword [rsp + 0xb0], rdi
mov dword [rsp + 0x40], 0x68
lea eax, [rdi + 1]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xd0]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], rdi
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov qword [rsp + 0x98], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x11a89
mov rcx, qword [rsp + 0xd0]
lea r9d, [rdi + 0x18]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x11a89
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x11a89
cmp dword [rsp + 0x7c], edi
cmove edi, eax
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x11a9c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
Function at 0x11ba4
Capabilities:
Get file attributes
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x90
and dword [rsp + 0x60], 0
and qword [r11 - 0x58], 0
xor eax, eax
and dword [rsp + 0x58], eax
and dword [rsp + 0x70], eax
mov rdi, rcx
mov dword [rsp + 0x64], eax
lea r8d, [rax + 0x14]
lea rcx, [r11 - 0x34]
xor edx, edx
mov qword [r11 - 0x40], rax
mov dword [rsp + 0x5c], eax
call fcn.00016910
mov edx, 0x400
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
jne 0x11c0e
mov eax, 0xc000009a
jmp 0x11d13
mov r8, qword [rsp + 0xb8]
mov ebp, 0x3ff
lea r9, [rsp + 0xc0]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe__vsnprintf]
test eax, eax
js 0x11c3c
cdqe
cmp rax, rbp
ja 0x11c3c
jne 0x11c43
mov byte [rbx + 0x3ff], 0
mov dword [rsp + 0x30], 0x68
lea rcx, [rsp + 0x50]
mov r9d, 0x80
mov r8d, 0x100082
mov rdx, rdi
mov dword [rsp + 0x28], 3
and dword [rsp + 0x20], 0
call fcn.00011474
test eax, eax
jns 0x11c85
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x11d11
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x11cfb
mov eax, dword [rsp + 0x78]
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov qword [rsp + 0x58], rax
xor eax, eax
xor r9d, r9d
and qword [rsp + 0x40], rax
repne scasb al, byte [rdi]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
not rcx
lea rax, [rsp + 0x60]
dec rcx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
add rsp, 0x90
pop rdi
pop rbp
pop rbx
ret
Function at 0x11d24
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xc0
xor r13d, r13d
xor eax, eax
mov rbp, r8
mov rbx, rcx
mov r12, rdx
mov dword [r11 - 0x78], r13d
mov dword [rsp + 0x64], eax
lea r8d, [r13 + 0x28]
lea rcx, [r11 - 0x48]
xor edx, edx
mov qword [r11 + 8], r13
mov qword [r11 - 0x70], rax
call fcn.00016910
lea r8d, [r13 + 0x14]
lea rcx, [rsp + 0x74]
xor edx, edx
mov dword [rsp + 0x70], r13d
call fcn.00016910
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x68
lea eax, [r13 + 1]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], r13
mov dword [rsp + 0xa0], 0x240
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r13d
mov ebx, eax
jl 0x11eb2
mov rcx, qword [rsp + 0xe0]
lea r9d, [r13 + 0x18]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r13d
mov ebx, eax
jl 0x11eb2
mov edi, dword [rsp + 0x78]
cmp edi, r13d
je 0x11ead
cmp dword [rsp + 0x7c], r13d
jne 0x11ead
lea ebx, [rdi + 1]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r13
je 0x11ead
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.00016910
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r13d
mov ebx, eax
jl 0x11eb2
mov qword [r12], rsi
mov dword [rbp], edi
jmp 0x11eb2
mov ebx, 0xc0000098
mov rcx, qword [rsp + 0xe0]
cmp rcx, r13
je 0x11ec5
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x11eec
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0x70
and qword [rax - 0x30], 0
and qword [rax - 0x18], 0
and qword [rax - 0x10], 0
mov rdi, rcx
mov qword [rax - 0x28], rcx
lea r8, [rax - 0x38]
lea rcx, [rax + 0x10]
mov edx, 0xf003f
mov dword [rax - 0x38], 0x30
mov dword [rax - 0x20], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x11fd7
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov ebx, eax
test eax, eax
js 0x11fbb
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x88]
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov ebx, eax
test eax, eax
js 0x11fd9
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x11ff0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x2a0
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebx, ebx
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov word [rsp + 0x80], bx
call fcn.00016910
lea rdx, [0x00017050]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call fcn.00011eec
lea rdx, [0x000170d0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00011d24
cmp eax, ebx
jne 0x120c3
mov r9, qword [rsp + 0x20]
lea r8, [0x00017100]
lea rcx, [rsp + 0x80]
mov edx, 0x208
call fcn.00011008
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.00016188
mov rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x00017170]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00011d24
cmp eax, ebx
jne 0x1215f
mov r9, qword [rsp + 0x20]
lea r8, [0x000171a0]
lea rcx, [rsp + 0x80]
mov edx, 0x208
call fcn.00011008
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.00016820
add rsp, 0x2a0
pop rbx
ret
Function at 0x12300
Capabilities:
Get file attributes
Print debug messages
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xd0
mov rbx, rcx
xor edi, edi
mov byte [rax + 0x10], dil
mov dword [rax - 0x38], 0x30
mov qword [rax - 0x30], rdi
mov dword [rax - 0x20], 0x240
mov qword [rax - 0x28], rcx
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x1020
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
lea r9, [rax - 0x70]
lea r8, [rax - 0x38]
mov edx, 0x110002
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x60], eax
cmp eax, edi
jge 0x124f0
cmp eax, 0xc0000022
jne 0x124f0
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xa0]
mov edx, 0x100180
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x60], eax
cmp eax, edi
jl 0x124e0
mov dword [rsp + 0x78], edi
xor edx, edx
lea r8d, [rdi + 0x24]
lea rcx, [rsp + 0x7c]
call fcn.00016910
mov dword [rsp + 0x20], 4
lea r9d, [rdi + 0x28]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x60], eax
cmp eax, edi
jge 0x1243b
mov rdx, rbx
lea rcx, [0x00017410]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x98], 0x80
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0x60], eax
cmp eax, edi
jge 0x12480
lea rcx, [0x00017440]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x1020
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xa0]
mov edx, 0x110002
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x60], eax
cmp eax, edi
jge 0x124f0
lea rcx, [0x00017460]
call sub.ntoskrnl.exe_DbgPrint
mov byte [rsp + 0xe8], 1
mov dword [rsp + 0x20], 0xd
mov r9d, 1
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebx, eax
mov dword [rsp + 0x60], eax
cmp eax, edi
jge 0x12549
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [0x00017440]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x1256b
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x12569
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x12584
Capabilities:
Delete file

Disassembly:
sub rsp, 0x68
mov rdx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x38], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
test eax, eax
jns 0x125db
lea rcx, [rsp + 0x20]
call fcn.00012300
add rsp, 0x68
ret
Function at 0x125e8
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov esi, 0x208
xor ebp, ebp
xor ecx, ecx
and dword [rsp + 0xa8], ebp
mov rdx, rsi
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x12633
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
jne 0x12645
mov rsi, qword [rsp + 0xa8]
mov edi, 0xc0000001
jmp 0x12832
mov edx, 0xc8060
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x12664
mov edi, 0xc0000001
jmp 0x12842
mov ebp, 0x208
xor edx, edx
mov rcx, rdi
mov r8, rbp
call fcn.00016910
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.00016910
xor edx, edx
mov r8d, 0xc8060
mov rcx, rsi
call fcn.00016910
mov rdx, qword [rsp + 0xa0]
or rcx, 0xffffffffffffffff
mov rdi, rdx
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
mov rcx, rbx
call fcn.00016ab0
mov edi, 0xc8060
mov rdx, rsi
mov r8d, edi
mov rcx, rbx
call fcn.00016704
mov rbp, rax
mov qword [rsp + 0xb8], rax
cmp rax, 0xffffffffffffffff
jne 0x126e5
mov eax, 0xc0000001
jmp 0x12877
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.00016910
xor edi, edi
lea rax, [rsp + 0x60]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x48], rdi
mov byte [rsp + 0x40], dil
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0xc8060
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
cmp eax, edi
jge 0x12741
mov edi, 0xc0000001
jmp 0x12832
mov rbp, qword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov edi, eax
lea rdx, [0x000174a0]
add rdi, rsi
lea rcx, [rdi + 0x5e]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
je 0x127f1
lea rdx, [0x000174b0]
lea rcx, [rdi + 0x5e]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
je 0x127f1
xor edx, edx
mov r8d, 0x208
mov rcx, rbp
call fcn.00016910
xor edx, edx
mov r8d, 0x208
mov rcx, rbx
call fcn.00016910
mov r8d, dword [rdi + 0x3c]
lea rdx, [rdi + 0x5e]
mov rcx, rbp
call fcn.00016ab0
test byte [rdi + 0x38], 0x10
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rbp
lea r8, [0x000174c0]
mov edx, 0x208
mov rcx, rbx
je 0x127e4
call fcn.00011008
mov rcx, rbx
call fcn.000125e8
jmp 0x127f1
call fcn.00011008
mov rcx, rbx
call fcn.00012584
cmp dword [rdi], 0
je 0x1280b
mov eax, dword [rsp + 0xa8]
add eax, dword [rdi]
mov dword [rsp + 0xa8], eax
jmp 0x12750
mov rbp, qword [rsp + 0xb8]
test rbp, rbp
je 0x12823
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor ebp, ebp
mov rcx, qword [rsp + 0xa0]
call fcn.00012584
mov edi, eax
test rsi, rsi
je 0x12842
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
je 0x12852
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x12867
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbp, rbp
je 0x12875
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret