joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f10
Capabilities:
Print debug messages
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
xor r15d, r15d
mov r12, r9
mov ebp, r8d
mov r14, rdx
mov qword [rax + 8], r15
mov ebx, r15d
test rcx, rcx
je 0x1400020a2
test rdx, rdx
je 0x1400020a2
test r8d, r8d
je 0x1400020a2
mov esi, dword [rsp + 0xf0]
test esi, esi
je 0x1400020a2
mov qword [rax - 0x50], rcx
lea r9, [rax - 0x70]
lea r8, [rax - 0x60]
lea rcx, [rax + 8]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x20
mov dword [rax - 0x60], 0x30
mov qword [rax - 0x58], r15
mov dword [rax - 0x48], 0x240
mov qword [rax - 0x40], r15
mov qword [rax - 0x38], r15
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov edi, eax
test eax, eax
js 0x140002081
mov qword [rsp + 0xd8], r13
cmp ebp, esi
mov r13d, esi
cmovb r13d, ebp
xor ecx, ecx
mov r8d, 0x46425244
mov edx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
jne 0x140001fea
mov edi, 0xc000009a
jmp 0x140002066
mov qword [rsp + 0x50], r12
nop
mov qword [rsp + 0x40], r15
mov ecx, r13d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x38], rdx
sub ecx, ebx
mov eax, ebx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0xd0]
add rax, rbp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, eax
test eax, eax
js 0x14000204d
mov rax, qword [rsp + 0x60]
add qword [rsp + 0x50], rax
add ebx, eax
cmp ebx, esi
jae 0x14000204d
test rax, rax
jne 0x140001ff0
test ebx, ebx
jne 0x140002058
mov edi, 0xc0000001
jmp 0x140002066
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.14000a930
mov r13, qword [rsp + 0xd8]
test rbp, rbp
je 0x140002081
mov edx, 0x46425244
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000209c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0xd0], r15
test edi, edi
js 0x1400020a7
jmp 0x1400020b5
mov edi, 0xc000000d
lea rcx, str.ReadFileDataBlock_failed__status___08x_n
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0xa0]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400020e0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xb0
xor r15d, r15d
mov r13, r9
mov ebp, r8d
mov r12, rdx
mov qword [rax + 8], r15
mov ebx, r15d
test rcx, rcx
je 0x14000228d
test rdx, rdx
je 0x14000228d
test r8d, r8d
je 0x14000228d
mov esi, dword [rsp + 0x100]
test esi, esi
je 0x14000228d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 3
mov qword [rax - 0x50], rcx
mov dword [rsp + 0x30], 2
lea r9, [rax - 0x70]
lea r8, [rax - 0x60]
lea rcx, [rax + 8]
mov edx, 0x100002
mov dword [rsp + 0x28], 0x80
mov dword [rax - 0x60], 0x30
mov qword [rsp + 0x20], r15
mov qword [rax - 0x58], r15
mov dword [rax - 0x48], 0x240
mov qword [rax - 0x40], r15
mov qword [rax - 0x38], r15
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
test eax, eax
js 0x14000226c
mov qword [rsp + 0xe8], r14
cmp ebp, esi
mov r14d, esi
cmovb r14d, ebp
mov r8d, 0x46425752
xor ecx, ecx
mov edx, r14d
mov edi, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
jne 0x1400021d9
mov edi, 0xc000009a
jmp 0x140002251
mov r8, rdi
mov rdx, r12
mov rcx, rax
call fcn.14000a930
mov qword [rsp + 0x60], r13
nop dword [rax]
mov qword [rsp + 0x40], r15
mov ecx, r14d
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rdx
sub ecx, ebx
mov eax, ebx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0xe0]
add rax, rbp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov edi, eax
test eax, eax
js 0x140002248
mov rax, qword [rsp + 0x70]
add qword [rsp + 0x60], rax
add ebx, eax
cmp ebx, esi
jb 0x1400021f0
test ebx, ebx
jne 0x140002251
mov edi, 0xc0000001
mov r14, qword [rsp + 0xe8]
test rbp, rbp
je 0x14000226c
mov edx, 0x46425752
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x140002287
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0xe0], r15
test edi, edi
js 0x140002292
jmp 0x1400022a0
mov edi, 0xc000000d
lea rcx, str.WriteFileDataBlock_failed__status___08x_n
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0xb0]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140002700
Capabilities:
Print debug messages
Set file attributes

Disassembly:
mov rax, rsp
push rbx
push rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov rdi, rdx
mov qword [rax + 8], r12
test rcx, rcx
je 0x14000283d
test rdx, rdx
je 0x14000283d
mov qword [rax - 0x38], rcx
mov dword [rax - 0x60], 0x60
lea r9, [rax - 0x58]
lea rcx, [rax + 8]
lea r8, [rax - 0x48]
mov edx, 0x100180
mov dword [rax - 0x48], 0x30
mov qword [rax - 0x40], r12
mov dword [rax - 0x30], 0x240
mov qword [rax - 0x28], r12
mov qword [rax - 0x20], r12
mov dword [rax - 0x68], 7
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
test eax, eax
js 0x140002813
mov qword [rsp + 0x98], rbp
movzx ebp, word [rdi]
xor ecx, ecx
add ebp, 0x18
mov qword [rsp + 0xa0], rsi
mov edx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, ebp
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14000aca0
mov byte [rsi], 1
mov qword [rsi + 8], r12
movzx ecx, word [rdi]
lea r8, [rsi + 0x14]
mov dword [rsi + 0x10], ecx
mov rdx, qword [rdi + 8]
nop dword [rax]
movzx ecx, word [rdx]
add r8, 2
add rdx, 2
mov word [r8 - 2], cx
test cx, cx
jne 0x1400027c0
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x30]
mov r9d, ebp
mov r8, rsi
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14000282e
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x90], r12
test ebx, ebx
js 0x140002842
mov eax, ebx
add rsp, 0x70
pop r12
pop rdi
pop rbx
ret
mov ebx, 0xc000000d
lea rcx, str.RenameFile_failed__status___08x_n
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
add rsp, 0x70
pop r12
pop rdi
pop rbx
ret
Function at 0x140002860
Capabilities:
Get file attributes
Print debug messages
Set file attributes
Write file on windows

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0xc0
xor r12d, r12d
mov qword [rsp + 0xe0], r12
mov edi, r12d
test rcx, rcx
jne 0x140002889
mov ebx, 0xc000000d
jmp 0x140002a8d
mov qword [rsp + 0x88], rcx
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0xe0]
mov edx, 0x100002
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x90], 0x240
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
test eax, eax
js 0x140002a6e
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x46424f56
mov qword [rsp + 0xb8], rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
jne 0x140002920
mov ebx, 0xc000009a
jmp 0x140002a47
mov qword [rsp + 0xf0], r12
movabs rax, 0xfffff78000000014
mov qword [rsp + 0xb0], rsi
mov rax, qword [rax]
mov rbx, rbp
mov esi, 0x1000
mov qword [rsp + 0xf0], rax
nop dword [rax]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
inc rbx
sub rsi, 1
mov byte [rbx - 1], al
jne 0x140002950
mov rcx, qword [rsp + 0xe0]
lea r9d, [rsi + 0x18]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rsi, qword [rsp + 0xb0]
mov ebx, eax
test eax, eax
js 0x140002a47
mov rcx, qword [rsp + 0xe0]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x50]
mov r9d, 8
mov qword [rsp + 0xf8], r12
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebx, eax
test eax, eax
js 0x140002a47
mov qword [rsp + 0xe8], r12
nop
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x1000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
js 0x140002a3d
mov rax, qword [rsp + 0x58]
add qword [rsp + 0xe8], rax
add edi, eax
mov eax, edi
cmp rax, qword [rsp + 0x68]
jl 0x1400029e0
mov eax, 0xc0000001
test edi, edi
cmove ebx, eax
test rbp, rbp
je 0x140002a66
xor eax, eax
mov rdi, rbp
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rcx, rbp
mov edx, 0x46424f56
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x140002a89
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0xe0], r12
test ebx, ebx
jns 0x140002a9b
lea rcx, str.OverwriteFileRandom_failed__status___08x_n
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
add rsp, 0xc0
pop r12
pop rdi
pop rbx
ret
Function at 0x140003170
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x70
xor eax, eax
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x40], esi
mov edx, 0x218
xor ecx, ecx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
mov qword [r11 + 0x10], rsi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov r8d, 0x218
mov rcx, rax
mov rdi, rax
call fcn.14000aca0
mov r11d, 0x82
mov rcx, rdi
sub rbx, rdi
lea rax, [r11 + 0x7fffff7c]
test rax, rax
je 0x1400031f7
movzx eax, word [rbx + rcx]
test ax, ax
je 0x1400031f7
mov word [rcx], ax
add rcx, 2
sub r11, 1
jne 0x1400031d3
jmp 0x1400031fc
test r11, r11
jne 0x140003200
sub rcx, 2
mov word [rcx], si
mov dword [rdi + 0x210], 0x400
mov dword [rdi + 0x214], 1
lea rcx, [0x140002e30]
lea rax, [0x1400056e0]
mov qword [rsp + 0x30], rdi
mov qword [rdi + 0x208], rax
mov qword [rsp + 0x28], rcx
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x88]
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x58], 0x200
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x14000328e
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003ca0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x480
xor eax, eax
mov r12, rcx
mov rbx, r8
xor r13d, r13d
lea rcx, [rsp + 0x74]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x70], r13d
call fcn.14000aca0
mov edx, dword [rbx + 0xc]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.14000aca0
mov esi, dword [rbx + 0xc]
mov ebx, 0xc0000001
mov edi, r13d
test esi, esi
je 0x140003d7b
nop word [rax + rax]
xor eax, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov ecx, esi
sub ecx, edi
mov eax, edi
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140003d70
cmp eax, 0x80000005
jne 0x140003d7b
add edi, dword [rsp + 0x68]
mov ebx, r13d
cmp edi, esi
jb 0x140003d20
test ebx, ebx
js 0x140003dde
mov r8d, dword [rbp + 4]
mov ecx, dword [rbp]
lea rdx, [rbp + 8]
call fcn.140003360
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
test eax, eax
mov dword [rsp + 0x74], eax
mov ecx, r13d
setns cl
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x404
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
cmovns ebx, r13d
test rbp, rbp
je 0x140003dee
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x480]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140003e10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x480
xor eax, eax
mov r12, rcx
mov rbx, r8
xor r13d, r13d
lea rcx, [rsp + 0x74]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x70], r13d
call fcn.14000aca0
mov edx, dword [rbx + 0xc]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.14000aca0
mov esi, dword [rbx + 0xc]
mov ebx, 0xc0000001
mov edi, r13d
test esi, esi
je 0x140003eeb
nop word [rax + rax]
xor eax, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov ecx, esi
sub ecx, edi
mov eax, edi
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140003ee0
cmp eax, 0x80000005
jne 0x140003eeb
add edi, dword [rsp + 0x68]
mov ebx, r13d
cmp edi, esi
jb 0x140003e90
test ebx, ebx
js 0x140003f4e
mov r8d, dword [rbp + 4]
mov ecx, dword [rbp]
lea rdx, [rbp + 8]
call fcn.1400038d0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
test eax, eax
mov dword [rsp + 0x74], eax
mov ecx, r13d
setns cl
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x404
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
cmovns ebx, r13d
test rbp, rbp
je 0x140003f5e
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x480]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140003f80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov edx, dword [r8 + 0xc]
xor eax, eax
mov r12, rcx
xor r13d, r13d
xor ecx, ecx
mov rbx, r8
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.14000aca0
mov esi, dword [rbx + 0xc]
mov ebx, 0xc0000001
mov edi, r13d
test esi, esi
je 0x14000403b
xor eax, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov ecx, esi
sub ecx, edi
mov eax, edi
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140004030
cmp eax, 0x80000005
jne 0x14000403b
add edi, dword [rsp + 0x58]
mov ebx, r13d
cmp edi, esi
jb 0x140003fe0
test ebx, ebx
js 0x1400040be
lea rcx, [rsp + 0x70]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rbp + 0x141c]
lea rax, [rbp + 0x1414]
mov qword [rsp + 0x28], r11
lea r9, [rbp + 0x140c]
lea r8, [rbp + 0x1404]
lea rdx, [rbp + 0x1400]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001ae0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0x1424
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
cmovns ebx, r13d
test rbp, rbp
je 0x1400040ce
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400040f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x490
xor eax, eax
mov r12, rcx
mov rbx, r8
xor r13d, r13d
lea rcx, [rsp + 0x84]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x80], r13d
call fcn.14000aca0
mov edx, dword [rbx + 0xc]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.14000aca0
mov esi, dword [rbx + 0xc]
mov ebx, 0xc0000001
mov edi, r13d
test esi, esi
je 0x1400041cb
nop dword [rax]
xor eax, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov ecx, esi
sub ecx, edi
mov eax, edi
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x1400041c0
cmp eax, 0x80000005
jne 0x1400041cb
add edi, dword [rsp + 0x68]
mov ebx, r13d
cmp edi, esi
jb 0x140004170
test ebx, ebx
js 0x140004270
lea rcx, [rsp + 0x70]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rbp + 0x141c]
lea rax, [rbp + 0x1414]
mov qword [rsp + 0x28], r11
lea r9, [rbp + 0x140c]
lea r8, [rbp + 0x1404]
lea rdx, [rbp + 0x1400]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001cf0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
test eax, eax
mov dword [rsp + 0x84], eax
mov ecx, r13d
setns cl
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 0x404
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x80], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
cmovns ebx, r13d
test rbp, rbp
je 0x140004280
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x490]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400042a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov edx, dword [r8 + 0xc]
xor eax, eax
mov r12, rcx
xor r13d, r13d
xor ecx, ecx
mov rbx, r8
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.14000aca0
mov esi, dword [rbx + 0xc]
mov edi, 0xc0000001
mov ebx, r13d
test esi, esi
je 0x14000435b
xor eax, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov ecx, esi
sub ecx, ebx
mov eax, ebx
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, eax
test eax, eax
jns 0x140004350
cmp eax, 0x80000005
jne 0x14000435b
add ebx, dword [rsp + 0x58]
mov edi, r13d
cmp ebx, esi
jb 0x140004300
test edi, edi
js 0x140004436
mov edx, dword [rbp + 0x808]
xor ecx, ecx
add rdx, 0x814
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbp + 0x808]
xor edx, edx
add r8, 0x814
mov rcx, rax
mov rbx, rax
call fcn.14000aca0
mov rcx, rbx
mov rdx, rbp
mov r8d, 0x814
call fcn.14000a930
lea rcx, [rsp + 0x70]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8d, dword [rbx + 0x808]
mov r9, qword [rbx + 0x800]
lea rdx, [rbx + 0x814]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x20], r8d
call fcn.140001f10
mov qword [rsp + 0x40], r13
mov ecx, r13d
test eax, eax
mov dword [rbx + 0x810], eax
mov qword [rsp + 0x38], r13
setns cl
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x80c], ecx
mov eax, dword [rbp + 0x808]
xor edx, edx
add eax, 0x814
mov rcx, r12
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, rbx
mov edi, eax
test eax, eax
cmovns edi, r13d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbp, rbp
je 0x140004446
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140004470
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x490
xor eax, eax
mov r12, rcx
mov rbx, r8
xor r13d, r13d
lea rcx, [rsp + 0x84]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x80], r13d
call fcn.14000aca0
mov edx, dword [rbx + 0xc]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.14000aca0
mov esi, dword [rbx + 0xc]
mov ebx, 0xc0000001
mov edi, r13d
test esi, esi
je 0x14000454b
nop dword [rax]
xor eax, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov ecx, esi
sub ecx, edi
mov eax, edi
xor r9d, r9d
mov dword [rsp + 0x30], ecx
add rax, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140004540
cmp eax, 0x80000005
jne 0x14000454b
add edi, dword [rsp + 0x68]
mov ebx, r13d
cmp edi, esi
jb 0x1400044f0
test ebx, ebx
js 0x1400045dd
lea rcx, [rsp + 0x70]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8d, dword [rbp + 0x808]
mov r9, qword [rbp + 0x800]
lea rdx, [rbp + 0x814]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x20], r8d
call fcn.1400020e0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
test eax, eax
mov dword [rsp + 0x84], eax
mov ecx, r13d
setns cl
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 0x404
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x80], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
cmovns ebx, r13d
test rbp, rbp
je 0x1400045ed
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x490]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret