joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003370
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12d, r8d
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
test rdx, rdx
jne 0x1400033b2
cmp qword [0x140006100], rbx
je 0x1400033b2
lea edi, [rdx + 1]
movzx eax, di
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov edi, 1
cmp rsi, rdi
jne 0x1400033c5
cmp qword [0x140006100], rbx
je 0x14000339d
test r14, 0xfffffffffffffffb
je 0x14000339d
mov qword [rsp + 0x20], rbx
test r8d, r8d
je 0x14000339d
lea rcx, [0x140006118]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r15b, al
mov byte [rsp + 0x68], al
test rsi, rsi
jne 0x140003439
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140003408
movzx eax, di
jmp 0x1400033a0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdi, r12
add rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003461
mov qword [rdi], rbx
mov rax, qword [rsp + 0x20]
mov qword [0x140006100], rax
jmp 0x140003466
mov rdi, r12
add rdi, qword [0x140006100]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003461
cmp qword [rdi], rbx
jne 0x140003461
mov qword [rdi], r14
mov qword [0x140006100], rbx
jmp 0x140003466
mov ebx, 0xc0000001
mov dword [rsp + 0x78], ebx
jmp 0x140003476
mov dl, r15b
lea rcx, [0x140006118]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
movzx eax, bx
jmp 0x1400033a0

Function at 0x140003490
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], rsp
test rcx, 0xfffffffffffffffb
je 0x1400034ef
xor edi, edi
mov qword [rsp + 0x20], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000350f
lea rdx, [0x1400034ef]
mov rcx, rsp
call sub.ntoskrnl.exe__local_unwind
nop
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140004440
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
js 0x1400034ef
movzx eax, di
jmp 0x1400034f4
Function at 0x140003550
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14d, r9d
mov rsi, r8
mov rbx, rcx
mov qword [rsp + 0x40], rdx
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x30], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x20], r9d
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [0x140004bc0]
call sub.ntoskrnl.exe_DbgPrint
nop
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400035d4
lea eax, [r15 + 1]
jmp 0x140003676
lfence
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edi, 1
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rdx, rbx
lea rcx, [0x140004c00]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x20], rdi
mov r9d, r14d
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x30], r15b
test ebx, ebx
jns 0x140003659
movzx eax, di
jmp 0x140003676
movzx eax, r15w
jmp 0x140003676
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140004440
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003698
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x40], r9
and qword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x140003712
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004780
mov eax, 0xc0000001
jmp 0x14000384c
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003742
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x1400036fb
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140003780
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004780
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140003708
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r14, rax
mov r8, rdi
mov rcx, rsi
test rax, rax
jne 0x1400037e5
xor edx, edx
call fcn.140004780
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x140003708
mov rdx, r14
call fcn.1400044c0
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov cl, al
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, r15d
jmp 0x14000384c
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140004440
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000386c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rsi, r9
mov edi, r8d
mov r15, rdx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x48], r9
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r12d, eax
test eax, eax
js 0x140003a03
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140003a03
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003910
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r8d, edi
xor edx, edx
mov rcx, rsi
call fcn.140004780
mov eax, 0xc0000001
jmp 0x140003a03
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140003968
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004780
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x140003906
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003993
mov r8, rdi
mov rdx, r15
mov rcx, r14
call fcn.1400044c0
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov cl, al
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
lfence
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, r12d
jmp 0x140003a03
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140004440
add rsp, 0x98
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003a24
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r9
mov edi, r8d
mov r14, rdx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x38], r9
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140003a99
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004780
mov eax, 0xc0000001
jmp 0x140003b18
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test r15d, r15d
jns 0x140003ab2
lea rcx, [0x140004b00]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003a92
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003adc
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140003a85
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.1400044c0
mov dword [rsp + 0x20], ebx
jmp 0x140003b0b
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140004440
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003b34
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15d, r8d
mov qword [rax - 0x28], rbx
mov r14, r9
mov qword [rax - 0x20], rbx
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbp, rax
test rax, rax
je 0x140003bd0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003bd0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003bd0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov r9, r14
mov byte [rsp + 0x28], bl
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
test eax, eax
mov ecx, 0xc0000001
cmovs ebx, ecx
mov eax, ebx
jmp 0x140003bd5
mov eax, 0xc0000001
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140003bf0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
xorps xmm0, xmm0
mov rdi, rdx
mov ebx, r8d
lea rdx, [rsp + 0x20]
mov rsi, r9
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x20]
mov ebp, eax
test rcx, rcx
je 0x140003cb8
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003cad
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r8d, 4
mov edx, ebx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov rdi, rax
test rax, rax
je 0x140003cad
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call fcn.1400044c0
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebp
jmp 0x140003cca
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.140004780
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004440
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003ce0
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov esi, r8d
mov edx, r8d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140003d50
lea rcx, [0x140004ae0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140003df8
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.1400044c0
lea rdx, [rsp + 0x28]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140003d89
lea rcx, [0x140004b00]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140003d46
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003db3
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140003d46
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.1400044c0
mov dword [rsp + 0x20], ebx
jmp 0x140003dd5
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140004440
add rsp, 0x78
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003e14
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
lea rax, [rdx - 0x10001]
xorps xmm0, xmm0
mov rbx, rcx
movabs rcx, 0x7ffffffefffe
mov r14, r9
mov rdi, rdx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
cmp rax, rcx
ja 0x140003f95
mov edx, r8d
xor ecx, ecx
mov ebp, r8d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x140003e8b
lea rcx, [0x140004ae0]
jmp 0x140003f9c
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.1400044c0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x140003ec9
lea rcx, [0x140004b00]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140003fa1
lfence
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003ef9
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140003fa1
lfence
mov r8, rbp
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_MmCreateMdl]
mov rdi, rax
test rax, rax
je 0x140003f70
lfence
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rbx, rax
test rax, rax
je 0x140003f62
lfence
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.1400044c0
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov cl, al
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
xor ebx, ebx
jmp 0x140003f67
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140003fa6
lea rcx, [0x140004b40]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004440
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003fc0
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15d, r8d
mov qword [rax - 0x28], rbx
mov r14, r9
mov qword [rax - 0x20], rbx
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbp, rax
test rax, rax
je 0x140004062
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
mov esi, eax
test rcx, rcx
je 0x140004062
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test esi, esi
js 0x140004062
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140004062
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov r9, rdi
mov byte [rsp + 0x28], bl
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
test eax, eax
mov ecx, 0xc0000001
cmovs ebx, ecx
mov eax, ebx
jmp 0x140004067
mov eax, 0xc0000001
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004084
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
xorps xmm0, xmm0
mov rbx, rdx
mov edi, r8d
mov rbp, rcx
mov edx, r8d
xor ecx, ecx
mov r14, r9
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x1400040e6
lea rcx, [0x140004ae0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400041c9
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.1400044c0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x20]
mov r14d, eax
test rcx, rcx
je 0x1400041bc
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400041b1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r8d, 4
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov rbp, rax
test rax, rax
je 0x1400041b1
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov bl, al
mov rcx, cr0
btr rcx, 0x10
mov cr0, rcx
cli
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.1400044c0
mov rcx, cr0
sti
bts rcx, 0x10
mov cr0, rcx
mov cl, bl
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r14d
jmp 0x1400041ce
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004780
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004440
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x2c5511380
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
lea rax, [rbp - 8]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call rax
test eax, eax
sete al
test al, al
jne 0x2c55114b9
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x800c
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call rax
test eax, eax
sete al
test al, al
jne 0x2c55114bc
mov rax, qword [rbp - 0x10]
mov ecx, dword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptHashData]
call rax
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8, rcx
mov edx, 0x6610
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call rax
mov rax, qword [rbp - 0x18]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
jmp 0x2c55114bd
nop
jmp 0x2c55114bd
nop
add rsp, 0x50
pop rbp
ret