joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002391c
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
or r15d, 0xffffffff
mov dword [rsp + 0xb0], r15d
xor r14d, r14d
mov qword [rsp + 0xc8], r14
and qword [rax + 0x10], r14
and qword [rax + 0x18], r14
xor edi, edi
mov qword [rax - 0x78], rdi
xor r13b, r13b
mov esi, 0x1000
mov r8d, esi
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call fcn.1400231e0
test eax, eax
js 0x140023a3e
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x140023a3e
and qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140023a3e
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockProcessPages]
nop
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
test rax, rax
je 0x140023a3e
sar rax, 0xc
lea r12, [rax + rax*2]
shl r12, 4
add r12, qword [0x14007a268]
call fcn.1400236fc
mov r14, rax
test rax, rax
je 0x140023a3e
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor esi, esi
mov r8d, esi
mov edx, 0x1000
mov rcx, r12
call fcn.140023c8c
test al, al
jne 0x140023a21
add esi, 4
cmp esi, 0x30
jb 0x140023a03
jmp 0x140023a3e
mov r15d, esi
jmp 0x140023a3e
test r14, r14
je 0x140023a57
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp qword [rsp + 0xc0], 0
je 0x140023a82
cmp qword [rsp + 0xb8], 0
je 0x140023a82
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xc0]
call fcn.140023190
test rdi, rdi
je 0x140023a9e
test r13b, r13b
jne 0x140023a95
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, r15d
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x140023ee8
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x40], 0
mov rax, qword [0x1400a3b90]
test rax, rax
jne 0x140023f84
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x30], 0xa
jb 0x140023f73
jne 0x140023f32
cmp dword [rsp + 0x38], 0x37ec
jbe 0x140023f73
lea rcx, [0x14007a278]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rcx, rax
test rax, rax
je 0x140023f6a
mov rax, qword [rax]
cmp rax, qword [0x14007a288]
jne 0x140023f6a
mov rax, qword [rcx + 8]
cmp rax, qword [0x14007a290]
jne 0x140023f6a
mov rax, qword [rcx + 0x10]
and rax, 0xfffffffffffffff0
jmp 0x140023f7d
mov rax, qword [0x1400a3b90]
jmp 0x140023f84
movabs rax, 0xfffffa8000000000
mov qword [0x1400a3b90], rax
add rsp, 0x28
ret
Function at 0x140026820
Capabilities:
Get system information on windows

Disassembly:
test rcx, rcx
je 0x1400269bd
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x158]
sub rsp, 0x258
and dword [rbp + 0x1a0], 0
lea r9, [rbp + 0x1a0]
xor edx, edx
mov r12, rcx
xor r8d, r8d
lea esi, [rdx + 0xb]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rbp + 0x1a0]
test eax, eax
je 0x1400269aa
mov edx, eax
lea ecx, [rsi - 0xa]
mov r8d, 0x6c747373
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp + 0x1b8], rax
mov rbx, rax
test rax, rax
je 0x1400269aa
mov ecx, dword [rbp + 0x1a0]
lea r9, [rbp + 0x1a0]
mov rdi, rax
mov rdx, rbx
xor eax, eax
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x1a0]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x14002699c
lea r14, [rbx + 8]
test r14, r14
je 0x14002699c
mov r15d, dword [rbx]
xor esi, esi
test r15d, r15d
je 0x14002699c
mov rbx, qword [rbp + 0x1a8]
lea rdi, [r14 + 0x18]
mov rax, qword [rdi - 8]
movabs rcx, 0x8000000000000000
mov r13d, dword [rdi]
mov qword [rbp + 0x1b0], rax
cmp rax, rcx
jb 0x140026983
test r13d, r13d
je 0x140026983
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x20a
call fcn.140034240
mov eax, esi
lea rdx, [r14 + 0x28]
imul rcx, rax, 0x128
add rdx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov eax, 0x208
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], ax
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
test eax, eax
jne 0x140026983
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rsp + 0x40]
mov r9, rbx
mov r8d, r13d
call r12
test al, al
je 0x140026995
inc esi
add rdi, 0x128
cmp esi, r15d
jb 0x1400268f0
mov rbx, qword [rbp + 0x1b8]
mov edx, 0x6c747373
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x258
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140026aec
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140026bde
test rdx, rdx
je 0x140026bde
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [rdx + rsi], dil
jne 0x140026b26
mov edx, 0x40
cmp esi, edx
ja 0x140026bde
call fcn.140026c00
test al, al
je 0x140026bde
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140026bde
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140026bde
mov ecx, 0x20b
cmp word [rax + rbx + 0x18], cx
jne 0x140026b79
mov ecx, dword [rax + rbx + 0x88]
jmp 0x140026b7d
mov ecx, dword [rax + rbx + 0x78]
mov r15d, ecx
mov ebp, edi
mov ecx, dword [r15 + rbx + 0x20]
mov r12d, dword [r15 + rbx + 0x1c]
add rcx, rbx
mov r13d, dword [r15 + rbx + 0x24]
add r12, rbx
add r13, rbx
mov qword [rsp + 0x50], rcx
cmp dword [r15 + rbx + 0x14], edi
jbe 0x140026bde
mov eax, ebp
mov ecx, dword [rcx + rax*4]
add rcx, rbx
je 0x140026bbf
mov r8d, esi
mov rdx, r14
call fcn.140022560
test eax, eax
je 0x140026bcf
inc ebp
cmp ebp, dword [r15 + rbx + 0x14]
jae 0x140026bde
mov rcx, qword [rsp + 0x50]
jmp 0x140026ba6
mov eax, ebp
movzx ecx, word [r13 + rax*2]
mov edi, dword [r12 + rcx*4]
add rdi, rbx
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140026cf0
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
cmp qword [0x1400a65b8], 0
mov rdi, rdx
mov ebx, ecx
jne 0x140026d4b
lea rdx, [0x140036040]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400a65b8], rax
test rax, rax
jne 0x140026d4b
lea rcx, [0x140036080]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000141
jmp 0x140026e40
mov rcx, rbx
lea rdx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140026e40
lea rax, [rbp + 0x38]
mov r9d, 0x80000000
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov edx, 0x200
mov byte [rsp + 0x28], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
js 0x140026e40
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea esi, [r9 + 0x1b]
mov edx, esi
call qword [0x1400a65b8]
cmp eax, 0xc0000004
jne 0x140026e40
mov edx, dword [rbp + 0x30]
movzx eax, word [rdi + 2]
lea ecx, [rdx - 0x10]
cmp eax, ecx
jae 0x140026ddb
mov word [rdi], cx
mov eax, 0x80000005
jmp 0x140026e40
mov ecx, 1
mov r8d, 0x69706744
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140026dfb
mov eax, 0xc000009a
jmp 0x140026e40
mov r9d, dword [rbp + 0x30]
lea rax, [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
mov r8, rbx
mov edx, esi
mov qword [rsp + 0x20], rax
call qword [0x1400a65b8]
mov esi, eax
test eax, eax
js 0x140026e29
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002fdd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub rsp, 0x138
movaps xmmword [rsp + 0x70], xmm10
movaps xmmword [rsp + 0x40], xmm7
lea rax, [rsp + 0x100]
movaps xmmword [rax - 0x80], xmm11
movaps xmmword [rax - 0x50], xmm14
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rax - 0x60], xmm13
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rax - 0x40], xmm15
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rax - 0x70], xmm12
mov qword [rax - 8], rbp
mov rbp, rsp
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], r13
mov qword [rax + 0x30], r15
mov qword [rax + 0x18], r12
mov qword [rax + 0x28], r14
mov qword [rbp + 0xd8], rcx
lea rax, [r8 - 0x30]
mov qword [rbp + 0xe0], rax
mov rbx, qword gs:[0x188]
mov qword [r8 + 0x20], rsp
mov rsi, qword [rbx + 0x90]
mov qword [rbp + 0xd0], rsi
cli
mov qword [rbx + 0x28], r8
lea r9, [r8 + 0x50]
mov qword [rbx + 0x38], r9
test qword [0x1400a69d0], 1
jne 0x14002fe8c
mov rdi, qword gs:[8]
mov qword [rdi + 4], r8
jmp 0x14002fe95
mov qword gs:[0x9008], r8
mov ecx, 0x6000
sub r9, rcx
mov qword gs:[0x1a8], r8
mov qword [rbx + 0x30], r9
lea rsp, [r8 - 0x190]
mov rdi, rsp
mov ecx, 0x32
rep movsq qword [rdi], qword [rsi]
lea rbp, [rsi - 0x110]
ldmxcsr dword [rbp - 0x54]
mov r11, qword [rbp + 0xf8]
mov rbp, qword [rbp + 0xd8]
mov rax, qword [rdx + 0x10]
mov rsp, qword [rdx + 8]
mov rcx, qword [rdx]
movss xmm0, dword [rdx + 0x18]
movss xmm1, dword [rdx + 0x20]
movss xmm2, dword [rdx + 0x28]
movss xmm3, dword [rdx + 0x30]
cmp qword [rdx + 0x38], 0
je 0x14002feff
mov r13, qword [rdx + 0x38]
mov r9, rbp
test qword [0x1400a69d0], 1
jne 0x14002ff15
swapgs
sysretq
mov r8d, dword gs:[0x9018]
bt r8d, 1
jb 0x14002ff5c
mov rbp, qword gs:[0x188]
mov rbp, qword [rbp + 0x220]
mov rbp, qword [rbp + 0x388]
bt ebp, 0
jae 0x14002ff59
bt r8d, 0
jb 0x14002ff50
bts rbp, 0x3f
jmp 0x14002ff59
and dword gs:[0x9018], 0xfffffffe
mov cr3, rbp
mov rbp, r9
bt r8d, 1
jb 0x14002ff6f
verw word gs:[0x902a]
swapgs
sysretq
ret

Function at 0x140031e70
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x10325476
ret
Function at 0x1400ac000
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
and dword [rsp + 0x20], 0
mov rdi, rcx
mov rax, qword [0x1400a69a0]
test rax, rax
je 0x1400ac048
test rcx, rcx
je 0x1400ac13b
mov edx, dword [0x1400a6998]
mov dword [rcx], edx
jmp 0x1400ac13b
lea rdx, [0x1400b0b90]
lea rcx, [rsp + 0x28]
call fcn.14000148c
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rsi, rax
test rax, rax
jne 0x1400ac073
xor eax, eax
jmp 0x1400ac13b
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x1400ac06c
mov edx, eax
mov ecx, 0x40
call fcn.140001aec
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140034240
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x1400ac121
mov r8d, dword [rbx]
xor edx, edx
test r8d, r8d
je 0x1400ac121
lea rcx, [rbx + 0x18]
mov r9, qword [rcx]
cmp rsi, r9
jb 0x1400ac0eb
mov eax, dword [rcx + 8]
add rax, r9
cmp rsi, rax
jb 0x1400ac0fb
inc edx
add rcx, 0x128
cmp edx, r8d
jae 0x1400ac121
jmp 0x1400ac0d8
mov eax, edx
imul rcx, rax, 0x128
mov rax, qword [rcx + rbx + 0x18]
mov qword [0x1400a69a0], rax
mov eax, dword [rcx + rbx + 0x20]
mov dword [0x1400a6998], eax
test rdi, rdi
je 0x1400ac121
mov dword [rdi], eax
test rbx, rbx
je 0x1400ac134
mov edx, 0x4b555341
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x1400a69a0]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002ff90
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ac158
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ecx, ecx
call section.PAGE
mov rdi, rax
mov rax, qword [0x1400a6990]
test rax, rax
jne 0x1400ac228
test rdi, rdi
je 0x1400ac226
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
lea rbx, [rax + 0x108]
movzx eax, word [rax + 6]
lea rcx, [rax + rax*4]
lea rsi, [rbx + rcx*8]
cmp rbx, rsi
jae 0x1400ac226
movups xmm6, xmmword [0x1400b0bb0]
mov eax, dword [rbx + 0x24]
and eax, 0x2a000000
cmp eax, 0x28000000
jne 0x1400ac21d
mov eax, dword [rbx]
cmp eax, 0x54494e49
je 0x1400ac21d
cmp eax, 0x45474150
je 0x1400ac21d
mov eax, dword [rbx + 8]
lea rcx, [rsp + 0x30]
mov r9d, dword [rbx + 0xc]
mov r8d, 0xf
and qword [rsp + 0x30], 0
add r9, rdi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm6
mov qword [rsp + 0x20], rax
call fcn.1400016dc
test eax, eax
jns 0x1400ac24a
add rbx, 0x28
cmp rbx, rsi
jb 0x1400ac1c6
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ff90
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 3]
add rax, 7
add rax, rcx
mov qword [0x1400a6990], rax
jmp 0x1400ac228
Function at 0x1400ac33c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x18], 0
lea rdx, [rbp - 0x18]
mov rbx, rcx
mov ecx, dword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x1400ac485
mov eax, dword [0x1400a6dd0]
test eax, eax
je 0x1400ac480
mov edx, dword [0x1400a6dc0]
mov ecx, eax
add rcx, qword [rbp - 0x18]
cmp edx, 0x611
jg 0x1400ac3be
mov eax, dword [rbx + 4]
cmp eax, 1
jne 0x1400ac3ad
bts dword [rcx], 0xb
jmp 0x1400ac485
test eax, eax
jne 0x1400ac485
btr dword [rcx], 0xb
jmp 0x1400ac485
cmp edx, 0x620
jne 0x1400ac3da
cmp dword [rbx + 4], 2
je 0x1400ac485
mov al, byte [rbx + 4]
mov byte [rcx], al
jmp 0x1400ac485
cmp edx, 0x630
jl 0x1400ac479
mov eax, dword [rbx + 4]
test eax, eax
jne 0x1400ac3f1
mov byte [rcx], al
jmp 0x1400ac413
cmp eax, 1
jne 0x1400ac419
xor eax, eax
mov byte [rbp - 0x20], 0
mov word [rbp - 0x1f], ax
mov byte [rbp - 0x1d], al
mov eax, dword [rbp - 0x20]
and eax, 0xffffff6a
or eax, 0x62
mov dword [rbp - 0x20], eax
mov byte [rcx], al
mov edx, dword [0x1400a6dc0]
mov ecx, dword [rbx + 8]
cmp ecx, 2
je 0x1400ac451
mov eax, dword [0x1400a6dd4]
test eax, eax
je 0x1400ac451
add rax, qword [rbp - 0x18]
cmp edx, 0xa03
jl 0x1400ac444
shl ecx, 8
xor ecx, dword [rax]
and ecx, 0x100
jmp 0x1400ac44f
shl ecx, 0xa
xor ecx, dword [rax]
and ecx, 0x400
xor dword [rax], ecx
mov edx, dword [rbx + 0xc]
cmp edx, 2
je 0x1400ac485
mov eax, dword [0x1400a6dd0]
mov rcx, qword [rbp - 0x18]
cmp edx, 1
jne 0x1400ac471
mov word [rax + rcx - 2], 0x808
jmp 0x1400ac485
and word [rax + rcx - 2], 0
jmp 0x1400ac485
mov edi, 0xc00000bb
jmp 0x1400ac485
mov edi, 0xc0000141
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400ac494
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002ff90
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1400acc7c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
test rcx, rcx
je 0x1400ace23
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x50], 0
mov rbx, rcx
and qword [rbp - 0x48], 0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov r15d, 2
cmp rax, qword [rbx]
jne 0x1400acccc
lea edi, [r15 - 1]
jmp 0x1400accfb
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [rbx]
lea rdx, [rbp - 0x48]
xor edi, edi
cmp rax, qword [rbx + 0x10]
cmove edi, r15d
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400acd37
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400acd0e
mov rdx, qword [rbx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
lea rdx, [rbx + 0x38]
mov cl, 1
call fcn.1400acbdc
cmp edi, 1
je 0x1400acd28
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400acd37
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp edi, r15d
je 0x1400acd62
mov rcx, qword [rbx + 0x10]
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400acdb9
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, qword [rbp - 0x50]
jmp 0x1400acd68
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rsi, qword [rbx + 0x30]
test rax, rax
je 0x1400acd88
mov rcx, rax
call fcn.14000175c
test al, al
jne 0x1400acd88
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400acd9b
mov rdx, qword [rbx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
cmp edi, r15d
je 0x1400acdaa
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400acdb9
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp qword [rbx + 0x20], 0
je 0x1400acde8
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400acdd4
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
and qword [rbx + 0x28], 0
mov rcx, qword [rbx + 0x20]
mov edx, 0x4b555341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rbx + 0x20], 0
lea rdx, [rbx + 0x38]
xor ecx, ecx
call fcn.1400acbdc
mov rdx, rbx
lea rcx, [0x1400a6ce0]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTableAvl]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002ff90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x1400ad540
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov ebx, 0x100000
mov ecx, 0x40
mov edx, ebx
mov rbp, rax
call fcn.140001aec
mov rsi, rax
mov rdi, rax
test r14, r14
jne 0x1400ad592
mov eax, 0xc000000d
jmp 0x1400ad6b6
test rsi, rsi
jne 0x1400ad5a1
mov eax, 0xc0000017
jmp 0x1400ad6b6
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
lea ecx, [r9 + 5]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x1400ad5cd
mov edx, 0x4b555341
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1400ad6b4
mov ebx, 0xc0000225
cmp qword [rsi + 0x50], rbp
je 0x1400ad5e7
mov eax, dword [rdi]
test eax, eax
je 0x1400ad5e9
add rdi, rax
cmp qword [rdi + 0x50], rbp
jne 0x1400ad5d8
xor ebx, ebx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
setne r12b
test ebx, ebx
js 0x1400ad69a
xor ebp, ebp
mov ebx, 0xc0000225
cmp dword [rdi + 4], ebp
jbe 0x1400ad69a
lea rcx, [rbp*4]
add rcx, rbp
add rcx, rcx
mov r15, qword [rdi + rcx*8 + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
cmp r15, rax
je 0x1400ad68f
mov rdx, r14
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov rcx, qword [r14]
mov ebx, eax
test rcx, rcx
je 0x1400ad69a
call qword [sym.imp.ntoskrnl.exe_PsGetThreadTeb]
test rax, rax
je 0x1400ad682
cmp qword [rax + 0x78], 0
jne 0x1400ad682
test r12b, r12b
je 0x1400ad671
cmp dword [rax + 0x21a8], 0
je 0x1400ad682
cmp dword [rax + 0x202c], 0
jmp 0x1400ad680
cmp qword [rax + 0x2c8], 0
je 0x1400ad682
cmp qword [rax + 0x58], 0
jne 0x1400ad69a
mov rcx, qword [r14]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [r14], 0
inc ebp
cmp ebp, dword [rdi + 4]
jb 0x1400ad611
mov edx, 0x4b555341
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp qword [r14], 0
mov eax, 0xc0000225
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400afa24
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rbp, rax
test rax, rax
je 0x1400afac7
lea r8d, [rbx + 0xa]
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x20]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rdi, rax
test rax, rax
je 0x1400afacc
mov r14d, 0x20b
cmp word [rbp + 0x18], r14w
jne 0x1400afa8b
mov rax, qword [rax + 0x58]
jmp 0x1400afa8e
mov eax, dword [rax + 0x3c]
test rax, rax
je 0x1400afacc
mov rax, rsi
lea rcx, [rsp + 0x24]
shr rax, 0x20
xor eax, esi
mov dword [rsp + 0x24], eax
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov ecx, eax
xor rcx, rsi
cmp word [rbp + 0x18], r14w
jne 0x1400afac0
mov rax, qword [rdi + 0x58]
mov qword [rax], rcx
jmp 0x1400afacc
mov eax, dword [rdi + 0x3c]
mov dword [rax], ecx
jmp 0x1400afacc
mov ebx, 0xc000007b
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14002ff90
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret