joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x140007cec
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.140011b60
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140007cb0
sub eax, ebx
jmp 0x140007cb2
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x140007ca0
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140007ce0
sub eax, ebx
jmp 0x140007ce2
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x140007cd0
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x140007d66
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140007840
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x140007d50
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x140007d66
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x140007c50
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d310
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov dword [rdx], 0x12345678
mov dword [rdx + 4], 0x23456789
mov dword [rdx + 8], 0x34567890
movzx eax, byte [rcx]
mov r11, r8
mov r9, rdx
mov r10, rcx
test al, al
je 0x14000d393
nop word [rax + rax]
mov r8d, dword [r9]
inc r10
mov rdx, r8
shr r8d, 8
xor rdx, rax
movzx eax, dl
mov edx, dword [r9 + 8]
mov ecx, dword [r11 + rax*4]
xor ecx, r8d
movzx eax, cl
mov dword [r9], ecx
add eax, dword [r9 + 4]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [r9 + 4], eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
mov dword [r9 + 8], eax
mov al, byte [r10]
test al, al
jne 0x14000d340
repz ret
Function at 0x14000fbc0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40e8], 0
mov rbx, rcx
je 0x14000fc83
xor r11d, r11d
cmp dword [rcx + 0xbc], r11d
jbe 0x14000fc83
lea r10, [rcx + 0xe0]
nop dword [rax]
movzx eax, byte [r10]
mov r8, qword [rbx + 0x40f8]
mov edx, dword [rbx + 0x40ec]
mov r9d, dword [rbx + 0x40f4]
xor rax, rdx
shr edx, 8
movzx ecx, al
and r9d, 0xfffd
inc r11d
mov eax, dword [r8 + rcx*4]
or r9d, 2
inc r10
xor eax, edx
mov edx, dword [rbx + 0x40f4]
mov dword [rbx + 0x40ec], eax
movzx eax, al
add eax, dword [rbx + 0x40f0]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [rbx + 0x40f0], eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r8 + rax*4]
xor eax, edx
mov dword [rbx + 0x40f4], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor byte [r10 - 1], al
cmp r11d, dword [rbx + 0xbc]
jb 0x14000fbf0
mov r9d, dword [rbx + 0xbc]
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
lea r8, [rbx + 0xe0]
call qword [rbx + 0x10]
xor ecx, ecx
or edx, 0xffffffff
cmp eax, dword [rbx + 0xbc]
mov dword [rbx + 0xbc], 0
cmovne ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14001105c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140014948
nop
cmp dword [0x140032d48], 1
je 0x140011008
mov dword [0x140032d44], 1
mov byte [0x140032d40], r12b
test ebx, ebx
jne 0x140010ff4
mov rcx, qword [0x140034d70]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140010fe1
mov rcx, qword [0x140034d68]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140010f80
call fcn.140014178
cmp qword [rdi], rax
jne 0x140010f80
jmp 0x140010f66
cmp rdi, rsi
jb 0x140010fe1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140014178
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140034d70]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140034d68]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140010fbf
cmp r13, rax
je 0x140010fdf
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140010f66
lea rdx, [0x140020310]
lea rcx, [0x1400202f8]
call fcn.140010db0
lea rdx, [0x140020320]
lea rcx, [0x140020318]
call fcn.140010db0
nop
test r12d, r12d
je 0x140011017
mov ecx, 8
call fcn.140014848
test r12d, r12d
jne 0x140011042
mov dword [0x140032d48], 1
lea ecx, [r12 + 8]
call fcn.140014848
mov ecx, r15d
call fcn.140010d44
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140010ed0
Function at 0x140011068
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140010ed0

Function at 0x1400120b8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400120ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400120d0
xor eax, eax
test eax, eax
je 0x1400120e0
mov ecx, eax
call fcn.14001296c
or eax, 0xffffffff
jmp 0x1400120e2
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400153db
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140031318]
jne 0x14001124a
rol rcx, 0x10
test cx, 0xffff
jne 0x140011246
repz ret
ror rcx, 0x10
jmp 0x140015334
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400333e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400334d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400153b9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400333e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400153db
mov rax, qword [rsp + 0x88]
mov qword [0x1400334d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140033478], rax
mov rax, qword [0x1400334d8]
mov qword [0x140033350], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140033460], rax
mov dword [0x140033340], 0xc0000409
mov dword [0x140033344], 1
mov rax, qword [0x140031318]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140031320]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400333d8], eax
mov ecx, 1
call fcn.140019e3c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002ce60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400333d8], 0
jne 0x140015462
mov ecx, 1
call fcn.140019e3c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140019e44
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140014178
xor ebx, ebx
mov rdi, rax
cmp qword [0x140033a20], rbx
jne 0x140019f4a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001a01f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001a01f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140033a20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140033a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140033a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140033a40], rax
test rax, rax
je 0x140019f41
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140033a38], rax
jmp 0x140019f51
mov rax, qword [0x140033a38]
jmp 0x140019f58
mov rax, qword [0x140033a38]
mov r11, qword [0x140033a40]
cmp rax, rdi
je 0x140019fc0
cmp r11, rdi
je 0x140019fc0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140033a40]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140019fc0
test rax, rax
je 0x140019fc0
call rsi
test rax, rax
je 0x140019fba
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140019fba
test byte [rsp + 0x38], 1
jne 0x140019fc0
bts ebp, 0x15
jmp 0x140019ffe
mov rcx, qword [0x140033a28]
cmp rcx, rdi
je 0x140019ffe
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140019ffe
call rax
mov rbx, rax
test rax, rax
je 0x140019ffe
mov rcx, qword [0x140033a30]
cmp rcx, rdi
je 0x140019ffe
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140019ffe
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140033a20]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001a01f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001a021
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400388f0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x140038922
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400389ca
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x140038966
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400389b5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140038982
mov dword [rsp + 0x1c], 1
jmp 0x14003898a
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400389b3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14003895c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x140038918
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret
Function at 0x140018530
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xa0]
call fcn.140029000
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14001864a
cmp qword [rsp + 0x40], 0
je 0x14001864a
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0x30]
call fcn.140028d00
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140018618
mov r9d, 0x8000
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x140018618
mov byte [rsp + 0x20], 1
jmp 0x14001863f
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp qword [rsp + 0x28], 0
je 0x14001865d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006f370
add rsp, 0x90
pop rdi
ret

Function at 0x14001a7ca
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x50]
mov r8d, 0x1d0
lea rdx, [0x140072000]
lea rcx, [0x140072070]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x140096630]
mov qword [rsp + 0x70], rax
mov edx, dword [rsp + 0x98]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x70]
call qword [0x1400836c0]
jmp 0x14001a81a
add rsp, 0x88
ret
Function at 0x140025650
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
je 0x140025675
mov rcx, qword [rsp + 0x70]
call sub.ntoskrnl.exe_strlen
test rax, rax
ja 0x14002567c
xor eax, eax
jmp 0x140025868
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x78], 0
je 0x1400256a1
mov rax, qword [rsp + 0x78]
mov dword [rax], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
xor r8d, r8d
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xc0000004
je 0x1400256f4
mov r9d, dword [rsp + 0x28]
mov r8d, 0xe61
lea rdx, [0x140073f00]
lea rcx, [0x140073f10]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x38]
jmp 0x140025868
mov eax, dword [rsp + 0x24]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14002573d
mov r9d, dword [rsp + 0x24]
mov r8d, 0xe67
lea rdx, [0x140073f00]
lea rcx, [0x140073f60]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x38]
jmp 0x140025868
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x140025797
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r9d, dword [rsp + 0x28]
mov r8d, 0xe6e
lea rdx, [0x140073f00]
lea rcx, [0x140073fb0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x38]
jmp 0x140025868
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov dword [rsp + 0x20], 0
jmp 0x1400257bb
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x14002584c
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14002a100
movzx eax, al
test eax, eax
je 0x140025847
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x78], 0
je 0x140025845
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax + 0x20]
mov dword [rcx], eax
jmp 0x14002584c
jmp 0x1400257b1
jmp 0x14002584e
cmp qword [rsp + 0x30], 0
je 0x140025863
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x38]
add rsp, 0x68
ret
Function at 0x140026d60
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0xc0], 0
je 0x140026da3
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x140026dbf
xor eax, eax
jmp 0x140026fd6
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140026df3
xor eax, eax
jmp 0x140026fd6
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x40]
add rax, 0x20
mov qword [rsp + 0x30], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
je 0x140026faa
mov rax, qword [rsp + 0x28]
sub rax, 0x10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, 0x58
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x20]
add rax, 0x60
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x20]
add rax, 0x30
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x140026f82
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
mov qword [rax], rcx
jmp 0x140026faa
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
jmp 0x140026e8d
jmp 0x140026fc6
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14006f370
add rsp, 0xa0
pop rdi
ret
Function at 0x140026ff0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400941b0]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0xc0], 0
je 0x140027033
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x14002704f
xor eax, eax
jmp 0x140027262
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140027083
xor eax, eax
jmp 0x140027262
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov qword [rsp + 0x40], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x30], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
je 0x140027236
mov rax, qword [rsp + 0x28]
sub rax, 8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, 0x2c
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x20]
add rax, 0x30
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x20]
add rax, 0x20
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x30]
mov edx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x14002720f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0xc0]
mov qword [rcx], rax
jmp 0x140027236
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, 8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
jmp 0x14002711b
jmp 0x140027252
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14006f370
add rsp, 0xa0
pop rdi
ret