joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008af8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r12d, r12d
mov eax, 0x5a4d
mov r15b, r8b
mov edi, edx
mov r11, rcx
mov r10d, r12d
mov ebx, r12d
mov ebp, r12d
cmp ax, word [rcx]
je 0x140008b37
or eax, 0xffffffff
jmp 0x140008bef
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140008b2f
movzx ecx, word [rax + 4]
cmp ecx, 0x14c
jne 0x140008b57
mov rbx, rax
jmp 0x140008b66
cmp ecx, 0x8664
jne 0x140008bea
mov rbp, rax
mov r8d, dword [rax + 0x58]
mov dword [rax + 0x58], r12d
mov eax, edx
shr eax, 1
movzx esi, r12w
je 0x140008ba1
mov r14d, eax
movzx ecx, word [r11]
movzx edx, si
mov esi, r12d
add edx, r10d
add edx, ecx
cmp edx, 0xffff
movzx r10d, dx
seta sil
add r11, 2
dec r14
jne 0x140008b7b
movzx eax, si
add r10d, eax
test dil, 1
je 0x140008bb4
movzx eax, byte [r11]
add r10d, eax
add r10d, edi
test r15b, r15b
je 0x140008bc1
mov eax, r12d
jmp 0x140008bd1
sub r10d, r8d
neg r10d
mov r10d, r8d
sbb eax, eax
and eax, 0xc0000001
test rbx, rbx
je 0x140008bdc
mov dword [rbx + 0x58], r10d
jmp 0x140008be0
mov dword [rbp + 0x58], r10d
test r9, r9
je 0x140008bef
mov dword [r9], r10d
jmp 0x140008bef
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x140008c0c
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp ax, word [rcx]
je 0x140008c1a
or eax, 0xffffffff
ret
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140008c16
movzx ecx, word [rax + 4]
cmp ecx, 0x14c
je 0x140008c3d
cmp ecx, 0x8664
jne 0x140008c45
mov eax, dword [rax + 0x50]
mov dword [rdx], eax
xor eax, eax
ret
mov eax, 0xc0000001
ret

Function at 0x140008c4c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov r12d, r9d
mov rsi, r8
mov r14d, edx
mov r15, rcx
cmp ax, word [r8]
jne 0x140008d12
movsxd rdi, dword [r8 + 0x3c]
add rdi, r8
cmp dword [rdi], 0x4550
jne 0x140008d12
movzx eax, word [rdi + 4]
test eax, 0x14c
jne 0x140008ca5
test eax, 0x8664
je 0x140008d12
mov eax, dword [rdi + 0x54]
cmp eax, r14d
ja 0x140008d12
movsxd r8, eax
mov rdx, rsi
call fcn.140001010
movzx ebp, word [rdi + 6]
movzx eax, word [rdi + 0x14]
xor ebx, ebx
test ebp, ebp
jle 0x140008d0a
add rdi, 0x24
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
je 0x140008d00
mov ecx, dword [rdi]
lea rdx, [r15 + r14]
mov r8d, eax
add rcx, r15
add rax, rcx
cmp rax, rdx
ja 0x140008d0a
mov edx, dword [rdi + 8]
lea r9, [rsi + r12]
add rdx, rsi
lea rax, [r8 + rdx]
cmp rax, r9
ja 0x140008d0a
call fcn.140001010
inc ebx
add rdi, 0x28
cmp ebx, ebp
jl 0x140008ccd
sub ebx, ebp
neg ebx
sbb eax, eax
jmp 0x140008d15
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140008d34
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov r12, r8
mov r13, rdx
and qword [rax - 0x30], 0
xor esi, esi
mov dword [0x140005230], 0x18
mov ecx, ecx
lea rdx, [rax - 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140008e6e
mov edi, 0xc0000001
mov ebx, edi
lea edx, [rsi + 0x30]
xor ecx, ecx
mov r8d, 0x4d505243
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140008e6e
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x28]
call sub.ntoskrnl.exe_PsGetProcessPeb
test rax, rax
je 0x140008e6e
mov ecx, dword [0x140005230]
mov rax, qword [rcx + rax]
test rax, rax
je 0x140008e6e
lea r14, [rax + 0x20]
mov rdi, qword [r14]
cmp rdi, r14
je 0x140008e60
lea rdx, [rdi + 0x48]
mov r8b, 1
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x140008e5b
test r12, r12
je 0x140008e0b
mov rax, qword [rdi + 0x20]
mov qword [r12], rax
test r15, r15
je 0x140008e16
mov eax, dword [rdi + 0x30]
mov dword [r15], eax
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x140008e53
mov edx, 0xa
cmp word [rbx + 2], dx
jbe 0x140008e53
lea r8, [0x140015020]
mov rcx, qword [rbx + 8]
call fcn.1400016f4
mov eax, 8
mov word [rbx], ax
lea rdx, [rdi + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x140008e60
mov rdi, qword [rdi]
jmp 0x140008de5
jmp 0x140008e6e
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140008e7e
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test rsi, rsi
je 0x140008e9a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov edx, 0x4d505243
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
Function at 0x140008f90
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
and qword [rbp - 0x19], 0
and qword [rbp - 0x21], 0
and qword [rbp + 0x5f], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2f], xmm0
and qword [rbp + 0x17], 0
mov qword [rbp + 0x1f], rcx
mov ecx, 0x100020
xor eax, eax
mov rdi, rdx
mov qword [rbp - 0x11], rcx
mov r14, r9
mov rsi, r8
mov edx, ecx
lea rcx, [rbp - 0x19]
lea r9, [rbp - 1]
lea r8, [rbp + 0xf]
mov dword [rsp + 0x28], 0x20
mov dword [rbp + 0xf], 0x30
mov dword [rbp + 0x27], 0x240
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
test eax, eax
js 0x1400090f3
mov rax, qword [rbp - 0x19]
and qword [rbp + 0x1f], 0
lea r8, [rbp + 0xf]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x21]
xor r9d, r9d
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov ebx, eax
test eax, eax
js 0x1400090f3
mov rcx, qword [rbp - 0x21]
and qword [rbp - 0x11], 0
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
lea r8, [rbp + 0x5f]
xor r9d, r9d
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0x10000
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
test eax, eax
js 0x1400090f3
mov rcx, qword [rbp + 0x5f]
lea r8, [rbp - 9]
mov rdx, rdi
call fcn.1400089a0
mov ebx, eax
test eax, eax
js 0x1400090f3
mov rdi, qword [rbp - 9]
test r14, r14
je 0x1400090e4
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x1400090e4
mov r8d, eax
mov rdx, rdi
mov rcx, r14
call fcn.140001010
mov rdx, qword [rbp + 0x5f]
test rsi, rsi
je 0x1400090f7
sub edi, edx
mov dword [rsi], edi
jmp 0x1400090f7
mov rdx, qword [rbp + 0x5f]
test rdx, rdx
je 0x140009106
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140009115
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140009124
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400092a0
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xa0
and qword [rbp + 0x5f], 0
and qword [rbp - 0x11], 0
and qword [rbp + 0xf], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27], xmm0
mov r14, r8
mov qword [rbp + 0x17], rcx
mov rbx, rdx
lea r8, [rbp + 7]
lea rcx, [rbp - 0x11]
mov edx, 4
mov r15, r9
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov edi, eax
test eax, eax
js 0x14000938e
mov rcx, qword [rbp - 0x11]
and qword [rbp - 1], 0
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rbp - 1]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
lea r8, [rbp + 0x5f]
xor r9d, r9d
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0x4000
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
test eax, eax
js 0x14000938e
mov rcx, qword [rbp + 0x5f]
lea r8, [rbp - 9]
mov rdx, rbx
call fcn.1400089a0
mov edi, eax
test eax, eax
js 0x14000938e
test r15, r15
je 0x1400093ce
cmp dword [rbp + 0x7f], 0
je 0x1400093ce
mov rcx, qword [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400093ce
mov edi, 0xc0000001
mov rbx, qword [rbp + 0x5f]
test rbx, rbx
je 0x1400093a4
mov rcx, qword [rbp - 0x11]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400093b3
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xa0]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rbp + 0x5f]
mov rdx, qword [rbp - 9]
test r14, r14
je 0x1400093e2
mov eax, edx
sub eax, ebx
mov dword [r14], eax
mov r8d, dword [rbp + 0x7f]
mov rcx, r15
call fcn.140001010
jmp 0x140009392
Function at 0x140009734
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x28], 0
and qword [rbp - 0x30], 0
and qword [rbp - 0x20], 0
mov r14d, edx
mov r12d, ecx
lea rdx, [rbp - 0x28]
mov ecx, ecx
mov rdi, r9
mov r15, r8
xor esi, esi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x1400098a4
lea rdx, [rbp - 0x30]
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov ebx, eax
test eax, eax
js 0x1400098a4
mov rcx, qword [rbp - 0x28]
and qword [rsp + 0x28], rsi
and qword [rdi + 0xe4], rsi
lea rax, [rbp - 0x10]
lea r9, [rbp - 0x18]
mov r8, rdi
xor edx, edx
mov dword [rdi + 0xd8], 3
mov qword [rdi + 0xdc], r15
mov qword [rsp + 0x20], rax
call fcn.1400093f0
mov ebx, eax
test eax, eax
js 0x1400098a4
lea r14d, [rsi + 0x38]
lea ecx, [rsi + 1]
mov r8d, 0x4d415043
mov edx, r14d
mov ebx, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x1400098a4
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.1400013e0
mov r15, qword [rbp - 0x18]
mov r14, qword [rbp - 0x10]
mov dword [rdi], r12d
mov qword [rdi + 0x28], r15
mov edx, 0x400
xor ecx, ecx
mov r8d, 0x4d415043
mov qword [rdi + 0x20], r14
mov r12d, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x1400098a4
mov qword [rsp + 0x38], rdi
mov qword [rdi + 8], rax
mov rdx, qword [rbp - 0x30]
mov byte [rsp + 0x30], 1
lea r9, [fcn.140009680]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], r14
and qword [rsp + 0x20], 0
call sub.ntoskrnl.exe_KeInitializeApc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call sub.ntoskrnl.exe_KeInsertQueueApc
neg al
sbb ebx, ebx
not ebx
and ebx, r12d
jl 0x1400098a4
lea rcx, [0x140015070]
mov r8, r15
mov rdx, r14
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400098b3
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400098c2
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
jns 0x1400098dd
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x20]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
call fcn.140009680
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400099ac
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x28], 0
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov rax, rdx
mov rsi, rcx
lea rdx, [rbp + 0x28]
mov rcx, rax
mov edi, r8d
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov ebx, eax
test eax, eax
js 0x140009acf
mov r8, qword [rbp + 0x28]
mov ebx, 0xc0000001
test dil, 1
je 0x140009a1c
mov eax, dword [0x1400052a4]
mov cl, byte [0x1400052a8]
mov dl, byte [rax + r8]
shr dl, cl
test dl, 1
je 0x140009ad3
test dil, 2
je 0x140009acb
mov rcx, r8
call sub.ntoskrnl.exe_PsGetThreadTeb
mov rdi, rax
test rax, rax
je 0x140009acf
mov rcx, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
cmp rax, qword [rcx]
ja 0x140009acf
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140009acf
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov r9d, 0x1fffff
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x200
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
test eax, eax
js 0x140009acf
mov rcx, qword [rbp - 0x18]
and qword [rbp - 0x10], 0
and qword [rsp + 0x20], 0
lea rdx, [rdi + 0x2c8]
lea r8, [rbp - 0x10]
mov r9d, 8
call qword [0x140005238]
mov ebx, eax
test eax, eax
js 0x140009acf
cmp qword [rbp - 0x10], 0
mov ebx, 0xc0000001
je 0x140009acf
mov r8, qword [rbp + 0x28]
xor ebx, ebx
jmp 0x140009ad3
mov r8, qword [rbp + 0x28]
test r8, r8
je 0x140009ae1
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140009af0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140009aff
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140009b18
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov r13d, r9d
mov r14, r8
mov r15, rdx
mov r12, rcx
test rdx, rdx
je 0x140009b49
mov dword [rdx], edi
test r8, r8
je 0x140009b51
mov dword [r8], edi
cmp di, word [rcx]
jne 0x140009b60
mov eax, 0xc0000001
jmp 0x140009c65
call fcn.140009900
mov ebx, eax
test eax, eax
js 0x140009c63
xor edx, edx
lea r9, [rsp + 0x50]
xor r8d, r8d
lea esi, [rdx + 5]
mov dword [rsp + 0x50], edi
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov ebx, eax
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140009c63
lea ecx, [rsi - 4]
mov edx, eax
mov r8d, 0x53595356
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
je 0x140009c63
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov ebx, eax
test eax, eax
js 0x140009c55
mov esi, 0xc0000001
mov rdi, rbp
lea rcx, [rbp + 0x38]
mov ebx, esi
jmp 0x140009bed
mov eax, dword [rdi]
test eax, eax
je 0x140009c55
add rdi, rax
lea rcx, [rdi + 0x38]
mov r8b, 1
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x140009be0
test rdi, rdi
je 0x140009c55
xor ebx, ebx
test r15, r15
je 0x140009c0f
mov eax, dword [rdi + 0x50]
mov dword [r15], eax
test r14, r14
je 0x140009c55
mov r12d, dword [rdi + 4]
mov ebx, esi
xor esi, esi
test r12d, r12d
je 0x140009c55
add rdi, 0x130
mov eax, dword [rdi]
mov ecx, dword [r15]
mov r8d, r13d
mov edx, eax
mov dword [rsp + 0x50], eax
call fcn.1400099ac
mov ebx, eax
test eax, eax
jns 0x140009c4e
inc esi
add rdi, 0x50
cmp esi, r12d
jb 0x140009c28
jmp 0x140009c55
mov eax, dword [rsp + 0x50]
mov dword [r14], eax
mov edx, 0x53595356
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009d00
Capabilities:
Check os version
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140005218]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rdi, qword [rbp + 0x150]
xor r13d, r13d
mov r15, r9
mov r12, r8
mov r14d, ecx
test rdi, rdi
je 0x140009d4b
mov qword [rdi], r13
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x30], r13
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
lea rdx, [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140009ed9
xorps xmm0, xmm0
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x78]
lea rcx, [rsp + 0x40]
mov edx, 0x1fffff
mov dword [rbp - 0x78], 0x30
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov ebx, eax
test eax, eax
js 0x140009ed9
lea rdx, [0x140015110]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
xor r9d, r9d
mov ecx, r14d
mov qword [rsp + 0x20], r13
call fcn.140008d34
mov ebx, eax
test eax, eax
js 0x140009ed9
lea rdx, [0x140015130]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x48]
lea rdx, [0x140015160]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x20], r13d
call fcn.1400092a0
mov ebx, eax
test eax, eax
js 0x140009ed9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x30]
add rcx, qword [rsp + 0x48]
mov r8, r15
xor edx, edx
mov qword [r15 + 0xe4], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], r13
mov qword [r15 + 0xdc], r12
mov dword [r15 + 0xd8], 1
mov qword [rsp + 0x20], rax
call fcn.1400093f0
mov ebx, eax
test eax, eax
js 0x140009ed9
cmp dword [rbp - 0x3c], 6
jae 0x140009e99
mov ebx, 0xc0000001
jmp 0x140009ed9
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140009c8c
mov ebx, eax
test eax, eax
js 0x140009ed9
mov qword [rsp + 0x30], r13
test rdi, rdi
je 0x140009f00
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov qword [rdi], rax
cmp qword [rsp + 0x30], r13
je 0x140009f00
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov r9d, 0x8000
mov qword [rsp + 0x48], r13
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140009f10
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140009f20
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140009f30
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1400021b0
mov rbx, qword [rsp + 0x238]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000adb8
Capabilities:
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
xor r14d, r14d
mov qword [rbp + 0x1f], r8
xorps xmm0, xmm0
mov dword [r11 - 0x78], r14d
mov qword [r11 - 0x80], r14
mov dword [rsp + 0x40], 0x60
movdqu xmmword [rbp + 0x2f], xmm0
mov dword [rsp + 0x38], 3
mov rbx, rdx
xor eax, eax
mov dword [rsp + 0x30], r14d
lea r9, [rbp - 1]
lea r8, [rbp + 0xf]
lea rcx, [rbp - 9]
mov edx, 0x1f01ff
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r14
mov qword [rbp - 1], r14
mov qword [rbp + 7], rax
mov qword [rbp - 9], r14
mov dword [rbp + 0xf], 0x30
mov qword [rbp + 0x17], r14
mov dword [rbp + 0x27], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x14000af54
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x47554452
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000af54
mov qword [rbp + 0x7f], r14
jmp 0x14000aebe
mov rsi, qword [rbp + 7]
mov rcx, qword [rbp - 9]
xor eax, eax
mov qword [rsp + 0x40], r14
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea rax, [rbp + 0x7f]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rbp - 1]
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
js 0x14000af49
add qword [rbp + 0x7f], rsi
mov rcx, qword [rbx]
xor eax, eax
mov qword [rsp + 0x40], r14
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 1]
mov dword [rsp + 0x30], 0x1000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jns 0x14000ae72
cmp eax, 0xc0000011
cmove eax, r14d
test eax, eax
js 0x14000af49
mov rcx, qword [rbx]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 1]
mov r9d, 1
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
js 0x14000af49
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, qword [rbp - 9]
mov qword [rbp - 9], r14
mov qword [rbx], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14000af63
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbx]
xor eax, eax
lea rdx, [rbp - 1]
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
call qword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret