joyce8/EMBER2024-capa huggingface dataset:
Function at 0x122d4
Capabilities:
Find process by pid
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov r8, rcx
lea rdx, [0x000180c0]
lea rcx, [0x000180d0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x123ac
lea rdx, [0x000180c0]
lea rcx, [0x00018100]
call sub.ntoskrnl.exe_DbgPrint
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1fffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
js 0x12399
lea rdx, [0x000180c0]
lea rcx, [0x00018130]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
mov ebx, eax
mov dword [rsp + 0x40], eax
mov r8d, eax
lea rdx, [0x000180c0]
lea rcx, [0x00018160]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x123a1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [0x000180c0]
lea rcx, [0x00018190]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x123d0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xb0
xor eax, eax
xor ebp, ebp
mov rbx, rcx
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
lea eax, [rbp + 8]
mov dword [rsp + 0x40], ebp
mov edi, 0x200
mov word [rsp + 0x50], ax
lea eax, [rbp + 0xa]
mov r8d, 0x6c697475
mov word [rsp + 0x52], ax
lea rax, [0x00017c80]
mov rdx, rdi
mov qword [r11 - 0x60], rax
xor eax, eax
xor ecx, ecx
mov dword [rsp + 0x44], eax
mov word [rsp + 0x30], bp
mov qword [r11 + 0x10], rbp
mov qword [r11 - 0x70], rax
mov rsi, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
cmp rax, rbp
jne 0x12469
lea rdx, [0x000181c0]
lea rcx, [0x000181d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x125ea
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00017320
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], bp
mov word [rsp + 0x32], di
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rcx, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
cmp eax, ebp
jge 0x124b5
lea rdx, [0x000181c0]
lea rcx, [0x00018200]
jmp 0x125e2
mov r8, qword [rsp + 0x38]
lea rbx, [0x000181c0]
lea rcx, [0x00018230]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0xc8]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x90], 0x240
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
cmp eax, ebp
mov edi, eax
jge 0x1257b
lea rcx, [0x00018090]
mov r8d, eax
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 0xc0000034
jne 0x12564
lea rcx, [0x00017eb0]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rsp + 0x48], 5
jne 0x125ea
mov rdx, rbx
lea rcx, [0x00017eb0]
jmp 0x1245f
mov rcx, qword [rsp + 0xc8]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, ebp
jl 0x125c1
mov rsi, qword [rsp + 0x68]
mov r9, qword [rsp + 0x38]
lea rcx, [0x000182a0]
mov r8, rsi
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbp
je 0x125ea
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp eax, ebp
jge 0x125ea
lea rcx, [0x00018260]
mov rdx, rbx
mov r8d, eax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x125ff
mov edx, 0x6c697475
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0xb0]
mov rax, rsi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x126bc
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
and qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call sub.FLTMGR.SYS_FltQueryInformationFile
test eax, eax
js 0x126f1
mov rax, qword [rsp + 0x38]
jmp 0x12709
lea rdx, [0x000182f0]
lea rcx, [0x00018310]
mov r8d, eax
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
add rsp, 0x58
ret

Function at 0x12714
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
mov dil, bpl
mov rax, cr8
cmp al, 1
ja 0x1282d
mov edx, 0x400
xor ecx, ecx
mov r8d, 0x636f7270
mov word [rsp + 0x22], dx
mov word [rsp + 0x20], bp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp rax, rbp
je 0x12805
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.00016b58
cmp eax, ebp
jl 0x127cf
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
shr rax, 1
cmp rax, 0x7ffffffe
ja 0x127c7
mov r9, rcx
mov edx, 0x200
sub r9, rbx
cmp rax, rbp
je 0x127be
movzx r8d, word [r9 + rbx]
cmp r8w, bp
je 0x127be
dec rdx
mov word [rbx], r8w
dec rax
add rbx, 2
cmp rdx, rbp
jne 0x1279b
cmp rdx, rbp
jne 0x127c7
sub rbx, 2
mov word [rbx], bp
mov dil, 1
jmp 0x1281d
lea rdx, [0x00018340]
lea rcx, [0x00018350]
mov r8d, eax
call sub.ntoskrnl.exe_DbgPrint
movzx r9d, word [rsp + 0x20]
mov r8, qword [rsp + 0x28]
lea rdx, [0x00018340]
lea rcx, [0x00018380]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x12818
lea rdx, [0x00018340]
lea rcx, [0x000183c0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x28]
cmp rcx, rbp
je 0x1282d
mov edx, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov al, dil
add rsp, 0x30
pop rdi
ret

Function at 0x128b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d2a8]
test rbx, rbx
je 0x12906
cmp qword [rbx], rdi
je 0x128ec
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x128de
test rbx, rbx
je 0x12906
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x1295f
mov edx, 0x10
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x12936
mov rcx, qword [0x0001d2a8]
mov qword [rax], rdi
mov qword [0x0001d2a8], rax
mov qword [rax + 8], rcx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x000183f0]
lea rcx, [0x00018410]
mov r8d, edi
call sub.ntoskrnl.exe_DbgPrint
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x129dc
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov r8, qword [0x0001d2a8]
test r8, r8
je 0x12a25
mov rbx, qword [r8 + 8]
mov r8, qword [r8]
lea rdx, [0x00018440]
lea rcx, [0x00018460]
call sub.ntoskrnl.exe_DbgPrint
mov r8, rbx
test rbx, rbx
jne 0x12a03
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]

Function at 0x12aa8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d280]
test rbx, rbx
je 0x12afe
cmp qword [rbx], rdi
je 0x12ae4
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x12ad6
test rbx, rbx
je 0x12afe
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x12b57
mov edx, 0x10
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x12b2e
mov rcx, qword [0x0001d280]
mov qword [rax], rdi
mov qword [0x0001d280], rax
mov qword [rax + 8], rcx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x00018490]
lea rcx, [0x000184b0]
mov r8d, edi
call sub.ntoskrnl.exe_DbgPrint
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x12bd4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov r8, qword [0x0001d280]
test r8, r8
je 0x12c1d
mov rbx, qword [r8 + 8]
mov r8, qword [r8]
lea rdx, [0x000184e0]
lea rcx, [0x00018500]
call sub.ntoskrnl.exe_DbgPrint
mov r8, rbx
test rbx, rbx
jne 0x12bfb
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
Function at 0x12c3c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d328]
test rbx, rbx
je 0x12c92
cmp qword [rbx], rdi
je 0x12c78
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x12c6a
test rbx, rbx
je 0x12c92
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x12ceb
mov edx, 0x10
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x12cc2
mov rcx, qword [0x0001d328]
mov qword [rax], rdi
mov qword [0x0001d328], rax
mov qword [rax + 8], rcx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x00018530]
lea rcx, [0x00018550]
mov r8d, edi
call sub.ntoskrnl.exe_DbgPrint
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x12dec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov ebp, edx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rdi, qword [0x0001d2c0]
xor r12d, r12d
cmp rdi, r12
je 0x12e69
mov rcx, qword [rdi + 8]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r12d
je 0x12e49
mov rdi, qword [rdi + 0x18]
cmp rdi, r12
jne 0x12e2e
cmp rdi, r12
je 0x12e69
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rax, rdi
jmp 0x12f50
mov edi, 0x636f7270
mov edx, 0x20
xor ecx, ecx
mov r8d, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r12
je 0x12f24
mov r8d, edi
mov edi, 0x400
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x12f24
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00017320
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rax, qword [rbx + 8]
not rcx
dec rcx
mov rdi, rcx
cmp rcx, 0x7ffffffe
ja 0x12f0b
mov r8, rsi
mov ecx, 0x200
sub r8, rax
cmp rdi, r12
je 0x12f02
movzx edx, word [r8 + rax]
cmp dx, r12w
je 0x12f02
dec rcx
mov word [rax], dx
dec rdi
add rax, 2
cmp rcx, r12
jne 0x12ee0
cmp rcx, r12
jne 0x12f0b
sub rax, 2
mov word [rax], r12w
mov rax, qword [0x0001d2c0]
mov dword [rbx + 0x10], ebp
mov qword [rbx + 0x18], rax
mov qword [0x0001d2c0], rbx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x00018580]
lea rcx, [0x000185a0]
mov r8, rsi
call sub.ntoskrnl.exe_DbgPrint
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x12ffc
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov r11, qword [0x0001d2c0]
test r11, r11
je 0x1304b
mov r8, qword [r11 + 8]
mov rbx, qword [r11 + 0x18]
test r8, r8
je 0x13043
lea rdx, [0x000185e0]
lea rcx, [0x00018600]
call sub.ntoskrnl.exe_DbgPrint
mov r11, rbx
test rbx, rbx
jne 0x13023
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]

Function at 0x130f0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov ebp, edx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rdi, qword [0x0001d290]
xor r12d, r12d
cmp rdi, r12
je 0x1316d
mov rcx, qword [rdi + 8]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r12d
je 0x1314d
mov rdi, qword [rdi + 0x18]
cmp rdi, r12
jne 0x13132
cmp rdi, r12
je 0x1316d
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rax, rdi
jmp 0x13254
mov edi, 0x636f7270
mov edx, 0x20
xor ecx, ecx
mov r8d, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r12
je 0x13228
mov r8d, edi
mov edi, 0x400
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x13228
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00017320
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rax, qword [rbx + 8]
not rcx
dec rcx
mov rdi, rcx
cmp rcx, 0x7ffffffe
ja 0x1320f
mov r8, rsi
mov ecx, 0x200
sub r8, rax
cmp rdi, r12
je 0x13206
movzx edx, word [r8 + rax]
cmp dx, r12w
je 0x13206
dec rcx
mov word [rax], dx
dec rdi
add rax, 2
cmp rcx, r12
jne 0x131e4
cmp rcx, r12
jne 0x1320f
sub rax, 2
mov word [rax], r12w
mov rax, qword [0x0001d290]
mov dword [rbx + 0x10], ebp
mov qword [rbx + 0x18], rax
mov qword [0x0001d290], rbx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x00018630]
lea rcx, [0x00018650]
mov r8, rsi
call sub.ntoskrnl.exe_DbgPrint
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x13300
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov r11, qword [0x0001d290]
test r11, r11
je 0x1334f
mov r8, qword [r11 + 8]
mov rbx, qword [r11 + 0x18]
test r8, r8
je 0x13347
lea rdx, [0x00018690]
lea rcx, [0x000186b0]
call sub.ntoskrnl.exe_DbgPrint
mov r11, rbx
test rbx, rbx
jne 0x13327
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]

Function at 0x133f4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d260]
xor ebp, ebp
cmp rbx, rbp
je 0x13467
mov rcx, qword [rbx + 8]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, ebp
je 0x1344a
mov rbx, qword [rbx + 0x18]
cmp rbx, rbp
jne 0x13430
cmp rbx, rbp
je 0x13467
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x1353b
mov edx, 0x20
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rbp
je 0x1350f
mov edx, 0x400
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 8], rax
cmp rax, rbp
je 0x1350f
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.00017320
mov rax, qword [rbx + 8]
mov r11, rdi
cmp rdi, 0x7ffffffe
ja 0x134f7
mov r8, rsi
mov ecx, 0x200
sub r8, rax
cmp r11, rbp
je 0x134ee
movzx edx, word [r8 + rax]
cmp dx, bp
je 0x134ee
dec rcx
mov word [rax], dx
dec r11
add rax, 2
cmp rcx, rbp
jne 0x134cd
cmp rcx, rbp
jne 0x134f7
sub rax, 2
mov word [rax], bp
mov rax, qword [0x0001d260]
mov dword [rbx + 0x10], edi
mov qword [rbx + 0x18], rax
mov qword [0x0001d260], rbx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x000186e0]
lea rcx, [0x00018700]
mov r9, rsi
mov r8d, edi
call sub.ntoskrnl.exe_DbgPrint
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x135e4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov r11, qword [0x0001d260]
test r11, r11
je 0x13633
mov r8, qword [r11 + 8]
mov rbx, qword [r11 + 0x18]
test r8, r8
je 0x1362b
lea rdx, [0x00018740]
lea rcx, [0x00018760]
call sub.ntoskrnl.exe_DbgPrint
mov r11, rbx
test rbx, rbx
jne 0x1360b
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
Function at 0x13768
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d278]
xor r12d, r12d
cmp rbx, r12
je 0x137d9
cmp qword [rbx], rdi
je 0x137bc
mov rbx, qword [rbx + 0x18]
cmp rbx, r12
jne 0x137ae
cmp rbx, r12
je 0x137d9
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x138af
mov edx, 0x20
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r12
je 0x13886
mov edx, 0x400
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 8], rax
cmp rax, r12
je 0x13886
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.00017320
mov rax, qword [rbx + 8]
mov r11, rsi
cmp rsi, 0x7ffffffe
ja 0x1386a
mov r8, rbp
mov ecx, 0x200
sub r8, rax
cmp r11, r12
je 0x13861
movzx edx, word [r8 + rax]
cmp dx, r12w
je 0x13861
dec rcx
mov word [rax], dx
dec r11
add rax, 2
cmp rcx, r12
jne 0x1383f
cmp rcx, r12
jne 0x1386a
sub rax, 2
mov word [rax], r12w
mov rax, qword [0x0001d278]
mov qword [rbx], rdi
mov dword [rbx + 0x10], esi
mov qword [0x0001d278], rbx
mov qword [rbx + 0x18], rax
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x000187b0]
lea rcx, [0x000187d0]
mov r8, rbp
call sub.ntoskrnl.exe_DbgPrint
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret

Function at 0x138d4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d278]
test rbx, rbx
je 0x13981
cmp qword [rbx], rsi
je 0x1391a
mov rdi, rbx
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x13909
test rbx, rbx
je 0x13981
mov rax, qword [rbx + 0x18]
test rdi, rdi
je 0x1392e
mov qword [rdi + 0x18], rax
jmp 0x13935
mov qword [0x0001d278], rax
mov rcx, qword [rbx + 8]
mov edi, 0x636f7270
test rcx, rcx
je 0x1394b
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x00018810]
lea rcx, [0x00018830]
mov r8, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x13994
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x13ac4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rbx, qword [0x0001d188]
xor ebp, ebp
cmp rbx, rbp
je 0x13b37
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, ebp
je 0x13b1a
mov rbx, qword [rbx + 0x18]
cmp rbx, rbp
jne 0x13b00
cmp rbx, rbp
je 0x13b37
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x13c08
mov edx, 0x20
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rbp
je 0x13bdf
mov edx, 0x400
xor ecx, ecx
mov r8d, 0x636f7270
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 8], rax
cmp rax, rbp
je 0x13bdf
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.00017320
mov rax, qword [rbx + 8]
mov r11, rsi
cmp rsi, 0x7ffffffe
ja 0x13bc7
mov r8, rdi
mov ecx, 0x200
sub r8, rax
cmp r11, rbp
je 0x13bbe
movzx edx, word [r8 + rax]
cmp dx, bp
je 0x13bbe
dec rcx
mov word [rax], dx
dec r11
add rax, 2
cmp rcx, rbp
jne 0x13b9d
cmp rcx, rbp
jne 0x13bc7
sub rax, 2
mov word [rax], bp
mov rax, qword [0x0001d188]
mov dword [rbx + 0x10], esi
mov qword [rbx + 0x18], rax
mov qword [0x0001d188], rbx
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
lea rdx, [0x000188c0]
lea rcx, [0x000188e0]
mov r8, rdi
call sub.ntoskrnl.exe_DbgPrint
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x13cb0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov r11, qword [0x0001d188]
test r11, r11
je 0x13cff
mov r8, qword [r11 + 8]
mov rbx, qword [r11 + 0x18]
test r8, r8
je 0x13cf7
lea rdx, [0x00018920]
lea rcx, [0x00018940]
call sub.ntoskrnl.exe_DbgPrint
mov r11, rbx
test rbx, rbx
jne 0x13cd7
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]