joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000193c
Capabilities:
Find process by pid

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x38], 0
mov edi, 4
and qword [rbp + 0x40], 0
mov rbx, rcx
mov rcx, qword [rcx + 8]
xorps xmm0, xmm0
mov r8d, edi
lea r14d, [rdi + 4]
mov edx, r14d
movups xmmword [rbp - 0x10], xmm0
call fcn.1400034e0
test eax, eax
je 0x140001a90
mov rcx, qword [rbx + 0x10]
mov r8d, edi
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x140001a90
mov rcx, qword [rbx + 0x18]
lea r15d, [rdi + 0xc]
mov edx, r15d
mov r8d, edi
call fcn.1400034e0
test eax, eax
je 0x140001a90
mov rdx, qword [rbx + 8]
lea rcx, [rbp + 0x38]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001a90
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0x40]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001a90
mov rdx, qword [rbx + 0x18]
lea rcx, [rbp - 0x10]
mov r8d, r15d
call fcn.140003514
test eax, eax
je 0x140001a90
mov ecx, dword [rbx]
lea rdx, [rbp + 0x30]
and qword [rbp + 0x30], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140001a8b
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
lea r9, [rbp - 0x10]
or rcx, 0xffffffffffffffff
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwFlushVirtualMemory]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbx + 8]
lea rdx, [rbp + 0x38]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001a84
mov rcx, qword [rbx + 0x10]
lea rdx, [rbp + 0x40]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001a84
mov rcx, qword [rbx + 0x18]
lea rdx, [rbp - 0x10]
mov r8d, r15d
call fcn.140003514
test eax, eax
jne 0x140001a8b
mov rdi, 0xffffffffc0000005
movsxd rax, edi
jmp 0x140001a97
mov rax, 0xffffffffc0000005
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
Function at 0x140001aa4
Capabilities:
Find process by pid

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x20
and qword [rbp + 0x38], 0
mov ebx, 4
and qword [rbp + 0x40], 0
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r8d, ebx
lea r15d, [rbx + 4]
mov edx, r15d
call fcn.1400034e0
test eax, eax
je 0x140001bc5
mov rcx, qword [rsi + 0x10]
mov r8d, ebx
mov edx, r15d
call fcn.1400034e0
test eax, eax
je 0x140001bc5
mov rdx, qword [rsi + 8]
lea rcx, [rbp + 0x38]
mov r8d, r15d
call fcn.140003514
test eax, eax
je 0x140001bc5
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x40]
mov r8d, r15d
call fcn.140003514
test eax, eax
je 0x140001bc5
mov ecx, dword [rsi]
lea rdx, [rbp + 0x30]
and qword [rbp + 0x30], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140001bc0
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
xor ecx, ecx
call fcn.14000163c
mov r9d, dword [rsi + 0x18]
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x38]
or rcx, 0xffffffffffffffff
mov bl, al
call qword [sym.imp.ntoskrnl.exe_NtFreeVirtualMemory]
mov cl, bl
mov edi, eax
call fcn.14000163c
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsi + 8]
lea rdx, [rbp + 0x38]
mov r8d, r15d
call fcn.140003514
test eax, eax
je 0x140001bb9
mov rcx, qword [rsi + 0x10]
lea rdx, [rbp + 0x40]
mov r8d, r15d
call fcn.140003514
test eax, eax
jne 0x140001bc0
mov rdi, 0xffffffffc0000005
movsxd rax, edi
jmp 0x140001bcc
mov rax, 0xffffffffc0000005
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140001c38
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x20
and qword [rbp + 0x28], 0
mov ebx, 4
and qword [rbp + 0x30], 0
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov r8d, ebx
lea r14d, [rbx + 4]
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x140001d3f
mov rcx, qword [rdi + 0x10]
mov r8d, ebx
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x140001d3f
mov rdx, qword [rdi + 8]
lea rcx, [rbp + 0x28]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001d3f
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x30]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001d3f
mov ecx, dword [rdi]
lea rdx, [rbp + 0x20]
and qword [rbp + 0x20], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140001d3a
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov r9d, dword [rdi + 0x18]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwLockVirtualMemory]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0x28]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140001d33
mov rcx, qword [rdi + 0x10]
lea rdx, [rbp + 0x30]
mov r8d, r14d
call fcn.140003514
test eax, eax
jne 0x140001d3a
mov rbx, 0xffffffffc0000005
movsxd rax, ebx
jmp 0x140001d46
mov rax, 0xffffffffc0000005
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140001d54
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov r14d, 4
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
xorps xmm0, xmm0
mov r8d, r14d
movups xmmword [rbp - 0x10], xmm0
lea ebx, [r14 + 0xc]
mov edx, ebx
call fcn.1400034e0
test eax, eax
je 0x140001e6c
mov rdx, qword [rdi + 0x18]
lea rcx, [rbp - 0x10]
mov r8d, ebx
call fcn.140003514
test eax, eax
je 0x140001e6c
mov rcx, qword [rdi]
mov r8d, r14d
lea r14d, [r8 + 4]
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x140001e6c
and qword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
cmp qword [rbp - 8], 0
je 0x140001e24
and qword [rbp + 0x28], 0
lea r8, [rbp + 0x28]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessThreadByCid]
mov ebx, eax
test eax, eax
js 0x140001e67
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov rcx, qword [rdi]
lea rdx, [rbp + 0x30]
or rax, 0xffffffffa0000000
mov r8d, r14d
mov qword [rbp + 0x30], rax
call fcn.140003514
test eax, eax
mov rcx, 0xffffffffc0000005
cmove ebx, ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140001e5d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140001e67
mov rax, qword [rbp - 0x10]
lea rdx, [rbp + 0x28]
mov rcx, qword [rdi]
or rax, 0xffffffffa0000000
mov r8, r14
mov qword [rbp + 0x28], rax
call fcn.140003514
test eax, eax
mov rcx, 0xffffffffc0000005
cmove ebx, ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movsxd rax, ebx
jmp 0x140001e73
mov rax, 0xffffffffc0000005
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x140001fbc
Capabilities:
Find process by pid

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x40], 0
mov r15d, 4
and qword [rbp + 0x48], 0
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov r8d, r15d
lea r14d, [r15 + 4]
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x1400020ff
mov rcx, qword [rbx + 0x10]
mov r8d, r15d
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x1400020ff
mov rcx, qword [rbx + 0x20]
mov r8d, r15d
mov edx, r15d
call fcn.1400034e0
test eax, eax
je 0x1400020ff
mov rdx, qword [rbx + 8]
lea rcx, [rbp + 0x40]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x1400020ff
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0x48]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x1400020ff
mov ecx, dword [rbx]
lea rdx, [rbp + 0x38]
and qword [rbp + 0x38], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x1400020fa
mov rcx, qword [rbp + 0x38]
and dword [rbp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov r9d, dword [rbx + 0x18]
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x40]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbx + 8]
lea rdx, [rbp + 0x40]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x1400020f3
mov rcx, qword [rbx + 0x10]
lea rdx, [rbp + 0x48]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x1400020f3
mov rcx, qword [rbx + 0x20]
lea rdx, [rbp + 0x30]
mov r8d, r15d
call fcn.140003514
test eax, eax
jne 0x1400020fa
mov rdi, 0xffffffffc0000005
movsxd rax, edi
jmp 0x140002106
mov rax, 0xffffffffc0000005
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
Function at 0x140002114
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
mov rdi, rcx
mov r15d, 4
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140002147
mov edx, dword [rdi + 0x18]
mov r8d, r15d
call fcn.1400034e0
test eax, eax
je 0x14000215f
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14000216b
mov r8d, r15d
mov rdx, r15
call fcn.1400034e0
test eax, eax
jne 0x14000216b
mov rax, 0xffffffffc0000005
jmp 0x1400022ad
mov ecx, dword [rdi]
lea rdx, [rsp + 0x58]
and qword [rsp + 0x58], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x1400022aa
xor ebp, ebp
and dword [rsp + 0x50], ebp
cmp qword [rdi + 0x10], rbp
je 0x1400021ca
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x1400021ca
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
jne 0x1400021ca
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, 0xffffffffc000009a
jmp 0x1400022ad
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
xor ecx, ecx
call fcn.14000163c
mov r9d, dword [rdi + 0x18]
mov bl, al
mov edx, dword [rdi + 8]
lea rax, [rsp + 0x50]
mov r8, rbp
mov qword [rsp + 0x20], rax
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_NtQueryInformationProcess]
mov cl, bl
mov esi, eax
call fcn.14000163c
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbx, 0xffffffffc0000005
test esi, esi
js 0x14000228f
test rbp, rbp
je 0x14000228f
lfence
mov eax, dword [rsp + 0x50]
mov r9, qword [rdi + 0x10]
mov edx, eax
cmp rax, 8
jb 0x140002271
xor ecx, ecx
lea r8, [rax - 8]
mov rax, qword [rcx + rbp]
sub rax, rbp
cmp rax, rdx
jae 0x140002261
add rax, r9
mov qword [rcx + rbp], rax
add rcx, r15
add rcx, r15
cmp rcx, r8
jbe 0x14000224b
mov r9, qword [rdi + 0x10]
mov eax, dword [rsp + 0x50]
mov r8d, eax
mov rdx, rbp
mov rcx, r9
call fcn.140003514
test eax, eax
mov rcx, rbp
cmove esi, ebx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x1400022aa
mov r8, r15
lea rdx, [rsp + 0x50]
call fcn.140003514
test eax, eax
cmove esi, ebx
movsxd rax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x140002474
Capabilities:
Find process by pid
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
mov ecx, dword [rcx]
cmp ecx, 0xb5
jne 0x140002636
mov rax, qword [rdi + 8]
test rax, rax
je 0x140002636
mov ebx, 8
cmp dword [rdi + 0x10], ebx
jne 0x140002636
and qword [rbp + 0x38], 0
lea r12d, [rbx - 4]
mov r8d, r12d
mov edx, ebx
mov rcx, rax
call fcn.1400034e0
test eax, eax
je 0x14000262d
mov edx, dword [rdi + 0x20]
mov r8d, r12d
mov rcx, qword [rdi + 0x18]
call fcn.1400034e0
test eax, eax
je 0x14000262d
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140002504
mov r8d, r12d
mov edx, r12d
call fcn.1400034e0
test eax, eax
je 0x14000262d
mov rdx, qword [rdi + 8]
lea rcx, [rbp + 0x38]
mov r8, rbx
call fcn.140003514
test eax, eax
je 0x14000262d
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0x40]
and qword [rbp + 0x40], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x140002628
or qword [rbp + 0x38], 0xffffffffffffffff
xor r14d, r14d
and dword [rbp + 0x30], r14d
cmp qword [rdi + 0x18], r14
je 0x140002580
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x140002580
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r14, rax
test rax, rax
jne 0x140002580
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, 0xffffffffc000009a
jmp 0x14000265a
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
xor ecx, ecx
call fcn.14000163c
mov ecx, dword [rdi + 0x20]
lea rdx, [rbp + 0x38]
mov r8d, dword [rdi + 0x10]
mov bl, al
lea rax, [rbp + 0x30]
mov r9, r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, dword [rdi]
call qword [sym.imp.ntoskrnl.exe_NtQuerySystemInformationEx]
mov cl, bl
mov esi, eax
call fcn.14000163c
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbx, 0xffffffffc0000005
test esi, esi
js 0x14000260e
test r14, r14
je 0x14000260e
lfence
mov r8d, dword [rbp + 0x30]
mov rdx, r14
mov rcx, qword [rdi + 0x18]
call fcn.140003514
test eax, eax
mov rcx, r14
cmove esi, ebx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140002628
mov r8, r12
lea rdx, [rbp + 0x30]
call fcn.140003514
test eax, eax
cmove esi, ebx
movsxd rax, esi
jmp 0x14000265a
mov rax, 0xffffffffc0000005
jmp 0x14000265a
mov rax, qword [rdi + 0x28]
mov r9, qword [rdi + 0x18]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_NtQuerySystemInformationEx]
cdqe
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000266c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140002697
mov rdx, qword [rbx + 0x20]
mov r8d, 4
call fcn.1400034e0
test eax, eax
je 0x1400026b2
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400026be
mov edx, 8
lea r8d, [rdx - 4]
call fcn.1400034e0
test eax, eax
jne 0x1400026be
mov rax, 0xffffffffc0000005
jmp 0x1400027f4
mov ecx, dword [rbx]
lea rdx, [rsp + 0x50]
and qword [rsp + 0x50], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x1400027f1
xor esi, esi
and qword [rsp + 0x58], rsi
cmp qword [rbx + 0x18], rsi
je 0x14000271e
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14000271e
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x14000271e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, 0xffffffffc000009a
jmp 0x1400027f4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov r8d, dword [rbx + 0x10]
lea rax, [rsp + 0x58]
mov rdx, qword [rbx + 8]
mov r9, rsi
mov qword [rsp + 0x28], rax
or rcx, 0xffffffffffffffff
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbp, 0xffffffffc0000005
test edi, edi
js 0x1400027d3
test rsi, rsi
je 0x1400027d3
lfence
cmp dword [rbx + 0x10], 2
jne 0x1400027b2
mov rdx, qword [rsp + 0x58]
mov r9, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400027b2
xor ecx, ecx
lea r8, [rdx - 8]
mov rax, qword [rcx + rsi]
sub rax, rsi
cmp rax, rdx
jae 0x1400027a9
add rax, r9
mov qword [rcx + rsi], rax
add rcx, 4
add rcx, 4
cmp rcx, r8
jbe 0x140002792
mov r8, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, qword [rbx + 0x18]
call fcn.140003514
test eax, eax
mov rcx, rsi
cmove edi, ebp
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400027f1
mov r8d, 8
lea rdx, [rsp + 0x58]
call fcn.140003514
test eax, eax
cmove edi, ebp
movsxd rax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002804
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov rax, qword [rdi + 8]
lea rdx, [rax + rcx]
cmp rdx, rax
jb 0x140002910
mov rax, qword [rdi + 0x10]
lea r8, [rax + rcx]
cmp r8, rax
jb 0x140002910
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rcx, qword [rax]
cmp rdx, rcx
ja 0x140002910
cmp r8, rcx
ja 0x140002910
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140002872
mov edx, 8
lea r8d, [rdx - 4]
call fcn.1400034e0
test eax, eax
je 0x140002910
mov ecx, dword [rdi]
lea rdx, [rsp + 0x50]
and qword [rsp + 0x50], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000290b
cmp qword [rdi + 0x18], 0
je 0x140002900
and qword [rsp + 0x58], 0
call qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r9, qword [rdi + 0x10]
mov r8, rax
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x18]
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov rcx, qword [rdi + 0x20]
mov ebx, eax
test rcx, rcx
je 0x140002900
mov r8d, 8
lea rdx, [rsp + 0x58]
call fcn.140003514
test eax, eax
mov rcx, 0xffffffffc0000005
cmove ebx, ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movsxd rax, ebx
jmp 0x140002917
mov rax, 0xffffffffc0000005
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140002924
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [rcx]
lea rdx, [rsp + 0x30]
and qword [rsp + 0x30], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140002961
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsResumeProcess]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movsxd rax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140002a70
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140002b74
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x140002b74
mov edx, eax
mov r8d, 1
call fcn.1400034e0
test eax, eax
jne 0x140002abc
mov rax, 0xffffffffc0000005
jmp 0x140002b7b
mov ecx, dword [rsi]
lea rdx, [rsp + 0x30]
and qword [rsp + 0x30], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140002b6f
mov edx, dword [rsi + 0x18]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
je 0x140002b5f
mov r8d, dword [rsi + 0x18]
mov rcx, rax
mov rdx, qword [rsi + 0x10]
call fcn.140003514
test eax, eax
jne 0x140002b0f
mov rdi, 0xffffffffc0000005
jmp 0x140002b52
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
xor ecx, ecx
call fcn.14000163c
mov r9d, dword [rsi + 0x18]
mov r8, rbp
mov edx, dword [rsi + 8]
or rcx, 0xffffffffffffffff
mov bl, al
call qword [sym.imp.ntoskrnl.exe_NtSetInformationProcess]
mov cl, bl
mov edi, eax
call fcn.14000163c
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140002b64
mov edi, 0xc000009a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movsxd rax, edi
jmp 0x140002b7b
mov rax, 0xffffffffc000000d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140002d9c
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [rcx]
lea rdx, [rsp + 0x30]
and qword [rsp + 0x30], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140002dd9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsSuspendProcess]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movsxd rax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140002e88
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x20
and qword [rbp + 0x28], 0
mov ebx, 4
and qword [rbp + 0x30], 0
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov r8d, ebx
lea r14d, [rbx + 4]
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x140002f8f
mov rcx, qword [rdi + 0x10]
mov r8d, ebx
mov edx, r14d
call fcn.1400034e0
test eax, eax
je 0x140002f8f
mov rdx, qword [rdi + 8]
lea rcx, [rbp + 0x28]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140002f8f
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x30]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140002f8f
mov ecx, dword [rdi]
lea rdx, [rbp + 0x20]
and qword [rbp + 0x20], 0
and ecx, 0x5fffffff
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140002f8a
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov r9d, dword [rdi + 0x18]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnlockVirtualMemory]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0x28]
mov r8d, r14d
call fcn.140003514
test eax, eax
je 0x140002f83
mov rcx, qword [rdi + 0x10]
lea rdx, [rbp + 0x30]
mov r8d, r14d
call fcn.140003514
test eax, eax
jne 0x140002f8a
mov rbx, 0xffffffffc0000005
movsxd rax, ebx
jmp 0x140002f96
mov rax, 0xffffffffc0000005
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret