joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002130
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov esi, ecx
test ecx, ecx
je 0x14000222c
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rdi, qword [rdx + 0x20]
test rdi, rdi
je 0x14000222c
mov ebp, 0x104
movzx eax, word [rdi + 0x48]
test ax, ax
je 0x14000222c
cmp ax, bp
jae 0x14000222c
mov r11, qword [rdi + 0x50]
xor r9d, r9d
movzx ecx, word [r11]
test cx, cx
je 0x1400021ce
xor r10d, r10d
nop dword [rax]
movzx r8d, cl
lea eax, [r8 - 0x20]
movzx ecx, al
lea edx, [r8 - 0x61]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r10 + 0x20], cl
mov r10d, r9d
movzx eax, word [r11 + r9*2]
movzx ecx, al
test ax, ax
jne 0x1400021a0
lea rcx, [rsp + 0x20]
mov byte [rsp + r9 + 0x20], 0
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
je 0x140002220
nop word [rax + rax]
movsx eax, byte [rsp + rcx + 0x20]
inc rcx
add eax, ebx
imul ebx, eax, 0x101
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x1400021f0
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, esi
je 0x140002247
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140002170
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, qword [rdi + 0x20]
jmp 0x14000222e
Function at 0x140002250
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov r15d, edx
mov rbp, rcx
test rcx, rcx
je 0x1400023f0
test edx, edx
je 0x1400023f0
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400023f0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400023f0
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
xor esi, esi
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r12d, dword [rsp + 0x90]
add r12, rbp
mov r13d, dword [r12 + 0x20]
mov ecx, dword [r12 + 0x1c]
add r13, rbp
mov edx, dword [r12 + 0x24]
add rcx, rbp
add rdx, rbp
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x160], rdx
cmp dword [r12 + 0x14], esi
jbe 0x1400023f0
nop dword [rax]
movzx eax, word [rdx + rsi*2]
xor ebx, ebx
mov edi, dword [r13 + rsi*4]
add rdi, rbp
mov r14d, dword [rcx + rax*4]
mov rcx, rdi
add r14, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
je 0x1400023d0
nop word [rax + rax]
movsx eax, byte [rcx + rdi]
inc rcx
add eax, ebx
imul ebx, eax, 0x101
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x1400023a0
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp r15d, eax
je 0x1400023eb
inc esi
cmp esi, dword [r12 + 0x14]
jae 0x1400023f0
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x160]
jmp 0x140002370
mov rax, r14
jmp 0x1400023f2
xor eax, eax
mov rbx, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400049d1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x130
mov ebp, ecx
test ecx, ecx
je 0x14000109b
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x14000109b
mov r14d, 0x104
nop
movzx eax, word [rbx + 0x48]
test ax, ax
je 0x14000109b
cmp ax, r14w
jae 0x14000109b
mov rax, qword [rbx + 0x50]
xor edi, edi
cmp word [rax], di
je 0x140001080
xor esi, esi
xor ecx, ecx
nop
movzx ecx, byte [rcx + rax]
call fcn.140001ea0
inc edi
mov byte [rsp + rsi + 0x20], al
mov rax, qword [rbx + 0x50]
mov esi, edi
lea rcx, [rdi + rdi]
cmp word [rcx + rax], 0
jne 0x140001060
lea rcx, [rsp + 0x20]
mov byte [rsp + rdi + 0x20], 0
call fcn.140001df0
cmp eax, ebp
je 0x1400010bb
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001040
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rbx + 0x20]
jmp 0x14000109d
Function at 0x1400010d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov ebp, edx
mov rdi, rcx
test rcx, rcx
je 0x140001205
test edx, edx
je 0x140001205
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001205
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001205
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
xor ebx, ebx
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r14d, dword [rsp + 0x90]
add r14, rdi
mov r15d, dword [r14 + 0x20]
mov r12d, dword [r14 + 0x1c]
add r15, rdi
mov r13d, dword [r14 + 0x24]
add r12, rdi
add r13, rdi
cmp dword [r14 + 0x14], ebx
jbe 0x140001205
nop dword [rax + rax]
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r15 + rbx*4]
add rcx, rdi
mov esi, dword [r12 + rax*4]
add rsi, rdi
call fcn.140001df0
cmp ebp, eax
je 0x140001228
inc ebx
cmp ebx, dword [r14 + 0x14]
jb 0x1400011e0
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x140001207

Function at 0x140001230
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000125a
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000125a
mov eax, dword [rax + rcx + 0x88]
add rax, rcx
mov qword [rdx], rax
mov eax, 1
ret
xor eax, eax
ret
Function at 0x140001df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov edx, ebx
test eax, eax
je 0x140001e2b
nop
movsx eax, byte [rdi + rdx]
inc rdx
add eax, ebx
imul ebx, eax, 0x101
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rdx, rcx
jne 0x140001e10
lea eax, [rbx + rbx*8]
mov rbx, qword [rsp + 0x30]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
add rsp, 0x20
pop rdi
ret

Function at 0x140001ec1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x14001c320]
syscall
ret
Function at 0x140001000
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000102b
xor al, al
jmp 0x1400010b7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessExitStatus]
cmp eax, 0x103
je 0x14000104a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140001024
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400015f0
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400014fc
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140001274
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400013c0
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400022dc
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140001db4
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140001b48
mov rcx, rbx
call fcn.140001818
mov rcx, rbx
call fcn.140001634
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140001160
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x11c
call fcn.140003f80
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x34], 0xa
jne 0x1400011d9
cmp dword [rsp + 0x3c], 0x2800
je 0x1400011d9
xorps xmm0, xmm0
lea rdx, [0x1400041a0]
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov ecx, dword [rax + 3]
test ecx, ecx
lea eax, [rcx - 8]
cmove eax, ecx
jmp 0x1400011db
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140003a20
add rsp, 0x168
ret
Function at 0x1400013c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
call fcn.140003f80
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x24], 0xa
jb 0x1400014d8
call fcn.140001160
mov eax, eax
mov rsi, qword [rax + rsi]
mov rdi, qword [rax + rdi]
movzx eax, word [rsi + 0x58]
movzx ecx, word [rsi + 0x5a]
cmp word [rdi + 0x58], ax
jb 0x140001452
mov r8d, ecx
xor edx, edx
mov rcx, qword [rdi + 0x60]
call fcn.140003f80
movzx r8d, word [rsi + 0x58]
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rdi + 0x60]
call fcn.140003cc0
mov rbp, qword [rdi + 0x60]
jmp 0x140001485
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.140003f80
movzx r8d, word [rsi + 0x58]
mov rcx, rbp
mov rdx, qword [rsi + 0x60]
call fcn.140003cc0
mov qword [rdi + 0x60], rbp
movzx ecx, word [rsi + 0x5a]
mov word [rdi + 0x5a], cx
movzx eax, word [rsi + 0x58]
mov word [rdi + 0x58], ax
mov rbx, qword [rdi + 0x20]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400014c8
cmp word [rbx + 0x10], 0
je 0x1400014c8
cmp word [rbx + 0x12], 0
je 0x1400014c8
mov qword [rbx + 0x18], rbp
movzx eax, word [rdi + 0x58]
mov word [rbx + 0x10], ax
movzx eax, word [rdi + 0x5a]
mov word [rbx + 0x12], ax
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140003a20
mov rbx, qword [rsp + 0x180]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000263c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, dword [rcx + 0x20]
mov rdi, rcx
mov ecx, 0x400
mov r8d, 0x7a617a
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140006050], rax
test rax, rax
jne 0x140002673
mov eax, 0xc0000001
jmp 0x140002736
lea rax, [0x140002360]
sub eax, dword [rdi + 0x18]
lea rbx, [0x140002780]
mov dword [0x140006058], eax
lea rax, [0x140002360]
sub eax, dword [rdi + 0x18]
mov dword [0x14000605c], eax
lea rax, [0x140002380]
sub eax, dword [rdi + 0x18]
mov dword [0x140006064], eax
lea rax, [0x140002750]
mov r8d, dword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
sub ebx, dword [rdi + 0x18]
mov qword [rdi + 0x68], rax
mov rcx, qword [0x140006050]
call fcn.140003cc0
mov rcx, qword [0x140006050]
xor edx, edx
mov r8d, 0x1000
call fcn.140003f80
xorps xmm0, xmm0
lea rdx, [0x140004220]
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, ebx
lea rcx, [rsp + 0x20]
add rdx, qword [0x140006050]
call sub.ntoskrnl.exe_IoCreateDriver
test eax, eax
jns 0x140002728
mov rcx, qword [0x140006050]
mov edx, 0x7a617a
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140002669
lea rcx, [0x140004240]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140002880
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
xorps xmm0, xmm0
and qword [rbp - 0x48], 0
mov rbx, r8
mov eax, edx
lea rdx, [rbp - 0x50]
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x40], rax
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400028e1
lea rcx, [0x140004270]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140002943
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r9, [rbp - 0x40]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rbp - 0x48]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000291f
mov rax, qword [rbp - 0x48]
mov qword [rbx], rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rbp - 0x48]
neg rax
sbb eax, eax
not eax
and eax, 0xc0000001
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003a20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140002960
Capabilities:
Attach user process memory
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x118], rax
movups xmm0, xmmword [rcx]
movdqu xmmword [r11 - 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
movups xmmword [r11 - 0x20], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x98], xmm1
movups xmmword [r11 - 0x80], xmm1
movups xmmword [r11 - 0x70], xmm1
xor edi, edi
mov qword [r11 - 0x98], rdi
movups xmmword [r11 - 0x50], xmm0
mov qword [r11 - 0xa0], rdi
mov byte [rsp + 0x80], dil
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
test al, al
je 0x1400029e2
mov eax, 0xc0000001
jmp 0x140002bac
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rdx, [rsp + 0xe8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x80], 1
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xb0], 0x240
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x98]
mov edx, 0x100181
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
test eax, eax
jns 0x140002aac
mov eax, 0xc0000001
jmp 0x140002bac
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x140002ae2
mov eax, 0xc0000001
jmp 0x140002bac
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], rdi
mov rax, qword [rsp + 0x88]
mov byte [rax + 0x4c], 1
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ebx, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140002b29
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x88], rdi
lea rcx, [rsp + 0xe8]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x80], dil
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
or qword [rsp + 0x90], 0xffffffffffffffff
test ebx, ebx
js 0x140002b5e
xor eax, eax
jmp 0x140002bac
mov eax, 0xc0000001
jmp 0x140002bac
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140003a20
mov rbx, qword [rsp + 0x138]
add rsp, 0x120
pop rdi
ret

Function at 0x140002bd0
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rbx, rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call section..text
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140002c00
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
xorps xmm0, xmm0
and qword [rbp - 0x48], 0
mov qword [rbp - 0x40], rdx
lea rdx, [rbp - 0x50]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002c59
lea rcx, [0x140004270]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140002c97
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9d, 0x8000
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x40]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
lea rcx, [rbp - 0x38]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003a20
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret
Function at 0x140002cb4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp - 8], rax
movups xmm0, xmmword [rdx]
xor edi, edi
lea rdx, [rbp - 0x60]
mov r14, r8
mov qword [rbp - 0x60], rdi
movdqu xmmword [rbp - 0x48], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rbp - 0x60]
mov r15d, eax
test rcx, rcx
jne 0x140002d1c
mov eax, 0xc0000001
jmp 0x140002e05
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rcx, qword [rbp - 0x60]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp - 0x60]
test rbx, rbx
je 0x140002d9e
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rsi, rax
mov ecx, dword [rax + 0xc]
add rcx, 0xc
mov ebx, dword [rcx]
cmp rbx, rcx
je 0x140002df5
mov ecx, dword [rbx + 0x30]
test ecx, ecx
je 0x140002d89
mov edx, ecx
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140002d99
mov eax, dword [rsi + 0xc]
mov ebx, dword [rbx]
add rax, 0xc
cmp rbx, rax
jne 0x140002d61
jmp 0x140002df5
mov edi, dword [rbx + 0x18]
jmp 0x140002df5
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rsi, rax
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x140002df5
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x140002ddf
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140002df1
mov rax, qword [rsi + 0x18]
mov rbx, qword [rbx]
add rax, 0x10
cmp rbx, rax
jne 0x140002db7
jmp 0x140002df5
mov rdi, qword [rbx + 0x30]
lea rcx, [rbp - 0x38]
mov qword [r14], rdi
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, r15d
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003a20
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret