joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400500f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov ecx, 0x20
call fcn.14004fe20
mov rcx, qword [0x1400992d0]
mov qword [rcx + 8], rax
mov rax, qword [0x1400992d0]
cmp qword [rax + 8], 0
jne 0x140050137
mov r8d, 0x7a
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a5d0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
mov edx, 0x20
mov rax, qword [0x1400992d0]
mov rcx, qword [rax + 8]
call fcn.140024a10
mov ecx, 0xa0
call fcn.14004fe20
mov rcx, qword [0x1400992d0]
mov rcx, qword [rcx + 8]
mov qword [rcx], rax
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
cmp qword [rax], 0
jne 0x140050195
mov r8d, 0x82
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a600]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov edx, 0xa0
mov rcx, qword [rax]
call fcn.140024a10
mov ecx, 0x10
call fcn.14004fe20
mov rcx, qword [0x1400992d0]
mov rcx, qword [rcx + 8]
mov qword [rcx + 8], rax
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
cmp qword [rax + 8], 0
jne 0x1400501f8
mov r8d, 0x8a
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a630]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov edx, 0x10
mov rcx, qword [rax + 8]
call fcn.140024a10
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 8]
call fcn.14000b370
mov r8d, 3
mov edx, 0x64
mov ecx, 0x2000
call fcn.1400505d0
movzx eax, al
test eax, eax
jne 0x140050261
mov r8d, 0x93
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a670]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
mov r8d, 1
mov edx, 0x64
mov ecx, 0x2000
call fcn.1400505d0
movzx eax, al
test eax, eax
jne 0x14005029a
mov r8d, 0x99
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a670]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
mov r8d, 2
mov edx, 0x64
mov ecx, 0x64
call fcn.1400505d0
movzx eax, al
test eax, eax
jne 0x1400502d3
mov r8d, 0x9f
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a670]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
mov r8d, 4
mov edx, 0x64
mov ecx, 0x38
call fcn.1400505d0
movzx eax, al
test eax, eax
jne 0x14005030c
mov r8d, 0xa5
lea rdx, [0x14007a5c0]
lea rcx, [0x14007a670]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140050311
call fcn.140050390
add rsp, 0x28
ret
Function at 0x140050390
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 1
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
movzx eax, byte [rax + 0x18]
test eax, eax
jne 0x1400503cf
mov r8d, 0x4f
lea rdx, [0x14007a530]
lea rcx, [0x14007a550]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x1400504f8
mov qword [rsp + 0x28], 0
jmp 0x1400503e7
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xa
jae 0x1400504e4
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
cmp qword [rax + rcx*8], 0
je 0x1400504df
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [0x1400992d0]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
mov rdx, qword [0x1400992d0]
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
mov r8, qword [rsp + 0x28]
mov r8d, dword [rax + r8*4 + 0x78]
mov rax, qword [rsp + 0x28]
mov edx, dword [rcx + rax*4 + 0x50]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax*8]
call fcn.14004fe80
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14005048e
mov r8d, 0x60
lea rdx, [0x14007a530]
lea rcx, [0x14007a580]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400504e4
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov qword [rax + rcx*8], 0
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov dword [rax + rcx*4 + 0x50], 0
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov dword [rax + rcx*4 + 0x78], 0
jmp 0x1400503da
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 8]
mov byte [rax + 0x18], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140054c50
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov ecx, 0x28
call fcn.140054c20
mov qword [0x1400992d0], rax
cmp qword [0x1400992d0], 0
jne 0x140054cba
mov r8d, 0xb3
lea rdx, [0x14007ab30]
lea rcx, [0x14007ab50]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140054e8a
mov dword [rsp + 0x20], 1
mov edx, 0x28
mov rcx, qword [0x1400992d0]
call fcn.140024a10
mov cx, 0xffff
call qword [sym.imp.ntoskrnl.exe_KeQueryActiveProcessorCountEx]
mov rcx, qword [0x1400992d0]
mov dword [rcx + 0x18], eax
mov rax, qword [0x1400992d0]
mov eax, dword [rax + 0x18]
shl rax, 3
mov rcx, rax
call fcn.140054c20
mov rcx, qword [0x1400992d0]
mov qword [rcx], rax
mov rax, qword [0x1400992d0]
cmp qword [rax], 0
jne 0x140054d34
mov r8d, 0xbf
lea rdx, [0x14007ab30]
lea rcx, [0x14007ab90]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140054e8a
mov dword [rsp + 0x20], 2
mov rax, qword [0x1400992d0]
mov eax, dword [rax + 0x18]
shl rax, 3
mov rdx, rax
mov rax, qword [0x1400992d0]
mov rcx, qword [rax]
call fcn.140024a10
mov ecx, 0x990
call fcn.140054c20
mov rcx, qword [0x1400992d0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400992d0]
cmp qword [rax + 0x10], 0
jne 0x140054d9f
mov r8d, 0xca
lea rdx, [0x14007ab30]
lea rcx, [0x14007abd0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140054e8a
mov dword [rsp + 0x20], 3
mov edx, 0x990
mov rax, qword [0x1400992d0]
mov rcx, qword [rax + 0x10]
call fcn.140024a10
mov rax, qword [0x1400992d0]
mov rax, qword [rax + 0x10]
mov rcx, rax
call fcn.14000b370
call fcn.140049cd0
mov dword [rsp + 0x20], 4
call fcn.1400500f0
movzx eax, al
test eax, eax
jne 0x140054def
xor al, al
jmp 0x140054e8a
mov dword [rsp + 0x20], 5
call fcn.14004c010
movzx eax, al
test eax, eax
jne 0x140054e0a
xor al, al
jmp 0x140054e8a
mov dword [rsp + 0x20], 6
mov rax, qword [0x1400992d0]
mov byte [rax + 0x20], 1
xor eax, eax
xor ecx, ecx
cpuid
lea rdi, [rsp + 0x28]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov rax, qword [0x1400992d0]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x1c], ecx
mov al, 1
jmp 0x140054e8a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x1400551f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14004d120
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [0x1400992d0]
mov rcx, qword [rcx]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14005523f
mov r8d, 0x192
lea rdx, [0x14007aea0]
lea rcx, [0x14007aec0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140055320
call fcn.140054ac0
mov rax, qword [rsp + 0x30]
add rax, 0x20
vmxon qword [rax]
sete al
setb cl
adc al, cl
movzx eax, al
test eax, eax
je 0x140055283
mov r9d, dword [rsp + 0x24]
mov r8d, 0x19b
lea rdx, [0x14007aea0]
lea rcx, [0x14007aef0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140055320
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x60], 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.1400515c0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x68], 1
vmlaunch
sete al
setb cl
adc al, cl
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
mov r9d, eax
mov r8d, 0x1ac
lea rdx, [0x14007aea0]
lea rcx, [0x14007af30]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x68], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x60], 0
vmxoff
jmp 0x140055320
add rsp, 0x48
ret
Function at 0x140055650
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov ecx, 0x480
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x38], 0xffffffffffffffff
mov ecx, 0x1000
call fcn.140054bf0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 8], 0
jne 0x1400556d6
mov r8d, 0x8c
lea rdx, [0x14007aa70]
lea rcx, [0x14007aa80]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x1400557d9
mov dword [rsp + 0x20], 2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
jne 0x14005572c
mov r8d, 0x93
lea rdx, [0x14007aa70]
lea rcx, [0x14007aab0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x1400557d9
mov dword [rsp + 0x20], 3
mov edx, 0x1000
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.140024a10
mov rax, qword [rsp + 0x28]
and rax, 0x7fffffff
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
btr eax, 0x1f
mov ecx, dword [rcx]
and ecx, 0x80000000
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov eax, dword [rax]
btr eax, 0x1f
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov dword [rcx], eax
mov al, 1
jmp 0x1400557d9
add rsp, 0x40
pop rdi
ret
Function at 0x1400557e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov ecx, 0x480
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x28]
shr rax, 0x20
and rax, 0x1fff
cmp rax, 0x1000
jbe 0x14005584a
mov ecx, 0x1000
call fcn.140054bf0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
jmp 0x14005586a
mov rax, qword [rsp + 0x28]
shr rax, 0x20
and rax, 0x1fff
mov rcx, rax
call fcn.140054bf0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov dword [rsp + 0x20], 2
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x18], 0
jne 0x14005589e
mov r8d, 0x14c
lea rdx, [0x14007ade0]
lea rcx, [0x14007adf0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140055988
mov dword [rsp + 0x20], 3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x20], 0
jne 0x1400558f4
mov r8d, 0x153
lea rdx, [0x14007ade0]
lea rcx, [0x14007ae20]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140055988
mov dword [rsp + 0x20], 4
mov edx, 0x1000
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
call fcn.140024a10
mov rax, qword [rsp + 0x28]
and rax, 0x7fffffff
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov eax, dword [rax]
btr eax, 0x1f
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
mov dword [rcx], eax
mov al, 1
jmp 0x140055988
add rsp, 0x40
pop rdi
ret
Function at 0x1400625b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0
jne 0x1400625da
cmp qword [rsp + 0x48], 0
jne 0x1400625da
xor al, al
jmp 0x140062711
mov byte [rsp + 0x20], 0
mov r8d, 0x6e556353
mov edx, 0x1e0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140062622
mov r8d, 0x61
lea rdx, [0x14007d650]
lea rcx, [0x14007d670]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x140062711
mov edx, 0x1e0
mov rcx, qword [rsp + 0x28]
call fcn.140024a10
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0xf0], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0xf8], rcx
cmp qword [rsp + 0x50], 0
je 0x1400626a0
mov rax, qword [rsp + 0x28]
add rax, 0x12c
mov r8d, 0x2c
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call fcn.14006fb00
jmp 0x1400626a0
lea rcx, [0x1400a41f8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rax, qword [rsp + 0x28]
mov rdx, rax
lea rcx, [0x1400a4230]
call fcn.14000b3a0
mov rax, qword [rsp + 0x28]
add rax, 0x10
mov rcx, rax
call fcn.14000b370
mov rax, qword [rsp + 0x28]
add rax, 0xa0
mov rcx, rax
call fcn.14000b370
mov rax, qword [rsp + 0x28]
add rax, 0xd8
mov rcx, rax
call fcn.14000b370
lea rcx, [0x1400a41f8]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov byte [rsp + 0x20], 1
jmp 0x14006270c
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400630b0
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, byte [0x1400a4240]
test eax, eax
jne 0x1400630cf
xor al, al
jmp 0x14006319a
mov byte [rsp + 0x20], 0
cmp dword [rsp + 0x58], 0x1c
jge 0x1400630e2
cmp dword [rsp + 0x58], 0
jge 0x140063105
mov r8d, 0x333
lea rdx, [0x14007d7c0]
lea rcx, [0x14007d7d0]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x14006319a
lea rcx, [0x1400a4230]
call fcn.14000b420
movzx eax, al
test eax, eax
je 0x14006311c
mov rax, qword [0x1400a4230]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a4230]
cmp qword [rsp + 0x28], rax
je 0x140063193
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x30], 0
jne 0x140063157
jmp 0x140063128
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
cmp qword [rax + 0xf8], rcx
jne 0x140063191
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0xf8], 0
je 0x140063191
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax + 0x110]
mov byte [rsp + 0x20], al
jmp 0x140063193
jmp 0x140063128
jmp 0x140063195
movzx eax, byte [rsp + 0x20]
Function at 0x1400637d0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x70], 0
je 0x14006380e
cmp qword [rsp + 0x78], 0
je 0x14006380e
cmp qword [rsp + 0x80], 0
jne 0x140063818
mov eax, 0xffffffff
jmp 0x1400638ce
cmp qword [rsp + 0x80], 1
jbe 0x14006382d
mov eax, 0xfffffffe
jmp 0x1400638ce
mov dword [rsp + 0x20], 0x100
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140063875
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov dword [rsp + 0x20], eax
jmp 0x14006389c
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [rsp + 0x20], 0x100
jne 0x1400638b8
mov eax, 0xfffffffd
jmp 0x1400638ce
cmp dword [rsp + 0x20], 0xcc
jne 0x1400638c9
mov eax, 1
jmp 0x1400638ce
mov eax, 2
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x60
pop rdi
ret

Function at 0x1400638f0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0xa0], 0
je 0x14006392a
cmp qword [rsp + 0xa8], 0
jne 0x140063931
xor eax, eax
jmp 0x140063a03
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 4
jae 0x140063953
xor eax, eax
jmp 0x140063a03
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400639aa
xor eax, eax
jmp 0x140063a03
mov rax, qword [rsp + 0x28]
shr rax, 0xc
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call fcn.140049bd0
mov qword [rsp + 0x38], rax
jmp 0x1400639f3
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x90
pop rdi
ret
Function at 0x140063a20
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.140063580
movzx eax, byte [0x1400a4241]
test eax, eax
jne 0x140063a55
xor al, al
jmp 0x140063ba5
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140063bc0
test rax, rax
je 0x140063a76
mov al, 1
jmp 0x140063ba5
mov dword [rsp + 0x20], 0x100
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140063ac7
mov rax, qword [rsp + 0x88]
movzx eax, byte [rax]
mov dword [rsp + 0x20], eax
jmp 0x140063aee
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [rsp + 0x20], 0x100
jne 0x140063b0a
xor al, al
jmp 0x140063ba5
mov r8d, 0x6e556353
mov edx, 0x28
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140063b2e
xor al, al
jmp 0x140063ba5
mov edx, 0x28
mov rcx, qword [rsp + 0x28]
call fcn.140024a10
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x20]
mov byte [rax + 0x20], cl
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x21], 0xcc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400a4258]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rax, qword [rsp + 0x28]
mov rdx, rax
lea rcx, [0x1400a4248]
call fcn.14000b3a0
lea rcx, [0x1400a4258]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x70
pop rdi
ret
Function at 0x14006be50
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0xc0000001
mov dword [rsp + 0x24], 0
call fcn.140061750
cmp dword [rax], 0x47ba
jae 0x14006bea7
mov r8d, 0xd
lea rdx, [0x14007e0d0]
lea rcx, [0x14007e0f0]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x14006c093
lea r9, [rsp + 0x24]
xor r8d, r8d
xor edx, edx
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x24]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14006bee7
movzx eax, byte [rsp + 0x20]
jmp 0x14006c093
mov eax, dword [rsp + 0x24]
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.140024a10
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x38]
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006c052
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
jmp 0x14006bf43
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
test rax, rax
je 0x14006c052
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x50]
call fcn.140029000
cmp rax, qword [rsp + 0x80]
jne 0x14006c04d
mov qword [rsp + 0x48], 0
jmp 0x14006bf87
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 4]
cmp qword [rsp + 0x48], rax
jae 0x14006c04b
mov qword [rsp + 0x58], 0
imul rax, qword [rsp + 0x48], 0x50
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006bfd6
mov dword [rsp + 0x40], 1
jmp 0x14006bfde
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x40], 1
jne 0x14006c046
call fcn.140061760
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax]
btr eax, 0x15
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rsp + 0x20], 1
jmp 0x14006c03b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14006bf7a
jmp 0x14006c052
jmp 0x14006bf2c
jmp 0x14006c079
cmp qword [rsp + 0x38], 0
je 0x14006c08e
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movzx eax, byte [rsp + 0x20]
add rsp, 0x78
ret
Function at 0x14006c0a0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x21], 0
cmp qword [rsp + 0xa0], 0
jne 0x14006c0d9
movzx eax, byte [rsp + 0x21]
jmp 0x14006c24b
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x14006c1ae
mov qword [rsp + 0x28], 0
jmp 0x14006c148
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x88]
cmp qword [rsp + 0x28], rax
jae 0x14006c1ae
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x90]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
add eax, 0x40
mov eax, eax
mov eax, dword [rax]
and eax, 0xafffff9f
mov ecx, dword [rsp + 0x24]
add ecx, 0x40
mov ecx, ecx
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
add eax, 0x44
mov eax, eax
mov eax, dword [rax]
and eax, 0xbfffff9f
mov ecx, dword [rsp + 0x24]
add ecx, 0x44
mov ecx, ecx
mov dword [rcx], eax
mov byte [rsp + 0x20], 1
jmp 0x14006c13b
cmp qword [rsp + 0x48], 0
je 0x14006c22b
mov qword [rsp + 0x30], 0
jmp 0x14006c1ce
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0xe8]
cmp qword [rsp + 0x30], rax
jae 0x14006c22b
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0xf0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x70]
and eax, 0xafffff9f
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 0x70], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x74]
and eax, 0xbfffff9f
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 0x74], eax
mov byte [rsp + 0x20], 1
jmp 0x14006c1c1
jmp 0x14006c232
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x90
pop rdi
ret