joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002eab0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xc0], 0
jne 0x14002eae6
xor eax, eax
jmp 0x14002ebd2
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0xc0]
call fcn.1400283c0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x14002eb81
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x38]
call fcn.140028570
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x30], eax
jmp 0x14002ebb0
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp qword [rsp + 0x38], 0
je 0x14002ebce
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0xb0
pop rdi
ret

Function at 0x140030eb0
Capabilities:
Attach user process memory

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 0xc0000001
cmp qword [rsp + 0x80], 0
je 0x140030f0b
cmp dword [rsp + 0x98], 0
je 0x140030f0b
cmp qword [rsp + 0x88], 0
je 0x140030f0b
cmp qword [rsp + 0x90], 0
jne 0x140030f14
mov eax, dword [rsp + 0x30]
jmp 0x140030fb9
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
cmp dword [rsp + 0xb0], 0
je 0x140030f43
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xa0]
mov r8d, dword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call fcn.14002d210
mov dword [rsp + 0x30], eax
jmp 0x140030fa0
cmp dword [rsp + 0xb0], 0
je 0x140030fb5
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x70
pop rdi
ret
Function at 0x140048220
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x24], 0xc0000001
mov byte [rsp + 0x20], 0
cmp qword [0x1400992b0], 1
jne 0x140048242
xor eax, eax
jmp 0x14004834b
xor ecx, ecx
call fcn.14002a4f0
mov dword [rsp + 0x2c], eax
jmp 0x140048274
mov ecx, dword [rsp + 0x2c]
call fcn.14002a4f0
mov r8d, 0x1b
lea rdx, [0x140075d00]
lea rcx, [0x140075d10]
call sub.ntoskrnl.exe_DbgPrint
nop
call fcn.14004f110
movzx eax, al
test eax, eax
jne 0x1400482c5
mov r8d, 0x20
lea rdx, [0x140075d00]
lea rcx, [0x140075d40]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x24]
jmp 0x14004834b
call fcn.140055050
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400482e1
call fcn.14004ce80
call fcn.140054600
jmp 0x1400482e3
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140048306
mov qword [0x1400992b0], 1
mov dword [rsp + 0x24], 0
xor ecx, ecx
call fcn.14004cc20
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14004831d
lea rax, [0x140070c20]
mov qword [rsp + 0x30], rax
jmp 0x140048329
lea rax, [0x140070c30]
mov qword [rsp + 0x30], rax
mov r9, qword [rsp + 0x30]
mov r8d, 0x36
lea rdx, [0x140075d00]
lea rcx, [0x140075d80]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret
Function at 0x14004a100
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
movabs rax, 0xff8000000000
mov rcx, qword [rsp + 0x50]
and rcx, rax
mov rax, rcx
shr rax, 0x27
mov qword [rsp + 0x20], rax
movabs rax, 0x7fc0000000
mov rcx, qword [rsp + 0x50]
and rcx, rax
mov rax, rcx
shr rax, 0x1e
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
and rax, 0x3fe00000
shr rax, 0x15
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x20], 0
jbe 0x14004a17e
mov r8d, 0x143
lea rdx, [0x1400761d0]
lea rcx, [0x1400761f0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x14004a1aa
mov rax, qword [0x140098620]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x980]
imul rcx, qword [rsp + 0x28], 0x1000
lea rax, [rax + rcx + 0x2000]
mov rcx, qword [rsp + 0x30]
lea rax, [rax + rcx*8]
add rsp, 0x48
ret

Function at 0x14004b920
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x48]
and rax, 0x7ffffff
shl rax, 0x15
mov rcx, qword [rsp + 0x40]
movabs rdx, 0xffff0000001fffff
mov rcx, qword [rcx]
and rcx, rdx
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x48]
call fcn.14004b830
movzx eax, al
cmp eax, 1
jne 0x14004b9af
mov dl, 1
mov rcx, qword [rsp + 0x48]
call fcn.140049e60
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
and rax, 7
shl rax, 3
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
and rcx, 0xffffffffffffffc7
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov al, 1
jmp 0x14004ba01
mov r8d, 0x2000
mov dl, 1
mov ecx, 3
call fcn.14004fd90
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14004b9eb
mov r8d, 0xdb
lea rdx, [0x140076110]
lea rcx, [0x140076130]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004ba01
imul rax, qword [rsp + 0x48], 0x200000
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.14004ba10
add rsp, 0x38
ret
Function at 0x14004f540
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
jmp 0x14004f566
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x20], eax
jae 0x14004f64e
mov ecx, 0x30
call fcn.14004f4e0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14004f5ab
mov r8d, 0x13
lea rdx, [0x140079670]
lea rcx, [0x140079690]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f650
mov edx, 0x30
mov rcx, qword [rsp + 0x28]
call fcn.140024220
mov rcx, qword [rsp + 0x40]
call fcn.14004f4e0
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
jne 0x14004f5f4
mov r8d, 0x1b
lea rdx, [0x140079670]
lea rcx, [0x140079690]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f650
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.140024220
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x28], 0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov rcx, qword [0x140098620]
mov rcx, qword [rcx + 8]
mov rdx, rax
mov rcx, qword [rcx + 8]
call fcn.14000b3c0
jmp 0x14004f55c
mov al, 1
add rsp, 0x38
ret
Function at 0x14004f7b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov ecx, 0x20
call fcn.14004f4e0
mov rcx, qword [0x140098620]
mov qword [rcx + 8], rax
mov rax, qword [0x140098620]
cmp qword [rax + 8], 0
jne 0x14004f7f7
mov r8d, 0x7a
lea rdx, [0x140079750]
lea rcx, [0x140079760]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
mov edx, 0x20
mov rax, qword [0x140098620]
mov rcx, qword [rax + 8]
call fcn.140024220
mov ecx, 0xa0
call fcn.14004f4e0
mov rcx, qword [0x140098620]
mov rcx, qword [rcx + 8]
mov qword [rcx], rax
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
cmp qword [rax], 0
jne 0x14004f855
mov r8d, 0x82
lea rdx, [0x140079750]
lea rcx, [0x140079790]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov edx, 0xa0
mov rcx, qword [rax]
call fcn.140024220
mov ecx, 0x10
call fcn.14004f4e0
mov rcx, qword [0x140098620]
mov rcx, qword [rcx + 8]
mov qword [rcx + 8], rax
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
cmp qword [rax + 8], 0
jne 0x14004f8b8
mov r8d, 0x8a
lea rdx, [0x140079750]
lea rcx, [0x1400797c0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov edx, 0x10
mov rcx, qword [rax + 8]
call fcn.140024220
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 8]
call fcn.14000b390
mov r8d, 3
mov edx, 0x64
mov ecx, 0x2000
call fcn.14004fc90
movzx eax, al
test eax, eax
jne 0x14004f921
mov r8d, 0x93
lea rdx, [0x140079750]
lea rcx, [0x140079800]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
mov r8d, 1
mov edx, 0x64
mov ecx, 0x2000
call fcn.14004fc90
movzx eax, al
test eax, eax
jne 0x14004f95a
mov r8d, 0x99
lea rdx, [0x140079750]
lea rcx, [0x140079800]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
mov r8d, 2
mov edx, 0x64
mov ecx, 0x64
call fcn.14004fc90
movzx eax, al
test eax, eax
jne 0x14004f993
mov r8d, 0x9f
lea rdx, [0x140079750]
lea rcx, [0x140079800]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
mov r8d, 4
mov edx, 0x64
mov ecx, 0x38
call fcn.14004fc90
movzx eax, al
test eax, eax
jne 0x14004f9cc
mov r8d, 0xa5
lea rdx, [0x140079750]
lea rcx, [0x140079800]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14004f9d1
call fcn.14004fa50
add rsp, 0x28
ret
Function at 0x14004fa50
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 1
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
movzx eax, byte [rax + 0x18]
test eax, eax
jne 0x14004fa8f
mov r8d, 0x4f
lea rdx, [0x1400796c0]
lea rcx, [0x1400796e0]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x14004fbb8
mov qword [rsp + 0x28], 0
jmp 0x14004faa7
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xa
jae 0x14004fba4
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
cmp qword [rax + rcx*8], 0
je 0x14004fb9f
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [0x140098620]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
mov rdx, qword [0x140098620]
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
mov r8, qword [rsp + 0x28]
mov r8d, dword [rax + r8*4 + 0x78]
mov rax, qword [rsp + 0x28]
mov edx, dword [rcx + rax*4 + 0x50]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax*8]
call fcn.14004f540
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14004fb4e
mov r8d, 0x60
lea rdx, [0x1400796c0]
lea rcx, [0x140079710]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14004fba4
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov qword [rax + rcx*8], 0
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov dword [rax + rcx*4 + 0x50], 0
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov dword [rax + rcx*4 + 0x78], 0
jmp 0x14004fa9a
mov rax, qword [0x140098620]
mov rax, qword [rax + 8]
mov byte [rax + 0x18], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140054310
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov ecx, 0x28
call fcn.1400542e0
mov qword [0x140098620], rax
cmp qword [0x140098620], 0
jne 0x14005437a
mov r8d, 0xb3
lea rdx, [0x140079cc0]
lea rcx, [0x140079ce0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14005454a
mov dword [rsp + 0x20], 1
mov edx, 0x28
mov rcx, qword [0x140098620]
call fcn.140024220
mov cx, 0xffff
call qword [sym.imp.ntoskrnl.exe_KeQueryActiveProcessorCountEx]
mov rcx, qword [0x140098620]
mov dword [rcx + 0x18], eax
mov rax, qword [0x140098620]
mov eax, dword [rax + 0x18]
shl rax, 3
mov rcx, rax
call fcn.1400542e0
mov rcx, qword [0x140098620]
mov qword [rcx], rax
mov rax, qword [0x140098620]
cmp qword [rax], 0
jne 0x1400543f4
mov r8d, 0xbf
lea rdx, [0x140079cc0]
lea rcx, [0x140079d20]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14005454a
mov dword [rsp + 0x20], 2
mov rax, qword [0x140098620]
mov eax, dword [rax + 0x18]
shl rax, 3
mov rdx, rax
mov rax, qword [0x140098620]
mov rcx, qword [rax]
call fcn.140024220
mov ecx, 0x990
call fcn.1400542e0
mov rcx, qword [0x140098620]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140098620]
cmp qword [rax + 0x10], 0
jne 0x14005445f
mov r8d, 0xca
lea rdx, [0x140079cc0]
lea rcx, [0x140079d60]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14005454a
mov dword [rsp + 0x20], 3
mov edx, 0x990
mov rax, qword [0x140098620]
mov rcx, qword [rax + 0x10]
call fcn.140024220
mov rax, qword [0x140098620]
mov rax, qword [rax + 0x10]
mov rcx, rax
call fcn.14000b390
call fcn.140049390
mov dword [rsp + 0x20], 4
call fcn.14004f7b0
movzx eax, al
test eax, eax
jne 0x1400544af
xor al, al
jmp 0x14005454a
mov dword [rsp + 0x20], 5
call fcn.14004b6d0
movzx eax, al
test eax, eax
jne 0x1400544ca
xor al, al
jmp 0x14005454a
mov dword [rsp + 0x20], 6
mov rax, qword [0x140098620]
mov byte [rax + 0x20], 1
xor eax, eax
xor ecx, ecx
cpuid
lea rdi, [rsp + 0x28]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov rax, qword [0x140098620]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x1c], ecx
mov al, 1
jmp 0x14005454a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x1400548b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14004c7e0
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [0x140098620]
mov rcx, qword [rcx]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400548ff
mov r8d, 0x192
lea rdx, [0x14007a030]
lea rcx, [0x14007a050]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400549e0
call fcn.140054180
mov rax, qword [rsp + 0x30]
add rax, 0x20
vmxon qword [rax]
sete al
setb cl
adc al, cl
movzx eax, al
test eax, eax
je 0x140054943
mov r9d, dword [rsp + 0x24]
mov r8d, 0x19b
lea rdx, [0x14007a030]
lea rcx, [0x14007a080]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400549e0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x60], 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.140050c80
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x68], 1
vmlaunch
sete al
setb cl
adc al, cl
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
mov r9d, eax
mov r8d, 0x1ac
lea rdx, [0x14007a030]
lea rcx, [0x14007a0c0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x68], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x60], 0
vmxoff
jmp 0x1400549e0
add rsp, 0x48
ret
Function at 0x140054d10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov ecx, 0x480
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x38], 0xffffffffffffffff
mov ecx, 0x1000
call fcn.1400542b0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 8], 0
jne 0x140054d96
mov r8d, 0x8c
lea rdx, [0x140079c00]
lea rcx, [0x140079c10]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140054e99
mov dword [rsp + 0x20], 2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
jne 0x140054dec
mov r8d, 0x93
lea rdx, [0x140079c00]
lea rcx, [0x140079c40]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140054e99
mov dword [rsp + 0x20], 3
mov edx, 0x1000
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.140024220
mov rax, qword [rsp + 0x28]
and rax, 0x7fffffff
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
btr eax, 0x1f
mov ecx, dword [rcx]
and ecx, 0x80000000
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov eax, dword [rax]
btr eax, 0x1f
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov dword [rcx], eax
mov al, 1
jmp 0x140054e99
add rsp, 0x40
pop rdi
ret
Function at 0x140054ea0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov ecx, 0x480
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x28]
shr rax, 0x20
and rax, 0x1fff
cmp rax, 0x1000
jbe 0x140054f0a
mov ecx, 0x1000
call fcn.1400542b0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
jmp 0x140054f2a
mov rax, qword [rsp + 0x28]
shr rax, 0x20
and rax, 0x1fff
mov rcx, rax
call fcn.1400542b0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov dword [rsp + 0x20], 2
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x18], 0
jne 0x140054f5e
mov r8d, 0x14c
lea rdx, [0x140079f70]
lea rcx, [0x140079f80]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140055048
mov dword [rsp + 0x20], 3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x20], 0
jne 0x140054fb4
mov r8d, 0x153
lea rdx, [0x140079f70]
lea rcx, [0x140079fb0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140055048
mov dword [rsp + 0x20], 4
mov edx, 0x1000
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
call fcn.140024220
mov rax, qword [rsp + 0x28]
and rax, 0x7fffffff
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov eax, dword [rax]
btr eax, 0x1f
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
mov dword [rcx], eax
mov al, 1
jmp 0x140055048
add rsp, 0x40
pop rdi
ret
Function at 0x140061c70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0
jne 0x140061c9a
cmp qword [rsp + 0x48], 0
jne 0x140061c9a
xor al, al
jmp 0x140061dd1
mov byte [rsp + 0x20], 0
mov r8d, 0x6e556353
mov edx, 0x1e0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140061ce2
mov r8d, 0x61
lea rdx, [0x14007c7e0]
lea rcx, [0x14007c800]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x140061dd1
mov edx, 0x1e0
mov rcx, qword [rsp + 0x28]
call fcn.140024220
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0xf0], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0xf8], rcx
cmp qword [rsp + 0x50], 0
je 0x140061d60
mov rax, qword [rsp + 0x28]
add rax, 0x12c
mov r8d, 0x2c
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call fcn.14006f1c0
jmp 0x140061d60
lea rcx, [0x1400a3548]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rax, qword [rsp + 0x28]
mov rdx, rax
lea rcx, [0x1400a3580]
call fcn.14000b3c0
mov rax, qword [rsp + 0x28]
add rax, 0x10
mov rcx, rax
call fcn.14000b390
mov rax, qword [rsp + 0x28]
add rax, 0xa0
mov rcx, rax
call fcn.14000b390
mov rax, qword [rsp + 0x28]
add rax, 0xd8
mov rcx, rax
call fcn.14000b390
lea rcx, [0x1400a3548]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov byte [rsp + 0x20], 1
jmp 0x140061dcc
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140062770
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, byte [0x1400a3590]
test eax, eax
jne 0x14006278f
xor al, al
jmp 0x14006285a
mov byte [rsp + 0x20], 0
cmp dword [rsp + 0x58], 0x1c
jge 0x1400627a2
cmp dword [rsp + 0x58], 0
jge 0x1400627c5
mov r8d, 0x333
lea rdx, [0x14007c950]
lea rcx, [0x14007c960]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x14006285a
lea rcx, [0x1400a3580]
call fcn.14000b440
movzx eax, al
test eax, eax
je 0x1400627dc
xor al, al
jmp 0x14006285a
mov rax, qword [0x1400a3580]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a3580]
cmp qword [rsp + 0x28], rax
je 0x140062853
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x30], 0
jne 0x140062817
jmp 0x1400627e8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
cmp qword [rax + 0xf8], rcx
jne 0x140062851
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0xf8], 0
je 0x140062851
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax + 0x110]
mov byte [rsp + 0x20], al
jmp 0x140062853
jmp 0x1400627e8
jmp 0x140062855
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140062e90
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x70], 0
je 0x140062ece
cmp qword [rsp + 0x78], 0
je 0x140062ece
cmp qword [rsp + 0x80], 0
jne 0x140062ed8
mov eax, 0xffffffff
jmp 0x140062f8e
cmp qword [rsp + 0x80], 1
jbe 0x140062eed
mov eax, 0xfffffffe
jmp 0x140062f8e
mov dword [rsp + 0x20], 0x100
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140062f35
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov dword [rsp + 0x20], eax
jmp 0x140062f5c
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [rsp + 0x20], 0x100
jne 0x140062f78
mov eax, 0xfffffffd
jmp 0x140062f8e
cmp dword [rsp + 0x20], 0xcc
jne 0x140062f89
mov eax, 1
jmp 0x140062f8e
mov eax, 2
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x60
pop rdi
ret

Function at 0x140062fb0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0xa0], 0
je 0x140062fea
cmp qword [rsp + 0xa8], 0
jne 0x140062ff1
xor eax, eax
jmp 0x1400630c3
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 4
jae 0x140063013
xor eax, eax
jmp 0x1400630c3
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14006306a
xor eax, eax
jmp 0x1400630c3
mov rax, qword [rsp + 0x28]
shr rax, 0xc
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call fcn.140049290
mov qword [rsp + 0x38], rax
jmp 0x1400630b3
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x90
pop rdi
ret