joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33a14
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x90
xor ebx, ebx
mov rbp, rdx
lea rdx, [rax - 0x80]
mov r12, rcx
mov qword [rax - 0x80], rbx
mov qword [rax - 0x78], rbx
mov dil, bl
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x30], rbx
mov dword [rax + 0x18], ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jge 0x33a5d
xor al, al
jmp 0x33c4e
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x38]
cmp eax, ebx
jge 0x33a7c
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x33a56
call fcn.0003acde
mov rcx, qword [rsp + 0x40]
mov rsi, rax
call fcn.0003acde
mov r13d, 1
cmp rsi, rbx
je 0x33ab2
cmp rax, rbx
je 0x33ab2
mov rdx, rax
mov rcx, rsi
call fcn.0003acc6
cmp eax, ebx
jne 0x33abd
mov dil, r13b
jmp 0x33abd
movzx edi, dil
cmp rsi, rax
cmove edi, r13d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dil, bl
je 0x33a56
mov edi, 0x400
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0xd8]
mov edx, edi
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
cmp eax, ebx
jl 0x33a56
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x30]
mov edx, edi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
cmp eax, ebx
jge 0x33b6c
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x33a56
mov ebp, 0x10100
mov ecx, r13d
mov rdx, rbp
call fcn.00036578
mov rdi, rax
cmp rax, rbx
jne 0x33b99
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x30]
jmp 0x33b61
mov rdx, rbp
mov ecx, r13d
call fcn.00036578
mov rsi, rax
cmp rax, rbx
jne 0x33bb6
mov rcx, rdi
call fcn.000365f0
jmp 0x33b84
mov rcx, qword [rsp + 0xd8]
lea rax, [rsp + 0xd0]
mov r12d, 0x1b
mov edx, r12d
mov r9d, ebp
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
cmp eax, ebx
jl 0x33c23
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xd0]
mov r9d, ebp
mov r8, rsi
mov edx, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
cmp eax, ebx
jl 0x33c23
mov r8b, r13b
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
movzx ecx, bl
cmp eax, ebx
cmove ecx, r13d
mov bl, cl
mov rcx, rsi
call fcn.000365f0
mov rcx, rdi
call fcn.000365f0
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x33d50
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
and qword [rax + 0x20], 0
and qword [rax + 0x18], 0
mov rdi, rdx
lea rdx, [rax - 0x18]
xor bl, bl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x33d80
xor al, al
jmp 0x33e2c
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x33d9f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x33d79
cmp qword [0x0004aa88], 0
je 0x33e14
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x58]
call fcn.00033ce4
test eax, eax
js 0x33e14
cmp qword [0x0004aa88], 0
je 0x33e01
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call fcn.00033ce4
test eax, eax
js 0x33e01
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x34188
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x341a7
xor eax, eax
jmp 0x341c3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x341d0
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, qword [0x0004d308]
and qword [rax + 0x20], 0
and qword [rax + 0x18], 0
lea rdx, [rax - 0x58]
xor bl, bl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x34204
xor al, al
jmp 0x3433c
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x34223
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x341fd
cmp qword [0x0004aa88], 0
je 0x34324
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x98]
call fcn.00033ce4
test eax, eax
js 0x34324
cmp qword [0x0004aa88], 0
je 0x3430b
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x90]
call fcn.00033ce4
test eax, eax
js 0x3430b
mov rax, qword [rsp + 0x98]
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
movzx r9d, word [rsp + 0x30]
shr r9d, 1
je 0x342f2
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.00032aa4
test al, al
je 0x342f2
mov rax, qword [rsp + 0x90]
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
movzx r9d, word [rsp + 0x30]
shr r9d, 1
je 0x342f2
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.00032aa4
test al, al
je 0x342f2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov bl, al
mov rcx, qword [rsp + 0x90]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x343a0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
sub rsp, 0x90
mov r12, rdx
xor esi, esi
mov qword [rax + 0x20], rsi
lea rdx, [rax + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jge 0x343d6
xor al, al
jmp 0x3451c
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov edx, 0x80
lea r8d, [rdx - 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x70]
mov r8d, 1
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8b, 1
lea rdx, [rdi + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, esi
jl 0x344f7
movzx ecx, word [rsp + 0x48]
cmp rcx, 0x7ffffffe
jbe 0x34465
mov byte [r12], sil
jmp 0x344e4
mov qword [rsp + 0x40], rcx
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x38], r8
mov edx, 0x104
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x28], r12
mov rax, rsi
mov qword [rsp + 0x30], rax
cmp rdx, rsi
je 0x344cb
cmp rcx, rsi
je 0x344cb
mov r9b, byte [r8]
cmp r9b, sil
je 0x344cb
mov byte [r12], r9b
inc r12
mov qword [rsp + 0x28], r12
inc r8
mov qword [rsp + 0x38], r8
dec rdx
mov qword [rsp + 0x58], rdx
dec rcx
mov qword [rsp + 0x40], rcx
inc rax
mov qword [rsp + 0x30], rax
jmp 0x3448b
cmp rdx, rsi
jne 0x344e0
dec r12
mov qword [rsp + 0x28], r12
dec rax
mov qword [rsp + 0x30], rax
mov byte [r12], sil
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
mov sil, 1
mov byte [rsp + 0x20], sil
jmp 0x34500
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, sil
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x3453c
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x0003c840]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x346d8
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x3469a
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x346c5
cmp rbx, 0x6400000
ja 0x346c5
mov rdx, rbx
mov ecx, edi
call fcn.00036578
mov rdi, rax
test rax, rax
je 0x34695
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x34686
mov rcx, rdi
call fcn.000365f0
mov ebx, esi
jmp 0x3469a
cmp qword [rsp + 0x58], rbx
je 0x346ac
mov rcx, rdi
call fcn.000365f0
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x346d8
mov rcx, qword [rsp + 0xe0]
mov qword [0x0004dd00], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x346d8
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x346f4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x34718
xor al, al
jmp 0x3473f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x34750
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x34774
lea rax, [0x0003b5a0]
jmp 0x347e4
mov rcx, qword [rsp + 0x38]
call fcn.0003acde
mov r11, rax
test rax, rax
jne 0x34793
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x3476b
lea rdi, [0x0004dbf0]
mov byte [0x0004dcf3], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x347cb
mov al, byte [r11 + rcx]
test al, al
je 0x347cb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x347ac
test rdx, rdx
jne 0x347d3
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x34b08
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x0004dd18]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x34be9
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x34b4f
xor eax, eax
jmp 0x34be9
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.00036578
mov rbx, rax
test rax, rax
je 0x34b48
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x34b88
mov rcx, rbx
call fcn.000365f0
jmp 0x34b48
xor edi, edi
cmp dword [rbx], edi
jbe 0x34bda
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x0003ea00]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.0003acc6
test eax, eax
je 0x34bc5
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x34b92
jmp 0x34bda
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x0004dd18], rax
mov rcx, rbx
call fcn.000365f0
mov rax, qword [0x0004dd18]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x3523c
Capabilities:
Attach user process memory
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov byte [rax + 8], 0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor ebx, ebx
and dword [rsp + 0x88], ebx
mov esi, 0x4000
mov rbp, rax
mov edi, esi
xor r12b, r12b
test rbx, rbx
je 0x35276
mov rcx, rbx
call fcn.000365f0
mov edx, edi
mov ecx, 1
call fcn.00036578
mov rbx, rax
test rax, rax
je 0x35354
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, rax
mov ecx, 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
add edi, esi
cmp eax, 0xc0000004
je 0x35269
test eax, eax
js 0x3534c
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbp, rax
je 0x35305
and qword [rsp + 0x90], 0
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x3534c
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r12b, 1
xor esi, esi
cmp dword [rbx], esi
jbe 0x3533c
lea rdi, [rbx + 0xe]
cmp ebp, dword [rdi - 6]
jne 0x35332
movzx edx, word [rdi]
lea r9, [rsp + 0x80]
lea r8, [fcn.000351d8]
mov rcx, rbp
call fcn.00037128
test al, al
je 0x3533c
inc esi
add rdi, 0x18
cmp esi, dword [rbx]
jb 0x3530f
test r12b, r12b
je 0x3534c
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbx
call fcn.000365f0
mov al, byte [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x35b10
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbp, rdx
lea rdx, [rsp + 0x30]
mov rsi, r8
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x35c4b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x35c40
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.000359e8
and qword [rsp + 0xd8], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov edx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x35c32
mov rcx, qword [rsp + 0xd8]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x35c32
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00035c6c
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x361f0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x3622c
cmp dword [rsp + 0x48], 2
jne 0x3632a
lea eax, [r11 - 2]
jmp 0x3632c
cmp r11d, 6
jne 0x362c7
mov ecx, dword [rsp + 0x48]
xor eax, eax
cmp ecx, eax
jne 0x36248
mov eax, r11d
jmp 0x3632c
cmp ecx, 1
jne 0x36273
cmp dword [rsp + 0x40], 0x1b58
jne 0x3625f
lea eax, [rcx + 7]
jmp 0x3632c
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x3632c
cmp ecx, 2
jne 0x362b0
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x203a
jne 0x3628e
mov eax, 0xe
jmp 0x3632c
cmp ecx, 0x20d0
jne 0x362a0
mov eax, 0xf
jmp 0x3632c
mov edx, 0x11
cmp ecx, 0x23f0
cmove eax, edx
jmp 0x3632c
cmp ecx, 3
jne 0x3632a
cmp dword [rsp + 0x40], 0x2580
mov ecx, 0x14
cmove eax, ecx
jmp 0x3632c
cmp r11d, 0xa
jne 0x3632a
xor eax, eax
cmp dword [rsp + 0x48], eax
jne 0x3632a
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x295a
jne 0x362e7
lea eax, [r11 + 0x15]
jmp 0x3632c
cmp ecx, 0x2945
jne 0x362f6
mov eax, 0x1d
jmp 0x3632c
cmp ecx, 0x2933
jne 0x36305
mov eax, 0x1b
jmp 0x3632c
cmp ecx, 0x2924
jne 0x36314
mov eax, 0x19
jmp 0x3632c
add ecx, 0xffffd800
mov edx, 0x17
cmp ecx, 0x124
cmovbe eax, edx
jmp 0x3632c
xor eax, eax
add rsp, 0x38
ret
Function at 0x36338
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov qword [rax + 0x10], rsi
mov rbx, rsi
mov qword [rax - 0x48], rbx
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x36417
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea ebx, [rsi + 1]
mov r8d, ebx
lea edx, [rsi + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov r8d, ebx
lea edx, [rbx + 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
mov r8d, ebx
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
add rdx, 2
mov ecx, ebx
call fcn.00036578
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x363fa
movzx r8d, word [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov rcx, rax
call fcn.0003ad40
movzx r11d, word [rdi + 0x60]
shr r11w, 1
movzx ecx, r11w
mov word [rbx + rcx*2], si
jmp 0x36401
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x36434
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x36556
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x36536
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.00036578
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x3652b
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.0003ad40
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x3653d
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x36a0c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x36a4d
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x36a41
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x36a50
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x36a2c
xor r8d, r8d
test r8, r8
je 0x36a68
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x36a6a
mov eax, edx
mov rbx, qword [rsp + 8]
ret

Function at 0x36a78
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
movzx r11d, word [rcx + 6]
xor r9d, r9d
lea r8, [rax + rcx + 0x18]
mov rbx, rcx
test r11d, r11d
je 0x36ab7
mov r10d, dword [r8 + 0xc]
cmp edx, r10d
jb 0x36aab
mov eax, dword [r8 + 8]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x36aba
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x36a96
xor r8d, r8d
test r8, r8
je 0x36ad2
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x36ad4
mov eax, edx
mov rbx, qword [rsp + 8]
ret