joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42949
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
cmp edx, 0x38
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
jb 0x42a28
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
test esi, esi
mov dword [ebp + 8], eax
je 0x42a28
cmp esi, 0x2762762
ja 0x42a28
mov eax, esi
imul eax, eax, 0x34
add eax, 4
cmp edx, eax
jb 0x42a28
mov edi, esi
shl edi, 2
cmp dword [ecx + 4], edi
mov dword [ebp - 8], edi
jae 0x429b0
mov eax, 0xc0000023
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov esi, eax
jmp 0x42a30
push 0x10
push 0x69504354
push edi
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
test eax, eax
mov dword [ebp - 4], eax
jne 0x429ce
mov esi, 0xc000009a
jmp 0x42a2d
and dword [ebp + 0xc], 0
test esi, esi
jbe 0x429fe
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
push 4
push dword [ebp + 8]
call fcn.00042728
mov edx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add dword [ebp + 8], 0x34
cmp dword [ebp + 0xc], esi
mov dword [ecx + edx*4], eax
jb 0x429df
mov esi, dword [ebp - 4]
mov ecx, edi
mov edi, dword [ebx + 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 8]
mov dword [ebx + 0x1c], eax
jmp 0x42a2d
mov esi, 0xc000000d
mov dword [ebx + 0x18], esi
mov dl, 2
mov ecx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x42a48
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x34
push esi
mov esi, dword [ebp + 8]
push edi
jae 0x42a62
mov eax, 0xc000000d
jmp 0x42a6d
mov eax, dword [esi + 0xc]
push 5
push eax
call fcn.00042728
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], eax
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x42b90
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, 0x4ff10
xor ecx, ecx
mov eax, edi
inc ecx
lock xadd dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
cmp ecx, 0x4c
mov ebx, 0xc000000d
jb 0x42c18
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x42bf5
cmp eax, 0x1af286b
ja 0x42c17
dec eax
shl eax, 4
add eax, 0x38
cmp ecx, eax
jb 0x42c17
cmp dword [esi + 0x24], 2
je 0x42beb
test byte [esi + 4], 1
je 0x42beb
push dword [esi + 0x30]
push dword [esi + 8]
call fcn.00041792
push 6
push esi
call fcn.00042a89
jmp 0x42c15
cmp dword [esi + 0x24], 2
jne 0x42c17
push dword [esi + 0x30]
push dword [esi + 8]
call fcn.00041792
cmp eax, 0x2b04
jne 0x42c0f
xor eax, eax
push eax
call fcn.000233ee
mov ebx, eax
pop esi
mov eax, dword [ebp + 8]
mov dl, 2
mov ecx, eax
mov dword [eax + 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
or eax, 0xffffffff
lock xadd dword [edi], eax
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x42c3c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 4
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0xc]
jb 0x42cb2
cmp dword [eax + 4], 4
jb 0x42cb2
mov eax, dword [edi]
push ebx
mov ebx, 0x4fc00
mov ecx, ebx
mov dword [ebp + 0xc], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push 0
push 0x20
push 0
push dword [ebp + 0xc]
mov byte [ebp + 0xb], al
call fcn.00011f9a
test eax, eax
je 0x42c9a
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x88]
mov dword [edi], eax
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], 4
xor edi, edi
jmp 0x42ca4
mov eax, 0xc000023c
mov dword [esi + 0x18], eax
mov edi, eax
mov dl, byte [ebp + 0xb]
mov ecx, ebx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop ebx
jmp 0x42cbc
mov eax, 0xc000000d
mov dword [esi + 0x18], eax
mov edi, eax
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x43067
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 4
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], 0xc000000d
jb 0x4311d
cmp dword [eax + 4], 0x20
jb 0x4311d
push edi
mov edi, dword [esi]
mov ecx, 0x4fc00
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [0x51b34]
test ecx, ecx
je 0x4310f
cmp dword [ecx + 0x88], edi
je 0x430b9
mov ecx, dword [ecx]
test ecx, ecx
jne 0x430ab
test ecx, ecx
je 0x4310f
mov edx, dword [ecx + 0x160]
and dword [ebp - 4], 0
mov dword [esi], edx
mov edx, dword [ecx + 0x164]
mov dword [esi + 4], edx
mov edx, dword [ecx + 0x170]
mov dword [esi + 8], edx
mov edx, dword [ecx + 0x174]
mov dword [esi + 0xc], edx
mov edx, dword [ecx + 0x158]
mov dword [esi + 0x10], edx
mov edx, dword [ecx + 0x15c]
mov dword [esi + 0x14], edx
mov edx, dword [ecx + 0x168]
mov dword [esi + 0x18], edx
mov ecx, dword [ecx + 0x16c]
mov dword [esi + 0x1c], ecx
mov dword [ebx + 0x1c], 0x20
mov dl, al
mov ecx, 0x4fc00
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop edi
mov esi, dword [ebp - 4]
mov dl, 2
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x47e1c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 5]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov edi, 0x4fc00
mov ecx, edi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 1], al
mov eax, dword [0x505e0]
mov ecx, 0x505e0
cmp eax, ecx
je 0x47e6a
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
lea esi, [eax - 0x58]
cmp dword [esi + 0x40], edx
jne 0x47e64
mov ebx, dword [esi + 0x34]
cmp ebx, dword [ebp + 0x10]
je 0x47e8a
mov eax, dword [eax]
cmp eax, ecx
jne 0x47e54
mov dl, byte [ebp - 1]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
push dword [ebp - 5]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov eax, 0xc000000d
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ecx], eax
push 0
mov dword [eax + 4], ecx
call fcn.00040b23
mov dl, byte [ebp - 1]
mov ecx, edi
mov ebx, eax
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
push dword [ebp - 5]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ecx], ebx
mov dword [eax + 0x1c], 4
xor eax, eax
jmp 0x47e83
Function at 0x48001
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov eax, dword [0x505f0]
mov edi, 0x505f0
jmp 0x48061
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 4]
cmp ecx, dword [ebp + 8]
jne 0x4805f
mov edx, dword [eax + 8]
mov esi, dword [eax]
xor ecx, ecx
add edx, 0x38
xchg dword [edx], ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 8], eax
mov eax, esi
jmp 0x48061
mov eax, dword [eax]
cmp eax, edi
jne 0x4802a
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov esi, dword [ebp - 0xc]
jmp 0x48098
mov edi, dword [esi + 8]
mov eax, esi
mov esi, dword [esi]
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [edi + 0x1c], 0
mov dl, 2
mov ecx, edi
mov dword [edi + 0x18], 0xc0000120
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [ebp - 0xc]
cmp esi, eax
jne 0x48073
pop edi
pop esi
leave
ret 4

Function at 0x48100
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov eax, dword [0x505d0]
mov ecx, 0x505d0
cmp eax, ecx
je 0x48152
mov esi, dword [ebp + 8]
cmp dword [eax + 0x10], esi
je 0x48139
mov eax, dword [eax]
cmp eax, ecx
je 0x48155
jmp 0x48129
mov ebx, dword [eax + 8]
mov dword [ebp - 4], eax
xor ecx, ecx
lea edx, [ebx + 0x38]
xchg dword [edx], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
jmp 0x48155
mov esi, dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
cmp dword [ebp - 4], edi
jne 0x48176
push edi
push dword [esi + 0x10]
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push 0
push esi
call edi
jmp 0x481cd
push dword [ebp + 0xc]
call fcn.000233ee
mov edi, dword [ebx + 0xc]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x1c], eax
mov ecx, dword [esi + 0xc]
mov esi, dword [esi + 0x10]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
push edi
push dword [eax + 0x10]
call esi
push edi
push dword [ebp - 4]
call esi
push edi
push dword [ebp + 8]
call esi
cmp dword [ebp + 0xc], edi
je 0x481c3
mov dword [ebx + 0x1c], edi
mov dl, 2
mov ecx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x482ee
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov edi, 0x4fc00
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
mov eax, dword [0x505d8]
mov ecx, 0x505d8
cmp eax, ecx
je 0x48338
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
lea esi, [eax - 0x58]
cmp dword [esi + 0x40], edx
jne 0x48332
mov ebx, dword [esi + 0x34]
cmp ebx, dword [ebp + 0x10]
je 0x48355
mov eax, dword [eax]
cmp eax, ecx
jne 0x48322
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov eax, 0xc000000d
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ecx], eax
mov dword [eax + 4], ecx
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov eax, dword [0x4ff9c]
lea ecx, [eax + 1]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov dword [edx], ecx
push 2
mov dword [eax + 0x1c], 4
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [ebp - 4]
push eax
push 1
call fcn.000459e0
mov dl, byte [ebp - 4]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
xor eax, eax
jmp 0x4834e
Function at 0x49dd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0001cac6
mov edi, dword [ebp + 8]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x49fb0
mov ax, word [edi + 0x14]
mov word [esi + 0x14], ax
mov ax, word [edi + 0x16]
mov word [esi + 0x16], ax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x24]
dec eax
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x98], eax
mov ax, 6
mov ch, al
push esi
mov cl, ah
movzx eax, cx
xor cx, cx
mov dh, cl
mov dl, ch
movzx ecx, dx
add eax, ecx
movzx ecx, word [edi + 0x12]
add eax, ecx
movzx ecx, word [edi + 0xe]
add eax, ecx
movzx ecx, word [edi + 0xc]
add eax, ecx
movzx ecx, word [edi + 0x10]
add eax, ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x84], ebx
mov eax, dword [0x59b80]
and byte [esi + 0x126], 0xf1
mov dword [esi + 0x88], eax
mov ax, word [esi + 0x126]
mov word [esi + 0x8e], bx
mov word [esi + 0x90], 0x3c
mov word [esi + 0x8c], 0x1e
mov cx, word [edi + 0x1a]
mov word [esi + 0x20], cx
mov cx, word [edi + 0x1c]
mov word [esi + 0x22], cx
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x28], ecx
mov cx, word [edi + 0x3e]
mov word [esi + 0x132], cx
mov cx, word [edi + 0x3c]
mov word [esi + 0x130], cx
mov cl, byte [edi + 0x1e]
or dword [esi + 0x7c], 0x10
and cl, 7
movzx cx, cl
and eax, 0xffffff8f
mov byte [esi + 0x1c], 3
mov dword [esi + 0xb4], ebx
mov dword [esi + 8], 1
shl ecx, 4
or ecx, eax
mov word [esi + 0x126], cx
mov eax, dword [edi + 0x2c]
and eax, 5
or dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x134], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x13c], eax
mov al, byte [edi + 0x19]
mov byte [esi + 0x1d], al
call fcn.00013e31
lea eax, [esi + 0xdc]
push eax
call dword [0x59d10]
mov al, byte [edi + 0x1f]
lea ecx, [edi + 8]
mov byte [esi + 0xe5], al
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
push dword [ebp + 0x10]
push ebx
push esi
call fcn.0001c965
mov ebx, dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
lea ecx, [esi + 4]
mov dword [ebp + 8], eax
call ebx
cmp dword [ebp + 8], 0
je 0x49f8a
test byte [esi + 0x1e], 1
jne 0x49f9f
dec dword [esi + 8]
lea ecx, [edi + 8]
call ebx
mov ax, word [edi + 0x36]
cmp ax, 2
jae 0x49f7c
push 2
pop eax
jmp 0x49f7f
movzx eax, ax
push eax
push 0
push esi
call fcn.000169ec
jmp 0x49fca
test byte [esi + 0x1e], 1
jne 0x49f9f
push 2
push 0x40
push esi
call fcn.0001b38b
lea ecx, [esi + 4]
call ebx
push 2
push esi
call fcn.00013d9a
lea ecx, [edi + 8]
xor esi, esi
call ebx
jmp 0x49fca
push ebx
lea eax, [edi + 0xc]
push eax
push 1
push 4
call fcn.00014c90
movzx eax, byte [edi + 0x19]
push 1
push eax
call fcn.00049514
push dword [ebp + 0xc]
push edi
call fcn.00049d67
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4c074
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
xor edx, edx
push esi
mov dword [ebx + 0x1c], edx
cmp dword [eax + 8], 8
mov esi, dword [eax + 4]
push edi
mov dword [ebp - 0x10], ecx
jae 0x4c0a8
mov eax, 0xc000000d
mov dword [ebx + 0x18], eax
mov edi, eax
jmp 0x4c23e
cmp byte [ecx], 0
mov dword [ebp - 0xc], edx
je 0x4c1d0
mov edi, dword [0x59ba4]
inc edi
cmp esi, 4
jb 0x4c099
mov ecx, dword [ecx + 4]
cmp ecx, edx
mov dword [ebp - 8], ecx
je 0x4c099
cmp di, 0xc000
jae 0x4c1c2
movzx eax, di
mov edx, 0xc000
sub edx, eax
movzx eax, cx
cmp edx, eax
jl 0x4c1c2
mov ecx, 0x50200
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov esi, dword [0x50500]
mov byte [ebp + 0xf], al
jmp 0x4c139
test esi, esi
je 0x4c127
cmp di, word [esi + 6]
jb 0x4c127
xor eax, eax
mov ax, word [esi + 4]
cmp di, ax
ja 0x4c127
lea edi, [eax + 1]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [esi]
mov dword [ebp - 4], eax
mov ebx, edi
jmp 0x4c14d
mov ax, di
mov ch, al
mov cl, ah
push ecx
call fcn.0004a687
test eax, eax
je 0x4c143
inc edi
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ebx, edi
jmp 0x4c14d
dec dword [ebp - 4]
inc edi
cmp dword [ebp - 4], 0
je 0x4c15a
cmp di, 0xc000
jb 0x4c100
cmp dword [ebp - 4], 0
jne 0x4c1bb
push 0x10
push 0x74504354
push 8
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
test eax, eax
je 0x4c1b1
mov ecx, dword [ebp - 8]
lea ecx, [ebx + ecx - 1]
mov word [eax + 4], cx
mov ecx, dword [ebp - 0xc]
test ecx, ecx
mov word [eax + 6], bx
je 0x4c18d
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
jmp 0x4c19a
mov ecx, dword [0x50500]
mov dword [eax], ecx
mov dword [0x50500], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x1c], 4
movzx eax, bx
mov ebx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x4c22b
mov edi, 0xc000009a
mov ebx, dword [ebp + 8]
jmp 0x4c22d
mov edi, 0xc000000d
jmp 0x4c1b6
mov dword [ebx + 0x18], 0xc000000d
mov edi, 0xc000009a
jmp 0x4c23e
mov eax, dword [ecx + 4]
mov esi, dword [0x50500]
mov ecx, 0x50200
mov dword [ebp + 8], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp + 0xf], al
mov edi, 0xc000000d
jmp 0x4c208
movzx eax, word [esi + 6]
cmp eax, dword [ebp + 8]
je 0x4c20e
movzx eax, word [esi + 4]
cmp dword [ebp + 8], eax
jbe 0x4c22d
mov dword [ebp - 0xc], esi
mov esi, dword [esi]
test esi, esi
je 0x4c22d
jmp 0x4c1f1
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4c21e
mov eax, dword [esi]
mov dword [0x50500], eax
jmp 0x4c222
mov ecx, dword [esi]
mov dword [eax], ecx
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
mov dl, byte [ebp + 0xf]
mov ecx, 0x50200
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dword [ebx + 0x18], edi
mov dl, 2
mov ecx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x59e85
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x60]
movzx ecx, byte [eax]
push edi
xor edi, edi
sub ecx, edi
je 0x5a1e0
dec ecx
dec ecx
je 0x5a1e0
sub ecx, 0xc
jne 0x5a1f4
push eax
push esi
call fcn.000166b1
pop edi
pop esi
pop ebp
ret 8
mov dl, 2
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x59eb7
dec ecx
je 0x59eb0
sub ecx, 3
jne 0x5b4fb
push eax
push esi
call fcn.0001f623
mov edi, eax
jmp 0x5a1e0
mov edi, 0xc0000002
jmp 0x5a1e0

Function at 0x5a2c2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x60]
or byte [eax + 3], 1
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
push edi
push 0x10
push 0x69494354
push 0x14
push 0
call esi
mov edi, eax
test edi, edi
je 0x5b49b
push 0x10
push 0x6a494354
push 0x28
push 0
call esi
xor ecx, ecx
mov esi, eax
cmp esi, ecx
push ecx
je 0x5b4a4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x1c
jb 0x5b4b4
mov dword [edi + 8], ebx
mov eax, dword [eax + 0x18]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], esi
call dword [sym.imp.HAL.dll_KeQueryPerformanceCounter]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
and dword [esi + 0x1c], 0
push edi
push ebx
mov dword [esi + 0x14], eax
call fcn.0001ff32
test al, al
jne 0x5b4cb
mov eax, dword [ebp + 0xc]
push fcn.0001fe95
push esi
push dword [eax + 8]
push dword [ebx + 0xc]
call fcn.0005a382
cmp eax, 0x2bf7
jne 0x5a4dd
pop edi
pop esi
mov eax, 0x103
pop ebx
pop ebp
ret 8
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call fcn.0001fe95
jmp 0x5a371
mov dword [ebp + 0xc], 0xc000009a
jmp 0x5b4e2
push edi
mov dword [ebp + 0xc], 0xc000009a
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x5b4e2
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp + 0xc], 0xc000000d
call esi
push 0
push edi
call esi
jmp 0x5b4e2
push 0
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp + 0xc], 0xc0000120
call edi
push 0
push esi
call edi
mov eax, dword [ebp + 0xc]
and dword [ebx + 0x1c], 0
mov dl, 2
mov ecx, ebx
mov dword [ebx + 0x18], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x5a371
Function at 0x5a7af
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp + 0xc]
push eax
movzx eax, word [ebx]
push eax
push dword [esi]
lea eax, [ebp - 8]
push 2
push eax
push dword [ebp + 8]
call edi
cmp eax, 0x80000005
mov ecx, 0xc0000023
je 0x5a86c
cmp eax, ecx
je 0x5a86c
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 0xffff
ja 0x5a8c2
push 0x69504354
push dword [ebp + 0xc]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test eax, eax
mov dword [ebp + 0x14], eax
je 0x5a8b8
mov eax, dword [esi]
test eax, eax
jne 0x5b556
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
mov word [ebx], ax
push dword [esi]
lea eax, [ebp - 8]
push 2
push eax
push dword [ebp + 8]
call edi
jmp 0x5a7f7
mov eax, 0xc000009a
jmp 0x5a7f7
mov eax, ecx
jmp 0x5a7f7
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x5a896

Function at 0x5af6b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp + 0xc]
push eax
push dword [ebx]
lea eax, [ebp - 8]
push dword [esi]
push 2
push eax
push dword [ebp + 8]
call edi
cmp eax, 0x80000005
je 0x5b505
cmp eax, 0xc0000023
je 0x5b505
pop edi
pop esi
pop ebx
leave
ret 0x10
push 0x69504354
push dword [ebp + 0xc]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test eax, eax
mov dword [ebp + 0x14], eax
je 0x5b54c
mov eax, dword [esi]
test eax, eax
je 0x5b52b
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
mov dword [ebx], eax
push dword [esi]
lea eax, [ebp - 8]
push 2
push eax
push dword [ebp + 8]
call edi
jmp 0x5afb7
mov eax, 0xc000009a
jmp 0x5afb7