joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800051f0
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2f8
mov dword [rsp + 0xd0], 0xc0000001
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x88], rax
xor eax, eax
mov word [rsp + 0x80], ax
mov eax, 0x208
mov word [rsp + 0x82], ax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.180014bb0
mov r8d, 6
lea rdx, str.system
mov rcx, qword [rsp + 0x300]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 6
jne 0x180005290
lea rdx, str.DosDevicesc:windows_
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
mov dword [rsp + 0xd0], eax
jmp 0x1800052ac
lea rdx, [0x180016740]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
mov dword [rsp + 0xd0], eax
mov rdx, qword [rsp + 0x300]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa8], 0x40
lea rax, [rsp + 0x80]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x90]
mov edx, 0x80000000
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0xd0], 0
jl 0x180005481
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0xd0], 0
jl 0x180005481
mov rcx, qword [rsp + 0x310]
mov eax, dword [rsp + 0x68]
mov dword [rcx], eax
mov rax, qword [rsp + 0x310]
mov edx, dword [rax]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r11, rax
mov rax, qword [rsp + 0x308]
mov qword [rax], r11
mov rax, qword [rsp + 0x310]
mov r8d, dword [rax]
xor edx, edx
mov rcx, qword [rsp + 0x308]
mov rcx, qword [rcx]
call fcn.180014bb0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x310]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x308]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0xd0], 0
jl 0x180005481
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0xd0]
jmp 0x180005488
mov eax, dword [rsp + 0xd0]
add rsp, 0x2f8
ret
Function at 0x180005740
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov dword [rsp + 0xb8], 0xc0000001
lea rdx, str.__C:WINDOWS_system32drivers_acpi.sys
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0x40
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jl 0x18000586b
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jl 0x18000586b
mov rcx, qword [rsp + 0x100]
mov eax, dword [rsp + 0xc4]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0xb8]
add rsp, 0xf8
ret
Function at 0x180006060
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0xc0]
call fcn.180005880
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180006254
mov dword [rsp + 0x78], 0
lea rdi, [rsp + 0x7c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
lea rdi, [rsp + 0x64]
xor eax, eax
mov ecx, 0x14
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jl 0x1800061fd
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0
jne 0x180006132
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
jmp 0x180006258
movsxd rdx, dword [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x98], rax
movsxd r8, dword [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.180014bb0
mov dword [rsp + 0x90], 0
lea rdi, [rsp + 0x94]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jl 0x1800061db
jmp 0x1800061fd
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
jmp 0x180006258
mov rcx, qword [rsp + 0x58]
call fcn.180005a20
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x180006223
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x50]
jmp 0x180006258
mov rcx, qword [rsp + 0x58]
call fcn.180005c20
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x180006249
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x50]
jmp 0x180006258
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x50]
add rsp, 0xb0
pop rdi
ret
Function at 0x180008dc0
Capabilities:
Get file attributes

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov qword [rsp + 0xb8], 0xffffffffffffffff
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0x40
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x4021
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x88]
mov edx, 0x100001
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jne 0x180008f57
cmp qword [rsp + 0xb8], 0xffffffffffffffff
je 0x180008f57
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 3
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
je 0x180008f57
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0xb8], 0xffffffffffffffff
mov rax, qword [rsp + 0xb8]
add rsp, 0xd8
ret

Function at 0x180008f70
Capabilities:
Get file attributes

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], 3
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jne 0x180008fea
mov al, 1
jmp 0x180008fec
xor al, al
add rsp, 0x88
ret
Function at 0x180009f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xc0000034
je 0x180009fe3
cmp dword [rsp + 0x38], 0
jne 0x180009fea
xor al, al
jmp 0x18000a090
mov edx, dword [rsp + 0x38]
mov r8d, 0x6f6a386b
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x30]
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x18000a03d
xor al, al
jmp 0x18000a090
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 4
jne 0x18000a07a
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 8]
cmp rax, 4
jne 0x18000a07a
mov rax, qword [rsp + 0x30]
add rax, 0xc
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x80]
cmp dword [rcx], eax
je 0x18000a078
xor al, al
jmp 0x18000a090
jmp 0x18000a07e
xor al, al
jmp 0x18000a090
mov edx, 0x6f6a386b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, 1
add rsp, 0x68
ret
Function at 0x18000e270
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
cmp dword [0x180018720], 0
je 0x18000e28d
mov eax, dword [0x180018720]
jmp 0x18000e397
mov dword [rsp + 0x30], 0x11c
lea rdi, [rsp + 0x34]
xor eax, eax
mov ecx, 0x118
rep stosb byte [rdi], al
mov qword [rsp + 0x150], 0
lea rdx, str.RtlGetVersion
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x18000e2ed
lea rcx, [rsp + 0x30]
call qword [rsp + 0x150]
jmp 0x18000e305
xor r9d, r9d
lea r8, [rsp + 0x3c]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x34]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x34], 5
jne 0x18000e31f
cmp dword [rsp + 0x38], 1
jne 0x18000e31f
mov dword [0x180018720], 0x33
jmp 0x18000e391
cmp dword [rsp + 0x34], 6
jne 0x18000e339
cmp dword [rsp + 0x38], 1
jne 0x18000e339
mov dword [0x180018720], 0x3d
jmp 0x18000e391
cmp dword [rsp + 0x34], 6
jne 0x18000e353
cmp dword [rsp + 0x38], 2
jne 0x18000e353
mov dword [0x180018720], 0x3e
jmp 0x18000e391
cmp dword [rsp + 0x34], 6
jne 0x18000e36d
cmp dword [rsp + 0x38], 3
jne 0x18000e36d
mov dword [0x180018720], 0x3f
jmp 0x18000e391
cmp dword [rsp + 0x34], 0xa
jne 0x18000e387
cmp dword [rsp + 0x38], 0
jne 0x18000e387
mov dword [0x180018720], 0x64
jmp 0x18000e391
mov dword [0x180018720], 0x64
mov eax, dword [0x180018720]
add rsp, 0x160
pop rdi
ret
Function at 0x180010d90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0x30
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [0x180010e30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0x1fffff
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
add rsp, 0x88
ret
Function at 0x180011680
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x6f6a386b
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x180018848], rax
xor eax, eax
mov word [0x180018840], ax
mov eax, 0x104
mov word [0x180018842], ax
mov r8d, 0x104
xor edx, edx
mov rcx, qword [0x180018848]
call fcn.180014bb0
mov r8d, 0x6f6a386b
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x50], rax
xor eax, eax
mov word [rsp + 0x48], ax
mov eax, 0x104
mov word [rsp + 0x4a], ax
mov r8d, 0x104
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.180014bb0
lea rdx, [0x1800172b4]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [0x180018840]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x48]
call fcn.1800125f0
lea rdx, [rsp + 0x48]
lea rcx, [0x180018840]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea r11, [0x180018808]
mov qword [rsp + 0x30], r11
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [0x180018840]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x180011795
mov eax, dword [rsp + 0x68]
jmp 0x1800117e5
mov rax, qword [0x180018808]
mov ecx, dword [rax + 0x30]
or ecx, 4
mov rax, qword [0x180018808]
mov dword [rax + 0x30], ecx
mov dword [rsp + 0x40], 0
jmp 0x1800117c1
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x1b
jge 0x1800117e3
movsxd rdx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
lea rax, [0x1800119b0]
mov qword [rcx + rdx*8 + 0x70], rax
jmp 0x1800117b6
xor eax, eax
add rsp, 0x78
ret
Function at 0x1800117f0
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x70], 0
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, str.DeviceTcp
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r11, qword [rsp + 0xa0]
mov qword [rsp + 0x30], r11
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jge 0x180011881
mov eax, dword [rsp + 0x70]
jmp 0x180011937
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x40]
mov edx, 0x1f01ff
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
mov dword [rsp + 0x70], eax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov r11, rax
mov rax, qword [rsp + 0xa8]
mov qword [rax], r11
cmp dword [rsp + 0x70], 0
jge 0x1800118e2
mov eax, dword [rsp + 0x70]
jmp 0x180011937
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov eax, dword [rax + 0x30]
and eax, 0x14
mov ecx, dword [rcx + 0x30]
or ecx, eax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov ecx, dword [rax + 0x30]
and ecx, 0xffffff7f
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov dword [rax + 0x30], ecx
mov eax, dword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x180012ea0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0x80], 0
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x30], rax
lea rax, [0x18000f2f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov edx, 0x1fffff
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov r11, qword [rsp + 0x100]
mov qword [rsp + 0x30], r11
lea rax, [0x18000f380]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x88]
mov edx, 0x1fffff
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov r11, qword [rsp + 0x100]
mov qword [rsp + 0x30], r11
lea rax, [0x18000eb90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0x1fffff
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
add rsp, 0xf8
ret

Function at 0x180013130
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
lea rdx, str.__C:log.txt
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0x40
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jl 0x180013263
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xd8
ret
Function at 0x1800148a0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1800148e9
xor al, al
jmp 0x1800149ab
cmp qword [rsp + 0x20], 0
je 0x180014903
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x18001490a
xor al, al
jmp 0x1800149ab
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r11, rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
cmp r11, qword [rax]
jne 0x180014957
mov rax, qword [rsp + 0x28]
or rax, 0xffffffff80000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
xor r8d, r8d
lea rdx, [rsp + 0x64]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObSetHandleAttributes]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1800149a3
xor al, al
jmp 0x1800149ab
jmp 0x1800149a9
mov al, 1
add rsp, 0x78
ret
Function at 0x140007bb0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
xor eax, eax
lock cmpxchg dword [0x14023704c], ebx
je 0x140007c7c
mov eax, ebx
xchg dword [0x14023704c], eax
mov eax, 1
xchg dword [0x140237124], eax
call fcn.14000bc70
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400095d0
lea ecx, [rbx + 1]
call fcn.14000b7f0
call fcn.140008d20
lea rcx, [0x14023f2c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lock and dword [0x140237300], 0xfffffffe
lock and dword [0x140237300], 0xffffffef
mov eax, ebx
lea rcx, [0x14023f2c8]
xchg dword [0x14023ae9c], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
xchg dword [0x140237050], eax
test eax, eax
jne 0x140007c48
lea rcx, str.dbgEngineStore:___Has_not_started_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xchg qword [0x14023f308], rbx
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140007c69
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
lea rcx, [0x140237020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add rsp, 0x20
pop rbx
ret

Function at 0x140007c90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, ecx
xor eax, eax
lock cmpxchg dword [0x14023704c], ebx
test al, 1
jne 0x140007cc4
lea rcx, str.RfeStopINetInterface:__Filtering_Engine_has_not_been_started
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x1402370f0], ebx
je 0x140007d65
cmp qword [0x1402370c0], rbx
je 0x140007d65
lea rcx, [0x1402370c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rax, [0x1402370a0]
mov rdx, rdi
xchg dword [rax + rdi*4], ebx
lea rcx, [0x1402370c8]
test ebx, ebx
jne 0x140007d13
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1402370c0]
shl rdx, 6
mov dword [rdx + rax + 0x20], 0xb2d05e0
mov rax, qword [0x1402370c0]
mov dword [rdx + rax + 0x24], 0xb2d05e0
lock dec dword [0x140237068]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r9d, r9d
mov dword [rsp + 0x28], 0xb2d05e0
mov edx, edi
mov dword [rsp + 0x20], 0xb2d05e0
mov ecx, 0x120404
lea r8d, [r9 + 2]
call fcn.14000b950
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret