joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2070c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor ebx, ebx
mov r13d, edx
mov rbp, rcx
mov dil, bl
mov byte [rsp + 0x78], bl
cmp r9w, bx
jne 0x20790
add rcx, 0x228
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdi, qword [rsp + 0x80]
mov rcx, rdi
mov r14b, al
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x20788
lea rcx, [rbp + 0x340]
mov rdx, r13
mov r8, rdi
call fcn.00012b0c
cmp eax, ebx
jl 0x20788
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
lea esi, [rbx + 1]
movzx edx, bl
cmp al, bl
cmovne edx, esi
mov bl, dl
mov dl, r14b
jmp 0x208a0
mov esi, 1
cmp r9w, si
jne 0x208ad
mov rax, qword [0x00065ef8]
mov r12d, 0x104
cmp rax, rbx
jne 0x207c3
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x00065ef8], rax
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
jne 0x207d8
mov al, sil
jmp 0x208af
mov r8, r12
mov r12, qword [0x00065ef8]
xor edx, edx
mov rcx, r12
call fcn.00028240
cmp r13d, ebx
je 0x2081d
lea rax, [rsp + 0x78]
mov r8d, 0xd05
mov r9, r12
mov edx, r13d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.000208cc
mov dil, byte [rsp + 0x78]
mov r12, qword [0x00065ef8]
jmp 0x2081f
mov al, bl
cmp al, bl
je 0x207d0
cmp dil, 3
jne 0x207d0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
mov rdx, r12
not rcx
sub rcx, rsi
mov r8, rcx
lea rcx, [0x0002a590]
call fcn.000140f0
lea rcx, [rbp + 0x228]
mov r14d, eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdi, qword [rsp + 0x80]
mov rcx, rdi
mov r13b, al
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x2089d
lea rcx, [rbp + 0x340]
mov rdx, r14
mov r8, rdi
call fcn.00012b0c
cmp eax, ebx
jl 0x2089d
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx edx, bl
cmp al, bl
cmovne edx, esi
mov bl, dl
mov dl, r13b
lea rcx, [rbp + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x20ddc
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
or rcx, 0xffffffffffffffff
xor r8d, r8d
mov qword [rax - 0x40], r8
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov r13, rdx
mov dword [rsp + 0x24], r8d
not rcx
mov ebx, 0xc0000001
lea rdx, [rcx - 2]
movsxd rax, edx
cmp rax, r8
mov rcx, rax
jl 0x20e41
cmp byte [rcx + r13], 0x2e
je 0x20e58
dec eax
sub rcx, 1
jns 0x20e32
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp eax, r8d
je 0x20e41
cmp eax, edx
je 0x20e41
movsxd r12, eax
mov rsi, r8
cmp r12, r8
jle 0x20e41
mov ebp, 1
cmp byte [rsi + r13], 0x2e
jne 0x20f14
or rcx, 0xffffffffffffffff
xor eax, eax
movsxd rdx, ebp
add rdx, r13
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x0002a590]
call fcn.000140f0
lea rcx, [r14 + 0x220]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rcx, [rsp + 0x28]
mov r15b, al
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x20ec8
mov ebx, 0xc000000d
jmp 0x20ef7
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x28]
mov rdx, rdi
add rcx, 0x240
call fcn.00012b0c
mov ebx, eax
test eax, eax
js 0x20ef7
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x20ef7
mov eax, dword [rdx]
mov dword [rsp + 0x24], eax
lea rcx, [r14 + 0x220]
mov dl, r15b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xor r8d, r8d
cmp ebx, r8d
jge 0x20f2b
mov r14, qword [rsp + 0x70]
inc rsi
inc ebp
cmp rsi, r12
jl 0x20e71
cmp ebx, r8d
jl 0x20e41
xor eax, eax
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], r8d
mov rdi, r13
mov byte [rsp + 0x20], r8b
mov byte [rsp + 0x21], r8b
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x80]
mov eax, 0x100
mov word [rdi + 4], ax
mov word [rdi + 6], ax
not rcx
and ecx, ecx
mov word [rdi + 8], r8w
mov word [rdi + 0xa], r8w
mov word [rcx + rdi + 0xc], ax
mov word [rcx + rdi + 0xe], ax
mov eax, 0xcc0
mov word [rcx + rdi + 0x10], ax
movzx eax, word [rcx + rdi + 0xc]
mov byte [rsp + 0x22], 1
mov word [rcx + rdi + 0x12], ax
movzx eax, word [rcx + rdi + 0xe]
mov byte [rsp + 0x23], 0x90
mov word [rcx + rdi + 0x14], ax
mov eax, dword [rsp + 0x20]
mov dword [rcx + rdi + 0x16], eax
mov eax, 0x400
mov word [rcx + rdi + 0x1a], ax
mov eax, dword [rsp + 0x24]
mov dword [rcx + rdi + 0x1c], eax
lea eax, [rcx + 0x20]
mov rcx, qword [rsp + 0x88]
mov dword [rcx], eax
xor eax, eax
jmp 0x20e43
Function at 0x210cc
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
and qword [rax + 8], 0
mov r12, qword [0x00065e78]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r15d, r8d
repne scasb al, byte [rdi]
mov r14d, r9d
mov rsi, rdx
not rcx
lea r8, [rcx - 1]
lea rcx, [0x0002a590]
call fcn.000140f0
lea rcx, [r12 + 0x228]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rcx, [rsp + 0x60]
mov r13b, al
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x21148
mov edi, 0xc000000d
jmp 0x2115f
lea rcx, [r12 + 0x340]
lea r8, [rsp + 0x60]
mov rdx, rbx
call fcn.00012b0c
mov edi, eax
lea rcx, [r12 + 0x228]
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test edi, edi
js 0x2117b
xor eax, eax
jmp 0x21280
mov edi, 0x110
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x2119f
mov eax, 0xc0000001
jmp 0x21280
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00028240
mov rcx, rsi
call fcn.0001684c
test al, al
jne 0x21203
xor eax, eax
or r13, 0xffffffffffffffff
mov rdi, rsi
mov rcx, r13
mov r9d, 0xd05
mov rdx, rsi
repne scasb al, byte [rdi]
mov byte [rsp + 0x20], 3
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call fcn.000213e8
xor eax, eax
mov rcx, r13
mov rdi, rsi
mov rdx, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rsp + 0x60]
call fcn.000283d0
jmp 0x21218
mov rcx, rsi
call fcn.00011074
mov ebx, eax
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x104], ebx
mov rax, qword [rsp + 0x60]
lea rcx, [r12 + 0x228]
mov dword [rax + 0x108], r15d
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x10c], r14d
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [rsp + 0x60]
lea rcx, [r12 + 0x340]
mov edx, ebx
mov dil, al
call fcn.000128ec
lea rcx, [r12 + 0x228]
mov dl, dil
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test ebx, ebx
jns 0x2127e
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x2127e
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x212a4
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
and qword [rax + 8], 0
mov rbp, qword [0x00065e78]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r14d, r8d
repne scasb al, byte [rdi]
mov r12, rdx
not rcx
lea r13, [rcx - 1]
lea r8d, [rcx - 1]
lea rcx, [0x0002a590]
call fcn.000140f0
lea rcx, [rbp + 0x220]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rcx, [rsp + 0x50]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x2131a
mov edi, 0xc000000d
jmp 0x21330
lea rcx, [rbp + 0x240]
lea r8, [rsp + 0x50]
mov rdx, rdi
call fcn.00012b0c
mov edi, eax
lea rcx, [rbp + 0x220]
mov dl, bl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test edi, edi
js 0x2134a
xor eax, eax
jmp 0x213cb
mov edx, 4
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x21368
mov eax, 0xc0000001
jmp 0x213cb
lea rcx, [0x0002a590]
mov r8d, r13d
mov rdx, r12
mov dword [rax], r14d
call fcn.000140f0
lea rcx, [rbp + 0x220]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [rsp + 0x50]
lea rcx, [rbp + 0x240]
mov rdx, rdi
mov bl, al
call fcn.000128ec
lea rcx, [rbp + 0x220]
mov dl, bl
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test edi, edi
jns 0x213c9
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x213c9
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x21f58
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r14, qword [0x00065e98]
mov esi, r8d
mov rbp, rdx
mov r12d, 0xc0000001
test rdx, rdx
je 0x2218b
test r8d, r8d
je 0x2218b
test sil, 7
jne 0x2218b
lea rcx, [r14 + 0x18]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, qword [r14 + 8]
xor edx, edx
mov r8d, 0xe100
mov bl, al
call fcn.00028240
lea rcx, [r14 + 0x18]
mov dl, bl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rdx, [0x00029400]
mov r8d, esi
mov rcx, rbp
call fcn.00013174
lea rdi, [rbp + rsi]
lea rbx, [rbp + 4]
cmp rbx, rdi
jae 0x220ea
mov dl, 0x23
cmp byte [rbp], dl
jne 0x220ea
cmp byte [rbp + 1], dl
jne 0x220ea
movzx r11d, word [rbp + 2]
add rbx, r11
cmp rbx, rdi
jae 0x220ea
lea rsi, [rbx + 4]
mov rax, rsi
cmp rsi, rdi
jae 0x220ea
cmp byte [rbx], dl
jne 0x220ea
cmp byte [rbx + 1], dl
jne 0x220ea
movzx r10d, word [rbx + 2]
add rax, r10
cmp rax, rdi
jae 0x220ea
lea r9, [rax + 4]
mov rcx, r9
cmp r9, rdi
jae 0x220ea
cmp byte [rax], dl
jne 0x220ea
cmp byte [rax + 1], dl
jne 0x220ea
movzx r8d, word [rax + 2]
add rcx, r8
cmp rcx, rdi
jae 0x220ea
lea rbx, [rcx + 4]
mov r13, rbx
cmp rbx, rdi
jae 0x220ea
cmp byte [rcx], dl
jne 0x220ea
cmp byte [rcx + 1], dl
jne 0x220ea
movzx edx, word [rcx + 2]
add rbx, rdx
cmp rbx, rdi
jae 0x220ea
mov rax, rbx
add rbx, 2
cmp rbx, rdi
ja 0x220ea
cmp byte [rax], 0xd
jne 0x220ea
cmp byte [rax + 1], 0xa
jne 0x220ea
mov ecx, r8d
mov eax, edx
lea rdx, [rbp + 4]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r9
mov r8d, r11d
mov rcx, r14
mov r9, rsi
mov dword [rsp + 0x20], r10d
call fcn.000221b0
mov rbp, rbx
add rbx, 4
xor r12d, r12d
mov dl, 0x23
cmp rbx, rdi
jb 0x21fec
test r12d, r12d
js 0x2218b
and dword [rsp + 0x88], 0
xor edx, edx
lea r9, [rsp + 0x88]
lea ebx, [rdx + 5]
xor r8d, r8d
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x2218b
mov edx, dword [rsp + 0x88]
mov esi, 0x636f7270
lea ecx, [rbx - 4]
mov r8d, esi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x2218b
mov r8d, dword [rsp + 0x88]
lea r9, [rsp + 0x88]
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x22180
cmp dword [rdi], 0
mov rbx, rdi
je 0x22180
mov eax, dword [rbx]
add rbx, rax
cmp dword [rbx + 0x50], 0x64
jbe 0x2217b
mov rdx, qword [rbx + 0x50]
xor r8d, r8d
mov rcx, r14
call fcn.000236ec
cmp dword [rbx], 0
jne 0x22161
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x50]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x22714
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r13d, r9d
mov r14, r8
mov rdi, rdx
mov r15, rcx
xor r12b, r12b
mov byte [rax - 0x78], r12b
and qword [rax - 0x48], 0
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [rax - 0x40]
call fcn.00028240
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
mov esi, 1
xor edx, edx
test r13d, r13d
je 0x22927
lea rax, [r14 + 0x11c]
cmp dword [rax], esi
je 0x22790
add edx, esi
add rax, 0x120
cmp edx, r13d
jb 0x2277a
jmp 0x22927
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x22902
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [0x0002a118]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10000000
xor r8d, r8d
mov edx, 0x240
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
js 0x22902
lea rdx, [0x00029410]
lea rcx, [rsp + 0x60]
call qword [fcn.004e696c]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
je 0x22902
mov rcx, qword [rsp + 0x48]
call rax
mov rdi, rax
test rax, rax
jne 0x2284e
lea rdx, [0x00029450]
lea rcx, [rsp + 0x60]
call qword [fcn.004e696c]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
je 0x2284e
mov rcx, qword [rsp + 0x48]
call rax
mov rdi, rax
test rax, rax
je 0x2284e
xor sil, sil
test rdi, rdi
je 0x22902
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
test sil, sil
je 0x22872
mov ecx, dword [rdi + 8]
jmp 0x22876
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x228f0
and qword [rsp + 0x58], 0
test sil, sil
je 0x228ab
movsxd rax, dword [rcx + 0x3c]
mov r8d, dword [rax + rcx + 0x34]
mov qword [rsp + 0x58], r8
mov r9d, dword [rax + rcx + 0x50]
add r9, r8
mov eax, 0x80000000
cmp r9, rax
jbe 0x228d2
mov r9, rax
jmp 0x228d2
movsxd rax, dword [rcx + 0x3c]
mov r8, qword [rax + rcx + 0x30]
mov qword [rsp + 0x58], r8
mov r9d, dword [rax + rcx + 0x50]
add r9, r8
movabs rax, 0x80000000000
cmp r9, rax
cmova r9, rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.00022c6c
mov r12b, al
mov byte [rsp + 0x40], al
jmp 0x228f7
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x22912
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x22922
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, r12b
jmp 0x22929
xor al, al
lea r11, [rsp + 0xa0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x22950
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r13d, r9d
mov r14, r8
mov rdi, rdx
mov r15, rcx
xor ebx, ebx
mov r12b, bl
mov byte [rax - 0x78], bl
mov qword [rax - 0x50], rbx
xor edx, edx
lea r8d, [rbx + 0x28]
lea rcx, [rax - 0x48]
call fcn.00028240
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea esi, [rbx + 1]
mov edx, ebx
cmp r13d, ebx
jbe 0x22b42
lea rax, [r14 + 0x11c]
cmp dword [rax], 2
je 0x229cd
add edx, esi
add rax, 0x120
cmp edx, r13d
jb 0x229b6
jmp 0x22b42
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x22b1d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov rax, qword [0x0002a118]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10000000
xor r8d, r8d
mov edx, 0x240
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
cmp eax, ebx
jl 0x22b1d
lea rdx, [0x00029410]
lea rcx, [rsp + 0x58]
call qword [fcn.004e696c]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
cmp rax, rbx
je 0x22b1d
mov rcx, qword [rsp + 0x48]
call rax
mov rdi, rax
cmp rax, rbx
jne 0x22a8a
lea rdx, [0x00029450]
lea rcx, [rsp + 0x58]
call qword [fcn.004e696c]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
cmp rax, rbx
je 0x22a8a
mov rcx, qword [rsp + 0x48]
call rax
mov rdi, rax
cmp rax, rbx
je 0x22a8a
mov sil, bl
cmp rdi, rbx
je 0x22b1d
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp sil, bl
je 0x22ad9
mov rax, qword [rdi + 0x10]
cmp dword [rax + 0x44], ebx
je 0x22b09
cmp word [rax + 0x40], bx
je 0x22b09
movzx r8d, word [rax + 0x40]
mov edx, dword [rax + 0x44]
mov dword [rsp + 0x20], r13d
mov r9, r14
mov rcx, r15
call fcn.0002346c
mov r12b, al
mov byte [rsp + 0x40], al
jmp 0x22b09
mov rdx, qword [rdi + 0x20]
cmp qword [rdx + 0x78], rbx
je 0x22b09
cmp word [rdx + 0x70], bx
je 0x22b09
movzx r8d, word [rdx + 0x70]
mov dword [rsp + 0x20], r13d
mov r9, r14
mov rdx, qword [rdx + 0x78]
mov rcx, r15
call fcn.0002346c
mov r12b, al
mov byte [rsp + 0x40], al
jmp 0x22b12
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x22b2d
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x22b3d
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, r12b
jmp 0x22b44
xor al, al
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x22e5c
Capabilities:
Allocate or change rwx memory
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
and qword [rax - 0x70], 0
mov r14, qword [0x00065e98]
mov r12d, r9d
xor ebp, ebp
mov r13, r8
mov r15, rdx
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.000144e8
test eax, eax
js 0x23027
mov rsi, qword [rsp + 0x48]
xor ebx, ebx
mov rcx, r13
and qword [rsp + 0x30], rbx
and qword [rsp + 0x50], rbx
and qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x23013
test r12d, r12d
je 0x23013
test rsi, rsi
je 0x23013
cmp r12d, 0x3d0900
jb 0x22ef8
mov edi, 0x80000005
jmp 0x23018
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.000145d8
mov edi, eax
test eax, eax
js 0x22fe6
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.000232a4
lea rdx, [rsp + 0x40]
mov r9, r13
mov r8, rsi
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.00023074
mov rbx, qword [rsp + 0x40]
mov edi, eax
test eax, eax
js 0x22fe6
cmp byte [rbx + 0x1000], 0
je 0x22f6a
mov edi, 0xc0000001
jmp 0x22fe6
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x30]
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x40
mov qword [rsp + 0x50], 0x3d2000
mov dword [rsp + 0x20], 0x103000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edi, eax
test eax, eax
js 0x22fe6
mov rcx, qword [rsp + 0x30]
mov r8d, 0x3d19cd
mov rdx, rbx
call fcn.000283d0
cmp byte [rbx + 0x1000], 0
mov r9, qword [rsp + 0x30]
je 0x22fca
mov r8d, r9d
imul r8d, r8d, 0xfffffffc
jmp 0x22fcd
mov r8, r9
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.00021a14
neg al
sbb edi, edi
not edi
and edi, 0xc0000001
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rbx, rbx
je 0x23001
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x23018
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x23018
mov edi, 0xc000000d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
jns 0x2304a
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
inc ebp
mov qword [rsp + 0x50], 0xfffffffffa0a1f00
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
cmp ebp, 3
jb 0x22e92
lea r11, [rsp + 0x90]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x26bc0
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
mov rbx, r9
mov rcx, r8
mov rdi, rdx
lea r9, [rax - 0x18]
lea r8, [rax - 0x10]
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
jns 0x26c00
mov eax, 0xc0000369
jmp 0x26cc7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x26c16
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rbx
mov r9d, 0x22
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x26cc7
mov rdx, qword [rsp + 0x40]
test byte [rdx + 0x30], 4
je 0x26c58
mov rax, qword [rbx]
or dword [rax + 0x30], 4
mov rdx, qword [rsp + 0x40]
test byte [rdx + 0x30], 0x10
je 0x26c6a
mov rax, qword [rbx]
or dword [rax + 0x30], 0x10
mov rdx, qword [rsp + 0x40]
bt dword [rdx + 0x30], 0xd
jae 0x26c7e
mov rax, qword [rbx]
bts dword [rax + 0x30], 0xd
mov rdx, qword [rsp + 0x40]
bt dword [rdx + 0x34], 8
jae 0x26c92
mov rax, qword [rbx]
bts dword [rax + 0x34], 8
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
test rax, rax
jne 0x26cbd
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [rbx], 0
jmp 0x26bf6
mov rax, qword [rbx]
btr dword [rax + 0x30], 7
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret