joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f5cc
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
and qword [r11 + 0x20], 0
movabs rax, 0x7b301ecc07b301ed
mov ebp, r8d
mov r15, rdx
lea r8, [rbp - 0x430]
mul r8
mov r14, rdx
shr r14, 9
test ecx, ecx
jne 0x14000f618
mov eax, 0xc0000001
jmp 0x14000f735
mov ecx, ecx
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000f720
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rcx]
test rsi, rsi
je 0x14000f725
test rbx, rbx
je 0x14000f733
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000f720
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObGetObjectType]
test rax, rax
je 0x14000f720
cmp rax, rsi
jne 0x14000f720
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000f720
mov rcx, qword [0x1400d6b50]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000f720
mov rax, qword [0x1400d6b50]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x14000f720
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000f720
mov rdx, rbp
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x14000f720
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14001ea80
mov rcx, qword [rsp + 0x58]
mov r8d, r14d
mov rdx, rbx
call fcn.14000f750
mov edi, eax
test eax, eax
js 0x14000f715
mov eax, dword [rbx]
cmp r14d, eax
jb 0x14000f70d
mov r8, rbp
mov rdx, rbx
mov rcx, r15
call fcn.14001e7c0
xor edi, edi
jmp 0x14000f715
mov dword [r15], eax
mov edi, 0xc0000023
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14000f733
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400112dc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
xor ebx, ebx
mov rsi, rcx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14001133e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x14001132f
inc rax
test edx, edx
jne 0x14001131c
test ecx, ecx
mov rcx, qword [rsp + 0x40]
je 0x14001135f
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbx, 4
cmp rbx, 0xc350
jb 0x1400112f9
and qword [rdi], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rdi], rcx
mov eax, ebx
jmp 0x14001134f
Function at 0x140011bd4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400d6a00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov r14, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140011c7a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x140011c7a
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140011c64
movzx r8d, word [rdx + 0x72]
cmp r8, rsi
cmova r8, rsi
mov rdx, qword [rdx + 0x78]
mov rcx, r14
call fcn.14001e7c0
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001e6e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret

Function at 0x140012c8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r9d, r9d
mov rsi, rdx
mov r8, rcx
test rcx, rcx
je 0x140012d73
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140012d73
movsxd rax, dword [rcx + 0x3c]
mov ecx, 0x20b
cmp word [rax + r8 + 0x18], cx
jne 0x140012ce0
mov ecx, dword [rax + r8 + 0x88]
jmp 0x140012ce5
mov ecx, dword [rax + r8 + 0x78]
mov r10d, ecx
mov edx, r9d
mov r14d, dword [r10 + r8 + 0x24]
mov r15d, dword [r10 + r8 + 0x20]
add r14, r8
mov edi, dword [r10 + r8 + 0x1c]
add r15, r8
mov r12d, dword [r10 + r8 + 0x14]
add rdi, r8
test r12d, r12d
je 0x140012d6e
cmp rsi, 0xffff
ja 0x140012d29
movzx r11d, dx
mov ecx, r11d
movzx eax, si
add ecx, dword [r10 + r8 + 0x10]
cmp eax, ecx
jmp 0x140012d58
cmp edx, dword [r10 + r8 + 0x18]
jae 0x140012d73
mov eax, edx
mov rbp, rsi
mov ecx, dword [r15 + rax*4]
movzx r11d, word [r14 + rax*2]
add rcx, r8
sub rbp, rcx
movzx eax, byte [rcx]
movzx ebx, byte [rcx + rbp]
sub eax, ebx
jne 0x140012d56
inc rcx
test ebx, ebx
jne 0x140012d44
test eax, eax
je 0x140012d63
inc edx
cmp edx, r12d
jb 0x140012d0d
jmp 0x140012d6e
movzx eax, r11w
mov r9d, dword [rdi + rax*4]
add r9, r8
mov rax, r9
jmp 0x140012d75
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140012d90
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov rax, qword [0x1400d6a00]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov edi, r9d
mov rsi, r8
mov rbx, rdx
mov r14, rcx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140012fa6
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140012fa6
lea rax, [0x1400200e0]
mov dword [rbp - 0x69], 0x10000e
mov qword [rbp - 0x61], rax
lea rdx, [rbp - 0x69]
lea rax, [0x1400200f0]
mov dword [rbp - 0x59], 0xe000c
mov qword [rbp - 0x51], rax
mov r15d, 0x10
lea rax, [0x14001fb50]
mov dword [rbp - 0x29], 0xa0008
mov qword [rbp - 0x21], rax
add r14, r15
lea rax, [0x140020100]
mov dword [rbp - 9], 0xc000a
mov qword [rbp - 1], rax
mov r8b, 1
lea rax, [0x140020110]
mov dword [rbp - 0x19], 0x10000e
mov qword [rbp - 0x11], rax
mov rcx, r14
lea rax, [0x140020120]
mov dword [rbp - 0x49], 0xa0008
mov qword [rbp - 0x41], rax
lea rax, [0x140020130]
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x39], 0xa0008
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140012e8c
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
call fcn.140013b88
jmp 0x140012fa6
mov r8b, 1
lea rdx, [rbp - 0x59]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140012eae
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoThreadToProcess]
mov rcx, rax
jmp 0x140012e7c
mov r8b, 1
lea rdx, [rbp - 0x49]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140012ee9
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140009578
test eax, eax
jns 0x140012fa6
lea rcx, [0x140020140]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140012fa6
mov r8b, 1
lea rdx, [rbp - 0x39]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140012f35
xorps xmm0, xmm0
lea rdx, [rbp + 7]
mov rcx, rbx
movups xmmword [rbp + 7], xmm0
call fcn.140012934
test eax, eax
js 0x140012f2c
cmp edi, r15d
lea rdx, [rbp + 7]
mov rcx, rsi
cmovb r15, rdi
mov r8, r15
call fcn.14001e7c0
jmp 0x140012fa6
lea rcx, [0x140020160]
jmp 0x140012edf
mov r8b, 1
lea rdx, [rbp - 0x29]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140012f59
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.14000935c
jmp 0x140012fa6
mov r8b, 1
lea rdx, [rbp - 0x19]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x140012f7d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140009440
jmp 0x140012fa6
mov r8b, 1
lea rdx, [rbp - 9]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
test al, al
je 0x140012fa1
call fcn.140009688
jmp 0x140012fa6
call fcn.1400129a0
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14001e6e0
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140012fc4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov eax, 0x1000
mov dword [rsp + 0x28], 0x40
mov rsi, rdx
mov qword [rbp + 0x38], rax
mov rdi, rcx
mov dword [rsp + 0x20], eax
xor ebx, ebx
mov dword [rbp - 0x30], 0x68
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], rbx
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x1c], ebx
lea r9, [rbp + 0x38]
mov dword [rbp - 0x2c], 0x6800
xor r8d, r8d
mov dword [rbp - 0x28], 0x6a0000
mov dword [rbp - 0x24], 0xe8006a
mov dword [rbp - 0x20], 0xba000000
mov dword [rbp - 0x18], 0x1e7e02c7
mov dword [rbp - 0x14], 0xbac037
mov dword [rbp - 0x10], 0x89000000
mov dword [rbp - 0xc], 0x4c202
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x1400130e3
movzx eax, word [rsi]
mov rbx, qword [rbp + 0x30]
add rbx, 0x200
mov word [rbx], ax
movzx eax, word [rsi + 2]
mov word [rbx + 2], ax
mov eax, dword [rbp + 0x30]
add eax, 0x210
mov dword [rbx + 4], eax
movzx r8d, word [rsi]
mov rdx, qword [rsi + 8]
mov ecx, eax
call fcn.14001e7c0
mov rax, qword [rbp + 0x30]
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp - 0x10]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5e0]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 0x30]
mov dword [rax + 6], ebx
mov rax, qword [rbp + 0x30]
sub edi, eax
sub edi, 0x13
mov dword [rax + 0xf], edi
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x14], eax
mov rcx, qword [rbp + 0x30]
lea eax, [rcx + 0x5ec]
mov dword [rcx + 0x1f], eax
mov rax, qword [rbp + 0x30]
jmp 0x1400130e5
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400130f8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
mov dword [rsp + 0x28], 0x40
mov eax, 0x1000
mov qword [rbp + 0x30], r14
mov rdi, rdx
mov qword [rbp + 0x38], rax
mov rsi, rcx
mov qword [rbp - 0x44], r14
lea rdx, [rbp + 0x30]
mov qword [rbp - 0x30], r14
or rcx, 0xffffffffffffffff
mov qword [rbp - 0x24], r14
lea r9, [rbp + 0x38]
mov qword [rbp - 0x14], r14
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x50], 0x28ec8348
mov dword [rbp - 0x4c], 0x48c93148
mov dword [rbp - 0x48], 0xb849d231
mov qword [rbp - 0x3c], 0xb949
mov dword [rbp - 0x34], 0xb8480000
mov dword [rbp - 0x28], 0xba48d0ff
mov dword [rbp - 0x1c], 0x1e7e02c7
mov dword [rbp - 0x18], 0xba48c037
mov dword [rbp - 0xc], 0x83480289
mov word [rbp - 8], 0x28c4
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14001324b
mov rbx, qword [rbp + 0x30]
mov rdx, rdi
add rbx, 0x200
mov rcx, rbx
mov dword [rbx], 0x3d00000
mov rax, qword [rbp + 0x30]
add rax, 0x210
mov qword [rbx + 8], rax
call fcn.14001c254
mov rcx, qword [rbp + 0x30]
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movzx eax, word [rbp - 8]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [rbp - 0x10]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0xc3
mov rax, qword [rbp + 0x30]
mov qword [rax + 0xc], rbx
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5e0]
mov qword [rcx + 0x16], rax
mov rax, qword [rbp + 0x30]
mov qword [rax + 0x20], rsi
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5e8]
mov qword [rcx + 0x2c], rax
mov rcx, qword [rbp + 0x30]
lea rax, [rcx + 0x5ec]
mov qword [rcx + 0x3c], rax
mov rax, qword [rbp + 0x30]
jmp 0x14001324d
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140013c58
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
lea rdx, [rsp + 0x40]
mov ecx, ecx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140013ccd
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
and qword [rsp + 0x48], 0
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov ebx, eax
test eax, eax
js 0x140013cc2
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rcx + 8]
call fcn.1400163bc
test al, al
je 0x140013cbd
neg rdi
sbb ebx, ebx
not ebx
and ebx, 0xc0000001
jmp 0x140013cc2
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140013cdc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140013d45
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov ebx, eax
test eax, eax
js 0x140013d38
mov rbx, qword [rsp + 0x48]
mov rcx, rdi
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
add r8, r8
call fcn.14001e7c0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140013d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x20], 0
lea rax, [rax + 0x20]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
lea r8d, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x140013d9b
mov eax, 0xc0000001
jmp 0x140013dfd
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rsp + 0x58]
mov r8d, 2
mov rdi, rax
mov rdx, rbx
lea rax, [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x140013df0
lea r9, [rdi + 0xc]
mov edx, 0x104
lea r8, [0x14001fc10]
mov rcx, rbp
call fcn.14001bfbc
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140014458
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rdx, qword [rdx + 8]
mov rbx, rcx
and dword [rbp + 0x2b], 0
lea rcx, [rbp + 7]
and dword [rbp + 0x43], 0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0x2f], 0
lea rax, [rbp + 7]
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r8, [rbp + 0x27]
mov dword [rbp + 0x27], 0x30
mov edx, 0x10000000
mov dword [rbp + 0x3f], 0x40
lea rcx, [rbp + 0x6f]
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jne 0x14001462f
xorps xmm0, xmm0
lea rdx, [0x1400214e0]
lea rcx, [rbp - 9]
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movaps xmm0, xmmword [rbp - 9]
lea r8, [0x1400d6c70]
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
call fcn.140013d50
test eax, eax
jne 0x14001462f
lea rdx, [0x140021500]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movaps xmm0, xmmword [rbp - 9]
lea r8, [0x1400d6e80]
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
call fcn.140013d50
test eax, eax
jne 0x14001462f
lea rdx, [0x140021520]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movaps xmm0, xmmword [rbp - 9]
lea r8, [0x1400d7090]
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
call fcn.140013d50
test eax, eax
jne 0x14001462f
lea rdx, [0x140021550]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movaps xmm0, xmmword [rbp - 9]
lea r8, [0x1400d72a0]
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
call fcn.140013d50
test eax, eax
jne 0x14001462f
lea rdx, [0x1400d6c70]
lea rcx, [0x1400dc470]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400d6e80]
lea rcx, [0x1400dc460]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x1400dc488]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [0x1400dc470]
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x14001462f
lea rdx, [0x1400dc470]
lea rcx, [0x1400dc460]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x140014625
mov rcx, qword [0x1400dc488]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
jmp 0x14001462f
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x140014c8c
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
lea r8, [0x1400dbfa0]
lea rdx, [0x140076770]
call sub.FLTMGR.SYS_FltRegisterFilter
test eax, eax
js 0x140014ccf
mov rcx, qword [0x1400dbfa0]
call sub.FLTMGR.SYS_FltStartFiltering
test eax, eax
jns 0x140014ccf
mov rcx, qword [0x1400dbfa0]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov edx, 0x1f0001
lea rcx, [rbp + 0x18]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x140014d92
lea rdx, [0x1400d7090]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x1400dbfa0]
lea rax, [rbp - 0x40]
and qword [rbp - 0x28], 0
lea r8, [rbp - 0x30]
and qword [rbp - 8], 0
lea rdx, [0x1400dbf98]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
lea rax, [0x140016290]
mov dword [rsp + 0x38], 0x63
mov qword [rsp + 0x30], rax
lea rax, [0x140016260]
mov qword [rsp + 0x28], rax
lea rax, [0x140016250]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x30], 0x30
mov dword [rbp - 0x18], 0x240
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov rcx, qword [rbp + 0x18]
mov ebx, eax
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
and qword [0x1400dbf78], 0
lea rax, [0x1400dbf80]
mov qword [0x1400dbf88], rax
mov qword [0x1400dbf80], rax
test ebx, ebx
jns 0x140014db4
mov rcx, qword [0x1400dbf98]
test rcx, rcx
je 0x140014da3
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov rcx, qword [0x1400dbfa0]
test rcx, rcx
je 0x140014db4
call sub.FLTMGR.SYS_FltUnregisterFilter
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140014e58
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
mov edi, 0xc0000001
mov dword [rsp + 0x30], edi
mov ebx, 0x50
mov r8d, 0x687a77
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140014f67
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14001ea80
mov rax, cr8
cmp al, 1
ja 0x140014f46
call qword [sym.imp.ntoskrnl.exe_KeAreApcsDisabled]
test al, al
jne 0x140014edb
mov rax, cr8
cmp al, 1
je 0x140014edb
mov rax, cr8
movzx edx, al
lea rcx, [0x14001f760]
jmp 0x140014f54
xor r8d, r8d
xor edx, edx
lea rcx, [rsi + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov dword [rsi + 0x48], edi
and qword [rsi], 0
lea rax, [0x140014f80]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x18], rsi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExQueueWorkItem]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsi + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
nop
mov edi, dword [rsi + 0x48]
mov dword [rsp + 0x30], edi
mov rax, qword [rsi + 0x28]
mov qword [r14], rax
jmp 0x140014f59
mov rcx, cr8
movzx edx, cl
lea rcx, [0x14001f7a0]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x687a77
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140016868
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x48], 0
mov r14, rdx
mov esi, r8d
sub rsi, 0x28
shr rsi, 5
test ecx, ecx
jne 0x14001689c
mov eax, 0xc0000001
jmp 0x140016965
mov ecx, ecx
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140016950
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rcx]
test rbp, rbp
je 0x140016955
test rbx, rbx
je 0x140016963
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140016950
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObGetObjectType]
test rax, rax
je 0x140016950
cmp rax, rbp
jne 0x140016950
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140016950
mov rcx, qword [0x1400d6b50]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140016950
mov rax, qword [0x1400d6b50]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x140016950
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140016950
mov rcx, qword [rsp + 0x48]
mov r8d, esi
mov rdx, r14
call fcn.14000f450
mov edi, eax
test eax, eax
js 0x140016950
cmp esi, dword [r14]
sbb edi, edi
and edi, 0xc0000023
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140016963
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret