joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000814c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov r8, rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r9
lea rdi, [rsp + 0x20]
xor eax, eax
lea ecx, [rax + 8]
rep stosb byte [rdi], al
lea rdi, [rsp + 0x38]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
jns 0x1400081bb
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400081bb
mov eax, 0xc0000001
jmp 0x140008228
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400081f8
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.14000ec00
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140008226
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000e340
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140008240
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov r8, rcx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r9
lea rdi, [rsp + 0x30]
xor eax, eax
lea ecx, [rax + 8]
rep stosb byte [rdi], al
lea rdi, [rsp + 0x48]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
jns 0x1400082b7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400082b7
mov eax, 0xc0000001
jmp 0x140008377
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008347
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rdi, rax
test rax, rax
je 0x140008347
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rbx, rax
test rax, rax
je 0x14000833e
mov r8, r14
mov rdx, rax
mov rcx, r15
call fcn.14000ec00
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140008375
mov eax, esi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000e340
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140008394
Capabilities:
Attach user process memory
Find process by pid
Map section object

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
xorps xmm0, xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
xor esi, esi
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140008411
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov rsi, rax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r14d, 1
mov r8d, r14d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rdx, [0x14000f3d0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x90], 0x30
and qword [rsp + 0x98], 0
mov dword [rsp + 0xa8], 0x40
lea rax, [rsp + 0x80]
mov qword [rsp + 0xa0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
lea r8, [rsp + 0x90]
mov edx, 0xf001f
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
test eax, eax
jne 0x140008566
mov qword [rsp + 0x70], rsi
mov ecx, 0x2000
mov qword [rsp + 0x68], rcx
and qword [rsp + 0x60], 0
mov dword [rsp + 0x48], 4
and dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rsp + 0x60]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jne 0x14000855b
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x14000855b
mov rdx, qword [rsp + 0x68]
cmp rdi, rdx
cmova rdi, rdx
test rdi, rdi
je 0x14000855b
sub rsi, qword [rsp + 0x70]
lea rax, [rsi + rdi]
cmp rax, rdx
ja 0x140008547
lea rdx, [rsi + r14]
mov r8, rdi
mov rcx, r15
call fcn.14000ec00
mov rdx, r14
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
jmp 0x14000855b
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14000856d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x1400085a6
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14000e340
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400085c8
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
and qword [rax + 8], 0
mov r15, r9
mov rdi, r8
mov r14, rdx
test rcx, rcx
je 0x140008695
lea rdx, [rax + 8]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x14000869a
mov rcx, qword [rsp + 0x60]
call fcn.140007dc4
mov rcx, qword [rsp + 0x60]
mov rbp, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor esi, esi
jmp 0x14000868c
lea rdx, [rsi + r14]
mov rcx, rbp
call fcn.1400088c8
test rax, rax
je 0x140008695
and qword [rsp + 0x30], 0
mov rcx, rax
and ecx, 0xfff
mov edx, 0x1000
sub rdx, rcx
mov r8, rdi
cmp rdx, rdi
lea rcx, [rsi + r15]
mov r9d, 1
cmovb r8, rdx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
mov ebx, eax
mov rax, qword [rsp + 0x30]
sub rdi, rax
add rsi, rax
test ebx, ebx
jne 0x140008691
test rax, rax
je 0x140008691
test rdi, rdi
jne 0x140008627
mov eax, ebx
jmp 0x14000869a
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140008838
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
lea rdx, [0x14000f470]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov edi, dword [rax + 3]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rbx, qword [rsp + 0x50]
add rbx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
xor ecx, ecx
test al, al
je 0x140008895
mov rcx, qword [rbx]
mov qword [0x140a1a9f8], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
add rcx, rdi
call fcn.140008800
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140008af0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov r8, rcx
and qword [rsp + 0x20], 0
lea rdi, [rsp + 0x28]
xor eax, eax
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140008b48
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008b94
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008b87
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.14000ec00
jmp 0x140008b87
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000e340
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140008bac
Capabilities:
Find process by pid
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15, r9
mov r14, r8
mov r13, rdx
mov rbx, rcx
and qword [rax - 0x60], 0
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rax - 0x48]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
jns 0x140008c11
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008c2c
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140008c33
mov al, 1
jmp 0x140008d0d
mov r8, r14
mov rdx, r15
mov rcx, rax
call fcn.14000ec00
jmp 0x140008c5d
mov r15, cr3
mov qword [rsp + 0x48], r15
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax + 0x28]
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov r12b, al
mov byte [rsp + 0x30], al
mov rcx, cr0
btr rcx, 0x10
mov cr0, rcx
cli
mov cr3, rbx
mov r8, r14
mov rdx, rdi
mov rcx, r13
call fcn.14000ec00
jmp 0x140008cb1
mov cr3, r15
mov rax, cr0
sti
bts rax, 0x10
mov cr0, rax
mov cl, r12b
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r8b, 1
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_PsTerminateSystemThread]
test esi, esi
js 0x140008d0a
and qword [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov al, sil
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140008d28
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
lea rax, [rdx - 0x10001]
xorps xmm0, xmm0
mov rsi, rcx
movabs rcx, 0x7ffffffefffe
mov r14, r9
mov rbp, r8
mov rdi, rdx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
cmp rax, rcx
ja 0x140008dbc
mov rdx, r8
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140008dbc
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.14000ec00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
jns 0x140008dd6
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000e340
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8, rbp
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_MmCreateMdl]
mov rdi, rax
test rax, rax
je 0x140008e44
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rsi, rax
test rax, rax
je 0x140008e36
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.14000ec00
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
xor esi, esi
jmp 0x140008e3b
mov esi, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, sil
jmp 0x140008dbe

Function at 0x140008ee4
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and qword [rax + 8], 0
mov r15, r9
mov rdi, r8
mov r14, rdx
test rcx, rcx
je 0x140008fa5
lea rdx, [rax + 8]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x140008faa
mov rcx, qword [rsp + 0x50]
call fcn.140007dc4
mov rcx, qword [rsp + 0x50]
mov rbp, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor esi, esi
jmp 0x140008f9c
lea rdx, [rsi + r14]
mov rcx, rbp
call fcn.1400088c8
test rax, rax
je 0x140008fa5
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov rcx, rax
mov edx, 0x1000
and ecx, 0xfff
mov r8, rdi
sub rdx, rcx
mov rcx, rax
cmp rdx, rdi
cmovb r8, rdx
lea rdx, [rsi + r15]
call fcn.140008e70
mov ebx, eax
mov rax, qword [rsp + 0x20]
sub rdi, rax
add rsi, rax
test ebx, ebx
jne 0x140008fa1
test rax, rax
je 0x140008fa1
test rdi, rdi
jne 0x140008f43
mov eax, ebx
jmp 0x140008faa
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140008fc4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov ecx, ecx
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400090af
mov edx, 8
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [rsp + 0x78], rax
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor ebx, ebx
mov dword [rsp + 0x60], ebx
movsxd rsi, ebx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000904e
mov edx, 0x1000
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov edx, 0xcc
mov r8d, 0x1000
mov rcx, rsi
call fcn.14000eb00
jmp 0x140009056
cmp ebx, 0x1000000
jg 0x14000905e
add ebx, 0x1000
jmp 0x140009006
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jne 0x1400090af
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x1400090b1
xor al, al
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000921c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0x88], rax
and dword [rsp + 0x40], 0
mov rdi, rdx
lea rdx, [rsp + 0x48]
mov rsi, r8
mov ebx, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400092ed
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rcx, [rsp + 0x50]
call fcn.140003e70
test al, al
je 0x1400092e2
mov rcx, qword [0x140a1aa00]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400092a3
lea rdx, [0x14000f4b0]
lea rcx, [rsp + 0x50]
call fcn.140003d64
mov qword [0x140a1aa00], rax
mov rcx, qword [0x140a1aa00]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400092e2
mov rax, qword [0x140a1aa00]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov r9, rsi
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x30
xor r8d, r8d
mov rdx, rdi
call qword [0x1400103b8]
mov ebx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14000e340
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000dc38
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rbx, rcx
mov dword [rsp + 0x28], 0x40
or rsi, 0xffffffffffffffff
mov dword [rbp - 0x19], 0x28ec8348
xor edi, edi
mov dword [rbp - 0x15], 0xb9
mov rcx, rsi
mov qword [rbp - 0x11], 0xba4800
lea r9, [rbp - 0x29]
mov dword [rbp - 9], 0x49000000
xor r8d, r8d
mov qword [rbp - 5], 0xb8
lea rdx, [rbp + 0x6f]
mov qword [rbp + 3], 0xb94900
mov dword [rbp + 0xb], 0x48000000
mov qword [rbp + 0xf], 0xb8
mov dword [rbp + 0x17], 0x48d0ff00
mov qword [rbp + 0x1b], 0xba
mov dword [rbp + 0x23], 0x7e02c700
mov dword [rbp + 0x27], 0x48c0371e
mov qword [rbp + 0x2b], 0xba
mov dword [rbp + 0x33], 0x2894800
mov dword [rbp + 0x37], 0x28c48348
mov qword [rbp + 0x6f], rdi
mov qword [rbp - 0x29], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000de10
mov rcx, qword [rbp + 0x6f]
lea r9, [rbp + 0x7f]
movaps xmm0, xmmword [rbp - 0x19]
lea rdx, [rbp + 0x77]
movaps xmm1, xmmword [rbp - 9]
xor r8d, r8d
mov eax, dword [rbp + 0x37]
movups xmmword [rcx], xmm0
mov dword [rsp + 0x28], 0x40
movaps xmm0, xmmword [rbp + 7]
movups xmmword [rcx + 0x10], xmm1
mov dword [rsp + 0x20], 0x1000
movaps xmm1, xmmword [rbp + 0x17]
movups xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [rbp + 0x27]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov dword [rcx + 0x50], eax
mov byte [rcx + 0x54], 0xc3
mov rcx, rsi
mov qword [rbp + 0x77], rdi
mov qword [rbp + 0x7f], 0x2090
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000ddf9
mov rcx, qword [rbp + 0x77]
lea rdx, [0x1400182f0]
mov r8d, 0x2090
call fcn.14000ec00
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x77]
mov qword [rcx + 0x5f8], rax
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x7f]
mov qword [rcx + 0x600], rax
mov rax, qword [rbp + 0x6f]
mov dword [rax + 5], edi
mov rax, qword [rbp + 0x6f]
mov qword [rax + 0xb], rbx
mov rax, qword [rbp + 0x6f]
mov dword [rax + 0x15], 1
mov rcx, qword [rbp + 0x6f]
lea rax, [rcx + 0x5f4]
mov qword [rcx + 0x1f], rax
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx + 0x5f8]
mov qword [rcx + 0x29], rax
mov rcx, qword [rbp + 0x6f]
lea rax, [rcx + 0x5f0]
mov qword [rcx + 0x35], rax
mov rcx, qword [rbp + 0x6f]
lea rax, [rcx + 0x5e8]
mov qword [rcx + 0x45], rax
mov rax, qword [rbp + 0x6f]
jmp 0x14000de12
mov r9d, 0x8000
lea r8, [rbp - 0x29]
lea rdx, [rbp + 0x6f]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
xor eax, eax
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000de28
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov dword [rsp + 0x28], 0x40
xor edi, edi
mov dword [rbp - 0x38], 0x68
or rsi, 0xffffffffffffffff
mov dword [rbp - 0x34], 0x6800
mov rcx, rsi
mov dword [rbp - 0x30], 0x680000
lea r9, [rbp - 0x40]
mov qword [rbp - 0x2c], 0x68000000
xor r8d, r8d
mov dword [rbp - 0x24], 0xe8
lea rdx, [rbp + 0x28]
mov dword [rbp - 0x20], 0x10c48300
mov dword [rbp - 0x1c], 0xba
mov dword [rbp - 0x18], 0x7e02c700
mov dword [rbp - 0x14], 0xbac0371e
mov dword [rbp - 0x10], edi
mov word [rbp - 0xc], 0x289
mov qword [rbp + 0x28], rdi
mov qword [rbp - 0x40], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000dfca
mov rcx, qword [rbp + 0x28]
lea r9, [rbp + 0x38]
movups xmm0, xmmword [rbp - 0x38]
mov eax, edi
mov dword [rsp + 0x28], 0x40
movups xmm1, xmmword [rbp - 0x28]
xor r8d, r8d
lea rdx, [rbp + 0x30]
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], 0x1000
movsd xmm0, qword [rbp - 0x18]
movups xmmword [rcx + 0x10], xmm1
movsd qword [rcx + 0x20], xmm0
mov dword [rcx + 0x28], eax
movzx eax, word [rbp - 0xc]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0xc3
mov rcx, rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 0x1780
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x14000dfb3
mov rcx, qword [rbp + 0x30]
lea rdx, [0x140016b70]
mov r8d, 0x1780
call fcn.14000ec00
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
mov qword [rcx + 0x5f8], rax
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
mov qword [rcx + 0x600], rax
mov rcx, qword [rbp + 0x28]
lea eax, [rcx + 0x5f4]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 0x28]
mov dword [rax + 6], 1
mov rax, qword [rbp + 0x28]
mov dword [rax + 0xb], ebx
mov rax, qword [rbp + 0x28]
mov dword [rax + 0x10], edi
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + 0x5f8]
sub eax, ecx
sub eax, 0x19
mov dword [rcx + 0x15], eax
mov rcx, qword [rbp + 0x28]
lea eax, [rcx + 0x5f0]
mov dword [rcx + 0x1d], eax
mov rcx, qword [rbp + 0x28]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x28], eax
mov rax, qword [rbp + 0x28]
jmp 0x14000dfcc
mov rdx, qword [rbp + 0x28]
lea r8, [rbp - 0x40]
mov r9d, 0x8000
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000dfdc
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x14001a380]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
xor edi, edi
lea rsi, [rbx + 0x14]
cmp rbx, rsi
jae 0x14000e049
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000e03d
cmp byte [rbx], 0x80
jne 0x14000e03d
lea rcx, [rbx + 5]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000e03d
cmp byte [rbx + 5], 0xc3
je 0x14000e042
inc rbx
jmp 0x14000e012
mov edi, dword [rbx + 1]
test edi, edi
jne 0x14000e08a
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.14000eb00
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
jne 0x14000e08a
cmp dword [rsp + 0x24], 6
jne 0x14000e085
cmp dword [rsp + 0x28], 1
mov edi, 0x1f6
je 0x14000e08a
mov edi, 0x232
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000e340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret