joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001da0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp dx, 4
je 0x140001db4
mov eax, 0xc000000d
add rsp, 0x28
ret
movzx edx, word [rcx]
mov ecx, edx
test edx, edx
je 0x140001df5
sub ecx, 1
je 0x140001dec
sub ecx, 1
je 0x140001de3
cmp ecx, 1
je 0x140001dda
lea rcx, [0x140011970]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001daa
add rsp, 0x28
jmp 0x14000aca4
add rsp, 0x28
jmp 0x14000ad58
add rsp, 0x28
jmp 0x14000fc78
add rsp, 0x28
jmp 0x14000fc6c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [0x14006d220]
call fcn.1400109bc
mov esi, eax
test eax, eax
js 0x14000acfd
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
movzx r9d, dil
mov qword [rsp + 0x28], rbx
lea r8, [0x140012b30]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000ad3a
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x140012ba0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d220]
call fcn.140010b1c
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [0x14006d228]
call fcn.1400109bc
mov esi, eax
test eax, eax
js 0x14000adb1
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
movzx r9d, dil
mov qword [rsp + 0x28], rbx
lea r8, [0x140012750]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000adee
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
mov dword [rsp + 0x30], esi
movzx r9d, bl
lea r8, [0x1400127c0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d228]
call fcn.140010b1c
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [0x14006ce58]
jmp fcn.1400109bc
push rbx
sub rsp, 0x20
mov rcx, qword [0x14006ce50]
call fcn.1400109bc
mov rcx, qword [0x14006ce50]
mov ebx, eax
call fcn.140010b1c
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140001e00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov r8d, 4
cmp dx, r8w
je 0x140001e1a
mov eax, 0xc000000d
add rsp, 0x28
ret
movzx edx, word [rcx]
mov ecx, edx
sub ecx, r8d
je 0x140001e5c
sub ecx, 1
je 0x140001e53
sub ecx, 1
je 0x140001e4a
cmp ecx, 1
je 0x140001e41
lea rcx, [0x140011970]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001e10
add rsp, 0x28
jmp 0x14000d43c
add rsp, 0x28
jmp 0x14000d430
add rsp, 0x28
jmp 0x14000d470
add rsp, 0x28
jmp 0x14000d424
mov rcx, qword [0x14006d188]
jmp fcn.14000e1c0
mov rcx, qword [0x14006d178]
jmp fcn.14000e1c0
sub rsp, 0x28
lea rcx, [0x14006d140]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea rcx, [0x14000c1a0]
call fcn.14000e428
lea rcx, [0x14006d140]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x14006d180]
jmp fcn.14000e1c0
Function at 0x140001e68
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov r8, rcx
cmp dx, 0xc
je 0x140001e7f
mov eax, 0xc000000d
add rsp, 0x28
ret
movzx edx, word [rcx]
mov ecx, edx
test edx, edx
je 0x140001ecc
sub ecx, 1
je 0x140001ebf
sub ecx, 1
je 0x140001eb2
cmp ecx, 1
je 0x140001ea5
lea rcx, [0x140011970]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001e75
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp 0x14000ae0c
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp 0x14000aed8
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp fcn.14000fcb0
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp 0x14000fca0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
mov rdx, rcx
mov rcx, qword [0x14006d220]
call fcn.140010a3c
mov esi, eax
lfence
mov rbx, cr8
test eax, eax
js 0x14000ae78
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
mov qword [rsp + 0x30], rbp
movzx r9d, bl
lea r8, [0x140012a40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000aeb3
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x38], rbp
lea r8, [0x140012ab0]
mov edx, 2
mov dword [rsp + 0x30], esi
movzx r9d, bl
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d220]
call fcn.140010b1c
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
mov rdx, rcx
mov rcx, qword [0x14006d228]
call fcn.140010a3c
mov esi, eax
lfence
mov rbx, cr8
test eax, eax
js 0x14000af44
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
mov qword [rsp + 0x30], rbp
movzx r9d, bl
lea r8, [0x140012660]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000af7f
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x38], rbp
lea r8, [0x1400126d0]
mov edx, 2
mov dword [rsp + 0x30], esi
movzx r9d, bl
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d228]
call fcn.140010b1c
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rdx, rcx
mov rcx, qword [0x14006ce58]
jmp fcn.140010a3c
Function at 0x140001edc
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov r8, rcx
cmp dx, 0xc
je 0x140001ef3
mov eax, 0xc000000d
add rsp, 0x28
ret
movzx edx, word [rcx]
mov ecx, edx
sub ecx, 4
je 0x140001f2f
sub ecx, 1
je 0x140001f22
cmp ecx, 1
je 0x140001f15
lea rcx, [0x140011970]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001ee9
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp 0x14000d64c
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp 0x14000d65c
mov rcx, qword [r8 + 4]
add rsp, 0x28
jmp 0x14000d47c
mov rdx, rcx
mov rcx, qword [0x14006d188]
jmp 0x14000e248
mov rdx, rcx
mov rcx, qword [0x14006d178]
jmp 0x14000e248
mov rdx, rcx
mov rcx, qword [0x14006d180]
jmp 0x14000e248
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rsi, rcx
add rcx, 0x70
mov r14, rdx
mov edi, 0xc0000225
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
jmp 0x14000e27f
mov rbx, qword [rax]
cmp qword [rbx], r14
je 0x14000e294
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlEnumerateGenericTableWithoutSplayingAvl]
test rax, rax
jne 0x14000e277
jmp 0x14000e2c2
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTableAvl]
test al, al
jne 0x14000e2b2
lea rcx, [0x140014350]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000e2c0
mov edx, 0x6c527350
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
lea rcx, [rsi + 0x70]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140001f3c
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov r9, rcx
cmp dx, 0xc
je 0x140001f53
mov eax, 0xc000000d
add rsp, 0x28
ret
movzx edx, word [rcx]
mov ecx, edx
sub ecx, 4
je 0x140001fad
sub ecx, 1
je 0x140001f91
cmp ecx, 2
je 0x140001f75
lea rcx, [0x140011970]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001f49
cmp word [r9 + 4], 0
movzx edx, word [r9 + 2]
mov ecx, dword [r9 + 8]
setne r8b
add rsp, 0x28
jmp 0x14000d78c
cmp word [r9 + 4], 0
movzx edx, word [r9 + 2]
mov ecx, dword [r9 + 8]
setne r8b
add rsp, 0x28
jmp 0x14000d84c
cmp word [r9 + 4], 0
movzx edx, word [r9 + 2]
mov ecx, dword [r9 + 8]
setne r8b
add rsp, 0x28
jmp 0x14000d714
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov bpl, r8b
lea rcx, [0x14006d140]
mov esi, edx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rcx, rbx
call fcn.14000e480
test rax, rax
je 0x14000d75e
test bpl, bpl
je 0x14000d757
mov dword [rax + 0xc], esi
mov dil, 1
mov byte [rax + 8], dil
mov dil, 1
lea rcx, [0x14006d140]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rbx, qword [rsp + 0x30]
neg dil
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sbb eax, eax
not eax
and eax, 0xc0000225
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov bpl, r8b
lea rcx, [0x14006d140]
mov esi, edx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rcx, rbx
call fcn.14000e480
mov rbx, rax
test rax, rax
je 0x14000d81c
mov al, byte [rax + 0x18]
test bpl, bpl
je 0x14000d7e8
test al, al
jne 0x14000d7e3
mov rcx, rbx
call fcn.14000dc78
mov rcx, rbx
call fcn.14000dce4
mov dil, 1
jmp 0x14000d812
test al, al
jne 0x14000d800
lea rcx, [0x14006d140]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov eax, 0xc0000429
jmp 0x14000d835
mov rcx, rbx
call fcn.14000d66c
mov rcx, rbx
call fcn.14000cee4
mov esi, edi
mov byte [rbx + 0x18], dil
mov dil, 1
mov dword [rbx + 0x1c], esi
lea rcx, [0x14006d140]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
neg dil
sbb eax, eax
not eax
and eax, 0xc0000225
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov bpl, r8b
lea rcx, [0x14006d140]
mov esi, edx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rcx, rbx
call fcn.14000e480
test rax, rax
je 0x14000d896
test bpl, bpl
je 0x14000d88f
mov dword [rax + 0x14], esi
mov dil, 1
mov byte [rax + 0x10], dil
mov dil, 1
lea rcx, [0x14006d140]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rbx, qword [rsp + 0x30]
neg dil
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sbb eax, eax
not eax
and eax, 0xc0000225
add rsp, 0x20
pop rdi
ret
Function at 0x140009c2c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x200
mov r8d, 0x44486c46
add bx, word [rcx]
mov ecx, 1
movzx edx, bx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor ebp, ebp
mov word [rsp + 0x42], bx
mov qword [rsp + 0x48], rax
mov word [rsp + 0x40], bp
test rax, rax
jne 0x140009c8e
lea rcx, [0x140012430]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc00000a0
jmp 0x140009d90
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000b02c
mov ebx, eax
test eax, eax
jns 0x140009ccc
lfence
mov r8, rdi
lea rcx, [0x140012840]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x48]
mov edx, 0x44486c46
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140009d90
mov rcx, qword [0x14006d220]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8, rsi
call fcn.1400101a0
mov esi, eax
test eax, eax
js 0x140009d2b
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0x40]
movzx r9d, bl
mov qword [rsp + 0x30], rcx
lea r8, [0x140012960]
mov edx, 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140009d72
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0x40]
movzx r9d, bl
mov qword [rsp + 0x38], rcx
lea r8, [0x1400129c0]
mov edx, 2
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d220]
call fcn.140010b1c
mov rcx, qword [rsp + 0x48]
mov edx, 0x44486c46
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140009da8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x200
mov r8d, 0x44486c46
add bx, word [rcx]
mov ecx, 1
movzx edx, bx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor ebp, ebp
mov word [rsp + 0x42], bx
mov qword [rsp + 0x48], rax
mov word [rsp + 0x40], bp
test rax, rax
jne 0x140009e0a
lea rcx, [0x140012430]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc00000a0
jmp 0x140009f0c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000b02c
mov ebx, eax
test eax, eax
jns 0x140009e48
lfence
mov r8, rdi
lea rcx, [0x140012460]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x48]
mov edx, 0x44486c46
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140009f0c
mov rcx, qword [0x14006d228]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8, rsi
call fcn.14001037c
mov esi, eax
test eax, eax
js 0x140009ea7
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0x40]
movzx r9d, bl
mov qword [rsp + 0x30], rcx
lea r8, [0x140012580]
mov edx, 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140009eee
lfence
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0x40]
movzx r9d, bl
mov qword [rsp + 0x38], rcx
lea r8, [0x1400125e0]
mov edx, 2
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d228]
call fcn.140010b1c
mov rcx, qword [rsp + 0x48]
mov edx, 0x44486c46
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000aae0
Capabilities:
Print debug messages
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor edx, edx
lea rcx, [0x14006d228]
call fcn.140010754
mov ebx, eax
test eax, eax
jns 0x14000ab1e
lfence
mov edx, eax
lea rcx, [0x140012290]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x14000ac58
mov rcx, qword [0x14006d228]
lea rdx, [0x14000a970]
call fcn.140010808
xor r8d, r8d
lea rdx, [0x14000ac90]
xor ecx, ecx
call section..text
mov edx, 1
lea rcx, [0x14006d220]
call fcn.140010754
mov ebx, eax
test eax, eax
jns 0x14000ab78
lfence
mov edx, eax
lea rcx, [0x140012290]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x14006d228]
call fcn.14001068c
jmp 0x14000ab17
mov rcx, qword [0x14006d220]
lea rdx, [0x14000a800]
call fcn.140010808
xor r8d, r8d
lea rdx, [0x14000ac70]
lea ecx, [r8 + 1]
call section..text
lea r8, [0x14006cb80]
mov rcx, rdi
lea rdx, [0x14006a2c0]
call sub.FLTMGR.SYS_FltRegisterFilter
mov esi, eax
test eax, eax
js 0x14000ac2a
mov rcx, qword [0x14006cb80]
call sub.FLTMGR.SYS_FltStartFiltering
mov esi, eax
lfence
test eax, eax
jns 0x14000abeb
mov edx, eax
lea rcx, [0x1400122d0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x14006cb80]
call sub.FLTMGR.SYS_FltUnregisterFilter
jmp 0x14000ac3b
mov byte [0x14006cb78], 1
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
movzx r9d, dil
mov qword [rsp + 0x28], rbx
lea r8, [0x140012350]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000ac56
lfence
mov edx, eax
lea rcx, [0x140012310]
call sub.ntoskrnl.exe_DbgPrint
lfence
mov rcx, qword [0x14006d228]
call fcn.14001068c
mov rcx, qword [0x14006d220]
call fcn.14001068c
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000afb0
Capabilities:
Check os version
Print debug messages

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14006cb38]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x114
call fcn.1400115c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
jns 0x14000affb
lfence
mov edx, eax
lea rcx, [0x140012c70]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x24], 6
jb 0x14000b00f
jne 0x14000b00b
cmp dword [rsp + 0x28], 2
jb 0x14000b00f
mov al, 1
jmp 0x14000b011
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140011110
add rsp, 0x158
ret
Function at 0x14000b434
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, r8
lea r9, [rax + 0x20]
mov r14, rdx
xor ebx, ebx
and dword [rax + 0x20], ebx
xor r8d, r8d
and dword [rax - 0x28], ebx
xor edx, edx
mov ebp, ecx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000b508
mov eax, dword [rsp + 0x20]
add dword [rsp + 0x68], eax
test rbx, rbx
je 0x14000b48c
mov edx, 0x72706c48
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, 0x6020000
call sub.ntoskrnl.exe_RtlIsNtDdiVersionAvailable
test al, al
je 0x14000b4a1
mov eax, 0x200
jmp 0x14000b4a6
call fcn.14000b588
mov edx, dword [rsp + 0x68]
mov r8d, 0x72706c48
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000b503
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
cmp eax, 0xc0000004
je 0x14000b471
lfence
test eax, eax
jns 0x14000b4f7
mov edx, 0x72706c48
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x14000b508
mov eax, dword [rsp + 0x68]
mov qword [r14], rbx
mov qword [rsi], rax
jmp 0x14000b4f3
mov eax, 0xc0000022
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14000b814
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call fcn.140009600
movabs rcx, 0x3000100000000
cmp rax, rcx
je 0x14000b83c
lea rcx, [0x140012ee0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14000b873
xor edx, edx
lea rcx, [0x14006cba8]
lea r8d, [rdx + 2]
call fcn.140004264
test eax, eax
jns 0x14000b85b
lea rcx, [0x140012f10]
jmp 0x14000b833
mov edx, 1
lea rcx, [0x14006cbc0]
call fcn.1400059c8
shr eax, 0x1f
not al
and al, 1
add rsp, 0x28
ret

Function at 0x14000b920
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.14000b730
mov dword [0x14006cb90], eax
test eax, eax
je 0x14000b984
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov ecx, dword [0x14006cb90]
lea r8, [0x140012e20]
mov dword [rsp + 0x30], ecx
mov edx, 3
movzx r9d, bl
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4a]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000b990
lea rcx, [0x140012ea0]
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000b99c
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
lea r9, [rsp + 0x30]
and qword [0x14006cba0], 0
lea r8, [0x14000b9f0]
mov edx, 0x40
mov byte [rsp + 0x30], 1
call fcn.14000b5a8
cmp qword [0x14006cba0], 0
jne 0x14000b9e0
lea rcx, [0x140012df0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret
Function at 0x14000bb10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x50
mov bpl, r8b
mov r14d, edx
mov rdi, rcx
mov ebx, 0x200
add bx, word [rcx]
mov r8d, 0x6e4d7350
movzx edx, bx
mov ecx, 1
mov rsi, r9
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r12d, r12d
mov word [rsp + 0x42], bx
mov qword [rsp + 0x48], rax
mov word [rsp + 0x40], r12w
test rax, rax
jne 0x14000bb7e
lea rcx, [0x140012430]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc00000a0
jmp 0x14000bc29
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000b02c
mov ebx, eax
test eax, eax
jns 0x14000bba7
lfence
mov r8, rdi
lea rcx, [0x140013820]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000bc17
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0x40]
movzx r9d, bl
mov qword [rsp + 0x30], rcx
lea r8, [0x1400141a0]
mov edx, 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d188]
lea rdx, [rsp + 0x40]
mov r9, rsi
mov r8d, r14d
call fcn.14000de88
mov ebx, eax
test bpl, bpl
je 0x14000bc17
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov dl, 1
call fcn.14000d8c4
mov rcx, qword [rsp + 0x48]
mov edx, 0x6e4d7350
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x14000bc44
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x50
mov bpl, r8b
mov r14d, edx
mov rdi, rcx
mov ebx, 0x200
add bx, word [rcx]
mov r8d, 0x6e4d7350
movzx edx, bx
mov ecx, 1
mov rsi, r9
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r12d, r12d
mov word [rsp + 0x42], bx
mov qword [rsp + 0x48], rax
mov word [rsp + 0x40], r12w
test rax, rax
jne 0x14000bcb2
lea rcx, [0x140012430]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc00000a0
jmp 0x14000bd5d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000b02c
mov ebx, eax
test eax, eax
jns 0x14000bcdb
lfence
mov r8, rdi
lea rcx, [0x140013820]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000bd4b
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0x40]
movzx r9d, bl
mov qword [rsp + 0x30], rcx
lea r8, [0x140014210]
mov edx, 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x14006d178]
lea rdx, [rsp + 0x40]
mov r9, rsi
mov r8d, r14d
call fcn.14000de88
mov ebx, eax
test bpl, bpl
je 0x14000bd4b
mov r9b, 1
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call fcn.14000d8c4
mov rcx, qword [rsp + 0x48]
mov edx, 0x6e4d7350
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret