joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1657a
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
and dword [esi + 0x1c], 0
mov ecx, dword [edx + 0xc]
mov eax, 0x128010
cmp ecx, eax
push edi
ja 0x29722
je 0x29750
sub ecx, 0x120003
jne 0x1bd84
push edx
push esi
call fcn.0001901a
pop edi
pop esi
leave
ret 8
sub ecx, 0x25
je 0x1bd9e
sub ecx, 0x2c
je 0x3a462
sub ecx, 0x7fb0
jne 0x3a44c
push edx
push esi
call fcn.0001bbfe
jmp 0x165b5
sub ecx, 0x128014
je 0x29750
sub ecx, 4
je 0x29744
sub ecx, 4
jne 0x3a4c1
push edx
push esi
call fcn.00029761
jmp 0x165b5
push edx
push esi
call fcn.0005bcb8
jmp 0x165b5
push edx
push esi
call fcn.0005bc5b
jmp 0x165b5
sub ecx, 4
je 0x3a456
sub ecx, 4
jne 0x3a4cf
push edx
push esi
call fcn.0005bbf0
jmp 0x165b5
cmp dword [edx + 8], 0xc
jb 0x3a4ba
cmp dword [edx + 4], 0x3c
jb 0x3a4ba
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 4]
push ebx
mov ebx, dword [edx]
mov dword [ebp - 4], eax
mov ax, word [edx + 8]
push 0xf
mov word [ebp + 0xc], ax
mov ax, word [edx + 0xa]
pop ecx
mov word [ebp + 8], ax
push dword [ebp + 8]
xor eax, eax
push dword [ebp + 0xc]
mov edi, edx
push ebx
push dword [ebp - 4]
rep stosd dword es:[edi], eax
push edx
call fcn.00049a98
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffffc4
add ecx, 0x3c
mov dword [esi + 0x1c], ecx
pop ebx
mov dword [esi + 0x18], eax
mov edi, eax
jmp 0x3a4d7
mov eax, 0xc000000d
jmp 0x3a4b3
sub ecx, 4
je 0x29738
sub ecx, 4
je 0x3a4e8
mov edi, 0xc0000002
mov dword [esi + 0x18], edi
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x165b5
push edx
push esi
call fcn.0004bff4
jmp 0x165b5
Function at 0x16718
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, dword [0x5169c]
push ebx
push esi
push edi
je 0x3a4f4
cmp eax, dword [0x516a0]
je 0x1fcbb
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 0x60]
mov eax, dword [edi + 0x18]
mov ecx, dword [eax + 0x10]
cmp ecx, 2
jne 0x1682d
mov cl, byte [edi + 1]
cmp cl, 7
je 0x167af
cmp cl, 8
jne 0x1a358
push edi
push esi
call fcn.0002ca2b
pop edi
pop esi
pop ebx
pop ebp
ret 8
push edi
push esi
call fcn.0001bf47
jmp 0x16768
push edi
push esi
call fcn.0001741e
jmp 0x16768
cmp ecx, 1
jne 0x1a38d
mov cl, byte [edi + 1]
cmp cl, 7
je 0x1fc97
cmp cl, 9
je 0x1687a
cmp cl, 0xa
je 0x3a502
cmp cl, 0xb
jne 0x1e742
push edi
push esi
call fcn.0005a12e
mov edi, eax
and dword [esi + 0x1c], 0
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x16768
push edi
push esi
call fcn.0001a0e3
jmp 0x16768
movzx ecx, cl
dec ecx
jne 0x1a36a
push edi
push esi
call fcn.0001ba55
jmp 0x16860
dec ecx
je 0x1e8ab
dec ecx
je 0x1bdaa
dec ecx
je 0x1fcaf
dec ecx
je 0x1fca3
dec ecx
je 0x1b425
mov al, byte [edi + 1]
cmp al, 0xc
jne 0x3a50e
push edi
push esi
call fcn.0001a6b2
jmp 0x16768
push edi
push esi
call fcn.0001b448
jmp 0x16768
mov ebx, dword [eax + 0xc]
push 0x20a30
push esi
push ebx
call fcn.00014950
test eax, eax
jl 0x16768
push edi
push esi
push ebx
call fcn.0001c62a
test eax, eax
je 0x16799
jmp 0x16768
cmp cl, 3
je 0x1fb72
cmp cl, 6
jmp 0x1a387
push edi
push esi
call fcn.0001e8bc
jmp 0x16768
mov eax, dword [eax + 0xc]
push 0x20a30
push esi
push eax
call fcn.00014950
test eax, eax
jl 0x16768
jmp 0x16799
push edi
push esi
call fcn.0001fc1b
jmp 0x16768
push edi
push esi
call fcn.0004bf1b
jmp 0x16768
push edi
push esi
call fcn.0004beab
jmp 0x16768
push dword [ebp + 0xc]
push eax
call fcn.00059e05
jmp 0x16768
push dword [ebp + 0xc]
push eax
call fcn.0005b8d9
jmp 0x16768
push edi
push esi
call fcn.0004bf82
jmp 0x16768
jbe 0x3a51d
cmp al, 0xe
mov edi, 0xc0000002
jbe 0x16862
mov edi, 0xc0000010
jmp 0x16862
Function at 0x1741e
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x18]
mov ebx, dword [eax + 0xc]
mov eax, dword [ebx]
lea ecx, [ebx + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], fcn.000148bc
mov dword [ebp - 8], esi
mov dword [ebp + 0xc], ecx
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
lea ecx, [esi + 0x38]
mov edx, 0x20a30
xchg dword [ecx], edx
cmp byte [esi + 0x24], 0
jne 0x3a11a
mov ecx, dword [esi + 0x60]
or byte [ecx + 3], 1
inc dword [ebx + 4]
xor ecx, ecx
mov edx, 0x4fa80
inc ecx
lock xadd dword [edx], ecx
inc ecx
je 0x1746e
and dword [esi + 0x40], 0
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp + 0xc]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
push dword [esi + 4]
xor eax, eax
mov ax, word [edi + 8]
push dword [edi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00017bff
mov ecx, 0x103
cmp eax, ecx
jne 0x3a0ff
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret 8
and byte [edi + 3], 0xfe
test eax, eax
jne 0x3a10c
push dword [edi + 4]
jmp 0x3a10e
push 0
push eax
push esi
call fcn.000148bc
jmp 0x174b4
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, al
call edi
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
xor edx, edx
lea ecx, [esi + 0x38]
xchg dword [ecx], edx
mov ecx, dword [ebp + 0xc]
and dword [esi + 0x1c], 0
mov ebx, 0xc0000120
mov dl, al
mov dword [esi + 0x18], ebx
call edi
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x174b4
Function at 0x19d64
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
and dword [ebp - 0xc], 0
mov dword [ebp - 8], ecx
push ebx
mov ebx, dword [eax + 0xc]
mov edx, ecx
push esi
mov esi, dword [0x51ab0]
shr ecx, 2
push edi
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, 0x4fb80
dec esi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp + 0xf], al
mov eax, esi
imul eax, eax, 0x104
lea ecx, [eax + 4]
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
ja 0x319e8
mov dword [ebx], esi
mov eax, dword [0x51ab4]
test eax, eax
je 0x19e30
and dword [ebp - 4], 0
lea edx, [ebx + 4]
mov dword [ebp - 8], edx
cmp eax, 0x51440
je 0x19e2a
movzx ecx, word [eax + 0xf4]
mov esi, dword [eax + 0xf8]
lea edi, [edx + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [eax + 0xf4]
shr ecx, 1
add ecx, dword [ebp - 4]
add dword [ebp - 4], 0x82
and word [ebx + ecx*2 + 8], 0
mov ecx, dword [eax + 0x88]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x10]
add edx, 0x104
mov dword [ebp - 8], edx
mov eax, dword [eax]
test eax, eax
jne 0x19dd5
mov esi, dword [ebp + 8]
mov dword [esi + 0x1c], ecx
mov edi, dword [ebp - 0xc]
mov dl, byte [ebp + 0xf]
mov ecx, 0x4fb80
mov dword [esi + 0x18], edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0x80000005
jmp 0x19e36
Function at 0x1a6b2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x18]
mov ecx, dword [eax + 0xc]
lea ebx, [edi + 4]
mov edx, dword [ebx]
dec edx
mov dword [ebp - 0x14], fcn.000148bc
mov dword [ebp - 0x10], esi
je 0x1a75b
dec edx
je 0x1a75b
dec edx
jne 0x1a743
cmp dword [eax + 0x10], 2
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
je 0x3a35b
push 0
push esi
push ecx
call fcn.00014950
test eax, eax
jl 0x1a73c
mov edx, dword [esi + 4]
push edx
call fcn.000165c0
push dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edx
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.0001a767
mov ecx, eax
mov eax, 0x103
cmp ecx, eax
je 0x1a73c
push dword [ebp - 8]
and byte [edi + 3], 0xfe
push ecx
push esi
call fcn.000148bc
pop edi
pop esi
pop ebx
leave
ret 8
dec edx
jne 0x3a316
cmp dword [eax + 0x10], 2
jne 0x3a354
mov dword [ebp - 4], 1
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
jmp 0x1a6f8
dec edx
je 0x1a75b
sub edx, 5
je 0x3a33f
mov edi, 0xc0000002
and dword [esi + 0x1c], 0
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1a73c
mov eax, dword [eax + 0x10]
cmp eax, 2
je 0x1a754
cmp eax, 1
je 0x1a75b
mov edi, 0xc000000d
jmp 0x3a327
mov dword [ebp - 4], 1
jmp 0x1a6f8

Function at 0x1bbfe
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
cmp ecx, 0x18
mov eax, dword [ebx + 0x18]
mov edx, dword [eax + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0xc]
jb 0x23d88
add ecx, 0xffffffe8
cmp ecx, dword [edi + 0x14]
jb 0x23d88
mov eax, dword [eax + 0x10]
dec eax
je 0x1bc3d
dec eax
jne 0x23d81
cmp dword [ebx + 0xc], 0x120028
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
je 0x1e753
push 0
push esi
push edx
call fcn.00014950
test eax, eax
jl 0x1bc8f
mov dword [ebp - 0xc], fcn.000148bc
mov dword [ebp - 8], esi
push dword [edi + 0x14]
lea eax, [edi + 0x18]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.0001bc9b
mov ecx, eax
mov eax, 0x103
cmp ecx, eax
je 0x1bc8f
and byte [ebx + 3], 0xfe
push 0
push ecx
push esi
call fcn.000148bc
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [edi]
cmp eax, 0x400
je 0x1bc4f
cmp eax, 0x401
je 0x1bc4f
jmp 0x3a1ff
dec eax
je 0x1bc3d
mov edi, 0xc000000d
mov dword [esi + 0x18], edi
jmp 0x3a209
mov eax, 0xc0000022
mov dword [esi + 0x18], eax
mov edi, eax
and dword [esi + 0x1c], 0
mov ecx, esi
mov dl, 2
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1bc8f
Function at 0x1fe8b
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
xor edi, edi
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov eax, dword [0x50578]
mov ecx, 0x50578
cmp eax, ecx
je 0x1fed1
mov edx, dword [eax + 0x10]
cmp edx, dword [ebp + 8]
jne 0x37dc8
mov esi, dword [eax + 8]
mov edi, eax
xor ecx, ecx
lea edx, [esi + 0x38]
xchg dword [edx], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
test edi, edi
je 0x37dcf
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0002051d
push 0
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, eax
call edi
push 0
push dword [ebp + 8]
call edi
and dword [esi + 0x18], 0
mov dl, 2
mov ecx, esi
mov dword [esi + 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop ebx
pop edi
pop esi
leave
ret 0x14
mov eax, dword [eax]
jmp 0x1feab
push edi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1ff1d

Function at 0x220ce
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
xor bl, bl
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
mov esi, dword [ebp + 8]
cmp ecx, edi
je 0x22105
lea edx, [ecx - 0x58]
cmp edx, esi
je 0x220f8
mov ecx, dword [ecx]
jmp 0x220e9
mov ecx, dword [esi + 0x58]
mov edi, dword [esi + 0x5c]
mov dword [edi], ecx
mov dword [ecx + 4], edi
mov bl, 1
mov ecx, dword [ebp + 0x10]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor eax, eax
mov al, byte [esi + 0x25]
push eax
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
test bl, bl
je 0x22135
and dword [esi + 0x1c], 0
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], 0xc0000120
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x22ffe
Capabilities:
Complete processing asynchronous io request

Disassembly:
lea ebx, [esi - 0x58]
mov eax, dword [ebx + 0x60]
cmp dword [eax + 8], 0xc
mov dword [ebp - 0x18], eax
jae 0x301a3
xor edi, edi
test edi, edi
jne 0x301ab
mov eax, dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebx + 0x58]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
xor ecx, ecx
lea edx, [ebx + 0x38]
xchg dword [edx], ecx
test ecx, ecx
je 0x301e8
mov ecx, dword [ebp - 0x18]
push 0x20
pop edx
cmp dword [ecx + 4], edx
jae 0x301f1
and dword [ebx + 0x1c], 0
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x2304b
jmp 0x229f5
cmp byte [ebp - 1], 0
jne 0x30204
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [eax + 4], edx
and dword [ecx - 0x40], 0
add ecx, 0xffffffa8
mov dl, 2
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [ebp - 0x20]
cmp dword [ebp - 0x20], eax
je 0x23063
jmp 0x229ca
mov esi, dword [ebp - 8]
jmp 0x22951
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], 0
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
cmp al, 2
jae 0x3015f
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 0xc], al
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
cmp esi, eax
jne 0x22951
mov dl, byte [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
lea eax, [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x229c0
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x78694354
push 0x48
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x23063
mov eax, dword [ebp + 0xc]
push 8
pop ecx
lea edi, [ebx + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp + 0x10]
push 0x402ac
push ebx
mov dword [ebx + 0x44], eax
call sub.TDI.SYS_CTEInitEvent
push ebx
push ebx
call sub.TDI.SYS_CTEScheduleDelayedEvent
jmp 0x23063
mov edi, dword [ebx + 0xc]
jmp 0x22966
cmp dword [edi], 1
jne 0x301ca
lea ecx, [ebp - 0x20]
push ecx
push dword [eax + 0x18]
call fcn.000402d7
test al, al
je 0x301ca
mov eax, dword [esi]
mov dword [ebp - 8], eax
jmp 0x229b2
mov eax, dword [edi + 4]
test eax, eax
je 0x2296e
mov ecx, dword [ebp - 0x10]
and eax, dword [ebp - 0x10]
and ecx, dword [ebp - 0x14]
cmp eax, ecx
je 0x2296e
jmp 0x301c0
mov byte [ebp - 1], 1
jmp 0x2298f
mov esi, dword [ebp + 8]
mov edi, dword [ebx + 0xc]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x1c], edx
jmp 0x229a2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
jmp 0x229ca
Function at 0x23cf9
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
xor edi, edi
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov eax, dword [0x50570]
mov ecx, 0x50570
cmp eax, ecx
je 0x23d3f
mov edx, dword [ebp + 8]
cmp dword [eax + 0x10], edx
jne 0x37dde
mov esi, dword [eax + 8]
mov edi, eax
xor ecx, ecx
lea edx, [esi + 0x38]
xchg dword [edx], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
test edi, edi
push 0
je 0x37de5
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push dword [ebp + 0xc]
and dword [esi + 0x1c], 0
call fcn.0002342e
push 0
push dword [ebp + 8]
mov dword [esi + 0x18], eax
call edi
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
leave
ret 8
mov eax, dword [eax]
jmp 0x23d19
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x23d7b

Function at 0x24d66
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0x103
cmp dword [eax + 4], 0x14
jb 0x37e4d
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
cmp byte [esi + 0x24], 0
jne 0x37e57
cmp dword [0x50568], edi
jne 0x37e61
mov eax, 0x47f37
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
mov dword [0x50568], esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
test edi, edi
jne 0x24de4
push dword [ebp + 0xc]
push esi
call fcn.00024e92
mov edi, eax
cmp edi, 0xc0000120
je 0x37e6b
cmp edi, 0x103
je 0x24df9
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, 0x103
pop esi
pop ebp
ret 8
mov edi, 0xc000000d
jmp 0x24dec
mov edi, 0xc0000120
jmp 0x24dc0
mov edi, 0x80000011
jmp 0x24dc0
mov edi, 0x103
jmp 0x24de4
Function at 0x25327
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x4f904]
and dword [ebp - 0x12c], 0
push esi
push edi
push 0x2b
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x134]
mov esi, 0x253c0
lea edi, [ebp - 0x124]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0005a3e6
test eax, eax
jl 0x253b2
mov edi, 0x4fb80
push ebx
lea eax, [ebp - 0x190]
push eax
push 0x72
lea eax, [ebp - 0x78]
push eax
xor esi, esi
push esi
push dword [ebp - 0x12c]
push dword [ebp - 0x134]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, esi
jge 0x35ae3
cmp eax, 0x80000005
je 0x35c55
push dword [ebp - 0x134]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.00010ef2
leave
ret 0xc
cmp dword [ebp - 0x74], 1
jne 0x35c55
mov eax, dword [ebp - 0x70]
shr eax, 1
mov word [ebp + eax*2 - 0x6c], si
add dword [ebp - 0x70], 2
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
push dword [ebp + 8]
push eax
call fcn.0005b6f2
mov ebx, eax
cmp ebx, 2
je 0x35c55
mov eax, dword [ebp - 0x144]
bswap eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x140]
bswap eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x130]
bswap eax
mov ecx, edi
mov dword [ebp - 0x160], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov edx, dword [ebp - 0x178]
mov byte [ebp - 0x125], al
lea eax, [ebp - 0x138]
push eax
mov eax, dword [0x513b8]
mov ecx, dword [eax + 4]
push 1
push esi
push dword [ebp - 0x160]
push dword [ebp - 0x150]
call fcn.00023b63
mov dl, byte [ebp - 0x125]
mov esi, eax
neg esi
sbb esi, esi
not esi
and esi, dword [ebp - 0x138]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
test esi, esi
jne 0x35c55
mov eax, dword [ebp - 0x130]
bswap eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x174], eax
or eax, 0xffffffff
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x14c], eax
push 0x34
lea eax, [ebp - 0x178]
push eax
xor ecx, ecx
lea eax, [ebp - 0x18c]
push eax
mov dword [ebp - 0x18c], 0x301
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], 0x200
mov dword [ebp - 0x180], 0x100
mov dword [ebp - 0x17c], 0x101
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], 3
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x148], ecx
call fcn.00023da5
inc dword [ebp - 0x12c]
je 0x253a5
jmp 0x25370
Function at 0x25898
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
push 0x10
push 0x6b494354
push 0x14
push 0
call edi
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
je 0x37df3
push 0x10
push 0x6c494354
push 0xc
push 0
call edi
mov ecx, eax
test ecx, ecx
mov dword [ebp + 8], ecx
je 0x37dfa
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0x60]
or byte [eax + 3], 1
push esi
push ebx
call fcn.000255ab
test al, al
jne 0x37e20
mov ebx, dword [ebx + 0xc]
xor eax, eax
cmp dword [edi + 8], 0xc
jb 0x2594d
cmp dword [edi + 0xc], 0x1280a0
je 0x37e09
push eax
movzx eax, word [ebx]
push fcn.00023cf9
push dword [ebp + 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
call fcn.00025959
cmp eax, 0x2bf7
jne 0x37e12
pop edi
pop esi
mov eax, 0x103
pop ebx
pop ebp
ret 8
mov eax, 0x2b2a
jmp 0x25936
mov edi, 0xc000009a
jmp 0x37e37
push eax
push esi
mov edi, 0xc000009a
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x37e37
mov ax, word [ebx + 0xc]
jmp 0x2591e
push eax
push dword [ebp + 8]
call fcn.00023cf9
jmp 0x25941
push 0
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, 0xc0000120
call esi
push 0
push dword [ebp + 8]
call esi
and dword [ebx + 0x1c], 0
mov dl, 2
mov ecx, ebx
mov dword [ebx + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x25941