joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400043b0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea r9, [rax + 0x20]
and dword [rax + 0x20], ebx
mov rsi, r8
mov rdi, rdx
xor r8d, r8d
xor edx, edx
lea ecx, [rbx + 5]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000445c
mov ebp, 0x6864694e
test rbx, rbx
je 0x1400043fc
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x1400121d8]
mov edx, dword [rsp + 0x48]
test rax, rax
je 0x140004428
cmp dword [0x1400121d0], 0x4a61
jb 0x140004428
mov r8d, ebp
mov ecx, 0x100
call qword [0x1400102b0]
jmp 0x140004436
mov r8d, ebp
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140004467
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rax
mov ecx, 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400043ec
test eax, eax
js 0x140004483
test rbx, rbx
je 0x140004483
jmp 0x140004479
mov eax, 0xc000009a
jmp 0x140004483
cmp qword [rbx + 0x50], rdi
je 0x140004498
mov eax, dword [rbx]
add rbx, rax
cmp dword [rbx], 0
jne 0x14000446e
mov eax, 0xc0000225
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edi, edi
cmp dword [rbx + 4], edi
jbe 0x140004509
lea rcx, [rdi + rdi*4]
add rcx, rcx
mov rbp, qword [rbx + rcx*8 + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
cmp rbp, rax
je 0x140004502
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x140004502
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
mov rcx, qword [rsi]
test al, al
jne 0x1400044f8
mov eax, dword [rcx + 0x78]
test al, al
js 0x1400044f8
mov eax, dword [rcx + 0x74]
test al, 0x10
je 0x1400044f8
cmp qword [rcx + 0x58], 0
je 0x1400044f8
cmp qword [rcx + 0x2c8], 0
jne 0x140004509
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsi], 0
inc edi
cmp edi, dword [rbx + 4]
jb 0x14000449f
mov rax, qword [rsi]
neg rax
sbb eax, eax
not eax
and eax, 0xc0000225
jmp 0x140004483
Function at 0x1400048ec
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
xor edi, edi
mov rbx, rdx
test rdx, rdx
je 0x140004a2e
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140004a2e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140004a2e
movups xmm1, xmmword [rax + 0x28]
add rax, 0x18
lea rcx, [rsp + 0x20]
mov edx, 0x80
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
add rcx, rdx
movups xmm0, xmmword [rax + 0x70]
add rax, rdx
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
cmp dword [rsp + 0x90], edi
je 0x140004a2e
mov esi, dword [r11 - 0xa8]
mov ebp, edi
add rsi, rbx
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rbx
mov r13d, dword [rsi + 0x20]
add r15, rbx
add r13, rbx
cmp dword [rsi + 0x18], edi
jbe 0x140004a29
mov r12d, ebp
mov rdx, r8
mov ecx, dword [r13 + r12*4]
add rcx, rbx
call sub.ntoskrnl.exe__stricmp
test eax, eax
je 0x140004a1d
mov r8, qword [rsp + 0x150]
inc ebp
cmp ebp, dword [rsi + 0x18]
jb 0x1400049f5
jmp 0x140004a29
movzx eax, word [r15 + r12*2]
mov edi, dword [r14 + rax*4]
add rdi, rbx
mov rax, rdi
jmp 0x140004a30
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140004b08
Capabilities:
Check for software breakpoints
Get system information on windows
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1400121b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [0x14000ecb0]
and dword [rsp + 0x20], 0
lea r9, [r11 - 0x48]
xor ebx, ebx
mov r13, rcx
xor r8d, r8d
xor edx, edx
movdqu xmmword [rsp + 0x28], xmm0
lea edi, [rbx + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov esi, 0xc0000004
mov r12d, 0x6864694e
jmp 0x140004bd5
test rbx, rbx
je 0x140004b7b
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x1400121d8]
mov edx, dword [rsp + 0x20]
test rax, rax
je 0x140004ba7
cmp dword [0x1400121d0], 0x4a61
jb 0x140004ba7
mov r8d, r12d
mov ecx, 0x100
call qword [0x1400102b0]
jmp 0x140004bb5
mov r8d, r12d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140004c57
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, esi
je 0x140004b6a
test eax, eax
js 0x140004c2c
test rbx, rbx
je 0x140004c2c
mov r8d, dword [rbx]
xor edx, edx
test r8d, r8d
je 0x140004c19
lea rcx, [rbx + 0x20]
mov r9, qword [rcx - 8]
cmp qword [sym.imp.ntoskrnl.exe_NtCreateFile], r9
jb 0x140004c0b
mov eax, dword [rcx]
add rax, r9
cmp qword [sym.imp.ntoskrnl.exe_NtCreateFile], rax
jb 0x140004c5e
inc edx
add rcx, 0x128
cmp edx, r8d
jb 0x140004bf0
mov edi, 0xc0000225
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000e360
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 0xc000009a
jmp 0x140004c2c
mov eax, edx
imul rcx, rax, 0x128
mov rbp, qword [rcx + rbx + 0x18]
test rbp, rbp
je 0x140004c19
mov eax, 0x5a4d
mov edi, 0xc0000225
cmp word [rbp], ax
jne 0x140004d39
movsxd rax, dword [rbp + 0x3c]
cmp dword [rax + rbp], 0x4550
jne 0x140004d39
lea rsi, [rbp + 0x108]
add rsi, rax
movzx eax, word [rax + rbp + 6]
lea rcx, [rax + rax*4]
lea r15, [rsi + rcx*8]
jmp 0x140004d0d
lea rdx, [0x14000ecc0]
mov rcx, rsi
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x140004d09
mov r14d, dword [rsi + 0xc]
mov r10d, dword [rsi + 8]
add r14, rbp
je 0x140004d09
test r10d, r10d
je 0x140004d09
xor edx, edx
test r10d, r10d
je 0x140004d09
xor r8d, r8d
lea r9, [rsp + 0x28]
mov r11b, byte [r9]
cmp r11b, 0xcc
je 0x140004cf6
lea eax, [r8 + rdx]
cmp r11b, byte [rax + r14]
jne 0x140004d17
inc r8d
inc r9
cmp r8d, 0xf
jb 0x140004ce3
mov eax, edx
add rax, r14
jne 0x140004d20
add rsi, 0x28
cmp rsi, r15
jb 0x140004caf
jmp 0x140004c1e
inc edx
cmp edx, r10d
jb 0x140004cdb
jmp 0x140004d09
mov r8d, dword [rax + 3]
xor edi, edi
add r8, 7
add r8, rax
mov qword [r13 + 0x1030], r8
jmp 0x140004c1e
mov edi, 0xc0000141
jmp 0x140004c1e
Function at 0x140004d44
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400121b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
lea r8, [rbp - 0x48]
mov r15, rdx
mov qword [rbp - 0x50], rbx
mov r14, rcx
mov dword [rbp - 0x48], ebx
mov rcx, qword [0x1400121f8]
lea rdx, [0x14000ec50]
mov edi, ebx
mov sil, bl
call fcn.14000a13c
test eax, eax
js 0x140004ddf
mov ecx, dword [rbp - 0x48]
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140004ddf
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdx, qword [rbp - 0x50]
lea r8, [0x14000ec70]
mov rcx, r14
call fcn.140004a54
test rax, rax
jne 0x140004e01
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000e360
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8, r15
mov rdx, rax
mov rcx, r14
call fcn.1400048ec
mov rcx, rax
test rax, rax
je 0x140004dcb
mov al, byte [rax]
jmp 0x140004e28
inc edi
cmp al, 0xb8
jne 0x140004e25
mov sil, byte [rdi + rcx]
mov al, byte [rdi + rcx]
cmp al, 0xc3
jne 0x140004e1b
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test sil, sil
je 0x140004e54
mov rax, qword [r14 + 0x1030]
mov rcx, qword [rax]
movzx eax, sil
movsxd rbx, dword [rcx + rax*4]
sar rbx, 4
add rbx, rcx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
jmp 0x140004de1
Function at 0x1400058c4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov edi, dword [rdx + 4]
xor r15d, r15d
mov eax, dword [rdx + 8]
mov rbx, rdx
mov r14, rcx
mov dword [rbp + 0xb], r15d
mov ecx, edi
mov dword [rbp + 0x23], r15d
lea rdx, [rbp - 0x19]
mov qword [rbp + 0x77], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 0x19], r15
mov qword [rbp + 0x6f], r15
mov qword [rbp + 0x7f], rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140005a95
xorps xmm0, xmm0
mov dword [rbp + 7], 0x30
lea r9, [rbp - 9]
mov qword [rbp + 0xf], r15
lea r8, [rbp + 7]
mov dword [rbp + 0x1f], 0x200
mov edx, 0x1fffff
mov qword [rbp + 0x17], r15
lea rcx, [rbp + 0x77]
mov qword [rbp - 9], rdi
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rbp - 1], r15
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov esi, eax
test eax, eax
js 0x140005a44
mov rcx, qword [rbp + 0x77]
lea r9, [rbp + 0x7f]
mov dword [rsp + 0x28], 0x20
lea rdx, [rbp + 0x6f]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov esi, eax
test eax, eax
js 0x140005a44
mov eax, dword [rbx + 8]
mov rcx, r14
mov r9, qword [rbp + 0x6f]
mov r8, qword [rbp - 0x19]
mov rdx, qword [rbx + 0x10]
mov dword [rsp + 0x28], 1
mov qword [rbp + 0x7f], rax
mov qword [rsp + 0x20], rax
call fcn.140005bc8
mov esi, eax
test eax, eax
js 0x140005a44
mov qword [rsp + 0x50], r15
lea r8, [rbp + 7]
mov qword [rsp + 0x48], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov edx, 0x1fffff
mov qword [rbp + 0xf], r15
mov dword [rbp + 0x1f], 0x200
mov qword [rbp + 0x17], r15
mov rdi, qword gs:[0x188]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov bl, byte [rdi + 0x232]
mov byte [rdi + 0x232], r15b
mov rcx, qword [rbp + 0x6f]
mov rax, qword [r14 + 0x1038]
mov r9, qword [rbp + 0x77]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x11]
call qword [0x1400102b0]
mov esi, eax
mov byte [rdi + 0x232], bl
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140005a53
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test esi, esi
jns 0x140005a75
cmp qword [rbp + 0x6f], r15
je 0x140005a75
mov rcx, qword [rbp + 0x77]
lea r8, [rbp + 0x7f]
mov r9d, 0x4000
lea rdx, [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140005a84
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140005a93
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005d98
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400121b0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rdx + 0x20]
xor r15d, r15d
or rsi, 0xffffffffffffffff
mov qword [rbp - 0x31], r15
mov rbx, rsi
mov qword [rbp - 0x29], r15
mov rdi, rdx
mov r14, rcx
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140005dda
lea rbx, [rbx*2 + 2]
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x11]
call fcn.140002fe4
mov rdx, qword [rdi + 0x20]
lea rcx, [rbp - 0x11]
mov r8, rbx
call fcn.140003aa0
mov ebx, eax
test eax, eax
js 0x140005f0d
mov rax, qword [rdi + 0x20]
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x140005e1a
lea rbx, [rsi*2 + 2]
mov r8, rbx
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x21]
call fcn.140002fe4
mov rdx, qword [rdi + 0x18]
lea rcx, [rbp - 0x21]
mov r8, rbx
call fcn.140003aa0
mov ebx, eax
test eax, eax
js 0x140005ef9
mov ecx, dword [rdi]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140005ef9
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8, qword [rbp - 0x31]
mov rcx, r14
mov rdx, qword [rbp - 0x39]
call fcn.140004a54
test rax, rax
jne 0x140005e95
lea rcx, [rbp - 1]
jmp 0x140005eb0
mov r8, qword [rbp - 0x29]
mov rdx, rax
mov rcx, r14
call fcn.1400048ec
lea rcx, [rbp - 1]
mov rbx, rax
test rax, rax
jne 0x140005ec7
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ebx, 0xc0000001
jmp 0x140005ef9
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [rdi + 0x10]
mov r9, rbx
mov r8, qword [rbp - 0x39]
mov rcx, r14
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.140005bc8
mov rcx, qword [rbp - 0x39]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140005f0d
mov edx, 0x6864694e
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140005f21
mov edx, 0x6864694e
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14000e360
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009120
Capabilities:
Create device object
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rdi, rcx
call fcn.140006fec
test al, al
jne 0x140008e61
mov ebx, 0xc0000424
jmp 0x140008f0c
and qword [rbp + 0x77], 0
lea rax, [0x14000f820]
mov qword [rbp - 0x51], rax
lea r8, [rbp - 0x59]
lea rax, [0x14000f840]
mov dword [rbp - 0x59], 0x20001e
mov qword [rbp - 0x41], rax
mov r15d, 0x100
lea rax, [0x14000f880]
mov dword [rbp - 0x49], 0x180016
mov qword [rbp - 0x31], rax
mov r9d, 0x22
lea rax, [rbp + 0x77]
mov dword [rbp - 0x39], 0x160014
mov qword [rsp + 0x30], rax
xor edx, edx
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
jns 0x140008ee0
mov edx, eax
lea rcx, [0x14000f8a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140008f0c
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x140008f16
mov edx, eax
lea rcx, [0x14000f8d0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
call fcn.140006f18
jmp 0x14000904f
cmp byte [section..data], 0
jne 0x140009002
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rdx, [0x140012208]
and qword [rbp + 0x1f], 0
mov ecx, 3
and qword [rbp + 0x3f], 0
and qword [rbp - 0x11], 0
mov qword [rbp + 7], rax
lea rax, [0x14000a740]
mov qword [rbp + 0x17], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rbp + 0x27], rax
lea rax, [0x14000a7b0]
mov qword [rbp + 0x37], rax
lea rax, [0x14000f860]
mov qword [rbp - 0x19], rax
lea rax, [rbp + 7]
mov dword [rbp + 0xf], ecx
mov dword [rbp + 0x2f], ecx
lea rcx, [rbp - 0x29]
mov qword [rbp - 9], rax
mov dword [rbp - 0x29], 0x20100
mov dword [rbp - 0x21], 0x160014
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
test eax, eax
jns 0x140008fb5
mov edx, eax
lea rcx, [0x14000f910]
call sub.ntoskrnl.exe_DbgPrint
and word [0x140012006], 0
mov rax, qword [0x140012210]
lea rdx, [rbp - 0x39]
and qword [rsp + 0x28], 0
lea rcx, [0x14000bde0]
add rax, 0x3098
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
mov ebx, eax
test eax, eax
jns 0x140009013
mov edx, eax
lea rcx, [0x14000f950]
call sub.ntoskrnl.exe_DbgPrint
xor ebx, ebx
mov byte [0x140012005], bl
jmp 0x140009013
mov rax, qword [rbp + 0x77]
or dword [rax + 0x30], 4
mov rax, qword [rbp + 0x77]
btr dword [rax + 0x30], 7
lea rax, [0x140009070]
mov qword [rdi + 0x68], rax
lea rax, [0x140007340]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x70], rax
lea rax, [0x140007360]
mov qword [rdi + 0xe0], rax
call fcn.140001190
lea rcx, [0x14000f990]
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
jmp 0x140008e2c
Function at 0x14000a078
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, edx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ecx, dword [0x1400121d0]
sub ecx, 0x2800
je 0x14000a0e8
sub ecx, 0x15a
je 0x14000a0e8
sub ecx, 0xedf
je 0x14000a0e8
sub ecx, 0x29e
je 0x14000a0e8
sub ecx, 0x4d4
je 0x14000a0e8
sub ecx, 0x343
je 0x14000a0e8
sub ecx, 0x275
je 0x14000a0e8
sub ecx, 0x257
je 0x14000a0e1
cmp ecx, 1
je 0x14000a0e1
mov ebx, 0x4b8
jmp 0x14000a0ed
mov ebx, 0x360
jmp 0x14000a0ed
mov ebx, 0x358
test eax, eax
js 0x14000a131
lea rdx, [rsp + 0x48]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000a124
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbx + rax]
mov rax, qword [rsp + 0x40]
mov qword [rbx + rax], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a13c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, r8
mov dword [rax + 0x18], r15d
mov rbp, rdx
mov ebx, r15d
test r8, r8
je 0x14000a25b
test rdx, rdx
je 0x14000a25b
xor edx, edx
lea r9, [rax + 0x18]
xor r8d, r8d
lea edi, [rdx + 5]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov r12d, 0x6864694e
jmp 0x14000a1f7
test rbx, rbx
je 0x14000a1a1
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x1400121d8]
mov edx, dword [rsp + 0x60]
test rax, rax
je 0x14000a1cd
cmp dword [0x1400121d0], 0x4a61
jb 0x14000a1cd
mov r8d, r12d
mov ecx, 0x100
call qword [0x1400102b0]
jmp 0x14000a1db
mov r8d, r12d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000a200
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov esi, eax
cmp eax, 0xc0000004
je 0x14000a190
test esi, esi
js 0x14000a24f
test rbx, rbx
je 0x14000a254
mov rdi, rbx
cmp dword [rbx], r15d
je 0x14000a237
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x14000a22d
cmp word [rdi + 0x38], r15w
jbe 0x14000a22d
mov rdx, rbp
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14000a247
mov eax, dword [rdi]
add rdi, rax
cmp dword [rdi], r15d
jne 0x14000a211
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x14000a260
mov eax, dword [rdi + 0x50]
mov dword [r14], eax
jmp 0x14000a237
test rbx, rbx
jne 0x14000a237
mov esi, 0xc000009a
jmp 0x14000a243
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000a498
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, dword [0x1400121d0]
mov r14, rcx
mov ebp, edx
mov r8d, eax
mov edx, 0x257
mov ecx, 0x15a
mov edi, 0x4d4
mov esi, 0x343
mov r9d, 0xedf
lea r10d, [rdx + 0x47]
lea r11d, [rdx + 0x1e]
sub r8d, 0x2800
je 0x14000a51a
sub r8d, ecx
je 0x14000a51a
sub r8d, r9d
je 0x14000a51a
sub r8d, r10d
je 0x14000a513
sub r8d, edi
je 0x14000a513
sub r8d, esi
je 0x14000a513
sub r8d, r11d
je 0x14000a513
sub r8d, edx
je 0x14000a51a
cmp r8d, 1
je 0x14000a51a
mov ebx, 0x448
jmp 0x14000a51f
mov ebx, 0x2e8
jmp 0x14000a51f
mov ebx, 0x2f0
sub eax, 0x2800
je 0x14000a558
sub eax, ecx
je 0x14000a558
sub eax, r9d
je 0x14000a558
sub eax, r10d
je 0x14000a558
sub eax, edi
je 0x14000a558
sub eax, esi
je 0x14000a558
sub eax, r11d
je 0x14000a558
sub eax, edx
je 0x14000a551
cmp eax, 1
je 0x14000a551
mov esi, 0x438
jmp 0x14000a55d
mov esi, 0x2e0
jmp 0x14000a55d
mov esi, 0x2d8
mov rcx, rbp
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000a5cc
add rsi, qword [rsp + 0x50]
xor edx, edx
add rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov r8d, ebp
mov rdx, rbx
mov rcx, r14
call fcn.140009cb8
test al, al
jne 0x14000a59f
mov edi, 0xc0000001
jmp 0x14000a5b4
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rdx], rax
mov qword [rax + 8], rdx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14000aa2c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [rdx]
mov rdi, rdx
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000aa8e
call fcn.14000af24
mov edx, eax
mov al, byte [rdi + 4]
add rdx, qword [rsp + 0x38]
shl al, 4
or al, byte [rdi + 5]
mov byte [rdx], al
mov al, byte [rdx + 2]
mov cl, al
xor cl, byte [rdi + 4]
and cl, 7
xor cl, al
mov byte [rdx + 2], cl
and cl, 0xf
mov al, byte [rdi + 5]
shl al, 4
or al, cl
mov byte [rdx + 2], al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret