joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22fbe
Capabilities:
Complete processing asynchronous io request

Disassembly:
lea ebx, [esi - 0x58]
mov eax, dword [ebx + 0x60]
cmp dword [eax + 8], 0xc
mov dword [ebp - 0x18], eax
jae 0x30177
xor edi, edi
test edi, edi
jne 0x3017f
mov eax, dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebx + 0x58]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
xor ecx, ecx
lea edx, [ebx + 0x38]
xchg dword [edx], ecx
test ecx, ecx
je 0x301bc
mov ecx, dword [ebp - 0x18]
push 0x20
pop edx
cmp dword [ecx + 4], edx
jae 0x301c5
and dword [ebx + 0x1c], 0
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x2300b
jmp 0x229b5
cmp byte [ebp - 1], 0
jne 0x301d8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [eax + 4], edx
and dword [ecx - 0x40], 0
add ecx, 0xffffffa8
mov dl, 2
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [ebp - 0x20]
cmp dword [ebp - 0x20], eax
je 0x23023
jmp 0x2298a
mov esi, dword [ebp - 8]
jmp 0x22911
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], 0
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
cmp al, 2
jae 0x30133
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 0xc], al
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
cmp esi, eax
jne 0x22911
mov dl, byte [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
lea eax, [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x22980
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x78694354
push 0x48
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x23023
mov eax, dword [ebp + 0xc]
push 8
pop ecx
lea edi, [ebx + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp + 0x10]
push 0x4032c
push ebx
mov dword [ebx + 0x44], eax
call sub.TDI.SYS_CTEInitEvent
push ebx
push ebx
call sub.TDI.SYS_CTEScheduleDelayedEvent
jmp 0x23023
mov edi, dword [ebx + 0xc]
jmp 0x22926
cmp dword [edi], 1
jne 0x3019e
lea ecx, [ebp - 0x20]
push ecx
push dword [eax + 0x18]
call fcn.00040357
test al, al
je 0x3019e
mov eax, dword [esi]
mov dword [ebp - 8], eax
jmp 0x22972
mov eax, dword [edi + 4]
test eax, eax
je 0x2292e
mov ecx, dword [ebp - 0x10]
and eax, dword [ebp - 0x10]
and ecx, dword [ebp - 0x14]
cmp eax, ecx
je 0x2292e
jmp 0x30194
mov byte [ebp - 1], 1
jmp 0x2294f
mov esi, dword [ebp + 8]
mov edi, dword [ebx + 0xc]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x1c], edx
jmp 0x22962
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
jmp 0x2298a
Function at 0x23cb9
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
xor edi, edi
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov eax, dword [0x505f0]
mov ecx, 0x505f0
cmp eax, ecx
je 0x23cff
mov edx, dword [ebp + 8]
cmp dword [eax + 0x10], edx
jne 0x37db2
mov esi, dword [eax + 8]
mov edi, eax
xor ecx, ecx
lea edx, [esi + 0x38]
xchg dword [edx], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
test edi, edi
push 0
je 0x37db9
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push dword [ebp + 0xc]
and dword [esi + 0x1c], 0
call fcn.000233ee
push 0
push dword [ebp + 8]
mov dword [esi + 0x18], eax
call edi
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
leave
ret 8
mov eax, dword [eax]
jmp 0x23cd9
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x23d3b

Function at 0x24d26
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0x103
cmp dword [eax + 4], 0x14
jb 0x37e21
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
cmp byte [esi + 0x24], 0
jne 0x37e2b
cmp dword [0x505e8], edi
jne 0x37e35
mov eax, 0x47fb7
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
mov dword [0x505e8], esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
test edi, edi
jne 0x24da4
push dword [ebp + 0xc]
push esi
call fcn.00024e52
mov edi, eax
cmp edi, 0xc0000120
je 0x37e3f
cmp edi, 0x103
je 0x24db9
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, 0x103
pop esi
pop ebp
ret 8
mov edi, 0xc000000d
jmp 0x24dac
mov edi, 0xc0000120
jmp 0x24d80
mov edi, 0x80000011
jmp 0x24d80
mov edi, 0x103
jmp 0x24da4
Function at 0x252e7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x4f984]
and dword [ebp - 0x12c], 0
push esi
push edi
push 0x2b
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x134]
mov esi, 0x25380
lea edi, [ebp - 0x124]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0005a476
test eax, eax
jl 0x25372
mov edi, 0x4fc00
push ebx
lea eax, [ebp - 0x190]
push eax
push 0x72
lea eax, [ebp - 0x78]
push eax
xor esi, esi
push esi
push dword [ebp - 0x12c]
push dword [ebp - 0x134]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, esi
jge 0x35ab7
cmp eax, 0x80000005
je 0x35c29
push dword [ebp - 0x134]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.00010eee
leave
ret 0xc
cmp dword [ebp - 0x74], 1
jne 0x35c29
mov eax, dword [ebp - 0x70]
shr eax, 1
mov word [ebp + eax*2 - 0x6c], si
add dword [ebp - 0x70], 2
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
push dword [ebp + 8]
push eax
call fcn.0005b7cc
mov ebx, eax
cmp ebx, 2
je 0x35c29
mov eax, dword [ebp - 0x144]
bswap eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x140]
bswap eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x130]
bswap eax
mov ecx, edi
mov dword [ebp - 0x160], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov edx, dword [ebp - 0x178]
mov byte [ebp - 0x125], al
lea eax, [ebp - 0x138]
push eax
mov eax, dword [0x51438]
mov ecx, dword [eax + 4]
push 1
push esi
push dword [ebp - 0x160]
push dword [ebp - 0x150]
call fcn.00023b23
mov dl, byte [ebp - 0x125]
mov esi, eax
neg esi
sbb esi, esi
not esi
and esi, dword [ebp - 0x138]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
test esi, esi
jne 0x35c29
mov eax, dword [ebp - 0x130]
bswap eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x174], eax
or eax, 0xffffffff
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x14c], eax
push 0x34
lea eax, [ebp - 0x178]
push eax
xor ecx, ecx
lea eax, [ebp - 0x18c]
push eax
mov dword [ebp - 0x18c], 0x301
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], 0x200
mov dword [ebp - 0x180], 0x100
mov dword [ebp - 0x17c], 0x101
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], 3
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x148], ecx
call fcn.00023d65
inc dword [ebp - 0x12c]
je 0x25365
jmp 0x25330
Function at 0x25858
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
push 0x10
push 0x6b494354
push 0x14
push 0
call edi
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
je 0x37dc7
push 0x10
push 0x6c494354
push 0xc
push 0
call edi
mov ecx, eax
test ecx, ecx
mov dword [ebp + 8], ecx
je 0x37dce
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0x60]
or byte [eax + 3], 1
push esi
push ebx
call fcn.0002556b
test al, al
jne 0x37df4
mov ebx, dword [ebx + 0xc]
xor eax, eax
cmp dword [edi + 8], 0xc
jb 0x2590d
cmp dword [edi + 0xc], 0x1280a0
je 0x37ddd
push eax
movzx eax, word [ebx]
push fcn.00023cb9
push dword [ebp + 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
call fcn.00025919
cmp eax, 0x2bf7
jne 0x37de6
pop edi
pop esi
mov eax, 0x103
pop ebx
pop ebp
ret 8
mov eax, 0x2b2a
jmp 0x258f6
mov edi, 0xc000009a
jmp 0x37e0b
push eax
push esi
mov edi, 0xc000009a
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x37e0b
mov ax, word [ebx + 0xc]
jmp 0x258de
push eax
push dword [ebp + 8]
call fcn.00023cb9
jmp 0x25901
push 0
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, 0xc0000120
call esi
push 0
push dword [ebp + 8]
call esi
and dword [ebx + 0x1c], 0
mov dl, 2
mov ecx, ebx
mov dword [ebx + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x25901
Function at 0x27300
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x27411
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x2d23f
test eax, eax
jne 0x2d23f
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x27350
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
jne 0x2d23c
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
je 0x27411
jmp 0x2d23f

Function at 0x28024
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x10
pop ecx
lea edi, [eax + 0x10]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x4c], 0
pop edi
mov dword [eax + 0x48], 0x1c0
pop esi
pop ebp
ret 8
Function at 0x28089
Capabilities:
Complete processing asynchronous io request

Disassembly:
push 0x14
pop esi
xor ebx, ebx
cmp edi, esi
jb 0x2807d
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [edx], esi
mov eax, esi
jmp 0x280c0
push 4
mov dword [edx], esi
pop eax
jmp 0x280c0
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, dword [0x51720]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
je 0x280b9
mov eax, dword [ecx + 0x60]
mov edi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
movzx eax, byte [eax + 1]
sub eax, 8
je 0x28065
dec eax
dec eax
je 0x3a36f
mov ebx, 0xc0000010
xor eax, eax
mov dl, 2
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
cmp edi, 4
jae 0x3a37e
mov ebx, 0xc0000023
jmp 0x280be
mov eax, dword [edx]
mov dword [0x54984], eax
xor ebx, ebx
jmp 0x280be
Function at 0x29721
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
and dword [edi + 0x1c], 0
cmp dword [eax + 8], 4
mov ebx, dword [edi + 0xc]
jb 0x3a325
mov si, word [ebx]
mov ax, word [ebx + 2]
cmp si, ax
jb 0x3a325
cmp ax, 0x401
mov edx, dword [0x59ba4]
jb 0x29768
movzx ecx, si
cmp ecx, edx
jbe 0x29780
mov ecx, 0xc000
cmp ax, cx
jb 0x3a29e
cmp si, 0xfffe
ja 0x3a29e
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], 0x12801c
jne 0x297fc
push 0x10
push 0x74504354
push 8
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
mov esi, eax
test esi, esi
je 0x297f3
mov ax, word [ebx]
mov word [esi + 4], ax
mov ax, word [ebx + 2]
mov edi, 0x50200
mov ecx, edi
mov word [esi + 6], ax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [0x5007c]
mov dword [esi], ecx
mov dword [0x5007c], esi
mov dl, al
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov dword [edi + 0x18], esi
mov dl, 2
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov dword [ebp - 4], 0xc000009a
jmp 0x297da
cmp dword [0x5007c], 0
jne 0x3a2b4
jmp 0x297da
cmp edx, ecx
jb 0x3a319
cmp ax, 0x401
jb 0x3a319
cmp si, 0xfffe
jbe 0x29780
jmp 0x3a319
mov edi, 0x50200
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [0x5007c]
mov byte [ebp + 0xf], al
mov eax, ecx
mov edx, eax
mov dword [ebp - 4], 0xc000000d
jmp 0x3a2ee
mov si, word [ebx + 2]
cmp si, word [eax + 6]
ja 0x3a2ea
mov si, word [ebx]
cmp si, word [eax + 4]
jae 0x3a2f4
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x3a311
jmp 0x3a2d7
push 0
cmp edx, ecx
mov ecx, dword [eax]
push eax
jne 0x3a305
mov dword [0x5007c], ecx
jmp 0x3a307
mov dword [edx], ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [ebp - 4], 0
mov dl, byte [ebp + 0xf]
jmp 0x297cf
mov dword [ebp - 4], 0xc000000d
jmp 0x297da
mov eax, 0xc000000d
mov dword [edi + 0x18], eax
mov esi, eax
jmp 0x297e0

Function at 0x29810
Capabilities:
Install driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
mov edi, dword [ebp + 8]
push 0x11
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 0x298ba
lea eax, [ebp - 0x1c]
push eax
call esi
push 0x2992a
lea eax, [ebp - 0x14]
push eax
call esi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
xor esi, esi
push esi
push esi
push esi
push 3
push esi
push 0x80
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x34]
push eax
mov ebx, 0xc0000000
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
jne 0x3e0e3
Function at 0x2b39f
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov cx, word [ebp + 0x28]
mov word [eax], cx
mov cx, 0x800
mov dh, cl
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
test esi, esi
push edi
mov dl, ch
mov word [eax + 2], dx
mov cl, byte [ebx + 0x6b]
mov byte [eax + 4], cl
mov cx, word [ebp + 0x14]
mov byte [eax + 5], 4
mov word [eax + 6], cx
lea edx, [eax + 8]
jne 0x2b3df
lea esi, [ebx + 0x64]
movzx ecx, byte [ebx + 0x6b]
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, byte [ebx + 0x6b]
mov esi, dword [ebp + 0x18]
add edx, eax
mov eax, dword [ebp + 0x24]
mov dword [edx], eax
movzx ecx, byte [ebx + 0x6b]
add edx, 4
test esi, esi
mov edi, edx
je 0x2b9e5
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0x2c], 0
movzx eax, byte [ebx + 0x6b]
mov ecx, dword [ebp + 0x20]
mov dword [eax + edx], ecx
je 0x2b43a
cmp byte [ebx + 0x6a], 0
jne 0x2d5e1
movzx eax, byte fs:[0x51]
push dword [ebp + 0xc]
shl eax, 6
mov esi, eax
mov eax, dword [ebx + 0x60]
add eax, esi
inc dword [eax]
mov eax, dword [ebx + 0x10]
push dword [eax + 4]
call dword [eax + 0x30]
mov edi, eax
cmp edi, 0x103
jne 0x2d5e8
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x28
mov esi, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x2b420
mov edi, 0xc0010011
jmp 0x2d614
mov eax, dword [ebx + 0x60]
add eax, esi
dec dword [eax]
test edi, edi
jne 0x2d5fe
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
add dword [ebx + 0x54], eax
jmp 0x2d614
cmp edi, 0xc000009a
jne 0x2d60e
inc dword [ebx + 0x11c]
jmp 0x2d614
inc dword [ebx + 0x120]
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.NDIS.SYS_NdisUnchainBufferAtFront]
push dword [ebp + 0x28]
call fcn.00013960
push dword [ebp + 0xc]
call dword [sym.imp.NDIS.SYS_NdisFreePacket]
jmp 0x2b468

Function at 0x2bef2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
and dword [ecx + 0x1c], 0
mov dl, 2
mov dword [ecx + 0x18], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop ebp
ret 0xc
Function at 0x2c9ff
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [edi]
lea ecx, [edi + 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], fcn.000148bc
mov dword [ebp - 0xc], esi
mov dword [ebp + 8], ecx
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
lea ebx, [esi + 0x38]
mov ecx, 0x20a3a
xchg dword [ebx], ecx
cmp byte [esi + 0x24], 0
mov dl, al
jne 0x3a203
mov ecx, dword [esi + 0x60]
or byte [ecx + 3], 1
mov ecx, dword [ebp + 8]
inc dword [edi + 4]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
push dword [esi + 4]
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
add eax, 4
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0002c894
mov ecx, 0x103
cmp eax, ecx
jne 0x3a1ee
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [ebp + 0xc]
and byte [ecx + 3], 0xfe
push 0
push eax
push esi
call fcn.000148bc
jmp 0x2ca80
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
call edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov ecx, dword [ebp + 8]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
xor ecx, ecx
xchg dword [ebx], ecx
mov ecx, dword [ebp + 8]
and dword [esi + 0x1c], 0
mov ebx, 0xc0000120
mov dl, al
mov dword [esi + 0x18], ebx
call edi
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x2ca80
Function at 0x40385
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push esi
call dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
jmp 0x403b0
lea esi, [eax - 0x58]
mov edx, dword [esi + 0x40]
cmp edx, dword [ebp + 8]
jne 0x403ae
mov edx, dword [esi + 0x34]
cmp edx, dword [ebp + 0xc]
je 0x403c4
mov eax, dword [eax]
cmp eax, ecx
jne 0x4039b
mov ecx, dword [ebp + 0x14]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
xor al, al
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ecx], eax
mov dword [eax + 4], ecx
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
mov ecx, dword [ebp + 0x14]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
push 2
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
and dword [esi + 0x1c], 0
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], 0xc0000120
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov al, 1
jmp 0x403bf
Function at 0x425c6
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
cmp dword [ecx + 8], 4
push ebx
mov ebx, dword [ecx + 4]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
jae 0x425f6
mov eax, 0xc000000d
mov dword [edi + 0x18], eax
mov esi, eax
jmp 0x42710
mov eax, dword [eax]
mov ecx, 0x4fc00
mov dword [ebp + 8], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
movzx ecx, byte [ebp + 0xa]
movzx edx, byte [ebp + 0xb]
add edx, ecx
mov ecx, dword [ebp + 8]
movzx esi, ch
add edx, esi
movzx esi, cl
add edx, esi
mov esi, dword [0x51c34]
dec esi
and edx, esi
mov esi, dword [0x51c38]
mov esi, dword [esi + edx*4]
jmp 0x4263e
test byte [esi + 0x14], 1
je 0x4263c
cmp dword [esi + 4], ecx
je 0x42642
mov esi, dword [esi]
test esi, esi
jne 0x42631
mov dl, al
mov ecx, 0x4fc00
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
test esi, esi
je 0x42703
lea ecx, [esi + 0x20]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
test byte [esi + 0x14], 1
mov byte [ebp + 0xf], al
je 0x426f5
mov eax, dword [ebp + 8]
cmp dword [esi + 4], eax
jne 0x426f5
push 4
pop eax
cmp ebx, eax
jae 0x4268c
and dword [edi + 0x1c], 0
mov dword [ebp - 4], 0xc0000023
jmp 0x426f5
jne 0x426a9
mov ecx, dword [esi + 0xb8]
mov edx, dword [edi + 0xc]
lea ecx, [ecx*4 + 8]
mov dword [edx], ecx
mov dword [ebp - 4], 0x80000005
jmp 0x426f2
mov esi, dword [esi + 0xa4]
mov eax, dword [edi + 0xc]
xor edx, edx
shr ebx, 2
cmp esi, edx
mov dword [ebp - 8], ebx
je 0x426ed
mov dword [ebp + 8], edx
mov ecx, dword [ebp + 8]
mov ecx, dword [esi + ecx*4]
jmp 0x426d7
cmp edx, dword [ebp - 8]
jae 0x426e6
mov ebx, dword [ecx + 8]
mov dword [eax + edx*4], ebx
mov ecx, dword [ecx]
inc edx
test ecx, ecx
jne 0x426c9
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x20
jae 0x426ed
jmp 0x426c1
mov dword [ebp - 4], 0x80000005
mov eax, edx
shl eax, 2
mov dword [edi + 0x1c], eax
mov dl, byte [ebp + 0xf]
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
jmp 0x4270a
mov dword [ebp - 4], 0xc000000d
mov esi, dword [ebp - 4]
mov dword [edi + 0x18], esi
mov dl, 2
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8