joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003330c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x690044
mov dword [rsp + 0x34], 0x6b0073
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x14003348c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x63005c
mov dword [rbp + 0x13], 0x61006c
mov dword [rbp + 0x17], 0x730073
mov dword [rbp + 0x1b], 0x6e0070
mov dword [rbp + 0x1f], 0x2e0070
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x140033591
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140035084
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor ebx, ebx
mov rdi, rcx
mov eax, 0x730079
mov ecx, 0x790073
mov rsi, rdx
mov dword [rbp - 0x29], 0x53005c
lea r14d, [rbx + 1]
mov dword [rbp - 0x25], eax
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x11], ecx
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
test r8d, r8d
jne 0x14003514a
mov dword [rbp + 0xf], 0x66005c
mov dword [rbp + 0x13], 0x730061
mov dword [rbp + 0x17], 0x660074
mov dword [rbp + 0x1b], 0x740061
mov dword [rbp + 0x1f], 0x73002e
mov qword [rbp + 0x23], rax
jmp 0x140035196
cmp r8d, 2
jne 0x140035171
mov dword [rbp + 0xf], 0x6e005c
mov dword [rbp + 0x13], 0x660074
mov dword [rbp + 0x17], 0x2e0073
mov dword [rbp + 0x1b], ecx
mov dword [rbp + 0x1f], 0x73
jmp 0x140035196
cmp r8d, r14d
jne 0x140035196
mov dword [rbp + 0xf], 0x65005c
mov dword [rbp + 0x13], 0x660078
mov dword [rbp + 0x17], 0x740061
mov dword [rbp + 0x1b], 0x73002e
mov qword [rbp + 0x1f], rax
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x29]
mov r9b, r14b
call fcn.14002f234
test eax, eax
jne 0x1400351d7
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400362b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x3c], 0
mov rdi, rcx
mov ecx, 0x8fb
mov ebx, edx
mov dword [rsp + 0x28], 0x7355744e
mov dword [rsp + 0x2c], 0x65527265
mov dword [rsp + 0x30], 0x74736967
mov dword [rsp + 0x34], 0x6f487265
mov dword [rsp + 0x38], 0x79654b74
call fcn.140029ab4
test eax, eax
jne 0x140036342
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, rdi
call fcn.140005ac8
cmp al, 1
jne 0x140036342
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140036342
cmp eax, ebx
jae 0x140036342
mov edx, eax
mov ecx, 0x2e3
call fcn.140029bac
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140037404
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x380069
mov dword [rsp + 0x34], 0x340030
mov dword [rsp + 0x38], 0x700032
mov dword [rsp + 0x3c], 0x740072
call fcn.140078a80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x1400376c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x69005c
mov dword [rbp + 0x13], 0x300038
mov dword [rbp + 0x17], 0x320034
mov dword [rbp + 0x1b], 0x720070
mov dword [rbp + 0x1f], 0x2e0074
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x1400377c9
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140039094
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x14], 0
mov eax, 0x720065
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x44005c
mov dword [rbp - 0x3c], 0x690072
mov dword [rbp - 0x38], 0x650076
mov dword [rbp - 0x34], 0x5c0072
mov dword [rbp - 0x30], 0x700049
mov dword [rbp - 0x2c], 0x690046
mov dword [rbp - 0x28], 0x74006c
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], 0x720044
mov dword [rbp - 0x1c], 0x760069
mov dword [rbp - 0x18], eax
call fcn.140078a80
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x60
pop rbp
ret
Function at 0x140039478
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x69005c
mov dword [rbp + 0x13], 0x660070
mov dword [rbp + 0x17], 0x74006c
mov dword [rbp + 0x1b], 0x720064
mov dword [rbp + 0x1f], 0x2e0076
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x14003957d
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140039978
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x700049
mov dword [rsp + 0x34], 0x650073
mov dword [rsp + 0x38], 0x63
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret
Function at 0x14003cd74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x62004b
mov dword [rsp + 0x34], 0x430064
mov dword [rsp + 0x38], 0x61006c
mov dword [rsp + 0x3c], 0x730073
call fcn.140078a80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x14003cf40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x6b005c
mov dword [rbp + 0x13], 0x640062
mov dword [rbp + 0x17], 0x6c0063
mov dword [rbp + 0x1b], 0x730061
mov dword [rbp + 0x1f], 0x2e0073
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x14003d045
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14003d558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x6f006d
mov dword [rsp + 0x34], 0x430075
mov dword [rsp + 0x38], 0x61006c
mov dword [rsp + 0x3c], 0x730073
call fcn.140078a80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret
Function at 0x14003d808
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x6d005c
mov dword [rbp + 0x13], 0x75006f
mov dword [rbp + 0x17], 0x6c0063
mov dword [rbp + 0x1b], 0x730061
mov dword [rbp + 0x1f], 0x2e0073
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x14003d90d
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14003df34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x46005c
mov dword [rsp + 0x24], 0x6c0069
mov dword [rsp + 0x28], 0x530065
mov dword [rsp + 0x2c], 0x730079
mov dword [rsp + 0x30], 0x650074
mov dword [rsp + 0x34], 0x5c006d
mov dword [rsp + 0x38], 0x73004d
mov dword [rsp + 0x3c], 0x730066
call fcn.140078a80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret
Function at 0x14003edf4
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ecx, 0x61
xor r14b, r14b
call fcn.140029ab4
mov rbx, rax
test rax, rax
je 0x14003ee4f
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x41b0
call fcn.140029ab4
mov ecx, 0x20
mov rdi, rax
call fcn.140029ab4
mov ecx, 0x21
mov r15, rax
call fcn.140029ab4
mov ecx, 3
mov rsi, rax
call fcn.140029ab4
mov ecx, 2
mov r12, rax
call fcn.140029ab4
test edi, edi
je 0x14003ef7c
cmp edi, esi
jae 0x14003ef7c
test r15, r15
je 0x14003ef7c
test esi, esi
je 0x14003ef7c
test r12, r12
je 0x14003ef7c
test eax, eax
je 0x14003ef7c
mov edx, r15d
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov ecx, edi
lea r8d, [r9 + 2]
add rcx, r15
sub edx, ecx
add edx, esi
call fcn.14008a254
xor edi, edi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003ef7c
mov eax, dword [rbp + 0x80]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rcx
movzx edx, word [rax + 6]
mov eax, 0x545
cmp ax, dx
je 0x14003ef7c
mov eax, 0x512
cmp ax, dx
jne 0x14003ef61
cmp qword [rbp + 0x18], 0x40000
jne 0x14003ef61
mov eax, dword [rbp + 8]
test eax, eax
je 0x14003ef61
cmp qword [rbp - 0x20], 0x40
jne 0x14003ef61
cmp dword [rbp - 0x18], 1
jne 0x14003ef61
sub eax, r15d
add eax, ecx
je 0x14003ef61
cmp eax, esi
jb 0x14003ef6a
inc edi
cmp edi, 0x64
jae 0x14003ef7c
jmp 0x14003eef4
mov edx, eax
mov ecx, 0x5f
add rdx, r12
call fcn.140029bac
mov r14b, 1
test rbx, rbx
je 0x14003ef8d
lea rcx, [rbp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov al, r14b
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003efc0
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ecx, 0x61
call fcn.140029ab4
mov rbx, rax
test rax, rax
je 0x14003f018
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x43ab
call fcn.140029ab4
mov ecx, 0x20
mov rsi, rax
call fcn.140029ab4
mov ecx, 0x21
mov r14, rax
call fcn.140029ab4
mov ecx, 3
mov rdi, rax
call fcn.140029ab4
mov r15d, 2
mov ecx, r15d
mov r12, rax
call fcn.140029ab4
test esi, esi
je 0x14003f16f
cmp esi, edi
jae 0x14003f16f
test r14, r14
je 0x14003f16f
test edi, edi
je 0x14003f16f
test r12, r12
je 0x14003f16f
test eax, eax
je 0x14003f16f
mov edx, r14d
lea rax, [rsp + 0x40]
mov ecx, esi
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
add rcx, r14
xor r9d, r9d
sub edx, ecx
mov r8d, r15d
add edx, edi
call fcn.14008a254
xor r15b, r15b
xor esi, esi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003f16f
mov eax, dword [rbp + 0x80]
mov rcx, qword [rsp + 0x48]
mov r8d, 0x53c
add rcx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rcx
movzx edx, word [rax + 6]
movzx eax, dx
sub ax, r8w
cmp ax, 7
ja 0x14003f122
cmp qword [rbp + 0x18], 0x800000
jne 0x14003f122
cmp dword [rbp], 0x4ec4ec4f
jne 0x14003f122
mov r15b, 1
jmp 0x14003f151
mov eax, 0x512
cmp ax, dx
jne 0x14003f151
cmp qword [rbp + 0x18], 0x40000
jne 0x14003f151
cmp qword [rbp - 0x20], 0x40
jne 0x14003f151
cmp r15b, 1
jne 0x14003f151
mov eax, dword [rbp + 8]
sub eax, r14d
add eax, ecx
je 0x14003f151
cmp eax, edi
jb 0x14003f160
inc esi
cmp esi, 0x190
jae 0x14003f16f
jmp 0x14003f0c3
mov edx, eax
mov ecx, 0x338
add rdx, r12
call fcn.140029bac
test rbx, rbx
je 0x14003f180
lea rcx, [rbp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003f1b0
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ecx, 0x61
xor r14b, r14b
call fcn.140029ab4
mov rbx, rax
test rax, rax
je 0x14003f20b
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x42df
call fcn.140029ab4
mov ecx, 0x20
mov rdi, rax
call fcn.140029ab4
mov ecx, 0x21
mov r15, rax
call fcn.140029ab4
mov ecx, 3
mov rsi, rax
call fcn.140029ab4
mov ecx, 2
mov r12, rax
call fcn.140029ab4
test edi, edi
je 0x14003f331
cmp edi, esi
jae 0x14003f331
test r15, r15
je 0x14003f331
test esi, esi
je 0x14003f331
test r12, r12
je 0x14003f331
test eax, eax
je 0x14003f331
mov edx, r15d
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov ecx, edi
lea r8d, [r9 + 2]
add rcx, r15
sub edx, ecx
add edx, esi
call fcn.14008a254
xor edi, edi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003f331
mov eax, dword [rbp + 0x80]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rcx
movzx edx, word [rax + 6]
mov eax, 0x545
cmp ax, dx
je 0x14003f331
mov eax, 0x50e
cmp ax, dx
jne 0x14003f313
cmp qword [rbp - 0x20], 0x40000
jne 0x14003f313
cmp qword [rbp + 0x18], 0x40
jne 0x14003f313
mov eax, dword [rbp - 0x30]
sub eax, r15d
add eax, ecx
je 0x14003f313
cmp eax, esi
jb 0x14003f31f
inc edi
cmp edi, 0xc8
jae 0x14003f331
jmp 0x14003f2b0
mov edx, eax
mov ecx, 0x2bb
add rdx, r12
call fcn.140029bac
mov r14b, 1
test rbx, rbx
je 0x14003f342
lea rcx, [rbp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov al, r14b
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140040010
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ecx, 0x61
xor r14b, r14b
call fcn.140029ab4
mov rbx, rax
test rax, rax
je 0x14004006b
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x42fd
call fcn.140029ab4
mov ecx, 0x20
mov rdi, rax
call fcn.140029ab4
mov ecx, 0x21
mov r15, rax
call fcn.140029ab4
mov ecx, 3
mov rsi, rax
call fcn.140029ab4
mov ecx, 2
mov r12, rax
call fcn.140029ab4
test edi, edi
je 0x140040191
cmp edi, esi
jae 0x140040191
test r15, r15
je 0x140040191
test esi, esi
je 0x140040191
test r12, r12
je 0x140040191
test eax, eax
je 0x140040191
mov edx, r15d
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov ecx, edi
lea r8d, [r9 + 2]
add rcx, r15
sub edx, ecx
add edx, esi
call fcn.14008a254
xor edi, edi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x140040191
mov eax, dword [rbp + 0x80]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rcx
movzx edx, word [rax + 6]
mov eax, 0x545
cmp ax, dx
je 0x140040191
mov eax, 0x50e
cmp ax, dx
jne 0x140040173
cmp qword [rbp - 0x20], 0x40000
jne 0x140040173
cmp qword [rbp + 0x18], 0x40
jne 0x140040173
mov eax, dword [rbp - 0x30]
sub eax, r15d
add eax, ecx
je 0x140040173
cmp eax, esi
jb 0x14004017f
inc edi
cmp edi, 0xc8
jae 0x140040191
jmp 0x140040110
mov edx, eax
mov ecx, 0x2d0
add rdx, r12
call fcn.140029bac
mov r14b, 1
test rbx, rbx
je 0x1400401a2
lea rcx, [rbp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov al, r14b
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret