joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011178
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov r15, rcx
mov r13d, 1
mov edx, r13d
lea rcx, [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_RtlCreateSecurityDescriptor]
xor r9d, r9d
lea rcx, [rbp - 0x49]
xor r8d, r8d
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_RtlSetDaclSecurityDescriptor]
xor r12d, r12d
mov dword [rsp + 0x30], 0x30
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], r12
mov qword [rbp - 0x79], rax
lea ebx, [r13 + 0x5b]
lea rax, [rbp - 0x49]
mov dword [rbp - 0x71], 0x240
mov qword [rbp - 0x69], rax
mov esi, r12d
mov qword [rbp - 0x61], r12
mov r14d, r12d
mov rdx, qword [r15 + 0x10]
lea rcx, [rbp - 0x59]
add r14d, r13d
mov rdx, qword [rdx + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x30]
mov edx, 0xf000f
lea rcx, [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ZwCreateDirectoryObject]
mov edi, eax
cmp eax, 0xc000003a
jne 0x140011256
mov rcx, qword [r15 + 0x10]
mov edx, ebx
mov rcx, qword [rcx + 0x80]
call sub.ntoskrnl.exe_wcsrchr
test rsi, rsi
je 0x140011248
mov word [rsi], bx
mov rsi, rax
test rax, rax
je 0x1400112ce
mov word [rax], r12w
jmp 0x1400112ce
test edi, edi
js 0x1400112b9
mov rbx, cr8
mov cr8, r13
mov rcx, qword [0x140052108]
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [0x140052050]
xor r8d, r8d
lea edx, [r8 + 0x18]
call fcn.140014c70
mov rcx, qword [rbp + 0x6f]
mov r8, rax
xor edx, edx
mov qword [rax + 0x10], rcx
lea rcx, [0x140052110]
call fcn.14000c8ec
mov rcx, qword [0x140052108]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
movzx eax, bl
mov cr8, rax
mov ebx, 0x5c
jmp 0x1400112c3
cmp edi, 0xc0000035
cmove edi, r12d
test rsi, rsi
je 0x1400112d8
mov word [rsi], bx
mov rsi, r12
cmp r14d, 0x40
jb 0x1400111f9
cmp r14d, 0x40
jb 0x1400112e5
mov edi, 0xc0000001
jmp 0x1400112e9
test edi, edi
jns 0x140011313
lfence
mov r9, qword [r15 + 0x10]
mov r8d, edi
mov rax, qword [r15]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xc10204bd
or dword [rsp + 0x20], 0xffffffff
mov r9, qword [r9 + 0x80]
call fcn.140014bd4
lea r11, [rsp + 0xf0]
shr edi, 0x1f
mov rbx, qword [r11 + 0x30]
xor dil, r13b
mov rsi, qword [r11 + 0x40]
mov al, dil
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140013c4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rbx, rdx
mov rdi, rcx
mov rdx, qword [rdx + 0x10]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rbx + 0x20]
lea rax, [rbp - 0x69]
and qword [rbp - 1], 0
lea rcx, [rbp - 0x59]
xorps xmm0, xmm0
mov qword [rbp + 7], rax
movdqu xmmword [rbp + 0x17], xmm0
mov dword [rbp - 9], 0x30
mov dword [rbp + 0xf], 0x240
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x41], 0
lea rax, [rbp - 0x59]
xorps xmm0, xmm0
mov qword [rbp - 0x39], rax
mov ebx, 0x20019
mov dword [rbp - 0x49], 0x30
mov edx, ebx
mov dword [rbp - 0x31], 0x240
lea r8, [rbp - 0x49]
lea rcx, [rbp + 0x77]
movdqu xmmword [rbp - 0x29], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x140013cf9
lea r8, [rbp - 9]
mov rcx, rdi
lea rdx, [rbp - 0x49]
call fcn.140013e20
jmp 0x140013e09
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x14002ce10]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0x2f], 0
lea rax, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r8, [rbp + 0x27]
mov dword [rbp + 0x27], 0x30
mov edx, ebx
mov dword [rbp + 0x3f], 0x240
lea rcx, [rbp + 0x77]
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x140013df0
mov rcx, qword [rdi + 8]
xor r8d, r8d
mov edx, 0x800
call fcn.140014c70
mov rdi, rax
test rax, rax
jne 0x140013d71
mov ebx, 0xc000009a
jmp 0x140013dde
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x59]
mov r9, rdi
mov dword [rsp + 0x20], 0x800
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x140013dcc
movzx eax, word [rbp - 0x69]
cmp dword [rdi + 8], eax
jb 0x140013dc7
lfence
movzx r8d, word [rbp - 0x69]
lea rcx, [rdi + 0xc]
mov rdx, qword [rbp - 0x61]
shr r8, 1
inc r8
call sub.ntoskrnl.exe__wcsnicmp
test eax, eax
je 0x140013dcc
mov ebx, 0xc0000035
test rdi, rdi
je 0x140013dde
mov edx, 0x800
mov rcx, rdi
call fcn.14000e2f4
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x140013df0
mov al, 1
jmp 0x140013e09
lfence
xor r9d, r9d
mov r8d, ebx
mov ecx, 0xc10204d9
lea edx, [r9 + 0x33]
call fcn.140014bb8
xor al, al
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400142bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov eax, edx
mov rsi, rcx
xor ebx, ebx
test r8, r8
jne 0x140014508
test rcx, rcx
je 0x140014508
mov rdx, qword [rcx]
mov ecx, eax
call fcn.1400134c8
mov r12, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140014504
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x240
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
lea r8, [rsp + 0x60]
mov edx, 0x20019
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov r14d, eax
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x1400144f5
mov rax, qword [rsi + 8]
test rax, rax
je 0x14001438f
movzx ecx, word [rax + 2]
test cx, cx
je 0x14001438f
lea rdx, [rcx + 0x18]
mov r8d, dword [str.sboxS]
mov ecx, dword [0x140051f60]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
jmp 0x140014392
mov rdi, rbx
mov qword [rsp + 0xd8], rdi
test rdi, rdi
je 0x1400144d0
mov eax, dword [rsi + 0x20]
test eax, eax
je 0x1400143c5
lea edx, [rax + 8]
mov r8d, dword [str.sboxS]
mov ecx, dword [0x140051f60]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
jmp 0x1400143c8
mov r15, rbx
mov qword [rsp + 0x38], r15
test r15, r15
je 0x1400144c1
mov rax, qword [rsi + 8]
movzx edx, word [rax]
mov word [rdi], dx
mov rax, qword [rsi + 8]
movzx ecx, word [rax + 2]
mov word [rdi + 2], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
cmp dx, cx
jbe 0x1400143fe
mov word [rdi], cx
jmp 0x140014401
movzx ecx, dx
movzx r8d, cx
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.140027b80
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x140014422
mov eax, dword [rax]
jmp 0x140014424
mov eax, ebx
mov dword [rsp + 0xd0], eax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsi + 0x20]
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8d, dword [rsi + 0x10]
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov r14d, eax
mov dword [rsp + 0x30], eax
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14001446d
mov eax, dword [rsp + 0xd0]
mov dword [rcx], eax
mov eax, dword [rsi + 0x20]
mov edx, dword [rsp + 0xd0]
cmp edx, eax
cmova edx, eax
mov dword [rsp + 0xd0], edx
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140014497
mov r8d, edx
mov rdx, r15
call fcn.140027b80
jmp 0x1400144b2
mov edx, dword [str.sboxS]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [str.sboxS]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r14d, r14d
jne 0x1400144dc
mov ebx, 0xc0000503
jmp 0x1400144ea
cmp r14d, 0xc0000034
cmove r14d, ebx
mov ebx, r14d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [str.sboxS]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x14001450a
xor eax, eax
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014524
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
xor ebx, ebx
test rcx, rcx
jne 0x140014741
test rdx, rdx
je 0x140014741
mov rdx, qword [rdx]
mov ecx, r8d
call fcn.1400134c8
mov r12, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14001473d
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x88], 0x240
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, 0x20006
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov r15d, eax
test eax, eax
jne 0x140014722
mov r15d, 0xc0000022
mov dword [rsp + 0x40], r15d
mov rax, qword [rsi + 8]
test rax, rax
je 0x14001461c
movzx ecx, word [rax + 2]
test cx, cx
je 0x14001461c
lea rdx, [rcx + 0x18]
mov r8d, dword [str.sboxS]
mov ecx, dword [0x140051f60]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
jmp 0x14001461f
mov rdi, rbx
mov qword [rsp + 0xe8], rdi
test rdi, rdi
je 0x140014717
mov eax, dword [rsi + 0x20]
test eax, eax
je 0x140014652
lea edx, [rax + 8]
mov r8d, dword [str.sboxS]
mov ecx, dword [0x140051f60]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
jmp 0x140014655
mov r14, rbx
mov qword [rsp + 0x48], r14
test r14, r14
je 0x140014708
mov rax, qword [rsi + 8]
movzx edx, word [rax]
mov word [rdi], dx
mov rax, qword [rsi + 8]
movzx ecx, word [rax + 2]
mov word [rdi + 2], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
cmp dx, cx
jbe 0x14001468b
mov word [rdi], cx
jmp 0x14001468e
movzx ecx, dx
movzx r8d, cx
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.140027b80
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x1400146b7
mov r8d, dword [rsi + 0x20]
mov rcx, r14
call fcn.140027b80
mov eax, dword [rsi + 0x20]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, dword [rsi + 0x14]
mov r8d, dword [rsi + 0x10]
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r15d, eax
mov dword [rsp + 0x40], eax
jmp 0x1400146f9
mov edx, dword [str.sboxS]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [str.sboxS]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ebx, 0xc0000503
test r15d, r15d
cmovne ebx, r15d
mov edx, dword [str.sboxS]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140014743
xor eax, eax
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140018c28
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, r9
mov r14d, r8d
mov rbx, rcx
xor esi, esi
mov qword [r9], rsi
mov r13, qword [rsp + 0xb0]
mov dword [r13], esi
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
test rax, rax
je 0x140018d84
lea r15d, [r14*2 + 0x20]
xor r8d, r8d
mov edx, r15d
mov rcx, qword [0x140052050]
call fcn.140014c70
mov rsi, rax
test rax, rax
je 0x140018d84
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov edx, 0x20
lea r8d, [rdx - 0x18]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rdi + 0x20]
mov qword [rsp + 0x20], rbx
mov edx, 0x50
lea r8d, [rdx - 0x48]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov edi, dword [rsp + 0x98]
add rdi, rbx
mov edx, 0x10
lea r8d, [rdx - 0xc]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx eax, word [rdi]
shr eax, 1
mov dword [rsp + 0xb0], eax
movzx ecx, word [rdi + 2]
shr ecx, 1
mov dword [rsp + 0xa8], ecx
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x28], rdx
test eax, eax
je 0x140018d77
test ecx, ecx
je 0x140018d77
test rdx, rdx
je 0x140018d77
cmp eax, r14d
ja 0x140018d77
cmp eax, ecx
ja 0x140018d77
lfence
mov rdi, qword [rsp + 0x28]
cmp rdi, qword [rsp + 0x20]
jae 0x140018d3e
add rdi, qword [rsp + 0x20]
mov qword [rsp + 0x28], rdi
mov eax, dword [rsp + 0xb0]
lea rbx, [rax + rax]
mov r8d, 2
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140027b80
xor eax, eax
mov word [rbx + rsi], ax
mov qword [r12], rsi
mov dword [r13], r15d
jmp 0x140018d79
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140018da0
Capabilities:
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rdi, rcx
cmp qword [0x140052218], rsi
jne 0x140018e5c
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140018e5c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x70]
mov r8d, 0x258
call fcn.140018c28
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140018e51
mov edx, dword [rsp + 0x50]
test edx, edx
je 0x140018e51
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x140018e05
cmp eax, 0xa
jbe 0x140018e49
lfence
mov rbx, qword [rsp + 0x58]
lea rdx, [0x14002d3f0]
mov eax, eax
add rax, 0xfffffffffffffff6
lea rcx, [rbx + rax*2]
call sub.ntoskrnl.exe__wcsicmp
mov rdx, qword [0x140052218]
test eax, eax
cmove rdx, rdi
mov qword [0x140052218], rdx
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call fcn.14000e2f4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp rdi, qword [0x140052218]
sete al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140018f68
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rbx, r8
lea rdx, [rax + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
xor esi, esi
test eax, eax
jns 0x140018f97
or dword [rbx], 0xffffffff
jmp 0x140018fe3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov dword [rbx], eax
test rbp, rbp
je 0x140018fde
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsReferencePrimaryToken]
mov rcx, rax
mov rdx, rbp
mov rdi, rax
call fcn.140021a20
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_PsDereferencePrimaryToken]
test ebx, ebx
jns 0x140018fde
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140018fe3
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a114
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [r11 + 8], 0
mov rsi, r9
mov rbp, r8
mov rax, rdx
cmp rcx, 0xffffffffffffffff
jne 0x14001a152
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
jmp 0x14001a197
test rcx, rcx
je 0x14001a17e
mov r8, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rax, [rsp + 0x40]
and qword [rsp + 0x28], 0
mov r9b, 1
xor edx, edx
mov qword [rsp + 0x20], rax
mov r8, qword [r8]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
jmp 0x14001a191
test rax, rax
je 0x14001a1d9
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14001a1de
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov rcx, qword [rsp + 0x40]
mov dword [rsi], eax
call qword [sym.imp.ntoskrnl.exe_PsReferencePrimaryToken]
mov rcx, rax
mov rdx, rbp
mov rbx, rax
call fcn.140021a20
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_PsDereferencePrimaryToken]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
jns 0x14001a1e6
jmp 0x14001a1de
mov edi, 0xc000000d
and qword [rbp + 8], 0
or dword [rsi], 0xffffffff
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a200
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x48]
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14001a2ad
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessJob]
test rax, rax
je 0x14001a2a2
mov rcx, qword [0x140052050]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rdx, rax
call fcn.140014d90
test eax, eax
js 0x14001a2a2
mov rcx, qword [rsp + 0x40]
lea rax, [0x14002fd60]
cmp rcx, rax
je 0x14001a290
cmp word [rcx], 0x78
jne 0x14001a285
mov rcx, qword [rcx + 8]
lea r8d, [rbx + 0x16]
lea rdx, [0x14002d5a0]
call sub.ntoskrnl.exe__wcsnicmp
mov rcx, qword [rsp + 0x40]
test eax, eax
movzx ebx, bl
mov edx, 1
cmove ebx, edx
mov edx, dword [rsp + 0x38]
call fcn.14000e2f4
jmp 0x14001a2a2
cmp dword [0x140052048], 6
mov edx, 1
movzx ebx, bl
cmovae ebx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x14001ac14
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
xor r8d, r8d
movsxd rdi, edx
mov rbx, rcx
mov rcx, qword [0x140052050]
lea edx, [r8 + 0x10]
call fcn.140014c70
mov r8, qword [rbx]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
xor ebp, ebp
xorps xmm0, xmm0
xor r9d, r9d
mov qword [rax], r8
mov edx, 0x1fffff
mov qword [rax + 8], rdi
lea r8, [rsp + 0x40]
lea rax, [0x14001ad90]
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x58], 0x200
mov qword [rsp + 0x50], rbp
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x14001ad6b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
jne 0x14001ad67
mov esi, dword [rbx + 0x28]
xor r8d, r8d
mov rcx, qword [0x140052050]
add esi, 0x40
mov edx, esi
call fcn.140014c70
mov rdi, rax
test rax, rax
je 0x14001ad67
mov ecx, dword [rbx + 0xa4]
test ecx, ecx
jne 0x14001ad03
mov r9, qword [rbx + 0x20]
lea r8, [0x14002d5d0]
mov edx, esi
mov rcx, rax
call fcn.1400038d4
jmp 0x14001ad32
mov eax, dword [rbx + 0xa4]
cmp eax, 0xffffffff
je 0x14001ad2f
mov eax, dword [rbx + 0xa4]
lea r8, [0x14002d5e0]
mov r9, qword [rbx + 0x20]
mov rcx, rdi
mov edx, esi
mov dword [rsp + 0x20], eax
call fcn.1400038d4
jmp 0x14001ad32
mov word [rdi], bp
mov dword [rbx + 0xa4], 0xffffffff
cmp word [rdi], bp
je 0x14001ad5d
mov rax, qword [rbx]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov ecx, 0xc102090a
call fcn.140014a04
mov edx, esi
mov rcx, rdi
call fcn.14000e2f4
mov al, 1
jmp 0x14001ad6d
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001d648
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, r8
lea rax, [rbp - 0x48]
mov r8, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov r15, r9
mov rsi, rdx
xor r12d, r12d
mov qword [r11 - 0x70], r12
mov r9b, 1
xor edx, edx
mov qword [r11 - 0x78], rax
mov r8, qword [r8]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x14001d6a3
lfence
jmp 0x14001d7c1
mov rcx, qword [rbp - 0x48]
cmp rcx, rbx
je 0x14001d6bc
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000022
jmp 0x14001d7c1
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rbp - 0x48]
cmp rcx, rax
jne 0x14001d6d0
mov dil, r12b
jmp 0x14001d6dd
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dil, 1
lea rax, [rbp - 0x40]
mov r9b, 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test dil, dil
je 0x14001d711
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lfence
test ebx, ebx
js 0x14001d7bf
mov esi, 5
movzx r14d, r12w
cmp dword [0x140052048], esi
mov rdi, r12
jb 0x14001d754
mov rax, qword [0x140052168]
mov rcx, qword [rbp - 0x50]
call qword [0x14002f658]
movzx r14d, word [rax + 0x10]
mov rdi, qword [rax + 0x18]
mov rdx, rdi
movzx ecx, r14w
call fcn.14001d7e4
test rax, rax
je 0x14001d77f
mov r8, qword [rbp - 0x50]
lea r9, [rbp - 0x40]
mov rdx, rax
mov qword [rsp + 0x20], r12
mov rcx, r15
call fcn.14001d144
jmp 0x14001d7b3
cmp r14w, 0xa
jne 0x14001d7b5
lea rcx, [0x14002daa0]
sub rdi, rcx
movzx eax, word [rcx]
cmp word [rdi + rcx], ax
jne 0x14001d7b5
add rcx, 2
sub rsi, 1
jne 0x14001d790
mov r8d, dword [rbp - 0x3c]
mov rcx, r15
mov rdx, qword [rbp - 0x50]
call fcn.14001eb88
mov ebx, eax
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret