joyce8/EMBER2024-capa huggingface dataset:
Function at 0x142a0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
call fcn.00017200
test al, al
jne 0x142cc
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1441b
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push edi
mov ecx, 0x1a590
call esi
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
cdq
push edx
push eax
push dword [0x1a59c]
call fcn.000104f2
mov edi, dword [ebp + 8]
mov ebx, eax
test ebx, ebx
je 0x143ee
mov eax, dword [ebp + 0xc]
add eax, 4
je 0x1432a
test byte [eax + 4], 0x20
je 0x1432a
mov dl, byte [ebp - 1]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov edx, edi
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
jmp 0x1440f
test byte [ebx + 0x30], 2
je 0x143ee
cmp byte [ebx + 0xd1], 0
jne 0x143ee
call fcn.00017200
test al, al
je 0x1441f
cmp byte [ebx + 0x131], 0
jne 0x1441f
lea ecx, [ebx + 0x134]
mov dword [ebp + 8], ecx
call esi
lea ecx, [ebx + 0x104]
mov edx, dword [ecx + 4]
lea esi, [edi + 0x58]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [edx], esi
mov dword [ecx + 4], esi
mov ecx, dword [ebp + 8]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [edi + 0x60]
or byte [eax + 3], 1
and dword [edi + 0x1c], 0
lea ecx, [edi + 0x38]
mov eax, 0x1359e
xchg dword [ecx], eax
mov dword [ebp + 0xc], eax
mov eax, 0x103
mov dword [edi + 0x18], eax
push dword [ebx + 0x24]
mov dword [ebp - 8], eax
push dword [ebx + 0x20]
push 3
call fcn.00017d8e
test eax, eax
jge 0x143ee
mov ecx, dword [ebp + 8]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebx], ecx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dl, al
mov dword [esi + 4], esi
mov dword [esi], esi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x38]
xchg dword [eax], ecx
and dword [edi + 0x18], 0
and dword [ebp - 8], 0
mov dl, byte [ebp - 1]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, 0x103
cmp dword [ebp - 8], eax
je 0x14418
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
mov ecx, dword [ebp + 0x10]
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dl, byte [ebp - 1]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
and dword [ecx + 0x1c], 0
mov esi, 0xc0000184
xor dl, dl
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x14418
Function at 0x14aa0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x58], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x5c], edi
call fcn.00017200
test al, al
jne 0x14ad5
mov ecx, edi
jmp 0x14bd2
push 0x4b
lea eax, [ebp - 0x50]
push 0
push eax
call sub.ntoskrnl.exe_memset
mov edi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
add esp, 0xc
push 0xe
pop eax
push 2
mov word [ebp - 0x50], ax
pop eax
mov ecx, 0x1a590
mov word [ebp - 0x4e], ax
call edi
mov byte [ebp - 0x51], al
mov eax, dword [ebx + 0x18]
cdq
push edx
push eax
push dword [0x1a5b8]
call fcn.000104f2
test eax, eax
je 0x14bb7
lea ebx, [eax - 8]
lea eax, [ebp - 0x4e]
push eax
push 1
push ebx
call fcn.00018916
test al, 1
je 0x14b5a
mov dl, byte [ebp - 0x51]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
and dword [esi + 0x1c], 0
mov edi, 0xc0000141
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x14be1
test al, 2
je 0x14bb7
cmp byte [ebx + 0x15d], 0
jne 0x14bb7
lea ecx, [ebx + 0x1a0]
call edi
lea ecx, [esi + 0x58]
lea edi, [ebx + 0x170]
mov dl, al
mov eax, dword [edi + 4]
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov dword [edi + 4], ecx
lea ecx, [ebx + 0x1a0]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
mov eax, 0x149fc
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
push 3
mov edi, 0x103
push ebx
mov dword [esi + 0x18], edi
call fcn.00011854
mov dword [ebp - 0x58], edi
mov dl, byte [ebp - 0x51]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, 0x103
cmp dword [ebp - 0x58], eax
je 0x14be1
mov ecx, dword [ebp - 0x5c]
inc byte [esi + 0x23]
add dword [esi + 0x60], 0x24
mov edx, esi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00018b7d
leave
ret 0xc
Function at 0x151ec
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
cmp edi, edx
jne 0x15211
mov dword [ebp + 8], 0xc0000141
jmp 0x153a2
mov eax, dword [edi + 8]
or eax, dword [edi + 0xc]
je 0x15205
mov eax, dword [edi + 0xf0]
mov ecx, dword [edi + 0xf4]
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], ecx
cmp eax, edx
je 0x15205
lea eax, [edi + 0x168]
push esi
mov esi, dword [eax]
mov dword [ebp - 0x10], eax
cmp esi, edx
je 0x1539a
cmp esi, eax
je 0x1539a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
cmp dword [esi + 0xc], edx
jl 0x15394
cmp dword [esi + 0x9c], edx
je 0x15394
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
lea ecx, [edi + 0x1a0]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [esi + 0x9c]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x98]
lea ecx, [esi + ecx + 0xa4]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push eax
push dword [esi + 0x10]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [ebp + 8]
call dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebx], al
mov eax, dword [edi + 8]
or eax, dword [edi + 0xc]
jne 0x15303
push esi
call fcn.00015bc8
mov ecx, dword [ebp - 4]
mov eax, 0xc0000141
mov dword [ebp + 8], eax
test ecx, ecx
je 0x153a1
xor edx, edx
add ecx, 0x38
xchg dword [ecx], edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 4]
and dword [eax + 0x1c], 0
push 0
push dword [ebp - 4]
call fcn.0001720c
jmp 0x153a1
mov eax, 0xc000021b
cmp dword [ebp + 8], eax
jne 0x15313
and dword [ebp - 8], 0
jmp 0x15322
cmp dword [ebp + 8], 0
jne 0x15322
cmp dword [ebp - 8], 0
jne 0x15322
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x9c]
cmp dword [ebp - 8], eax
jae 0x15356
cmp dword [ebp - 4], 0
je 0x15356
sub eax, dword [ebp - 8]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 8]
add dword [esi + 0x98], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [ecx + 4], esi
mov dword [eax], esi
jmp 0x1535f
push esi
call fcn.00015bc8
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], 0
je 0x153a1
push eax
push dword [ebp - 4]
call fcn.00015056
mov dl, byte [ebx]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp - 4]
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebx], al
jmp 0x153a1
push esi
call fcn.00015bc8
mov dword [ebp + 8], 0xc0000141
pop esi
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 8
Function at 0x153b0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x1a0]
mov dword [ebp - 8], ecx
call ebx
mov byte [ebp + 0xb], al
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x154b3
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x154b3
mov eax, dword [esi + 0x1c]
cmp eax, dword [ebp + 0x10]
jne 0x154b3
lea eax, [esi + 0x168]
cmp dword [eax], eax
je 0x154b3
push edi
jmp 0x1547e
lea ecx, [esi + 0x168]
cmp dword [ecx], ecx
je 0x15488
mov edi, dword [eax]
mov ecx, dword [edi]
mov dword [eax], ecx
mov dword [ecx + 4], eax
cmp edi, eax
je 0x1547e
add edi, 0xffffffa8
lea eax, [edi + 0x58]
mov dword [eax + 4], eax
mov dword [eax], eax
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
lea eax, [esi + 0x168]
push eax
push edi
call fcn.00015056
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 8]
call ebx
cmp dword [ebp - 4], 0
mov byte [ebp + 0xb], al
jl 0x154b2
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x154b2
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x154b2
mov eax, dword [esi + 0x1c]
cmp eax, dword [ebp + 0x10]
jne 0x154b2
lea eax, [esi + 0x170]
cmp dword [eax], eax
jne 0x15409
lea edi, [esi + 0x168]
jmp 0x154a1
lea eax, [ebp + 0xb]
push eax
push esi
call fcn.000151ec
mov dword [ebp - 4], eax
test eax, eax
jl 0x154a7
cmp dword [edi], edi
jne 0x15490
jmp 0x154b2
cmp eax, 0xc000021b
jne 0x154b2
and dword [ebp - 4], 0
pop edi
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x154e4
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
cmp eax, dword [ebp + 0xc]
jne 0x154e4
cmp ecx, dword [ebp + 0x10]
jne 0x154e4
cmp dword [ebp - 4], 0
jl 0x154e4
add esi, 0x168
cmp dword [esi], esi
jne 0x154e4
push ecx
push eax
push 0xc
call fcn.00017d8e
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp - 8]
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x15726
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
call fcn.00017200
test al, al
jne 0x15753
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x158c8
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push edi
mov ecx, 0x1a590
call esi
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
cdq
push edx
push eax
push dword [0x1a5b8]
call fcn.000104f2
mov edi, dword [ebp + 8]
mov ebx, eax
test ebx, ebx
je 0x15894
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x157b9
mov dl, byte [ebp - 1]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
and dword [ecx + 0x1c], 0
mov esi, 0xc00000bc
xor dl, dl
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x158c5
test al, 2
je 0x15894
cmp byte [ebx + 0x155], 0
jne 0x15894
lea ecx, [ebx + 0x198]
mov dword [ebp + 0xc], ecx
call esi
mov byte [ebp + 0xb], al
lea eax, [ebx + 0x180]
push eax
call fcn.00016024
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
test byte [ebx + 0x1c], 4
jne 0x15894
cmp dword [ebp - 0xc], 5
jge 0x15894
mov ecx, dword [ebp + 0xc]
call esi
lea ecx, [ebx + 0x180]
mov edx, dword [ecx + 4]
lea esi, [edi + 0x58]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [edx], esi
mov dword [ecx + 4], esi
mov ecx, dword [ebp + 0xc]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [edi + 0x60]
or byte [eax + 3], 1
lea ecx, [edi + 0x38]
mov eax, 0x149fc
xchg dword [ecx], eax
mov dword [ebp + 8], eax
mov eax, 0x103
mov dword [edi + 0x18], eax
push dword [ebx + 0x14]
mov dword [ebp - 8], eax
push dword [ebx + 0x10]
push 0xb
call fcn.00017d8e
test eax, eax
jge 0x15894
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebx], ecx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 0xc]
mov dl, al
mov dword [esi + 4], esi
mov dword [esi], esi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x38]
xchg dword [eax], ecx
and dword [edi + 0x18], 0
and dword [ebp - 8], 0
mov dl, byte [ebp - 1]
mov ecx, 0x1a590
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov eax, dword [ebp - 8]
cmp eax, 0x103
je 0x158c5
cmp eax, 0xc000009a
je 0x158c5
mov ecx, dword [ebp + 0x10]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1701e
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edi, 0x1a620
mov ecx, edi
mov esi, eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
cmp byte [0x1a630], 0
je 0x1704f
mov esi, dword [ebp + 8]
mov dword [esi + 0x18], 0xc0000010
jmp 0x17063
mov dword [0x1a634], esi
mov esi, dword [ebp + 8]
mov byte [0x1a630], 1
and dword [esi + 0x18], 0
mov dl, al
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
cmp dword [esi + 0x18], 0
jne 0x17078
call fcn.000117d2
and dword [esi + 0x1c], 0
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [esi + 0x18]
pop edi
pop esi
pop ebp
ret 8

Function at 0x174a6
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0xc]
test esi, esi
je 0x1750e
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x20
jb 0x1750e
cmp dword [0x19900], 0
mov ebx, 0x198e8
jne 0x174e4
push 0
push 0x640000
push 0x19900
call fcn.00017316
test eax, eax
jl 0x174fe
cmp dword [0x198e8], 0
jne 0x1751e
push 0
push 0x40000
push ebx
call fcn.00017316
test eax, eax
jge 0x1751e
push 0x19900
call fcn.0001743a
push ebx
call fcn.0001743a
and dword [edi + 0x1c], 0
mov eax, 0xc0000001
mov dword [edi + 0x18], eax
mov esi, eax
jmp 0x17561
mov eax, dword [0x19904]
cdq
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [0x19910]
mov dword [esi + 8], eax
mov eax, dword [0x19914]
mov dword [esi + 0xc], eax
mov eax, dword [0x198ec]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0x198f8]
mov dword [esi + 0x18], eax
mov eax, dword [0x198fc]
mov dword [esi + 0x1c], eax
xor esi, esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], 0x20
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x17ce4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov ecx, dword [0x1a5d0]
push ebx
mov eax, 0x1a5d0
push esi
push edi
cmp ecx, eax
je 0x17d6c
mov edx, dword [ecx]
mov dword [0x1a5d0], edx
mov dword [edx + 4], eax
lea esi, [ecx - 0x58]
lea eax, [esi + 0x58]
mov dword [eax + 4], eax
mov dword [eax], eax
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
mov eax, dword [esi + 4]
test byte [eax + 6], 5
mov ebx, dword [esi + 0x60]
je 0x17d24
mov edi, dword [eax + 0xc]
jmp 0x17d36
push 0x10
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov edi, eax
test edi, edi
je 0x17d72
cmp dword [ebx + 4], 8
jb 0x17d72
push dword [0x19910]
push dword [0x19908]
call fcn.00017a9c
and dword [edi + 4], 0
mov dword [edi], eax
and dword [esi + 0x18], 0
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], 8
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x17d6e
Function at 0x17eca
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00018696
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ebx, 0x1a590
mov ecx, ebx
call esi
mov edi, 0x1a620
mov ecx, edi
mov byte [ebp - 2], al
call esi
and dword [0x1a634], 0
mov byte [ebp - 1], al
mov byte [0x1a630], 0
call fcn.00017094
mov esi, 0x1a5d0
jmp 0x17f15
call fcn.00017ce4
cmp dword [0x1a5d0], esi
jne 0x17f10
mov dl, byte [ebp - 1]
mov esi, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
call esi
mov dl, byte [ebp - 2]
mov ecx, ebx
call esi
call fcn.000170c4
push 0x19900
call fcn.0001743a
push 0x198e8
call fcn.0001743a
mov ecx, dword [ebp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x17f6c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
test byte [eax + 6], 5
push edi
je 0x17f84
mov edi, dword [eax + 0xc]
jmp 0x17f96
push 0x10
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov edi, eax
test edi, edi
je 0x18056
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 8
jb 0x18056
push ebx
mov ebx, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, 0x1a590
call ebx
mov ecx, 0x1a620
mov byte [ebp + 0xf], al
call ebx
push dword [0x19910]
mov byte [ebp + 0xb], al
push dword [0x19908]
call fcn.00017a9c
xor ebx, ebx
mov dword [edi], eax
or eax, ebx
mov dword [edi + 4], ebx
jne 0x1801f
mov edi, 0x1a5d0
cmp dword [0x1a5d0], edi
jne 0x1801f
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
lea eax, [esi + 0x58]
mov edx, 0x103
mov dword [esi + 0x18], edx
mov ecx, dword [0x1a5d4]
mov dword [eax + 4], ecx
mov dword [eax], edi
mov dword [ecx], eax
mov dword [0x1a5d4], eax
mov eax, 0x17194
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
mov ebx, edx
mov dl, byte [ebp + 0xb]
mov edi, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, 0x1a620
call edi
mov dl, byte [ebp + 0xf]
mov ecx, 0x1a590
call edi
test ebx, ebx
jne 0x18051
and dword [esi + 0x18], ebx
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], 8
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
pop ebx
jmp 0x1806a
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x185b8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
xor edi, edi
test byte [eax + 6], 5
je 0x185d9
mov eax, dword [eax + 0xc]
jmp 0x185e7
push 0x10
push edi
push edi
push 1
push edi
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
cmp eax, edi
je 0x18611
cmp ebx, 8
jb 0x18611
push dword [eax]
push dword [0x198f0]
call fcn.000184d4
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x18625
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40f3ab
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40f3e6
add dword [esp], 5
retf

Function at 0x40f551
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40f58c
add dword [esp], 5
retf

Function at 0x41291f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f3ab
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41297f
add dword [esp], 5
retf

Function at 0x412bc8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f3ab
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x412c28
add dword [esp], 5
retf

Function at 0x412e16
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x412e51
add dword [esp], 5
retf

Function at 0x4130e2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41311d
add dword [esp], 5
retf

Function at 0x4153cf
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41540a
add dword [esp], 5
retf
Function at 0x41b6cb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41b706
add dword [esp], 5
retf

Function at 0x41ba10
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41ba4b
add dword [esp], 5
retf

Function at 0x41bb34
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41bb60
add dword [esp], 5
retf

Function at 0x41be95
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x12251c0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x41bed0
add dword [esp], 5
retf