joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13674
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
xor edi, edi
test byte [rcx + 0xa], 5
mov rbp, rdx
je 0x136a5
mov rsi, qword [rcx + 0x18]
jmp 0x136c3
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 0x10
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rsi, rax
cmp rsi, rdi
je 0x137af
cmp dword [rbp + 8], 8
jb 0x137af
lea rcx, [0x0001f7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rcx, [0x0001f8c0]
mov bpl, al
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [0x0001e158]
mov rcx, qword [0x0001e150]
mov r12b, al
call fcn.00011adc
mov r11d, eax
mov qword [rsi], r11
cmp byte [rbx + 0x44], dil
je 0x13727
mov rax, rdi
xchg qword [rbx + 0x68], rax
cmp rax, rdi
je 0x13727
mov edi, 0xc0000120
jmp 0x1377d
cmp qword [rsi], rdi
jne 0x1377d
lea rdx, [0x0001f830]
cmp qword [0x0001f830], rdx
jne 0x1377d
mov rax, qword [rbx + 0xb8]
lea rcx, [rbx + 0xa8]
mov edi, 0x103
or byte [rax + 3], 1
mov dword [rbx + 0x30], 0x103
mov rax, qword [0x0001f838]
mov qword [rcx + 8], rax
mov qword [rcx], rdx
mov qword [rax], rcx
lea rax, [0x00013604]
mov qword [0x0001f838], rcx
xchg qword [rbx + 0x68], rax
lea rcx, [0x0001f8c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rcx, [0x0001f7c0]
mov dl, bpl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp edi, 0x103
je 0x137c2
mov qword [rbx + 0x38], 8
jmp 0x137b4
mov edi, 0xc000009a
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x13c90
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
xor ebx, ebx
mov rdi, rcx
cmp rsi, rbx
je 0x13d07
cmp dword [rdx + 8], 0x20
jb 0x13d07
cmp qword [0x0001e140], rbx
jne 0x13cd1
lea rcx, [0x0001e140]
mov edx, 0x640000
call fcn.00013aa4
cmp eax, ebx
jl 0x13cef
cmp qword [0x0001e120], rbx
jne 0x13d32
lea rcx, [0x0001e120]
mov edx, 0x40000
call fcn.00013aa4
cmp eax, ebx
jge 0x13d32
lea rcx, [0x0001e140]
call fcn.00013c24
lea rcx, [0x0001e120]
call fcn.00013c24
mov eax, 0xc0000001
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], eax
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x0001e148]
mov qword [rsi], rax
mov rax, qword [0x0001e158]
mov qword [rsi + 8], rax
mov rax, qword [0x0001e128]
mov qword [rsi + 0x10], rax
mov rax, qword [0x0001e138]
mov qword [rsi + 0x18], rax
mov dword [rdi + 0x30], ebx
mov qword [rdi + 0x38], 0x20
jmp 0x13d15
Function at 0x13ff0
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
and dword [0x0001eac8], 0
lea rdi, [rcx + 0x70]
mov rbx, rcx
lea rax, [0x00013d70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
and qword [0x0001eac0], 0
mov rcx, rdx
call fcn.00017d60
test eax, eax
js 0x141a2
lea rax, [0x0001f7a0]
lea r8, [0x0001f320]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x140bc
mov rax, qword [0x0001f7a0]
lea rdx, [0x0001f320]
lea rcx, [0x0001f530]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x140a3
mov rcx, qword [0x0001f7a0]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [0x0001f7a0], 0
jmp 0x140bc
mov rax, qword [0x0001f7a0]
btr dword [rax + 0x30], 7
mov rax, qword [0x0001f7a0]
or dword [rax + 0x30], 0x10
xor edi, edi
mov rcx, rbx
test edi, edi
jns 0x140cf
call fcn.00013e00
mov eax, edi
jmp 0x141a2
lea rax, [0x0001f740]
lea r9, [0x0001f750]
lea r8, [0x0001eae0]
mov qword [rsp + 0x28], rax
lea rax, [0x0001f748]
lea rdx, [0x0001c050]
mov qword [rsp + 0x20], rax
call fcn.000183f0
lea rdx, [0x0001f758]
mov qword [rsp + 0x28], rdx
lea rax, [0x0001f760]
lea r9, [0x0001f768]
lea rdx, [0x0001c070]
lea r8, [0x0001ecf0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.000183f0
lea rdx, [0x0001f770]
mov qword [rsp + 0x28], rdx
lea rax, [0x0001f778]
lea r9, [0x0001f780]
lea rdx, [0x0001bf20]
lea r8, [0x0001ef00]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.000183f0
lea rdx, [0x0001f788]
mov qword [rsp + 0x28], rdx
lea rax, [0x0001f790]
lea r9, [0x0001f798]
lea rdx, [0x0001bf40]
lea r8, [0x0001f110]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.000183f0
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14758
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov esi, ebp
cmp byte [0x0001f8e0], bpl
jne 0x147a6
inc byte [rcx + 0x43]
add qword [rcx + 0xb8], 0x48
mov rdx, rcx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1495c
lea rcx, [0x0001f7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001f808]
mov r9, qword [rdi + 0x30]
mov ecx, dword [r8]
mov r15b, al
xor edx, edx
mov rax, r9
div rcx
mov rdi, qword [r8 + rdx*8 + 8]
jmp 0x147dc
cmp qword [rdi], r9
je 0x147e4
mov rdi, qword [rdi + 8]
cmp rdi, rbp
jne 0x147d3
mov rdi, rbp
cmp rdi, rbp
je 0x14924
test byte [rdi + 0x20], 1
je 0x14821
lea rcx, [0x0001f7c0]
mov dl, r15b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov edi, 0xc00000bc
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], rbp
mov dword [rbx + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1495c
test byte [rdi + 0x20], 2
je 0x14924
cmp byte [rdi + 0x1ad], bpl
jne 0x14924
lea rcx, [rdi + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea r13, [rdi + 0x200]
mov rcx, qword [r13]
jmp 0x14857
mov rcx, qword [rcx]
inc ebp
cmp rcx, r13
jne 0x14852
lea rcx, [rdi + 0x228]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test byte [rdi + 0x20], 4
jne 0x14924
cmp ebp, 5
jge 0x14924
lea rcx, [rdi + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, qword [r13 + 8]
lea rbp, [rbx + 0xa8]
mov qword [rbp + 8], rcx
mov qword [rbp], r13
mov qword [rcx], rbp
lea rcx, [rdi + 0x228]
mov dl, al
mov qword [r13 + 8], rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r11, qword [rbx + 0xb8]
mov eax, 0x103
or byte [r11 + 3], 1
lea r13, [0x000143a4]
mov ecx, 0xb
xchg qword [rbx + 0x68], r13
mov dword [rbx + 0x30], eax
mov rdx, qword [rdi + 0x10]
mov esi, eax
call fcn.00013208
test eax, eax
jns 0x14924
lea rcx, [rdi + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [rbp + 8]
mov r8, qword [rbp]
mov qword [rdx], r8
mov qword [r8 + 8], rdx
lea rcx, [rdi + 0x228]
mov dl, al
mov qword [rbp + 8], rbp
mov qword [rbp], rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xchg qword [rbx + 0x68], r13
and dword [rbx + 0x30], 0
xor esi, esi
lea rcx, [0x0001f7c0]
mov dl, r15b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp esi, 0x103
je 0x1495a
cmp esi, 0xc000009a
je 0x1495a
inc byte [rbx + 0x43]
add qword [rbx + 0xb8], 0x48
mov rdx, rbx
mov rcx, r14
jmp 0x1479b
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x154b0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x0001f7c0]
xor r15d, r15d
mov r14, r8
mov rdi, rdx
mov ebp, r15d
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r10, qword [0x0001f808]
mov rcx, qword [rdi + 0x30]
mov r9d, dword [r10]
mov r13b, al
xor edx, edx
mov rax, rcx
div r9
mov rbx, qword [r10 + rdx*8 + 8]
jmp 0x15511
cmp qword [rbx], rcx
je 0x15519
mov rbx, qword [rbx + 8]
cmp rbx, r15
jne 0x15508
mov rbx, r15
cmp rbx, r15
je 0x1569c
add rbx, 0xfffffffffffffff0
lea rcx, [rbx + 0x238]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [rdi + 8]
mov r11b, al
cmp edx, r15d
je 0x15652
sub edx, 1
je 0x1561e
sub edx, 2
je 0x155ea
sub edx, 1
je 0x155b0
sub edx, 1
je 0x15576
sub edx, 2
je 0x1556c
cmp edx, 1
jne 0x1568c
mov ebp, 0xc0000184
jmp 0x1568c
mov rax, qword [rdi + 0x10]
cmp rax, r15
je 0x1559d
mov qword [rbx + 0x158], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x160], rax
lea rax, [0x00015d34]
jmp 0x15674
mov qword [rbx + 0x158], r15
mov qword [rbx + 0x160], r15
jmp 0x1568c
mov rax, qword [rdi + 0x10]
cmp rax, r15
je 0x155d7
mov qword [rbx + 0x128], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x130], rax
lea rax, [0x00017134]
jmp 0x15674
mov qword [rbx + 0x128], r15
mov qword [rbx + 0x130], r15
jmp 0x1568c
mov rax, qword [rdi + 0x10]
cmp rax, r15
je 0x1560e
mov qword [rbx + 0x108], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x110], rax
lea rax, [0x00015b34]
jmp 0x15674
mov qword [rbx + 0x108], r15
mov qword [rbx + 0x110], r15
jmp 0x1568c
mov rax, qword [rdi + 0x10]
cmp rax, r15
je 0x15642
mov qword [rbx + 0xe8], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0xf0], rax
lea rax, [0x0001a954]
jmp 0x15674
mov qword [rbx + 0xe8], r15
mov qword [rbx + 0xf0], r15
jmp 0x1568c
mov rax, qword [rdi + 0x10]
cmp rax, r15
je 0x1567e
mov qword [rbx + 0xd8], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0xe0], rax
lea rax, [0x0001a230]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rbx
jmp 0x1568c
mov qword [rbx + 0xd8], r15
mov qword [rbx + 0xe0], r15
lea rcx, [rbx + 0x238]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rcx, [0x0001f7c0]
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp ebp, r15d
jge 0x156c8
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], r15d
mov qword [rsi + 0x38], r15
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x156df
inc byte [rsi + 0x43]
add qword [rsi + 0xb8], 0x48
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1593c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov r13, r8
mov r12, rdx
mov rdi, rcx
cmp byte [0x0001f8e0], bl
jne 0x1597d
inc byte [rcx + 0x43]
add qword [rcx + 0xb8], 0x48
mov rdx, rcx
mov rcx, r8
jmp 0x15b0d
lea rcx, [0x0001f7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001f7d8]
mov r9, qword [r12 + 0x30]
mov ecx, dword [r8]
mov bpl, al
xor edx, edx
mov rax, r9
div rcx
mov rcx, qword [r8 + rdx*8 + 8]
jmp 0x159b4
cmp qword [rcx], r9
je 0x159bc
mov rcx, qword [rcx + 8]
cmp rcx, rbx
jne 0x159ab
mov rcx, rbx
cmp rcx, rbx
je 0x15ab3
lea rsi, [rcx - 0x10]
test byte [rsi + 0x48], 2
je 0x15ab3
cmp byte [rsi + 0xe9], bl
jne 0x15ab3
test byte [r12 + 0xc], 0x80
je 0x15a26
lea r8, [rsi + 0x100]
mov edx, ebx
mov rax, qword [r8]
cmp rax, r8
je 0x15a0a
add edx, dword [rax + 0xdc]
mov rax, qword [rax]
cmp rax, r8
jne 0x159f8
cmp edx, ebx
jne 0x15a26
lea rcx, [0x0001f7c0]
mov dl, bpl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], ebx
jmp 0x15aed
cmp byte [0x0001f8e0], bl
je 0x15acf
cmp byte [rsi + 0x18d], bl
jne 0x15acf
cmp byte [rsi + 0xe7], bl
je 0x15acf
lea rcx, [rsi + 0x190]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea r9, [rdi + 0xa8]
lea r8, [rsi + 0x110]
mov rdx, qword [r8 + 8]
mov qword [r9], r8
lea rcx, [rsi + 0x190]
mov qword [r9 + 8], rdx
mov qword [rdx], r9
mov dl, al
mov qword [r8 + 8], r9
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r11, qword [rdi + 0xb8]
or byte [r11 + 3], 1
lea rax, [0x00019d74]
xor edx, edx
xchg qword [rdi + 0x68], rax
mov rcx, rsi
mov dword [rdi + 0x30], 0x103
call fcn.0001abcc
mov ebx, 0x103
lea rcx, [0x0001f7c0]
mov dl, bpl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp ebx, 0x103
jne 0x15afc
mov eax, ebx
jmp 0x15b13
lea rcx, [0x0001f7c0]
mov dl, bpl
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov eax, 0xc0000184
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], eax
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x15b13
inc byte [rdi + 0x43]
add qword [rdi + 0xb8], 0x48
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x16e3c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x80
mov rax, qword [0x0001e100]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp byte [0x0001f8e0], bl
jne 0x16e87
inc byte [rcx + 0x43]
add qword [rcx + 0xb8], 0x48
mov rdx, rcx
mov rcx, r8
jmp 0x16fe2
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x4b]
call fcn.0001ba40
mov r11d, 0xe
lea rcx, [0x0001f7c0]
lea r15d, [r11 - 0xc]
mov word [rsp + 0x20], r11w
mov word [rsp + 0x22], r15w
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001f808]
mov ecx, dword [r8]
mov r9, qword [rsi + 0x30]
mov r12b, al
xor edx, edx
mov rax, r9
div rcx
mov rcx, qword [r8 + rdx*8 + 8]
jmp 0x16ee3
cmp qword [rcx], r9
je 0x16eeb
mov rcx, qword [rcx + 8]
cmp rcx, rbx
jne 0x16eda
mov rcx, rbx
cmp rcx, rbx
je 0x16fb5
lea rsi, [rcx - 0x10]
lea r8, [rsp + 0x22]
mov edx, 1
mov rcx, rsi
call fcn.0001b828
test al, 1
je 0x16f3c
lea rcx, [0x0001f7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov esi, 0xc0000141
xor edx, edx
mov rcx, rdi
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], esi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x16fe8
test r15b, al
je 0x16fb5
cmp byte [rsi + 0x1bd], bl
jne 0x16fb5
lea rcx, [rsi + 0x238]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea r9, [rdi + 0xa8]
lea r8, [rsi + 0x1e0]
mov rdx, qword [r8 + 8]
mov qword [r9], r8
lea rcx, [rsi + 0x238]
mov qword [r9 + 8], rdx
mov qword [rdx], r9
mov dl, al
mov qword [r8 + 8], r9
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r11, qword [rdi + 0xb8]
or byte [r11 + 3], 1
lea rdx, [0x000143a4]
mov rcx, rsi
xchg qword [rdi + 0x68], rdx
mov edx, 3
mov dword [rdi + 0x30], 0x103
call fcn.000157e8
mov ebx, 0x103
lea rcx, [0x0001f7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp ebx, 0x103
jne 0x16fd1
mov eax, ebx
jmp 0x16fe8
inc byte [rdi + 0x43]
add qword [rdi + 0xb8], 0x48
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.0001b9d0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1779c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
and qword [rax + 0x18], 0
and dword [rax + 8], 0
mov r12, rdx
mov rsi, rcx
test rcx, rcx
je 0x179c4
cmp qword [rcx + 0x10], 0
je 0x179c4
mov rbx, qword [rcx + 0x128]
mov r14, qword [rcx + 0x130]
test rbx, rbx
je 0x179c4
lea rbp, [rcx + 0x1d0]
mov rdi, qword [rbp]
test rdi, rdi
je 0x179c4
cmp rdi, rbp
je 0x179c4
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rax], rcx
mov qword [rcx + 8], rax
cmp dword [rdi + 0x18], 0
jl 0x179bc
cmp dword [rdi + 0xdc], 0
je 0x179bc
mov dl, byte [rdx]
lea rcx, [rsi + 0x238]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r8d, dword [rdi + 0xdc]
mov eax, dword [rdi + 0xd8]
mov r9d, dword [rdi + 0x30]
lea rdx, [rax + rdi + 0xe4]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdx
mov edx, dword [rdi + 0x40]
lea rax, [rsp + 0x90]
mov rcx, r14
mov qword [rsp + 0x40], rax
mov eax, dword [rdi + 0x1c]
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r8d
mov r8, qword [rdi + 0x48]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call rbx
lea rcx, [rsi + 0x238]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp qword [rsi + 0x10], 0
mov byte [r12], al
jne 0x17906
mov rcx, rdi
call fcn.00016df4
mov rcx, qword [rsp + 0xa0]
mov ebx, 0xc0000141
test rcx, rcx
je 0x179c9
xor eax, eax
xor edx, edx
xchg qword [rcx + 0x68], rax
mov rcx, qword [rsp + 0xa0]
mov dword [rcx + 0x30], ebx
mov rax, qword [rsp + 0xa0]
and qword [rax + 0x38], 0
mov rcx, qword [rsp + 0xa0]
call fcn.000137e8
jmp 0x179c9
mov ecx, 0xc000021b
cmp ebx, ecx
jne 0x1791a
xor eax, eax
mov dword [rsp + 0x90], eax
jmp 0x1792a
mov eax, dword [rsp + 0x90]
test ebx, ebx
jne 0x1792a
test eax, eax
cmove ebx, ecx
mov ecx, dword [rdi + 0xdc]
cmp eax, ecx
jae 0x17969
cmp qword [rsp + 0xa0], 0
je 0x17969
sub ecx, eax
mov dword [rdi + 0xdc], ecx
mov eax, dword [rsp + 0x90]
add dword [rdi + 0xd8], eax
mov rax, qword [rbp]
mov qword [rdi + 8], rbp
mov qword [rdi], rax
mov qword [rax + 8], rdi
mov qword [rbp], rdi
jmp 0x17971
mov rcx, rdi
call fcn.00016df4
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x179c9
mov rdx, rbp
call fcn.000175bc
mov dl, byte [r12]
lea rcx, [rsi + 0x238]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea rcx, [rsi + 0x238]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [r12], al
jmp 0x179c9
mov rcx, rdi
call fcn.00016df4
mov ebx, 0xc0000141
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x179ec
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
add rcx, 0x238
mov esi, r15d
mov r13, rdx
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [rsp + 0x50], al
cmp qword [rdi + 0x10], r15
je 0x17b2d
cmp qword [rdi + 0x20], r13
jne 0x17b03
lea r12, [rdi + 0x1d0]
cmp qword [r12], r12
je 0x17b03
lea rbp, [rdi + 0x1e0]
jmp 0x17ad2
cmp qword [r12], r12
je 0x17b03
mov rbx, qword [rbp]
mov rax, qword [rbx]
mov qword [rbp], rax
mov qword [rax + 8], rbp
cmp rbx, rbp
je 0x17ad2
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
lea rcx, [rbx - 0xa8]
mov rax, r15
mov rdx, r12
xchg qword [rbx - 0x40], rax
call fcn.000175bc
mov dl, byte [rsp + 0x50]
lea rcx, [rdi + 0x238]
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rcx, [rbx - 0xa8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea rcx, [rdi + 0x238]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp esi, r15d
mov byte [rsp + 0x50], al
jl 0x17b03
cmp qword [rdi + 0x10], r15
je 0x17b2d
cmp qword [rdi + 0x20], r13
jne 0x17b03
cmp qword [rbp], rbp
jne 0x17a53
jmp 0x17af2
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.0001779c
cmp eax, r15d
mov esi, eax
jl 0x17afa
cmp qword [r12], r12
jne 0x17ade
jmp 0x17b03
cmp eax, 0xc000021b
cmove esi, r15d
cmp qword [rdi + 0x10], r15
je 0x17b2d
mov rdx, qword [rdi + 0x20]
cmp rdx, r13
jne 0x17b2d
cmp esi, r15d
jl 0x17b2d
lea rax, [rdi + 0x1d0]
cmp qword [rax], rax
jne 0x17b2d
mov ecx, 0xc
call fcn.00013208
mov dl, byte [rsp + 0x50]
lea rcx, [rdi + 0x238]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x183f0
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, rcx
lea rcx, [rax - 0x28]
mov r12, r9
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rbx, qword [rsp + 0x90]
lea rcx, [rsp + 0x40]
mov r8, r12
mov edx, 0x1f01ff
mov r9, rbx
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
js 0x184f2
mov rax, qword [rbx]
test byte [rax + 0x30], 0x80
je 0x18454
btr dword [rax + 0x30], 7
mov bpl, 1
jmp 0x18457
xor bpl, bpl
mov rcx, qword [rbx]
mov rdi, qword [rsp + 0x98]
mov r8, rsi
mov eax, dword [rcx + 0x34]
mov r9d, dword [rcx + 0x48]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov rcx, r13
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, eax
test eax, eax
jns 0x18497
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x184c3
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov qword [rbx], rax
test rax, rax
jne 0x184cf
mov rcx, qword [r12]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov esi, 0xc0000001
and qword [rdi], 0
and qword [rbx], 0
mov eax, esi
jmp 0x184f2
mov eax, dword [rax + 0x30]
mov rcx, qword [rdi]
and eax, 0x14
or dword [rcx + 0x30], eax
mov rax, qword [rdi]
btr dword [rax + 0x30], 7
test bpl, bpl
je 0x184f0
mov rax, qword [rbx]
bts dword [rax + 0x30], 7
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1865c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, qword [rcx + 0x18]
xor sil, sil
mov r12, r8
mov rbx, rdx
mov rdi, rcx
cmp byte [0x0001f8e0], sil
je 0x18784
test rbp, rbp
je 0x18784
cmp dword [rdx + 0x10], 0x1c
jb 0x18784
lea rcx, [0x0001f7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001f7d8]
mov r9, qword [rbx + 0x30]
mov ecx, dword [r8]
mov r11b, al
xor edx, edx
mov rax, r9
div rcx
mov rcx, qword [r8 + rdx*8 + 8]
jmp 0x186db
cmp qword [rcx], r9
je 0x186e0
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x186d2
mov ebx, 1
test rcx, rcx
je 0x18744
mov eax, dword [rbp + 0x10]
sub eax, ebx
je 0x18737
sub eax, ebx
je 0x18729
sub eax, ebx
je 0x18720
sub eax, ebx
je 0x18717
sub eax, ebx
je 0x1870e
cmp eax, ebx
jne 0x18744
test byte [rcx + 0x190], 0x20
jmp 0x18730
test byte [rcx + 0x190], 0x10
jmp 0x18730
test byte [rcx + 0x190], 8
jmp 0x18730
test byte [rcx + 0x190], 4
jmp 0x18730
test byte [rcx + 0x190], 2
je 0x18744
mov sil, bl
jmp 0x18744
test byte [rcx + 0x190], bl
movzx esi, sil
cmovne esi, ebx
lea rcx, [0x0001f7c0]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test sil, sil
je 0x18771
and qword [rdi + 0x38], 0
and dword [rdi + 0x30], 0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x187a0
add byte [rdi + 0x43], bl
add qword [rdi + 0xb8], 0x48
mov rdx, rdi
mov rcx, r12
jmp 0x1879a
mov ebx, 1
mov rdx, rcx
add byte [rcx + 0x43], bl
add qword [rcx + 0xb8], 0x48
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret