joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14a58
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp byte [0x000266c2], bl
je 0x14a7b
lea rcx, [0x0001eb40]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rdi
call fcn.00014784
movzx ecx, word [rdi + 8]
call fcn.00016964
cmp al, bl
jne 0x14a9a
mov rcx, rdi
call fcn.00016a34
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14ab0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x00025280]
mov r13d, edx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rbx, qword [0x000251c8]
mov byte [0x00025288], al
test rbx, rbx
je 0x14bed
lea rsi, [r12 + 0x18]
cmp edi, r13d
jae 0x14be7
cmp qword [rbx + 0x20], 0
mov rbp, qword [rbx + 8]
jne 0x14b17
cmp qword [rbx + 0x28], 0
je 0x14bdb
mov ecx, edi
lea rdx, [rbx + 0x10]
mov r8d, 0x20
shl rcx, 5
add rcx, r12
call fcn.0001dd60
cmp byte [0x000266c2], 0
je 0x14b8d
mov eax, dword [rsi + 4]
movzx ecx, word [rsi - 0xa]
movzx edx, word [rsi - 0xc]
movzx r8d, word [rsi - 0xe]
movzx r9d, word [rsi - 0x10]
mov dword [rsp + 0x58], eax
mov eax, dword [rsi]
mov dword [rsp + 0x50], eax
mov eax, dword [rsi - 4]
mov dword [rsp + 0x48], eax
mov eax, dword [rsi - 8]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov r8d, dword [rsi - 0x18]
mov dword [rsp + 0x20], r9d
mov r9d, dword [rsi - 0x14]
lea rcx, [0x0001eb60]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx]
inc edi
add rsi, 0x20
test rcx, rcx
je 0x14ba3
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14bb2
mov rax, qword [rbx]
mov qword [rcx], rax
cmp qword [0x000251c8], rbx
jne 0x14bc6
mov rax, qword [rbx + 8]
mov qword [0x000251c8], rax
dec dword [0x000251c0]
lea rcx, [0x00025200]
mov rdx, rbx
call fcn.000155d0
mov rbx, rbp
test rbp, rbp
jne 0x14af8
mov al, byte [0x00025288]
lea rcx, [0x00025280]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x15250
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 4], 4
movsxd rdi, r8d
mov rbx, rdx
mov rsi, rcx
jne 0x15344
cmp edi, 8
jle 0x15419
cmp byte [rdx], 4
jne 0x15419
mov edx, 1
cmp byte [rbx + 1], dl
jne 0x15419
mov dword [rcx], edx
movsx ecx, byte [rbx + 2]
movzx eax, byte [rbx + 3]
mov r8d, 0x100
imul cx, r8w
add cx, ax
xor eax, eax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
mov word [rsi + 0xc], cx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x48], ecx
mov al, byte [rsp + 0x4b]
mov byte [rsp + 0x33], cl
mov byte [rsp + 0x30], al
mov al, byte [rsp + 0x4a]
mov byte [rsp + 0x31], al
mov al, byte [rsp + 0x49]
mov byte [rsp + 0x32], al
mov edx, dword [rsp + 0x30]
mov dword [rsi + 8], edx
test edx, edx
jle 0x15419
cmp edx, 0xff
jg 0x15419
mov cl, byte [0x000266c2]
test cl, cl
je 0x15313
lea rcx, [0x0001ed80]
call sub.ntoskrnl.exe_DbgPrint
mov cl, byte [0x000266c2]
cmp edi, 0xa
jle 0x15415
cmp byte [rdi + rbx - 1], 0
jne 0x15415
test cl, cl
je 0x15415
lea rdx, [rbx + 9]
lea rcx, [0x0001edb0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x15415
cmp dword [rcx + 4], 5
jne 0x15419
cmp edi, 4
jle 0x15419
cmp byte [rdx], 5
jne 0x15419
mov edx, 1
cmp byte [rbx + 1], dl
jne 0x15419
cmp byte [rbx + 2], 0
jne 0x15419
cmp byte [rbx + 3], dl
jne 0x153d5
cmp edi, 0xa
jl 0x153d5
mov dword [rcx], edx
movsx ecx, byte [rbx + 8]
movzx eax, byte [rbx + 9]
mov r8d, 0x100
imul cx, r8w
add cx, ax
xor eax, eax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
mov word [rsi + 0xc], cx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x48], ecx
mov al, byte [rsp + 0x4b]
mov byte [rsp + 0x33], cl
mov byte [rsp + 0x30], al
mov al, byte [rsp + 0x4a]
mov byte [rsp + 0x31], al
mov al, byte [rsp + 0x49]
mov byte [rsp + 0x32], al
mov eax, dword [rsp + 0x30]
mov dword [rsi + 8], eax
jmp 0x15419
cmp byte [rbx + 3], 3
jne 0x15419
mov al, byte [rbx + 4]
test al, al
jle 0x15419
movsx r8d, al
lea eax, [rdi - 5]
lea ecx, [r8 + 2]
cmp ecx, eax
jg 0x15419
lea eax, [r8 + 5]
mov dword [rsi], edx
mov r8d, 0x100
movsxd rcx, eax
movsx eax, byte [rcx + rbx]
movzx edx, byte [rcx + rbx + 1]
imul ax, r8w
add dx, ax
mov word [rsi + 0xc], dx
and dword [rsi + 8], 0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x15674
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov al, byte [0x000266c2]
xor ebx, ebx
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov rdi, rcx
cmp al, bl
je 0x156b7
lea rcx, [0x0001ede0]
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [0x000266c2]
cmp byte [0x000269da], bl
jne 0x156fc
cmp byte [0x000269db], bl
jne 0x156fc
cmp dword [0x00025900], ebx
ja 0x156fc
cmp al, bl
je 0x156df
lea rcx, [0x0001ee00]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov al, byte [rdi + 9]
cmp al, 6
jne 0x1571e
mov al, byte [rsp + 0x60]
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], al
call fcn.000162f0
jmp 0x156e1
cmp al, 0x11
jne 0x1573d
mov al, byte [rsp + 0x60]
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], al
call fcn.0001c50c
jmp 0x156e1
cmp al, 1
jne 0x156df
mov bl, byte [rsp + 0x60]
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], bl
call fcn.00016230
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov byte [rsp + 0x20], bl
call fcn.0001c108
jmp 0x156e1
Function at 0x162f0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
lea rcx, [0x00025480]
mov r12d, r9d
mov r14, r8
mov rbx, rdx
xor r13d, r13d
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov bpl, byte [rsp + 0x70]
mov rdx, rbx
mov r8b, bpl
mov rcx, rsi
mov byte [0x00025488], al
call fcn.00015d54
mov rdi, rax
test rax, rax
je 0x16492
mov dl, byte [0x000266c2]
test dl, dl
je 0x1636a
lea rcx, [0x0001f290]
call sub.ntoskrnl.exe_DbgPrint
mov dl, byte [0x000266c2]
mov ecx, dword [rsi + 0xc]
xor eax, eax
lea rsi, [rdi + 0x60]
mov word [rsp + 0x21], ax
mov byte [rsp + 0x23], al
mov dword [rsp + 0x28], ecx
mov al, byte [rsp + 0x2b]
mov byte [rsp + 0x23], cl
mov byte [rsp + 0x20], al
mov al, byte [rsp + 0x2a]
mov byte [rsp + 0x21], al
mov al, byte [rsp + 0x29]
mov byte [rsp + 0x22], al
mov eax, dword [rsp + 0x20]
cmp dword [rdi + 0x38], eax
je 0x163a9
lea rsi, [rdi + 0x40]
mov qword [rsi], r14
mov dword [rsi + 8], r12d
mov byte [rsi + 0xc], bpl
cmp dword [rdi + 0x18], 1
jne 0x16465
test dl, dl
je 0x163d4
mov edx, dword [0x00026960]
lea rcx, [0x0001f2b0]
call sub.ntoskrnl.exe_DbgPrint
xor r12d, r12d
cmp dword [0x00026960], r12d
jbe 0x1647c
lea rbp, [0x00026970]
and qword [rsp + 0x28], 0
mov ebx, dword [rdi + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [rbp]
cmp ebx, dword [rdi + 0x20]
mov r13d, eax
jge 0x16453
lea rcx, [0x00025400]
call fcn.0001559c
cmp byte [0x000266c2], 0
mov rbx, rax
je 0x1642e
lea rcx, [0x0001f2d0]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
test rbx, rbx
je 0x16453
mov rcx, qword [rsp + 0x28]
mov byte [rbx + 0x18], 1
mov qword [rbx + 0x10], rcx
mov rax, qword [rbp]
mov qword [rbx + 8], rax
mov rax, qword [rdi + 0x28]
mov qword [rbx], rax
mov qword [rdi + 0x28], rbx
inc r12d
add rbp, 8
cmp r12d, dword [0x00026960]
jb 0x163eb
jmp 0x1647c
cmp dword [rdi + 0x18], 2
je 0x16471
cmp dword [rdi + 0x18], 3
jne 0x1647c
mov rcx, rdi
call fcn.00015618
mov r13d, eax
and qword [rsi], 0
and dword [rsi + 8], 0
cmp dword [rdi + 0x18], 3
jne 0x16492
mov rcx, rdi
call fcn.0001577c
mov dl, byte [0x00025488]
lea rcx, [0x00025480]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, r13d
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x164d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx ebx, cx
mov dil, r13b
cmp cx, r13w
je 0x165af
mov esi, r13d
lea rbp, [0x00025174]
cmp byte [0x000266c2], r13b
je 0x16525
movzx r8d, word [rbp]
lea rcx, [0x0001f320]
movzx r9d, bx
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
cmp word [rbp], bx
je 0x16591
inc esi
add rbp, 2
cmp esi, 1
jb 0x16505
mov r12d, dword [0x000254c0]
mov esi, r13d
cmp r12d, r13d
jbe 0x165af
lea rbp, [0x000254c4]
cmp byte [0x000266c2], r13b
je 0x1656c
movzx r8d, word [rbp]
lea rcx, [0x0001f3a0]
movzx r9d, bx
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
cmp word [rbp], bx
je 0x1657f
inc esi
add rbp, 2
cmp esi, r12d
jb 0x1654c
jmp 0x165af
cmp byte [0x000266c2], r13b
je 0x165ac
lea rcx, [0x0001f3d0]
jmp 0x165a1
cmp byte [0x000266c2], r13b
je 0x165ac
lea rcx, [0x0001f360]
movzx r8d, bx
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
mov dil, 1
cmp byte [0x000266c2], r13b
je 0x165cb
lea rcx, [0x0001f400]
movzx r8d, dil
movzx edx, bx
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov al, dil
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x165f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, 0x1f4
mov ebx, edx
mov rsi, rcx
cmp edx, eax
cmova ebx, eax
cmp byte [0x000266c2], 0
je 0x1662c
mov r8d, edx
mov rdx, rcx
lea rcx, [0x0001f4b0]
mov r9d, ebx
call sub.ntoskrnl.exe_DbgPrint
mov dword [0x00027990], ebx
test rsi, rsi
je 0x16651
test ebx, ebx
je 0x16651
mov r8d, ebx
lea rcx, [0x00027994]
mov rdx, rsi
shl r8d, 4
call fcn.0001dd60
xor edi, edi
test ebx, ebx
je 0x16691
add rsi, 8
cmp byte [0x000266c2], 0
je 0x16687
mov eax, dword [rsi + 4]
mov r9d, dword [rsi - 4]
mov r8d, dword [rsi - 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi]
lea rcx, [0x0001f4f0]
mov edx, edi
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
inc edi
add rsi, 0x10
cmp edi, ebx
jb 0x1665b
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x166a8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov esi, dword [0x000269e0]
mov r8b, byte [0x000266c2]
mov eax, 0x1f4
cmp esi, eax
mov ebp, edx
mov r12d, ecx
cmova esi, eax
test r8b, r8b
je 0x166f6
mov r8d, edx
mov edx, ecx
lea rcx, [0x0001f530]
mov r9d, esi
call sub.ntoskrnl.exe_DbgPrint
mov r8b, byte [0x000266c2]
xor ebx, ebx
test esi, esi
je 0x16778
lea rdi, [0x000269e8]
test r8b, r8b
je 0x16730
mov eax, dword [rdi]
lea rcx, [0x0001f570]
mov r9d, ebp
mov dword [rsp + 0x28], eax
mov eax, dword [rdi - 4]
mov r8d, r12d
mov edx, ebx
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov r8b, byte [0x000266c2]
mov ecx, dword [rdi - 4]
xor eax, eax
mov word [rsp + 0x61], ax
mov byte [rsp + 0x63], al
mov dword [rsp + 0x68], ecx
mov al, byte [rsp + 0x6b]
mov byte [rsp + 0x63], cl
mov byte [rsp + 0x60], al
mov al, byte [rsp + 0x6a]
mov byte [rsp + 0x61], al
mov al, byte [rsp + 0x69]
mov byte [rsp + 0x62], al
cmp r12d, dword [rsp + 0x60]
jne 0x1676e
cmp ebp, dword [rdi]
je 0x167a7
cmp dword [rdi], 0
je 0x167a7
inc ebx
add rdi, 8
cmp ebx, esi
jb 0x16703
test r8b, r8b
je 0x16792
lea rcx, [0x0001f5f0]
mov r9d, ebx
mov r8d, ebp
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
test r8b, r8b
je 0x167c1
lea rcx, [0x0001f5b0]
mov r9d, ebx
mov r8d, ebp
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
mov al, 1
jmp 0x16794
Function at 0x167cc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov ebp, dword [0x00027990]
mov r8b, byte [0x000266c2]
mov eax, 0x1f4
cmp ebp, eax
mov esi, edx
mov r12d, ecx
cmova ebp, eax
test r8b, r8b
je 0x1681a
mov r8d, edx
mov edx, ecx
lea rcx, [0x0001f630]
mov r9d, ebp
call sub.ntoskrnl.exe_DbgPrint
mov r8b, byte [0x000266c2]
xor edi, edi
test ebp, ebp
je 0x16911
lea rbx, [0x00027998]
test r8b, r8b
je 0x16866
mov eax, dword [rbx + 8]
lea rcx, [0x0001f670]
mov r9d, esi
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 4]
mov r8d, r12d
mov dword [rsp + 0x30], eax
mov eax, dword [rbx]
mov edx, edi
mov dword [rsp + 0x28], eax
mov eax, dword [rbx - 4]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov r8b, byte [0x000266c2]
mov ecx, dword [rbx - 4]
xor eax, eax
mov word [rsp + 0x81], ax
mov byte [rsp + 0x83], al
mov dword [rsp + 0x40], ecx
mov al, byte [rsp + 0x43]
mov byte [rsp + 0x83], cl
mov byte [rsp + 0x80], al
mov al, byte [rsp + 0x42]
mov byte [rsp + 0x81], al
mov al, byte [rsp + 0x41]
mov byte [rsp + 0x82], al
cmp r12d, dword [rsp + 0x80]
jb 0x16903
mov ecx, dword [rbx]
xor eax, eax
mov word [rsp + 0x89], ax
mov byte [rsp + 0x8b], al
mov dword [rsp + 0x40], ecx
mov al, byte [rsp + 0x43]
mov byte [rsp + 0x8b], cl
mov byte [rsp + 0x88], al
mov al, byte [rsp + 0x42]
mov byte [rsp + 0x89], al
mov al, byte [rsp + 0x41]
mov byte [rsp + 0x8a], al
cmp r12d, dword [rsp + 0x88]
ja 0x16903
cmp esi, dword [rbx + 4]
jb 0x16903
cmp esi, dword [rbx + 8]
jbe 0x16940
inc edi
add rbx, 0x10
cmp edi, ebp
jb 0x1682b
test r8b, r8b
je 0x1692b
lea rcx, [0x0001f700]
mov r9d, edi
mov r8d, esi
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
test r8b, r8b
je 0x1695a
lea rcx, [0x0001f6c0]
mov r9d, edi
mov r8d, esi
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
mov al, 1
jmp 0x1692d
Function at 0x1718c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rcx
lea rcx, [0x00025dd8]
mov ebx, edx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
xor ebp, ebp
mov byte [0x00025de0], al
lea r12d, [rbp + 1]
cmp rdi, rbp
je case.default.0x172bd
cmp ebx, ebp
je case.default.0x172bd
cmp dword [0x00025dc0], ebx
jae 0x1720e
lea esi, [rbx + 0xfff]
and esi, 0xfffff000
call fcn.0001714c
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r11, rax
mov qword [0x00025dd0], rax
cmp rax, rbp
je 0x17285
mov dword [0x00025dc0], esi
jmp 0x17215
mov r11, qword [0x00025dd0]
mov r8, rbx
mov rdx, rdi
mov rcx, r11
call fcn.0001dd60
mov dword [0x00025dc4], ebx
mov ecx, ebp
jmp 0x1723b
cmp dword [rdi], ebx
ja 0x17240
mov eax, dword [rdi]
sub ebx, dword [rdi]
add ecx, r12d
add rdi, rax
cmp ebx, 0x78
jae 0x1722d
mov r11, qword [0x00025dd0]
mov dword [0x00025dc8], ecx
mov rdx, r11
jmp 0x1725e
cmp dword [rdx + 4], ebp
jne 0x17264
mov eax, dword [rdx]
dec ecx
add rdx, rax
cmp ecx, ebp
ja 0x17252
jmp 0x17285
cmp byte [0x000266c2], bpl
je case.default.0x172bd
lea rcx, [0x0001fc30]
call sub.ntoskrnl.exe_DbgPrint
call fcn.0001714c
mov r11, qword [0x00025dd0]
mov dl, byte [0x00025de0]
movzx eax, bpl
cmp r11, rbp
cmovne eax, r12d
lea rcx, [0x00025dd8]
mov byte [0x000269db], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
jmp qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
insb byte [rdi], dx
jne 0x1f9f4
and byte [rdx], cl
add ah, cl
int3
insb byte [rdi], dx
jne 0x1fa15
and byte [0x202e6f5b], ah
and eax, 0x202c756c
and eax, 0x2029756c
or al, byte [rax]
int3
and byte [rax], ch
and eax, 0x2029756c
or al, byte [rax]
int3
Function at 0x173e4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov rbp, rcx
lea rcx, [0x00025d80]
mov r13d, edx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rbx, qword [0x00025cc8]
mov byte [0x00025d88], al
test rbx, rbx
je 0x17517
lea rsi, [rbp + 0x20]
cmp edi, r13d
jae 0x17511
mov r12, qword [rbx + 8]
lea rcx, [rdi + rdi*4]
lea rdx, [rbx + 0x10]
lea rcx, [rbp + rcx*8]
mov r8d, 0x28
mov eax, edi
call fcn.0001dd60
cmp byte [0x000266c2], 0
je 0x174b7
mov eax, dword [rsi + 4]
movzx ecx, word [rsi - 6]
movzx edx, word [rsi - 8]
movzx r8d, word [rsi - 0xa]
movzx r9d, word [rsi - 0xc]
mov dword [rsp + 0x60], eax
mov eax, dword [rsi]
mov dword [rsp + 0x58], eax
mov eax, dword [rsi - 0x10]
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r8d
mov r8d, dword [rsi - 0x20]
mov dword [rsp + 0x38], r9d
mov r9d, dword [rsi - 0x1c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi - 0x14]
lea rcx, [0x0001fc60]
mov edx, edi
mov dword [rsp + 0x28], eax
mov eax, dword [rsi - 0x18]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx]
inc edi
add rsi, 0x28
test rcx, rcx
je 0x174cd
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x174dc
mov rax, qword [rbx]
mov qword [rcx], rax
cmp qword [0x00025cc8], rbx
jne 0x174f0
mov rax, qword [rbx + 8]
mov qword [0x00025cc8], rax
dec dword [0x00025cc0]
lea rcx, [0x00025d00]
mov rdx, rbx
call fcn.000155d0
mov rbx, r12
test r12, r12
jne 0x1742b
mov al, byte [0x00025d88]
lea rcx, [0x00025d80]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18028
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [0x0002d418]
mov ebx, edx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [0x0002d420], al
test rdi, rdi
je case.default.0x18121
test ebx, ebx
je case.default.0x18121
cmp dword [0x0002d400], ebx
jae 0x18097
lea esi, [rbx + 0xfff]
and esi, 0xfffff000
call fcn.00017fe8
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x0002d410], rax
test rax, rax
je 0x18105
mov dword [0x0002d400], esi
jmp 0x1809e
mov rax, qword [0x0002d410]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.0001dd60
mov dword [0x0002d404], ebx
xor ecx, ecx
jmp 0x180c3
cmp dword [rdi], ebx
ja 0x180c8
mov eax, dword [rdi]
sub ebx, dword [rdi]
inc ecx
add rdi, rax
cmp ebx, 0x34
jae 0x180b6
mov rdx, qword [0x0002d410]
mov dword [0x0002d408], ecx
test ecx, ecx
je 0x18105
cmp dword [rdx + 4], 0
jne 0x180eb
mov eax, dword [rdx]
add rdx, rax
add ecx, 0xffffffff
jne 0x180d9
jmp 0x18105
cmp byte [0x000266c2], 0
je case.default.0x18121
lea rcx, [0x00020510]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00017fe8
mov dl, byte [0x0002d420]
lea rcx, [0x0002d418]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]

Function at 0x182b0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
mov rbp, rcx
lea rcx, [0x00025c80]
mov r12d, edx
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x00025bc8]
mov byte [0x00025c88], al
test r8, r8
je 0x183a9
lea rdi, [rbp + 0x18]
cmp ebx, r12d
jae 0x183a3
cmp dword [r8 + 0x10], 0
mov rsi, qword [r8 + 8]
je 0x18397
and dword [r8 + 0x10], 0
mov rax, qword [r8 + 0x14]
mov ecx, ebx
imul rcx, rcx, 0x1c
add rcx, rbp
cmp byte [0x000266c2], 0
mov qword [rcx], rax
mov rax, qword [r8 + 0x1c]
mov qword [rcx + 8], rax
mov rax, qword [r8 + 0x24]
mov qword [rcx + 0x10], rax
mov eax, dword [r8 + 0x2c]
mov dword [rcx + 0x18], eax
je 0x18391
movzx eax, word [rdi + 2]
movzx ecx, word [rdi]
movzx edx, word [rdi - 2]
movzx r8d, word [rdi - 4]
mov r9d, dword [rdi - 0x14]
mov dword [rsp + 0x50], eax
mov eax, dword [rdi - 8]
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], r8d
mov r8d, dword [rdi - 0x18]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi - 0xc]
lea rcx, [0x00020540]
mov edx, ebx
mov dword [rsp + 0x28], eax
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
inc ebx
add rdi, 0x1c
mov r8, rsi
test rsi, rsi
jne 0x182f8
mov al, byte [0x00025c88]
lea rcx, [0x00025c80]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x187c0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor r15d, r15d
mov rbp, rcx
lea r14, [0x00020600]
mov r12d, r15d
cmp byte [0x000266c2], r15b
je 0x1887a
cmp qword [rcx + 0x20], r15
mov eax, dword [rbp + 0x40]
mov r10, r14
cmovne r10, qword [rcx + 0x20]
cmp qword [rbp + 0x18], r15
mov dword [rsp + 0x60], eax
mov eax, dword [rbp + 0x3c]
mov rcx, r14
mov r9, r14
cmovne rcx, qword [rbp + 0x18]
cmp qword [rbp + 0x10], r15
mov dword [rsp + 0x58], eax
mov eax, dword [rbp + 0x38]
cmovne r9, qword [rbp + 0x10]
cmp qword [rbp + 8], r15
mov dword [rsp + 0x50], eax
mov eax, dword [rbp + 0x34]
mov r8, r14
cmovne r8, qword [rbp + 8]
cmp qword [rbp], r15
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x30]
mov rdx, r14
cmovne rdx, qword [rbp]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x28]
mov dword [rsp + 0x30], eax
mov qword [r11 - 0x70], r10
mov qword [r11 - 0x78], rcx
lea rcx, [0x00020610]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x00025900], r15d
jne 0x1888a
xor eax, eax
jmp 0x189b6
lea rcx, [0x00025910]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [0x00025918], al
call fcn.00015554
mov rbx, qword [0x00025908]
mov esi, dword [0x00025900]
mov r13d, eax
cmp esi, r15d
jbe 0x1890b
cmp dword [rbx + 0xc], r15d
je 0x188c3
cmp r13d, dword [rbx + 0xc]
jae 0x188fc
mov rdx, rbp
mov rcx, rbx
call fcn.00018490
cmp al, r15b
je 0x188fc
mov edi, dword [rbx + 0x14]
and edi, 3
cmp edi, 2
je 0x188e7
test dword [rbx + 0x14], 0xff0
je 0x188f2
mov rdx, rbp
mov rcx, rbx
call fcn.00018b24
cmp edi, 2
je 0x18905
cmp edi, 1
je 0x1890b
mov eax, dword [rbx]
dec esi
add rbx, rax
jmp 0x188b2
mov r12d, 1
mov dl, byte [0x00025918]
lea rcx, [0x00025910]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp byte [0x000266c2], r15b
je 0x189b3
cmp qword [rbp + 0x20], r15
mov ecx, dword [rbp + 0x30]
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], eax
mov eax, dword [rbp + 0x3c]
mov dword [rsp + 0x58], eax
mov eax, dword [rbp + 0x38]
mov r11, r14
cmovne r11, qword [rbp + 0x20]
cmp qword [rbp + 0x18], r15
mov dword [rsp + 0x50], eax
mov eax, dword [rbp + 0x34]
mov r10, r14
mov r9, r14
cmovne r10, qword [rbp + 0x18]
cmp qword [rbp + 0x10], r15
mov dword [rsp + 0x48], eax
cmovne r9, qword [rbp + 0x10]
cmp qword [rbp + 8], r15
mov dword [rsp + 0x40], ecx
mov ecx, dword [rbp + 0x2c]
mov r8, r14
cmovne r8, qword [rbp + 8]
cmp qword [rbp], r15
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbp + 0x28]
cmovne r14, qword [rbp]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r11
lea rcx, [0x000206a0]
mov rdx, r14
mov qword [rsp + 0x20], r10
call sub.ntoskrnl.exe_DbgPrint
mov eax, r12d
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret