joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24f0a
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x1c]
lea edx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
cmp dword [esi + 0x50], 0
jle 0x24fa0
lea eax, [esi + 0x28]
cmp dword [eax], eax
jne 0x24fa0
lea ecx, [esi + 0x38]
mov eax, dword [ecx]
cmp eax, ecx
je 0x24fa0
lea esi, [eax - 0x58]
mov ecx, dword [esi + 0x5c]
mov eax, dword [esi + 0x58]
push edi
mov edi, dword [esi + 0x60]
mov dword [ecx], eax
mov dword [eax + 4], ecx
and dword [esi + 0x58], 0
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x24f75
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
cmp byte [edi], 0xf
pop edi
jne 0x24f86
push dword [ebp + 0xc]
push esi
call fcn.00024dce
jmp 0x24f90
mov eax, dword [ebp + 0xc]
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x24fa9
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
pop esi
leave
ret 8

Function at 0x255a2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0xc]
and dword [ecx + 0xbc], 0
mov eax, dword [eax + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
lea ecx, [eax + 0x20]
inc edx
lock xadd dword [ecx], edx
push eax
push esi
call fcn.000252c3
cmp eax, 0xc0000016
je 0x255ea
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop esi
pop ebp
ret 8
Function at 0x25aa7
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
jmp 0x25b37
lea esi, [eax - 0x78]
xor edi, edi
lea eax, [esi + 0x18]
xchg dword [eax], edi
test edi, edi
je 0x25b00
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x25b57
push 0xc0000120
push edi
call fcn.00024dce
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, byte [0x12011]
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [ebx + 0x50]
cmp dword [eax], 0
jl 0x25b1e
cmp word [ebx + 0x44], 0x7fff
jae 0x25b1e
lea edx, [esi + 0x78]
lea ecx, [ebx + 0x40]
call dword [sym.imp.ntoskrnl.exe_InterlockedPushEntrySList]
jmp 0x25b37
xor ecx, ecx
inc ecx
lock xadd dword [eax], ecx
lea eax, [esi + 0x20]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x25b37
push esi
call fcn.0001c0b1
lea ecx, [ebx + 0x48]
call dword [sym.imp.ntoskrnl.exe_InterlockedPopEntrySList]
test eax, eax
jne 0x25ab7
lea ecx, [ebx + 0x40]
call dword [sym.imp.ntoskrnl.exe_InterlockedPopEntrySList]
test eax, eax
je 0x25b84
jmp 0x25b5e
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
jmp 0x25b67
lea esi, [eax - 0x78]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
add ebx, 0x58
inc eax
lock xadd dword [ebx], eax
inc eax
mov dword [esi + 0x70], eax
jne 0x25b82
xor eax, eax
inc eax
lock xadd dword [ebx], eax
inc eax
mov dword [esi + 0x70], eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x25bcb
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov cl, 2
call dword [sym.imp.HAL.dll_KfRaiseIrql]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
lea ecx, [edi + 0x1c]
mov byte [ebp - 1], al
mov dword [ebp + 8], ecx
jmp 0x25c11
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
test byte [ebx + 7], 0x20
push ebx
je 0x25c09
call fcn.0002bbf7
jmp 0x25c0e
call fcn.00025b90
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
call esi
push edi
call fcn.00025a7f
mov ebx, eax
test ebx, ebx
je 0x25c48
jmp 0x25bf2
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
test byte [ebx + 7], 0x20
push ebx
je 0x25c3b
call fcn.0002bbf7
jmp 0x25c40
call fcn.00025b90
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
call esi
push 0
push edi
call fcn.00025a13
mov ebx, eax
test ebx, ebx
jne 0x25c24
test byte [edi + 0xc], 2
je 0x25ca8
lea ebx, [edi + 0x40]
jmp 0x25c97
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
xor edi, edi
add eax, 0xffffffa0
xchg dword [eax], edi
test edi, edi
je 0x25c97
lea eax, [edi + 0x25]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push edi
call fcn.000276fb
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
call esi
mov eax, dword [ebx]
cmp eax, ebx
jne 0x25c61
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
jmp 0x25d13
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
jmp 0x25d03
cmp dword [ebp - 8], 0
je 0x25cf1
push 0xc0000120
push dword [ebp - 8]
call fcn.00024dce
mov eax, dword [ebp - 8]
cmp byte [eax + 0x24], 0
je 0x25ce2
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, byte [0x12011]
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [esi + 0x20]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x25d03
push esi
call fcn.0001c0b1
lea eax, [ebp - 8]
push eax
push edi
call fcn.00025aa7
mov esi, eax
test esi, esi
jne 0x25cb3
mov cl, byte [ebp - 1]
call dword [sym.imp.HAL.dll_KfLowerIrql]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x265ec
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
cmp byte [edi], 0xf
mov eax, dword [edi + 0x18]
mov ebx, dword [eax + 0xc]
mov esi, ecx
je 0x2661e
cmp dword [edi + 4], 0xc
jb 0x26612
test byte [ebx + 0xc], 1
jne 0x2661e
mov dword [ebp - 4], 0xc000000d
jmp 0x26741
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
push ebx
call fcn.00025a7f
test eax, eax
mov dword [ebp - 8], eax
jne 0x266f8
test byte [ebx + 0xd], 0x10
je 0x26667
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [edi], 0xf
mov eax, 0xc0000120
mov dword [ebp - 4], eax
jne 0x26741
push eax
push esi
call fcn.00024dce
jmp 0x26728
lea eax, [esi + 0x38]
mov ecx, 0x262bd
xchg dword [eax], ecx
cmp byte [esi + 0x24], 0
je 0x266ac
and dword [esi + 0x58], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [edi], 0xf
mov eax, 0xc0000120
mov dword [ebp - 4], eax
jne 0x26698
push eax
push esi
call fcn.00024dce
xor ecx, ecx
lea eax, [esi + 0x38]
xchg dword [eax], ecx
test ecx, ecx
je 0x2672e
jmp 0x26741
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
cmp byte [edi], 0xf
je 0x266d6
cmp dword [edi + 0xc], 0x12090
je 0x266d6
lea ecx, [ebx + 0x38]
mov edx, dword [ecx + 4]
lea eax, [esi + 0x58]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ecx + 4], eax
jmp 0x266e8
lea ecx, [ebx + 0x38]
mov edx, dword [ecx]
lea eax, [esi + 0x58]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [edx + 4], eax
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov eax, 0x103
jmp 0x26757
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
call fcn.000263b5
test eax, eax
mov dword [ebp - 4], eax
jge 0x26757
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x28]
mov edx, dword [ecx]
add eax, 0x78
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [esi + 0x24], 0
je 0x26741
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov edi, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2782f
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00010514
test al, al
je 0x279c6
cmp dword [ebp + 0xc], 0xc000023f
jne 0x279c0
cmp word [ebx], 0xafd1
jne 0x279c0
test byte [ebx + 0x5d], 1
jne 0x279c0
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp + 0xc], esi
je 0x27884
movzx eax, word [eax + 4]
add eax, 8
mov dword [ebp + 8], eax
jmp 0x27887
mov dword [ebp + 8], esi
push edi
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea eax, [ebx + 0x28]
jmp 0x278b6
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [eax], edx
lea edi, [ecx - 0x58]
mov dword [edx + 4], eax
xor ecx, ecx
lea edx, [edi + 0x38]
xchg dword [edx], ecx
test ecx, ecx
jne 0x278bf
mov dword [edi + 0x58], esi
mov dword [ebp + 0xc], esi
cmp dword [eax], eax
jne 0x27899
lea eax, [ebx + 0x30]
jmp 0x278f0
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x27995
mov ecx, dword [eax]
mov edx, dword [ecx]
add ecx, 0xffffffa8
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [ebp + 0xc], ecx
xor edx, edx
add ecx, 0x38
xchg dword [ecx], edx
test edx, edx
jne 0x278f4
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x58], esi
mov dword [ebp + 0xc], esi
cmp dword [eax], eax
jne 0x278cd
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x48]
cmp eax, ecx
jae 0x279cd
cmp eax, esi
ja 0x27917
mov eax, dword [ebx + 0x44]
lea eax, [eax + eax*2]
shl eax, 4
cmp eax, ecx
jae 0x279cd
push dword [ebx + 0x18]
push dword [ebp + 8]
call fcn.0001c902
cmp eax, esi
je 0x279cd
mov edi, dword [eax + 0x14]
mov ecx, dword [ebp + 8]
mov edx, ecx
mov dword [eax + 0x20], esi
mov dword [eax + 0xc], esi
mov dword [eax + 8], esi
mov esi, dword [ebp + 0x10]
shr ecx, 2
mov dword [eax + 0x18], 0xc000023f
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov dword [eax + 0x10], ecx
lea ecx, [ebx + 0x38]
mov edx, dword [ecx + 4]
push 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
push 1
mov dword [ecx + 4], eax
inc dword [ebx + 0x44]
push ebx
call fcn.000103d2
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
test byte [ebx + 0xe], 1
je 0x2798c
push 0
push 1
push ebx
call fcn.00010545
xor esi, esi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x279be
push esi
push dword [ebp + 8]
mov dword [edi + 0x1c], esi
push dword [ebp + 0x10]
mov dword [edi + 0x18], 0xc000023f
push esi
push esi
push esi
push esi
push edi
call fcn.000293ee
mov dl, byte [0x12011]
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
push ebx
call fcn.0001b2f0
xor eax, eax
pop ebx
leave
ret 0xc
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x2798e
Function at 0x2b82b
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x1c]
lea edx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea eax, [edi + 0xb8]
mov esi, dword [eax]
xor ebx, ebx
cmp esi, ebx
lea ecx, [ebp - 0xc]
jne 0x2b85e
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x2b8ba
mov dword [esi + 0xc], ebx
mov dword [eax], ebx
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x2b887
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
push edi
call fcn.00025d28
mov dword [edi + 0xbc], ebx
cmp dword [esi + 0x5c], ebx
mov dl, byte [0x12011]
mov ecx, esi
sete byte [ebp + 0xb]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
cmp dword [0x12764], ebx
jbe 0x2b8ba
cmp byte [ebp + 0xb], bl
je 0x2b8ba
call fcn.0002b35b
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x2bcf1
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x28]
mov ecx, 0x12740
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
cmp dword [ebp + 8], 0
jne 0x2bd28
inc dword [0x12598]
jne 0x2bd28
mov dword [0x12598], 1
mov eax, dword [0x12598]
push esi
mov esi, dword [0x12748]
cmp esi, 0x12748
mov dword [ebp - 8], eax
je 0x2bde1
push ebx
push edi
jmp 0x2bd4a
mov esi, dword [ebp - 4]
cmp byte [esi + 0xe], 0
mov eax, dword [esi]
mov dword [ebp - 4], eax
jne 0x2bdd2
mov edx, dword [esi + 8]
mov edi, dword [edx + 0x60]
mov eax, dword [edi + 0x18]
mov ebx, dword [eax + 0xc]
cmp word [ebx], 0xafd
jne 0x2bdd2
cmp dword [ebp + 8], 0
je 0x2bd73
cmp ebx, dword [ebp + 8]
jne 0x2bdd2
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
and dword [esi], 0
xor eax, eax
add edx, 0x38
xchg dword [edx], eax
test eax, eax
je 0x2bdd2
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
xor eax, eax
cmp dword [edi + 4], eax
je 0x2bdc1
mov eax, dword [ebp - 8]
mov dword [ebx + 0x38], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 8]
mov dword [edi], eax
mov dword [eax + 4], edi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x10]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [ebp - 0xc], esi
jmp 0x2bdc9
cmp dword [edi + 8], eax
je 0x2bdc9
mov dword [edi + 8], eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
cmp dword [ebp - 4], 0x12748
jne 0x2bd47
pop edi
pop ebx
lea ecx, [ebp - 0x28]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
pop esi
jmp 0x2be11
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov eax, dword [ebp - 8]
and dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], eax
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x10]
cmp ecx, eax
jne 0x2bded
leave
ret 4
Function at 0x2c7ef
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x14]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea ebx, [esi + 0x38]
mov edi, dword [ebx]
cmp edi, ebx
je 0x2c8af
cmp dword [ebp + 0xc], 0
lea eax, [edi - 0x58]
mov edi, dword [edi]
jl 0x2c830
cmp dword [eax + 0x40], 0
je 0x2c84f
mov edx, dword [eax + 0x5c]
add eax, 0x58
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 4], eax
jmp 0x2c817
mov ecx, dword [eax + 0x60]
movzx edx, byte [ecx]
push 3
pop edi
sub edx, edi
je 0x2c870
dec edx
je 0x2c867
mov ebx, dword [eax + 0x48]
mov dword [ebp + 8], edi
jmp 0x2c87a
mov dword [ebp + 8], 2
jmp 0x2c877
mov dword [ebp + 8], 1
mov ebx, dword [ecx + 4]
mov ecx, dword [esi + 0x44]
mov edx, dword [ebp + 8]
lea edi, [edx + ecx*8]
mov dword [eax + 0x40], edi
inc dword [esi + 0x44]
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
push ebx
push 0
push edi
push esi
call fcn.0001a4e6
test al, al
je 0x2c806
cmp dword [ebp + 8], 3
je 0x2c8eb
jmp 0x2c806
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [esi + 0x4c], edi
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x2c8e1
mov eax, dword [ecx]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov dword [eax + 4], edx
and dword [ecx - 0x3c], 0
add ecx, 0xffffffa8
mov dword [ecx + 0x18], edi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
cmp ecx, eax
jne 0x2c8c0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x2d282
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
and dword [esi + 0x1c], 0
mov eax, dword [edx + 0x18]
push edi
mov edi, dword [eax + 0xc]
mov dword [ebp - 8], edx
lea ecx, [edi + 0x1c]
lea edx, [ebp - 0x14]
mov byte [ebp - 1], 0
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea ebx, [esi + 0x38]
mov eax, 0x2d1c3
xchg dword [ebx], eax
cmp byte [esi + 0x24], 0
je 0x2d2eb
and dword [esi + 0x58], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
xor eax, eax
xchg dword [ebx], eax
test eax, eax
jne 0x2d2e4
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov edi, 0xc0000120
jmp 0x2d340
cmp byte [edi + 2], 3
je 0x2d301
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov edi, 0xc0000140
jmp 0x2d340
mov eax, dword [edi + 0x4c]
cmp eax, 0x103
je 0x2d381
cmp eax, 0xc0000016
je 0x2d381
test eax, eax
jge 0x2d355
and dword [esi + 0x58], 0
lea ecx, [ebp - 0x14]
mov edi, eax
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
xor eax, eax
xchg dword [ebx], eax
test eax, eax
jne 0x2d340
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dword [esi + 0x18], edi
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x2d3c2
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
sub ecx, 3
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
je 0x2d36b
push 2
pop ecx
jmp 0x2d36e
xor ecx, ecx
inc ecx
mov eax, dword [edi + 0x44]
lea ebx, [ecx + eax*8]
inc eax
mov dword [edi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [ebp - 1], 1
jmp 0x2d388
and dword [esi + 0x40], 0
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
lea ecx, [edi + 0x38]
mov edx, dword [ecx + 4]
lea eax, [esi + 0x58]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [ebp - 1], 0
je 0x2d3bd
push dword [ebp - 8]
push 0
push ebx
push edi
call fcn.0001a4e6
mov eax, 0x103
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x39a54b05
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x165d091d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xeeecc
call fcn.0043aee0
mov eax, dword [0x464a70]
xor eax, ebp
mov dword [ebp - 0x20], eax
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xeeecc], 0
push 0
lea edx, [ebp - 0xeeecc]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xeeec8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [ebp - 0xd], 0xe7
push 0xe7
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xeeec8]
push ecx
call fcn.004013c0
add esp, 0xc
push 0x40
push 0x3000
push 0xeeea8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
push 0xeeea8
lea edx, [ebp - 0xeeec8]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00437960
add esp, 0xc
call dword [0x46895c]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
push 0
push 0
push 0x64
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [0x468960]
test eax, eax
jne 0x401502
jmp 0x401526
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [0x468958]
test eax, eax
je 0x401526
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObject_failed___d__n
call fcn.00437e03
add esp, 8
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004378f6
mov esp, ebp
pop ebp
ret

Function at 0x40c4bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40c504
call fcn.00414d0a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40c504
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40c520
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040c037
mov esi, eax
test edi, edi
je 0x40c51e
test ebx, ebx
je 0x40c51e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4