joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801410a4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
lahf
setb ah
cwde
mov qword [rsp + 0x18], rbp
push rsi
movzx ax, dh
bswap rax
push rdi
lahf
cdqe
push r14
lahf
bswap ax
cwde
mov eax, 0x1450
jmp 0x1801410d1
call fcn.18014493f
sub rsp, rax
mov rax, qword [0x180085010]
test r12w, cx
xor rax, rsp
mov qword [rsp + 0x1440], rax
lahf
movsxd r10, edx
mov rdi, rcx
or esi, 0x313a2f0c
btc bp, 0xf1
mov rax, r10
mov ebp, r9d
sar rax, 6
btc r14, rdx
adc dl, 0x9f
lea rcx, [0x180087a10]
sub sil, 0xf6
and r10d, 0x3f
shld r14d, eax, 0x2c
xadd si, r14w
bsf r14, r15
lea rbp, [rbp + r8]
clc
or dl, 0x29
mov rsi, r8
dec r14w
mov rax, qword [rcx + rax*8]
inc dx
lea rdx, [r10 + r10*8]
test cl, r13b
inc r14b
mov r14, qword [rax + rdx*8 + 0x28]
test bp, 0x4273
sub eax, eax
cmp si, cx
mov qword [rdi], rax
mov dword [rdi + 8], eax
test al, r12b
cmp r8, rbp
jmp 0x180141170
jae 0x180141253
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x1801411d6
mov al, byte [rsi]
jmp 0x18014118b
inc rsi
test r11b, r13b
clc
cmp edi, eax
cmp al, 0xa
jne 0x1801411af
inc dword [rdi + 8]
jmp 0x1801411a4
mov byte [rbx], 0xd
jmp 0x1801411ac
inc rbx
mov byte [rbx], al
nop
cdqe
inc rbx
movzx eax, di
lea rax, [rsp + 0x143f]
jmp 0x1801411c8
cmp rbx, rax
jmp 0x1801411d0
jb 0x18014117b
and qword [rsp + 0x20], 0
rcl eax, 0xf7
lea rax, [rsp + 0x40]
movsx rcx, r13w
inc ch
clc
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
xchg cl, dl
bswap dx
lea rdx, [rsp + 0x40]
mov cx, 0x37bc
mov rcx, r14
jmp 0x18014120b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x180141218
je 0x180141245
mov eax, dword [rsp + 0x30]
cmp r14w, r12w
cmc
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x180141231
jb 0x180141253
cmp rsi, rbp
jb 0x180141176
jmp 0x180141253
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
shl al, 0xcb
sal cl, 0xfc
mov rax, rdi
clc
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x180141267
call fcn.18012808d
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
not rdi
movsx rbp, r13w
mov rbp, qword [r11 + 0x30]
xchg r14b, dil
movzx r14, ax
mov rsp, r11
bswap si
pop r14
movsxd rsi, ebp
xchg esi, edi
pop rdi
movsx esi, r11w
cmove si, cx
movsxd rsi, r12d
pop rsi
jmp 0x1801412a9
ret
Function at 0x1801412aa
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
movzx rax, r14w
movzx ax, r10b
push rdi
xchg al, al
movzx eax, cx
push r14
mov eax, 0x1450
call fcn.18014493f
sub rsp, rax
mov rax, qword [0x180085010]
sal di, 5
shr r10b, cl
cmp bx, di
xor rax, rsp
bt si, bx
movzx r14w, r10b
sbb r10d, r11d
mov qword [rsp + 0x1440], rax
cbw
sub r14d, r14d
movsxd r10, edx
btr dx, bp
bsf r14w, r10w
mov rdi, rcx
mov rax, r10
bt cx, bp
cmp r15w, bp
rol sil, cl
mov ebp, r9d
sal r14d, 0xbf
bt r14w, 0xe7
rcr cx, 0x66
sar rax, 6
cmovns cx, cx
lea rcx, [0x180087a10]
cmp ax, 0x421f
adc r14b, r9b
and r10d, 0x3f
rcr r14b, 0x22
jmp 0x180141351
lea rbp, [rbp + r8]
bt si, r9w
cwd
mov rsi, r8
shr r14b, 0xc1
mov rax, qword [rcx + rax*8]
bswap r14
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x18014137b
xor eax, eax
test r14b, 0xfb
stc
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmc
cmp r8, rbp
jmp 0x180141391
jae 0x1801414a9
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1801413a4
jae 0x18014140c
movzx eax, word [rsi]
test sil, 0xea
test r15, rbx
add rsi, 2
cmp ax, 0xa
jne 0x1801413e3
add dword [rdi + 8], 2
btr ecx, r13d
movzx cx, r15b
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
cmp r13b, 0x3c
test cx, r14w
mov word [rbx], ax
add rbx, 2
dec ax
lea rax, [rsp + 0x143e]
cmc
jmp 0x1801413fe
cmp rbx, rax
jmp 0x180141406
jb 0x18014139c
and qword [rsp + 0x20], 0
btr r9d, 0xae
sete r9b
sub cl, 0x37
lea rax, [rsp + 0x40]
sar r9b, cl
rcr r8b, 0x82
sub rbx, rax
cdq
lea r9, [rsp + 0x30]
stc
xor dl, 0xf
sar rbx, 1
lea rdx, [rsp + 0x40]
adc ecx, 0x729b1a71
bt rcx, rbp
sar r8w, cl
add ebx, ebx
mov rcx, r14
setl r8b
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x180141466
je 0x18014149a
mov eax, dword [rsp + 0x30]
test ax, cx
cmp r13b, 0xb1
jmp 0x18014147c
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1801414a9
cmp rsi, rbp
jmp 0x18014148f
jb 0x180141397
jmp 0x1801414a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
sar ch, cl
movzx cx, r11b
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
jmp 0x1801414be
xor rcx, rsp
jmp 0x1801414c6
call fcn.18012808d
lea r11, [rsp + 0x1450]
movsxd rbx, eax
mov rbx, qword [r11 + 0x20]
movzx si, sil
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movsx r14d, di
mov edi, 0x3aa41e7b
pop r14
movzx si, r8b
cmovl rdi, r10
pop rdi
bswap si
pop rsi
ret
Function at 0x1400018d8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
mov rdi, rdx
mov r8, rcx
test rcx, rcx
je 0x1400019b4
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400019b4
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400019b4
mov ecx, 0x20b
cmp word [rax + r8 + 0x18], cx
jne 0x140001934
mov ecx, dword [rax + r8 + 0x88]
jmp 0x140001939
mov ecx, dword [rax + r8 + 0x78]
mov r9d, ecx
xor edx, edx
mov r14d, dword [r9 + r8 + 0x24]
mov ebp, dword [r9 + r8 + 0x20]
add r14, r8
mov r11d, dword [r9 + r8 + 0x1c]
add rbp, r8
mov r15d, dword [r9 + r8 + 0x14]
add r11, r8
test r15d, r15d
je 0x1400019b4
cmp rdi, 0xffff
ja 0x14000197b
movzx ecx, dx
movzx ebx, dx
add ecx, dword [r9 + r8 + 0x10]
movzx eax, di
cmp eax, ecx
jmp 0x1400019ab
cmp edx, dword [r9 + r8 + 0x18]
jae 0x1400019b4
mov ecx, dword [rbp + rdx*4]
mov rsi, rdi
movzx ebx, word [r14 + rdx*2]
add rcx, r8
sub rsi, rcx
movzx eax, byte [rcx]
movzx r10d, byte [rcx + rsi]
sub eax, r10d
jne 0x1400019a9
inc rcx
test r10d, r10d
jne 0x140001994
test eax, eax
je 0x1400019cf
inc edx
cmp edx, r15d
jb 0x140001960
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
movzx eax, bx
mov eax, dword [r11 + rax*4]
add rax, r8
jmp 0x1400019b6

Function at 0x140001bb0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov ebx, r8d
mov rdi, rdx
test rcx, rcx
je 0x140001c06
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140001c06
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov dword [0x140005de8], ebx
mov qword [0x140005de0], rdi
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x60]
call fcn.140001fd8
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x140001e48
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xc8
movups xmm0, xmmword [0x1400036a0]
mov eax, dword [0x1400036c8]
lea rdx, [rbp - 0x29]
movups xmm1, xmmword [0x1400036b0]
mov dword [rbp - 1], eax
mov rbx, rcx
movzx eax, word [0x1400036cc]
lea rcx, [rbp - 0x39]
movups xmmword [rbp - 0x29], xmm0
xor edi, edi
mov word [rbp + 3], ax
movsd xmm0, qword [0x1400036c0]
movsd qword [rbp - 9], xmm0
mov qword [rbp + 0x67], rdi
movups xmmword [rbp - 0x19], xmm1
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x39]
mov dword [rbp + 7], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov qword [rbp + 0xf], rdi
mov edx, 0xf001f
mov dword [rbp + 0x1f], 0x40
lea rcx, [rbp + 0x77]
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
test eax, eax
js 0x140001f50
mov rsi, qword [rbp + 0x77]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001f50
mov rdx, qword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0x67]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
or rdx, 0xffffffffffffffff
mov qword [rbp + 0x7f], rbx
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
cmove rdi, qword [rbp + 0x67]
mov rax, rdi
jmp 0x140001f52
xor eax, eax
add rsp, 0xc8
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400022f8
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
test rcx, rcx
je 0x14000234f
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000234f
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea ecx, [rdi + 0x2000]
call fcn.140001530
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400026ec
Capabilities:
Map section object

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
and qword [rbp + 0x6f], 0
lea rax, [rbp - 1]
and qword [rbp + 0x77], 0
xorps xmm0, xmm0
and qword [rbp + 0x7f], 0
xorps xmm1, xmm1
and qword [rbp - 9], 0
mov rdx, rcx
and qword [rbp + 0x27], 0
lea rcx, [rbp - 1]
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0x2f], rax
movups xmmword [rbp + 0x3f], xmm0
mov dword [rbp + 0x1f], 0x30
movups xmmword [rbp + 0xf], xmm1
mov dword [rbp + 0x37], 0x40
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rbp + 0xf]
mov dword [rsp + 0x28], 0x20
lea r8, [rbp + 0x1f]
mov dword [rsp + 0x20], 1
mov edx, 0x100020
lea rcx, [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x140002812
mov rax, qword [rbp + 0x77]
lea r8, [rbp + 0x1f]
and qword [rbp + 0x2f], 0
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x1000000
mov edx, 0xf001f
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
js 0x140002812
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 9]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0x7f]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x3e8
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
js 0x140002812
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, qword [rbp + 0x7f]
jmp 0x140002814
xor eax, eax
add rsp, 0xb0
pop rbp
ret

Function at 0x140002878
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and qword [rax - 0x28], 0
mov rbp, rdx
lea rdx, [rax - 0x28]
mov edi, r8d
mov r15, r9
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002922
mov rbx, qword [rsp + 0x20]
lea rcx, [rbx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002922
mov rsi, qword [rbx + 0x28]
test rsi, rsi
je 0x140002922
mov r8d, 0x17427
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cli
mov r14, cr3
mov cr3, rsi
sti
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002903
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call fcn.140003180
mov al, 1
jmp 0x140002924
cli
mov cr3, r14
sti
mov r8, rdi
mov rdx, rbx
mov rcx, r15
call fcn.140003180
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140002940
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
and qword [rax - 0x18], 0
mov rbp, rdx
lea rdx, [rax - 0x18]
mov esi, r8d
mov r14, r9
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400029eb
mov rbx, qword [rsp + 0x20]
lea rcx, [rbx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400029eb
mov rdi, qword [rbx + 0x28]
test rdi, rdi
je 0x1400029eb
mov r8d, 0x17427
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, esi
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.140003180
cli
mov r14, cr3
mov cr3, rdi
sti
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400029da
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.140003180
mov al, 1
jmp 0x1400029ed
cli
mov cr3, r14
sti
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140002a08
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
and qword [r11 - 0x38], 0
xorps xmm0, xmm0
mov rsi, rdx
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
lea rdx, [r11 - 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x48], xmm0
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rdi, rax
test rax, rax
je 0x140002aa7
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x140002aa7
add rcx, 0xc
mov ebx, dword [rcx]
cmp rbx, rcx
je 0x140002aa7
mov eax, dword [rbx + 0x30]
test eax, eax
je 0x140002a94
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
mov edx, eax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140002aa2
mov eax, dword [rdi + 0xc]
mov ebx, dword [rbx]
add rax, 0xc
cmp rbx, rax
jmp 0x140002a61
mov ebx, dword [rbx + 0x18]
jmp 0x140002aa9
xor ebx, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140002ac8
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
and qword [r11 - 0x38], 0
xorps xmm0, xmm0
mov rsi, rdx
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
lea rdx, [r11 - 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x48], xmm0
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
test rax, rax
je 0x140002b6d
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140002b6d
add rcx, 0x10
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x140002b6d
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x140002b57
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140002b67
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbx]
add rax, 0x10
cmp rbx, rax
jmp 0x140002b24
mov rbx, qword [rbx + 0x30]
jmp 0x140002b6f
xor ebx, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140002b90
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x28], 0
mov rdi, rdx
xorps xmm0, xmm0
lea rdx, [rbp + 0x28]
movups xmmword [rbp - 0x20], xmm0
mov rbx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002bc6
xor eax, eax
jmp 0x140002c24
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14000283c
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rcx, qword [rbp + 0x28]
test rax, rax
je 0x140002bfc
movaps xmm0, xmmword [rbp - 0x20]
lea rdx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140002a08
mov qword [rbx], rax
jmp 0x140002bc2
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
test rax, rax
je 0x140002c1f
movaps xmm0, xmmword [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp + 0x28]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140002ac8
jmp 0x140002bf7
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x140002c34
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
or r9, 0xffffffffffffffff
mov r10, rdx
xor r8d, r8d
mov rdi, rcx
inc r9
cmp byte [rcx + r9], r8b
jne 0x140002c50
mov eax, r8d
mov rcx, r10
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x140002c5f
mov r11d, r8d
mov rbx, r10
movzx esi, byte [rbx]
mov eax, r11d
cdq
idiv r9d
movsxd rax, edx
movsx ecx, byte [rax + rdi]
add r8d, ecx
add r8d, esi
and r8d, 0x800000ff
jge 0x140002ca0
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
inc r11d
mov al, byte [rcx + r10]
mov byte [rbx], al
inc rbx
mov byte [rcx + r10], sil
cmp r11d, 0x100
jl 0x140002c73
mov rbx, qword [rsp + 8]
xor eax, eax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140002cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
mov rdi, rdx
mov rbx, rcx
mov r10d, r11d
test r9, r9
je 0x140002d53
sub rdi, r8
lea eax, [r11 + 1]
and eax, 0x800000ff
jge 0x140002d07
dec eax
or eax, 0xffffff00
inc eax
movsxd r11, eax
movzx edx, byte [r11 + rbx]
add r10d, edx
and r10d, 0x800000ff
jge 0x140002d28
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rcx, r10d
mov al, byte [rcx + rbx]
mov byte [r11 + rbx], al
mov byte [rcx + rbx], dl
movzx eax, byte [r11 + rbx]
add rdx, rax
movzx eax, dl
mov dl, byte [rax + rbx]
xor dl, byte [rdi + r8]
mov byte [r8], dl
inc r8
sub r9, 1
jne 0x140002cf3
mov rbx, qword [rsp + 8]
xor eax, eax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140002d68
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
lea rax, [rdx - 0x10001]
mov rdi, rdx
movabs rdx, 0x7ffffffefffe
mov rbx, r8
cmp rax, rdx
ja 0x140002e31
and qword [rbp + 0x6f], 0
lea rdx, [rbp + 0x6f]
and qword [rbp - 9], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0x1f], rax
movups xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002e31
lfence
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea r9, [rbp + 0x27]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, rdi
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
lea rcx, [rbp - 9]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x140002e23
movups xmm0, xmmword [rbp + 0x27]
movups xmm1, xmmword [rbp + 0x37]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rbp + 0x47]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x140002e36
mov eax, 0xc0000001
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140002eb0
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
and qword [rax - 0x18], 0
mov rsi, rdx
and qword [rax - 0x10], 0
lea rdx, [rax - 0x18]
mov rbx, r9
mov rdi, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002f1f
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002f19
lea rax, [rsp + 0x48]
mov r9d, 0x1fffff
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov byte [rsp + 0x28], 0
mov edx, 0x200
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp qword [rsp + 0x48], 0
je 0x140002f57
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x40]
mov r9, rbx
mov r8, rax
mov byte [rsp + 0x28], 1
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call fcn.140003028
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140002f6c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
and qword [rax - 0x18], 0
mov rsi, rdx
and qword [rax - 0x10], 0
lea rdx, [rax - 0x18]
mov rbx, r9
mov rdi, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002fdb
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002fd5
lea rax, [rsp + 0x48]
mov r9d, 0x1fffff
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov byte [rsp + 0x28], 0
mov edx, 0x200
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp qword [rsp + 0x48], 0
je 0x140003013
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rcx, rax
mov byte [rsp + 0x28], 1
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call fcn.140003028
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140004f90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140004fb1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140004fde
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004fe0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005039
test ecx, ecx
jle 0x140005019
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005039
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005039
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret