joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006a4c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and dword [rbp - 0x30], 0
mov r14, r9
and dword [rbp + 0x30], 0
mov r12, r8
and qword [rbp - 0x20], 0
mov r15, rdx
mov rsi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140006c31
test rdx, rdx
je 0x140006c31
lea rdx, [rbp - 0x20]
call fcn.140006c54
mov ebx, eax
test eax, eax
js 0x140006c2d
mov eax, 0x1000
cmp qword [rbp - 0x20], rax
jle 0x140006c2d
mov r8d, 0x746b734b
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140006c2d
lfence
and qword [rbp - 0x28], 0
mov ebx, 0x1000
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140018a40
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ebx
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140006c22
cmp eax, 0x103
je 0x140006c22
cmp dword [rbp - 0x10], 0
jbe 0x140006c22
lfence
mov r9, r12
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x30]
mov rcx, rdi
lea rdx, [rbp - 0x30]
call fcn.140008ff0
mov ebx, eax
test eax, eax
js 0x140006c22
mov eax, 0xaaaaaaab
xor ecx, ecx
mul dword [rbp + 0x30]
mov eax, dword [rbp - 0x30]
mov r8d, 0x746b734b
shr edx, 1
add eax, edx
mov qword [rbp - 0x28], rax
mov eax, 0xcccccccd
mul edx
shr edx, 4
mov dword [rbp + 0x30], edx
add rdx, 2
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
je 0x140006c22
lfence
mov r8d, dword [rbp + 0x30]
xor edx, edx
add r8, 2
mov rcx, rax
call fcn.140018a40
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov eax, dword [rbp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rsi
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140006c17
cmp eax, 0x103
je 0x140006c17
cmp dword [rbp - 0x10], 0
jle 0x140006c17
lfence
mov edx, dword [rbp - 0x10]
mov r8, r15
mov rcx, r14
call fcn.1400086e8
mov ebx, eax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140006c36
mov eax, 0xc0000001
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x140006c54
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x140006c96
test rdx, rdx
je 0x140006c96
xorps xmm0, xmm0
mov dword [rax - 0x48], 5
mov r9d, 0x18
lea r8, [rax - 0x28]
lea rdx, [rax - 0x38]
movups xmmword [rax - 0x38], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x48]
mov qword [rbx], rcx
jmp 0x140006c9b
mov eax, 0xc0000001
add rsp, 0x60
pop rbx
ret
Function at 0x140007b78
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 8], 0
mov r12, r8
and qword [rbp - 0x10], 0
lea r8, [rbp - 8]
mov r13b, dl
mov r15, rcx
lea rdx, [0x140019a70]
xor ecx, ecx
mov ebx, 0xc0000001
call fcn.140017bc0
test eax, eax
jns 0x140007bcd
lfence
jmp 0x140007d3d
xor r14d, r14d
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x48]
and dword [rbp + 0x48], 0
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov edx, r14d
and dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov esi, eax
cmp eax, 0x80000005
je 0x140007c0a
cmp eax, 0xc0000023
jne 0x140007c99
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x140007c99
lea rdx, [rax + 2]
xor ecx, ecx
mov r8d, 0x746b734b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140007c99
mov r8d, dword [rbp + 0x48]
xor edx, edx
add r8, 2
mov rcx, rax
call fcn.140018a40
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov r9, rdi
mov eax, dword [rbp + 0x48]
mov r8d, 1
mov edx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov esi, eax
test eax, eax
js 0x140007c8e
lfence
mov edx, dword [rdi + 8]
lea r9, [rbp - 0x10]
add rdx, rdi
lea r8, [0x140019ad0]
xor ecx, ecx
call fcn.140017838
mov ebx, eax
test eax, eax
jns 0x140007ca9
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test esi, esi
js 0x140007d2d
inc r14d
jmp 0x140007bd0
lfence
test r15, r15
je 0x140007d05
mov rax, qword [rbp - 0x10]
xor ecx, ecx
mov r8d, 0x746b734b
mov edx, dword [rax + 8]
add rdx, 2
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [r15], rax
test rax, rax
je 0x140007cfe
mov rcx, qword [rbp - 0x10]
xor edx, edx
mov r8d, dword [rcx + 8]
mov rcx, rax
add r8, 2
call fcn.140018a40
mov rdx, qword [rbp - 0x10]
mov rcx, qword [r15]
mov r8d, dword [rdx + 8]
add rdx, 0xc
call fcn.140018c40
jmp 0x140007d05
mov ebx, 0xc000000d
mov esi, ebx
mov ecx, dword [rdi + 8]
mov r8, r12
add rcx, rdi
mov dl, r13b
call fcn.140007de0
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test ebx, ebx
lea rcx, [rbp - 8]
cmovns ebx, esi
call fcn.140017310
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140007fc0
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [rbp + 0x30]
and qword [rbp - 0x40], 0
and qword [rbp - 0x38], 0
and qword [rbp - 0x30], 0
mov qword [rbp - 0x18], r8
xor r8d, r8d
mov qword [rbp - 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x10], r9
lea edx, [r8 + 1]
mov qword [rbp - 8], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x30]
lea rax, [0x140008070]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x1fffff
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x14000805a
and qword [rsp + 0x20], 0
lea rcx, [rbp - 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x80
pop rbp
ret

Function at 0x1400083c8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rdx, [rbp - 0x40]
call fcn.14000845c
xor ebx, ebx
test eax, eax
js 0x14000844f
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140008445
cmp word [rbp - 0x40], bx
jbe 0x140008445
cmp word [rax], bx
je 0x140008445
lea rax, [rbp - 0x40]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x28], rbx
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x18], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
test eax, eax
jns 0x140008445
cmp word [rbp - 0x40], 0xa
jbe 0x140008445
mov rdx, qword [rbp - 0x38]
cmp word [rdx + 0xa], 0x3a
lea rcx, [rdx + 8]
cmovne rcx, rdx
call fcn.1400095d8
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1400084ac
Capabilities:
Install driver

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x160]
mov r8d, 0x20a
call fcn.140018a40
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140018a40
lea rax, [rbp + 0x3a0]
mov r9, rbx
or r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov edx, 0x105
lea rcx, [rbp + 0x160]
call sub.ntoskrnl.exe__vsnwprintf_s
test eax, eax
je 0x1400085ec
mov r9, rdi
lea r8, [0x140019b40]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call sub.ntoskrnl.exe_swprintf_s
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.140017338
test eax, eax
js 0x1400085ec
mov rcx, qword [rsp + 0x30]
lea r8, [0x140019bb0]
mov ebx, 1
xor edx, edx
mov r9d, ebx
call fcn.140017e58
mov rcx, qword [rsp + 0x30]
lea r8, [0x140019bd0]
mov r9d, ebx
xor edx, edx
call fcn.140017e58
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 2]
lea r8, [0x140019be0]
xor edx, edx
call fcn.140017e58
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x160]
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
lea r8, [0x140019b20]
xor edx, edx
call fcn.140017f20
lea rcx, [rsp + 0x30]
call fcn.140017310
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
add rsp, 0x470
pop rdi
pop rbx
pop rbp
ret
Function at 0x140008ad4
Capabilities:
Enumerate processes via ntquerysysteminformation
Find process by pid
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, 0x2000
mov r14, rdx
mov ebx, ebp
mov edx, ebp
mov r15, rcx
jmp 0x140008b2d
and dword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
mov r8d, ebx
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, eax
test eax, eax
jns 0x140008b5b
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, 0xc0000004
jne 0x140008b48
add ebx, ebp
mov edx, ebx
mov r8d, 0x30397358
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x140008af5
mov esi, 0xc000009a
mov rbx, qword [rsp + 0x60]
mov eax, esi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rbp, rdi
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x140008ba1
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x140008ba1
mov r8, qword [rsp + 0x78]
mov r9, r14
mov rdx, qword [rdi + 0x50]
mov rcx, rdi
mov rax, r15
call qword [0x14001a3a0]
mov rcx, qword [rsp + 0x78]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bl, bl
jne 0x140008bac
mov eax, dword [rdi]
test eax, eax
je 0x140008bac
add rdi, rax
jmp 0x140008b5e
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140008b48

Function at 0x140008ff0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov r11, r8
mov rbx, rdx
mov rax, rcx
mov r10d, 0xc0000001
test rdx, rdx
je 0x1400090ea
test r8, r8
je 0x1400090ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400090ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400090ea
movzx eax, word [rcx + 0x18]
mov edx, 0x20b
cmp ax, dx
jne 0x14000908f
test r9, r9
je 0x140009050
mov eax, dword [rcx + 8]
mov dword [r9], eax
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14000905d
mov byte [rax], 1
movzx edx, word [rcx + 6]
test rdx, rdx
je 0x1400090ea
xor eax, eax
add rcx, 0x118
mov r8d, dword [rcx + 4]
test r8d, r8d
je 0x140009081
cmp dword [rcx], 0
ja 0x1400090df
inc rax
add rcx, 0x28
cmp rax, rdx
jge 0x1400090ea
jmp 0x140009073
mov edx, 0x10b
cmp ax, dx
jne 0x1400090ea
test r9, r9
je 0x1400090a4
mov eax, dword [rcx + 8]
mov dword [r9], eax
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400090b1
mov byte [rax], 0
movzx edx, word [rcx + 6]
test rdx, rdx
je 0x1400090ea
xor eax, eax
add rcx, 0x108
mov r8d, dword [rcx + 4]
test r8d, r8d
je 0x1400090d1
cmp dword [rcx], 0
ja 0x1400090df
inc rax
add rcx, 0x28
cmp rax, rdx
jge 0x1400090ea
jmp 0x1400090c3
mov dword [rbx], r8d
xor r10d, r10d
mov eax, dword [rcx]
mov dword [r11], eax
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x1400098e4
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x80
and dword [rax - 0x68], 0
mov rbx, r8
and dword [rax - 0x64], 0
mov r8d, edx
mov rdx, rcx
mov dword [rax - 0x60], 0x67452301
lea rcx, [rax - 0x68]
mov dword [rax - 0x5c], 0xefcdab89
mov dword [rax - 0x58], 0x98badcfe
mov dword [rax - 0x54], 0x10325476
call fcn.14000a334
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140009a14
add rsp, 0x80
pop rbx
ret
Function at 0x140012d6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
xor r14d, r14d
mov dil, 1
mov qword [rbp + 0x6f], r14
mov dword [rbp + 0x67], r14d
call fcn.140014984
mov rsi, rax
test rax, rax
jne 0x140012dad
mov eax, 0xc0000001
jmp 0x140012f89
lea r8, [rbp + 0x67]
mov dword [rbp - 0x79], 0x6c64746e
lea rdx, [rbp + 0x6f]
mov dword [rbp - 0x75], 0x6c642e6c
lea rcx, [rbp - 0x79]
mov word [rbp - 0x71], 0x6c
call fcn.140014ab4
mov ebx, eax
test eax, eax
jns 0x140012e77
lea r8, [rbp + 0x67]
mov dword [rbp - 0x59], 0x53005c
lea rdx, [rbp + 0x6f]
mov dword [rbp - 0x55], 0x730079
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x51], 0x650074
mov dword [rbp - 0x4d], 0x52006d
mov dword [rbp - 0x49], 0x6f006f
mov dword [rbp - 0x45], 0x5c0074
mov dword [rbp - 0x41], 0x790053
mov dword [rbp - 0x3d], 0x740073
mov dword [rbp - 0x39], 0x6d0065
mov dword [rbp - 0x35], 0x320033
mov dword [rbp - 0x31], 0x6e005c
mov dword [rbp - 0x2d], 0x640074
mov dword [rbp - 0x29], 0x6c006c
mov dword [rbp - 0x25], 0x64002e
mov dword [rbp - 0x21], 0x6c006c
mov word [rbp - 0x1d], r14w
call fcn.14001512c
mov ebx, eax
test eax, eax
js 0x140012f89
mov rdx, qword [rbp + 0x6f]
test rdx, rdx
je 0x140012f89
mov dil, r14b
jmp 0x140012e7b
mov rdx, qword [rbp + 0x6f]
movdqa xmm0, xmmword [str.ZwTerminateThreaZwCreateThreadExPQRAPAQASH]
lea rax, [0x1400264f8]
movdqu xmmword [rbp - 0x19], xmm0
lea r9, [rbp - 0x19]
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [str.ZwSuspendThread]
mov r8b, 1
movdqu xmmword [rbp + 0x17], xmm0
mov rcx, rsi
mov word [rbp - 9], 0x64
movdqa xmm0, xmmword [0x14001e060]
movdqu xmmword [rbp - 1], xmm0
mov dword [rbp - 0x69], 0x6552775a
mov dword [rbp - 0x65], 0x656d7573
mov dword [rbp - 0x61], 0x65726854
mov word [rbp - 0x5d], 0x6461
mov byte [rbp - 0x5b], r14b
mov byte [rbp + 0xf], r14b
mov byte [rsp + 0x20], dil
call fcn.140014c14
mov rdx, qword [rbp + 0x6f]
lea rax, [0x1400264e8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x17]
mov r8b, 1
mov byte [rsp + 0x20], dil
mov rcx, rsi
call fcn.140014c14
mov rdx, qword [rbp + 0x6f]
lea rax, [0x1400264f0]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x69]
mov r8b, 1
mov byte [rsp + 0x20], dil
mov rcx, rsi
call fcn.140014c14
mov rdx, qword [rbp + 0x6f]
lea rax, [0x140026500]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 1]
mov r8b, 1
mov byte [rsp + 0x20], dil
mov rcx, rsi
call fcn.140014c14
mov rdx, qword [rbp + 0x6f]
mov r8b, dil
mov rcx, rsi
call fcn.14001309c
mov rcx, qword [rbp + 0x6f]
call fcn.140015a2c
call fcn.140015430
test dil, dil
jne 0x140012f87
mov rdx, qword [rbp + 0x6f]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov eax, ebx
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001309c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001e1c0]
mov bl, r8b
mov rax, qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
lea r8, [rbp - 0x50]
movdqu xmmword [rbp - 0x50], xmm0
mov rdi, rdx
mov qword [0x140026538], rax
movdqa xmm0, xmmword [str.ZwWriteVirtualMeZwProtectVirtualZwReadVirtualMemCreateProcessIntZwAllocateVirtua]
xor eax, eax
movdqu xmmword [rbp - 0x38], xmm0
mov dl, bl
mov rcx, rdi
movdqa xmm0, xmmword [0x14001e1b0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x40], 0x79726f
mov dword [rbp - 0x28], 0x79726f6d
mov byte [rbp - 0x24], al
mov dword [rbp - 0x10], 0x6f6d654d
mov word [rbp - 0xc], 0x7972
mov byte [rbp - 0xa], al
mov dword [rbp - 0x60], 0x704f775a
mov dword [rbp - 0x5c], 0x754d6e65
mov dword [rbp - 0x58], 0x746e6174
mov byte [rbp - 0x54], al
call fcn.140014ef4
lea r8, [rbp - 0x38]
mov qword [0x140026540], rax
mov dl, bl
mov rcx, rdi
call fcn.140014ef4
lea r8, [rbp - 0x20]
mov qword [0x140026548], rax
mov dl, bl
mov rcx, rdi
call fcn.140014ef4
lea r8, [rbp - 0x60]
mov qword [0x140026550], rax
mov dl, bl
mov rcx, rdi
call fcn.140014ef4
lea r11, [rsp + 0x80]
mov qword [0x140026558], rax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140013190
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x50
and qword [rax + 8], 0
mov bpl, dl
mov rbx, rcx
mov edx, 0x10
mov rcx, qword gs:[0x188]
mov rdi, r9
mov sil, r8b
call qword [sym.imp.ntoskrnl.exe_KeSetPriorityThread]
cmp rbx, 4
ja 0x1400131d6
mov eax, 0xc0000227
jmp 0x14001324f
lfence
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400131f0
lfence
jmp 0x14001324f
mov rax, qword [rsp + 0xa0]
mov r9, rdi
mov rcx, qword [rsp + 0x60]
mov r8b, sil
mov qword [rsp + 0x40], rax
mov dl, bpl
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call fcn.140013264
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140013264
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov byte [r11 + 0x18], r8b
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r14, r9
mov r15b, dl
mov rbx, rcx
mov dword [rsp + 0x40], 0xc0000227
xor eax, eax
mov dil, al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x38], xmm0
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x68], rax
test r9, r9
je 0x14001341b
cmp dword [rsp + 0xe0], eax
je 0x14001341b
test rcx, rcx
je 0x14001341b
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov r13, rax
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov r12, rax
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dil, 1
mov byte [rsp + 0xd8], dil
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.140012d40
cmp al, dil
je 0x14001341b
test r15b, r15b
je 0x140013339
mov dword [rsp + 0x20], 0xc8
mov r9, r12
mov r8, r13
lea rdx, [0x140019d30]
mov rcx, rbx
call fcn.14001535c
mov rax, qword [rsp + 0xf8]
test rax, rax
je 0x140013369
mov r9, qword [rsp + 0x100]
mov r8, qword [r13 + 0x10]
mov dl, 1
mov rcx, rbx
mov r10, qword [0x14001a3a0]
call r10
test al, al
je 0x14001341b
test r12, r12
sete al
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], al
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xe8]
mov r8d, dword [rsp + 0xe0]
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14001344c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140013401
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140013401
mov ecx, dword [rsp + 0xe0]
add rcx, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, 4
call fcn.140012c08
cmp byte [rsp + 0xd0], 1
jne 0x1400133ff
mov r9d, 0x8000
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
jmp 0x14001341b
mov dword [rsp + 0x40], 0xc0000225
jmp 0x14001341b
cmp dil, 1
jne 0x14001342c
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001344c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
and qword [rax + 8], 0
mov rsi, r9
mov r15d, r8d
mov rdi, rdx
test rcx, rcx
je 0x1400135ea
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x1400135ea
test rdx, rdx
je 0x1400135ea
test r8d, r8d
je 0x1400135ea
mov r13b, byte [rsp + 0x88]
mov edx, 0xc29
cmp r13b, 1
mov eax, 0xf25
mov ebx, r15d
cmovne eax, edx
lea rdx, [r15 + 0x100]
test r9, r9
je 0x1400134d5
mov ebp, dword [rsp + 0x80]
test ebp, ebp
jne 0x1400134d9
xor ebp, ebp
xor esi, esi
add rax, rdx
mov r12d, ebp
add rax, r12
mov dword [rsp + 0x28], 0x40
mov qword [rcx], rax
lea rdx, [rsp + 0x60]
mov r9, rcx
mov dword [rsp + 0x20], 0x1000
or rcx, 0xffffffffffffffff
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x1400135ea
mov rcx, qword [rsp + 0x60]
mov r8, rbx
mov rdx, rdi
call fcn.140018c40
mov rcx, qword [rsp + 0x60]
add rcx, rbx
cmp r13b, 1
jne 0x14001358d
lea rdx, [0x140021c00]
mov r8d, 0xf00
call fcn.140018c40
mov rdi, qword [rsp + 0x60]
add rdi, 0xf00
add rdi, rbx
and dword [rdi], 0
and qword [rdi + 4], 0
or byte [rdi + 0xc], 3
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0xd], rax
mov dword [rdi + 0x15], r15d
mov dword [rdi + 0x19], ebp
test rsi, rsi
je 0x140013588
lea rbx, [rdi + 0x25]
mov r8d, r12d
mov rcx, rbx
mov rdx, rsi
call fcn.140018c40
mov qword [rdi + 0x1d], rbx
mov qword [r14], rdi
jmp 0x1400135e3
lea rdx, [0x140022b00]
mov r8d, 0xc10
call fcn.140018c40
mov rax, qword [rsp + 0x60]
add rax, 0xc10
add rbx, rax
and dword [rbx], 0
and dword [rbx + 4], 0
or byte [rbx + 8], 3
mov eax, dword [rsp + 0x60]
mov dword [rbx + 9], eax
mov dword [rbx + 0xd], r15d
mov dword [rbx + 0x11], ebp
test rsi, rsi
je 0x1400135e0
lea rcx, [rbx + 0x19]
mov r8, r12
mov rdx, rsi
call fcn.140018c40
lea eax, [rbx + 0x19]
mov dword [rbx + 0x15], eax
mov qword [r14], rbx
mov rax, qword [rsp + 0x60]
jmp 0x1400135ec
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret