joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140225af0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x98
mov rax, qword [0x1403c12b0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov eax, dword [rcx + 0x10]
mov rdi, r9
mov r15, qword [rbp + 0x7f]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test eax, eax
jne 0x140225b3c
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbx + 0x10]
cmp eax, 1
jne 0x140225b5b
mov rcx, qword [rbx + 8]
mov r9d, edi
mov r8, rsi
mov qword [rsp + 0x20], r15
mov rdx, r14
call sub.ntdll.dll_NtReadVirtualMemory
mov eax, dword [rbx + 0x10]
cmp eax, 2
jne 0x140225c50
mov eax, dword [rbx]
mov edx, 0x9a4
xor eax, 0x8fea0644
mov dword [rbp - 0x31], 0xf601f600
mov dword [rbp - 1], eax
mov eax, 0xfcb3e314
xor r14, rax
mov dword [rbp - 0x2d], 0xf603f670
mov rax, rdi
mov qword [rbp + 7], r14
xor rax, 0x544becbe
mov dword [rbp - 0x29], 0xf613f624
xor r14d, r14d
mov qword [rbp + 0xf], rax
mov dword [rbp - 9], r14d
mov eax, r14d
mov dword [rbp - 0x25], 0xf615f60b
mov dword [rbp - 0x21], 0xf617f601
mov dword [rbp - 0x1d], 0xf612f617
mov dword [rbp - 0x19], 0xf61bf60d
mov dword [rbp - 0x15], 0xf613
mov byte [rbp - 0x11], 1
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 0x31], cx
inc rax
cmp rax, 0xf
jb 0x140225bd2
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp - 0x31]
xor edx, edx
mov byte [rbp - 0x11], r14b
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140225c50
mov qword [rsp + 0x38], r14
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
mov dword [rsp + 0x28], edi
mov r9d, Ordinal_27
mov edx, 0x22240e
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140226190
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140225ff0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x98
mov rax, qword [0x1403c12b0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov eax, dword [rcx + 0x10]
mov rdi, r9
mov r15, qword [rbp + 0x7f]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test eax, eax
jne 0x14022603c
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rbx + 0x10]
cmp eax, 1
jne 0x14022605b
mov rcx, qword [rbx + 8]
mov r9d, edi
mov r8, rsi
mov qword [rsp + 0x20], r15
mov rdx, r14
call sub.ntdll.dll_NtWriteVirtualMemory
mov eax, dword [rbx + 0x10]
cmp eax, 2
jne 0x140226150
mov eax, dword [rbx]
mov edx, 0x9a4
xor eax, 0x8fea0644
mov dword [rbp - 0x31], 0xf601f600
mov dword [rbp - 1], eax
mov eax, 0xfcb3e314
xor r14, rax
mov dword [rbp - 0x2d], 0xf603f670
mov rax, rdi
mov qword [rbp + 7], r14
xor rax, 0x544becbe
mov dword [rbp - 0x29], 0xf613f624
xor r14d, r14d
mov qword [rbp + 0xf], rax
mov dword [rbp - 9], r14d
mov eax, r14d
mov dword [rbp - 0x25], 0xf615f60b
mov dword [rbp - 0x21], 0xf617f601
mov dword [rbp - 0x1d], 0xf612f617
mov dword [rbp - 0x19], 0xf61bf60d
mov dword [rbp - 0x15], 0xf613
mov byte [rbp - 0x11], 1
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 0x31], cx
inc rax
cmp rax, 0xf
jb 0x1402260d2
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp - 0x31]
xor edx, edx
mov byte [rbp - 0x11], r14b
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140226150
mov qword [rsp + 0x38], r14
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
mov dword [rsp + 0x28], edi
mov r9d, Ordinal_27
mov edx, 0x22240a
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140226190
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140029bbc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d294
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d294
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029d0c
cmp rax, 0xffffffffffffffff
je 0x140029d0c
xor edi, edi
test rbp, rbp
jle 0x140029cb7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fbc0
mov rbx, rax
test rax, rax
jne 0x140029c44
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029cad
mov edx, 0x8000
mov ecx, r14d
call fcn.14001abfc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001df70
cmp eax, 0xffffffff
je 0x140029c8d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c54
mov edx, r15d
mov ecx, r14d
call fcn.14001abfc
jmp 0x140029cad
cmp byte [rsi + 0x38], dil
je 0x140029ca4
cmp dword [rsi + 0x34], 5
jne 0x140029ca4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029cad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b960
jmp 0x140029d20
jns 0x140029d20
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d294
cmp rax, 0xffffffffffffffff
jne 0x140029cd8
cmp byte [rsi + 0x30], dil
je 0x140029d20
mov edi, dword [rsi + 0x2c]
jmp 0x140029d20
mov ecx, r14d
call fcn.1400190b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029d20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029d20
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029d19
mov eax, dword [rsi + 0x2c]
jmp 0x140029d1e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d294
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ae10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1004010e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea r9, str._______________Q_msgkey____M_shmkey____S_semkey__...
lea r8, str.usage:_ipcrm___q_msqid____m_shmid____s_semid_
lea rdx, str._s_n_s_n
call sub.cygwin1.dll_fprintf
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x140029bbc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d294
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d294
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029d0c
cmp rax, 0xffffffffffffffff
je 0x140029d0c
xor edi, edi
test rbp, rbp
jle 0x140029cb7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fbc0
mov rbx, rax
test rax, rax
jne 0x140029c44
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029cad
mov edx, 0x8000
mov ecx, r14d
call fcn.14001abfc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001df70
cmp eax, 0xffffffff
je 0x140029c8d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c54
mov edx, r15d
mov ecx, r14d
call fcn.14001abfc
jmp 0x140029cad
cmp byte [rsi + 0x38], dil
je 0x140029ca4
cmp dword [rsi + 0x34], 5
jne 0x140029ca4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029cad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b960
jmp 0x140029d20
jns 0x140029d20
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d294
cmp rax, 0xffffffffffffffff
jne 0x140029cd8
cmp byte [rsi + 0x30], dil
je 0x140029d20
mov edi, dword [rsi + 0x2c]
jmp 0x140029d20
mov ecx, r14d
call fcn.1400190b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029d20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029d20
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029d19
mov eax, dword [rsi + 0x2c]
jmp 0x140029d1e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d294
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ae10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f685f4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f685fe
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f68627
pop rbp
sub rbp, 0x33
sub rbp, 0xf685f4
sub rsp, 0x20
jmp 0x140f68646
mov rax, 0xf685f4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x6deed4
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f68665
jmp 0x140f6867c
pushfq
pop rbp
cmp eax, 0xd4e85d5f
invalid
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x140968334
Capabilities:
Encode data using xor

Disassembly:
in al, 0x9f
fimul dword [rcx - 0x79]
in al, 0xd9
pop rsp
sbb byte [rdx + 0x26], dh
imul ebp, dword [rdx - 0x142674f1], 0xffffffe7
or ebx, dword [rdi]
or edi, dword [0x19a0c6dc3]
and dl, bh
sub al, 0xeb
invalid
push 0xffffffffa9514f9d
call fcn.140a96b72
xor dword [rcx + 0x545b73ee], ebp
push 0x42
xor eax, 0x79cac52
jp 0x14096830f
jno 0x140968356
and ecx, dword [rax]
cmp qword [r9 - 0x38fa5894], r13
jo 0x1409683a4
add eax, 0x154a70c7
cmp ecx, edx
adc eax, 0x6069d139
adc eax, 0x185aad9d
imul esp, dword [rax + 0x15], 0x185aad9d
cld
insb byte [rdi], dx
movsd dword [rdi], dword [rsi]
retf 0x3fea
jge 0x1409683dd
cli
test byte [rbx + rbx*2 - 0x1e], cl
invalid
xchg esi, eax
or dword [rbx], ecx
xchg ebx, eax
scasd eax, dword [rdi]
push rsi
sti
enter 0x78a2, 0xffffffffffffffa1
adc eax, dword [rbp + 0x734840f2]
scasb al, byte [rdi]
add byte [rax], ch
mov bh, 0xd2
jns 0x14096835d
jae 0x14096838b
sbb eax, 0x31fb78d8
mov edi, edi
xor eax, 0x98fee010
invalid
mov esp, 0x40638ee
mov edi, 0xa9152beb
invalid
loope 0x1409683ca
add al, byte [rax]
jno 0x140968399
mov bh, 6
pushfq
movabs dword [0x3683e8983eea6390], eax
lodsb al, byte [rsi]
adc ch, byte [rdi + 0x61]
shl byte [rdx - 0x139b29c4], 0xd0
jmp rbp
Function at 0x140007f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007fb8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007fb0
cmp dword [rcx + 0x3c], edx
jl 0x140007fb0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140007fb0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140007fb8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400112c6
Capabilities:
Terminate process

Disassembly:
jmp 0x140015550
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011384
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400168a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400168c0
xor al, al
jmp 0x140016941
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400168d3
xor al, al
jmp 0x140016941
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400168fd
xor al, al
jmp 0x140016941
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016911
xor al, al
jmp 0x140016941
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016923
xor al, al
jmp 0x140016941
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001693f
xor al, al
jmp 0x140016941
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 0x58
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov ecx, 0x58
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x60]
add rax, 0x98
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 0x2a]
or al, 2
mov rcx, qword [rsp + 0x48]
mov byte [rcx + 0x2a], al
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 1
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [0x1400010d0]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
movzx eax, al
test eax, eax
jne 0x1400010bc
lea rcx, [0x140004a70]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x50
pop rdi
ret

Function at 0x140001c20
Capabilities:
Allocate or change rwx memory
Allocate user process rwx memory
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x90]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140001cb4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x140001cb4
mov eax, 0xc0000001
jmp 0x140001d45
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rcx, qword [rsp + 0x98]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140001d36
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400042b0
add rsp, 0x80
pop rdi
ret
Function at 0x140002d30
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x90], 0
jbe 0x140002d90
cmp qword [rsp + 0x98], 0
jbe 0x140002d90
movabs rax, 0x7fffffffffff
cmp qword [rsp + 0x98], rax
ja 0x140002d90
cmp dword [rsp + 0xa0], 0
jbe 0x140002d90
cmp qword [rsp + 0xa8], 0
ja 0x140002d9a
mov eax, 0xc0000001
jmp 0x140002f3a
mov qword [rsp + 0x48], 0
mov eax, dword [rsp + 0x90]
lea rdx, [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x140002f36
cmp qword [rsp + 0x48], 0
je 0x140002f36
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140002e29
call fcn.140002460
mov eax, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0
je 0x140002f2b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.140002ae0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140002e64
jmp 0x140002f2b
mov rax, qword [rsp + 0x30]
and rax, 0xfff
mov ecx, 0x1000
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x28]
jae 0x140002e9e
mov rax, qword [rsp + 0x30]
and rax, 0xfff
mov ecx, 0x1000
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140002ea8
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
add rcx, rax
mov rax, rcx
lea r9, [rsp + 0x40]
mov r8, qword [rsp + 0x70]
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.140002f50
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x20], 0
jge 0x140002f1c
jmp 0x140002f2b
cmp qword [rsp + 0x40], 0
jne 0x140002f26
jmp 0x140002f2b
jmp 0x140002e29
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x140003340
Capabilities:
Delete file
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x88], 0
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xa8], 0x30
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xc0], 0x40
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0xa8]
mov edx, 0x100181
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
je 0x14000348a
lea rcx, [0x140004e90]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000357f
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
je 0x1400034eb
lea rcx, [0x140004ec0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14000357f
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x88]
mov byte [rax + 0x4c], 1
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x80], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x80], 0
je 0x140003556
lea rcx, [0x140004ef0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000357f
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jl 0x14000357f
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov al, 1
jmp 0x140003587
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
xor al, al
add rsp, 0x108
ret