Function at 0xfffff80696e912bc
Capabilities:
Get file attributes
Hash data via bcrypt
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0xfffff80696e94070]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov esi, edx
mov dword [rsp + 0x84], esi
mov r13, rcx
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov dword [0xfffff80696e9410c], eax
mov edx, esi
mov r8d, 1
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
nop
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x88], rdi
mov r12d, edi
mov r14d, edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x70], rdi
mov r15d, edi
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rdx, [rsp + 0x98]
mov rcx, rax
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov ebx, eax
test eax, eax
jns 0xfffff80696e91372
lea rcx, [0xfffff80696e926d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0xfffff80696e9173f
xor r9d, r9d
xor r8d, r8d
lea rdx, [0xfffff80696e92700]
lea rcx, [rsp + 0x68]
call sub.cng.sys_BCryptOpenAlgorithmProvider
mov ebx, eax
test eax, eax
jns 0xfffff80696e91398
lea rcx, [0xfffff80696e92710]
jmp 0xfffff80696e91368
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x64]
lea rdx, [0xfffff80696e92740]
mov rcx, qword [rsp + 0x68]
call sub.cng.sys_BCryptGetProperty
mov ebx, eax
test eax, eax
jns 0xfffff80696e913d4
lea rcx, [0xfffff80696e92760]
jmp 0xfffff80696e91368
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x60]
lea rdx, [0xfffff80696e92780]
mov rcx, qword [rsp + 0x68]
call sub.cng.sys_BCryptGetProperty
mov ebx, eax
test eax, eax
jns 0xfffff80696e91413
lea rcx, [0xfffff80696e927b0]
jmp 0xfffff80696e91368
mov edx, dword [rsp + 0x64]
mov ebx, 0x401
mov r8d, 0x79726b6e
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rax, rax
jne 0xfffff80696e91448
lea rcx, [0xfffff80696e927d0]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc000009a
jmp 0xfffff80696e9173f
mov edx, dword [rsp + 0x60]
mov r8d, 0x79726b6e
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0xfffff80696e9146b
lea rcx, [0xfffff80696e927f0]
jmp 0xfffff80696e91439
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x64]
mov r8, r12
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call sub.cng.sys_BCryptCreateHash
mov ebx, eax
test eax, eax
jns 0xfffff80696e914a1
lea rcx, [0xfffff80696e92810]
jmp 0xfffff80696e91368
mov dword [rsp + 0xb0], 0x30
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xc8], 0x200
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x60
mov eax, 1
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xb0]
mov edx, 0x120089
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
jns 0xfffff80696e91538
lea rcx, [0xfffff80696e92830]
jmp 0xfffff80696e91368
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
jns 0xfffff80696e91573
lea rcx, [0xfffff80696e92850]
jmp 0xfffff80696e91368
mov rax, qword [rsp + 0xe8]
test rax, rax
jg 0xfffff80696e91591
mov ebx, 0xc0000001
lea rcx, [0xfffff80696e92870]
jmp 0xfffff80696e91368
cmp rax, 0x2000000
jle 0xfffff80696e915af
lea rcx, [0xfffff80696e928a0]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc0000904
jmp 0xfffff80696e9173f
mov edx, 0x2000
mov ecx, 0x401
mov r8d, 0x79726b6e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
test rax, rax
jne 0xfffff80696e915d9
lea rcx, [0xfffff80696e928d0]
jmp 0xfffff80696e91439
mov edi, dword [rsp + 0xe8]
test edi, edi
je 0xfffff80696e91656
mov esi, 0x2000
cmp edi, esi
cmovb esi, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0xfffff80696e916a1
cmp dword [rsp + 0xa8], esi
jne 0xfffff80696e9168b
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov rcx, qword [rsp + 0x78]
call sub.cng.sys_BCryptHashData
mov ebx, eax
test eax, eax
js 0xfffff80696e9167f
sub edi, esi
jne 0xfffff80696e915e4
mov esi, dword [rsp + 0x84]
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, r14
mov rcx, qword [rsp + 0x78]
call sub.cng.sys_BCryptFinishHash
mov ebx, eax
xor edi, edi
test eax, eax
jns 0xfffff80696e916ad
lea rcx, [0xfffff80696e92970]
jmp 0xfffff80696e91368
lea rcx, [0xfffff80696e92950]
jmp 0xfffff80696e91368
lea rcx, [0xfffff80696e92920]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc00000e5
jmp 0xfffff80696e9173f
lea rcx, [0xfffff80696e92900]
jmp 0xfffff80696e91368
xor r9d, r9d
xor r8d, r8d
lea rdx, [0xfffff80696e92990]
lea rcx, [rsp + 0x88]
call sub.cng.sys_BCryptOpenAlgorithmProvider
mov ebx, eax
test eax, eax
js 0xfffff80696e9138f
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x98
lea rax, str.ECS30
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
lea r8, [0xfffff80696e929b0]
xor edx, edx
mov rcx, qword [rsp + 0x88]
call sub.cng.sys_BCryptImportKeyPair
mov ebx, eax
test eax, eax
jns 0xfffff80696e91719
lea rcx, [0xfffff80696e929d0]
jmp 0xfffff80696e91368
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
mov r9d, dword [rsp + 0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sub.cng.sys_BCryptVerifySignature
mov ebx, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0xfffff80696e91753
xor edx, edx
call sub.cng.sys_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0xfffff80696e91765
call sub.cng.sys_BCryptDestroyKey
test r15, r15
je 0xfffff80696e91778
mov edx, 0x79726b6e
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0xfffff80696e91788
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0xfffff80696e91797
call sub.cng.sys_BCryptDestroyHash
test r14, r14
je 0xfffff80696e917aa
mov edx, 0x79726b6e
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r12, r12
je 0xfffff80696e917bd
mov edx, 0x79726b6e
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0xfffff80696e917ce
xor edx, edx
call sub.cng.sys_BCryptCloseAlgorithmProvider
mov eax, ebx
jmp 0xfffff80696e917d7
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.fffff80696e91eb0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret