joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2bc88
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x90
xor ebx, ebx
mov rbp, rdx
lea rdx, [rax - 0x80]
mov r12, rcx
mov qword [rax - 0x80], rbx
mov qword [rax - 0x78], rbx
mov dil, bl
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x30], rbx
mov dword [rax + 0x18], ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jge 0x2bcd1
xor al, al
jmp 0x2bec2
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x38]
cmp eax, ebx
jge 0x2bcf0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x2bcca
call fcn.0002f23e
mov rcx, qword [rsp + 0x40]
mov rsi, rax
call fcn.0002f23e
mov r13d, 1
cmp rsi, rbx
je 0x2bd26
cmp rax, rbx
je 0x2bd26
mov rdx, rax
mov rcx, rsi
call fcn.0002f226
cmp eax, ebx
jne 0x2bd31
mov dil, r13b
jmp 0x2bd31
movzx edi, dil
cmp rsi, rax
cmove edi, r13d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dil, bl
je 0x2bcca
mov edi, 0x400
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0xd8]
mov edx, edi
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x70], 0x200
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
cmp eax, ebx
jl 0x2bcca
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x30]
mov edx, edi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
cmp eax, ebx
jge 0x2bde0
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x2bcca
mov ebp, 0x10100
mov ecx, r13d
mov rdx, rbp
call fcn.0002e404
mov rdi, rax
cmp rax, rbx
jne 0x2be0d
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x30]
jmp 0x2bdd5
mov rdx, rbp
mov ecx, r13d
call fcn.0002e404
mov rsi, rax
cmp rax, rbx
jne 0x2be2a
mov rcx, rdi
call fcn.0002e47c
jmp 0x2bdf8
mov rcx, qword [rsp + 0xd8]
lea rax, [rsp + 0xd0]
mov r12d, 0x1b
mov edx, r12d
mov r9d, ebp
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
cmp eax, ebx
jl 0x2be97
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xd0]
mov r9d, ebp
mov r8, rsi
mov edx, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
cmp eax, ebx
jl 0x2be97
mov r8b, r13b
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
movzx ecx, bl
cmp eax, ebx
cmove ecx, r13d
mov bl, cl
mov rcx, rsi
call fcn.0002e47c
mov rcx, rdi
call fcn.0002e47c
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x2bfc4
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
and qword [rax + 0x20], 0
and qword [rax + 0x18], 0
mov rdi, rdx
lea rdx, [rax - 0x18]
xor bl, bl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2bff4
xor al, al
jmp 0x2c0a0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2c013
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x2bfed
cmp qword [0x0003eb68], 0
je 0x2c088
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x58]
call fcn.0002bf58
test eax, eax
js 0x2c088
cmp qword [0x0003eb68], 0
je 0x2c075
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call fcn.0002bf58
test eax, eax
js 0x2c075
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x2c3fc
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2c41b
xor eax, eax
jmp 0x2c437
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x2c444
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, qword [0x00040e40]
and qword [rax + 0x20], 0
and qword [rax + 0x18], 0
lea rdx, [rax - 0x58]
xor bl, bl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2c478
xor al, al
jmp 0x2c5b0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2c497
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x2c471
cmp qword [0x0003eb68], 0
je 0x2c598
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x98]
call fcn.0002bf58
test eax, eax
js 0x2c598
cmp qword [0x0003eb68], 0
je 0x2c57f
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x90]
call fcn.0002bf58
test eax, eax
js 0x2c57f
mov rax, qword [rsp + 0x98]
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
movzx r9d, word [rsp + 0x30]
shr r9d, 1
je 0x2c566
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.0002b188
test al, al
je 0x2c566
mov rax, qword [rsp + 0x90]
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
movzx r9d, word [rsp + 0x30]
shr r9d, 1
je 0x2c566
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.0002b188
test al, al
je 0x2c566
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov bl, al
mov rcx, qword [rsp + 0x90]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x2c614
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x00030a20]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x2c7b0
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x2c772
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x2c79d
cmp rbx, 0x6400000
ja 0x2c79d
mov rdx, rbx
mov ecx, edi
call fcn.0002e404
mov rdi, rax
test rax, rax
je 0x2c76d
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x2c75e
mov rcx, rdi
call fcn.0002e47c
mov ebx, esi
jmp 0x2c772
cmp qword [rsp + 0x58], rbx
je 0x2c784
mov rcx, rdi
call fcn.0002e47c
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x2c7b0
mov rcx, qword [rsp + 0xe0]
mov qword [0x00041838], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x2c7b0
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x2c7cc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x2c7f0
xor al, al
jmp 0x2c817
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x2c828
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2c84c
lea rax, [0x0002fb00]
jmp 0x2c8bc
mov rcx, qword [rsp + 0x38]
call fcn.0002f23e
mov r11, rax
test rax, rax
jne 0x2c86b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x2c843
lea rdi, [0x00041730]
mov byte [0x00041833], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x2c8a3
mov al, byte [r11 + rcx]
test al, al
je 0x2c8a3
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x2c884
test rdx, rdx
jne 0x2c8ab
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x2cbe0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x00041850]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x2ccc1
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x2cc27
xor eax, eax
jmp 0x2ccc1
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.0002e404
mov rbx, rax
test rax, rax
je 0x2cc20
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x2cc60
mov rcx, rbx
call fcn.0002e47c
jmp 0x2cc20
xor edi, edi
cmp dword [rbx], edi
jbe 0x2ccb2
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x00032470]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.0002f226
test eax, eax
je 0x2cc9d
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x2cc6a
jmp 0x2ccb2
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x00041850], rax
mov rcx, rbx
call fcn.0002e47c
mov rax, qword [0x00041850]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x2d95c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbp, rdx
lea rdx, [rsp + 0x30]
mov rsi, r8
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x2da97
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x2da8c
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.0002d834
and qword [rsp + 0xd8], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov edx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x2da7e
mov rcx, qword [rsp + 0xd8]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x2da7e
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.0002dab8
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x2e03c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x2e078
cmp dword [rsp + 0x48], 2
jne 0x2e1b5
lea eax, [r11 - 2]
jmp 0x2e1b7
cmp r11d, 6
jne 0x2e11d
mov ecx, dword [rsp + 0x48]
xor eax, eax
cmp ecx, eax
jne 0x2e094
mov eax, r11d
jmp 0x2e1b7
cmp ecx, 1
jne 0x2e0bf
cmp dword [rsp + 0x40], 0x1b58
jne 0x2e0ab
lea eax, [rcx + 7]
jmp 0x2e1b7
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x2e1b7
cmp ecx, 2
jne 0x2e0ff
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x203a
jne 0x2e0da
mov eax, 0xe
jmp 0x2e1b7
cmp ecx, 0x20d0
jne 0x2e0ec
mov eax, 0xf
jmp 0x2e1b7
mov edx, 0x11
cmp ecx, 0x23f0
cmove eax, edx
jmp 0x2e1b7
cmp ecx, 3
jne 0x2e1b5
cmp dword [rsp + 0x40], 0x2580
mov ecx, 0x14
cmove eax, ecx
jmp 0x2e1b7
cmp r11d, 0xa
jne 0x2e1b5
xor eax, eax
cmp dword [rsp + 0x48], eax
jne 0x2e1b5
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x2b5e
jne 0x2e145
lea eax, [r11 + 0x1b]
jmp 0x2e1b7
cmp ecx, 0x2b5b
jne 0x2e154
mov eax, 0x23
jmp 0x2e1b7
cmp ecx, 0x2b4a
jne 0x2e163
mov eax, 0x21
jmp 0x2e1b7
cmp ecx, 0x295a
jne 0x2e172
mov eax, 0x1f
jmp 0x2e1b7
cmp ecx, 0x2945
jne 0x2e181
mov eax, 0x1d
jmp 0x2e1b7
cmp ecx, 0x2933
jne 0x2e190
mov eax, 0x1b
jmp 0x2e1b7
cmp ecx, 0x2924
jne 0x2e19f
mov eax, 0x19
jmp 0x2e1b7
add ecx, 0xffffd800
mov edx, 0x17
cmp ecx, 0x124
cmovbe eax, edx
jmp 0x2e1b7
xor eax, eax
add rsp, 0x38
ret

Function at 0x2e1c4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov qword [rax + 0x10], rsi
mov rbx, rsi
mov qword [rax - 0x48], rbx
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x2e2a3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea ebx, [rsi + 1]
mov r8d, ebx
lea edx, [rsi + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov r8d, ebx
lea edx, [rbx + 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
mov r8d, ebx
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
add rdx, 2
mov ecx, ebx
call fcn.0002e404
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x2e286
movzx r8d, word [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov rcx, rax
call fcn.0002f2a0
movzx r11d, word [rdi + 0x60]
shr r11w, 1
movzx ecx, r11w
mov word [rbx + rcx*2], si
jmp 0x2e28d
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x2e2c0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x2e3e2
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x2e3c2
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.0002e404
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x2e3b7
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.0002f2a0
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x2e3c9
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x2e898
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x2e8d9
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x2e8cd
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x2e8dc
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x2e8b8
xor r8d, r8d
test r8, r8
je 0x2e8f4
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x2e8f6
mov eax, edx
mov rbx, qword [rsp + 8]
ret

Function at 0x2e904
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
movzx r11d, word [rcx + 6]
xor r9d, r9d
lea r8, [rax + rcx + 0x18]
mov rbx, rcx
test r11d, r11d
je 0x2e943
mov r10d, dword [r8 + 0xc]
cmp edx, r10d
jb 0x2e937
mov eax, dword [r8 + 8]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x2e946
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x2e922
xor r8d, r8d
test r8, r8
je 0x2e95e
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x2e960
mov eax, edx
mov rbx, qword [rsp + 8]
ret
Function at 0x2e96c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r12b, r8b
mov rbx, rcx
cmp word [rcx], ax
jne 0x2eae4
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x2eae4
mov edx, dword [rsi + 0x78]
test edx, edx
je 0x2eae4
test r8b, r8b
jne 0x2e9c0
mov rcx, rsi
call fcn.0002e904
mov edx, eax
mov edi, edx
add rdi, rbx
je 0x2eae4
mov ebp, dword [rsi + 0x50]
mov rax, rdi
sub rax, rbx
mov qword [rsp + 0x88], rax
cmp rbp, rax
jb 0x2eae4
mov eax, dword [rsi + 0x7c]
sub rax, rbx
add rax, rdi
cmp rbp, rax
jb 0x2eae4
mov edx, dword [rdi + 0x20]
test r12b, r12b
jne 0x2ea09
mov rcx, rsi
call fcn.0002e904
mov edx, eax
mov eax, edx
mov edx, dword [rdi + 0x1c]
add rax, rbx
mov qword [rsp + 0x20], rax
test r12b, r12b
jne 0x2ea25
mov rcx, rsi
call fcn.0002e904
mov edx, eax
mov r14d, edx
mov edx, dword [rdi + 0x24]
add r14, rbx
test r12b, r12b
jne 0x2ea3d
mov rcx, rsi
call fcn.0002e904
mov edx, eax
movsxd rcx, dword [rdi + 0x18]
mov r13d, edx
mov edx, dword [rdi + 0x14]
add r13, rbx
mov dword [rsp + 0x70], edx
cmp r13, rbx
jb 0x2eae4
lea rax, [rbx + rbp]
cmp r13, rax
ja 0x2eae4
xor edi, edi
mov r15, rcx
test ecx, ecx
jle 0x2eae4
cmp rdi, r15
movzx ebp, word [r13 + rdi*2]
jge 0x2eae4
cmp ebp, edx
jge 0x2eae4
movsxd rax, ebp
mov ecx, dword [r14 + rax*4]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x2ea9c
mov r8d, dword [rsi + 0x7c]
add rax, r8
cmp rcx, rax
jb 0x2eadc
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + rdi*4]
test r12b, r12b
jne 0x2eab3
mov rcx, rsi
call fcn.0002e904
mov edx, eax
mov r8d, edx
mov rdx, qword [rsp + 0x78]
add r8, rbx
sub r8, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + r8]
sub eax, ecx
jne 0x2ead4
inc rdx
test ecx, ecx
jne 0x2eac1
test eax, eax
je 0x2eafe
mov edx, dword [rsp + 0x70]
inc rdi
cmp rdi, r15
jl 0x2ea6d
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [r14 + rbp*4]
test r12b, r12b
jne 0x2eb11
mov rcx, rsi
call fcn.0002e904
mov edx, eax
mov eax, edx
add rax, rbx
jmp 0x2eae6

Function at 0x2eb20
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x2eb66
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
je 0x2eb66
movzx eax, word [r9 + 0x14]
movzx r11d, word [r9 + 6]
xor r10d, r10d
lea r8, [rax + r9 + 0x18]
cmp r11d, r10d
jbe 0x2eb66
mov ecx, dword [r8 + 0x14]
cmp edx, ecx
jb 0x2eb5a
add ecx, dword [r8 + 0x10]
cmp edx, ecx
jb 0x2eb69
inc r10d
add r8, 0x28
cmp r10d, r11d
jb 0x2eb4a
xor eax, eax
ret
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 0x14]
add eax, edx
ret
Function at 0x2efb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x2f0ab
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x2f0ab
mov rax, rdx
add rax, rcx
je 0x2f0ab
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x2f0a9
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x2f0a5
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x2f061
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x2f099
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x2f084
inc rax
test r11d, r11d
jne 0x2f06e
cmp r10d, r8d
jne 0x2f094
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x2f0a9
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x2f03d
xor eax, eax
jmp 0x2f0ba
jmp 0x2f0b7
xor eax, eax
jmp 0x2f0ba
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret