joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001db74
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x1003eb1c]
add edi, 0xffffdb6c
mov dword [0x1003eb18], edi
mov dword [0x1003eb24], 0
mov byte [0x1003eb28], 0
mov dword [0x1003eb1c], 0x1f5
mov dword [0x1003eb20], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1001dbde
xor eax, eax
mov dword [0x1003eb20], 0
mov dword [ebp - 0x20], eax
jmp 0x1001dc06
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1003eb20]
add eax, 1
mov dword [0x1003eb20], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1001dbde
jmp 0x1001dbcd
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1003eb2c], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x1003eb1c], 0x12d9
mov edi, dword [0x1003eb24]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1003eb2c], esi
mov dword [0x1003eb18], 0x1d57
mov eax, esi
cdq
idiv ecx
mov dword [0x1003eb24], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x1003eb28], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x1003eb28]
mov esi, dword [0x1003eb24]
mov byte [ebx + esi], cl
mov dword [0x1003eb18], 0x13c
mov esi, dword [0x1003eb20]
add esi, 1
mov dword [0x1003eb20], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1001dc06
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001dd5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1003eb20], 0
mov dword [0x1003eb24], 0
mov dword [0x1003eb30], 0
mov dword [0x1003eb18], 0x201d
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x1001ddd8
mov eax, dword [0x1003eb1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x3b1
mov dword [0x1003eb1c], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x1003eb18], 0x1361
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1003eb20], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1003eb24], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1003eb28], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1003eb28]
mov edx, dword [0x1003eb24]
mov byte [edi + edx], cl
mov edx, dword [0x1003eb20]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1003eb24]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1003eb30], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov dword [0x1003eb18], 0x1056
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x3c], edx
je 0x1001ddbb
mov eax, dword [0x1003eb24]
mov ecx, dword [0x1003eb20]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x1001ddd8
Function at 0x1001e3ae
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1003eb18], 0x1243
mov dword [0x1003eb1c], 0x2000
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1001e4b9
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.1001e64e
mov dword [0x1003eb1c], 0xa05
mov eax, dword [ebp - 0x38]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xc0
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x1c47
mov edx, dword [ebp - 0x38]
mov dword [edx + 0xc0], 0x4550
add edx, 0xffc00000
mov esi, dword [ebp - 0x2c]
mov dword [esi + 4], edx
mov edx, dword [ebp - 0x38]
mov dword [esi + 0x2c], edx
mov dword [0x1003eb18], 0x138f
cmp edx, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x1001e477
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x54
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x1003eb1c], 0x14aa
mov dword [ebp - 0x44], eax
call fcn.1001dec1
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov ecx, dword [ebp - 0x44]
mov dword [esp + 4], ecx
call fcn.1001e06e
cmp eax, 0
mov dword [ebp - 0x34], eax
je 0x1001e4e1
jmp 0x1001e3df
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1001f4cc]
mov dl, byte [eax + 0x1001f49d]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
je 0x1001e480
jmp 0x1001e4b9
xor eax, eax
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x4014be
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x40e338
xor ebx, ebx
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 1], al
mov eax, dword [edi + 0x18]
cdq
push edx
push eax
push dword [0x40e360]
call fcn.00405666
test eax, eax
je 0x401641
push esi
lea esi, [eax - 8]
lea eax, [esi + 0x3ac]
mov ecx, eax
mov dword [ebp - 8], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [edi + 4]
mov dl, al
sub ecx, ebx
je 0x401609
sub ecx, 1
je 0x4015dc
dec ecx
sub ecx, 1
je 0x4015af
sub ecx, 1
je 0x40157c
sub ecx, 1
je 0x401549
dec ecx
sub ecx, 1
je 0x40153f
sub ecx, 1
jne 0x401637
mov ebx, 0xc0000184
jmp 0x401637
mov eax, dword [edi + 8]
test eax, eax
je 0x40156b
mov dword [esi + 0x108], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x10c], eax
mov dword [edi + 8], 0x4085f0
jmp 0x401626
and dword [esi + 0x108], ebx
and dword [esi + 0x10c], ebx
jmp 0x401637
mov eax, dword [edi + 8]
test eax, eax
je 0x40159e
mov dword [esi + 0xf0], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xf4], eax
mov dword [edi + 8], 0x409d10
jmp 0x401626
and dword [esi + 0xf0], ebx
and dword [esi + 0xf4], ebx
jmp 0x401637
mov eax, dword [edi + 8]
test eax, eax
je 0x4015ce
mov dword [esi + 0xe0], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xe4], eax
mov dword [edi + 8], 0x408480
jmp 0x401626
and dword [esi + 0xe0], ebx
and dword [esi + 0xe4], ebx
jmp 0x401637
mov eax, dword [edi + 8]
test eax, eax
je 0x4015fb
mov dword [esi + 0xd0], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xd4], eax
mov dword [edi + 8], 0x4074d0
jmp 0x401626
and dword [esi + 0xd0], ebx
and dword [esi + 0xd4], ebx
jmp 0x401637
mov eax, dword [edi + 8]
test eax, eax
je 0x40162b
mov dword [esi + 0xc8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xcc], eax
mov dword [edi + 8], 0x406c20
mov dword [edi + 0xc], esi
jmp 0x401637
and dword [esi + 0xc8], ebx
and dword [esi + 0xcc], ebx
mov ecx, dword [ebp - 8]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop esi
mov dl, byte [ebp - 1]
mov ecx, 0x40e338
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop edi
test ebx, ebx
pop ebx
jns 0x40166c
mov ecx, dword [ebp + 8]
xor dl, dl
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x40167f
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
leave
ret 0xc
Function at 0x401c18
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebx
push edi
mov edi, 0x40e3c8
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [0x40e378]
mov bl, al
cmp ecx, 0x40e378
je 0x401c91
push esi
mov edx, dword [ecx]
cmp dword [edx + 4], ecx
jne 0x401c9d
mov eax, dword [ecx + 4]
cmp dword [eax], ecx
jne 0x401c9d
mov dword [eax], edx
lea esi, [ecx - 0x58]
mov dword [edx + 4], eax
xor ecx, ecx
lea eax, [esi + 0x38]
xchg dword [eax], ecx
test ecx, ecx
je 0x401c82
mov dl, bl
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
and dword [esi + 0x1c], 0
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], 0xc0000120
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov bl, al
mov ecx, dword [0x40e378]
cmp ecx, 0x40e378
jne 0x401c38
pop esi
mov ecx, edi
mov dl, bl
pop edi
pop ebx
jmp dword [sym.imp.HAL.dll_KfReleaseSpinLock]
push 3
pop ecx
int 0x29

Function at 0x401cd8
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.00406240
mov edi, 0x40e338
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov esi, 0x40e3c8
mov bh, al
mov ecx, esi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
and dword [0x40e3dc], 0
mov bl, al
mov byte [0x40e3d8], 0
call fcn.00401ca2
mov dl, bl
mov ecx, esi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, bh
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
call fcn.00401c18
call fcn.00401d62
push 0x40d020
call fcn.00402aa2
push 0x40d038
call fcn.00402aa2
mov ecx, dword [ebp + 8]
xor dl, dl
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x401ed2
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, 0x40e338
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, 0x40e3c8
mov bl, al
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [0x40e378]
mov edx, 0x40e378
mov bh, al
cmp ecx, edx
je 0x40200e
push esi
cmp dword [ecx + 4], edx
jne 0x40202b
mov eax, dword [ecx]
cmp dword [eax + 4], ecx
jne 0x40202b
mov dword [0x40e378], eax
mov dword [eax + 4], edx
cmp ecx, edx
je 0x401fff
lea esi, [ecx - 0x58]
mov dword [ecx + 4], ecx
mov dword [ecx], ecx
lea eax, [esi + 0x38]
xor ecx, ecx
xchg dword [eax], ecx
test ecx, ecx
je 0x401fff
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x60]
mov dword [ebp - 4], ecx
test byte [eax + 6], 5
je 0x401f57
mov edi, dword [eax + 0xc]
jmp 0x401f6c
push 0x10
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
je 0x401fb6
cmp dword [ecx + 4], 8
jb 0x401fb6
push dword [0x40d030]
push dword [0x40d028]
call fcn.0040297a
and dword [edi + 4], 0
mov dl, bh
mov ecx, 0x40e3c8
mov dword [edi], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov edi, 0x40e338
mov dl, bl
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], 8
jmp 0x401fd9
mov dl, bh
mov ecx, 0x40e3c8
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov edi, 0x40e338
mov dl, bl
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dword [esi + 0x18], 0xc000009a
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, 0x40e3c8
mov bl, al
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov edx, 0x40e378
mov bh, al
mov ecx, dword [0x40e378]
cmp ecx, edx
jne 0x401f08
pop esi
mov dl, bh
mov ecx, 0x40e3c8
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, bl
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop edi
xor eax, eax
pop ebx
leave
ret
push 3
pop ecx
int 0x29
call fcn.00401ed2
ret 0x10

Function at 0x40278c
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edi, 0x40e3c8
mov esi, eax
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
cmp byte [0x40e3d8], 0
je 0x4027b6
mov esi, 0xc0000010
jmp 0x4027c5
mov dword [0x40e3dc], esi
xor esi, esi
mov byte [0x40e3d8], 1
mov dl, al
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
test esi, esi
jne 0x4027d8
call fcn.00401982
mov ecx, dword [ebp + 8]
xor dl, dl
and dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x402ce8
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x402d4f
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x20
jb 0x402d4f
cmp dword [0x40d020], esi
jne 0x402d1f
push esi
push 0x640000
push 0x40d020
call fcn.004027f2
test eax, eax
js 0x402d3b
cmp dword [0x40d038], esi
jne 0x402d6f
push esi
push 0x40000
push 0x40d038
call fcn.004027f2
test eax, eax
jns 0x402d6f
push 0x40d020
call fcn.00402aa2
push 0x40d038
call fcn.00402aa2
mov eax, 0xc0000001
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov esi, eax
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [0x40d024]
cdq
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [0x40d030]
mov ecx, dword [0x40d034]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov eax, dword [0x40d03c]
cdq
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
mov eax, dword [0x40d048]
mov ecx, dword [0x40d04c]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], 0x20
jmp 0x402d5c

Function at 0x403a30
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov eax, dword [esi + 4]
test byte [eax + 6], 5
je 0x403a4a
mov ebx, dword [eax + 0xc]
jmp 0x403a5a
push 0x10
push edi
push edi
push 1
push edi
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov ebx, eax
test ebx, ebx
je 0x403b34
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 8
jb 0x403b34
mov ecx, 0x40e338
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, 0x40e3c8
mov byte [ebp - 2], al
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push dword [0x40d030]
mov byte [ebp - 1], al
push dword [0x40d028]
call fcn.0040297a
mov dword [ebx], eax
lea edx, [esi + 0x38]
mov dword [ebx + 4], edi
cmp byte [esi + 0x24], 0
je 0x403ac0
xor eax, eax
xchg dword [edx], eax
test eax, eax
je 0x403ab9
mov edi, 0xc0000120
jmp 0x403b07
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
jmp 0x403ac2
mov ecx, edi
or eax, ecx
jne 0x403b07
mov ebx, 0x40e378
cmp dword [0x40e378], ebx
jne 0x403b07
mov eax, dword [esi + 0x60]
mov edi, 0x103
or byte [eax + 3], 1
lea eax, [esi + 0x58]
mov dword [esi + 0x18], edi
mov ecx, dword [0x40e37c]
cmp dword [ecx], ebx
je 0x403af4
push 3
pop ecx
int 0x29
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x40e37c], eax
mov eax, 0x401bb0
xchg dword [edx], eax
mov dl, byte [ebp - 1]
mov ecx, 0x40e3c8
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, byte [ebp - 2]
mov ecx, 0x40e338
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
cmp edi, 0x103
je 0x403b46
mov dword [esi + 0x1c], 8
jmp 0x403b39
mov edi, 0xc000009a
xor dl, dl
mov dword [esi + 0x18], edi
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404108
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [eax + 4]
mov eax, dword [esi + 4]
test byte [eax + 6], 5
je 0x404127
mov eax, dword [eax + 0xc]
jmp 0x404135
push 0x10
push ebx
push ebx
push 1
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test eax, eax
je 0x40415f
cmp edi, 8
jb 0x40415f
push dword [eax]
push dword [0x40d040]
call fcn.00402fb6
xor dl, dl
mov dword [esi + 0x1c], eax
mov ecx, esi
mov dword [esi + 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x404173
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x404306
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x40434b
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x27b
jb 0x40434b
push 0x284
call fcn.0040576e
test eax, eax
je 0x404363
push edi
lea edi, [eax + 8]
mov ecx, 0x9e
push dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.004059e8
xor esi, esi
pop edi
jmp 0x404350
mov esi, 0xc000000d
and dword [ebx + 0x1c], 0
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40436a
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x40439d
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x53
jb 0x40439d
push ecx
call fcn.00405ab6
movzx esi, al
neg esi
sbb esi, esi
and esi, 0x3fffffe9
add esi, 0xc0000017
jmp 0x4043a2
mov esi, 0xc000000d
and dword [edi + 0x1c], 0
xor dl, dl
mov ecx, edi
mov dword [edi + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x4043bc
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4043f2
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x27b
jb 0x4043f2
push ecx
call fcn.00405b30
movzx esi, al
neg esi
sbb esi, esi
and esi, 0x3fffffe9
add esi, 0xc0000017
jmp 0x4043f7
mov esi, 0xc000000d
and dword [edi + 0x1c], 0
xor dl, dl
mov ecx, edi
mov dword [edi + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x404410
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
call fcn.00406298
mov ecx, dword [ebp + 8]
xor dl, dl
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
pop ebp
ret 8
Function at 0x404432
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0xc]
test esi, esi
je 0x404453
mov eax, dword [ebp + 0xc]
push 4
pop edx
cmp dword [eax + 4], edx
jb 0x404453
mov dword [esi], 1
jmp 0x404455
xor edx, edx
mov dword [ecx + 0x1c], edx
xor dl, dl
and dword [ecx + 0x18], 0
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x40446c
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, dword [ecx + 4]
xor esi, esi
push edi
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
test eax, eax
je 0x4044ea
cmp dword [ecx + 8], 4
jb 0x4044ea
lea ecx, [ebp - 4]
push ecx
push dword [eax]
call fcn.0040468c
test eax, eax
js 0x4044ea
mov edi, dword [ebp - 4]
test edi, edi
je 0x4044ea
cmp dword [edi + 4], esi
je 0x4044e2
movzx eax, word [edi]
test ax, ax
je 0x4044e2
add eax, 2
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0xc]
jbe 0x4044d6
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, 0xc0000017
jmp 0x4044ea
push edi
shr eax, 1
push eax
push dword [ebp - 0x10]
call fcn.0040417a
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 8]
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x404506
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
call fcn.004062ea
mov ecx, dword [ebp + 8]
xor dl, dl
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
pop ebp
ret 8
Function at 0x404528
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov edx, dword [ecx + 0x60]
movzx eax, byte [edx]
sub eax, edi
je 0x40462d
sub eax, 3
je 0x404624
sub eax, 1
je 0x40461b
sub eax, 0xa
je 0x40456c
sub eax, 4
jne 0x4045e9
push edx
push ecx
call fcn.00401cd8
jmp 0x404634
mov eax, dword [edx + 0xc]
mov esi, 0x2201c0
cmp eax, esi
ja 0x4045d3
je 0x4045ca
sub eax, 0x12c800
je 0x4045c1
sub eax, 0xf3994
je 0x4045b8
sub eax, 4
je 0x4045af
sub eax, 4
je 0x4045a3
sub eax, 0x20
jne 0x4045e9
push edx
push ecx
call fcn.00404410
jmp 0x404634
push edx
push ecx
call fcn.00404432
jmp 0x404634
push edx
push ecx
call fcn.0040446c
jmp 0x404634
push edx
push ecx
call fcn.0040463a
jmp 0x404634
push edx
push ecx
call fcn.00402ce8
jmp 0x404634
push edx
push ecx
call fcn.0040436a
jmp 0x404634
sub eax, 0x2201c4
je 0x404612
sub eax, 0x10
je 0x404607
sub eax, 4
je 0x404604
sub eax, 4
je 0x4045fb
xor dl, dl
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x404634
push edx
push ecx
call fcn.004043bc
jmp 0x404634
push edi
jmp 0x404609
push 1
push edx
push ecx
call fcn.00404306
jmp 0x404634
push edx
push ecx
call fcn.00404506
jmp 0x404634
push edx
push ecx
call fcn.00404108
jmp 0x404634
push edx
push ecx
call fcn.00403a30
jmp 0x404634
push edx
push ecx
call fcn.0040278c
pop edi
pop esi
pop ebp
ret 8

Function at 0x40463a
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40466e
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], 0x11
jb 0x40466e
mov edi, dword [ecx + 4]
cmp edi, 0x11
jb 0x40466e
push eax
call fcn.00402b1e
mov dword [esi + 0x18], eax
test eax, eax
js 0x40466e
mov dword [esi + 0x1c], edi
xor edi, edi
jmp 0x40467a
and dword [esi + 0x1c], 0
mov edi, 0xc0000001
mov dword [esi + 0x18], edi
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8