joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1089e
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
push edi
mov edi, dword [eax + 4]
je 0x108e4
cmp dword [eax + 8], 0x11
jb 0x108e4
cmp edi, 0x11
jb 0x108e4
push ecx
call fcn.00016fa2
test eax, eax
mov dword [esi + 0x18], eax
jl 0x108e4
mov dword [esi + 0x1c], edi
xor edi, edi
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
and dword [esi + 0x1c], 0
mov eax, 0xc0000001
mov dword [esi + 0x18], eax
mov edi, eax
jmp 0x108d2

Function at 0x108fa
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x60]
movzx edx, byte [eax]
sub edx, 0
je 0x10970
dec edx
dec edx
je 0x10967
dec edx
je 0x1095e
dec edx
je 0x10955
sub edx, 0xa
jne 0x1092f
mov edx, dword [eax + 0xc]
cmp edx, 0x12c800
je 0x1094c
cmp edx, 0x220194
je 0x10943
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x10977
push eax
push ecx
call fcn.0001089e
jmp 0x10977
push eax
push ecx
call fcn.000176b8
jmp 0x10977
push eax
push ecx
call fcn.00018856
jmp 0x10977
push eax
push ecx
call fcn.000181f6
jmp 0x10977
push eax
push ecx
call fcn.00018164
jmp 0x10977
push eax
push ecx
call fcn.000171b6
pop ebp
ret 8

Function at 0x10b72
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0xc]
mov dword [ebp + 0xc], eax
mov byte [ebp + 0xb], 0
call fcn.0001740a
test al, al
je 0x10c48
test ebx, ebx
je 0x10c48
cmp dword [ebp + 0xc], 0x1c
jb 0x10c48
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp + 0xf], al
mov eax, dword [esi + 0x18]
cdq
push edx
push eax
push dword [0x1a81c]
call fcn.000104f2
test eax, eax
je 0x10c1e
mov ebx, dword [ebx + 0x10]
dec ebx
je 0x10c11
dec ebx
je 0x10c08
dec ebx
je 0x10bff
dec ebx
je 0x10bf6
dec ebx
je 0x10bed
dec ebx
jne 0x10c1e
test byte [eax + 0x13c], 0x20
jmp 0x10c18
test byte [eax + 0x13c], 0x10
jmp 0x10c18
test byte [eax + 0x13c], 8
jmp 0x10c18
test byte [eax + 0x13c], 4
jmp 0x10c18
test byte [eax + 0x13c], 2
jmp 0x10c18
test byte [eax + 0x13c], 1
je 0x10c1e
mov byte [ebp + 0xb], 1
mov dl, byte [ebp + 0xf]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
cmp byte [ebp + 0xb], 0
je 0x10c48
and dword [edi + 0x1c], 0
and dword [edi + 0x18], 0
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x10c5a
mov ecx, dword [ebp + 0x10]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10c66
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0x60]
movzx eax, byte [esi]
sub eax, 0
je 0x10dad
sub eax, 0xe
je 0x10c9f
dec eax
je 0x10ce0
sub eax, 3
jne 0x10d99
push dword [ebp + 0x10]
push esi
push edi
call fcn.00010ad8
jmp 0x10db7
push esi
push edi
push dword [ebp + 8]
call sub.TDI.SYS_TdiMapUserRequest
test eax, eax
jge 0x10ce0
cmp dword [esi + 0xc], 0x210203
jne 0x10d99
mov esi, dword [esi + 0x10]
test esi, esi
je 0x10d99
mov dword [esi], 0x10b24
and dword [edi + 0x18], 0
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x10db7
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x10]
cmp eax, 2
jne 0x10d82
movzx eax, byte [esi + 1]
cmp eax, 6
jg 0x10d4f
je 0x10d43
dec eax
je 0x10d37
dec eax
je 0x10d28
dec eax
je 0x10d19
dec eax
jne 0x10d99
push dword [ebp + 0x10]
push esi
push edi
call fcn.00012986
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.000120da
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.00012552
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.00012464
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.00012770
jmp 0x10db7
sub eax, 7
je 0x10d76
dec eax
je 0x10d6a
sub eax, 0x127ffc
jne 0x10d99
push dword [ebp + 0x10]
push esi
push edi
call fcn.00010b72
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.000142e2
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.00014466
jmp 0x10db7
cmp eax, 1
jne 0x10d99
cmp byte [esi + 1], 0xb
jne 0x10d99
push dword [ebp + 0x10]
push esi
push edi
call fcn.0001164c
jmp 0x10db7
mov ecx, dword [ebp + 0x10]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x10db7
push dword [ebp + 0x10]
push esi
push edi
call fcn.00010a62
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1164c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x1a810
call ebx
mov byte [ebp + 0xf], al
mov eax, dword [edi + 0x18]
cdq
push edx
push eax
push dword [0x1a838]
call fcn.000104f2
test eax, eax
je 0x117c7
push esi
lea esi, [eax - 8]
lea ecx, [esi + 0x1a8]
mov dword [ebp - 8], ecx
call ebx
mov ecx, dword [edi + 4]
xor ebx, ebx
sub ecx, ebx
je 0x1178d
dec ecx
je 0x11760
dec ecx
dec ecx
je 0x11733
dec ecx
je 0x11700
dec ecx
je 0x116cd
dec ecx
dec ecx
je 0x116c1
dec ecx
jne 0x117bb
mov dword [ebp - 4], 0xc0000184
jmp 0x117bb
mov ecx, dword [edi + 8]
cmp ecx, ebx
je 0x116ef
mov dword [esi + 0x108], ecx
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x10c], ecx
mov dword [edi + 8], 0x137c8
jmp 0x117aa
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
jmp 0x117bb
mov ecx, dword [edi + 8]
cmp ecx, ebx
je 0x11722
mov dword [esi + 0xf0], ecx
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xf4], ecx
mov dword [edi + 8], 0x14e92
jmp 0x117aa
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
jmp 0x117bb
mov ecx, dword [edi + 8]
cmp ecx, ebx
je 0x11752
mov dword [esi + 0xe0], ecx
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xe4], ecx
mov dword [edi + 8], 0x13676
jmp 0x117aa
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
jmp 0x117bb
mov ecx, dword [edi + 8]
cmp ecx, ebx
je 0x1177f
mov dword [esi + 0xd0], ecx
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xd4], ecx
mov dword [edi + 8], 0x13402
jmp 0x117aa
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
jmp 0x117bb
mov ecx, dword [edi + 8]
cmp ecx, ebx
je 0x117af
mov dword [esi + 0xc8], ecx
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xcc], ecx
mov dword [edi + 8], 0x12a8e
mov dword [edi + 0xc], esi
jmp 0x117bb
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov ecx, dword [ebp - 8]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop esi
mov dl, byte [ebp + 0xf]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop ebx
jge 0x117f3
mov ecx, dword [ebp + 8]
xor dl, dl
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x11806
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
leave
ret 0xc
Function at 0x142e2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
call fcn.0001740a
test al, al
jne 0x1430e
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1443a
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push edi
mov ecx, 0x1a810
call esi
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
cdq
push edx
push eax
push dword [0x1a81c]
call fcn.000104f2
test eax, eax
mov edi, dword [ebp + 8]
je 0x1440d
lea ebx, [eax - 8]
test byte [ebx + 0x38], 2
je 0x1440d
cmp byte [ebx + 0xd9], 0
jne 0x1440d
mov eax, dword [ebp + 0xc]
test byte [eax + 8], 0x80
je 0x14396
push 0
push ebx
call fcn.00013aca
test eax, eax
jne 0x14396
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
xor esi, esi
mov dword [ecx + 0x1c], esi
mov dword [ecx + 0x18], esi
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x14437
call fcn.0001740a
test al, al
je 0x1443e
cmp byte [ebx + 0x139], 0
jne 0x1443e
cmp byte [ebx + 0xd7], 0
je 0x1443e
lea ecx, [ebx + 0x13c]
call esi
lea ecx, [edi + 0x58]
lea esi, [ebx + 0xec]
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
mov dword [ecx], esi
mov dword [edx], ecx
mov dword [esi + 4], ecx
mov dl, al
lea ecx, [ebx + 0x13c]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [edi + 0x60]
or byte [eax + 3], 1
mov eax, 0x135d2
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
push 0
mov esi, 0x103
push ebx
mov dword [edi + 0x18], esi
call fcn.000130b2
mov dword [ebp - 8], esi
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, 0x103
cmp dword [ebp - 8], eax
je 0x14437
mov ecx, dword [ebp + 0x10]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
and dword [ecx + 0x1c], 0
mov eax, 0xc0000184
mov dword [ecx + 0x18], eax
mov esi, eax
jmp 0x14387
Function at 0x14466
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
call fcn.0001740a
test al, al
jne 0x14492
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x145e1
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push edi
mov ecx, 0x1a810
call esi
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
cdq
push edx
push eax
push dword [0x1a81c]
call fcn.000104f2
mov edi, dword [ebp + 8]
mov ebx, eax
test ebx, ebx
je 0x145b4
mov eax, dword [ebp + 0xc]
add eax, 4
je 0x144f0
test byte [eax + 4], 0x20
je 0x144f0
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov edx, edi
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
jmp 0x145d5
test byte [ebx + 0x30], 2
je 0x145b4
cmp byte [ebx + 0xd1], 0
jne 0x145b4
call fcn.0001740a
test al, al
je 0x145e5
cmp byte [ebx + 0x131], 0
jne 0x145e5
lea ecx, [ebx + 0x134]
mov dword [ebp + 8], ecx
call esi
lea ecx, [ebx + 0x104]
mov edx, dword [ecx + 4]
lea esi, [edi + 0x58]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [edx], esi
mov dword [ecx + 4], esi
mov ecx, dword [ebp + 8]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [edi + 0x60]
or byte [eax + 3], 1
and dword [edi + 0x1c], 0
lea ecx, [edi + 0x38]
mov eax, 0x135d2
xchg dword [ecx], eax
mov dword [ebp + 0xc], eax
mov eax, 0x103
mov dword [edi + 0x18], eax
push dword [ebx + 0x24]
mov dword [ebp - 8], eax
push dword [ebx + 0x20]
push 3
call fcn.00018028
test eax, eax
jge 0x145b4
mov ecx, dword [ebp + 8]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebx], ecx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dl, al
mov dword [esi + 4], esi
mov dword [esi], esi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x38]
xchg dword [eax], ecx
and dword [edi + 0x18], 0
and dword [ebp - 8], 0
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, 0x103
cmp dword [ebp - 8], eax
je 0x145de
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
mov ecx, dword [ebp + 0x10]
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
and dword [ecx + 0x1c], 0
mov esi, 0xc0000184
xor dl, dl
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x145de
Function at 0x14c5a
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x58], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x5c], edi
call fcn.0001740a
test al, al
jne 0x14c8f
mov ecx, edi
jmp 0x14d8a
push 0x4b
lea eax, [ebp - 0x50]
push 0
push eax
call sub.ntoskrnl.exe_memset
mov edi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
add esp, 0xc
mov ecx, 0x1a810
mov word [ebp - 0x50], 0xe
mov word [ebp - 0x4e], 2
call edi
mov byte [ebp - 0x51], al
mov eax, dword [ebx + 0x18]
cdq
push edx
push eax
push dword [0x1a838]
call fcn.000104f2
test eax, eax
je 0x14d6f
lea ebx, [eax - 8]
lea eax, [ebp - 0x4e]
push eax
push 1
push ebx
call fcn.00018bae
test al, 1
je 0x14d12
mov dl, byte [ebp - 0x51]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
and dword [esi + 0x1c], 0
mov edi, 0xc0000141
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x14d99
test al, 2
je 0x14d6f
cmp byte [ebx + 0x165], 0
jne 0x14d6f
lea ecx, [ebx + 0x1a8]
call edi
lea ecx, [esi + 0x58]
lea edi, [ebx + 0x178]
mov dl, al
mov eax, dword [edi + 4]
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov dword [edi + 4], ecx
lea ecx, [ebx + 0x1a8]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
mov eax, 0x149cc
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
push 3
mov edi, 0x103
push ebx
mov dword [esi + 0x18], edi
call fcn.00011892
mov dword [ebp - 0x58], edi
mov dl, byte [ebp - 0x51]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, 0x103
cmp dword [ebp - 0x58], eax
je 0x14d99
mov ecx, dword [ebp - 0x5c]
inc byte [esi + 0x23]
add dword [esi + 0x60], 0x24
mov edx, esi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00018e19
leave
ret 0xc
Function at 0x153a2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
cmp edi, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
jne 0x153c7
mov dword [ebp + 8], 0xc0000141
jmp 0x15558
mov eax, dword [edi + 8]
or eax, dword [edi + 0xc]
je 0x153bb
mov eax, dword [edi + 0xf0]
cmp eax, edx
mov ecx, dword [edi + 0xf4]
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], ecx
je 0x153bb
lea eax, [edi + 0x170]
push esi
mov esi, dword [eax]
cmp esi, edx
mov dword [ebp - 0x10], eax
je 0x15550
cmp esi, eax
je 0x15550
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
cmp dword [esi + 0xc], edx
jl 0x1554a
cmp dword [esi + 0x9c], edx
je 0x1554a
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
lea ecx, [edi + 0x1a8]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [esi + 0x9c]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x98]
lea ecx, [esi + ecx + 0xa4]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push eax
push dword [esi + 0x10]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [ebp + 8]
call dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebx], al
mov eax, dword [edi + 8]
or eax, dword [edi + 0xc]
jne 0x154b9
push esi
call fcn.00015d7a
mov ecx, dword [ebp - 4]
test ecx, ecx
mov eax, 0xc0000141
mov dword [ebp + 8], eax
je 0x15557
xor edx, edx
add ecx, 0x38
xchg dword [ecx], edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 4]
and dword [eax + 0x1c], 0
push 0
push dword [ebp - 4]
call fcn.00017416
jmp 0x15557
mov eax, 0xc000021b
cmp dword [ebp + 8], eax
jne 0x154c9
and dword [ebp - 8], 0
jmp 0x154d8
cmp dword [ebp + 8], 0
jne 0x154d8
cmp dword [ebp - 8], 0
jne 0x154d8
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x9c]
cmp dword [ebp - 8], eax
jae 0x1550c
cmp dword [ebp - 4], 0
je 0x1550c
sub eax, dword [ebp - 8]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 8]
add dword [esi + 0x98], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
jmp 0x15515
push esi
call fcn.00015d7a
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], 0
je 0x15557
push eax
push dword [ebp - 4]
call fcn.0001520c
mov dl, byte [ebx]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp - 4]
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebx], al
jmp 0x15557
push esi
call fcn.00015d7a
mov dword [ebp + 8], 0xc0000141
pop esi
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 8
Function at 0x15566
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x1a8]
mov dword [ebp - 8], ecx
call ebx
mov byte [ebp + 0xb], al
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x15669
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x15669
mov eax, dword [esi + 0x1c]
cmp eax, dword [ebp + 0x10]
jne 0x15669
lea eax, [esi + 0x170]
cmp dword [eax], eax
je 0x15669
push edi
jmp 0x15634
lea ecx, [esi + 0x170]
cmp dword [ecx], ecx
je 0x1563e
mov edi, dword [eax]
cmp edi, eax
mov ecx, dword [edi]
mov dword [eax], ecx
mov dword [ecx + 4], eax
je 0x15634
add edi, 0xffffffa8
lea eax, [edi + 0x58]
mov dword [eax + 4], eax
mov dword [eax], eax
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
lea eax, [esi + 0x170]
push eax
push edi
call fcn.0001520c
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 8]
call ebx
cmp dword [ebp - 4], 0
mov byte [ebp + 0xb], al
jl 0x15668
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x15668
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x15668
mov eax, dword [esi + 0x1c]
cmp eax, dword [ebp + 0x10]
jne 0x15668
lea eax, [esi + 0x178]
cmp dword [eax], eax
jne 0x155bf
lea edi, [esi + 0x170]
jmp 0x15657
lea eax, [ebp + 0xb]
push eax
push esi
call fcn.000153a2
test eax, eax
mov dword [ebp - 4], eax
jl 0x1565d
cmp dword [edi], edi
jne 0x15646
jmp 0x15668
cmp eax, 0xc000021b
jne 0x15668
and dword [ebp - 4], 0
pop edi
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x1569a
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x1c]
jne 0x1569a
cmp ecx, dword [ebp + 0x10]
jne 0x1569a
cmp dword [ebp - 4], 0
jl 0x1569a
add esi, 0x170
cmp dword [esi], esi
jne 0x1569a
push ecx
push eax
push 0xc
call fcn.00018028
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp - 8]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x158da
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
call fcn.0001740a
test al, al
jne 0x15907
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x15a7c
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push edi
mov ecx, 0x1a810
call esi
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
cdq
push edx
push eax
push dword [0x1a838]
call fcn.000104f2
mov edi, dword [ebp + 8]
mov ebx, eax
test ebx, ebx
je 0x15a48
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x1596d
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
and dword [ecx + 0x1c], 0
mov esi, 0xc00000bc
xor dl, dl
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x15a79
test al, 2
je 0x15a48
cmp byte [ebx + 0x15d], 0
jne 0x15a48
lea ecx, [ebx + 0x1a0]
mov dword [ebp + 0xc], ecx
call esi
mov byte [ebp + 0xb], al
lea eax, [ebx + 0x188]
push eax
call fcn.000161bc
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
test byte [ebx + 0x1c], 4
jne 0x15a48
cmp dword [ebp - 0xc], 5
jge 0x15a48
mov ecx, dword [ebp + 0xc]
call esi
lea ecx, [ebx + 0x188]
mov edx, dword [ecx + 4]
lea esi, [edi + 0x58]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [edx], esi
mov dword [ecx + 4], esi
mov ecx, dword [ebp + 0xc]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [edi + 0x60]
or byte [eax + 3], 1
lea ecx, [edi + 0x38]
mov eax, 0x149cc
xchg dword [ecx], eax
mov dword [ebp + 8], eax
mov eax, 0x103
mov dword [edi + 0x18], eax
push dword [ebx + 0x14]
mov dword [ebp - 8], eax
push dword [ebx + 0x10]
push 0xb
call fcn.00018028
test eax, eax
jge 0x15a48
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebx], ecx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 0xc]
mov dl, al
mov dword [esi + 4], esi
mov dword [esi], esi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x38]
xchg dword [eax], ecx
and dword [edi + 0x18], 0
and dword [ebp - 8], 0
mov dl, byte [ebp - 1]
mov ecx, 0x1a810
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [ebp - 8]
cmp eax, 0x103
je 0x15a79
cmp eax, 0xc000009a
je 0x15a79
mov ecx, dword [ebp + 0x10]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop edi
pop esi
pop ebx
leave
ret 0xc