joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800064b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800064d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18000654c
mov rdi, r14
mov rcx, rbx
call fcn.1800075f0
test rax, rax
jle 0x180006524
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.18001b390
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000653c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180006544
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800064e6
sub r14, rdi
jmp 0x180006639
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180006563
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180006565
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000659a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18001b390
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180006636
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1800065d5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180006611
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180020c60
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x18000664f
cmp rbp, rax
ja 0x1800065e1
mov r8, rdi
test rdi, rdi
je 0x180006636
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180020c60
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x180006639
Function at 0x180006a60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18006c060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180006a8d
xor eax, eax
jmp 0x180006bd3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180006ac7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180006ac7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180006bd3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180006bc6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180006b0a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180006b19
movsx ecx, dil
jmp 0x180006b6d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x180006b87
sub eax, 1
je 0x180006b87
cmp eax, 2
jne 0x180006bc6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.18001fcd8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180006bcb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180006bb4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.18002097c
cmp rsi, rax
jne 0x180006bc6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x180006bcb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180018ee0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180008530
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x18006c060]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x78], rcx
xor r14d, r14d
mov dword [rsp + 0x60], r14d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x60], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.18001bbc0
mov dword [rbp - 0x6c], 0x104
mov dword [rbp - 0x70], r14d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x6c]
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x18000871c
mov edi, r14d
nop word [rax + rax]
mov dword [rbp - 0x68], 0xff
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x68]
lea r8, [rbp - 0x40]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180008711
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180008680
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call fcn.1800045f0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x1800086c7
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x68], r14w
add qword [rbx + 8], 0x20
jmp 0x1800086d8
lea r8, [rsp + 0x68]
mov rcx, rbx
call fcn.18000c820
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x180008711
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000870c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008746
call fcn.180019260
inc edi
cmp edi, dword [rbp - 0x70]
jb 0x180008620
mov rax, rbx
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.180018ee0
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18001f98c
int3
Function at 0x18000c0c0
Capabilities:
Enumerate pe sections

Disassembly:
cmp byte [rcx], 0
mov r8, rcx
je 0x18000c231
movzx eax, byte [rcx + 2]
lea r9, [0x18004c3f0]
movzx eax, byte [rax + r9]
mov byte [rcx + 2], al
movzx eax, byte [rcx + 3]
movzx eax, byte [rax + r9]
mov byte [rcx + 3], al
movzx eax, byte [rcx + 4]
movzx eax, byte [rax + r9]
mov byte [rcx + 4], al
movzx eax, byte [rcx + 5]
movzx eax, byte [rax + r9]
mov byte [rcx + 5], al
movzx eax, byte [rcx + 6]
movzx eax, byte [rax + r9]
mov byte [rcx + 6], al
movzx eax, byte [rcx + 7]
movzx eax, byte [rax + r9]
mov byte [rcx + 7], al
movzx eax, byte [rcx + 8]
movzx eax, byte [rax + r9]
mov byte [rcx + 8], al
movzx eax, byte [rcx + 9]
movzx eax, byte [rax + r9]
mov byte [rcx + 9], al
movzx eax, byte [rcx + 0xa]
movzx eax, byte [rax + r9]
mov byte [rcx + 0xa], al
movzx eax, byte [rcx + 0xb]
movzx eax, byte [rax + r9]
mov byte [rcx + 0xb], al
movzx eax, byte [rcx + 0xc]
movzx eax, byte [rax + r9]
mov byte [rcx + 0xc], al
movzx eax, byte [rcx + 0xd]
movzx eax, byte [rax + r9]
mov byte [rcx + 0xd], al
movzx eax, byte [rcx + 0xe]
movzx eax, byte [rax + r9]
mov byte [rcx + 0xe], al
movzx eax, byte [rcx + 0xf]
movzx eax, byte [rax + r9]
mov byte [rcx + 0xf], al
movzx eax, byte [rcx + 0x10]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x10], al
movzx eax, byte [rcx + 0x11]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x11], al
movzx eax, byte [rcx + 0x12]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x12], al
movzx eax, byte [rcx + 0x13]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x13], al
movzx eax, byte [rcx + 0x14]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x14], al
movzx eax, byte [rcx + 0x15]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x15], al
movzx eax, byte [rcx + 0x16]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x16], al
movzx eax, byte [rcx + 0x17]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x17], al
movzx eax, byte [rcx + 0x18]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x18], al
movzx eax, byte [rcx + 0x19]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x19], al
movzx eax, byte [rcx + 0x1a]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x1a], al
movzx ecx, byte [rcx + 0x1b]
movzx ecx, byte [rcx + r9]
mov byte [r8 + 0x1b], cl
movzx ecx, byte [r8 + 0x1c]
movzx ecx, byte [rcx + r9]
mov byte [r8 + 0x1c], cl
lea rax, [r8 + 2]
movzx ecx, byte [r8 + 0x1d]
movzx ecx, byte [rcx + r9]
mov byte [r8 + 0x1d], cl
mov byte [r8], 0
ret
lea rax, [rcx + 2]
ret
Function at 0x18000e960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x18000e9a4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18000e990
ret
Function at 0x180016f10
Capabilities:
Load windows common language runtime

Disassembly:
sub rsp, 0x58
mov rax, qword [0x18006c060]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
lea r8, [rsp + 0x30]
lea rdx, [0x180064218]
mov qword [rsp + 0x20], rax
lea rcx, [0x180064208]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
test eax, eax
js 0x180016fda
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x20]
lea r8, [0x1800641f8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x180016fda
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x180016fda
cmp dword [rsp + 0x38], 0
je 0x180016fda
mov rcx, qword [rsp + 0x20]
lea r9, [rsp + 0x28]
lea r8, [0x180064228]
lea rdx, [0x180064238]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x180016fda
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x180016fda
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180018ee0
add rsp, 0x58
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180018ee0
add rsp, 0x58
ret
Function at 0x112e8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdx, qword [rdx + 0xb8]
xor edi, edi
movzx ecx, byte [rdx]
cmp ecx, edi
je 0x1142a
sub ecx, 2
je 0x11420
sub ecx, 1
je 0x11416
sub ecx, 1
je 0x113b0
cmp ecx, 0xa
jne 0x11397
cmp dword [rdx + 0x18], 0x12c800
je 0x1138a
cmp dword [rdx + 0x18], 0x220194
jne 0x11397
mov rcx, qword [rbx + 0x18]
mov esi, dword [rdx + 8]
cmp rcx, rdi
je 0x1136c
cmp dword [rdx + 0x10], 0x11
jb 0x1136c
cmp esi, 0x11
jb 0x1136c
call fcn.00019ee0
cmp eax, edi
mov dword [rbx + 0x30], eax
jl 0x1136c
mov qword [rbx + 0x38], rsi
jmp 0x11407
mov esi, 0xc0000001
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], esi
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov edi, esi
jmp 0x11412
mov rcx, rbx
call fcn.0001ac34
jmp 0x1148e
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], edi
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x1148e
mov rcx, qword [rbx + 8]
mov esi, dword [rdx + 8]
test byte [rcx + 0xa], 5
je 0x113c3
mov rax, qword [rcx + 0x18]
jmp 0x113de
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 0x10
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
cmp rax, rdi
je 0x113ff
cmp esi, 8
jb 0x113ff
mov edx, dword [rax]
mov rcx, qword [0x0001da98]
call fcn.0001a174
mov r11d, eax
mov qword [rbx + 0x38], r11
jmp 0x11404
mov edi, 0xc000009a
mov dword [rbx + 0x30], edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1148e
mov rcx, rbx
call fcn.0001a784
jmp 0x1148e
mov rcx, rbx
call fcn.0001a51c
jmp 0x1148e
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [0x0001e8c0]
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [0x0001e8e0], dil
je 0x11452
mov dword [rbx + 0x30], 0xc0000010
jmp 0x11463
mov qword [0x0001e8e8], rsi
mov byte [0x0001e8e0], 1
mov dword [rbx + 0x30], edi
lea rcx, [0x0001e8c0]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [rbx + 0x30], edi
jne 0x1147c
call fcn.00012574
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [rbx + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x115ec
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, qword [rcx + 0x18]
xor sil, sil
mov r12, r8
cmp byte [0x0001e8e0], sil
mov rbx, rdx
mov rdi, rcx
je 0x11714
test rbp, rbp
je 0x11714
cmp dword [rdx + 0x10], 0x1c
jb 0x11714
lea rcx, [0x0001e7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001e7d8]
mov r9, qword [rbx + 0x30]
mov ecx, dword [r8]
mov r11b, al
xor edx, edx
mov rax, r9
div rcx
mov rcx, qword [r8 + rdx*8 + 8]
jmp 0x1166b
cmp qword [rcx], r9
je 0x11670
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x11662
test rcx, rcx
mov ebx, 1
je 0x116d4
mov eax, dword [rbp + 0x10]
sub eax, ebx
je 0x116c7
sub eax, ebx
je 0x116b9
sub eax, ebx
je 0x116b0
sub eax, ebx
je 0x116a7
sub eax, ebx
je 0x1169e
cmp eax, ebx
jne 0x116d4
test byte [rcx + 0x190], 0x20
jmp 0x116c0
test byte [rcx + 0x190], 0x10
jmp 0x116c0
test byte [rcx + 0x190], 8
jmp 0x116c0
test byte [rcx + 0x190], 4
jmp 0x116c0
test byte [rcx + 0x190], 2
je 0x116d4
mov sil, bl
jmp 0x116d4
test byte [rcx + 0x190], bl
movzx esi, sil
cmovne esi, ebx
lea rcx, [0x0001e7c0]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test sil, sil
je 0x11701
and qword [rdi + 0x38], 0
and dword [rdi + 0x30], 0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x11730
add byte [rdi + 0x43], bl
add qword [rdi + 0xb8], 0x48
mov rdx, rdi
mov rcx, r12
jmp 0x1172a
mov ebx, 1
mov rdx, rcx
add byte [rcx + 0x43], bl
add qword [rcx + 0xb8], 0x48
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x11754
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx + 0xb8]
mov rdi, rdx
mov rsi, r8
movzx edx, byte [rbx]
test edx, edx
je 0x11979
sub edx, 0xe
je 0x117dd
sub edx, 1
je 0x11826
cmp edx, 3
jne 0x118bb
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x20]
sub rcx, 1
je 0x117cd
cmp rcx, 1
je 0x117bd
add byte [rdi + 0x43], 1
lea rax, [rbx + 0x48]
mov rcx, r8
mov qword [rdi + 0xb8], rax
jmp 0x1194a
mov rdx, rbx
mov rcx, rdi
call fcn.00012c90
jmp 0x11984
mov rdx, rbx
mov rcx, rdi
call fcn.000121e8
jmp 0x11984
mov r8, rbx
mov rdx, rdi
call sub.TDI.SYS_TdiMapUserRequest
test eax, eax
jns 0x11826
cmp dword [rbx + 0x18], 0x210203
jne 0x118bb
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x118bb
lea rcx, [0x00011594]
xor edx, edx
mov qword [rax], rcx
and dword [rdi + 0x30], 0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x11984
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x20]
cmp rcx, 2
jne 0x11955
movzx ecx, byte [rbx + 1]
sub ecx, 1
je 0x118fc
sub ecx, 1
je 0x118d4
sub ecx, 1
je 0x118c1
sub ecx, 1
je 0x118bb
sub ecx, 2
je 0x118a8
sub ecx, 1
je 0x11895
sub ecx, 1
je 0x11882
cmp ecx, 0x127ffc
jne 0x118bb
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.000115ec
jmp 0x11984
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.00014ad0
jmp 0x11984
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.000159f0
jmp 0x11984
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.00013be4
jmp 0x11984
add byte [rdi + 0x43], 1
jmp 0x11906
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.00013004
jmp 0x11984
cmp byte [rdi + 0x43], 1
je 0x11902
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0001b780
lea rcx, [0x0001353c]
jmp 0x11930
cmp byte [rdi + 0x43], 1
jne 0x11910
mov byte [rdi + 0x43], 2
add qword [rdi + 0xb8], 0x48
jmp 0x11947
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0001b780
lea rcx, [0x000133e8]
mov byte [rbx + 3], 0
mov rax, qword [rdi + 0xb8]
mov qword [rax - 0x10], rcx
mov qword [rax - 8], rdi
mov byte [rax - 0x45], 0xe0
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x11984
cmp rcx, 1
jne 0x118bb
cmp byte [rbx + 1], 0xb
jne 0x118bb
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.00012368
jmp 0x11984
mov rdx, rbx
mov rcx, rdi
call fcn.000114a4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x12368
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x0001e7c0]
mov r14, r8
mov rdi, rdx
xor ebp, ebp
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r10, qword [0x0001e808]
mov rcx, qword [rdi + 0x30]
mov r13b, al
mov r9d, dword [r10]
xor edx, edx
mov rax, rcx
div r9
mov rbx, qword [r10 + rdx*8 + 8]
jmp 0x123c6
cmp qword [rbx], rcx
je 0x123cb
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x123bd
test rbx, rbx
je 0x1250a
add rbx, 0xfffffffffffffff0
lea rcx, [rbx + 0x228]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, dword [rdi + 8]
test edx, edx
mov r11b, al
je 0x124c0
sub edx, 1
je 0x1248c
sub edx, 2
je 0x12458
sub edx, 1
je 0x1241e
sub edx, 3
je 0x12414
cmp edx, 1
jne 0x124fa
mov ebp, 0xc0000184
jmp 0x124fa
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x12445
mov qword [rbx + 0x128], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x130], rax
lea rax, [0x0001668c]
jmp 0x124e2
and qword [rbx + 0x128], rbp
and qword [rbx + 0x130], rbp
jmp 0x124fa
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x1247c
mov qword [rbx + 0x108], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x110], rax
lea rax, [0x00014c84]
jmp 0x124e2
and qword [rbx + 0x108], rbp
and qword [rbx + 0x110], rbp
jmp 0x124fa
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x124b0
mov qword [rbx + 0xe8], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0xf0], rax
lea rax, [0x000146d0]
jmp 0x124e2
and qword [rbx + 0xe8], rbp
and qword [rbx + 0xf0], rbp
jmp 0x124fa
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x124ec
mov qword [rbx + 0xd8], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0xe0], rax
lea rax, [0x00013fb4]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rbx
jmp 0x124fa
and qword [rbx + 0xd8], rbp
and qword [rbx + 0xe0], rbp
lea rcx, [rbx + 0x228]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rcx, [0x0001e7c0]
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
test ebp, ebp
jns 0x12536
and dword [rsi + 0x30], 0
and qword [rsi + 0x38], 0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x1254e
add byte [rsi + 0x43], 1
add qword [rsi + 0xb8], 0x48
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x14ad0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
cmp byte [0x0001e8e0], bl
mov rdi, rcx
jne 0x14b13
add byte [rcx + 0x43], 1
add qword [rcx + 0xb8], 0x48
mov rdx, rcx
mov rcx, r8
jmp 0x14c5a
lea rcx, [0x0001e7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001e7d8]
mov r9, qword [rsi + 0x30]
mov ecx, dword [r8]
mov r12b, al
xor edx, edx
mov rax, r9
div rcx
mov rcx, qword [r8 + rdx*8 + 8]
jmp 0x14b49
cmp qword [rcx], r9
je 0x14b51
mov rcx, qword [rcx + 8]
cmp rcx, rbx
jne 0x14b40
mov rcx, rbx
cmp rcx, rbx
je 0x14c01
lea rsi, [rcx - 0x10]
test byte [rsi + 0x48], 2
je 0x14c01
cmp byte [rsi + 0xe9], bl
jne 0x14c01
cmp byte [0x0001e8e0], bl
je 0x14c1d
cmp byte [rsi + 0x18d], bl
jne 0x14c1d
cmp byte [rsi + 0xe7], bl
je 0x14c1d
lea rcx, [rsi + 0x190]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea r9, [rdi + 0xa8]
lea r8, [rsi + 0x110]
mov rdx, qword [r8 + 8]
mov qword [r9], r8
lea rcx, [rsi + 0x190]
mov qword [r9 + 8], rdx
mov qword [rdx], r9
mov dl, al
mov qword [r8 + 8], r9
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r11, qword [rdi + 0xb8]
or byte [r11 + 3], 1
lea rax, [0x00013af8]
xor edx, edx
xchg qword [rdi + 0x68], rax
mov rcx, rsi
mov dword [rdi + 0x30], 0x103
call fcn.00014948
mov ebx, 0x103
lea rcx, [0x0001e7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp ebx, 0x103
jne 0x14c48
mov eax, ebx
jmp 0x14c60
lea rcx, [0x0001e7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov qword [rdi + 0x38], rbx
mov ebx, 0xc0000184
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x14c60
add byte [rdi + 0x43], 1
add qword [rdi + 0xb8], 0x48
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret