joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085890
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rdi, rcx
mov dword [rsp + 0x148], 0
mov rax, qword [0x1400cdf88]
nop
mov ebx, 1
test rax, rax
jne 0x1400858d5
nop dword [rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400cdf88]
nop
test rax, rax
je 0x1400858c0
cmp eax, 2
jne 0x140085919
mov dword [rsp + 0x20], eax
mov r9d, 0x97
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.14004b780
nop
mov dword [rsp + 0x148], ebx
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov rcx, rax
call fcn.1400012e0
nop
jmp 0x1400859bf
mov rax, qword [0x1400cdf70]
test rax, rax
je 0x140085932
mov rcx, rdi
call rax
test al, al
jne 0x1400859dd
lock xadd qword [0x1400cdfb8], rbx
lea rax, [rbx + 1]
cmp rax, 1
jle 0x140085952
xor edx, edx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1400cdf68], eax
mov qword [0x1400cdf60], rdi
mov rcx, qword [0x1400c9ca0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
mov r9d, 0xc7
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.14004b780
nop
mov dword [rsp + 0x148], 2
lea rdx, str.crash_server_did_not_respond__self_terminating
mov rcx, rax
call fcn.1400012e0
nop
lea rcx, [rsp + 0x30]
call fcn.14004b9a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x14008b830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x178], rax
movzx edi, dl
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 7
jbe 0x14008b867
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008b968
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008b883
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x82
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008b90e
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008b973
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008b95f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008b99d
call fcn.1400551e8
xor al, al
jmp 0x14008b97c
test dil, dil
jne 0x14008b977
bt eax, 0xa
jae 0x14008b977
xor al, al
jmp 0x14008b97c
shr eax, 4
and al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140055420
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
call fcn.14005bf54
int3
Function at 0x14008bcc0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x178], rax
movzx edi, r8b
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 7
jbe 0x14008bcf8
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14008bf17
test dil, dil
je 0x14008be25
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14008be25
mov dl, 1
mov rcx, rbx
call fcn.14008b830
test al, al
jne 0x14008bf17
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008bd41
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 2
mov r9d, 0x5d
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_class_base::FilePath__enum_crashpad::FilePermissions_bool_
lea rcx, [rsp + 0x50]
call fcn.14004b780
nop
mov dword [rsp + 0x30], 3
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008bdb4
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
lea rdx, str._not_a_directory
mov rcx, rax
call fcn.1400012e0
nop
lea rcx, [rsp + 0x50]
call fcn.14004b9a0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008bf13
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008bf0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008bf40
jmp 0x14008bf0e
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008be32
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x62
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_class_base::FilePath__enum_crashpad::FilePermissions_bool_
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 0xc
lea rdx, str.CreateDirectory
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008bebd
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008bf13
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008bf0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008bf3a
call fcn.1400551e8
xor al, al
jmp 0x14008bf19
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140055420
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
call fcn.14005bf54
int3
call fcn.14005bf54
int3
Function at 0x14008c0a0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 7
jbe 0x14008c0d0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14008c1d0
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008c0eb
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x30
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::LoggingRemoveDirectoryImpl_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 3
lea rdx, str.RemoveDirectory
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008c176
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008c1cc
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008c1c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008c1eb
call fcn.1400551e8
xor al, al
jmp 0x14008c1d2
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140055420
add rsp, 0x180
pop rbx
ret
call fcn.14005bf54
int3
Function at 0x14008c820
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
mov rbx, rcx
mov dword [rsp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ax
shr dx, 8
cmp al, 6
jb 0x14008c8f4
jne 0x14008c858
cmp dx, 1
jbe 0x14008c8f4
mov ecx, dword [0x1400ccba0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1400ce020], eax
jg 0x14008c908
xor edx, edx
mov r8d, 0x10000000
mov rcx, rbx
call qword [0x1400ce018]
test eax, eax
jne 0x14008c8fd
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x21
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutilwincritical_section_with_debug_info.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CrashpadInitializeCriticalSectionEx_struct__RTL_CRITICAL_SECTION__unsigned_long_unsigned_long_
lea rcx, [rsp + 0x30]
call fcn.14004b920
nop
mov dword [rsp + 0x158], 1
lea rdx, [0x1400aad20]
mov rcx, rax
call fcn.1400012e0
nop
lea rcx, [rsp + 0x30]
call fcn.14004bbf0
xor al, al
add rsp, 0x140
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x140
pop rbx
ret
lea rcx, [0x1400ce020]
call fcn.140055298
cmp dword [0x1400ce020], 0xffffffff
jne 0x14008c87f
mov r8b, 1
lea rdx, str.::InitializeCriticalSectionEx
lea rcx, [0x14009d498]
call fcn.140046d80
mov qword [0x1400ce018], rax
lea rcx, [0x1400ce020]
call fcn.14005522c
jmp 0x14008c87f

Function at 0x14008ca10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14008ca38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14008ca38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400020dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
and qword [rbp + 0x7f], 0
mov r15, rdx
mov r14, rcx
lea rdx, [0x140006310]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x30
mov edx, 0x20019
mov dword [rbp + 0x1f], 0x240
lea rcx, [rbp + 0x7f]
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1400022e7
and dword [rbp + 0x77], 0
lea rdx, [0x140006390]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400063b0]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x77]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea rdx, [rbp - 0x29]
lea r8d, [r9 + 1]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
je 0x1400021a9
cmp eax, 0x80000005
jne 0x14000222c
mov edi, dword [rbp + 0x77]
xor ecx, ecx
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x1400022d8
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140006200
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x29]
mov r9, rbx
mov dword [rsp + 0x20], edi
mov r8d, 1
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jne 0x1400022d8
cmp dword [rbp + 0x77], edi
jne 0x1400022d8
mov edx, dword [rbx + 8]
mov eax, 0x3e
cmp dword [rbx + 0xc], eax
mov rcx, r14
cmovb eax, dword [rbx + 0xc]
add rdx, rbx
mov r8d, eax
call fcn.140005ec0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x77]
and dword [rbp + 0x77], 0
lea rdx, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r14d, [r9 + 1]
mov r8d, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
je 0x140002264
cmp eax, 0x80000005
jne 0x1400022d8
mov edi, dword [rbp + 0x77]
xor ecx, ecx
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x1400022d8
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140006200
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov r9, rbx
mov dword [rsp + 0x20], edi
mov r8d, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jne 0x1400022d8
cmp dword [rbp + 0x77], edi
jne 0x1400022d8
mov edx, dword [rbx + 8]
mov eax, 0x1e
cmp dword [rbx + 0xc], eax
mov rcx, r15
cmovb eax, dword [rbx + 0xc]
add rdx, rbx
mov r8d, eax
call fcn.140005ec0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400022e7
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002a54
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, 0x800
mov r14, rcx
mov dword [rsp + 0x38], eax
mov esi, 8
mov edx, eax
xor ecx, ecx
mov r8d, 0x5468704b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140002ad6
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x140002ad1
mov edx, 0x5468704b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp ebx, 0xc0000004
jne 0x140002adb
add esi, 0xffffffff
je 0x140002adb
mov eax, dword [rsp + 0x38]
jmp 0x140002a7a
mov qword [r14], rdi
jmp 0x140002add
mov ebx, 0xc000009a
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400030ec
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [rcx + 0x48]
mov r15, rdx
mov rbx, rcx
cmp eax, 0x14
ja 0x14000327f
mov ecx, 0x100108
bt ecx, eax
jae 0x14000327f
mov eax, dword [0x14000a398]
test al, 0x10
jne 0x140003188
lea rdx, [0x140006f00]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbx + 8]
lea rsi, [0x14000a3c0]
mov rdx, rsi
call fcn.14000e274
mov rdi, rax
test rax, rax
jne 0x14000325c
mov ecx, dword [0x14000a398]
test cl, 1
je 0x14000317d
mov edx, 0xc000009a
lea rcx, [0x140006f30]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, rsi
mov rcx, rdi
call fcn.1400050d4
mov r9d, dword [rbx + 0x48]
lea rax, [rbp + 0x20]
mov rcx, qword [0x14000a388]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea edx, [r8 + 0x3c]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x140003281
mov eax, dword [rbx + 0x30]
xor r8d, r8d
mov rcx, qword [rbp + 0x20]
and eax, 0x40014
or dword [rcx + 0x30], eax
mov eax, dword [rbx + 0x34]
mov rcx, qword [rbp + 0x20]
and eax, 0x100
or dword [rcx + 0x34], eax
mov rax, qword [rbp + 0x20]
mov rsi, qword [rax + 0x40]
mov rcx, rsi
and dword [rsi + 0x38], 0
mov rdx, qword [rbp + 0x20]
call fcn.140005690
mov r8d, 0x6e764653
lea rcx, [rsi + 0x28]
mov rdx, r15
call fcn.14000e1ac
mov edi, eax
test eax, eax
js 0x1400032ea
mov rcx, qword [rbp + 0x20]
lea r8, [rsi + 8]
mov rdx, rbx
call qword [0x14000a348]
mov edi, eax
test eax, eax
js 0x1400032ea
mov rax, qword [rbp + 0x20]
btr dword [rax + 0x30], 7
mov eax, dword [0x14000a398]
test al, 1
je 0x1400032ba
mov rdx, qword [rbp + 0x20]
mov ecx, dword [rdx + 0x48]
lea eax, [rcx - 1]
cmp eax, 0x38
ja 0x14000329b
mov eax, ecx
lea rcx, [0x1400084d0]
mov rcx, qword [rcx + rax*8]
jmp 0x1400032a2
mov r8b, 1
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x14000317d
mov rdx, rsi
mov rcx, rdi
call fcn.1400050d4
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rcx, [0x140006e00]
mov qword [rsp + 0x20], rcx
lea r9, [rsi + 0x28]
lea rcx, [0x140006fa0]
mov r8, rbx
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [0x14000a380]
cmp eax, 5
jne 0x1400032d0
cmp dword [0x14000a384], 1
jae 0x1400032d2
cmp eax, eax
jbe 0x14000327f
mov rcx, rbx
call fcn.140003818
mov edi, eax
test eax, eax
jns 0x14000327f
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x40]
call fcn.1400050a0
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, edi
jmp 0x140003281
Function at 0x140003308
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x30]
mov rbx, rdx
mov r15, qword [rdx + 0x40]
and eax, 0x40014
or dword [rdx + 0x30], eax
mov rbp, rcx
mov eax, dword [rcx + 0x34]
and eax, 0x100
or dword [rdx + 0x34], eax
xor esi, esi
lea r8, [r15 + 8]
mov rdx, rbp
mov rcx, rbx
call qword [0x14000a348]
mov edi, eax
test eax, eax
jns 0x14000337b
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], 0xffffffffffb3b4c0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
inc esi
cmp esi, 8
jb 0x140003342
mov eax, edi
jmp 0x1400033a3
btr dword [rbx + 0x30], 7
mov eax, dword [0x14000a398]
test al, 1
je 0x1400033a1
mov r8, qword [r15 + 8]
lea r9, [r15 + 0x28]
mov rdx, rbx
lea rcx, [0x140006c90]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140003764
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x18]
mov rdi, rcx
test rbx, rbx
je 0x14000380b
mov rax, qword [0x14000a388]
test rbx, rbx
je 0x140003797
cmp qword [rbx + 8], rax
jne 0x140003797
cmp qword [rbx + 0x40], 0
jne 0x1400037a5
mov rdi, rbx
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x14000380b
jmp 0x140003785
mov eax, dword [0x14000a398]
mov r8, qword [rbx + 0x40]
test al, 1
je 0x1400037f0
mov ecx, dword [rbx + 0x48]
lea eax, [rcx - 1]
cmp eax, 0x38
ja 0x1400037cd
mov eax, ecx
lea rcx, [0x1400084d0]
mov rcx, qword [rcx + rax*8]
jmp 0x1400037d4
lea rcx, [0x140006e00]
lea r9, [r8 + 0x28]
mov qword [rsp + 0x20], rcx
mov r8, qword [r8 + 8]
lea rcx, [0x140006ea0]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x40]
call fcn.1400050a0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400041a8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov eax, dword [0x14000a398]
mov rdi, rdx
mov rsi, qword [rcx + 0x40]
mov rbx, rcx
test al, 1
je 0x1400041db
lea rdx, [rsi + 0x28]
lea rcx, [0x140006b50]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rax, qword [rdi + 0xb8]
lea rcx, [0x140003748]
movups xmm0, xmmword [rax]
movups xmmword [rax - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rax - 0x38], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rax - 0x28], xmm0
movsd xmm1, qword [rax + 0x30]
movsd qword [rax - 0x18], xmm1
mov byte [rax - 0x45], 0
mov rax, qword [rdi + 0xb8]
mov qword [rax - 0x10], rcx
lea rcx, [rsp + 0x30]
mov qword [rax - 8], rcx
mov byte [rax - 0x45], 0xe0
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, qword [rsi + 8]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x14000426d
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, rdi
mov rcx, rbx
call fcn.140004288
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140004288
Capabilities:
Complete processing asynchronous io request
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x40]
mov rbx, rcx
mov ecx, dword [0x14000a398]
mov rdi, rdx
test cl, 1
je 0x1400042c9
mov r9d, dword [rdx + 0x30]
lea r8, [rsi + 0x28]
mov rdx, rbx
lea rcx, [0x140006bb0]
call sub.ntoskrnl.exe_DbgPrint
mov ecx, dword [0x14000a398]
mov r9d, dword [rdi + 0x30]
mov edx, 0x80000000
lea eax, [r9 + rdx]
test edx, eax
jne 0x1400042f6
cmp r9d, 0xc000010e
je 0x1400042f6
mov rdx, qword [rsi + 8]
lea r8, [rsi + 8]
mov rcx, rbx
call qword [0x14000a348]
jmp 0x140004320
test cl, 1
je 0x14000430e
lea r8, [rsi + 0x28]
mov rdx, rbx
lea rcx, [0x140006c10]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x40]
call fcn.1400050a0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov ebx, dword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret