joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001710
Capabilities:
Attach user process memory
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
movups xmmword [r11 - 0x20], xmm0
xorps xmm1, xmm1
movups xmmword [r11 - 0x80], xmm1
movups xmmword [r11 - 0x70], xmm1
movups xmmword [r11 - 0x60], xmm1
xor edi, edi
mov qword [r11 - 0x88], rdi
movups xmmword [r11 - 0x50], xmm0
mov qword [r11 - 0x90], rdi
mov byte [rsp + 0x80], dil
mov rax, cr8
test al, al
je 0x140001789
lea eax, [rdi + 2]
jmp 0x140001948
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rdx, [rsp + 0xd8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov esi, 1
mov byte [rsp + 0x80], sil
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xb0], 0x240
mov qword [rsp + 0xa8], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], esi
lea ebx, [rsi + 6]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x98]
mov edx, 0x100181
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
test eax, eax
jns 0x140001849
movzx eax, bx
jmp 0x140001948
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x14000187f
mov eax, 9
jmp 0x140001948
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], rdi
mov rax, qword [rsp + 0x88]
mov byte [rax + 0x4c], sil
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ebx, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400018c6
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x88], rdi
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x80], dil
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
or qword [rsp + 0x90], 0xffffffffffffffff
test ebx, ebx
js 0x1400018fc
movzx eax, di
jmp 0x140001948
movzx eax, si
jmp 0x140001948
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140002cf0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140001970
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 - 0x50], rdx
test rcx, 0xfffffffffffffffb
je 0x140001a8e
lea rax, [rdx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x140001a8e
xor edi, edi
mov qword [r11 - 0x60], rdi
mov byte [rsp + 0x21], dil
mov byte [rsp + 0x20], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea rdx, [r11 - 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400019f5
lea eax, [rdi + 3]
jmp 0x140001a93
mov esi, 1
mov byte [rsp + 0x21], sil
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x21], dil
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], sil
mov qword [rsp + 0x30], rdi
mov r9d, 0x8000
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x20], dil
test ebx, ebx
jns 0x140001a5e
movzx eax, si
jmp 0x140001a93
movzx eax, di
jmp 0x140001a93
mov eax, 2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140002cf0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001ab8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r15, r8
mov r11, rdx
mov r9, rcx
xor edx, edx
mov r10d, edx
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x140001aef
lea eax, [rdx + 5]
jmp 0x140001be2
movsxd rax, dword [rcx + 0x3c]
mov ecx, 0x20b
cmp word [rax + r9 + 0x18], cx
jne 0x140001b0a
mov ecx, dword [rax + r9 + 0x88]
jmp 0x140001b0f
mov ecx, dword [rax + r9 + 0x78]
mov esi, ecx
mov r12d, dword [rsi + r9 + 0x24]
add r12, r9
mov r13d, dword [rsi + r9 + 0x20]
add r13, r9
mov r14d, dword [rsi + r9 + 0x1c]
add r14, r9
mov r8d, edx
mov dword [rsp + 0x28], edx
mov edi, edx
mov ecx, edx
mov ebx, 0xffff
cmp edi, dword [rsi + r9 + 0x14]
jae 0x140001bcd
cmp r11, rbx
jbe 0x140001b66
cmp edi, dword [rsi + r9 + 0x18]
jae 0x140001bc6
mov eax, edi
mov edx, dword [r13 + rax*4]
add rdx, r9
mov eax, ecx
movzx r8d, word [r12 + rax*2]
cmp r11, rbx
ja 0x140001b7c
movzx ecx, r8w
add ecx, dword [rsi + r9 + 0x10]
movzx eax, r11w
cmp eax, ecx
je 0x140001bb0
cmp r11, rbx
jbe 0x140001bc2
mov rbx, r11
sub rbx, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + rbx]
sub eax, ecx
jne 0x140001b94
inc rdx
test ecx, ecx
jne 0x140001b82
xor edx, edx
test eax, eax
je 0x140001bb2
mov ebx, 0xffff
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], r8d
mov edi, r8d
mov ecx, r8d
jmp 0x140001b39
xor edx, edx
movzx eax, r8w
mov r10d, dword [r14 + rax*4]
add r10, r9
mov qword [r15], r10
jmp 0x140001bcd
xor edx, edx
jmp 0x140001b9f
mov eax, 8
jmp 0x140001be2
test r10, r10
jne 0x140001bd8
lea eax, [r10 + 1]
jmp 0x140001be2
movzx eax, dx
jmp 0x140001be2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140001bfc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, r8
movups xmm0, xmmword [rdx]
movdqu xmmword [rsp + 0x48], xmm0
test rcx, 0xfffffffffffffffb
je 0x140001dcf
xor r15d, r15d
mov qword [rsp + 0x28], r15
mov byte [rsp + 0x21], r15b
mov byte [rsp + 0x20], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140001c77
lea eax, [r15 + 3]
jmp 0x140001dd4
mov r12d, 1
mov byte [rsp + 0x21], r12b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x21], r15b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rbx, rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], r12b
mov rdi, r15
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov rcx, qword [rsp + 0x28]
test rbx, rbx
je 0x140001d25
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rsi, rax
mov ecx, dword [rax + 0xc]
mov ebx, dword [rcx + 0xc]
mov ecx, dword [rsi + 0xc]
add rcx, 0xc
cmp rbx, rcx
je 0x140001d80
mov ecx, dword [rbx + 0x30]
test ecx, ecx
jne 0x140001cf7
jmp 0x140001d21
mov rdx, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140001d21
mov edi, dword [rbx + 0x18]
jmp 0x140001d74
mov ebx, dword [rbx]
jmp 0x140001cde
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rsi, rax
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rsi + 0x18]
add rcx, 0x10
cmp rbx, rcx
je 0x140001d80
mov rdx, qword [rbx + 0x60]
test rdx, rdx
jne 0x140001d4e
jmp 0x140001d7b
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, r12b
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140001d7b
mov rdi, qword [rbx + 0x30]
mov qword [rsp + 0x30], rdi
jmp 0x140001d80
mov rbx, qword [rbx]
jmp 0x140001d36
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x20], r15b
mov qword [r14], rdi
test rdi, rdi
jne 0x140001d9e
movzx eax, r12w
jmp 0x140001dd4
movzx eax, r15w
jmp 0x140001dd4
mov eax, 2
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140002cf0
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140001dfc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
xor r14d, r14d
mov qword [r11 - 0x60], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [r11 - 0x67], r14b
mov byte [r11 - 0x68], r14b
mov qword [r11 - 0x58], r14
lea rdx, [r11 - 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140001e5f
lea eax, [r14 + 3]
jmp 0x140001eed
mov byte [rsp + 0x21], 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x21], r14b
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], 1
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.140001ab8
movzx ebx, ax
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x20], r14b
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
test bx, bx
je 0x140001ebe
movzx eax, bx
jmp 0x140001eed
movzx eax, r14w
jmp 0x140001eed
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140002cf0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x140001f0c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov ebx, r12d
mov qword [rax - 0x40], rbx
mov dword [rax + 0x18], r12d
mov qword [rax - 0x38], r12
mov esi, r12d
mov byte [rax - 0x48], r12b
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
lea edi, [rdx + 5]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
lea r13d, [r12 + 1]
cmp eax, 0xc0000004
jne 0x140001fe7
test rbx, rbx
je 0x140001f84
mov edx, 0x5173496e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov byte [rsp + 0x20], r12b
mov qword [rsp + 0x28], r12
mov edx, dword [rsp + 0x80]
mov r8d, 0x5173496e
mov ecx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140001fb0
movzx eax, r13w
jmp 0x14000206d
mov byte [rsp + 0x20], r13b
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rbx
call fcn.1400031c0
lea r9, [rsp + 0x80]
mov r8d, dword [rsp + 0x80]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
jmp 0x140001f5c
mov rdi, rbx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x20], r12b
cmp dword [rbx], r12d
je 0x14000201f
lea rcx, [rbx + 0x38]
mov r8b, r13b
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140002013
mov rsi, qword [rbx + 0x50]
jmp 0x14000201f
mov eax, dword [rbx]
add rbx, rax
mov qword [rsp + 0x28], rbx
jmp 0x140001ff4
mov qword [r14], rsi
test rdi, rdi
je 0x140002035
mov edx, 0x5173496e
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movzx eax, r12w
jmp 0x14000206d
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002088
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rcx
xor r14d, r14d
test dl, dl
jne 0x1400020b6
cmp qword [0x140005048], r14
je 0x1400020b6
lea ebx, [r14 + 1]
jmp 0x1400020c8
mov ebx, 1
cmp dl, bl
jne 0x1400020d0
cmp qword [0x140005048], r14
jne 0x1400020d0
movzx eax, bx
jmp 0x1400021a9
test rsi, 0xfffffffffffffffb
je 0x1400021a4
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x20], r14b
test dl, dl
jne 0x14000214c
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002104
mov eax, 3
jmp 0x1400021a9
mov byte [rsp + 0x20], bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x20], r14b
mov rdi, qword [rsp + 0x50]
lea rcx, [rdi + 0x440]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002147
mov qword [rdi + 0x440], r14
mov rcx, qword [rsp + 0x50]
mov qword [0x140005048], rcx
movzx eax, r14w
jmp 0x1400021a9
movzx eax, bx
jmp 0x1400021a9
mov rdi, qword [0x140005048]
lea rcx, [rdi + 0x440]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002186
cmp qword [rdi + 0x440], r14
jne 0x140002181
mov qword [rdi + 0x440], rsi
mov qword [0x140005048], r14
movzx eax, r14w
jmp 0x1400021a9
movzx eax, bx
jmp 0x1400021a9
movzx eax, bx
jmp 0x1400021a9
mov eax, 2
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140002330
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x60], rax
test rcx, 0xfffffffffffffffb
je 0x14000241a
xor edi, edi
mov qword [r11 - 0x50], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x21], dil
mov byte [rsp + 0x20], dil
lea rdx, [r11 - 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002394
lea eax, [rdi + 3]
jmp 0x14000241f
mov esi, 1
mov byte [rsp + 0x21], sil
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x21], dil
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], sil
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x20], dil
test ebx, ebx
jns 0x1400023ea
movzx eax, si
jmp 0x14000241f
movzx eax, di
jmp 0x14000241f
mov eax, 2
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002cf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002440
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r8
mov ebx, edx
test rcx, 0xfffffffffffffffb
je 0x140002562
xor esi, esi
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x31], sil
mov byte [rsp + 0x30], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400024ae
lea eax, [rsi + 3]
jmp 0x140002567
mov r14d, 1
mov byte [rsp + 0x31], r14b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x31], sil
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x30], r14b
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x40]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x30], sil
mov rcx, qword [rsp + 0x40]
mov qword [rdi], rcx
test rcx, rcx
jne 0x140002532
movzx eax, r14w
jmp 0x140002567
movzx eax, si
jmp 0x140002567
mov eax, 2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002cf0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
Function at 0x1400026dc
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, r9d
mov ebx, r8d
mov qword [rsp + 0x48], rdx
mov rsi, qword [rsp + 0xe0]
test rcx, 0xfffffffffffffffb
je 0x140002811
lea rax, [rdx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x140002811
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x31], r14b
mov byte [rsp + 0x30], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002773
lea eax, [r14 + 3]
jmp 0x140002816
mov r15d, 1
mov byte [rsp + 0x31], r15b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x31], r14b
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x30], r15b
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rsi
mov r9d, edi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x30], r14b
test ebx, ebx
jns 0x1400027e0
movzx eax, r15w
jmp 0x140002816
movzx eax, r14w
jmp 0x140002816
mov eax, 2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002cf0
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140002838
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15, r9
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
test rcx, 0xfffffffffffffffb
je 0x14000293d
lea rax, [rdx - 0x10000]
movabs rcx, 0x7ffffffeffff
cmp rax, rcx
ja 0x14000293d
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
xor r12d, r12d
test rax, rax
jne 0x14000289d
lea eax, [rbx + 3]
jmp 0x140002942
mov qword [rsp + 0x70], r12
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400028be
mov eax, 3
jmp 0x140002942
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x40], r12
lfence
cmp byte [rsp + 0x90], r12b
jne 0x1400028fd
lea r8, [0x140003350]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9, r15
mov r8, rbx
mov rdx, rdi
mov rcx, qword [rsp + 0x70]
jmp 0x14000290b
mov r9, rdi
mov r8, qword [rsp + 0x70]
mov rdx, r15
mov rcx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r12b
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
test eax, eax
jns 0x140002930
mov eax, 1
jmp 0x140002942
movzx eax, r12w
jmp 0x140002942
mov eax, 2
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140002960
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r9
mov esi, r8d
mov rdi, rdx
test rcx, 0xfffffffffffffffb
je 0x140002bbd
lea rax, [rdx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x140002bbd
xor r14d, r14d
mov qword [r11 - 0x70], r14
mov qword [r11 - 0x80], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x78], r14
mov byte [rsp + 0x34], r14b
mov byte [rsp + 0x33], r14b
mov byte [rsp + 0x32], r14b
mov byte [rsp + 0x31], r14b
mov byte [rsp + 0x30], r14b
lea rdx, [r11 - 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002a04
lea eax, [r14 + 3]
jmp 0x140002bc2
lfence
mov r15d, 1
mov byte [rsp + 0x34], r15b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x34], r14b
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x33], r15b
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140002a6b
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, r15w
jmp 0x140002bc2
lfence
mov byte [rsp + 0x32], r15b
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov byte [rsp + 0x31], r15b
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x33], r14b
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [rsp + 0x40], rax
lfence
test rax, rax
jne 0x140002ae4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movzx eax, r15w
jmp 0x140002bc2
mov byte [rsp + 0x30], r15b
mov r8, rsi
cmp byte [rsp + 0xe0], r14b
jne 0x140002b06
lfence
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
jmp 0x140002b11
mov rdx, rbx
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140002e80
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov byte [rsp + 0x30], r14b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov byte [rsp + 0x31], r14b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov byte [rsp + 0x32], r14b
movzx eax, r14w
jmp 0x140002bc2
mov eax, 2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002cf0
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret