joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000100c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ebp
nop
nop
mov ebp, esp
add esp, 7
add esp, 0xfffffff9
add esp, 2
sub esp, 2
add esp, 9
add esp, 0xfffffff7
add esp, 8
sub esp, 8
mov esp, ebp
pop ebp
xor eax, 1
add eax, 2
jne 0x1000103e
je 0x1000103e
call 0x930400c5
rol byte [ebx + eax*4], 0xf0
add eax, 0xc833db33
xor eax, 3
add eax, 4
xor eax, 5
xor ebx, ebx
xor ecx, eax
nop
mov ebx, dword fs:[0x30]
nop
nop
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001678
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ebp
nop
nop
mov ebp, esp
add esp, 7
add esp, 0xfffffff9
add esp, 2
sub esp, 2
add esp, 9
add esp, 0xfffffff7
add esp, 8
sub esp, 8
mov esp, ebp
pop ebp
xor eax, 1
add eax, 2
jne 0x100016aa
je 0x100016aa
call 0x93040731
rol byte [ebx + eax*4], 0xf0
add eax, 0xc833db33
xor eax, 3
add eax, 4
xor eax, 5
xor ebx, ebx
xor ecx, eax
nop
mov ebx, dword fs:[0x30]
nop
nop
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001970
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push ebp
nop
mov ebp, esp
push esi
pop esi
add esp, 9
add esp, 0xfffffff7
nop
nop
mov esp, ebp
pop ebp
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
push 0xcb2ce3db
call fcn.10001678
push eax
call fcn.100016db
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
xor ecx, ecx
mov cx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], 0
jmp 0x100019db
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 0x18], ecx
jge 0x10001aed
push ebp
nop
mov ebp, esp
add esp, 9
sub esp, 9
inc ecx
dec ecx
add esp, 2
add esp, 0xfffffffe
nop
mov esp, ebp
nop
pop ebp
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x10], 0
jne 0x10001a89
nop
push ebp
nop
mov ebp, esp
push esi
pop esi
add esp, 0xa
sub esp, 0xa
add esp, 6
sub esp, 6
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jle 0x10001a84
nop
push ebp
mov ebp, esp
push 0x695b
add esp, 7
sub esp, 7
test esi, esi
push ebx
pop ebx
mov esp, ebp
nop
pop ebp
push 4
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax + 0xc]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x100019c9
nop
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + 0xc]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x10], eax
nop
nop
push ebp
nop
mov ebp, esp
add esp, 0xa
add esp, 0xfffffff6
inc ecx
dec ecx
add esp, 9
add esp, 0xfffffff7
nop
mov esp, ebp
nop
nop
pop ebp
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
jmp 0x100019c9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001af4
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
nop
push ebp
nop
nop
mov ebp, esp
test esi, esi
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 8], eax
push 0xf77b2520
call fcn.10001678
push eax
call fcn.100016db
add esp, 8
mov dword [ebp - 0xc], eax
push 0x512a8158
call fcn.10001678
push eax
call fcn.100016db
add esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
jmp 0x10001b69
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 0x10], edx
jge 0x10001cbe
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x14], edx
nop
push ebp
mov ebp, esp
add esp, 7
add esp, 0xfffffff9
add esp, 1
add esp, 0xffffffff
add esp, 5
sub esp, 5
inc ecx
dec ecx
nop
nop
mov esp, ebp
pop ebp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
test ecx, ecx
je 0x10001c25
nop
nop
push ebp
mov ebp, esp
add esp, 3
add esp, 0xfffffffd
add esp, 1
sub esp, 1
add esp, 0xa
sub esp, 0xa
add esp, 7
add esp, 0xfffffff9
nop
mov esp, ebp
nop
pop ebp
push 0x4000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [ebp - 4]
jmp 0x10001b57
mov eax, dword [ebp - 0x18]
shl eax, 4
mov ecx, dword [ebp - 0x28]
lea edx, [eax + ecx*8 + 0x10005104]
mov eax, dword [ebp - 0x14]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
test eax, eax
je 0x10001c56
mov ecx, dword [ebp - 0x20]
or ch, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10001c9a
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x40
test edx, edx
je 0x10001c7f
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x10001c9a
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
test ecx, ecx
je 0x10001c9a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jbe 0x10001cb9
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [ebp - 0xc]
jmp 0x10001b57
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10cfc
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1f870]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
lea ecx, [ebp - 0x404]
mov word [ebp - 0x40a], 0x400
mov word [ebp - 0x40c], bx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], ebx
je 0x10ddc
push esi
push edi
push eax
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
push 0x10cbe
lea eax, [ebp - 0x40c]
push eax
call esi
movzx eax, word [ebp - 0x40c]
push dword [ebp - 0x408]
mov edi, dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
push ebx
mov dword [ebp + eax - 0x404], ebx
call edi
push 0x10cd6
lea eax, [ebp - 0x40c]
push eax
call esi
movzx eax, word [ebp - 0x40c]
push dword [ebp - 0x408]
mov dword [ebp + eax - 0x404], ebx
push ebx
call edi
movzx eax, word [ebp - 0x40c]
push 4
mov dword [ebp + eax - 0x404], ebx
lea eax, [ebp - 0x410]
push eax
push 4
push 0x10cf2
push dword [ebp - 0x408]
mov dword [ebp - 0x410], 1
push ebx
call dword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.00011c64
leave
ret 4

Function at 0x11f88
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 0x27]
push eax
movzx eax, byte [esi + 0x26]
push eax
movzx eax, byte [esi + 0x25]
push eax
movzx eax, byte [esi + 0x24]
push eax
movzx eax, byte [esi + 0x23]
push eax
movzx eax, byte [esi + 0x22]
push eax
movzx eax, byte [esi + 0x21]
push eax
movzx eax, byte [esi + 0x20]
push eax
movzx eax, byte [esi + 0x1f]
push eax
movzx eax, byte [esi + 0x1e]
push eax
movzx eax, byte [esi + 0x1d]
push eax
movzx eax, byte [esi + 0x1c]
push eax
push 0x11efe
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x34
cmp byte [ebp + 0xc], 0
je 0x1200e
movzx eax, word [esi + 8]
push eax
push 0x11f3a
call sub.ntoskrnl.exe_DbgPrint
push dword [esi + 0x18]
push 0x11f4a
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [esi + 0x14]
push eax
push 0x11f66
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
pop esi
pop ebp
ret 8

Function at 0x12018
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
or ecx, 0xffffffff
cmp word [ebp + 0xc], 0
jbe 0x1204a
mov eax, dword [ebp + 8]
push esi
movzx esi, word [ebp + 0xc]
xor edx, edx
mov dl, byte [eax]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x1f878]
inc eax
dec esi
jne 0x1202f
pop esi
movzx eax, ch
mov ah, cl
mov edx, ecx
shr edx, 0x10
movzx edx, dl
shr ecx, 0x18
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
pop ebp
ret 8
Function at 0x1a688
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
movzx ecx, byte [ebp + 0x10]
xor eax, eax
push ebx
inc eax
shl eax, cl
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x14]
or dword [esi + 0xc8], eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [esi + ecx*4 + 0x48], edi
test byte [edi + 0x256], 1
mov dword [ebp + 0x10], eax
je 0x1a6be
or byte [esi + 8], 1
jmp 0x1a6c2
and byte [esi + 8], 0xfe
cmp byte [edi + 0xc], 0x81
jne 0x1a6e1
push 0x1a672
call sub.ntoskrnl.exe_DbgPrint
pop ecx
push 0
push edi
call fcn.00011f88
or byte [esi + 8], 8
jmp 0x1a6e5
and byte [esi + 8], 0xf7
test byte [esi + 8], 1
je 0x1a6fd
push dword [ebp + 0x10]
lea esi, [ebx + 0x34]
push esi
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
push esi
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
push dword [ebp + 0x10]
add ebx, 0x38
push ebx
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
push ebx
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1ae30
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
push dword [ebp + 0xc]
push eax
push 0x1adf8
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
pop ebp
ret 8

Function at 0x1b0a2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 0xc8]
push 0x1b07e
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push 0x20
add esi, 0x48
pop edi
mov eax, dword [esi]
test eax, eax
je 0x1b0d2
push 0
push eax
call fcn.00011f88
add esi, 4
dec edi
jne 0x1b0c4
pop edi
pop esi
pop ebp
ret 4

Function at 0x1b4ba
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a0
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov bl, byte [esi + 0xc]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x1a0]
push eax
push esi
push dword [ebp + 8]
mov byte [ebp - 1], bl
call fcn.0001b196
cmp al, bl
je 0x1b503
mov byte [esi + 0xb], 3
jmp 0x1b613
lea ecx, [esi + 0x18]
call fcn.00011100
test eax, eax
jne 0x1b510
int3
movzx esi, bl
lea ecx, [eax + 8]
cmp dword [ecx + 4], 0
lea ebx, [ebp + esi*4 - 0x1a0]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
mov dword [ebx], ecx
je 0x1b52c
int3
cmp dword [ebp - 0x10], 0
mov eax, dword [eax + 0x14]
mov dword [ebp + esi*4 - 0x11c], eax
mov eax, dword [ebx]
push edi
mov edi, dword [eax]
jbe 0x1b60b
jmp 0x1b54a
mov esi, dword [ebp - 0x14]
cmp byte [ebp - 1], 1
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0xc], edx
jb 0x1b570
lea eax, [ebp - 0x118]
mov ecx, dword [eax]
cmp edx, ecx
jbe 0x1b567
mov edx, ecx
add eax, 4
dec esi
jne 0x1b55f
mov dword [ebp - 0xc], edx
test edx, edx
mov byte [ebp + 0xb], 0
jbe 0x1b5ba
mov eax, dword [ebp - 0x98]
mov al, byte [eax]
inc dword [ebp - 0x98]
cmp byte [ebp - 1], 1
mov byte [edi], al
jbe 0x1b5ae
mov al, byte [ebp - 1]
dec al
lea ecx, [ebp - 0x94]
movzx esi, al
mov eax, dword [ecx]
mov bl, byte [eax]
xor byte [edi], bl
inc eax
mov dword [ecx], eax
add ecx, 4
dec esi
jne 0x1b59c
mov ebx, dword [ebp - 0x18]
inc edi
inc byte [ebp + 0xb]
movzx eax, byte [ebp + 0xb]
cmp eax, edx
jb 0x1b578
add dword [ebp - 8], edx
xor dl, dl
xor esi, esi
lea eax, [ebp + esi - 0x11c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc]
jne 0x1b5f3
lea eax, [ebp + esi - 0x1a0]
mov ecx, dword [eax]
add ecx, 0x10
cmp dl, byte [ebp - 1]
mov dword [eax], ecx
jne 0x1b5e8
mov eax, dword [ebx]
mov edi, dword [eax]
jmp 0x1b5f5
mov eax, dword [ecx]
mov dword [ebp + esi - 0x98], eax
jmp 0x1b5f5
mov dword [eax], ecx
inc dl
add esi, 4
cmp dl, byte [ebp - 1]
jbe 0x1b5c1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jb 0x1b547
mov eax, dword [ebp + 0xc]
mov byte [eax + 0xb], 0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1b61e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 8], 0
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov bl, byte [edi + 0xc]
test bl, bl
mov byte [ebp + 0xf], bl
je 0x1b656
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp + 8]
call fcn.0001b196
cmp al, bl
je 0x1b65f
mov byte [edi + 0xb], 3
jmp 0x1b730
cmp dword [ebp - 0xc], 0
push esi
jbe 0x1b72b
cmp bl, 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jbe 0x1b68f
mov cl, bl
dec cl
lea eax, [ebp - 0x18]
movzx edx, cl
mov ecx, dword [eax]
cmp dword [ebp + 8], ecx
jbe 0x1b689
mov dword [ebp + 8], ecx
add eax, 4
dec edx
jne 0x1b67f
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jbe 0x1b6cc
cmp bl, 1
mov eax, dword [ebp - 0x14]
mov dl, byte [eax]
jbe 0x1b6ba
mov al, bl
dec al
lea ecx, [ebp - 0x10]
movzx esi, al
mov eax, dword [ecx]
xor dl, byte [eax]
inc eax
mov dword [ecx], eax
add ecx, 4
dec esi
jne 0x1b6ad
test dl, dl
jne 0x1b71a
inc dword [ebp - 0x14]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jb 0x1b699
mov eax, dword [ebp - 8]
add eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jae 0x1b72b
test bl, bl
jbe 0x1b66a
xor esi, esi
movzx ebx, bl
mov eax, dword [ebp + 8]
lea edx, [ebp + esi - 0x1c]
sub dword [edx], eax
jne 0x1b70c
lea ecx, [ebp + esi - 0x24]
mov eax, dword [ecx]
add eax, 0x10
push dword [eax]
mov dword [ecx], eax
mov ecx, dword [eax + 0xc]
push dword [edi + 0x24]
mov dword [edx], ecx
call fcn.0001258c
mov dword [ebp + esi - 0x14], eax
add esi, 4
dec ebx
jne 0x1b6e3
mov bl, byte [ebp + 0xf]
jmp 0x1b66a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, ecx
mov byte [edi + 0xb], 2
mov dword [edi + 0x20], eax
jmp 0x1b72f
mov byte [edi + 0xb], 0
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x1bd8e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi]
mov ebx, dword [edi + 0x14]
and eax, 0x400000
test byte [ebp + 0xe], 0x10
lea esi, [edi + 0xd0]
mov dword [ebp + 8], edx
jne 0x1bdc3
test byte [ebp + 0xc], 8
jne 0x1bdc3
and dword [ebp - 4], 0
jmp 0x1bdca
mov dword [ebp - 4], 1
and dword [ebp + 0xc], 0xffffffd6
test eax, eax
je 0x1be75
mov cl, byte [edi + 6]
and byte [ebp + 0xe], 0xbf
cmp cl, 4
je 0x1be1a
mov al, byte [esi + 4]
test al, 2
je 0x1be1a
test al, 4
jne 0x1be1a
mov byte [ebp + 0xf], 0
add ebx, 0x28
push 0xa
push dword [ebp + 8]
call fcn.000114ec
push ebx
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test al, 0xf
je 0x1be11
inc byte [ebp + 0xf]
cmp byte [ebp + 0xf], 0x64
jb 0x1bdf4
mov byte [esi + 4], 1
jmp 0x1bfa0
mov al, byte [edi + 8]
test al, 2
je 0x1be52
test al, 4
jne 0x1be52
mov byte [ebp + 0xf], 0
add ebx, 0x28
push 0xa
push dword [ebp + 8]
call fcn.000114ec
push ebx
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test al, 0xf
je 0x1be49
inc byte [ebp + 0xf]
cmp byte [ebp + 0xf], 0x64
jb 0x1be2c
and byte [edi + 8], 0xfd
jmp 0x1bfa0
cmp cl, 4
jne 0x1be5f
test cl, al
jne 0x1be65
cmp cl, cl
je 0x1be6e
test byte [esi + 4], 4
je 0x1be6e
push edi
push edx
call fcn.0001bad0
jmp 0x1be75
push edi
push edx
call fcn.0001ae56
cmp dword [ebp - 4], 0
je 0x1bf85
and dword [ebp + 0xc], 0xffeffff7
push 1
push 0xf
push 0
push 0x20
push 1
push edi
call fcn.0001d372
add ebx, 0x3c
push ebx
mov dword [ebp - 4], ebx
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test eax, eax
mov dword [ebp - 8], eax
je 0x1bfa0
xor cl, cl
mov edx, dword [ebp - 8]
xor ebx, ebx
inc ebx
mov eax, ebx
shl eax, cl
test edx, eax
jne 0x1bec6
inc cl
cmp cl, 4
jb 0x1beaf
jmp 0x1bed9
movzx eax, cl
imul eax, eax, 0x2e0
lea esi, [eax + edi + 0xd0]
mov byte [esi + 0x10], cl
xor eax, eax
mov al, byte [esi + 0x10]
push ebx
push eax
push 0
push ebx
push ebx
push edi
call fcn.0001d372
push dword [ebp - 4]
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test eax, 0x4010000
je 0x1bfa0
mov al, byte [esi + 4]
test al, 2
je 0x1bf6d
test al, 4
jne 0x1bf71
mov byte [ebp + 0xf], 0
push 0xa
push dword [ebp + 8]
call fcn.000114ec
xor eax, eax
mov al, byte [esi + 0x10]
push ebx
push eax
push 0
push 0
push ebx
push edi
call fcn.0001d372
push dword [ebp - 4]
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test al, 0xf
je 0x1bf3d
inc byte [ebp + 0xf]
cmp byte [ebp + 0xf], 0x64
jb 0x1bf0c
xor eax, eax
mov al, byte [esi + 0x10]
push ebx
mov byte [esi + 4], 1
push eax
push 0
push ebx
push ebx
push edi
call fcn.0001d372
push dword [ebp - 4]
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
xor ecx, ecx
mov cl, byte [esi + 0x10]
push ebx
push ecx
push eax
push ebx
push 0
push edi
call fcn.0001d372
jmp 0x1bfa0
test al, 4
je 0x1bf7c
push esi
push dword [ebp + 8]
call fcn.0001bb9c
jmp 0x1bf85
push esi
push dword [ebp + 8]
call fcn.0001af78
cmp dword [ebp + 0xc], 0
je 0x1bfa0
movzx eax, byte [edi + 4]
push dword [ebp + 0xc]
push eax
push 0x1bd4c
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1e102
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, dword [esi + 0x14]
xor ebx, ebx
inc ebx
push ebx
push eax
mov dword [ebp - 4], eax
call fcn.000115b0
cmp dword [esi + 0xc8], 0
mov dword [ebp - 0xc], eax
je 0x1e12f
int3
cmp byte [esi + 5], 0
je 0x1e136
int3
cmp byte [ebp + 0xc], 0
je 0x1e168
add edi, 0x18
push edi
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test al, 8
je 0x1e14a
int3
or eax, 8
push eax
push edi
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
push edi
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test al, 8
jne 0x1e154
push 2
push dword [ebp - 4]
call fcn.000114ec
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 4
push 0x16
lea edi, [esi + 0xd0]
push 0
push edi
mov dword [ebp - 0x10], edi
call fcn.0001dda2
push 0xa
push dword [ebp - 4]
call fcn.00011510
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0
push 0x16
push 0
push edi
call fcn.0001dda2
push 5
push dword [ebp - 4]
call fcn.000114ec
mov byte [ebp + 8], 1
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 2
jb 0x1e1c4
mov byte [edi + 4], 1
mov byte [edi + 3], 0xff
jmp 0x1e2af
push edi
push dword [ebp + 8]
push esi
call fcn.0001df22
test al, al
je 0x1e25e
mov dword [ebp - 8], 0x14
push edi
push dword [ebp + 8]
push esi
call fcn.0001df8c
push edi
push dword [ebp + 8]
mov bl, al
push esi
call fcn.0001e002
push 1
push dword [ebp - 4]
and bl, al
dec dword [ebp - 8]
call fcn.000114ec
cmp dword [ebp - 8], 0
jbe 0x1e20c
test bl, bl
je 0x1e1dd
test bl, bl
jne 0x1e287
cmp byte [ebp + 8], bl
lea eax, [ebp - 0x20]
push eax
push 1
je 0x1e225
push dword [ebp + 8]
push 0xa0
jmp 0x1e22c
push 0
push 0xb0
push 0xe
push 0
push edi
call fcn.0001dda2
push 0x14
pop eax
sub eax, dword [ebp - 8]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
movzx eax, byte [ebp - 0x1d]
push eax
movzx eax, byte [ebp - 0x1e]
push eax
movzx eax, byte [ebp - 0x1f]
push eax
push 0x1e078
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
test byte [edi + 4], 4
je 0x1e27d
xor eax, eax
mov al, byte [esi + 4]
push eax
push dword [ebp - 4]
call fcn.0001ba5a
push edi
push 2
push dword [ebp - 0xc]
call fcn.0001240e
mov byte [edi + 4], 1
mov byte [edi + 3], 0xff
jmp 0x1e2a1
push 0x14
pop eax
sub eax, dword [ebp - 8]
push eax
push 0x1e0d0
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov byte [edi + 4], 6
inc byte [esi + 9]
pop ecx
cmp byte [ebp + 8], 0
mov byte [ebp + 8], 0
sete al
mov byte [edi + 5], al
inc byte [ebp + 0xf]
add edi, 0x2e0
cmp byte [ebp + 0xf], 4
jb 0x1e1b1
push 4
lea edi, [esi + 0xd3]
pop ebx
test byte [edi + 1], 4
je 0x1e2e0
lea eax, [edi - 3]
push eax
push dword [ebp - 4]
mov byte [edi], 1
call fcn.0001ed74
add edi, 0x2e0
dec ebx
jne 0x1e2cb
cmp byte [esi + 9], 0
pop edi
pop esi
pop ebx
jne 0x1e2fd
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0001ed74
leave
ret 8