View More Demos

endbr64, push_r14, push_r13, push_r12, push_rbp, sub_rsp_0x28, mov_rax_qword_ptr_fs:[0x28], mov_qword_ptr_[rsp+0x18]rax, xor_eax_eax, mov_dword_ptr[rsp+0x14]0, test_rdx_rdx, je_0x96, cmp_qword_ptr[rdx@@ ]0, mov_r12_rdx, mov_eax_0x60003, je_0x24, mov_rcx_qword_ptr[rsp+0x18], xor_rcx_qword_ptr_fs:[0x28], jne_0x9c, add_rsp_0x28, pop_rbp, pop_r12, pop_r13, pop_r14, ret, mov_rbp_rdi, mov_edi_dword_ptr_[rip+0x2@@ 99@@ 13], mov_r13_rsi, mov_edx_0x2@@ 89, lea_rsi_[rip+0xd@@ f4@@ 2], call_0xffffffffffff4d@@ b8, mov_r14_rax, test_rax_rax, je_0x4d, lea_r8_[r@@ sp+0x14], mov_rcx_r13, mov_rdx_r12, mov_rsi_rax, mov_rdi_rbp, call_0xfffffffffffff87@@ a, mov_edx_0x2@@ 91, lea_rsi_[rip+0xd@@ f@@ 13], mov_rdi_r14, mov_dword_ptr_[rsp+0xc]eax, call_0xffffffffffff4e@@ 12, mov_eax_dword_ptr[rsp+0xc], jmp_0xffffffffffffff87, mov_eax_0x60003, jmp_0xffffffffffffff79, lea_rdi_[rip+0x@@ f5@@ 19], xor_eax_eax, call_0xffffffffffff7@@ 6f@@ 7, mov_eax_1, jmp_0xffffffffffffff5b, call_0xfffffffffffbf@@ 90@@ 8

Infer the name of this code_

Dr.Binary

Most likely this is a Windows file-open wrapper — e.g. a CreateFileW / NtCreateFile-style function (a CreateFileW-like wrapper that builds a UNICODE_STRING / path, validates the pointer, calls an Rtl path conversion helper, then calls an underlying NT file-open routine and returns an NTSTATUS/HRESULT).

Why:

  • endbr64 + push regs + stack-cookie (mov fs:[0x28] / xor / jne) => MSVC/Windows x64 style compiled code.
  • Early test/cmp on rdx and qword [rdx] — checking an incoming pointer/UNICODE_STRING for NULL/empty.
  • Calls that take converted-path (rax) and then call another routine with registers set up like Windows x64 call convention (rcx, rdx, r8, …) — consistent with calling an NT API (RtlDosPathNameToNtPathName_U then NtCreateFile or a kernel32 wrapper).
  • Multiple return codes set (e.g. returning a non-zero NTSTATUS/HRESULT on error, 1 on success).

So a reasonable inferred name: CreateFileW (or the module’s internal wrapper that ultimately calls NtCreateFile).