joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1620c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 - 0x18]
mov rbx, rcx
lea rcx, [0x000472f0]
mov qword [r11 - 0x10], rax
lea rax, [r11 - 0x18]
mov esi, edx
mov qword [r11 - 0x18], rax
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x000472e0]
lea r10, [0x000472e0]
mov r11b, al
jmp 0x162b5
lea rdx, [r8 - 0xa8]
mov r8, qword [r8]
mov rax, qword [rdx + 0xb8]
cmp qword [rax + 0x28], rbx
jne 0x162b5
mov rax, rdi
xchg qword [rdx + 0x68], rax
cmp rax, rdi
je 0x162b5
mov rax, qword [rdx + 0x18]
add rdx, 0xa8
lea r9, [rsp + 0x20]
mov dword [rax], esi
mov dword [rdx - 0x78], edi
mov qword [rdx - 0x70], 4
mov rax, qword [rdx + 8]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov qword [rdx + 8], rax
mov qword [rdx], r9
mov qword [rax], rdx
mov qword [rsp + 0x28], rdx
cmp r8, r10
jne 0x16253
lea rcx, [0x000472f0]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbx, qword [rsp + 0x20]
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1630d
mov dil, 1
lea rcx, [rbx - 0xa8]
mov rbx, qword [rbx]
mov rdx, qword [rcx + 0xb0]
mov r8, qword [rcx + 0xa8]
mov qword [rdx], r8
mov qword [r8 + 8], rdx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea r11, [rsp + 0x20]
cmp rbx, r11
jne 0x162dc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, dil
add rsp, 0x30
pop rdi
ret

Function at 0x18bf0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, rdx
mov ebx, r8d
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
mov r11, qword [rdi + 0xb8]
or byte [r11 + 3], 1
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.00020f14

Function at 0x18fe4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test r8d, r8d
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
jns 0x1901a
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], esi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x1902a
mov rcx, qword [rdx + 0xb8]
mov rcx, qword [rcx + 0x28]
call fcn.0001b0a0
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.00020f14
Function at 0x1b00c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
mov rcx, rbx
call fcn.00020f48
mov rsi, rax
test byte [rax], 0x20
jne 0x1b075
cmp qword [rax + 0x250], 0
je 0x1b075
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0003aae0
mov byte [rbx + 3], 0
mov rcx, qword [rsi + 0x250]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_PoCallDriver]
mov ebx, eax
jmp 0x1b088
mov ebx, 0xc0000002
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1b0a0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 0xb8]
mov rbx, rcx
mov rcx, rdx
or byte [rax + 3], 1
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
mov rcx, rbx
call fcn.00020f48
cmp qword [rax + 0x250], 0
je 0x1b0f9
test byte [rax], 0x20
jne 0x1b0f9
add byte [rdi + 0x43], 1
add qword [rdi + 0xb8], 0x48
mov rcx, qword [rax + 0x250]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_PoCallDriver]
jmp 0x1b104
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0x103
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1b4ec
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rdx + 0xb8]
mov rcx, rdx
mov rbx, rdx
or byte [rax + 3], 1
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0x103
add rsp, 0x20
pop rbx
ret

Function at 0x1b52c
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, rdx
mov rbx, rdx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], 0xc000000e
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc000000e
add rsp, 0x20
pop rbx
ret
Function at 0x20250
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x90
mov rdi, rcx
lea rdx, [0x0003cf30]
lea rcx, [rax - 0x68]
mov esi, 1
mov dword [rax + 8], esi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rdi + 0x258]
lea r9, [rsp + 0xa8]
mov r8d, 0x20000
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_IoOpenDeviceRegistryKey]
xor ebx, ebx
cmp eax, ebx
jl 0x203f0
mov rcx, qword [rsp + 0xa8]
lea r9d, [rsi + 3]
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rdx, [0x0003cf60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r11, qword [rdi + 0x240]
mov rcx, qword [r11 + 0x18]
cmp rcx, rbx
je 0x203e2
cmp dword [rcx + 0x20], 0x4e44445f
je 0x2031c
mov rax, qword [rcx + 0x10]
cmp rax, rbx
je 0x20314
mov rcx, qword [rcx + 8]
cmp qword [rax + 0x18], rcx
jne 0x20317
mov rcx, rbx
cmp rcx, rbx
jne 0x202f8
cmp rcx, rbx
je 0x203e2
lea rdx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
call fcn.0002c9e0
cmp eax, ebx
jl 0x203e2
cmp word [rsp + 0x62], 2
jne 0x20371
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov r8b, sil
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
cmp eax, ebx
jge 0x2038f
mov ebx, eax
lea rcx, [rsp + 0x60]
mov edx, esi
call fcn.0002da10
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x203f2
movzx eax, word [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rcx, [rsp + 0x60]
mov edx, esi
call fcn.0002da10
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x203f0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x21c1c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [r8 + 8]
and qword [rdx + 0x38], 0
mov rdi, rdx
cmp eax, 0x10
jae 0x21c61
mov ebx, 0xc0000004
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rdx + 0x18]
cmp dword [rbx], 0x4c676141
je 0x21c74
mov ebx, 0xc00000ef
jmp 0x21c41
mov edx, 0x20
xor ecx, ecx
mov r8d, 0x4c706341
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov rsi, rax
jne 0x21c96
mov ebx, 0xc000009a
jmp 0x21c41
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call fcn.0003cb30
mov qword [rbx + 8], rsi
mov qword [rdi + 0x38], 0x10
mov rcx, rsi
mov qword [rsi], rdi
mov word [rsi + 8], 1
call fcn.00026188
mov ebx, eax
mov eax, 0x103
cmp ebx, eax
jne 0x21c41
mov rcx, qword [rdi + 0xb8]
or byte [rcx + 3], 1
jmp 0x21c51

Function at 0x21ce8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
sub rsp, 0x60
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
and dword [r11 + 0x20], 0
lea rax, [r11 + 0x20]
xor r9d, r9d
mov rsi, rdx
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x20]
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x40], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x48], rax
call fcn.00022210
test eax, eax
mov ebx, eax
js 0x21da6
mov r9, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rax, [0x00021de0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.0002cadc
cmp qword [rsp + 0x48], 0
mov ebx, eax
je 0x21d7b
mov rcx, qword [rsp + 0x48]
mov edx, 0x41706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x103
cmp ebx, eax
je 0x21dce
test ebx, ebx
js 0x21da6
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.0002212c
mov rcx, qword [rsp + 0x40]
mov edx, 1
mov ebx, eax
call fcn.0002da10
cmp qword [rsp + 0x40], 0
je 0x21dbe
mov rcx, qword [rsp + 0x40]
mov edx, 0x52706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rsi
ret
Function at 0x2204c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
sub rsp, 0x50
and qword [r11 - 0x18], 0
and qword [r11 + 0x20], 0
and dword [rsp + 0x68], 0
lea rax, [r11 + 0x10]
mov r9d, 1
mov rsi, rdx
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x10]
mov qword [r11 - 0x38], rax
call fcn.00022210
test eax, eax
mov ebx, eax
js 0x220f0
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.0002c9e0
cmp qword [rsp + 0x40], 0
mov ebx, eax
je 0x220ce
mov rcx, qword [rsp + 0x40]
mov edx, 0x41706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test ebx, ebx
js 0x220f0
mov rdx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.0002212c
mov rcx, qword [rsp + 0x78]
mov edx, 1
mov ebx, eax
call fcn.0002da10
cmp qword [rsp + 0x78], 0
je 0x22108
mov rcx, qword [rsp + 0x78]
mov edx, 0x52706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rsi
ret

Function at 0x224d8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test rcx, rcx
mov esi, dword [r8 + 0x10]
mov ebx, dword [r8 + 8]
mov rdi, rdx
jne 0x224fb
xor ecx, ecx
jmp 0x2250c
call fcn.00020f48
test rax, rax
je 0x224f7
mov rcx, qword [rax + 0x240]
cmp esi, 0x20
mov qword [rdi + 0x38], 0x20
jae 0x22520
mov ebx, 0xc0000004
jmp 0x22583
cmp ebx, 0x10
jae 0x2252c
mov ebx, 0xc0000023
jmp 0x22583
mov rdx, qword [rdi + 0x18]
cmp dword [rdx], 0x486f7241
je 0x2253f
mov ebx, 0xc014000f
jmp 0x22583
mov r9, qword [rdx + 0x10]
mov r8d, dword [rdx + 8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx + 0x18]
mov edx, dword [rdx + 4]
mov qword [rsp + 0x20], rax
call fcn.000505ac
test eax, eax
mov ebx, eax
js 0x22583
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rsp + 0x40]
mov dword [rdx], 0x486f7541
mov qword [rdx + 8], rcx
mov qword [rdi + 0x38], 0x10
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x225ac
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
sub rsp, 0x60
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
and dword [r11 + 0x20], 0
lea rax, [r11 + 0x20]
xor r9d, r9d
mov rsi, rdx
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x20]
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x40], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x48], rax
call fcn.000227f4
test eax, eax
mov ebx, eax
js 0x2266a
mov r9, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rax, [0x000226a4]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.0002cadc
cmp qword [rsp + 0x48], 0
mov ebx, eax
je 0x2263f
mov rcx, qword [rsp + 0x48]
mov edx, 0x41706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x103
cmp ebx, eax
je 0x22692
test ebx, ebx
js 0x2266a
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.00022aac
mov rcx, qword [rsp + 0x40]
mov edx, 1
mov ebx, eax
call fcn.0002da10
cmp qword [rsp + 0x40], 0
je 0x22682
mov rcx, qword [rsp + 0x40]
mov edx, 0x52706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rsi
ret

Function at 0x22714
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
sub rsp, 0x50
and qword [r11 - 0x18], 0
and qword [r11 + 0x20], 0
and dword [rsp + 0x68], 0
lea rax, [r11 + 0x10]
mov r9d, 1
mov rsi, rdx
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x10]
mov qword [r11 - 0x38], rax
call fcn.000227f4
test eax, eax
mov ebx, eax
js 0x227b8
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.0002c9e0
cmp qword [rsp + 0x40], 0
mov ebx, eax
je 0x22796
mov rcx, qword [rsp + 0x40]
mov edx, 0x41706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test ebx, ebx
js 0x227b8
mov rdx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.00022aac
mov rcx, qword [rsp + 0x78]
mov edx, 1
mov ebx, eax
call fcn.0002da10
cmp qword [rsp + 0x78], 0
je 0x227d0
mov rcx, qword [rsp + 0x78]
mov edx, 0x52706341
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rsi
ret
Function at 0x262dc
Capabilities:
Complete processing asynchronous io request

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x00045e50]
lea rdx, [rcx + 0x40]
add rcx, 0x30
call qword [sym.imp.ntoskrnl.exe_ExInterlockedRemoveHeadList]
test rax, rax
jne 0x26336
mov rax, qword [0x00045e50]
mov rdx, qword [rax + 0x28]
mov ecx, dword [rdx]
mov rax, qword [0x00045e50]
cmp byte [rax + 0x54], 0
jne 0x26370
mov eax, ecx
and ecx, 0xfffffffc
lock cmpxchg dword [rdx], ecx
mov ecx, eax
jne 0x26314
test al, 1
je 0x26370
xor edx, edx
mov cx, 4
lea r8d, [rdx + 3]
call fcn.00025bf0
jmp 0x26370
mov rcx, qword [0x00045e50]
lea rdx, [rax - 0x10]
mov qword [rcx + 0x48], rdx
movzx eax, word [rdx + 0xa]
mov dword [rcx + 0x50], eax
movzx ecx, word [rdx + 8]
sub ecx, 1
je 0x26361
cmp ecx, 1
jne 0x26370
mov rcx, rdx
call qword [rdx]
jmp 0x26370
mov rcx, qword [rdx]
xor edx, edx
and dword [rcx + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
add rsp, 0x28
ret
Function at 0x29314
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
lea rax, [r11 - 0x38]
mov r12, rcx
lea rcx, [0x00046bc0]
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x38]
mov r14, rdx
mov qword [r11 - 0x38], rax
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rsi, qword [0x00046bb0]
mov r13b, al
mov byte [rsp + 0x70], al
lea rax, [0x00046bb0]
cmp rsi, rax
je 0x29412
lea r13, [0x00046bb0]
lea rbx, [rsi - 0xa8]
mov rsi, qword [rsi]
mov rbp, qword [rbx + 0xb8]
mov rcx, qword [rbp + 0x28]
call fcn.00020f48
cmp rax, r12
jne 0x29404
cmp dword [rbp + 0x18], 0x294080
jne 0x293cf
mov rax, rdi
xchg qword [rbx + 0x68], rax
cmp rax, rdi
je 0x29404
bts dword [r12 + 0xb8], 0x1d
mov rcx, qword [rbx + 0x18]
mov rdx, r14
mov r8d, 0x58
call fcn.0003aae0
mov qword [rbx + 0x38], 0x58
jmp 0x293d3
mov qword [rbx + 0x38], rdi
mov dword [rbx + 0x30], edi
lea rdx, [rbx + 0xa8]
lea r8, [rsp + 0x20]
mov rax, qword [rdx + 8]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov qword [rdx + 8], rax
mov qword [rdx], r8
mov qword [rax], rdx
mov qword [rsp + 0x28], rdx
cmp rsi, r13
jne 0x29375
mov r13b, byte [rsp + 0x70]
lea rcx, [0x00046bc0]
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbx, qword [rsp + 0x20]
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x29465
mov dil, 1
lea rcx, [rbx - 0xa8]
mov rbx, qword [rbx]
mov rdx, qword [rcx + 0xb0]
mov r8, qword [rcx + 0xa8]
mov qword [rdx], r8
mov qword [r8 + 8], rdx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea r11, [rsp + 0x20]
cmp rbx, r11
jne 0x29434
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov al, dil
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x2b7bc
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, qword [rdx + 0xb8]
mov rbx, rdx
mov rdi, rcx
call fcn.00020f48
mov rcx, rdi
call fcn.00020f48
movsxd r8, dword [rsi + 0x18]
xor edx, edx
mov rcx, qword [rax + 0xb0]
mov r8d, dword [rax + r8*4 + 0x1a4]
mov r11, rax
cmp rcx, rdx
jne 0x2b825
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
mov edi, 0xc0000001
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x2b8b6
cmp dword [rsi + 0x20], 7
jne 0x2b86b
mov rax, qword [rbx + 0xb8]
mov dword [rbx + 0x30], edx
or byte [rax + 3], 1
lock add dword [rcx + 0x220], 1
cmp dword [r11 + 0xb8], 4
lea r8, [fcn.00018bf0]
mov rdx, rbx
sete r9b
call fcn.000191f8
mov ecx, 0x103
cmp eax, 0xc0000016
cmove eax, ecx
jmp 0x2b8b6
cmp dword [rax + 0x140], r8d
mov rcx, rdi
jne 0x2b881
mov rdx, rbx
call fcn.0001b4ec
jmp 0x2b8b6
mov rax, qword [rbx + 0xb8]
mov dword [rbx + 0x30], edx
or byte [rax + 3], 1
lock add dword [r11 + 0x220], 1
mov qword [rsp + 0x28], rdx
lea r9, [0x0002b8cc]
mov dl, 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_PoRequestPowerIrp]
mov eax, 0x103
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x2bddc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x00042100]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x00045eb0]
and dword [rsp + 0x28], 0
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rdx, [0x0003f378]
xor r9d, r9d
xor r8d, r8d
mov byte [rsp + 0x40], 0xa4
mov byte [rsp + 0x41], 0x5b
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x42], 0x1f
mov byte [rsp + 0x43], 0xd
mov byte [rsp + 0x44], 0x53
mov byte [rsp + 0x45], 0x49
mov byte [rsp + 0x46], 0x4d
mov byte [rsp + 0x47], 0x54
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0xd
mov byte [rsp + 0x4a], 0x4d
mov byte [rsp + 0x4b], 0x53
mov byte [rsp + 0x4c], 0x46
mov byte [rsp + 0x4d], 0x54
mov byte [rsp + 0x4e], 0
mov byte [rsp + 0x4f], 0x68
mov byte [rsp + 0x50], 0xd
mov byte [rsp + 0x51], 0x5c
mov byte [rsp + 0x52], 0
mov byte [rsp + 0x53], 0xd
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x55], 0xa
mov byte [rsp + 0x56], 0
mov byte [rsp + 0x30], 0x5b
mov byte [rsp + 0x31], 0x2a
mov byte [rsp + 0x32], 0x68
call fcn.0002f14c
test eax, eax
jne 0x2bf1b
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x2bf1b
mov word [rbx + 0x3a], 8
lea r8d, [rax + 0x36]
mov edx, 0x52545348
mov dword [rbx + 0x50], r8d
mov rcx, qword [0x00045eb0]
call fcn.0002d2e8
cmp rax, 0
mov qword [rbx + 0x58], rax
je 0x2bf1b
mov r8d, dword [rbx + 0x50]
xor edx, edx
mov rcx, rax
call fcn.0003cb30
mov r11, qword [rbx + 0x58]
lea rdx, [rsp + 0x40]
or byte [r11 + 0x18], 1
mov rcx, qword [rbx + 0x58]
mov rax, qword [rdx]
mov qword [rcx + 0x19], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x21], rax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x29], eax
movzx eax, word [rdx + 0x14]
mov word [rcx + 0x2d], ax
mov al, byte [rdx + 0x16]
mov byte [rcx + 0x2f], al
mov rcx, qword [0x00045eb0]
and dword [rsp + 0x28], 0
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rdx, str.MSUT
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.0002f14c
test eax, eax
jne 0x2bfad
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x2bfad
mov word [rbx + 0x3a], 8
lea r8d, [rax + 0x22]
mov edx, 0x52545348
mov dword [rbx + 0x50], r8d
mov rcx, qword [0x00045eb0]
call fcn.0002d2e8
cmp rax, 0
mov qword [rbx + 0x58], rax
je 0x2bfad
mov r8d, dword [rbx + 0x50]
xor edx, edx
mov rcx, rax
call fcn.0003cb30
mov r11, qword [rbx + 0x58]
lea rdx, [rsp + 0x30]
or byte [r11 + 0x18], 1
mov rcx, qword [rbx + 0x58]
movzx eax, word [rdx]
mov word [rcx + 0x19], ax
mov al, byte [rdx + 2]
mov byte [rcx + 0x1b], al
call fcn.0002c068
test rax, rax
mov rbx, rax
jne 0x2bfc1
mov eax, 0xc000009a
jmp 0x2bff5
mov dword [rax], 1
mov dword [rax + 4], 5
mov dword [rax + 8], 1
mov rax, qword [0x00045ea8]
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.0002c0a8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.0003aa80
add rsp, 0x60
pop rbx
ret