joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002168
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140076ea0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r14, rdx
and qword [rsp + 0x38], 0
test rcx, rcx
jne 0x1400021a8
mov eax, 0xc0000001
jmp 0x1400022f1
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x1400022f1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
setne sil
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
xor edi, edi
mov qword [rsp + 0x50], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x40], xmm1
lea rdx, [0x1400161d0]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, sil
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.14000c6fc
mov r15d, 0xc0000225
test rax, rax
cmove ebx, r15d
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x140002257
mov r8, qword [rsp + 0x38]
lea rdx, [0x1400161f0]
mov rcx, rax
call fcn.14000b174
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
cmove ebx, r15d
mov dword [rsp + 0x30], ebx
mov rdx, r14
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
mov rcx, rdi
test sil, sil
je 0x140002280
call fcn.14000b4ac
lea r8, [0x140016200]
jmp 0x14000228c
call fcn.14000b5e0
lea r8, [0x140016230]
mov rbx, rax
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9b, 1
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rbx
call fcn.1400097d8
mov ebx, dword [rsp + 0x30]
test ebx, ebx
jns 0x1400022d2
mov r9d, ebx
lea r8, [0x140016260]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x1400022d9
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140014f80
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140002498
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
and qword [rax + 0x10], 0
mov ebp, ecx
xor ebx, ebx
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x140002544
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140002539
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002539
mov rcx, qword [0x1400774d0]
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002539
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rdi]
test rcx, rcx
je 0x140002539
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002539
mov rcx, qword [rsp + 0x38]
test ebp, ebp
je 0x140002524
mov rax, qword [0x1400774c8]
and dword [rax + rcx], 0
jmp 0x140002539
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x1400774c8]
mov dword [rcx + rdx], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
inc rbx
cmp rbx, 0xc350
jb 0x1400024b5
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000256c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor edx, edx
mov ebx, ecx
lea rcx, [rbp - 9]
lea r8d, [rdx + 0x58]
call fcn.140015300
and qword [rbp + 0x6f], 0
lea rdx, [rbp + 0x6f]
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140002653
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
movups xmm0, xmmword [0x1400154d0]
mov rbx, rax
mov rcx, qword [rax + 0x20]
mov rdx, qword [rcx + 0x78]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x1400154e0]
movups xmmword [rdx + 0x10], xmm1
mov ecx, dword [0x1400154f0]
mov dword [rdx + 0x20], ecx
movzx ecx, word [0x1400154f4]
mov word [rdx + 0x24], cx
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rbx + 0x20]
lea rdx, [0x140015500]
movups xmm0, xmmword [rbp - 0x19]
movdqu xmmword [rax + 0x70], xmm0
mov rax, qword [rbx + 0x20]
movups xmm1, xmmword [rbp - 0x19]
movdqu xmmword [rax + 0x60], xmm1
mov rcx, qword [rbp + 0x6f]
call fcn.140011470
mov rcx, qword [rbp + 0x6f]
lea rdx, [0x140015520]
call fcn.1400113a8
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0x90]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000266c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
mov ebx, 0xc0000001
mov dword [rax - 0x18], ebx
and qword [rax + 0x18], 0
and qword [rax + 0x10], 0
lea rdx, [rax + 0x18]
lea rcx, [0x140015460]
call fcn.140009a8c
test eax, eax
je 0x140002702
mov ecx, edi
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x140002706
mov rax, qword [0x1400774e0]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rax + rcx]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400026ea
mov rdx, qword [0x1400774e0]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rdx + rax]
mov rax, qword [rsp + 0x48]
mov qword [rdx + rax], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x14000270c
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140002954
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and qword [rax - 0x58], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
mov dword [rax - 0x60], 0x100
xorps xmm0, xmm0
and qword [rax - 0x68], 0
mov ebx, 0x80
and dword [rax - 0x70], 0
mov edx, 0x110000
and dword [rax - 0x78], 0
and qword [rax - 0x80], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov qword [rbp + 0x37], rcx
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
test eax, eax
js 0x140002a97
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x6f]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x67]
mov edx, ebx
mov qword [rsp + 0x20], rax
mov r8, qword [r8]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
test eax, eax
jns 0x140002a2c
mov rcx, qword [rbp + 0x67]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, edi
jmp 0x140002a97
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140002a86
cmp qword [rax + 8], 0
je 0x140002a86
cmp qword [rax + 0x10], 0
je 0x140002a86
mov rcx, qword [rcx + 0x28]
xor edx, edx
and qword [rcx + 0x10], 0
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
mov rcx, qword [rbp + 0x6f]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x67]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
test bl, bl
je 0x140002a28
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov edi, eax
test eax, eax
jns 0x140002a97
jmp 0x140002a28
mov rcx, qword [rbp + 0x67]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, 0xc000000d
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140002aac
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rbx, rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002ad8
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapViewOfSection]
add rsp, 0x20
pop rbx
ret

Function at 0x140005ef0
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x28]
lea rdi, [0x14007a9c0]
mov rbx, rcx
lea rdx, [0x140016d60]
mov rcx, rdi
or dword [rax + 0x68], 0x20
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140016d10]
lea rcx, [0x14007a9b0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x14007a9d8]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
mov r8, rdi
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x14000602a
mov rdx, rdi
lea rcx, [0x14007a9b0]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x140005f8a
mov rcx, qword [0x14007a9d8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x140006028
lea rax, [0x140002b60]
mov ecx, 0x1b
lea rdi, [rbx + 0x70]
rep stosq qword [rdi], rax
lea rax, [0x140002b80]
mov qword [rbx + 0xe0], rax
lea rax, [0x140002b60]
mov qword [rbx + 0x70], rax
lea rax, [0x140006040]
mov qword [rbx + 0x68], rax
mov qword [0x140077608], rbx
mov rax, qword [rbx + 0x28]
mov rcx, qword [rax]
mov qword [0x140077610], rcx
call fcn.14000d218
mov rcx, rbx
call fcn.14000d0dc
mov edi, eax
test eax, eax
jns 0x140006006
xor edx, edx
mov dword [rsp + 0x20], eax
lea r9, [0x140016db0]
lea r8, [0x140016dc0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
movabs rax, 0x7ffffffffff
mov qword [0x140077580], rax
movabs rax, 0xfffff00000000000
mov qword [0x140077588], rax
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140006c48
Capabilities:
Find process by pid
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140076ea0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
mov r14, rdx
xor ebx, ebx
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x38], rbx
mov r12d, r8d
mov dword [rbp - 0x40], ebx
mov r15, rcx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140006ca4
mov eax, 0xc0000001
jmp 0x140006d77
mov r8d, 0x20
lea r9, [rbp - 0x40]
lea rdx, [rbp - 0x30]
lea ecx, [r8 - 0x10]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140006d6b
mov ecx, dword [rbp - 0x40]
test ecx, ecx
je 0x140006d6b
add ecx, 0x1000
mov r8d, 0x6d7467
mov dword [rbp - 0x40], ecx
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140006d6b
mov r8d, dword [rbp - 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015300
mov r8d, dword [rbp - 0x40]
lea r9, [rbp - 0x40]
mov rdx, rdi
mov ecx, 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, eax
test eax, eax
js 0x140006d5d
cmp dword [rdi], ebx
jbe 0x140006d5d
mov eax, ebx
lea rdx, [rax*2 + 1]
add rdx, rax
lea rdx, [rdi + rdx*8]
mov eax, dword [rdx]
cmp r15, rax
jne 0x140006d57
mov eax, dword [r14]
cmp r12d, eax
jbe 0x140006d52
mov rcx, qword [rbp - 0x38]
mov r8, r14
call fcn.14000cf10
mov eax, dword [r14]
inc eax
mov dword [r14], eax
inc ebx
cmp ebx, dword [rdi]
jb 0x140006d23
mov edx, 0x6d7467
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140014f80
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400077ec
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x48], 0
mov r14, rdx
mov esi, r8d
sub rsi, 0x28
shr rsi, 5
test ecx, ecx
jne 0x140007820
mov eax, 0xc0000001
jmp 0x14000792d
mov ecx, ecx
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140007918
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rcx]
test rbp, rbp
je 0x14000791d
test rbx, rbx
je 0x14000792b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007918
and qword [rsp + 0x58], 0
cmp qword [sym.imp.ntoskrnl.exe_MmIsAddressValid], 0
je 0x140007918
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007918
lea rdx, [rsp + 0x58]
lea rcx, [0x140015470]
call fcn.14000fa90
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140007918
mov rcx, rbx
call qword [0x1400176c0]
test rax, rax
je 0x140007918
cmp rax, rbp
jne 0x140007918
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007918
mov rcx, qword [0x1400774d0]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007918
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x140007918
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007918
mov rcx, qword [rsp + 0x48]
mov r8d, esi
mov rdx, r14
call fcn.140007940
mov edi, eax
test eax, eax
js 0x140007918
cmp esi, dword [r14]
sbb edi, edi
and edi, 0xc0000023
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14000792b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140007abc
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and qword [r11 + 0x20], 0
movabs rax, 0x7b301ecc07b301ed
mov ebp, r8d
mov r15, rdx
lea r8, [rbp - 0x430]
mul r8
mov r14, rdx
shr r14, 9
test ecx, ecx
jne 0x140007b08
mov eax, 0xc0000001
jmp 0x140007c69
mov ecx, ecx
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140007c54
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rcx]
test rsi, rsi
je 0x140007c59
test rbx, rbx
je 0x140007c67
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007c54
and qword [rsp + 0x20], 0
cmp qword [sym.imp.ntoskrnl.exe_MmIsAddressValid], 0
je 0x140007c54
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007c54
lea rdx, [rsp + 0x20]
lea rcx, [0x140015470]
call fcn.14000fa90
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140007c54
mov rcx, rbx
call qword [0x1400176c0]
test rax, rax
je 0x140007c54
cmp rax, rsi
jne 0x140007c54
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007c54
mov rcx, qword [0x1400774d0]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007c54
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x140007c54
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140007c54
mov rdx, rbp
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140007c54
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140015300
mov rcx, qword [rsp + 0x68]
mov r8d, r14d
mov rdx, rbx
call fcn.140007c84
mov edi, eax
test eax, eax
js 0x140007c49
mov eax, dword [rbx]
cmp r14d, eax
jb 0x140007c41
mov r8, rbp
mov rdx, rbx
mov rcx, r15
call fcn.140015040
xor edi, edi
jmp 0x140007c49
mov dword [r15], eax
mov edi, 0xc0000023
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140007c67
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400081e0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x48], 0
mov r14d, r8d
mov r15, rdx
test ecx, ecx
jne 0x14000820c
mov eax, 0xc0000001
jmp 0x1400083c7
mov ecx, ecx
lea rdx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x1400083b3
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rbx, qword [rbp + 0x48]
mov rsi, qword [rcx]
test rsi, rsi
je 0x1400083b7
test rbx, rbx
je 0x1400083c5
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400083b3
and qword [rbp - 8], 0
cmp qword [sym.imp.ntoskrnl.exe_MmIsAddressValid], 0
je 0x1400083b3
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400083b3
lea rdx, [rbp - 8]
lea rcx, [0x140015470]
call fcn.14000fa90
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400083b3
mov rcx, rbx
call qword [0x1400176c0]
test rax, rax
je 0x1400083b3
cmp rax, rsi
jne 0x1400083b3
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400083b3
mov rcx, qword [0x1400774d0]
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400083b3
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rbx]
test rcx, rcx
je 0x1400083b3
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400083b3
and qword [rbp - 8], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
mov r9d, 0x10000000
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
xor r8d, r8d
mov byte [rsp + 0x28], 0
mov edx, 0x240
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
test eax, eax
js 0x1400083b3
and qword [rbp - 0x10], 0
lea r8, [rbp - 0x10]
mov rbx, qword gs:[0x188]
mov edx, 8
add rbx, qword [0x140077518]
mov sil, byte [rbx]
mov byte [rbx], 0
mov rcx, qword [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_NtOpenProcessToken]
mov edi, eax
test eax, eax
js 0x140008392
and dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
mov r9d, r14d
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 3
call qword [sym.imp.ntoskrnl.exe_NtQueryInformationToken]
mov edi, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400083a1
call qword [sym.imp.ntoskrnl.exe_NtClose]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400083b0
call qword [sym.imp.ntoskrnl.exe_NtClose]
mov byte [rbx], sil
mov rbx, qword [rbp + 0x48]
test rbx, rbx
je 0x1400083c5
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009a8c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rdi, rdx
xor ebx, ebx
mov rsi, rcx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140009aee
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov r8, rsi
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x140009adf
inc rax
test edx, edx
jne 0x140009acc
test ecx, ecx
mov rcx, qword [rsp + 0x40]
je 0x140009b0f
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbx, 4
cmp rbx, 0xc350
jb 0x140009aa9
and qword [rdi], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rdi], rcx
mov eax, ebx
jmp 0x140009aff
Function at 0x14000b174
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r9d, r9d
mov rsi, rdx
mov r8, rcx
test rcx, rcx
je 0x14000b25b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000b25b
movsxd rax, dword [rcx + 0x3c]
mov ecx, 0x20b
cmp word [rax + r8 + 0x18], cx
jne 0x14000b1c8
mov ecx, dword [rax + r8 + 0x88]
jmp 0x14000b1cd
mov ecx, dword [rax + r8 + 0x78]
mov r10d, ecx
mov edx, r9d
mov r14d, dword [r10 + r8 + 0x24]
mov r15d, dword [r10 + r8 + 0x20]
add r14, r8
mov edi, dword [r10 + r8 + 0x1c]
add r15, r8
mov r12d, dword [r10 + r8 + 0x14]
add rdi, r8
test r12d, r12d
je 0x14000b256
cmp rsi, 0xffff
ja 0x14000b211
movzx r11d, dx
mov ecx, r11d
movzx eax, si
add ecx, dword [r10 + r8 + 0x10]
cmp eax, ecx
jmp 0x14000b240
cmp edx, dword [r10 + r8 + 0x18]
jae 0x14000b25b
mov eax, edx
mov rbp, rsi
mov ecx, dword [r15 + rax*4]
movzx r11d, word [r14 + rax*2]
add rcx, r8
sub rbp, rcx
movzx eax, byte [rcx]
movzx ebx, byte [rcx + rbp]
sub eax, ebx
jne 0x14000b23e
inc rcx
test ebx, ebx
jne 0x14000b22c
test eax, eax
je 0x14000b24b
inc edx
cmp edx, r12d
jb 0x14000b1f5
jmp 0x14000b256
movzx eax, r11w
mov r9d, dword [rdi + rax*4]
add r9, r8
mov rax, r9
jmp 0x14000b25d
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret