joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405b8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405b81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405b8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b806f
add dl, dl
jne 0x1405b8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b80f6
xor eax, eax
add dl, dl
jne 0x1405b80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b81ad
add dl, dl
jne 0x1405b80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405b80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405b807e
mov eax, 1
add dl, dl
jne 0x1405b8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b80fb
sub eax, ebx
mov ebx, 1
jne 0x1405b814c
mov ecx, 1
add dl, dl
jne 0x1405b812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405b8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b815d
cmp eax, 0x7d00
jae 0x1405b819b
cmp eax, 0x500
jb 0x1405b8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b807e
cmp eax, 0x7f
ja 0x1405b819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405b81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405b807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400014e0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]

Function at 0x140001af8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140001b42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b44
xor al, al
add rsp, 0x28
ret

Function at 0x14000307c
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
push rdi
sub rsp, 0x20
mov edi, 4
mov dword [rsp + 0x30], 1
mov r8d, edi
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 4]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, edi
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x38]
lea ecx, [rdi - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 1
lea rdx, [rsp + 0x40]
lea ecx, [rdi + 5]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, edi
mov dword [rsp + 0x48], 3
lea rdx, [rsp + 0x48]
lea ecx, [rdi + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
add rsp, 0x20
pop rdi
ret

Function at 0x1400038cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x140003955
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140003955
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140003942
cmp rbx, rcx
jae 0x140003955
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000392d
cmp rbx, rcx
jae 0x140003955
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x140003957
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006434
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rdx]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
nop dword [rax + rax]
mov esi, eax
xor ebx, ebx
mov r11, rdi
lea edx, [rsi + rsi]
shr rdx, 3
lea rbp, [rdi + rdx*8]
cmp rdi, rbp
je 0x140006488
lea r8d, [rbx + 8]
mov rdx, r11
call fcn.140008788
xor rbx, rax
add r11, r8
cmp r11, rbp
jne 0x140006475
lea rdi, [rdi + rsi*2]
cmp r11, rdi
je 0x1400064aa
mov r8d, 2
mov rdx, r11
call fcn.140008788
xor rbx, rax
add r11, r8
cmp r11, rdi
jne 0x140006497
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400083b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
nop
lea rcx, [rsi + 0x30]
mov rdx, rbx
call fcn.140008e3c
cmp qword [rsi + 0x40], 0
jne 0x1400084d2
mov ebx, 0x12c
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
and qword [rbp - 0x30], 0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDDDiagnosticsHub
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
lea rcx, [rbp - 0x18]
call fcn.14000776c
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x18], rcx
test eax, eax
jne 0x1400084bc
and dword [rbp + 0x20], eax
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x38]
xor r8d, r8d
lea rdx, str.CollectorService.IdleShutdownInSeconds
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
cmp dword [rbp + 0x38], 4
jne 0x1400084bc
mov ebx, dword [rbp + 0x20]
test ebx, ebx
jne 0x1400084bc
lea r8, str.Service_idle_shutdown_has_been_disabled
lea rdx, str.onecorecomdiagnostics_standardcollector_basecollection_standardcollector.service_standardcollectorhost.cpp
mov rcx, qword [0x140017848]
call fcn.14000b534
jmp 0x1400084c8
lea rcx, [rsi + 0x18]
mov edx, ebx
call fcn.140005d70
nop
lea rcx, [rbp - 0x18]
call fcn.14000776c
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
invalid

Function at 0x140008788
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400087b8
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14000879a
mov rax, rcx
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rdi, rcx
mov ecx, dword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140001083
mov edx, dword [rdi + 0x10]
mov rcx, qword [rsp + 0x40]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rdx
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x48]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rdi + 8]
mov rax, qword [rsp + 0x48]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140001090
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov ecx, dword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x1400010f1
mov rcx, qword [rsp + 0x30]
and qword [rsp + 0x38], 0
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
lea rdx, [rdi + 8]
mov r9d, 0x8000
lea r8, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001100
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
mov rax, qword [rbx + 0x10]
lea r8, [rax + rcx]
cmp r8, rax
jb 0x14000129a
mov rax, qword [rbx + 8]
lea rdx, [rax + rcx]
cmp rdx, rax
jb 0x14000129a
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rcx, qword [rax]
cmp r8, rcx
ja 0x14000129a
cmp rdx, rcx
ja 0x14000129a
and qword [rbp + 0x30], 0
cmp dword [rbx + 0x1c], 0
mov eax, dword [rbx]
je 0x140001219
test eax, eax
je 0x14000120f
mov ecx, eax
lea rdx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
jne 0x14000129f
mov rcx, qword [rbp + 0x30]
call fcn.140002410
mov rcx, qword [rbp + 0x30]
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov esi, dword [rbx + 0x18]
xor r14d, r14d
jmp 0x140001203
mov rdx, qword [rbx + 0x10]
mov rcx, r15
add rdx, r14
call fcn.1400020d4
test rax, rax
je 0x14000120f
and qword [rbp + 0x38], 0
lea r9, [rbp + 0x38]
mov rcx, rax
mov edx, 0x1000
and ecx, 0xfff
mov r8, rsi
sub rdx, rcx
mov rcx, rax
cmp rdx, rsi
cmovb r8, rdx
mov rdx, qword [rbx + 8]
add rdx, r14
call fcn.1400020b0
mov edi, eax
mov rax, qword [rbp + 0x38]
sub rsi, rax
add r14, rax
test edi, edi
jne 0x140001208
test rax, rax
je 0x140001208
test rsi, rsi
jne 0x1400011a7
mov eax, edi
jmp 0x14000129f
mov eax, 0xc0000001
jmp 0x14000129f
mov rcx, rax
lea rdx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140001208
and qword [rbp + 0x38], 0
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rdx, qword [rbx + 0x10]
lea r9, [rbp - 0x40]
mov rcx, qword [rbp + 0x30]
mov r8, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x40
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov rcx, qword [rbp + 0x30]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
js 0x140001208
movaps xmm0, xmmword [rbp - 0x40]
mov rax, qword [rbx + 8]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rax + 0x30], xmm1
jmp 0x140001208
mov eax, 0xc0000005
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400012b8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
mov rax, qword [rbx + 0x10]
lea r8, [rax + rcx]
cmp r8, rax
jb 0x14000149d
mov rax, qword [rbx + 8]
lea rdx, [rax + rcx]
cmp rdx, rax
jb 0x14000149d
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rcx, qword [rax]
cmp r8, rcx
ja 0x14000149d
cmp rdx, rcx
ja 0x14000149d
and qword [rbp + 0x67], 0
cmp dword [rbx + 0x1c], 0
mov eax, dword [rbx]
je 0x1400013d3
test eax, eax
je 0x1400013c9
mov ecx, eax
lea rdx, [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
jne 0x1400014a2
mov rcx, qword [rbp + 0x67]
call fcn.140002410
mov rcx, qword [rbp + 0x67]
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov esi, dword [rbx + 0x18]
xor r14d, r14d
jmp 0x1400013bd
mov rdx, qword [rbx + 0x10]
mov rcx, r15
add rdx, r14
call fcn.1400020d4
test rax, rax
je 0x1400013c9
and qword [rbp + 0x6f], 0
lea r9, [rbp + 0x6f]
mov rcx, rax
mov edx, 0x1000
and ecx, 0xfff
mov r8, rsi
sub rdx, rcx
mov rcx, rax
cmp rdx, rsi
cmovb r8, rdx
mov rdx, qword [rbx + 8]
add rdx, r14
call fcn.1400020b0
mov edi, eax
mov rax, qword [rbp + 0x6f]
sub rsi, rax
add r14, rax
test edi, edi
jne 0x1400013c2
test rax, rax
je 0x1400013c2
test rsi, rsi
jne 0x140001361
mov eax, edi
jmp 0x1400014a2
mov eax, 0xc0000001
jmp 0x1400014a2
mov rcx, rax
lea rdx, [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x1400013c2
and qword [rbp + 0x6f], 0
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rdx, qword [rbx + 0x10]
lea r9, [rbp - 0x29]
mov rcx, qword [rbp + 0x67]
mov r8, rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x20
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov rcx, qword [rbp + 0x67]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
js 0x1400013c2
xor ecx, ecx
xorps xmm0, xmm0
xorps xmm1, xmm1
xorps xmm2, xmm2
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 0x27], rcx
movups xmmword [rbp + 7], xmm1
mov dword [rbp + 0x2f], ecx
movups xmmword [rbp + 0x17], xmm2
cmp byte [rbp - 0x29], cl
je 0x14000147c
mov al, byte [rbp + rcx - 0x29]
mov byte [rbp + rcx - 9], al
inc rcx
cmp byte [rbp + rcx - 9], 0xb8
jne 0x140001466
mov byte [rbp + rcx - 9], 0
cmp byte [rbp + rcx - 0x29], 0
jne 0x14000144f
mov ecx, dword [rbp + 0x2f]
movups xmm2, xmmword [rbp + 0x17]
movups xmm1, xmmword [rbp + 7]
movups xmm0, xmmword [rbp - 9]
mov rax, qword [rbx + 0x20]
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp + 0x27]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
movsd qword [rax + 0x30], xmm0
mov dword [rax + 0x38], ecx
jmp 0x1400013c2
mov eax, 0xc0000005
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400014bc
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
mov rbx, rcx
mov eax, dword [rcx]
test eax, eax
je 0x140001503
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140001503
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x140001508
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001510
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
and qword [rax + 8], 0
lea rdx, [rax + 8]
mov rbp, rcx
mov ecx, dword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x140001594
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp + 4]
call fcn.140001fe4
test rax, rax
je 0x14000157e
mov rbx, qword [rax + 0x30]
mov edi, dword [rax + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rax, qword [rbp + 0x208]
mov qword [rax], rbx
mov rax, qword [rbp + 0x210]
mov dword [rax], edi
jmp 0x140001589
mov esi, 0xc0000225
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbx, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400015ac
Capabilities:
Allocate or change rwx memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx]
mov rbx, rcx
test eax, eax
je 0x140001664
cmp qword [rcx + 8], 0
je 0x140001664
cmp dword [rcx + 0x10], 0
je 0x140001664
cmp qword [rcx + 0x18], 0
je 0x140001664
and qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140001601
mov eax, 0xc0000225
jmp 0x140001669
mov eax, dword [rbx + 0x10]
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x18]
mov ecx, dword [rax]
mov dword [rsp + 0x40], ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 8]
or rcx, 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwProtectVirtualMemory
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
test edi, edi
js 0x140001655
mov rdx, qword [rbx + 0x18]
mov ecx, dword [rsp + 0x40]
mov dword [rdx], ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x140001669
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140001674
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
mov rax, qword [rdi + 0x10]
lea r8, [rax + rcx]
cmp r8, rax
jb 0x1400017da
mov rax, qword [rdi + 8]
lea rdx, [rax + rcx]
cmp rdx, rax
jb 0x1400017da
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rcx, qword [rax]
cmp r8, rcx
ja 0x1400017da
cmp rdx, rcx
ja 0x1400017da
and qword [rbp + 0x30], 0
cmp dword [rdi + 0x1c], 0
mov eax, dword [rdi]
je 0x140001784
test eax, eax
je 0x14000177d
mov ecx, eax
lea rdx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x1400017df
mov rcx, qword [rbp + 0x30]
call fcn.140002410
mov rcx, qword [rbp + 0x30]
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov esi, dword [rdi + 0x18]
xor r14d, r14d
jmp 0x140001774
mov rdx, qword [rdi + 0x10]
mov rcx, r15
add rdx, r14
call fcn.1400020d4
test rax, rax
je 0x14000177d
and qword [rbp + 0x38], 0
lea r9, [rbp + 0x38]
mov rcx, rax
mov edx, 0x1000
and ecx, 0xfff
mov r8, rsi
sub rdx, rcx
mov rcx, rax
cmp rdx, rsi
cmovb r8, rdx
mov rdx, qword [rdi + 8]
add rdx, r14
call fcn.1400020b0
mov ebx, eax
mov rax, qword [rbp + 0x38]
sub rsi, rax
add r14, rax
test ebx, ebx
jne 0x140001779
test rax, rax
je 0x140001779
test rsi, rsi
jne 0x140001718
mov eax, ebx
jmp 0x1400017df
mov eax, 0xc0000001
jmp 0x1400017df
mov rcx, rax
lea rdx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140001779
and qword [rbp + 0x38], 0
mov ebx, dword [rdi + 0x18]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r9, qword [rdi + 8]
mov r8, rax
mov rdx, qword [rdi + 0x10]
lea rax, [rbp + 0x38]
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov rcx, qword [rbp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140001779
mov eax, 0xc0000005
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400017f4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
mov rax, qword [rdi + 0x10]
lea r8, [rax + rcx]
cmp r8, rax
jb 0x14000195a
mov rax, qword [rdi + 8]
lea rdx, [rax + rcx]
cmp rdx, rax
jb 0x14000195a
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rcx, qword [rax]
cmp r8, rcx
ja 0x14000195a
cmp rdx, rcx
ja 0x14000195a
and qword [rbp + 0x30], 0
cmp dword [rdi + 0x1c], 0
mov eax, dword [rdi]
je 0x140001904
test eax, eax
je 0x1400018fd
mov ecx, eax
lea rdx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x14000195f
mov rcx, qword [rbp + 0x30]
call fcn.140002410
mov rcx, qword [rbp + 0x30]
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov esi, dword [rdi + 0x18]
xor r14d, r14d
jmp 0x1400018f4
mov rdx, qword [rdi + 0x10]
mov rcx, r15
add rdx, r14
call fcn.1400020d4
test rax, rax
je 0x1400018fd
and qword [rbp + 0x38], 0
lea r9, [rbp + 0x38]
mov rcx, rax
mov edx, 0x1000
and ecx, 0xfff
mov r8, rsi
sub rdx, rcx
mov rcx, rax
cmp rdx, rsi
cmovb r8, rdx
mov rdx, qword [rdi + 8]
add rdx, r14
call fcn.14000225c
mov ebx, eax
mov rax, qword [rbp + 0x38]
sub rsi, rax
add r14, rax
test ebx, ebx
jne 0x1400018f9
test rax, rax
je 0x1400018f9
test rsi, rsi
jne 0x140001898
mov eax, ebx
jmp 0x14000195f
mov eax, 0xc0000001
jmp 0x14000195f
mov rcx, rax
lea rdx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x1400018f9
and qword [rbp + 0x38], 0
mov ebx, dword [rdi + 0x18]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r9, qword [rdi + 8]
mov rcx, rax
mov r8, qword [rbp + 0x30]
lea rax, [rbp + 0x38]
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov rcx, qword [rbp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400018f9
mov eax, 0xc0000005
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret