joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e70
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
xor eax, eax
xor ebx, ebx
mov rdx, rcx
mov dword [rbp + 0x27], ebx
lea rcx, [rbp + 7]
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
mov qword [rbp + 0x47], rax
mov qword [rbp + 0x4f], rax
mov qword [rbp + 0x77], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rax
mov word [rbp - 9], bx
mov qword [rbp - 7], rax
mov dword [rbp + 1], eax
mov word [rbp + 5], ax
mov word [rbp + 7], bx
mov qword [rbp + 9], rax
mov dword [rbp + 0x11], eax
mov word [rbp + 0x15], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [rsp + 0x50], ebx
lea rax, [rbp - 9]
mov qword [rsp + 0x48], rbx
lea r9, [rbp + 0x17]
mov dword [rsp + 0x40], 0x40
lea r8, [rbp + 0x27]
mov dword [rsp + 0x38], 3
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x27], 0x30
mov qword [rbp + 0x2f], rbx
mov dword [rbp + 0x3f], 0x40
mov qword [rbp + 0x37], rax
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x140001f6d
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
xor al, al
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x77]
xor r9d, r9d
mov qword [rbp + 0x6f], rbx
mov edx, 0x1f01ff
mov qword [rsp + 0x28], rbx
mov r8, qword [r8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x140001fc6
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret
mov rax, qword [rbp + 0x6f]
mov byte [rax + 0x4c], 1
mov rax, qword [rbp + 0x6f]
mov byte [rax + 0x49], bl
mov rax, qword [rbp + 0x6f]
mov rcx, qword [rax + 0x28]
mov qword [rcx], rbx
mov rax, qword [rbp + 0x6f]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], rbx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rbx, qword [rsp + 0xd0]
mov al, 1
add rsp, 0xc0
pop rbp
ret
Function at 0x1400030f0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x150
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x28]
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0x128
call fcn.140005e00
lea r9, [rsp + 0x170]
mov qword [rsp + 0x170], rbx
mov r8d, 0x130
lea rdx, [rsp + 0x20]
lea ecx, [rbx + 0xb]
lea rdi, [rsp + 0x20]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400031ae
mov rdx, qword [rsp + 0x170]
xor ecx, ecx
add rdx, 0x130
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8, qword [rsp + 0x170]
xor edx, edx
add r8, 0x130
mov rcx, rax
mov rdi, rax
call fcn.140005e00
mov r8d, dword [rsp + 0x170]
lea r9, [rsp + 0x170]
add r8d, 0x130
lea ecx, [rbx + 0xb]
mov rdx, rdi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x14000320e
mov rdx, rsi
lea rcx, [0x140006330]
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x140003234
mov rdx, rsi
lea rcx, [0x140006340]
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x140003234
cmp dword [rdi], ebx
jbe 0x140003203
nop dword [rax + rax]
mov eax, ebx
mov rdx, rsi
imul rcx, rax, 0x128
add rcx, 0x30
add rcx, rdi
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x14000321d
inc ebx
cmp ebx, dword [rdi]
jb 0x1400031e0
cmp qword [rsp + 0x170], 0
je 0x140003219
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x140003257
mov eax, ebx
imul rcx, rax, 0x128
mov eax, dword [rcx + rdi + 0x20]
mov dword [r14], eax
mov rbx, qword [rcx + rdi + 0x18]
jmp 0x14000323e
mov eax, dword [rdi + 0x20]
mov dword [r14], eax
mov rbx, qword [rdi + 0x18]
cmp qword [rsp + 0x170], 0
je 0x140003254
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400032e0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
test rdx, rdx
jne 0x1400032f6
xor eax, eax
add rsp, 0x50
pop rbx
ret
mov ecx, ecx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400032ee
xor eax, eax
mov qword [rsp + 0x60], rdi
mov edx, 0x200
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdx, rax
mov rdi, rax
sub rdx, rbx
nop dword [rax + rax]
movzx ecx, byte [rbx]
mov byte [rdx + rbx], cl
lea rbx, [rbx + 1]
test cl, cl
jne 0x140003350
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [0x14001823c]
lea eax, [rcx - 0x1db0]
cmp eax, 1
jbe 0x1400033ae
cmp ecx, 0x55f0
mov rcx, qword [rsp + 0x68]
jne 0x14000339d
mov rax, qword [rcx + 0x580]
test rax, rax
je 0x1400033cc
mov rax, qword [rax]
jmp 0x1400033ba
mov rax, qword [rcx + 0x428]
test rax, rax
je 0x1400033cc
mov rax, qword [rax]
jmp 0x1400033ba
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx + 0x320]
test rax, rax
je 0x1400033cc
mov rdx, rdi
mov rcx, rax
call fcn.140002cd0
jmp 0x1400033dd
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rcx, rax
mov rdx, rdi
call fcn.140002dc0
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdi, qword [rsp + 0x60]
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x140003410
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
lea rdx, [rsp + 0x40]
lea rcx, [0x140006330]
call fcn.1400030f0
mov r10, rax
test rax, rax
jne 0x140003432
add rsp, 0x38
ret
movsxd rcx, dword [rax + 0x3c]
lea rdx, [r10 + 0x18]
add rdx, rcx
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov r8d, ebx
movzx r9d, word [rcx + rax + 6]
movzx eax, word [rcx + rax + 0x14]
add rdx, rax
test r9d, r9d
je 0x14000351c
lea r11, [0x140006580]
nop word [rax + rax]
mov rax, rbx
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x14000350c
cmp rax, 5
jne 0x140003473
mov ecx, dword [rdx + 0xc]
mov r8d, dword [rdx + 0x10]
test ecx, ecx
je 0x14000351c
mov edx, dword [0x14001823c]
lea eax, [rdx - 0x1db0]
cmp eax, 1
jbe 0x140003540
cmp edx, 0x55f0
jne 0x140003528
xor eax, eax
mov word [rsp + 0x20], bx
lea rdx, [0x140006b50]
mov qword [rsp + 0x22], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r8d, 0x100
lea rdx, [0x140006b80]
lea rcx, [rax - 0x100]
call fcn.140003970
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
add rdx, 0x28
inc r8d
cmp r8d, r9d
jb 0x140003470
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
add rcx, r10
lea rdx, [0x140006bb0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.140003970
add rcx, r10
lea rdx, [0x140006b10]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.140003970

Function at 0x140003560
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x30]
lea rcx, [0x140006330]
call fcn.1400030f0
mov r10, rax
test rax, rax
je 0x14000360a
movsxd rcx, dword [rax + 0x3c]
lea rdx, [r10 + 0x18]
add rdx, rcx
xor r8d, r8d
movzx r9d, word [rcx + rax + 6]
movzx eax, word [rcx + rax + 0x14]
add rdx, rax
test r9d, r9d
je 0x14000360a
lea r11, [0x140006580]
nop dword [rax]
xor eax, eax
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x1400035fe
cmp rax, 5
jne 0x1400035b2
mov ecx, dword [rdx + 0xc]
mov r8d, dword [rdx + 0x10]
test ecx, ecx
je 0x14000360a
mov eax, dword [0x14001823c]
add rcx, r10
add eax, 0xffffe250
cmp eax, 1
jbe 0x140003611
lea rdx, [0x1400069c0]
call fcn.140003970
test rax, rax
je 0x14000360a
add rax, 0xffffffffffffffeb
add rsp, 0x28
ret
add rdx, 0x28
inc r8d
cmp r8d, r9d
jb 0x1400035b0
xor eax, eax
add rsp, 0x28
ret
lea rdx, [0x140006860]
jmp 0x1400035eb
Function at 0x1400037a0
Capabilities:
Allocate or change rwx memory
Attach user process memory
Execute shellcode via indirect call
Find process by pid

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
xor eax, eax
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0xf], rax
xor r12d, r12d
mov dword [rbp - 7], eax
lea rdx, [0x140006720]
mov qword [rbp - 0x21], r12
lea rcx, [rbp - 0x11]
mov word [rbp - 0x11], r12w
mov word [rbp - 3], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r8d, 0x200
lea rdx, [0x140006750]
lea rcx, [rax + 0x10]
call fcn.140003970
mov rsi, rax
test rax, rax
jne 0x14000381b
add rsp, 0x90
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0xc0], rbx
mov rax, r12
mov qword [rsp + 0xc8], r15
mov rbx, r12
lea r15, [0x140000000]
nop dword [rax + rax]
cmp qword [r15 + rax*8 + 0x8020], rbx
je 0x140003857
inc rax
cmp rax, 0x1000
jb 0x140003840
jmp 0x140003862
mov rbx, rax
mov qword [r15 + rax*8 + 0x10020], r12
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x29], r12
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400038e4
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 1]
xor eax, eax
mov qword [rbp + 0x7f], r14
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x77], r12
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r9, [rbp + 0x7f]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0x77]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jns 0x1400038e8
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000394c
mov r8, qword [rbp + 0x7f]
xor edx, edx
mov rcx, qword [rbp + 0x77]
call fcn.140005e00
mov rax, qword [rbp + 0x77]
lea r8, [rbp + 0x7f]
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
lea rax, [rbp - 0x21]
mov r9d, 0x20
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call rsi
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rbp + 0x77]
mov rcx, qword [rbp - 0x29]
mov qword [r15 + rbx*8 + 0x8020], rax
mov rax, qword [rbp + 0x7f]
mov qword [r15 + rbx*8 + 0x10020], rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rbp + 0x77]
mov rbx, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xc8]
add rsp, 0x90
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003b30
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov r14, rdx
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rbp, r9
mov rdi, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140003b76
xor eax, eax
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov qword [rsp + 0x70], rbx
or rbx, 0xffffffffffffffff
mov rdx, rbx
mov qword [rsp + 0x78], rsi
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140003b87
add rdx, 0x100
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x140003bb9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x140003c5c
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140003bc0
add r8, 0x100
xor edx, edx
mov rcx, rsi
call fcn.140005e00
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140003be0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140005f00
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140003970
lea rcx, [rsp + 0x28]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsi, qword [rsp + 0x78]
mov rsp, r11
pop r14
ret
Function at 0x140003c80
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rsi
sub rsp, 0x60
xor eax, eax
lea rsi, [0x140000000]
nop
cmp qword [rsi + rax*8 + 0x8020], rdx
je 0x140003cad
inc rax
cmp rax, 0x1000
jb 0x140003c90
xor al, al
add rsp, 0x60
pop rsi
ret
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x78], rdi
lea rdi, [rax*8]
mov rax, qword [rdi + rsi + 0x10020]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140003d66
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x28]
xor eax, eax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9d, 0x8000
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x20]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
lea rcx, [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x80]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
jns 0x140003d73
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor al, al
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret
mov qword [rdi + rsi + 0x8020], 0
mov qword [rdi + rsi + 0x10020], 0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdi, qword [rsp + 0x78]
mov al, 1
add rsp, 0x60
pop rsi
ret
Function at 0x140003ee0
Capabilities:
Find process by pid

Disassembly:
push rsi
push r12
push r14
sub rsp, 0x60
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov r14, r9
mov r12, r8
mov rsi, rdx
mov r10, qword [rax]
cmp rdx, r10
jae 0x140004038
lea rax, [rdx + r9]
cmp rax, r10
ja 0x140004038
mov qword [rsp + 0x90], rbp
lea rdx, [0x140000000]
mov qword [rsp + 0x58], rdi
mov bpl, 1
xor edi, edi
mov eax, edi
nop
cmp qword [rdx + rax*8 + 0x180d0], rcx
je 0x140003f48
inc rax
cmp rax, 0x14
jb 0x140003f30
mov rax, rdi
jmp 0x140003f50
mov rax, qword [rdx + rax*8 + 0x18170]
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x140003f8b
lea rdx, [rsp + 0x88]
xor bpl, bpl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140003f8b
xor al, al
mov rbp, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
add rsp, 0x60
pop r14
pop r12
pop rsi
ret
mov qword [rsp + 0x80], rbx
mov rbx, qword gs:[0x188]
mov qword [rsp + 0x50], r15
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov ecx, dword [0x14001823c]
mov edx, 0x210
add ecx, 0xffffe250
mov r15, rax
cmp ecx, 1
mov eax, 0x220
mov rcx, qword [rsp + 0x88]
cmova edx, eax
add rbx, rdx
mov qword [rbx], rcx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x88]
mov r9, r12
mov r8, rax
mov rdx, rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov esi, eax
test bpl, bpl
jne 0x14000401e
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rbx], r15
test esi, esi
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
setns al
jmp 0x140003f74
xor al, al
add rsp, 0x60
pop r14
pop r12
pop rsi
ret
Function at 0x140004050
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rsi
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov r14, rdx
mov rsi, r9
mov r13, r8
mov rdx, qword [rax]
cmp r14, rdx
jae 0x140004227
lea r15, [r14 + r9]
cmp r15, rdx
ja 0x140004227
xor r9d, r9d
mov qword [rsp + 0xc0], rbp
mov eax, r9d
lea rdx, [0x140000000]
mov bpl, 1
cmp qword [rdx + rax*8 + 0x180d0], rcx
je 0x1400040b5
inc rax
cmp rax, 0x14
jb 0x1400040a0
jmp 0x1400040bd
mov r9, qword [rdx + rax*8 + 0x18170]
mov qword [rsp + 0xb8], r9
test r9, r9
jne 0x1400040e3
lea rdx, [rsp + 0xb8]
xor bpl, bpl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400040e3
xor al, al
jmp 0x14000411b
mov rdx, rsi
mov qword [rsp + 0xc8], rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
jne 0x140004132
test bpl, bpl
jne 0x140004111
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor al, al
mov rdi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
add rsp, 0x88
pop r15
pop r14
pop r13
pop rsi
ret
mov qword [rsp + 0xb0], rbx
mov rbx, qword gs:[0x188]
mov qword [rsp + 0x80], r12
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov ecx, dword [0x14001823c]
mov edx, 0x210
add ecx, 0xffffe250
mov r12, rax
cmp ecx, 1
mov eax, 0x220
mov rcx, qword [rsp + 0xb8]
mov r8, rsi
cmova edx, eax
add rbx, rdx
xor edx, edx
mov qword [rbx], rcx
mov rcx, rdi
call fcn.140005e00
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x58]
call fcn.140005e00
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400041d6
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400041d6
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140005f00
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, r13
call fcn.140005f00
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test bpl, bpl
jne 0x14000420d
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rbx], r12
mov al, 1
mov r12, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xb0]
jmp 0x140004113
xor al, al
add rsp, 0x88
pop r15
pop r14
pop r13
pop rsi
ret
Function at 0x140004240
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x90
mov rax, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rsi, rdx
mov rbx, r9
mov rbp, r8
mov rdx, qword [rax]
cmp rsi, rdx
jae 0x1400043d9
lea rax, [rsi + r9]
cmp rax, rdx
ja 0x1400043d9
mov qword [rsp + 0xc0], r14
lea rdx, [rsp + 0x20]
xor r14d, r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140004297
xor al, al
jmp 0x1400042c7
mov rdx, rbx
mov qword [rsp + 0xb0], rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
jne 0x1400042da
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor al, al
mov rdi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
add rsp, 0x90
pop rsi
pop rbp
pop rbx
ret
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.140005e00
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x58]
call fcn.140005e00
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor eax, eax
mov byte [rsp + 0xb8], r14b
lea r9, [rsp + 0xb8]
mov word [rsp + 0xb9], ax
mov r8, rbx
mov qword [rsp + 0x28], r14
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140003e50
mov rcx, rax
mov r14, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140004362
lea rcx, [r14 + rbx]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140004362
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140005f00
cmp byte [rsp + 0xba], 0
mov rsi, qword [rsp + 0x28]
je 0x14000437d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
cmp byte [rsp + 0xb9], 0
je 0x140004390
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
cmp byte [rsp + 0xb8], 0
je 0x1400043a3
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.140005f00
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
jmp 0x1400042bf
xor al, al
add rsp, 0x90
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400047a0
Capabilities:
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, [rsp + 0x48]
mov rcx, qword [rcx]
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xor sil, sil
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400048bd
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x1400048b2
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400048a9
mov qword [rsp + 0x50], rbp
mov rcx, rbx
mov qword [rsp + 0x58], r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000489a
mov eax, dword [0x14001823c]
add eax, 0xffffe250
cmp eax, 1
jbe 0x140004829
mov rax, qword [rbx + 0xb8]
jmp 0x14000482d
mov rax, qword [rbx + 0x70]
test rax, rax
je 0x14000489a
cmp rax, qword [rsp + 0x48]
jne 0x14000489a
call fcn.140003560
mov rbp, rax
call fcn.140003410
mov rbx, rax
test rbp, rbp
je 0x14000489a
test rax, rax
je 0x14000489a
mov rcx, qword [rsp + 0x48]
call fcn.140005ab0
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov r14, rax
call rbp
test eax, eax
js 0x14000489a
mov r8, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
test r14, r14
je 0x140004886
call fcn.1400048d0
jmp 0x14000488b
call fcn.140004b80
mov rcx, qword [rsp + 0x40]
xor edx, edx
call rbx
test eax, eax
setns sil
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movzx eax, sil
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400052a0
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
xor eax, eax
lea rdx, [r11 - 0x38]
xor edi, edi
mov qword [r11 - 0x38], rax
mov qword [r11 + 0x10], rdi
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x28], rax
xor edx, edx
mov r9d, 0x240
mov dword [rsp + 0x20], edi
mov r8d, 0x1fffff
or rcx, 0xffffffffffffffff
call fcn.140005160
test eax, eax
js 0x14000535f
mov r8, qword [sym.imp.ntoskrnl.exe_PsThreadType]
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov edx, 0x1fffff
mov qword [rsp + 0x70], rbx
mov r8, qword [r8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_NtClose]
mov rcx, qword [rsp + 0x78]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
cmovs rcx, rdi
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret