joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4418e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x45c724]
mov dword [ebp - 4], eax
jmp 0x4418f9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x441916
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x4418f0
mov esp, ebp
pop ebp
ret

Function at 0x441920
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x45c734], eax
je 0x44193e
mov eax, 0x10dd
jmp 0x441a1f
mov eax, dword [0x45c744]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4419bc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x44199a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x44199a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00441a90
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00430f33
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x441946
mov dword [0x45c744], 0
call fcn.00441a30
mov ecx, dword [0x45c740]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x441a09
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00430f33
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x4419d4
mov dword [0x45c740], 0
mov dword [0x45c734], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x441f90
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x441fa5
xor eax, eax
jmp 0x44201a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x441fd2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x442015
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x442013
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x44200f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x442013
xor eax, eax
jmp 0x44201a
jmp 0x441fc9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4420c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x45c738], 0
je 0x4420d9
mov eax, dword [0x45c738]
jmp 0x442179
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x4420eb
xor eax, eax
jmp 0x442179
push 8
call fcn.004310d9
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x442141
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x44212a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00430f33
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x45c738], eax
mov dword [0x45c73c], 0
mov eax, dword [ebp - 4]
jmp 0x442179
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x44215b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x44210b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x45c740]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x45c740], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4429a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00442a70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x442a5c
cmp dword [ebp - 4], 0x50000000
jb 0x4429dc
cmp dword [ebp - 4], 0x80000000
ja 0x4429dc
mov dword [ebp - 4], 0x80010000
jmp 0x4429b5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00433910
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x442a02
jmp 0x442a5c
cmp dword [ebp - 0x10], 0x10000
jne 0x442a45
cmp dword [ebp - 0x14], 0x10000
jb 0x442a45
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x442a38
mov eax, dword [ebp - 0x24]
jmp 0x442a5e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x442a57
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00442a70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4429b5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x442aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00442b70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x442b64
cmp dword [ebp - 4], 0x50000000
jb 0x442ae1
cmp dword [ebp - 4], 0x80000000
ja 0x442ae1
mov dword [ebp - 4], 0x4fff0000
jmp 0x442aba
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00433910
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x442b07
jmp 0x442b64
cmp dword [ebp - 0x10], 0x10000
jne 0x442b4a
cmp dword [ebp - 0x14], 0x10000
jb 0x442b4a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x442b3d
mov eax, dword [ebp - 0x24]
jmp 0x442b66
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x442b5f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00442b70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x442aba
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x12cd8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor edi, edi
push edi
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoGetRelatedDeviceObject]
cmp dword [ebp + 0x14], edi
mov dword [ebp - 4], eax
jne 0x14d6e
xor esi, esi
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
push edi
push edi
push edi
push dword [ebp - 4]
push 3
call dword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
mov ebx, eax
cmp ebx, edi
je 0x16257
mov eax, dword [ebx + 0x60]
mov cl, byte [ebp + 0x1c]
mov dword [ebx + 4], esi
mov esi, dword [ebp + 0xc]
mov byte [eax - 0x23], cl
mov ecx, dword [ebp + 8]
mov dword [eax - 0xc], ecx
mov ecx, dword [ebp + 0x10]
sub eax, 0x24
lea edi, [eax + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x60]
mov ecx, dword [ebp - 4]
sub eax, 0x24
xor edi, edi
mov edx, ebx
mov dword [eax + 0x1c], 0x106b7
mov dword [eax + 0x20], edi
mov byte [eax + 3], 0xe0
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov esi, eax
cmp esi, 0x103
je 0x13b73
mov eax, 0xc0000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
je 0x12da6
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeReadStateEvent]
test eax, eax
je 0x1626c
cmp esi, edi
jl 0x12dad
mov esi, dword [ebp - 0xc]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret 0x18
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov esi, eax
jmp 0x12da6
push edi
push edi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call dword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov esi, eax
cmp esi, edi
je 0x1624d
push esi
call dword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
jmp 0x12d08
mov eax, 0xc000009a
jmp 0x12db0
cmp esi, edi
je 0x16262
push esi
call dword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, 0xc000009a
jmp 0x12daf
push 0x16298
call sub.ntoskrnl.exe_DbgPrint
push ebx
push 0x162d0
call sub.ntoskrnl.exe_DbgPrint
push 0x1632c
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
call sub.ntoskrnl.exe_DbgBreakPoint
jmp 0x12da6
Function at 0x15070
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
push 0x80
push 0x125a0
push 1
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
je 0x15fea
mov eax, dword [ebp + 0x10]
leave
ret 0xc
cmp dword [0x125ac], 4
jne 0x150aa
mov eax, dword [0x125a8]
lea eax, [eax + 0x125a0]
push 4
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jl 0x150aa
cmp eax, dword [ebp + 0x10]
je 0x150ad
cmp byte [0x12580], 0
mov ecx, 0x16056
jne 0x16039
mov ecx, 0x16062
push dword [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
push 0x1606a
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [ebp - 4]
add esp, 0x14
jmp 0x150ad

Function at 0x1765c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
inc edi
push edi
push dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov eax, dword [0x12660]
xor esi, esi
cmp eax, esi
je 0x176e2
push edi
push esi
push esi
push esi
push 4
push 0x12728
push edi
push 0x12650
push esi
push eax
call dword [sym.imp.ntoskrnl.exe_ZwNotifyChangeKey]
cmp eax, esi
jl 0x176c1
lea edi, [esi + 0x124d4]
mov eax, dword [edi]
push dword [eax]
push dword [esi + 0x124d0]
push dword [0x12660]
call fcn.00015070
mov ecx, dword [edi]
add esi, 8
cmp esi, 0x28
mov dword [ecx], eax
jae 0x176f4
jmp 0x17698
push eax
push 0x17706
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push dword [0x12660]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [0x12660], esi
jmp 0x176f4
push esi
push edi
push 0x17482
push dword [0x127a0]
call sub.ntoskrnl.exe_IoQueueWorkItem
mov ecx, dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
pop edi
pop esi
ret 4
Function at 0x1775f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1253c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x24], 0x400
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x200
mov dword [ebp - 0x18], 0x300
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], 4
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
push edi
push edi
push edi
add eax, 0x1c
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x10]
push 0x128004
call dword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
mov ebx, eax
cmp ebx, edi
jne 0x177e2
mov eax, 0xc000009a
jmp 0x1784f
mov ecx, dword [esi + 0xc]
mov eax, dword [ebx + 0x60]
mov dword [eax - 0xc], ecx
mov ecx, dword [esi + 0x10]
mov edx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x1780d
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x1784d
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x1784d
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_KeReadStateEvent]
test eax, eax
jne 0x1784d
push 0x1785e
call sub.ntoskrnl.exe_DbgPrint
push ebx
push 0x17896
call sub.ntoskrnl.exe_DbgPrint
push 0x178f2
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
call sub.ntoskrnl.exe_DbgBreakPoint
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00010703
leave
ret 8
Function at 0x188b6
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
cmp byte [ebx + 1], 7
push esi
push edi
mov dword [ebp - 4], ecx
jne 0x18932
cmp dword [ebx + 4], 4
jne 0x18932
mov eax, dword [ebx + 0x18]
mov esi, dword [eax + 0xc]
movzx eax, word [esi]
sub eax, 0xafd1
je 0x18919
dec eax
je 0x188eb
dec eax
dec eax
je 0x18919
dec eax
dec eax
jne 0x18932
push esi
call fcn.0001c704
mov edi, eax
test edi, edi
je 0x18919
push ebx
push dword [ebp - 4]
push dword [edi + 0xc]
call fcn.00018178
mov esi, eax
lea eax, [edi + 0x20]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x18949
push edi
call fcn.0001c0b1
jmp 0x18949
mov al, byte [esi + 2]
cmp al, 2
je 0x18924
cmp al, 3
jne 0x18932
push ebx
push dword [ebp - 4]
push dword [esi + 0x10]
call fcn.00018178
jmp 0x1894b
mov ecx, dword [ebp - 4]
mov esi, 0xc0000010
mov dword [ecx + 0x18], esi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1a4e6
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00012f53
push 1
push dword [ebp + 0x14]
mov ebx, eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0x28]
push dword [ebp + 0xc]
push dword [esi + 0x30]
push dword [eax + 0x30]
call dword [sym.imp.ntoskrnl.exe_IoSetIoCompletion]
push ebx
push esi
mov edi, eax
call fcn.00012f98
test edi, edi
jge 0x1a54b
cmp dword [ebp + 0x10], 0xc0000120
je 0x1a54b
push dword [ebp + 0xc]
push esi
call fcn.0002bad4
test eax, eax
je 0x1a547
mov dword [eax + 0x18], edi
mov dl, byte [0x12011]
mov ecx, eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor al, al
jmp 0x1a54d
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1b290
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x60]
push esi
push edi
mov edi, dword [edx + 0xc]
mov eax, edi
shr eax, 2
and eax, 0x3ff
cmp eax, 0x46
jae 0x21bf3
mov esi, eax
shl esi, 2
cmp dword [esi + 0x120a0], edi
jne 0x21bf3
mov byte [edx + 1], al
mov esi, dword [esi + 0x121b8]
test esi, esi
je 0x21bf3
call esi
pop edi
pop esi
pop ebp
ret 8
mov esi, 0xc0000010
mov dword [ecx + 0x18], esi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x1b2d7
Function at 0x1c010
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
add ecx, 0x1c
push edi
lea edx, [ebp - 0xc]
mov dword [ebp + 0xc], ecx
call ebx
mov edi, dword [ebp + 8]
cmp dword [edi], edi
jne 0x2246e
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
pop edi
pop ebx
leave
ret 0x10
push esi
mov eax, dword [edi]
mov ecx, dword [eax]
mov dword [edi], ecx
lea esi, [eax - 0x58]
mov dword [ecx + 4], edi
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x2248b
and dword [esi + 0x58], eax
jmp 0x224c2
cmp dword [ebp + 0x14], 0
je 0x22499
push esi
call dword [ebp + 0x14]
test al, al
je 0x224c2
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov eax, dword [ebp + 0x10]
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
call ebx
cmp dword [edi], edi
jne 0x2246f
pop esi
jmp 0x1c039
Function at 0x1d0a2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
push edi
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
sub dword [esi + 0x50], ecx
dec dword [esi + 0x54]
mov ecx, dword [esi + 0x54]
xor edx, edx
cmp dword [eax + 0x18], edx
jl 0x242a4
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x64]
lea eax, [esi + 0x48]
setb byte [ebp + 0xb]
cmp dword [eax], eax
jne 0x2431e
test byte [esi + 6], 1
jne 0x242d9
cmp byte [ebp + 0xb], 0
je 0x1d107
push edx
push 4
push ebx
call fcn.000103d2
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [ebp + 0xb], 0
je 0x1d126
test byte [ebx + 0xe], 1
je 0x1d126
push 0
push 4
push ebx
call fcn.00010545
pop edi
pop esi
pop ebx
leave
ret 8
mov edi, dword [esi + 0x58]
cmp edi, edx
je 0x242ae
mov dword [esi + 0x58], edx
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
push esi
call fcn.0001fb6b
test edi, edi
je 0x242cc
mov ecx, dword [esi + 0x10]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
push 0
push esi
call fcn.0001c5e5
jmp 0x1d126
mov edi, dword [esi + 0x58]
cmp edi, edx
je 0x242e9
cmp ecx, edx
jne 0x242e9
mov dword [esi + 0x58], edx
jmp 0x242fa
xor edi, edi
cmp byte [ebp + 0xb], 0
je 0x242fa
push edx
push 4
push ebx
call fcn.000103d2
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
test edi, edi
jne 0x242c1
cmp byte [ebp + 0xb], 0
je 0x242cc
test byte [ebx + 0xe], 1
je 0x242cc
push edi
push 4
push ebx
call fcn.00010545
jmp 0x242cc
lea ecx, [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x50]
cmp ecx, dword [esi + 0x64]
jbe 0x24336
mov ecx, dword [eax]
cmp ecx, dword [esi + 0x4c]
jne 0x24364
cmp dword [eax], eax
je 0x24364
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [edx + 4], eax
xor edx, edx
lea edi, [ecx - 0x20]
xchg dword [edi], edx
test edx, edx
jne 0x24352
and dword [ecx], edx
jmp 0x24327
mov edx, dword [ebp - 4]
lea edi, [ebp - 8]
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov dword [edx], ecx
mov dword [ebp - 4], ecx
jmp 0x24327
cmp byte [ebp + 0xb], 0
je 0x24374
push 0
push 4
push ebx
call fcn.000103d2
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x243a5
mov eax, dword [ecx]
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov dword [eax + 4], edx
add ecx, 0xffffffa8
or eax, 0xffffffff
lea edx, [ecx + 0x40]
xchg dword [edx], eax
test eax, eax
je 0x243a5
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
cmp ecx, eax
je 0x1d110
jmp 0x2437f
Function at 0x1f0b8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
cmp word [ebp + 8], 0x11
push esi
push edi
jne 0x1f14c
cmp dword [ebp + 0xc], 0
je 0x1f14c
mov esi, dword [0x127d0]
mov edi, 0x127d0
cmp esi, edi
je 0x1f146
push 1
lea eax, [esi + 0x10]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
call dword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x1f14c
mov esi, dword [esi]
jmp ExRaiseDatatypeMisalignment
lea ecx, [ebp - 0x2c]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
cmp esi, eax
pop ebx
je 0x1f146
xor edi, edi
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
mov dword [eax + 4], ecx
cmp byte [esi + 0xe], 0
jne 0x22716
mov ecx, dword [esi + 8]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
cmp esi, eax
jne MmQuerySystemSize
pop edi
pop esi
leave
ret 8
lea eax, [ebp - 0x14]
push ebx
lea edx, [ebp - 0x2c]
mov ecx, 0x12740
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
mov ebx, dword [0x12748]
jmp 0x1f18b
test ax, ax
je 0x1f1cb
jmp 0x1f18b
cmp eax, dword [edx + 0x8c]
je 0x1f1d2
jmp 0x1f18b
cmp dword [edi + 4], edx
jne 0x2270e
jmp 0x1f230
cmp ebx, 0x12748
je DbgPrint
lea eax, [ebx + 0xe]
cmp byte [eax], 0
mov dword [ebp + 0xc], eax
lea eax, [ebx + 8]
mov esi, ebx
mov dword [ebp - 8], eax
jne 0x226ef
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0x60]
lea edi, [eax + 4]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
mov ax, word [ebp + 8]
cmp word [esi + 0xc], ax
mov ebx, dword [ebx]
jne 0x1f16c
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1f173
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0xc]
and dword [esi], 0
cmp byte [eax], 0
jne ExAcquireResourceSharedLite
mov ecx, dword [ebp - 0xc]
xor eax, eax
add ecx, 0x38
xchg dword [ecx], eax
test eax, eax
je 0x1f18b
lea ecx, [edx + 0x1c]
lea edx, [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
mov ecx, dword [edi]
xor edx, edx
cmp ecx, edx
je KeInitializeSpinLock
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
cmp byte [eax], dl
jne 0x226f9
lea ecx, [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
jmp 0x1f18b
mov edx, dword [eax]
lea edi, [ebx - 0x10]
jmp 0x1f1bf
mov eax, dword [ebp - 8]
push edx
push 0x1000
push dword [eax]
call fcn.000103d2
jmp 0x1f230
mov dword [edi + 4], edx
jmp 0x1f230
mov eax, dword [esi + 8]
test byte [eax + 0xe], 1
je 0x2272b
push edi
push 0x1000
push eax
call fcn.00010545
push 0xe8646641
add esi, 0xfffffff0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1f13c