joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004340
Capabilities:
Complete processing asynchronous io request
Create device object
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [rdx + 0xb8]
mov rdi, rdx
mov r14, qword [rcx + 0x40]
lea rdx, [r11 + 8]
mov rsi, rcx
mov r8, qword [rax + 8]
mov rbp, qword [r8 + 0x10]
mov rcx, rbp
call fcn.140004968
test eax, eax
js 0x1400043fb
cmp byte [rsp + 0x80], 0
je 0x1400043fb
mov eax, dword [0x14000a398]
test al, 0x20
jne 0x1400043fb
lea rdx, [0x14000a3c0]
mov rcx, rbp
call fcn.14000e274
mov ecx, dword [0x14000a398]
mov rbx, rax
test cl, 1
je 0x1400043ca
test rax, rax
lea r8, [0x14000a030]
mov rdx, rbp
lea rcx, [0x1400067d0]
cmovne r8, rax
call sub.ntoskrnl.exe_DbgPrint
test rbx, rbx
je 0x1400043de
lea rdx, [0x14000a3c0]
mov rcx, rbx
call fcn.1400050d4
inc byte [rdi + 0x43]
mov rdx, rdi
add qword [rdi + 0xb8], 0x48
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x140004572
mov r9d, dword [rsi + 0x48]
lea rax, [rsp + 0x88]
mov rcx, qword [0x14000a388]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea edx, [r8 + 0x3c]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
jns 0x14000444a
and qword [rdi + 0x38], 0
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], eax
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x140004572
mov rax, qword [rsp + 0x88]
mov r8, rbp
mov rbx, qword [rax + 0x40]
mov rcx, rbx
and dword [rbx + 0x38], 0
mov rdx, qword [rsp + 0x88]
call fcn.140005690
lea rdx, [0x14000a3c0]
mov rcx, rbp
call fcn.14000e274
mov rbp, rax
test rax, rax
jne 0x1400044b0
mov eax, dword [0x14000a398]
test al, 1
je 0x14000449d
mov rdx, rsi
lea rcx, [0x140006840]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x1400043de
lea rcx, [rbx + 0x28]
mov r8d, 0x6e764653
mov rdx, rbp
call fcn.14000e1ac
lea rdx, [0x14000a3c0]
mov rcx, rbp
mov ebx, eax
call fcn.1400050d4
test ebx, ebx
js 0x140004484
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rax, qword [rdi + 0xb8]
lea rcx, [0x140003748]
mov rdx, rdi
movups xmm0, xmmword [rax]
movups xmmword [rax - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rax - 0x38], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rax - 0x28], xmm0
movsd xmm1, qword [rax + 0x30]
movsd qword [rax - 0x18], xmm1
mov byte [rax - 0x45], 0
mov rax, qword [rdi + 0xb8]
mov qword [rax - 0x10], rcx
lea rcx, [rsp + 0x40]
mov qword [rax - 8], rcx
mov byte [rax - 0x45], 0xe0
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x14000455f
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r8, qword [rsp + 0x88]
mov rdx, rdi
mov rcx, rsi
call fcn.140004588
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140004588
Capabilities:
Complete processing asynchronous io request
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [r8 + 0x40]
mov rbx, r8
mov r9, qword [rdx + 0xb8]
xor r15b, r15b
mov rsi, rdx
mov r14, rcx
mov rax, qword [rdi + 0x10]
mov r8, qword [r9 + 8]
mov rbp, qword [rax + 0x38]
mov eax, dword [0x14000a398]
cmp rbp, r8
je 0x1400045eb
test al, 1
je 0x1400045eb
mov rdx, qword [rbp + 8]
lea rcx, [0x1400068b0]
mov r9, rbp
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [0x14000a398]
mov r9d, dword [rsi + 0x30]
test r9d, r9d
js 0x14000470a
test al, 1
je 0x14000460f
lea r8, [rdi + 0x28]
mov rdx, r14
lea rcx, [0x140006910]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x14000b600]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x48]
call fcn.1400048e4
test al, al
jne 0x140004698
mov rcx, qword [rbp + 8]
mov rdx, rbx
call fcn.140003308
test eax, eax
mov eax, dword [0x14000a398]
js 0x140004669
mov r15b, 1
test r15b, al
je 0x1400046da
mov r9d, dword [rsi + 0x30]
lea r8, [rdi + 0x28]
mov rdx, r14
lea rcx, [0x140006980]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400046da
test al, 1
je 0x140004684
mov r9d, dword [rsi + 0x30]
lea r8, [rdi + 0x28]
mov rdx, r14
lea rcx, [0x140006a00]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x40]
call fcn.1400050a0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x1400046da
mov eax, dword [0x14000a398]
mov rbp, qword [rsp + 0x48]
test al, 1
je 0x1400046bf
mov rdx, qword [rbp + 0x40]
lea r8, [rdi + 0x28]
lea rcx, [0x140006a80]
mov rdx, qword [rdx + 8]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x40]
call fcn.1400050a0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [0x14000b600]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
test r15b, r15b
je 0x140004733
mov eax, dword [0x14000a398]
test al, 0x40
je 0x140004733
cmp qword [rdi + 0x10], 0
je 0x140004733
mov rdx, rdi
mov rcx, rbx
call fcn.14000e2a4
jmp 0x140004733
test al, 1
je 0x140004721
lea r8, [rdi + 0x28]
mov rdx, r14
lea rcx, [0x140006ae0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x40]
call fcn.1400050a0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov ebx, dword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140004a10
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
xor edx, edx
lea rcx, [0x14000a340]
lea r8d, [rdx + 0x40]
call fcn.140006200
lea rdx, [0x140006530]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x140006580]
mov qword [0x14000a340], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x1400065c0]
mov qword [0x14000a348], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x140006600]
mov qword [0x14000a350], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x140006630]
mov qword [0x14000a358], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x140006670]
mov qword [0x14000a360], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x1400066a0]
mov qword [0x14000a368], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x1400066e0]
mov qword [0x14000a370], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x14000a378], rax
add rsp, 0x30
pop rbp
ret

Function at 0x140004b44
Capabilities:
Complete processing asynchronous io request

Disassembly:
sub rsp, 0x28
mov r8, rdx
test rcx, rcx
je 0x140004b82
mov rax, qword [0x14000a388]
cmp qword [rcx + 8], rax
jne 0x140004b82
cmp qword [rcx + 0x40], 0
je 0x140004b82
inc byte [rdx + 0x43]
add qword [rdx + 0xb8], 0x48
mov rcx, qword [rcx + 0x40]
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp qword [sym.imp.ntoskrnl.exe_IofCallDriver]
and qword [rdx + 0x38], 0
mov rcx, r8
mov dword [rdx + 0x30], 0xc0000010
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc0000010
add rsp, 0x28
ret
Function at 0x1400059c8
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x14000a330]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdx, rcx
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp - 9]
and qword [rsp + 0x48], 0
lea r9, [rbp + 7]
and qword [rbp - 0x31], 0
lea r8, [rbp - 0x39]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp - 0x41]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x100180
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rbp - 0x39], 0x30
mov dword [rbp - 0x21], 0x240
mov qword [rbp - 0x29], rax
movdqu xmmword [rbp - 0x19], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, 4
test eax, eax
js 0x140005aaf
mov rcx, qword [rbp - 0x41]
lea r9d, [rbx + 0x24]
lea r8, [rbp + 0x27]
mov dword [rsp + 0x20], ebx
lea rdx, [rbp + 0x17]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x140005aa5
mov rcx, qword [rbp - 0x41]
lea r9d, [rbx + 0x24]
lea r8, [rbp + 0x27]
mov dword [rbp + 0x47], 0x80
lea rdx, [rbp + 0x17]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
and dword [rsp + 0x50], 0
lea rax, [rbp - 9]
and qword [rsp + 0x48], 0
lea r9, [rbp + 7]
and qword [rbp - 0x31], 0
lea r8, [rbp - 0x39]
mov dword [rsp + 0x40], 0x1020
lea rcx, [rbp - 0x41]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
mov edx, 0x110000
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rbp - 0x39], 0x30
mov dword [rbp - 0x21], 0x240
mov qword [rbp - 0x29], rax
movdqu xmmword [rbp - 0x19], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140005b49
mov rcx, qword [rbp - 0x41]
lea r8, [rbp - 0x49]
mov r9d, 1
mov byte [rbp - 0x49], 1
lea rdx, [rbp + 7]
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov rcx, qword [rbp - 0x41]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140005c60
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rbp
ret

Function at 0x14000e71c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
mov esi, 0x4000
mov edx, esi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, esi
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.140006200
test rdi, rdi
je 0x14000e794
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000e780
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add esi, esi
jmp 0x14000e737
test eax, eax
jne 0x14000e789
mov rax, rdi
jmp 0x14000e796
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e7ac
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rsi, rcx
mov ebx, r15d
lea ecx, [r15 + 5]
call fcn.14000e71c
mov rdi, rax
test rax, rax
jne 0x14000e7e5
xor eax, eax
jmp 0x14000e881
mov eax, dword [rax]
mov rcx, rdi
add rcx, rax
inc ebx
mov eax, dword [rcx]
test eax, eax
jne 0x14000e7ea
lea eax, [rbx + 1]
imul ecx, eax, 0x220
mov dword [rsi], ecx
mov edx, ecx
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r14, rax
test rax, rax
je 0x14000e7de
mov rbp, rax
mov rsi, rdi
mov eax, dword [rsi]
lea rdx, [rbp + 0x20]
add rsi, rax
mov rcx, qword [rsi + 0x40]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14000e828
mov byte [rbp + 8], 1
lea rdx, [rbp + 0x18]
mov eax, dword [rsi + 0x50]
mov dword [rbp + 0xc], eax
mov eax, dword [rsi + 0x58]
mov dword [rbp + 0x10], eax
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbp, 0x220
cmp dword [rsi], r15d
jne 0x14000e81b
xor edx, edx
mov byte [rbp + 8], r15b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000e89c
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x90
mov rax, qword [0x14000a330]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor ebx, ebx
mov r13, r9
mov byte [rsp + 0x40], bl
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r15b, bl
test rdx, rdx
je 0x14000e8df
test r9, r9
jne 0x14000e8f3
test byte [rsp + 0x100], 1
jne 0x14000e8f3
mov eax, 0xc0000030
jmp 0x14000ea46
mov dil, byte [rsp + 0x108]
test dil, dil
je 0x14000e917
test dword [rsp + 0xf8], 0x200
je 0x14000e917
mov eax, 0xc00000f4
jmp 0x14000ea46
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
cmp rsi, qword [rax]
jne 0x14000e92d
or rbp, 0xffffffff80000000
mov dil, bl
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rsi, rax
jne 0x14000e94c
test byte [rsp + 0x100], 1
je 0x14000e94c
mov eax, 0xc00000db
jmp 0x14000ea46
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rsi, rax
je 0x14000e968
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r15b, 1
test byte [rsp + 0x100], 1
mov rcx, rbp
je 0x14000e999
mov dl, dil
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov edi, eax
test r15b, r15b
je 0x14000ea44
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000ea44
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rbx
mov r9b, dil
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
test r15b, r15b
je 0x14000e9c8
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14000ea44
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp r12, rax
je 0x14000e9ea
lea rdx, [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x40], 1
mov r9d, dword [rsp + 0xf0]
lea rax, [rsp + 0x50]
mov edx, dword [rsp + 0xf8]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov rcx, qword [rsp + 0x48]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp byte [rsp + 0x40], bl
je 0x14000ea38
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
cmovns rbx, qword [rsp + 0x50]
mov qword [r13], rbx
mov eax, edi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140005c60
add rsp, 0x90
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000f110
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rsi, rdx
mov edi, r8d
mov r15, rdx
mov r8d, r8d
mov rbx, rcx
xor edx, edx
mov rcx, rsi
call fcn.140006200
mov rdx, rbx
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x21
lea r9, [rbp - 0x19]
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x30
mov edx, 0x100001
mov dword [rbp + 0x1f], 0x240
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x20], 7
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov r14d, eax
test eax, eax
js 0x14000f303
mov r12d, 1
mov edx, 0x148
mov ecx, r12d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov r8d, 0x148
mov rcx, rax
mov rbx, rax
call fcn.140006200
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 0x19]
mov byte [rsp + 0x50], r12b
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
mov byte [rsp + 0x40], r12b
xor edx, edx
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], 0x148
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov r12d, eax
test eax, eax
js 0x14000f238
mov ecx, dword [rbx + 0x38]
test cl, 0x10
je 0x14000f23e
mov ecx, dword [rbx + 0x3c]
lea rdx, [rbx + 0x40]
lea r8d, [rcx + rcx]
mov rcx, rsi
call fcn.140005ec0
lea rsi, [rsi + 0x200]
jmp 0x14000f23e
mov r14d, 0xc0000001
test r14d, r14d
js 0x14000f2ee
cmp r12d, 0x80000006
je 0x14000f2ee
sub rdi, rsi
mov r12d, 0x200
add rdi, r15
cmp rdi, r12
jle 0x14000f2ee
mov r15d, 0x148
xor edx, edx
mov r8d, r15d
mov rcx, rbx
call fcn.140006200
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 0x19]
mov byte [rsp + 0x50], 0
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov r15d, eax
test eax, eax
js 0x14000f2e1
mov ecx, dword [rbx + 0x38]
test cl, 0x10
je 0x14000f2e1
mov ecx, dword [rbx + 0x3c]
lea rdx, [rbx + 0x40]
lea r8d, [rcx + rcx]
mov rcx, rsi
call fcn.140005ec0
add rsi, r12
sub rdi, r12
cmp r15d, 0x80000006
jne 0x14000f260
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0xb0]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000f324
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rsi, rdx
mov edi, r8d
mov r15, rdx
mov r8d, r8d
mov rbx, rcx
xor edx, edx
mov rcx, rsi
call fcn.140006200
mov rdx, rbx
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x21
lea r9, [rbp - 0x19]
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x30
mov edx, 0x100001
mov dword [rbp + 0x1f], 0x240
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x20], 7
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov r14d, eax
test eax, eax
js 0x14000f517
mov r12d, 1
mov edx, 0x148
mov ecx, r12d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov r8d, 0x148
mov rcx, rax
mov rbx, rax
call fcn.140006200
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 0x19]
mov byte [rsp + 0x50], r12b
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
mov byte [rsp + 0x40], r12b
xor edx, edx
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], 0x148
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov r12d, eax
test eax, eax
js 0x14000f44c
mov ecx, dword [rbx + 0x38]
test cl, 0x10
jne 0x14000f452
mov ecx, dword [rbx + 0x3c]
lea rdx, [rbx + 0x40]
lea r8d, [rcx + rcx]
mov rcx, rsi
call fcn.140005ec0
lea rsi, [rsi + 0x200]
jmp 0x14000f452
mov r14d, 0xc0000001
test r14d, r14d
js 0x14000f502
cmp r12d, 0x80000006
je 0x14000f502
sub rdi, rsi
mov r12d, 0x200
add rdi, r15
cmp rdi, r12
jle 0x14000f502
mov r15d, 0x148
xor edx, edx
mov r8d, r15d
mov rcx, rbx
call fcn.140006200
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 0x19]
mov byte [rsp + 0x50], 0
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov r15d, eax
test eax, eax
js 0x14000f4f5
mov ecx, dword [rbx + 0x38]
test cl, 0x10
jne 0x14000f4f5
mov ecx, dword [rbx + 0x3c]
lea rdx, [rbx + 0x40]
lea r8d, [rcx + rcx]
mov rcx, rsi
call fcn.140005ec0
add rsi, r12
sub rdi, r12
cmp r15d, 0x80000006
jne 0x14000f474
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0xb0]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140010398
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14000a330]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r9
mov esi, r8d
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x40], rdx
mov bl, byte [rsp + 0xd8]
test bl, bl
je 0x1400103f9
mov eax, 1
lea r8d, [rax + 3]
cmp esi, 3
cmove r8d, eax
mov edx, dword [rsp + 0xd0]
mov rcx, r9
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
jmp 0x1400103f9
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9b, bl
mov r8, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov r8, qword [r8]
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
js 0x1400104ca
mov rcx, qword [rsp + 0x38]
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
cmp rcx, qword [rax]
jne 0x14001044a
or rdi, 0xffffffff80000000
mov qword [rsp + 0x40], rdi
jmp 0x14001045c
test rdi, rdi
jns 0x14001045c
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000008
jmp 0x1400104ca
cmp esi, 3
je 0x140010468
mov ebx, 0xc0000003
jmp 0x1400104c2
cmp dword [rsp + 0xd0], 2
jne 0x14001048b
movzx eax, word [r14]
mov word [rsp + 0x30], ax
jmp 0x140010489
jmp 0x140010490
mov ebx, 0xc0000004
test ebx, ebx
js 0x1400104c2
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObSetHandleAttributes]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140005c60
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400105c8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x70
mov sil, r9b
mov rbx, r8
mov r14d, edx
mov rdi, rcx
test r9b, r9b
je 0x14001061e
mov edx, 8
mov r8d, edx
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov edx, 0x10
lea r8d, [rdx - 0xc]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movups xmm0, xmmword [rbx]
movdqu xmmword [rsp + 0x58], xmm0
jmp 0x140010628
movups xmm0, xmmword [r8]
movdqu xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x60], 0
je 0x140010658
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessThreadByCid]
mov ebx, eax
test eax, eax
js 0x140010665
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140010665
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test ebx, ebx
js 0x1400106c6
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
js 0x1400106c6
test sil, sil
je 0x1400106be
mov rcx, qword [rsp + 0x48]
mov qword [rdi], rcx
jmp 0x1400106bc
jmp 0x1400106c6
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret