joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1038ef2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x57c], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x64
pop ebx
push ebx
lea eax, [ebp - 0xcc]
mov esi, ecx
push eax
push dword [esi + 0x80]
call edi
cmp word [ebp - 0xcc], 0
mov byte [ebp - 0x575], 0
jne 0x1038f51
cmp dword [ebp + 8], 0x2b
jne 0x1038f4a
mov ecx, esi
call fcn.01038ba9
mov al, 1
jmp 0x10390fe
push ebx
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x1054300]
mov ecx, dword [eax + 0x10]
call fcn.010039b1
push dword [0x1054054]
lea eax, [ebp - 0xcc]
push 4
push ebx
push eax
call fcn.0100428a
mov dword [ebp - 0x580], eax
test eax, eax
jne 0x103909f
mov ecx, dword [0x1054300]
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.01035bbc
test eax, eax
je 0x103909f
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [esi + 0x80]
call edi
cmp dword [ebp + 8], 0xd
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x1038fcc
cmp dword [ebp + 8], 9
jne 0x1038fda
cmp word [ebp - 0xcc], 0
je 0x103906d
push 0
push dword [esi + 0x90]
push 0x182
push dword [esi + 0x88]
call edi
cmp word [ebp - 0xcc], 0
je 0x103906d
mov eax, dword [0x1054300]
mov ecx, dword [eax + 0x10]
call fcn.0100e845
test eax, eax
je 0x103903f
push 0x54
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0x57c]
push eax
push 0x2d
pop ecx
xor edx, edx
cmp cx, word [eax]
sete dl
push edx
push dword [0x1054050]
push 0x1055580
call fcn.0104276e
lea eax, [ebp - 0x174]
push eax
jmp 0x1039045
push dword [ebp - 0x57c]
push dword [esi + 0x90]
push 0x181
push dword [esi + 0x88]
call edi
push 0
push dword [esi + 0x90]
push 0x186
push dword [esi + 0x88]
jmp 0x103908d
mov ebx, dword [esi + 0x90]
mov ecx, esi
call fcn.01038975
push 0
cmp eax, ebx
jne 0x1039081
dec ebx
push ebx
push 0x186
push dword [esi + 0x88]
call edi
mov ecx, esi
call fcn.01038a5c
mov byte [ebp - 0x575], 1
jmp 0x10390eb
xor eax, eax
cmp dword [ebp - 0x57c], eax
je 0x10390b1
push dword [ebp - 0x57c]
jmp 0x10390e4
cmp dword [ebp - 0x580], 0x77
push 0x200
lea ecx, [ebp - 0x574]
push ecx
jne 0x10390ca
push 0x77
jmp 0x10390cf
push 0xdd
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x574]
push eax
mov ecx, esi
call fcn.01038456
push dword [ebp - 0x57c]
call dword [sym.imp.msvcrt.dll_free]
mov al, byte [ebp - 0x575]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e8f
leave
ret 4
Function at 0x10417d9
Capabilities:
Get geographical location
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1041944
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1041930
push eax
mov dword [esi + 0x1c], eax
call edi
push 0x1041910
push dword [esi + 0x1c]
mov dword [esi], eax
call edi
push 0x10418f0
push dword [esi + 0x1c]
mov dword [esi + 8], eax
call edi
push 0x10418d8
push dword [esi + 0x1c]
mov dword [esi + 4], eax
call edi
push 0x10418c0
push dword [esi + 0x1c]
mov dword [esi + 0xc], eax
call edi
push 0x10418a4
push dword [esi + 0x1c]
mov dword [esi + 0x10], eax
call edi
push 0x104188c
push dword [esi + 0x1c]
mov dword [esi + 0x14], eax
call edi
push 8
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 0x1009
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x20], eax
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01001e8f
leave
ret
Function at 0x10440d2
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x43c
mov eax, 0x104fd56
call fcn.01001ea1
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x428], ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 4], ebx
mov edi, ecx
mov dword [ebp - 0x42c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x100247c
mov ecx, esi
call fcn.010127cb
push ebx
push 0x1a
lea eax, [ebp - 0x218]
push eax
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x104421f
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.010127f7
push 0x1044230
mov ecx, esi
call fcn.0103c2f7
lea eax, [edi + 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 0x424], eax
call fcn.0103c05e
push 0x104422c
mov ecx, esi
call fcn.0103c2f7
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x104418b
mov eax, dword [edi]
jmp 0x104418d
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10441b1
cmp dword [esi + 0x18], 8
jb 0x10441a3
mov eax, dword [edi]
jmp 0x10441a5
mov eax, edi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, ebx
jne 0x10441f9
mov eax, dword [ebp - 0x424]
cmp dword [eax + 0x18], 8
jb 0x10441c2
mov eax, dword [eax + 4]
jmp 0x10441c5
add eax, 4
cmp dword [esi + 0x18], 8
jb 0x10441cd
mov edi, dword [edi]
lea ecx, [ebp - 0x420]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x100247c
mov ecx, esi
call fcn.010127f7
lea eax, [ebp - 0x420]
push eax
mov ecx, esi
call fcn.0103c2f7
jmp 0x104421f
lea ecx, [ebp - 0x448]
call fcn.010167e7
xor edi, edi
inc edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0101738b
push ebx
push edi
lea ecx, [ebp - 0x448]
call fcn.0101212a
mov eax, esi
call fcn.01001f5c
ret 4
Function at 0x1045f90
Capabilities:
Delete file

Disassembly:
push 0x60
mov eax, 0x105039d
call fcn.01001ea1
mov esi, ecx
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x6c]
push 0x1030378
push eax
call fcn.01043761
push 0x103035c
push eax
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.01043f90
add esp, 0x18
push edi
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0101212a
push 0x100247c
mov ecx, esi
call fcn.0103ab1e
test eax, eax
jne 0x1045ffc
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0101212a
mov eax, esi
call fcn.01001f5c
ret
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.0103b24f
mov edi, 0x1030314
push edi
lea ecx, [ebp - 0x50]
call fcn.010127cb
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x34]
lea ebx, [esi + 0x48]
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.01043df6
mov eax, dword [eax]
push 0
push 1
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
call fcn.0101212a
mov eax, dword [esi + 0x4c]
cmp dword [ebp - 0x30], eax
je 0x1046082
push edi
lea ecx, [ebp - 0x50]
call fcn.010127cb
lea eax, [ebp - 0x50]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.01045636
cmp dword [eax + 0x18], 8
jb 0x104606c
mov eax, dword [eax + 4]
jmp 0x104606f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.0101212a
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x104608e
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
mov ecx, esi
call fcn.0104396a
mov esi, eax
jmp 0x1045fe8
Function at 0x10461a6
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x46c
mov eax, 0x1050478
call fcn.01001ea1
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x418], ax
xor esi, esi
lea eax, [ebp - 0x416]
push esi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
push 0x60
mov dword [ebp - 0x448], 0x104
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x43c], esi
call fcn.01002286
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x1046235
add ebx, 0x1c
push ebx
call fcn.01016782
mov dword [ebp - 0x41c], eax
jmp 0x104623b
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x45c]
push eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x10463dd
cmp dword [ebp - 0x424], esi
je 0x10463da
lea ecx, [ebp - 0x454]
call fcn.010174a3
mov dword [ebp - 4], 1
mov dword [ebp - 0x428], esi
cmp dword [ebp - 0x424], esi
jbe 0x1046391
lea eax, [ebp - 0x45c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x440], 0xff
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x1046379
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x478]
call fcn.010127cb
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x478]
push eax
mov byte [ebp - 4], 2
call fcn.01045ab5
push esi
push 1
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 1
call fcn.0101212a
mov ecx, dword [ebp - 0x41c]
call fcn.010460a7
test eax, eax
je 0x1046352
mov ecx, dword [ebp - 0x41c]
call fcn.01043904
test eax, eax
je 0x1046379
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], ebx
push eax
lea ecx, [ebp - 0x454]
inc ebx
call fcn.01045725
lea ecx, [ebp - 0x210]
push ecx
mov ecx, eax
call fcn.010127f7
inc dword [ebp - 0x428]
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x424]
jb 0x10462c7
xor edi, edi
cmp ebx, esi
jbe 0x10463cb
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x420], edi
call fcn.01045725
mov ecx, dword [ebp - 0x41c]
push eax
call fcn.01045ab5
mov ecx, dword [ebp - 0x41c]
call fcn.01045f90
inc edi
cmp edi, ebx
jb 0x1046397
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.010450a2
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x41c]
cmp ecx, esi
je 0x10463ee
push 1
call fcn.01018a89
mov eax, ebx
call fcn.01001f5c
ret 4
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call esi
cmp eax, 7
jne 0x44b624
push 1
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x660200], al
mov byte [0xa626e4], al
mov eax, 0xd7b0
mov dword [0x660218], ecx
mov word [0xa6273c], ax
mov word [0xa6273e], ax
mov word [0x660614], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x660248], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b678
call esi
cmp al, 4
ja 0x44b67e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x660244], eax
pop esi
ret
Function at 0x4ac635
Capabilities:
Encode data using xor

Disassembly:
ja 0x4ac65e
js 0x4ac5eb
add al, 0x17
pop ss
sub dword [ecx + 0x34], esi
jno 0x4ac61f
jae 0x4ac5f6
mov esi, 0xb0073476
fbstp tbyte [ebp - 0x5c]
and ah, byte [0xf0bc8514]
and eax, 0xf0bc8514
retf
cmp byte [edi - 0x25], ah
das
pop edx
movsb byte es:[edi], byte [esi]
and al, 0xd9
jns 0x4ac61a
sbb dh, byte [ecx - 0x3a169af3]
adc byte [ebp + 0x455bc5cd], ah
lds edx, [eax]
movsd dword es:[edi], dword [esi]
int 0xc5
pop ebx
inc ebp
insb byte es:[edi], dx
loop 0x4ac5e4
xor al, 0x6b
cmp byte [esi + 0xd601d40], dl
dec edx
jns 0x4ac5e6
fmul qword [ebx - 0x46]
insd dword es:[edi], dx
out 0xf5, al
test eax, 0x210759b5
xchg esi, eax
sti
pop esp
aam 0xc0
ficomp dword [ebx]
pop eax
pop ecx
sub dword [esp + esi*2 - 0x41], esp
jp 0x4ac5e9
mov edi, 0x768a07a
and bl, byte [eax]
and al, 0xf5
push 0x24182207
cmc
xlatb
jns 0x4ac60b
ror byte [ecx], 1
jns 0x4ac5e5
das
inc esi
jno 0x4ac646
invalid
movsd dword es:[edi], dword [esi]
sbb eax, 0x6800f375
jae 0x4ac667
pop ds
adc eax, 0x5b05db0a
push eax
push ecx
cmpsd dword [esi], dword es:[edi]
push ecx
jl 0x4ac6ec
sub dl, byte [esi]
or eax, 0x4d526942
loopne 0x4ac6d0
sbb dword [ebp - 0x68abc7b], esp
and ebp, dword [ecx + 0x7f628d79]
or byte [ecx + ebx - 0x4573780], ah
add edx, dword [eax - 0x1e]
push 0xf88115dd
inc ecx
mov edi, 0xedd38986
jecxz 0x4ac707
shr cl, cl
jmp 0xd66a0d2e
leave
inc ebx
leave
push ecx
dec esp
stosd dword es:[edi], eax
mov ebx, 0x8bba1840
xor ebp, dword [ebx + 0x55]
or byte [ecx - 0x6be39a10], cl
xchg esp, eax
test eax, 0x89a5ba13
leave
xchg byte [ebp - 0x1f1cb3c6], cl
lea edi, [edx]
dec esp
jecxz 0x4ac6bd
aas
stosb byte es:[edi], al
fld dword [esi]
or dword [esi + 0x65f567c8], esi
invalid
mov edi, 0x463a9789
test eax, 0xf639d6a1
lcall 0xb5a6, 0x47619494
sub eax, 0xf01a1e3d
or byte [ecx], bh
jnp 0x4ac6d8
retf 0x60ea

Function at 0x4ac735
Capabilities:
Encode data using xor

Disassembly:
xor dl, cl
ljmp 0xb748
cmp byte [0xfed67b67], cl
dec ecx
inc ebx
dec byte [ecx + 0x43]
das
shl dword [0x89f7d905], 1
mov dword [ecx], edx
popfd
push ss
out 0x59, eax
clc
mov dword [ecx], edx
popfd
push ss
out 0x59, eax
clc
jecxz 0x4ac706
mov edx, 0x6d047ce
je 0x4ac727
inc esp
mov ch, 0xb7
stosb byte es:[edi], al
imul eax, ebp, 0x9551250a
mov byte [ecx - 0x2b], ah
jo 0x4ac7c7
dec ecx
je 0x4ac72c
lea esi, [edi + ecx*8]
adc esp, dword [ecx + 0x49d18828]
hlt
Function at 0x583125
Capabilities:
Encode data using xor

Disassembly:
popal
sub dword [edx - 0x5a], 0x2f1f907e
pushal
mov dl, 0xd7
xor esi, ebp
add eax, 0x37b5730f
stosd dword es:[edi], eax
not byte [edi + 0x6a]
inc esi
jae 0x583143
dec ebx
mov eax, 0x8bb230bb
mov dl, 0x8b
stc
pop ds
pop ss
mov bl, 0x31
invalid
Function at 0x5d95c5
Capabilities:
Encode data using xor

Disassembly:
or dh, ch
repne scasb al, byte es:[edi]
wait
sbb dword [edi + eax*2 + 0x142c4594], ebx
add byte [eax + 0x22], 0x34
and bl, byte [eax + 0x2ed70860]
add dword [edx + eax], eax
pushal
or bh, dl
add dword cs:[edx + eax], eax
xor byte [esi + 0xdcee24d], 0x16
test byte [edx + 0x528679fd], ah
adc bl, byte [edx + 0x5f]
outsd dx, dword [esi]
out dx, al
in al, dx
xchg edx, eax
js 0x5d95d7
jp 0x5d95f8
inc ecx
jl 0x5d960a
ret
aas
cmpsd dword [esi], dword es:[edi]
xchg dword [ebx + 0x4b714b80], edx
dec eax
sal dword [edx + 0x5756f359], cl
call 0x61993853
add al, bl
push eax
push edi
cmc
Function at 0x12c16
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea edx, [ebp - 0xc]
mov ecx, 0x1a46c
mov esi, eax
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
cmp byte [0x1a220], 0
je 0x12c45
mov esi, 0xc0000010
jmp 0x12c54
mov dword [0x1a218], esi
mov byte [0x1a220], 1
xor esi, esi
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov ecx, dword [ebp + 8]
and dword [ecx + 0x1c], 0
xor dl, dl
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
leave
ret 8

Function at 0x12c7c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0xc]
test esi, esi
je 0x12ce4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x20
jb 0x12ce4
cmp dword [0x1a738], 0
mov ebx, 0x1a228
jne 0x12cba
push 0
push 0x640000
push 0x1a738
call fcn.0001288a
test eax, eax
jl 0x12cd4
cmp dword [0x1a228], 0
jne 0x12cf4
push 0
push 0x40000
push ebx
call fcn.0001288a
test eax, eax
jge 0x12cf4
push 0x1a738
call fcn.000129ac
push ebx
call fcn.000129ac
and dword [edi + 0x1c], 0
mov eax, 0xc0000001
mov dword [edi + 0x18], eax
mov esi, eax
jmp 0x12d3c
mov eax, dword [0x1a73c]
cdq
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [0x1a748]
mov dword [esi + 8], eax
mov eax, dword [0x1a74c]
mov dword [esi + 0xc], eax
mov eax, dword [0x1a22c]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0x1a238]
mov dword [esi + 0x18], eax
mov eax, dword [0x1a23c]
mov dword [esi + 0x1c], eax
call fcn.0001214e
xor esi, esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], 0x20
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x12d54
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.000122a2
mov esi, dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea edx, [ebp - 0x10]
mov ecx, 0x1a46c
call esi
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
and dword [0x1a218], 0
lea ecx, [ebp - 0x10]
mov byte [0x1a220], 0
call ebx
call fcn.000113a8
call fcn.00011acc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.NDIS.SYS_NdisInitializeEvent]
push 0x3e8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.NDIS.SYS_NdisWaitEvent]
lea edx, [ebp - 0x10]
mov ecx, 0x1a224
call esi
mov edi, 0x1a6d8
jmp 0x12df1
mov ecx, eax
mov eax, dword [eax]
mov dword [0x1a6d8], eax
mov dword [eax + 4], edi
lea eax, [ecx - 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
mov byte [eax + 0xb0], 0
call ebx
push dword [ebp - 4]
call fcn.00011874
lea edx, [ebp - 0x10]
mov ecx, 0x1a224
call esi
mov eax, dword [0x1a6d8]
cmp eax, edi
jne 0x12dc1
lea ecx, [ebp - 0x10]
call ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.NDIS.SYS_NdisInitializeEvent]
push 0x3e8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.NDIS.SYS_NdisWaitEvent]
call fcn.00012a86
call fcn.00011fc2
push 0x1a738
call fcn.000129ac
push 0x1a228
call fcn.000129ac
mov ecx, dword [ebp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x132b4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x132d4
mov ebx, 0xc000000d
jmp 0x13375
test byte [eax + 6], 5
je 0x132df
mov eax, dword [eax + 0xc]
jmp 0x132ed
push 0x10
push ecx
push ecx
push 1
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test eax, eax
je 0x13368
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 8
jb 0x13368
lea edx, [ebp - 0xc]
mov ecx, 0x1a46c
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea eax, [esi + 0x38]
mov ecx, 0x1325c
mov edx, eax
xchg dword [edx], ecx
cmp byte [esi + 0x24], 0
je 0x13329
xor ecx, ecx
xchg dword [eax], ecx
test ecx, ecx
je 0x13329
mov ebx, 0xc0000120
jmp 0x1334e
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
mov ecx, dword [0x1a754]
lea eax, [esi + 0x58]
mov dword [eax], 0x1a750
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x1a754], eax
mov ebx, 0x103
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
push 0
push 0
push 0x1a240
call dword [sym.imp.ntoskrnl.exe_KeInsertQueueDpc]
jmp 0x1336d
mov ebx, 0xc000009a
cmp ebx, 0x103
je 0x13386
and dword [esi + 0x1c], 0
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x13ec0
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
cmp dword [0x1a21c], esi
jne 0x13f08
push 0x183f2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x1a21c], eax
cmp eax, esi
jne 0x13f08
mov eax, 0xc0000001
jmp 0x13fc2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x13fc2
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
cmp edi, esi
jge 0x13f43
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x13fc1
push ebx
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x1b
push dword [ebp - 8]
call dword [0x1a21c]
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x13fa3
push 0x33544c46
push dword [ebp - 4]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
cmp edi, esi
je 0x13fa3
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x1b
push dword [ebp - 8]
call dword [0x1a21c]
mov ebx, eax
cmp ebx, esi
jl 0x13f9b
cmp dword [ebp - 4], esi
je 0x13f9b
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x13fa3
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 8], esi
je 0x13fb1
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
je 0x13fbe
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x13fcc
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x13ff3
push esi
mov esi, dword [ebp + 0xc]
push 4
pop edx
cmp dword [esi + 4], edx
pop esi
jb 0x13ff3
mov dword [eax], 2
mov dword [ecx + 0x1c], edx
jmp 0x13ff7
and dword [ecx + 0x1c], 0
and dword [ecx + 0x18], 0
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
pop ebp
ret 8
Function at 0x147a4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea edx, [ebp - 0xc]
mov ecx, 0x1a46c
xor bl, bl
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
mov eax, dword [0x1a750]
mov ecx, 0x1a750
cmp eax, ecx
je 0x1485c
cmp dword [0x1a758], 0x1a758
je 0x1485c
lea esi, [eax - 0x58]
xor edx, edx
lea edi, [esi + 0x38]
xchg dword [edi], edx
test edx, edx
jne 0x147f3
mov eax, dword [eax]
cmp eax, ecx
jne 0x147dd
jmp 0x147ff
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov bl, 1
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
test bl, bl
je 0x14865
mov eax, dword [esi + 4]
xor ebx, ebx
test byte [eax + 6], 5
je 0x1481c
mov edi, dword [eax + 0xc]
jmp 0x1482c
push 0x20
push ebx
push ebx
push 1
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov edi, eax
cmp edi, ebx
jne 0x14846
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], 0xc000009a
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x14865
call fcn.000146ac
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 8
jmp 0x1483a
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x150aa
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
xor edi, edi
test byte [eax + 6], 5
je 0x150cb
mov eax, dword [eax + 0xc]
jmp 0x150d9
push 0x10
push edi
push edi
push 1
push edi
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
cmp eax, edi
je 0x150fd
cmp ebx, 8
jb 0x150fd
push dword [eax]
call fcn.00014f8a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x15111
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8