joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056060
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005606d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005607d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140056065
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140056095
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140056082
sub eax, 3
jb 0x1400560af
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400560e6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400560d6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400560d4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400560c3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140056022
jmp 0x14005606d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140056132
cmp rsi, rcx
jae 0x14005613a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140056119
cmp al, 0x8f
ja 0x140056119
cmp byte [rsi - 2], 0xf
je 0x14005611f
sub al, 0xe8
cmp al, 1
ja 0x140056103
cmp rsi, rcx
jae 0x14005613a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140056109
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005613a
lodsb al, byte [rsi]
jmp 0x140056119
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x53000]
mov eax, dword [rdi]
or eax, eax
je 0x1400561a3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x565ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140056147
jns 0x14005617c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140056186
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14005619d
mov qword [rbx], rax
add rbx, 8
jmp 0x140056167
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400561dd
cmp al, 0xef
ja 0x1400561cf
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400561af
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400561be
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140056231
sub rsp, 0xffffffffffffff80
jmp 0x14000afa0
Function at 0x14000cd28
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r10, rcx
test edx, edx
je 0x14000cd5e
mov r9, rcx
mov rax, r9
lea rcx, [0x14006ea10]
sub rax, r10
and eax, 0xf
mov cl, byte [rax + rcx]
xor cl, byte [r9]
xor cl, r8b
inc r8d
not cl
mov byte [r9], cl
inc r9
cmp r8d, edx
jb 0x14000cd35
ret
Function at 0x140060400
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12d, 1
cmp qword [0x1400c0d48], r15
jne 0x140060561
xor ecx, ecx
call fcn.140066264
mov rcx, rax
mov rdi, rax
call fcn.14006104c
test al, al
jne 0x140060451
mov eax, r12d
jmp 0x1400605ca
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x140060465
mov eax, 2
jmp 0x1400605ca
cmp dword [rdi + 0x3c], 0x400
jl 0x140060478
mov eax, 3
jmp 0x1400605ca
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
cmp dword [rbx], 0x4550
je 0x140060491
mov eax, 4
jmp 0x1400605ca
mov qword [0x1400c0d48], r15
movzx r14d, r15w
movzx esi, word [rbx + 0x14]
add rsi, rbx
cmp r15w, word [rbx + 6]
jae 0x14006057f
movsx rax, r14w
lea rbp, [rax + rax*4]
mov eax, dword [rsi + rbp*8 + 0x3c]
test eax, 0x22000020
jne 0x1400604e9
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x1400604e9
cmp dword [rsi + rbp*8 + 0x20], 0x10
jb 0x1400604e9
mov eax, dword [rsi + rbp*8 + 0x24]
test eax, eax
je 0x1400604e9
lea rcx, [rdi + rax]
call fcn.14006104c
test al, al
jne 0x140060518
movzx ecx, word [rbx + 6]
add r14w, r12w
movsx eax, r14w
cmp eax, ecx
jl 0x1400604ae
mov rcx, qword [0x1400c0d48]
test rcx, rcx
je 0x14006057f
call fcn.14006104c
test al, al
jne 0x140060533
mov eax, 6
jmp 0x1400605ca
mov eax, dword [rsi + rbp*8 + 0x24]
mov ecx, dword [rsi + rbp*8 + 0x20]
add rax, rdi
add rcx, 0xfffffffffffffff0
add rcx, rax
mov qword [0x1400c0d48], rcx
jmp 0x140060500
mov rdx, qword [0x1400c0d48]
lea rcx, [0x1400c0d38]
mov r8d, 0x10
call sub.ntdll.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [0x1400c0d50], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call fcn.14006062c
test eax, eax
jne 0x140060586
mov eax, 7
jmp 0x1400605ca
mov eax, 5
jmp 0x1400605ca
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, r12d
call fcn.14006067c
test eax, eax
jne 0x1400605a2
mov eax, 8
jmp 0x1400605ca
mov rax, qword [0x1400c0d48]
movabs rcx, 0xcc873400686c01e9
mov qword [rax], rcx
lea rcx, [0x1400c0cd0]
mov rax, qword [0x1400c0d48]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14006240c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
lea rdx, [rsp + 0x40]
mov rbx, rcx
call fcn.14000cb0c
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call fcn.14004cd8c
mov rdx, rax
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp rdx, 0xffffffffffffffff
jne 0x14006248e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14006248a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x14006248a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x1400624a9
xor al, al
jmp 0x140062498
mov rcx, rdx
call fcn.14000a080
mov al, 1
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, [0x1400a8f64]
mov r8d, eax
call fcn.140063934
call fcn.140067338
int3

Function at 0x14006645c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbx, rdx
mov rdi, rcx
mov edx, dword [rax + rcx + 0x88]
test edx, edx
je 0x140066560
cmp dword [rax + rcx + 0x8c], 0
je 0x140066560
call fcn.140067a50
mov esi, eax
mov rcx, rdi
add rsi, rdi
mov edx, dword [rsi + 0x20]
call fcn.140067a50
mov edx, dword [rsi + 0x24]
mov rcx, rdi
mov r13d, eax
add r13, rdi
call fcn.140067a50
mov edx, dword [rsi + 0x1c]
mov rcx, rdi
mov r12d, eax
add r12, rdi
call fcn.140067a50
mov r14d, eax
add r14, rdi
cmp rbx, 0x10000
jae 0x14006651f
mov edx, dword [rsi + 0x10]
cmp rbx, rdx
jb 0x140066572
mov ecx, dword [rsi + 0x14]
add ecx, edx
cmp rbx, rcx
jae 0x140066572
sub rbx, rdx
mov eax, dword [r14 + rbx*4]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
cmp dword [rsi + 0x18], ebp
jbe 0x140066572
mov edx, dword [r13 + rbp*4]
mov rcx, rdi
call fcn.140067a50
mov edx, eax
mov rcx, rbx
add rdx, rdi
call fcn.14000c658
test al, al
jne 0x14006654d
inc ebp
cmp ebp, dword [rsi + 0x18]
jae 0x140066572
jmp 0x140066526
movzx edx, word [r12 + rbp*2]
mov rcx, rdi
mov edx, dword [r14 + rdx*4]
call fcn.140067a50
jmp 0x140066502
lea rcx, [0x1400a91a2]
call fcn.140063934
call fcn.140067338
int3
mov rdx, rbx
lea rcx, [0x1400a9218]
call fcn.140063934
call fcn.140067338
int3
Function at 0x140066588
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rdi, rdx
lea rdx, [rsp + 0x20]
call fcn.14000cb34
lea rcx, [rsp + 0x20]
call fcn.1400662f4
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14006666c
cmp dword [rax + rsi + 0x8c], 0
je 0x14006666c
lea rbx, [rsi + rcx]
mov r15d, dword [rbx + 0x24]
mov r14d, dword [rbx + 0x1c]
add r15, rsi
add r14, rsi
cmp rdi, 0x10000
jae 0x140066637
mov edx, dword [rbx + 0x10]
cmp rdi, rdx
jb 0x14006667e
mov ecx, dword [rbx + 0x14]
add ecx, edx
cmp rdi, rcx
jae 0x14006667e
sub rdi, rdx
mov eax, dword [r14 + rdi*4]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r12d, dword [rbx + 0x20]
xor ebp, ebp
add r12, rsi
cmp dword [rbx + 0x18], ebp
jbe 0x14006667e
mov edx, dword [r12 + rbp*4]
mov rcx, rdi
add rdx, rsi
call sub.ntdll.dll_strcmp
test eax, eax
je 0x140066661
inc ebp
cmp ebp, dword [rbx + 0x18]
jae 0x14006667e
jmp 0x140066645
movzx eax, word [r15 + rbp*2]
mov eax, dword [r14 + rax*4]
jmp 0x140066616
lea rcx, [0x1400a927e]
call fcn.140063934
call fcn.140067338
int3
lea rcx, [0x1400a92fa]
call fcn.140063934
call fcn.140067338
int3

Function at 0x1400667a4
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x150
and dword [rcx], 0
xor edx, edx
mov r15, rcx
mov dword [rsp + 0x20], 0x130
xor r14d, r14d
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006689e
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400668b8
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc r14d
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140066801
mov eax, r14d
imul rcx, rax, 0x130
call fcn.140063248
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r12, rax
xor ebp, ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400668d2
mov eax, ebp
lea rsi, [rsp + 0x20]
imul rdi, rax, 0x130
inc ebp
mov ecx, 0x130
add rdi, r12
rep movsb byte [rdi], byte [rsi]
cmp ebp, r14d
jae 0x14006686e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14006683e
mov rcx, rbx
call fcn.14000a080
lea r11, [rsp + 0x150]
mov dword [r15], ebp
mov rbx, qword [r11 + 0x20]
mov rax, r12
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400a90a2]
call fcn.140063934
call fcn.140067338
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400a90e4]
call fcn.140063934
call fcn.140067338
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400a9126]
call fcn.140063934
call fcn.140067338
int3
Function at 0x14000129c
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and dword [rax - 0x28], 0
mov r14d, r9d
mov ebx, r8d
mov r15, rdx
mov rbp, rcx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x1400012db
mov ebx, dword [rsp + 0x70]
jmp 0x140001362
movzx eax, word [rax + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x1400012f9
mov ecx, 0x20b
cmp ax, cx
jne 0x1400012d2
mov rsi, qword [rdi + 0x30]
jmp 0x1400012fc
mov esi, dword [rdi + 0x34]
mov r8d, 5
lea r9, [rsp + 0x20]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
test rax, rax
je 0x14000135a
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x14000135a
mov rdi, rbp
sub rdi, rsi
add rdi, r15
mov edx, dword [rax + 4]
test edx, edx
je 0x1400012d2
sub ecx, edx
lea r8, [rax + 8]
mov dword [rsp + 0x20], ecx
add edx, 0xfffffff8
mov ecx, dword [rax]
mov r9, rdi
add rcx, rbp
shr edx, 1
call fcn.140001178
test rax, rax
je 0x1400012d2
mov ecx, dword [rsp + 0x20]
test ecx, ecx
jne 0x140001328
jmp 0x140001362
test byte [rdi + 0x16], 1
cmovne ebx, r14d
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140001558
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
and dword [rax + 0x18], 0
mov r14, rcx
mov rcx, rdx
mov rbp, rdx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je 0x140001718
mov r8d, 9
lea r9, [rsp + 0x90]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rbx, rax
test rax, rax
je 0x140001718
cmp byte [r14 + 0x58], 0
mov r12d, 0x20b
jne 0x1400016a9
cmp word [rdi + 0x18], r12w
jne 0x1400015cb
mov rax, qword [rax]
jmp 0x1400015cd
mov eax, dword [rax]
test rax, rax
je 0x1400016a9
and qword [rsp + 0x98], 0
lea r9, [rsp + 0x40]
mov eax, 0x1000
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x98]
mov dword [rsp + 0x20], eax
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x1400016a9
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadTeb]
mov rcx, qword [r14]
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
je 0x140001659
mov ecx, dword [rsp + 0x98]
mov dword [rsi + 0x202c], ecx
cmp word [rdi + 0x18], r12w
jne 0x14000164b
mov rcx, qword [rbx]
jmp 0x14000164d
mov ecx, dword [rbx]
mov rax, qword [rsp + 0x98]
mov dword [rax], ecx
jmp 0x14000167e
mov rax, qword [rsp + 0x98]
mov qword [rsi + 0x58], rax
cmp word [rdi + 0x18], r12w
jne 0x140001671
mov rcx, qword [rbx]
jmp 0x140001673
mov ecx, dword [rbx]
mov rax, qword [rsp + 0x98]
mov qword [rax], rcx
mov rax, qword [rsp + 0x98]
lea r9, [0x140002ad0]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8, [0x140002af0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov byte [r14 + 0x58], 1
movzx ecx, word [rdi + 0x18]
cmp cx, r12w
jne 0x1400016b9
mov rbx, qword [rbx + 0x18]
jmp 0x1400016bc
mov ebx, dword [rbx + 0xc]
cmp cx, r12w
jne 0x1400016c7
mov rax, qword [rbx]
jmp 0x1400016c9
mov eax, dword [rbx]
test rax, rax
je 0x140001718
cmp cx, r12w
jne 0x1400016d9
mov r8, qword [rbx]
jmp 0x1400016dc
mov r8d, dword [rbx]
and qword [rsp + 0x30], 0
mov r9d, 3
mov qword [rsp + 0x28], 1
mov rdx, r14
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.1400094d0
movzx ecx, word [rdi + 0x18]
mov eax, 4
cmp cx, r12w
lea edx, [rax + 4]
cmove eax, edx
add rbx, rax
jmp 0x1400016bc
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000172c
Capabilities:
Get system information on windows

Disassembly:
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx]
jmp fcn.140008754
Function at 0x140001bec
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140005090]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x40], 0
xor esi, esi
mov rbx, rdx
test rdx, rdx
je 0x140001d77
test rcx, rcx
je 0x140001d77
mov eax, dword [rcx]
test eax, eax
je 0x140001d77
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rcx
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140001d50
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
lea rcx, [rbp - 0x50]
mov r9b, 1
mov edx, 0x10000
mov r8, qword [r8]
call fcn.14000c2e0
lea rcx, [rbp - 0x38]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x140001d50
mov r8, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
mov rax, r8
cmp r8, rcx
je 0x140001cb0
mov rax, qword [rax]
lea rcx, [rbp - 0x50]
inc esi
cmp rax, rcx
jne 0x140001ca2
mov rax, qword [rbx]
mov ecx, esi
mov qword [rbx], rcx
cmp rax, rcx
jae 0x140001cc7
mov edi, 0xc0000023
jmp 0x140001d54
xor r9d, r9d
lea rax, [rbp - 0x50]
mov rdx, r8
cmp r8, rax
je 0x140001d5d
mov rax, qword [rdx + 0x18]
lea rcx, [r9 + r9*2]
add rcx, rcx
inc r9d
mov qword [rbx + rcx*8 + 0x10], rax
mov eax, dword [rdx + 0x20]
mov dword [rbx + rcx*8 + 0x18], eax
mov rax, qword [rdx + 0x10]
mov qword [rbx + rcx*8 + 8], rax
mov eax, dword [rdx + 0x34]
mov dword [rbx + rcx*8 + 0x2c], eax
mov rax, qword [rdx + 0x28]
mov qword [rbx + rcx*8 + 0x20], rax
mov eax, dword [rdx + 0x30]
mov dword [rbx + rcx*8 + 0x28], eax
mov eax, dword [rdx + 0x38]
mov dword [rbx + rcx*8 + 0x30], eax
lea rax, [rbp - 0x50]
mov rdx, qword [rdx]
cmp rdx, rax
jne 0x140001cda
jmp 0x140001d54
mov rax, qword [r8]
cmp qword [rax + 8], r8
jne 0x140001d70
mov rcx, qword [r8 + 8]
cmp qword [rcx], r8
jne 0x140001d70
mov qword [rcx], rax
mov edx, 0x656e6f42
mov qword [rax + 8], rcx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r8, qword [rbp - 0x50]
lea rax, [rbp - 0x50]
cmp r8, rax
jne 0x140001d29
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140001d6c
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x140001d7c
mov ecx, 3
int 0x29
mov eax, 0xc000000d
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140002410
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001d98
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rdi, rcx
mov ecx, dword [rcx + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140001dd0
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x40]
call fcn.14000eaec
mov ebx, eax
jmp 0x140001df0
lfence
xor edx, edx
mov dword [rsp + 0x20], eax
lea r9, [0x140002c40]
lea r8, [0x140002be0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001e00
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140001e10
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
cmp dword [0x140005558], 0
je 0x140001ed7
cmp dword [0x140005538], 0
je 0x140001ed7
cmp byte [0x140005528], 0
jne 0x140001e66
xor edx, edx
lea r9, [0x140002b30]
lea r8, [0x140002ba0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc000a004
jmp 0x140001ef5
mov ecx, dword [rcx]
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140001ea3
mov rcx, qword [rsp + 0x48]
mov edx, dword [0x140005538]
mov rbx, qword [rdx + rcx]
xor ecx, ecx
call fcn.14000be38
mov edx, dword [0x140005558]
mov rcx, rbx
add rax, rdx
call qword [0x140003330]
jmp 0x140001ec3
lfence
xor edx, edx
mov dword [rsp + 0x20], edi
lea r9, [0x140002b30]
lea r8, [0x140002be0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140001ed3
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x140001ef5
xor edx, edx
lea r9, [0x140002b30]
lea r8, [0x140002b50]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc0000141
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400077e4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
mov dword [rsp + 0x28], 0x40
mov eax, 0x1000
mov qword [rbp + 0x30], r14
mov rdi, rdx
mov qword [rbp + 0x38], rax
mov rsi, rcx
mov qword [rbp - 0x44], r14
lea rdx, [rbp + 0x30]
mov qword [rbp - 0x30], r14
or rcx, 0xffffffffffffffff
mov qword [rbp - 0x24], r14
lea r9, [rbp + 0x38]
mov qword [rbp - 0x14], r14
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x50], 0x28ec8348
mov dword [rbp - 0x4c], 0x48c93148
mov dword [rbp - 0x48], 0xb849d231
mov qword [rbp - 0x3c], 0xb949
mov dword [rbp - 0x34], 0xb8480000
mov dword [rbp - 0x28], 0xba48d0ff
mov dword [rbp - 0x1c], 0x1e7e02c7
mov dword [rbp - 0x18], 0xba48c037
mov dword [rbp - 0xc], 0x83480289
mov word [rbp - 8], 0x28c4
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140007937
mov rbx, qword [rbp + 0x30]
mov rdx, rdi
add rbx, 0x200
mov rcx, rbx
mov dword [rbx], 0x3d00000
mov rax, qword [rbp + 0x30]
add rax, 0x210
mov qword [rbx + 8], rax
call fcn.140001088
mov rcx, qword [rbp + 0x30]
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movzx eax, word [rbp - 8]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [rbp - 0x10]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0xc3
mov rax, qword [rbp + 0x30]
mov qword [rax + 0xc], rbx
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5e0]
mov qword [rcx + 0x16], rax
mov rax, qword [rbp + 0x30]
mov qword [rax + 0x20], rsi
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5e8]
mov qword [rcx + 0x2c], rax
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5ec]
mov qword [rcx + 0x3c], rax
mov rax, qword [rbp + 0x30]
jmp 0x140007939
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007954
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov eax, 0x1000
mov dword [rsp + 0x28], 0x40
mov rsi, rdx
mov qword [rbp + 0x38], rax
mov rdi, rcx
mov dword [rsp + 0x20], eax
xor ebx, ebx
mov dword [rbp - 0x30], 0x68
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], rbx
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x1c], ebx
lea r9, [rbp + 0x38]
mov dword [rbp - 0x2c], 0x6800
xor r8d, r8d
mov dword [rbp - 0x28], 0x6a0000
mov dword [rbp - 0x24], 0xe8006a
mov dword [rbp - 0x20], 0xba000000
mov dword [rbp - 0x18], 0x1e7e02c7
mov dword [rbp - 0x14], 0xbac037
mov dword [rbp - 0x10], 0x89000000
mov dword [rbp - 0xc], 0x4c202
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140007a73
movzx eax, word [rsi]
mov rbx, qword [rbp + 0x30]
add rbx, 0x200
mov word [rbx], ax
movzx eax, word [rsi + 2]
mov word [rbx + 2], ax
mov eax, dword [rbp + 0x30]
add eax, 0x210
mov dword [rbx + 4], eax
movzx r8d, word [rsi]
mov rdx, qword [rsi + 8]
mov ecx, eax
call fcn.1400026c0
mov rax, qword [rbp + 0x30]
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp - 0x10]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5e0]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 0x30]
mov dword [rax + 6], ebx
mov rax, qword [rbp + 0x30]
sub edi, eax
sub edi, 0x13
mov dword [rax + 0xf], edi
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x14], eax
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5ec]
mov dword [rcx + 0x1f], eax
mov rax, qword [rbp + 0x30]
jmp 0x140007a75
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret