joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400094ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140043018]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140009530
movzx eax, r14w
jmp 0x140009665
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000956c
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000956c
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140009665
cmp qword [rcx + 0x80], r14
je 0x140009662
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400095aa
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400095d3
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140014a3c
cmp ax, di
je 0x140009662
movzx edi, si
jmp 0x140009662
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x14002f2e0]
test eax, eax
je 0x140009628
sub eax, 1
je 0x140009628
cmp eax, 2
jne 0x140009662
movzx ecx, word [rbp + 7]
jmp 0x1400095b6
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140009652
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140013fd0
cmp r14, rax
jne 0x140009662
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
cmovne di, si
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000aa70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14000b624
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b66e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b66e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b66e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b66e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b66e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b670
xor al, al
add rsp, 0x28
ret

Function at 0x14001946c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019298
Function at 0x1400216ec
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140021412
call fcn.140012e04
mov dword [rax], 0x16
call fcn.140012cb4
jmp 0x14002155d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002155d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002155d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140021441
lock or dword [rcx + 0x14], 0x10
jmp 0x14002155d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140021455
call fcn.140022c08
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140021465
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140021468
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14001d714
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400224f8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14002154b
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400214f9
mov rcx, rbx
call fcn.14001d714
cmp eax, 0xffffffff
je 0x1400214e4
mov rcx, rbx
call fcn.14001d714
cmp eax, 0xfffffffe
je 0x1400214e4
mov rcx, rbx
call fcn.14001d714
movsxd rdi, eax
lea r14, [0x140045570]
mov rcx, rbx
sar rdi, 6
call fcn.14001d714
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400214eb
lea rdx, [0x1400433c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400214f9
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14002151d
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14002151d
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14002151d
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14002153b
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140021546
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140021562
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400213dc
Function at 0x140002160
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and qword [rax - 0x58], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
mov dword [rax - 0x60], 0x100
xorps xmm0, xmm0
and qword [rax - 0x68], 0
mov ebx, 0x110000
and dword [rax - 0x70], 0
mov edx, ebx
and dword [rax - 0x78], 0
and qword [rax - 0x80], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov qword [rbp + 0x37], rcx
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
test eax, eax
js 0x140002280
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x6f]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x67]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov r8, qword [r8]
mov dword [rsp + 0x20], 0x656c6946
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
xor edx, edx
mov edi, eax
test eax, eax
jns 0x14000223f
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
jmp 0x14000227e
mov rax, qword [rbp + 0x6f]
mov rcx, qword [rax + 0x28]
and qword [rcx + 0x10], 0
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
mov rcx, qword [rbp + 0x6f]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x67]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
test bl, bl
je 0x14000227e
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov edi, eax
test eax, eax
jns 0x140002280
mov eax, edi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140002640
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x60
and qword [rax + 8], 0
lea rdx, [0x140004100]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rax - 0x18], xmm0
mov rbx, rcx
movups xmmword [rax - 0x28], xmm1
mov rax, qword [rcx + 0x28]
or dword [rax + 0x68], 0x20
lea rax, [0x1400022a0]
mov qword [rcx + 0x70], rax
lea rax, [0x1400022a0]
mov qword [rcx + 0x80], rax
lea rax, [0x1400022c0]
mov qword [rcx + 0xe0], rax
lea rax, [0x140002760]
mov qword [rcx + 0x68], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x70]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x140002755
lea rdx, [0x140003fe0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x140002713
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, edi
jmp 0x140002755
lea rdx, [0x14000a7f0]
lea rcx, [0x14000a7e0]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov rcx, rbx
call fcn.140001c24
test eax, eax
js 0x140002755
mov rcx, rbx
call fcn.140001d8c
test eax, eax
js 0x140002755
mov rcx, qword [rbx + 0x28]
add rcx, 0x48
mov qword [0x1400098a8], rcx
call fcn.140002160
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140002798
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rbx, rcx
mov dword [rsp + 0x28], 0x40
or rsi, 0xffffffffffffffff
mov dword [rbp - 0x19], 0x28ec8348
xor edi, edi
mov dword [rbp - 0x15], 0xb9
mov rcx, rsi
mov qword [rbp - 0x11], 0xba4800
lea r9, [rbp - 0x29]
mov dword [rbp - 9], 0x49000000
xor r8d, r8d
mov qword [rbp - 5], 0xb8
lea rdx, [rbp + 0x6f]
mov qword [rbp + 3], 0xb94900
mov dword [rbp + 0xb], 0x48000000
mov qword [rbp + 0xf], 0xb8
mov dword [rbp + 0x17], 0x48d0ff00
mov qword [rbp + 0x1b], 0xba
mov dword [rbp + 0x23], 0x7e02c700
mov dword [rbp + 0x27], 0x48c0371e
mov qword [rbp + 0x2b], 0xba
mov dword [rbp + 0x33], 0x2894800
mov dword [rbp + 0x37], 0x28c48348
mov qword [rbp + 0x6f], rdi
mov qword [rbp - 0x29], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140002970
mov rcx, qword [rbp + 0x6f]
lea r9, [rbp + 0x7f]
movaps xmm0, xmmword [rbp - 0x19]
lea rdx, [rbp + 0x77]
movaps xmm1, xmmword [rbp - 9]
xor r8d, r8d
mov eax, dword [rbp + 0x37]
movups xmmword [rcx], xmm0
mov dword [rsp + 0x28], 0x40
movaps xmm0, xmmword [rbp + 7]
movups xmmword [rcx + 0x10], xmm1
mov dword [rsp + 0x20], 0x1000
movaps xmm1, xmmword [rbp + 0x17]
movups xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [rbp + 0x27]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov dword [rcx + 0x50], eax
mov byte [rcx + 0x54], 0xc3
mov rcx, rsi
mov qword [rbp + 0x77], rdi
mov qword [rbp + 0x7f], 0x2090
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140002959
mov rcx, qword [rbp + 0x77]
lea rdx, [0x140007780]
mov r8d, 0x2090
call fcn.1400039c0
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x77]
mov qword [rcx + 0x5f8], rax
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x7f]
mov qword [rcx + 0x600], rax
mov rax, qword [rbp + 0x6f]
mov dword [rax + 5], edi
mov rax, qword [rbp + 0x6f]
mov qword [rax + 0xb], rbx
mov rax, qword [rbp + 0x6f]
mov dword [rax + 0x15], 1
mov rcx, qword [rbp + 0x6f]
lea rax, [rcx + 0x5f4]
mov qword [rcx + 0x1f], rax
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx + 0x5f8]
mov qword [rcx + 0x29], rax
mov rcx, qword [rbp + 0x6f]
lea rax, [rcx + 0x5f0]
mov qword [rcx + 0x35], rax
mov rcx, qword [rbp + 0x6f]
lea rax, [rcx + 0x5e8]
mov qword [rcx + 0x45], rax
mov rax, qword [rbp + 0x6f]
jmp 0x140002972
mov r9d, 0x8000
lea r8, [rbp - 0x29]
lea rdx, [rbp + 0x6f]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
xor eax, eax
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002988
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov dword [rsp + 0x28], 0x40
xor edi, edi
mov dword [rbp - 0x38], 0x68
or rsi, 0xffffffffffffffff
mov dword [rbp - 0x34], 0x6800
mov rcx, rsi
mov dword [rbp - 0x30], 0x680000
lea r9, [rbp - 0x40]
mov qword [rbp - 0x2c], 0x68000000
xor r8d, r8d
mov dword [rbp - 0x24], 0xe8
lea rdx, [rbp + 0x28]
mov dword [rbp - 0x20], 0x10c48300
mov dword [rbp - 0x1c], 0xba
mov dword [rbp - 0x18], 0x7e02c700
mov dword [rbp - 0x14], 0xbac0371e
mov dword [rbp - 0x10], edi
mov word [rbp - 0xc], 0x289
mov qword [rbp + 0x28], rdi
mov qword [rbp - 0x40], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140002b2a
mov rcx, qword [rbp + 0x28]
lea r9, [rbp + 0x38]
movups xmm0, xmmword [rbp - 0x38]
mov eax, edi
mov dword [rsp + 0x28], 0x40
movups xmm1, xmmword [rbp - 0x28]
xor r8d, r8d
lea rdx, [rbp + 0x30]
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], 0x1000
movsd xmm0, qword [rbp - 0x18]
movups xmmword [rcx + 0x10], xmm1
movsd qword [rcx + 0x20], xmm0
mov dword [rcx + 0x28], eax
movzx eax, word [rbp - 0xc]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0xc3
mov rcx, rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 0x1780
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140002b13
mov rcx, qword [rbp + 0x30]
lea rdx, section..data
mov r8d, 0x1780
call fcn.1400039c0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
mov qword [rcx + 0x5f8], rax
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x600], rax
mov rcx, qword [rbp + 0x28]
lea eax, [rcx + 0x5f4]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 0x28]
mov dword [rax + 6], 1
mov rax, qword [rbp + 0x28]
mov dword [rax + 0xb], ebx
mov rax, qword [rbp + 0x28]
mov dword [rax + 0x10], edi
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + 0x5f8]
sub eax, ecx
sub eax, 0x19
mov dword [rcx + 0x15], eax
mov rcx, qword [rbp + 0x28]
lea eax, [rcx + 0x5f0]
mov dword [rcx + 0x1d], eax
mov rcx, qword [rbp + 0x28]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x28], eax
mov rax, qword [rbp + 0x28]
jmp 0x140002b2c
mov r9d, 0x8000
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002b3c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rbx, qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
xor edi, edi
lea rsi, [rbx + 0x14]
cmp rbx, rsi
jae 0x140002b97
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002b8b
cmp byte [rbx], 0x80
jne 0x140002b8b
lea rcx, [rbx + 5]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002b8b
cmp byte [rbx + 5], 0xc3
je 0x140002b90
inc rbx
jmp 0x140002b60
mov edi, dword [rbx + 1]
test edi, edi
jne 0x140002bd8
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.140003c80
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
jne 0x140002bd8
cmp dword [rsp + 0x24], 6
jne 0x140002bd3
cmp dword [rsp + 0x28], 1
mov edi, 0x1f6
je 0x140002bd8
mov edi, 0x232
lea r11, [rsp + 0x140]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002e68
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x70
mov rdi, r8
and qword [rax + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
and qword [rax - 0x40], 0
mov ecx, ecx
lea rdx, [rax + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002ec0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140002ec0
mov eax, 0xc0000001
jmp 0x140002f50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ebx, eax
mov dword [rsp + 0x30], eax
mov r8, qword [rsp + 0x88]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.140003c80
mov rcx, qword [rsp + 0x38]
mov qword [rdi], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140002f40
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x140003064
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and qword [rbp + 0x28], 0
xorps xmm0, xmm0
mov ecx, ecx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400030b2
lea rcx, [0x1400040d0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x1400030f0
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9d, 0x8000
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x18]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
lea rcx, [rbp - 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400030fc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ecx, ecx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x140003142
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003142
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000313b
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000001
jmp 0x140003161
mov rcx, qword [rsp + 0x40]
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov rcx, qword [rsp + 0x40]
mov qword [rdi], rax
test rcx, rcx
je 0x14000315f
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000316c
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
xorps xmm0, xmm0
mov ecx, ecx
mov r14, rdx
xor ebx, ebx
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], rbx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400031be
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400031be
xor eax, eax
jmp 0x1400032a4
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
mov rdi, rsi
mov r8d, dword [rdi + 0x30]
lea r9, [rdi + 0x48]
mov rdx, qword [rdi + 0x20]
lea rcx, [0x1400041b0]
call sub.ntoskrnl.exe_DbgPrint
xorps xmm0, xmm0
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
mov rdx, qword [rdi + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140003289
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400031e1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, dword [rax + 0xc]
mov esi, dword [rcx + 0x14]
mov edi, esi
mov edx, dword [rdi + 0x10]
lea r9, [rdi + 0x24]
mov r8d, dword [rdi + 0x18]
lea rcx, [0x1400041b0]
call sub.ntoskrnl.exe_DbgPrint
xorps xmm0, xmm0
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
mov edx, dword [rdi + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140003284
mov edi, dword [rdi]
cmp rdi, rsi
je 0x14000328d
jmp 0x14000323c
mov ebx, dword [rdi + 0x10]
jmp 0x14000328d
mov rbx, qword [rdi + 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400032bc
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xorps xmm0, xmm0
mov ecx, ecx
mov r12, rdx
xor edi, edi
lea rdx, [rbp + 0x48]
mov qword [rbp + 0x48], rdi
movups xmmword [rbp - 0x30], xmm0
mov r15, r8
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r14d, eax
test eax, eax
jns 0x14000331d
lea rcx, [0x1400040d0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140003404
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp - 0x30]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp + 0x48]
test rbx, rbx
je 0x140003396
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rsi, rax
mov ecx, dword [rax + 0xc]
add rcx, 0xc
mov ebx, dword [rcx]
cmp rbx, rcx
je 0x1400033ea
mov ecx, dword [rbx + 0x30]
test ecx, ecx
je 0x140003383
mov edx, ecx
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140003391
mov eax, dword [rsi + 0xc]
mov ebx, dword [rbx]
add rax, 0xc
cmp rbx, rax
jmp 0x140003356
mov edi, dword [rbx + 0x18]
jmp 0x1400033ea
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rsi, rax
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x1400033ea
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x1400033d6
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rcx, [rbp - 0x40]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x1400033e6
mov rax, qword [rsi + 0x18]
mov rbx, qword [rbx]
add rax, 0x10
cmp rbx, rax
jmp 0x1400033ad
mov rdi, qword [rbx + 0x30]
lea rcx, [rbp - 0x30]
mov qword [r15], rdi
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, r14d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret