joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002a98
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
movzx edi, cl
xor edx, edx
lea rcx, [rbp - 0x49]
mov r8d, 0x98
call fcn.1400099c0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
xor edx, edx
call fcn.140006d34
mov rbx, rax
test rax, rax
je 0x140002ba2
and dword [rbp - 0x35], 0
mov dword [rbp - 0x39], 1
mov ecx, dword [rax + 8]
mov dword [rbp - 0x31], ecx
mov rcx, qword [rax]
mov qword [rbp - 0x41], rcx
mov dword [rbp + 0x4b], edi
call fcn.140006798
mov qword [rbp - 0x11], rax
mov edi, 0x2d0
test rax, rax
je 0x140002b1f
lea rdx, [rbx + 0x10]
mov word [rbp - 0x17], di
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
call fcn.140006798
mov qword [rbp + 0x3f], rax
test rax, rax
je 0x140002b3f
lea rdx, [rbx + 0x20]
mov word [rbp + 0x39], di
lea rcx, [rbp + 0x37]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov edi, 0x800
mov r8d, 0x6576656e
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp + 0x2f], rax
test rax, rax
je 0x140002b7c
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.1400099c0
lea rdx, [rbx + 0x30]
mov word [rbp + 0x29], di
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rcx, [rbp - 0x49]
call fcn.140002778
lea r9, [rbp - 0x19]
mov r8d, 0x54
lea rdx, [0x14000a1c0]
lea rcx, [0x14000a1e0]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rbp - 0x11], 0
je 0x140002bb4
mov dl, 1
lea rcx, [rbp - 0x19]
call fcn.14000687c
cmp qword [rbp + 0x3f], 0
je 0x140002bc6
mov dl, 1
lea rcx, [rbp + 0x37]
call fcn.14000687c
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140002bdf
mov edx, 0x6576656e
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rbp + 0x2f], 0
test rbx, rbx
je 0x140002bec
mov rcx, rbx
call fcn.140006ee4
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140003c14
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
xor edi, edi
lea rcx, [0x14000ee00]
mov word [rax - 0x18], di
xor r9d, r9d
mov dword [rax - 0x20], 0x53484143
xor r8d, r8d
xor edx, edx
mov qword [rax - 0x28], 0xe70
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
call fcn.1400047f4
call fcn.1400020d0
lea ebp, [rdi + 1]
mov rcx, rbx
mov byte [0x14000ee90], bpl
call fcn.140003d30
test eax, eax
js 0x140003cc5
lea r8, [0x14000ee88]
mov rcx, rsi
lea rdx, [0x14000c6c0]
call sub.FLTMGR.SYS_FltRegisterFilter
test eax, eax
js 0x140003cc5
mov rcx, qword [0x14000ee88]
call fcn.1400020d4
call fcn.140001ee0
test al, al
je 0x140003cc5
call fcn.140001df8
test al, al
je 0x140003cc5
mov rcx, qword [0x14000ee88]
call sub.FLTMGR.SYS_FltStartFiltering
test eax, eax
movzx edi, dil
cmovns edi, ebp
mov rbx, qword [rsp + 0x50]
mov al, dil
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140003d30
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
xor edi, edi
mov qword [rbp + 0x17], rcx
xorps xmm0, xmm0
mov qword [rbp + 0x7f], rdi
lea rcx, [rbp + 0x7f]
mov qword [rbp + 0x77], rdi
lea r8, [rbp + 7]
mov qword [rbp + 0x6f], rdi
mov edx, 0xf003f
mov dword [rbp + 0x67], edi
mov dword [rbp - 9], edi
mov qword [rbp - 1], rdi
mov qword [rbp + 0xf], rdi
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x140003f16
lea rdx, [0x14000a500]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rbp + 0x7f]
lea r8, [rbp + 7]
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0x77]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rdi
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rbp + 0x17], rax
mov edx, 0xf003f
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov ebx, eax
test eax, eax
js 0x140003f16
lea rdx, [0x14000a520]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x77]
lea r13, [0x14000a540]
lea r9d, [rdi + 1]
mov dword [rsp + 0x28], 0x2a
xor r8d, r8d
mov qword [rsp + 0x20], r13
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x140003f16
mov rdx, r13
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rbp + 0x77]
lea r8, [rbp + 7]
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0x6f]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rdi
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rbp + 0x17], rax
mov edx, 0xf003f
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov ebx, eax
test eax, eax
js 0x140003f16
lea rdx, [0x14000a570]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x6f]
lea rax, [0x14000a590]
mov dword [rsp + 0x28], 0xe
lea r9d, [rdi + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x140003f16
lea rdx, [0x14000a5a0]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x6f]
lea r9d, [rdi + 4]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
mov ebx, eax
cmovns ebx, edi
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140003f29
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rbp + 0x6f], rdi
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140003f3c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rbp + 0x77], rdi
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140003f4b
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
add rsp, 0x88
pop r13
pop rdi
pop rbx
pop rbp
ret
Function at 0x140004600
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
xorps xmm0, xmm0
xorps xmm1, xmm1
mov rdi, rcx
movups xmmword [rax - 0x18], xmm0
movups xmmword [rax - 0x28], xmm1
cmp byte [rcx + 0x20], bl
jne 0x140004719
cmp dword [rcx + 0x58], 3
jne 0x140004719
mov eax, dword [rcx + 0x10]
test rax, 0x1800000
je 0x140004719
cmp qword [rcx + 0x30], rbx
jne 0x14000466d
lea r9, [rcx + 0x60]
mov r8d, 0x25c
lea rcx, [0x14000a720]
lea rdx, [0x14000a710]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140004719
lea rdx, [0x14000a750]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rdi + 0x60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
jne 0x140004719
mov eax, dword [rdi + 0x48]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x64], eax
lea rcx, [0x14000f100]
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x60], eax
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
call fcn.140004310
test al, al
je 0x14000472b
mov eax, dword [rdi + 0x50]
lea rdx, [0x14000a710]
mov rbx, qword [rsp + 0x68]
lea rcx, [0x14000a780]
mov r9d, dword [rdi + 0x48]
mov r8d, 0x271
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rdi + 0x600]
mov r8, rbx
mov edx, 0x2d0
call fcn.140004c30
mov bl, 1
mov rsi, qword [rsp + 0x78]
mov al, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rcx, [rdi + 0x8d0]
call fcn.140004024
test al, al
je 0x140004717
mov r8d, 0x27b
lea rdx, [0x14000a710]
lea rcx, [0x14000a7c0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140004719

Function at 0x140004758
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 0x10], 0
lea r8, [rax + 0x10]
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x44], esi
lea rcx, [0x14000f100]
mov dword [rsp + 0x40], edi
mov rdx, qword [rsp + 0x40]
call fcn.140004310
test al, al
je 0x1400047e2
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rcx, [0x14000f100]
call fcn.1400041c8
mov rbx, qword [rsp + 0x48]
lea rdx, [0x14000a5e0]
mov qword [rsp + 0x28], rbx
lea rcx, [0x14000a610]
mov r9d, esi
mov dword [rsp + 0x20], edi
mov r8d, 0x1ca
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x68666163
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140004868
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14000e628]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
lea r9, [rbp - 0x40]
xor r8d, r8d
mov dword [rbp - 0x40], r14d
xor edx, edx
mov edi, r14d
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
cmp eax, 0xc0000004
jne 0x1400049c9
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400049c9
mov edx, eax
xor ecx, ecx
mov r8d, 0x68666163
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1400049c9
mov r8d, dword [rbp - 0x40]
xor edx, edx
mov rcx, rax
mov dword [rbp - 0x38], 0x44005c
mov dword [rbp - 0x34], 0x760065
mov dword [rbp - 0x30], 0x630069
mov dword [rbp - 0x2c], 0x5c0065
mov dword [rbp - 0x28], 0x610048
mov dword [rbp - 0x24], 0x640072
mov dword [rbp - 0x20], 0x690064
mov dword [rbp - 0x1c], 0x6b0073
mov dword [rbp - 0x18], 0x6f0056
mov dword [rbp - 0x14], 0x75006c
mov dword [rbp - 0x10], 0x65006d
mov word [rbp - 0xc], r14w
call fcn.1400099c0
mov r8d, dword [rbp - 0x40]
lea r9, [rbp - 0x40]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
test eax, eax
js 0x1400049bb
lea rax, [rbp - 0x38]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x140004959
movzx eax, word [rbx]
shr rax, 1
cmp rax, r8
jbe 0x1400049bb
mov rcx, qword [rbx + 8]
lea rdx, [rbp - 0x38]
call sub.ntoskrnl.exe__wcsnicmp
test eax, eax
jne 0x1400049bb
movzx esi, word [rbx + 2]
mov r8d, 0x68666163
xor ecx, ecx
lea rdx, [rsi + 0x64]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x1400049bb
lea r8, [rsi + 0x64]
xor edx, edx
mov rcx, rax
call fcn.1400099c0
movzx r8d, word [rbx]
mov rcx, rdi
mov rdx, qword [rbx + 8]
call fcn.140009700
mov edx, 0x68666163
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400095b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400049f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x68], r14
cmp byte [rdx + 0x20], r14b
jne 0x140004c1e
mov eax, dword [rdx + 0x58]
lea r15d, [r14 + 1]
cmp eax, r15d
jne 0x140004b9f
lea rcx, [rdx + 0x8d0]
call fcn.140004024
test al, al
je 0x140004c1e
test byte [rdi + 0x10], r15b
je 0x140004c1e
cmp dword [0x140019570], 2
mov rax, qword [rbx + 0x10]
jne 0x140004a5d
cmp r15w, word [rax + 0x2a]
jmp 0x140004a66
mov ecx, 5
cmp cx, word [rax + 0x2a]
jne 0x140004c1e
lea rsi, [rdi + 0x60]
mov rcx, rsi
call fcn.140004834
test al, al
je 0x140004a9d
mov r9, rsi
lea rdx, [0x14000a650]
mov r8d, 0x211
lea rcx, [0x14000a660]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140004c1e
mov eax, dword [rdi + 0x48]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x7c], eax
lea rcx, [0x14000f100]
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x78], eax
mov rdx, qword [rsp + 0x78]
call fcn.140004310
test al, al
jne 0x140004afa
mov edx, 0x410
xor ecx, ecx
mov r8d, 0x68666163
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140004c1e
mov rdx, qword [rsp + 0x78]
lea rcx, [0x14000f100]
mov r8, rax
call fcn.1400043b4
jmp 0x140004aff
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140004c1e
xor edx, edx
mov r8d, 0x410
mov rcx, rbx
call fcn.1400099c0
mov r8, rsi
mov edx, 0x208
mov rcx, rbx
call fcn.140004c30
movzx r8d, word [rbp + 8]
lea rcx, [rbx + 0x208]
mov r9, qword [rbp + 0x10]
mov edx, 0x104
shr r8, 1
sub r9, rcx
lea rax, [r8 - 0x104]
add rax, rdx
je 0x140004b65
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140004b65
mov word [rcx], ax
add rcx, 2
sub rdx, r15
jne 0x140004b43
test rdx, rdx
mov qword [rsp + 0x28], rsi
lea rax, [rcx - 2]
mov r8d, 0x228
cmovne rax, rcx
lea rdx, [0x14000a650]
lea rcx, [0x14000a690]
mov word [rax], r14w
mov eax, dword [rdi + 0x50]
mov r9d, dword [rdi + 0x48]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140004c1e
cmp eax, 3
je 0x140004c1e
mov eax, dword [rdx + 0x48]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x7c], eax
lea rcx, [0x14000f100]
mov eax, dword [rdx + 0x50]
mov dword [rsp + 0x78], eax
mov rdx, qword [rsp + 0x78]
call fcn.140004310
test al, al
je 0x140004c1e
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x68]
lea rcx, [0x14000f100]
call fcn.1400041c8
mov eax, dword [rdi + 0x50]
lea rdx, [0x14000a650]
mov rbx, qword [rsp + 0x68]
lea rcx, [0x14000a6d0]
mov r9d, dword [rdi + 0x48]
mov r8d, 0x23b
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x68666163
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004d98
Capabilities:
Print debug messages
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x14000e628]
xor rax, rsp
mov qword [rbp + 0x47], rax
and dword [rbp - 0xd], 0
lea rdx, [0x14000ab20]
and dword [rbp + 0xb], 0
mov rbx, rcx
and qword [rbp - 0x39], 0
xorps xmm0, xmm0
xorps xmm1, xmm1
mov r9, rcx
lea rcx, [0x14000a8a0]
mov r8d, 0x1f2
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x31], xmm1
call sub.ntoskrnl.exe_DbgPrint
mov rdx, rbx
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 9], 0
lea rax, [rbp - 0x31]
mov dword [rsp + 0x68], 0x100
lea r9, [rbp - 0x21]
and qword [rsp + 0x60], 0
lea r8, [rbp - 0x11]
and dword [rsp + 0x58], 0
lea rcx, [rbp - 0x39]
and dword [rsp + 0x50], 0
xorps xmm0, xmm0
and qword [rsp + 0x48], 0
mov edx, 0x10100
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp - 0x11], 0x30
mov dword [rbp + 7], 0x240
mov qword [rbp - 1], rax
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov ebx, eax
test eax, eax
jns 0x140004e9e
mov r8d, 0x20c
lea rcx, [0x14000ab40]
lea rdx, [0x14000ab20]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140004f07
mov rcx, qword [rbp - 0x39]
lea r8, [rbp + 0x1f]
xor eax, eax
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
mov qword [rbp + 0x3f], rax
lea rdx, [rbp - 0x21]
mov dword [rbp + 0x3f], 0x80
movups xmmword [rbp + 0x1f], xmm0
lea r9d, [rax + 0x28]
movups xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebx, eax
test eax, eax
jns 0x140004ee9
mov r8d, 0x215
lea rcx, [0x14000ab70]
jmp 0x140004e90
mov rcx, qword [rbp - 0x39]
call fcn.140005498
test al, al
jne 0x140004f05
mov r8d, 0x21b
lea rcx, [0x14000aba0]
jmp 0x140004e90
xor ebx, ebx
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140004f16
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400095b0
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rbp
ret
Function at 0x140004fec
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000e628]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rdx, [rbp - 0x48]
mov ecx, dword [rcx]
xor ebx, ebx
mov qword [rbp - 0x48], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400050e5
mov rcx, qword [rbp - 0x48]
cmp qword [0x140019548], rcx
mov rdi, qword [rdi + 8]
mov dword [rbp - 0x4c], ebx
jne 0x140005050
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000001
jmp 0x1400050e7
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9d, 2
lea rax, [rbp - 0x4c]
lea r8, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
test eax, eax
js 0x1400050d1
cmp byte [rbp - 0x4f], bl
je 0x1400050c6
mov rax, qword [0x140019540]
test rax, rax
je 0x1400050d1
mov r9d, 2
mov byte [rbp - 0x4f], bl
lea r8, [rbp - 0x50]
mov rcx, rdi
lea edx, [r9 + 2]
call qword [0x14000c458]
test eax, eax
js 0x1400050d1
mov r8d, 0x14c
lea rdx, [0x14000aa30]
lea rcx, [0x14000aa50]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ebx, eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400095b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005498
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x40]
and qword [r11 - 0x60], 0
xor r9d, r9d
mov edx, 0x10000
mov qword [r11 - 0x68], rax
mov r8, qword [r8]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x1400054fb
mov r8d, 0x192
lea rcx, [0x14000aab0]
lea rdx, [0x14000aaa0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140005661
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoGetRelatedDeviceObject]
mov ebx, 1
mov r13, rax
mov dl, bl
mov cl, byte [rax + 0x4c]
call qword [sym.imp.ntoskrnl.exe_IoAllocateIrp]
mov rdi, rax
test rax, rax
jne 0x140005539
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r8d, 0x19b
lea rcx, [0x14000aaf0]
jmp 0x1400054e8
xor r8d, r8d
lea rcx, [rbp - 0x20]
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov byte [rbp + 0x38], bl
lea rax, [rbp + 0x38]
mov qword [rdi + 0x18], rax
xor r15d, r15d
lea rax, [rbp - 0x20]
xor r14d, r14d
mov qword [rdi + 0x50], rax
xor esi, esi
lea rax, [rbp - 0x30]
mov qword [rdi + 0x48], rax
mov rax, qword [rbp + 0x40]
mov qword [rdi + 0xc0], rax
mov rax, qword gs:[0x188]
mov rcx, qword [rdi + 0xb8]
mov qword [rdi + 0x98], rax
mov byte [rdi + 0x40], 0
mov byte [rcx - 0x48], 6
mov qword [rcx - 0x20], r13
mov rax, qword [rbp + 0x40]
mov qword [rcx - 0x18], rax
mov dword [rcx - 0x40], ebx
mov dword [rcx - 0x38], 0xd
mov rax, qword [rbp + 0x40]
mov qword [rcx - 0x30], rax
lea rcx, [0x140005680]
mov rax, qword [rdi + 0xb8]
mov qword [rax - 0x10], rcx
lea rcx, [rbp - 0x20]
mov qword [rax - 8], rcx
mov byte [rax - 0x45], 0xe0
mov rax, qword [rbp + 0x40]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x140005602
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140005602
mov r15, qword [rbx + 0x10]
and qword [rbx + 0x10], rsi
mov r14, qword [rbx]
and qword [rbx], rsi
mov rsi, qword [rbx + 8]
and qword [rbx + 8], 0
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
and qword [rsp + 0x20], 0
lea rcx, [rbp - 0x20]
mov r9b, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rax, qword [rbp + 0x40]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140005655
test r15, r15
je 0x140005644
mov qword [rbx + 0x10], r15
test r14, r14
je 0x14000564c
mov qword [rbx], r14
test rsi, rsi
je 0x140005655
mov qword [rbx + 8], rsi
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140005dd0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14000e628]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
xorps xmm0, xmm0
and dword [rbp - 0x44], 0
mov rbx, rdx
lea rdx, [rbp - 0x50]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140005e1b
xor al, al
jmp 0x140005eb2
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_IoIs32bitProcess]
mov rcx, qword [rbp - 0x50]
test al, al
je 0x140005e64
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
movsxd rcx, dword [rax + 0x10]
mov edx, dword [rcx + 0x28]
mov qword [rbp - 0x40], rdx
movsxd rcx, dword [rax + 0x10]
movzx edx, word [rcx + 0x24]
mov word [rbp - 0x48], dx
movsxd rax, dword [rax + 0x10]
movzx ecx, word [rax + 0x26]
mov word [rbp - 0x46], cx
jmp 0x140005e8f
call sub.ntoskrnl.exe_PsGetProcessPeb
mov rdx, qword [rax + 0x20]
mov r8, qword [rdx + 0x40]
mov qword [rbp - 0x40], r8
mov rdx, qword [rax + 0x20]
movzx r8d, word [rdx + 0x38]
mov word [rbp - 0x48], r8w
mov rax, qword [rax + 0x20]
movzx edx, word [rax + 0x3a]
mov word [rbp - 0x46], dx
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400095b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret

Function at 0x140005ecc
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000e628]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
test rcx, rcx
je 0x140005f1c
test rdx, rdx
je 0x140005f1c
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ecx, eax
test eax, eax
js 0x140005f21
mov eax, dword [rsp + 0x48]
mov dword [rbx], eax
mov eax, ecx
jmp 0x140005f21
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400095b0
add rsp, 0x60
pop rbx
ret