joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007cbc
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and qword [r11 + 0x20], 0
movabs rax, 0x7b301ecc07b301ed
mov ebp, r8d
mov r15, rdx
lea r8, [rbp - 0x430]
mul r8
mov r14, rdx
shr r14, 9
test ecx, ecx
jne 0x140007d08
mov eax, 0xc0000001
jmp 0x140007e69
mov ecx, ecx
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140007e54
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rcx]
test rsi, rsi
je 0x140007e59
test rbx, rbx
je 0x140007e67
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007e54
and qword [rsp + 0x20], 0
cmp qword [sym.imp.ntoskrnl.exe_MmIsAddressValid], 0
je 0x140007e54
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007e54
lea rdx, [rsp + 0x20]
lea rcx, [0x1400154b0]
call fcn.14000fa00
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140007e54
mov rcx, rbx
call qword [0x1400176c8]
test rax, rax
je 0x140007e54
cmp rax, rsi
jne 0x140007e54
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007e54
mov rcx, qword [0x1400774d0]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007e54
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x140007e54
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007e54
mov rdx, rbp
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140007e54
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140015340
mov rcx, qword [rsp + 0x68]
mov r8d, r14d
mov rdx, rbx
call fcn.140007e84
mov edi, eax
test eax, eax
js 0x140007e49
mov eax, dword [rbx]
cmp r14d, eax
jb 0x140007e41
mov r8, rbp
mov rdx, rbx
mov rcx, r15
call fcn.140015080
xor edi, edi
jmp 0x140007e49
mov dword [r15], eax
mov edi, 0xc0000023
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140007e67
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400083e0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x48], 0
mov r14d, r8d
mov r15, rdx
test ecx, ecx
jne 0x14000840c
mov eax, 0xc0000001
jmp 0x1400085c7
mov ecx, ecx
lea rdx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x1400085b3
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rbp + 0x48]
mov rsi, qword [rcx]
test rsi, rsi
je 0x1400085b7
test rbx, rbx
je 0x1400085c5
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400085b3
and qword [rbp - 8], 0
cmp qword [sym.imp.ntoskrnl.exe_MmIsAddressValid], 0
je 0x1400085b3
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400085b3
lea rdx, [rbp - 8]
lea rcx, [0x1400154b0]
call fcn.14000fa00
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400085b3
mov rcx, rbx
call qword [0x1400176c8]
test rax, rax
je 0x1400085b3
cmp rax, rsi
jne 0x1400085b3
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400085b3
mov rcx, qword [0x1400774d0]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400085b3
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x1400085b3
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400085b3
and qword [rbp - 8], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
mov r9d, 0x10000000
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
xor r8d, r8d
mov byte [rsp + 0x28], 0
mov edx, 0x240
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
test eax, eax
js 0x1400085b3
and qword [rbp - 0x10], 0
lea r8, [rbp - 0x10]
mov rbx, qword gs:[0x188]
mov edx, 8
add rbx, qword [0x140077518]
mov sil, byte [rbx]
mov byte [rbx], 0
mov rcx, qword [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_NtOpenProcessToken]
mov edi, eax
test eax, eax
js 0x140008592
and dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
mov r9d, r14d
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 3
call qword [sym.imp.ntoskrnl.exe_NtQueryInformationToken]
mov edi, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400085a1
call qword [sym.imp.ntoskrnl.exe_NtClose]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400085b0
call qword [sym.imp.ntoskrnl.exe_NtClose]
mov byte [rbx], sil
mov rbx, qword [rbp + 0x48]
test rbx, rbx
je 0x1400085c5
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000995c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
xor ebx, ebx
mov rsi, rcx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400099be
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x1400099af
inc rax
test edx, edx
jne 0x14000999c
test ecx, ecx
mov rcx, qword [rsp + 0x40]
je 0x1400099df
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbx, 4
cmp rbx, 0xc350
jb 0x140009979
and qword [rdi], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rdi], rcx
mov eax, ebx
jmp 0x1400099cf
Function at 0x14000a090
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
and qword [rax + 0x18], 0
lea rdx, [rax + 0x18]
and qword [rax + 0x10], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000a121
mov ebx, 4
mov edi, 0x1ffff
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov esi, eax
test eax, eax
js 0x14000a10a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadProcess]
cmp qword [rsp + 0x40], rax
jne 0x14000a0ff
mov rax, qword [0x140077418]
mov r8b, 1
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [0x1400176c8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbx, 4
sub rdi, 1
jne 0x14000a0c2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b0e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r9d, r9d
mov rsi, rdx
mov r8, rcx
test rcx, rcx
je 0x14000b1cf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000b1cf
movsxd rax, dword [rcx + 0x3c]
mov ecx, 0x20b
cmp word [rax + r8 + 0x18], cx
jne 0x14000b13c
mov ecx, dword [rax + r8 + 0x88]
jmp 0x14000b141
mov ecx, dword [rax + r8 + 0x78]
mov r10d, ecx
mov edx, r9d
mov r14d, dword [r10 + r8 + 0x24]
mov r15d, dword [r10 + r8 + 0x20]
add r14, r8
mov edi, dword [r10 + r8 + 0x1c]
add r15, r8
mov r12d, dword [r10 + r8 + 0x14]
add rdi, r8
test r12d, r12d
je 0x14000b1ca
cmp rsi, 0xffff
ja 0x14000b185
movzx r11d, dx
mov ecx, r11d
movzx eax, si
add ecx, dword [r10 + r8 + 0x10]
cmp eax, ecx
jmp 0x14000b1b4
cmp edx, dword [r10 + r8 + 0x18]
jae 0x14000b1cf
mov eax, edx
mov rbp, rsi
mov ecx, dword [r15 + rax*4]
movzx r11d, word [r14 + rax*2]
add rcx, r8
sub rbp, rcx
movzx eax, byte [rcx]
movzx ebx, byte [rcx + rbp]
sub eax, ebx
jne 0x14000b1b2
inc rcx
test ebx, ebx
jne 0x14000b1a0
test eax, eax
je 0x14000b1bf
inc edx
cmp edx, r12d
jb 0x14000b169
jmp 0x14000b1ca
movzx eax, r11w
mov r9d, dword [rdi + rax*4]
add r9, r8
mov rax, r9
jmp 0x14000b1d1
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14000b1ec
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov rax, qword [0x140076ea0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov edi, r9d
mov rsi, r8
mov rbx, rdx
mov r14, rcx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000b402
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000b402
lea rax, [0x140015d00]
mov dword [rbp - 0x69], 0x10000e
mov qword [rbp - 0x61], rax
lea rdx, [rbp - 0x69]
lea rax, [0x140015d10]
mov dword [rbp - 0x59], 0xe000c
mov qword [rbp - 0x51], rax
mov r15d, 0x10
lea rax, [0x1400158f0]
mov dword [rbp - 0x29], 0xa0008
mov qword [rbp - 0x21], rax
add r14, r15
lea rax, [0x140015d20]
mov dword [rbp - 9], 0xc000a
mov qword [rbp - 1], rax
mov r8b, 1
lea rax, [0x140015d30]
mov dword [rbp - 0x19], 0x10000e
mov qword [rbp - 0x11], rax
mov rcx, r14
lea rax, [0x140015d40]
mov dword [rbp - 0x49], 0xa0008
mov qword [rbp - 0x41], rax
lea rax, [0x140015d50]
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x39], 0xa0008
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x14000b2e8
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
call fcn.14000c1ac
jmp 0x14000b402
mov r8b, 1
lea rdx, [rbp - 0x59]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x14000b30a
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoThreadToProcess]
mov rcx, rax
jmp 0x14000b2d8
mov r8b, 1
lea rdx, [rbp - 0x49]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x14000b345
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140001e70
test eax, eax
jns 0x14000b402
lea rcx, [0x140015d60]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000b402
mov r8b, 1
lea rdx, [rbp - 0x39]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x14000b391
xorps xmm0, xmm0
lea rdx, [rbp + 7]
mov rcx, rbx
movups xmmword [rbp + 7], xmm0
call fcn.14000adb0
test eax, eax
js 0x14000b388
cmp edi, r15d
lea rdx, [rbp + 7]
mov rcx, rsi
cmovb r15, rdi
mov r8, r15
call fcn.140015080
jmp 0x14000b402
lea rcx, [0x140015d80]
jmp 0x14000b33b
mov r8b, 1
lea rdx, [rbp - 0x29]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x14000b3b5
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140001c54
jmp 0x14000b402
mov r8b, 1
lea rdx, [rbp - 0x19]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x14000b3d9
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140001d38
jmp 0x14000b402
mov r8b, 1
lea rdx, [rbp - 9]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
test al, al
je 0x14000b3fd
call fcn.140001f80
jmp 0x14000b402
call fcn.14000ae1c
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140014fb0
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000b420
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov eax, 0x1000
mov dword [rsp + 0x28], 0x40
mov rsi, rdx
mov qword [rbp + 0x38], rax
mov rdi, rcx
mov dword [rsp + 0x20], eax
xor ebx, ebx
mov dword [rbp - 0x30], 0x68
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], rbx
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x1c], ebx
lea r9, [rbp + 0x38]
mov dword [rbp - 0x2c], 0x6800
xor r8d, r8d
mov dword [rbp - 0x28], 0x6a0000
mov dword [rbp - 0x24], 0xe8006a
mov dword [rbp - 0x20], 0xba000000
mov dword [rbp - 0x18], 0x1e7e02c7
mov dword [rbp - 0x14], 0xbac037
mov dword [rbp - 0x10], 0x89000000
mov dword [rbp - 0xc], 0x4c202
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000b53f
movzx eax, word [rsi]
mov rbx, qword [rbp + 0x30]
add rbx, 0x200
mov word [rbx], ax
movzx eax, word [rsi + 2]
mov word [rbx + 2], ax
mov eax, dword [rbp + 0x30]
add eax, 0x210
mov dword [rbx + 4], eax
movzx r8d, word [rsi]
mov rdx, qword [rsi + 8]
mov ecx, eax
call fcn.140015080
mov rax, qword [rbp + 0x30]
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp - 0x10]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5e0]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 0x30]
mov dword [rax + 6], ebx
mov rax, qword [rbp + 0x30]
sub edi, eax
sub edi, 0x13
mov dword [rax + 0xf], edi
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x14], eax
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5ec]
mov dword [rcx + 0x1f], eax
mov rax, qword [rbp + 0x30]
jmp 0x14000b541
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b554
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
mov dword [rsp + 0x28], 0x40
mov eax, 0x1000
mov qword [rbp + 0x30], r14
mov rdi, rdx
mov qword [rbp + 0x38], rax
mov rsi, rcx
mov qword [rbp - 0x44], r14
lea rdx, [rbp + 0x30]
mov qword [rbp - 0x30], r14
or rcx, 0xffffffffffffffff
mov qword [rbp - 0x24], r14
lea r9, [rbp + 0x38]
mov qword [rbp - 0x14], r14
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x50], 0x28ec8348
mov dword [rbp - 0x4c], 0x48c93148
mov dword [rbp - 0x48], 0xb849d231
mov qword [rbp - 0x3c], 0xb949
mov dword [rbp - 0x34], 0xb8480000
mov dword [rbp - 0x28], 0xba48d0ff
mov dword [rbp - 0x1c], 0x1e7e02c7
mov dword [rbp - 0x18], 0xba48c037
mov dword [rbp - 0xc], 0x83480289
mov word [rbp - 8], 0x28c4
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000b6a7
mov rbx, qword [rbp + 0x30]
mov rdx, rdi
add rbx, 0x200
mov rcx, rbx
mov dword [rbx], 0x3d00000
mov rax, qword [rbp + 0x30]
add rax, 0x210
mov qword [rbx + 8], rax
call fcn.140012cc4
mov rcx, qword [rbp + 0x30]
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movzx eax, word [rbp - 8]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [rbp - 0x10]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0xc3
mov rax, qword [rbp + 0x30]
mov qword [rax + 0xc], rbx
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5e0]
mov qword [rcx + 0x16], rax
mov rax, qword [rbp + 0x30]
mov qword [rax + 0x20], rsi
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5e8]
mov qword [rcx + 0x2c], rax
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5ec]
mov qword [rcx + 0x3c], rax
mov rax, qword [rbp + 0x30]
jmp 0x14000b6a9
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000c27c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
lea rdx, [rsp + 0x40]
mov ecx, ecx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000c2f1
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
and qword [rsp + 0x48], 0
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov ebx, eax
test eax, eax
js 0x14000c2e6
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rcx + 8]
call fcn.14000e694
test al, al
je 0x14000c2e1
neg rdi
sbb ebx, ebx
not ebx
and ebx, 0xc0000001
jmp 0x14000c2e6
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000c300
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000c369
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov ebx, eax
test eax, eax
js 0x14000c35c
mov rbx, qword [rsp + 0x48]
mov rcx, rdi
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
add r8, r8
call fcn.140015080
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000c524
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x14001a014]
mov rbx, rcx
imul rdx, rax, 0x38
xor esi, esi
mov r8d, 0x6d7467
lea ecx, [rsi + 1]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [0x140077178], rax
mov eax, dword [0x14001a014]
xor edx, edx
imul r8, rax, 0x38
call fcn.140015340
and qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x40]
and qword [rsp + 0x38], rsi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000c58c
xor eax, eax
jmp 0x14000c5f8
mov ebx, 4
mov edi, 0xffff
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x14000c5e1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_IoThreadToProcess]
cmp rax, qword [rsp + 0x40]
jne 0x14000c5e1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000c5e1
mov rcx, qword [rsp + 0x38]
call fcn.1400113e8
mov rcx, qword [rsp + 0x38]
movzx esi, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbx, 4
sub rdi, 1
jne 0x14000c596
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d04c
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
lea r8, [0x140079508]
lea rdx, [0x140017900]
call sub.FLTMGR.SYS_FltRegisterFilter
test eax, eax
js 0x14000d08f
mov rcx, qword [0x140079508]
call sub.FLTMGR.SYS_FltStartFiltering
test eax, eax
jns 0x14000d08f
mov rcx, qword [0x140079508]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov edx, 0x1f0001
lea rcx, [rbp + 0x18]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x14000d135
lea rdx, [0x1400162c0]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140079508]
lea rax, [rbp - 0x40]
and qword [rbp - 0x28], 0
lea r8, [rbp - 0x30]
and qword [rbp - 8], 0
lea rdx, [0x140079500]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
lea rax, [0x14000e590]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
lea rax, [0x14000e570]
mov qword [rsp + 0x28], rax
lea rax, [0x14000e560]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x30], 0x30
mov dword [rbp - 0x18], 0x240
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov rcx, qword [rbp + 0x18]
mov ebx, eax
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
test ebx, ebx
jns 0x14000d157
mov rcx, qword [0x140079500]
test rcx, rcx
je 0x14000d146
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x140079508]
test rcx, rcx
je 0x14000d157
call sub.FLTMGR.SYS_FltUnregisterFilter
xor edx, edx
mov dword [rsp + 0x20], ebx
lea r9, [0x1400162e0]
lea r8, [0x140016300]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x14000d218
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
mov edi, 0xc0000001
mov dword [rsp + 0x30], edi
mov ebx, 0x50
mov r8d, 0x687a77
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000d327
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140015340
mov rax, cr8
cmp al, 1
ja 0x14000d306
call qword [sym.imp.ntoskrnl.exe_KeAreApcsDisabled]
test al, al
jne 0x14000d29b
mov rax, cr8
cmp al, 1
je 0x14000d29b
mov rax, cr8
movzx edx, al
lea rcx, [0x1400155c0]
jmp 0x14000d314
xor r8d, r8d
xor edx, edx
lea rcx, [rsi + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov dword [rsi + 0x48], edi
and qword [rsi], 0
lea rax, [0x14000d340]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x18], rsi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExQueueWorkItem]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsi + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
nop
mov edi, dword [rsi + 0x48]
mov dword [rsp + 0x30], edi
mov rax, qword [rsi + 0x28]
mov qword [r14], rax
jmp 0x14000d319
mov rcx, cr8
movzx edx, cl
lea rcx, [0x140015600]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x687a77
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000ebb0
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
and qword [rbp + 0x67], 0
xorps xmm0, xmm0
and qword [rbp - 0x19], 0
mov rdi, r9
and dword [rbp + 0x13], 0
lea r9, [rbp - 1]
and dword [rbp + 0x2b], 0
mov rsi, r8
and qword [rbp - 0x11], 0
lea r8, [rbp + 0xf]
and qword [rbp - 9], 0
mov r14, rdx
and qword [rbp + 0x17], 0
mov edx, 0x80000000
mov qword [rbp + 0x1f], rcx
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], 0x20
movups xmmword [rbp - 1], xmm0
mov dword [rbp + 0xf], 0x30
movdqu xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x27], 0x240
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x14000ecee
mov rax, qword [rbp + 0x67]
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x1000000
xor r8d, r8d
mov dword [rsp + 0x20], 4
lea edx, [r9 + 6]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov ebx, eax
test eax, eax
jns 0x14000ec80
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14000ecec
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 9]
mov dword [rsp + 0x48], 4
lea r8, [rbp - 0x11]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x400
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
test eax, eax
jns 0x14000ecd7
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14000ec74
mov rax, qword [rbp + 0x67]
mov qword [r14], rax
mov rax, qword [rbp - 0x19]
mov qword [rsi], rax
mov rax, qword [rbp - 0x11]
mov qword [rdi], rax
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret