joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1889e
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
cmp byte [ebx + 1], 7
push esi
push edi
mov dword [ebp - 4], ecx
jne 0x1891a
cmp dword [ebx + 4], 4
jne 0x1891a
mov eax, dword [ebx + 0x18]
mov esi, dword [eax + 0xc]
movzx eax, word [esi]
sub eax, 0xafd1
je 0x18901
dec eax
je 0x188d3
dec eax
dec eax
je 0x18901
dec eax
dec eax
jne 0x1891a
push esi
call fcn.0001bf07
mov edi, eax
test edi, edi
je 0x18901
push ebx
push dword [ebp - 4]
push dword [edi + 0xc]
call fcn.0001815f
mov esi, eax
lea eax, [edi + 0x20]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x18931
push edi
call fcn.0001c24b
jmp 0x18931
mov al, byte [esi + 2]
cmp al, 2
je 0x1890c
cmp al, 3
jne 0x1891a
push ebx
push dword [ebp - 4]
push dword [esi + 0x10]
call fcn.0001815f
jmp 0x18933
mov ecx, dword [ebp - 4]
mov esi, 0xc0000010
mov dword [ecx + 0x18], esi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1a4ba
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00012fc3
push 1
push dword [ebp + 0x14]
mov ebx, eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0x28]
push dword [ebp + 0xc]
push dword [esi + 0x30]
push dword [eax + 0x30]
call dword [sym.imp.ntoskrnl.exe_IoSetIoCompletion]
push ebx
push esi
mov edi, eax
call fcn.00013008
test edi, edi
jge 0x1a51f
cmp dword [ebp + 0x10], 0xc0000120
je 0x1a51f
push dword [ebp + 0xc]
push esi
call fcn.0002bad4
test eax, eax
je 0x1a51b
mov dword [eax + 0x18], edi
mov dl, byte [0x12011]
mov ecx, eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor al, al
jmp 0x1a521
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1b280
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x60]
push esi
push edi
mov edi, dword [edx + 0xc]
mov eax, edi
shr eax, 2
and eax, 0x3ff
cmp eax, 0x46
jae 0x21bef
mov esi, eax
shl esi, 2
cmp dword [esi + 0x120a0], edi
jne 0x21bef
mov byte [edx + 1], al
mov esi, dword [esi + 0x121b8]
test esi, esi
je 0x21bef
call esi
pop edi
pop esi
pop ebp
ret 8
mov esi, 0xc0000010
mov dword [ecx + 0x18], esi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x1b2c7
Function at 0x1c1aa
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
add ecx, 0x1c
push edi
lea edx, [ebp - 0xc]
mov dword [ebp + 0xc], ecx
call ebx
mov edi, dword [ebp + 8]
cmp dword [edi], edi
jne 0x22467
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
pop edi
pop ebx
leave
ret 0x10
push esi
mov eax, dword [edi]
mov ecx, dword [eax]
mov dword [edi], ecx
lea esi, [eax - 0x58]
mov dword [ecx + 4], edi
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x22484
and dword [esi + 0x58], eax
jmp 0x224bb
cmp dword [ebp + 0x14], 0
je 0x22492
push esi
call dword [ebp + 0x14]
test al, al
je 0x224bb
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov eax, dword [ebp + 0x10]
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
call ebx
cmp dword [edi], edi
jne 0x22468
pop esi
jmp 0x1c1d3
Function at 0x1ccb7
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
push edi
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
sub dword [esi + 0x50], ecx
dec dword [esi + 0x54]
mov ecx, dword [esi + 0x54]
xor edx, edx
cmp dword [eax + 0x18], edx
jl 0x24296
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x64]
lea eax, [esi + 0x48]
setb byte [ebp + 0xb]
cmp dword [eax], eax
jne 0x24310
test byte [esi + 6], 1
jne 0x242cb
cmp byte [ebp + 0xb], 0
je 0x1cd1c
push edx
push 4
push ebx
call fcn.000103d2
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [ebp + 0xb], 0
je 0x1cd3b
test byte [ebx + 0xe], 1
je 0x1cd3b
push 0
push 4
push ebx
call fcn.00010545
pop edi
pop esi
pop ebx
leave
ret 8
mov edi, dword [esi + 0x58]
cmp edi, edx
je 0x242a0
mov dword [esi + 0x58], edx
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
push esi
call fcn.0001e328
test edi, edi
je 0x242be
mov ecx, dword [esi + 0x10]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
push 0
push esi
call fcn.0001c64e
jmp 0x1cd3b
mov edi, dword [esi + 0x58]
cmp edi, edx
je 0x242db
cmp ecx, edx
jne 0x242db
mov dword [esi + 0x58], edx
jmp 0x242ec
xor edi, edi
cmp byte [ebp + 0xb], 0
je 0x242ec
push edx
push 4
push ebx
call fcn.000103d2
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
test edi, edi
jne 0x242b3
cmp byte [ebp + 0xb], 0
je 0x242be
test byte [ebx + 0xe], 1
je 0x242be
push edi
push 4
push ebx
call fcn.00010545
jmp 0x242be
lea ecx, [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x50]
cmp ecx, dword [esi + 0x64]
jbe 0x24328
mov ecx, dword [eax]
cmp ecx, dword [esi + 0x4c]
jne 0x24356
cmp dword [eax], eax
je 0x24356
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [edx + 4], eax
xor edx, edx
lea edi, [ecx - 0x20]
xchg dword [edi], edx
test edx, edx
jne 0x24344
and dword [ecx], edx
jmp 0x24319
mov edx, dword [ebp - 4]
lea edi, [ebp - 8]
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov dword [edx], ecx
mov dword [ebp - 4], ecx
jmp 0x24319
cmp byte [ebp + 0xb], 0
je 0x24366
push 0
push 4
push ebx
call fcn.000103d2
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x24397
mov eax, dword [ecx]
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov dword [eax + 4], edx
add ecx, 0xffffffa8
or eax, 0xffffffff
lea edx, [ecx + 0x40]
xchg dword [edx], eax
test eax, eax
je 0x24397
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
cmp ecx, eax
jne 0x24371
jmp 0x1cd25
Function at 0x1f642
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
cmp word [ebp + 8], 0x11
push esi
push edi
jne 0x1f6d6
cmp dword [ebp + 0xc], 0
je 0x1f6d6
mov esi, dword [0x127d0]
mov edi, 0x127d0
cmp esi, edi
je IoQueueWorkItem
push 1
lea eax, [esi + 0x10]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
call dword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x1f6d6
mov esi, dword [esi]
jmp 0x1f668
lea ecx, [ebp - 0x2c]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
cmp esi, eax
pop ebx
je 0x1f6d0
xor edi, edi
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
mov dword [eax + 4], ecx
cmp byte [esi + 0xe], 0
jne 0x2270f
mov ecx, dword [esi + 8]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1f69c
pop edi
pop esi
leave
ret 8
lea eax, [ebp - 0x14]
push ebx
lea edx, [ebp - 0x2c]
mov ecx, 0x12740
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
mov ebx, dword [0x12748]
jmp 0x1f715
test ax, ax
jne 0x1f715
jmp ExInterlockedFlushSList
cmp eax, dword [edx + 0x8c]
jne 0x1f715
jmp 0x1f75c
cmp dword [edi + 4], edx
je 0x1f7ba
jmp KeReadStateEvent
cmp ebx, 0x12748
je 0x1f686
lea eax, [ebx + 0xe]
cmp byte [eax], 0
mov dword [ebp + 0xc], eax
lea eax, [ebx + 8]
mov esi, ebx
mov dword [ebp - 8], eax
jne MmAdvanceMdl
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0x60]
lea edi, [eax + 4]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
mov ax, word [ebp + 8]
cmp word [esi + 0xc], ax
mov ebx, dword [ebx]
jne 0x1f6f6
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1f6fd
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0xc]
and dword [esi], 0
cmp byte [eax], 0
jne KeSetTimerEx
mov ecx, dword [ebp - 0xc]
xor eax, eax
add ecx, 0x38
xchg dword [ecx], eax
test eax, eax
je 0x1f715
lea ecx, [edx + 0x1c]
lea edx, [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
mov ecx, dword [edi]
xor edx, edx
cmp ecx, edx
je KeInitializeTimer
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
cmp byte [eax], dl
jne 0x226f2
lea ecx, [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
jmp 0x1f715
mov edx, dword [eax]
lea edi, [ebx - 0x10]
jmp 0x1f749
mov eax, dword [ebp - 8]
push edx
push 0x1000
push dword [eax]
call fcn.000103d2
jmp 0x1f7ba
mov dword [edi + 4], edx
jmp 0x1f7ba
mov eax, dword [esi + 8]
test byte [eax + 0xe], 1
je 0x22724
push edi
push 0x1000
push eax
call fcn.00010545
push 0xe8646641
add esi, 0xfffffff0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1f6c6
Function at 0x24efb
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x1c]
lea edx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
cmp dword [esi + 0x50], 0
jle 0x24f91
lea eax, [esi + 0x28]
cmp dword [eax], eax
jne 0x24f91
lea ecx, [esi + 0x38]
mov eax, dword [ecx]
cmp eax, ecx
je 0x24f91
lea esi, [eax - 0x58]
mov ecx, dword [esi + 0x5c]
mov eax, dword [esi + 0x58]
push edi
mov edi, dword [esi + 0x60]
mov dword [ecx], eax
mov dword [eax + 4], ecx
and dword [esi + 0x58], 0
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x24f66
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
cmp byte [edi], 0xf
pop edi
jne 0x24f77
push dword [ebp + 0xc]
push esi
call fcn.00024dbf
jmp 0x24f81
mov eax, dword [ebp + 0xc]
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x24f9a
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
pop esi
leave
ret 8

Function at 0x25593
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0xc]
and dword [ecx + 0xbc], 0
mov eax, dword [eax + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
lea ecx, [eax + 0x20]
inc edx
lock xadd dword [ecx], edx
push eax
push esi
call fcn.000252b4
cmp eax, 0xc0000016
je 0x255db
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop esi
pop ebp
ret 8
Function at 0x25a98
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
jmp 0x25b28
lea esi, [eax - 0x78]
xor edi, edi
lea eax, [esi + 0x18]
xchg dword [eax], edi
test edi, edi
je 0x25af1
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x25b48
push 0xc0000120
push edi
call fcn.00024dbf
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, byte [0x12011]
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [ebx + 0x50]
cmp dword [eax], 0
jl 0x25b0f
cmp word [ebx + 0x44], 0x7fff
jae 0x25b0f
lea edx, [esi + 0x78]
lea ecx, [ebx + 0x40]
call dword [sym.imp.ntoskrnl.exe_InterlockedPushEntrySList]
jmp 0x25b28
xor ecx, ecx
inc ecx
lock xadd dword [eax], ecx
lea eax, [esi + 0x20]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x25b28
push esi
call fcn.0001c24b
lea ecx, [ebx + 0x48]
call dword [sym.imp.ntoskrnl.exe_InterlockedPopEntrySList]
test eax, eax
jne 0x25aa8
lea ecx, [ebx + 0x40]
call dword [sym.imp.ntoskrnl.exe_InterlockedPopEntrySList]
test eax, eax
jne 0x25b4f
jmp 0x25b75
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
jmp 0x25b58
lea esi, [eax - 0x78]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
add ebx, 0x58
inc eax
lock xadd dword [ebx], eax
inc eax
mov dword [esi + 0x70], eax
jne 0x25b73
xor eax, eax
inc eax
lock xadd dword [ebx], eax
inc eax
mov dword [esi + 0x70], eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x25bbc
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov cl, 2
call dword [sym.imp.HAL.dll_KfRaiseIrql]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
lea ecx, [edi + 0x1c]
mov byte [ebp - 1], al
mov dword [ebp + 8], ecx
jmp 0x25c02
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
test byte [ebx + 7], 0x20
push ebx
je 0x25bfa
call fcn.0002bbf7
jmp 0x25bff
call fcn.00025b81
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
call esi
push edi
call fcn.00025a70
mov ebx, eax
test ebx, ebx
jne 0x25be3
jmp 0x25c39
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
test byte [ebx + 7], 0x20
push ebx
je 0x25c2c
call fcn.0002bbf7
jmp 0x25c31
call fcn.00025b81
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
call esi
push 0
push edi
call fcn.00025a04
mov ebx, eax
test ebx, ebx
jne 0x25c15
test byte [edi + 0xc], 2
je 0x25c99
lea ebx, [edi + 0x40]
jmp 0x25c88
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
xor edi, edi
add eax, 0xffffffa0
xchg dword [eax], edi
test edi, edi
je 0x25c88
lea eax, [edi + 0x25]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push edi
call fcn.000276ec
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
call esi
mov eax, dword [ebx]
cmp eax, ebx
jne 0x25c52
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
jmp 0x25d04
lea ecx, [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
jmp 0x25cf4
cmp dword [ebp - 8], 0
je 0x25ce2
push 0xc0000120
push dword [ebp - 8]
call fcn.00024dbf
mov eax, dword [ebp - 8]
cmp byte [eax + 0x24], 0
je 0x25cd3
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, byte [0x12011]
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea eax, [esi + 0x20]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x25cf4
push esi
call fcn.0001c24b
lea eax, [ebp - 8]
push eax
push edi
call fcn.00025a98
mov esi, eax
test esi, esi
jne 0x25ca4
mov cl, byte [ebp - 1]
call dword [sym.imp.HAL.dll_KfLowerIrql]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x265dc
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
cmp byte [edi], 0xf
mov eax, dword [edi + 0x18]
mov ebx, dword [eax + 0xc]
mov esi, ecx
je 0x2660e
cmp dword [edi + 4], 0xc
jb 0x26602
test byte [ebx + 0xc], 1
jne 0x2660e
mov dword [ebp - 4], 0xc000000d
jmp 0x26731
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
push ebx
call fcn.00025a70
test eax, eax
mov dword [ebp - 8], eax
jne 0x266e8
test byte [ebx + 0xd], 0x10
je 0x26657
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [edi], 0xf
mov eax, 0xc0000120
mov dword [ebp - 4], eax
jne 0x26731
push eax
push esi
call fcn.00024dbf
jmp 0x26718
lea eax, [esi + 0x38]
mov ecx, 0x262ae
xchg dword [eax], ecx
cmp byte [esi + 0x24], 0
je 0x2669c
and dword [esi + 0x58], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [edi], 0xf
mov eax, 0xc0000120
mov dword [ebp - 4], eax
jne 0x26688
push eax
push esi
call fcn.00024dbf
xor ecx, ecx
lea eax, [esi + 0x38]
xchg dword [eax], ecx
test ecx, ecx
jne 0x26731
jmp 0x2671e
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
cmp byte [edi], 0xf
je 0x266c6
cmp dword [edi + 0xc], 0x12090
je 0x266c6
lea ecx, [ebx + 0x38]
mov edx, dword [ecx + 4]
lea eax, [esi + 0x58]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ecx + 4], eax
jmp 0x266d8
lea ecx, [ebx + 0x38]
mov edx, dword [ecx]
lea eax, [esi + 0x58]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [edx + 4], eax
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
mov eax, 0x103
jmp 0x26747
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
call fcn.000263a6
test eax, eax
mov dword [ebp - 4], eax
jge 0x26747
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x28]
mov edx, dword [ecx]
add eax, 0x78
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
cmp byte [esi + 0x24], 0
je 0x26731
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov edi, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov dl, byte [0x12011]
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x27820
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00010514
test al, al
je 0x279b7
cmp dword [ebp + 0xc], 0xc000023f
jne 0x279b1
cmp word [ebx], 0xafd1
jne 0x279b1
test byte [ebx + 0x5d], 1
jne 0x279b1
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp + 0xc], esi
je 0x27875
movzx eax, word [eax + 4]
add eax, 8
mov dword [ebp + 8], eax
jmp 0x27878
mov dword [ebp + 8], esi
push edi
lea ecx, [ebx + 0x1c]
lea edx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea eax, [ebx + 0x28]
jmp 0x278a7
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [eax], edx
lea edi, [ecx - 0x58]
mov dword [edx + 4], eax
xor ecx, ecx
lea edx, [edi + 0x38]
xchg dword [edx], ecx
test ecx, ecx
jne 0x278b0
mov dword [edi + 0x58], esi
mov dword [ebp + 0xc], esi
cmp dword [eax], eax
jne 0x2788a
lea eax, [ebx + 0x30]
jmp 0x278e1
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x27986
mov ecx, dword [eax]
mov edx, dword [ecx]
add ecx, 0xffffffa8
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [ebp + 0xc], ecx
xor edx, edx
add ecx, 0x38
xchg dword [ecx], edx
test edx, edx
jne 0x278e5
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x58], esi
mov dword [ebp + 0xc], esi
cmp dword [eax], eax
jne 0x278be
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x48]
cmp eax, ecx
jae 0x279be
cmp eax, esi
ja 0x27908
mov eax, dword [ebx + 0x44]
lea eax, [eax + eax*2]
shl eax, 4
cmp eax, ecx
jae 0x279be
push dword [ebx + 0x18]
push dword [ebp + 8]
call fcn.0001c8ab
cmp eax, esi
je 0x279be
mov edi, dword [eax + 0x14]
mov ecx, dword [ebp + 8]
mov edx, ecx
mov dword [eax + 0x20], esi
mov dword [eax + 0xc], esi
mov dword [eax + 8], esi
mov esi, dword [ebp + 0x10]
shr ecx, 2
mov dword [eax + 0x18], 0xc000023f
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov dword [eax + 0x10], ecx
lea ecx, [ebx + 0x38]
mov edx, dword [ecx + 4]
push 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
push 1
mov dword [ecx + 4], eax
inc dword [ebx + 0x44]
push ebx
call fcn.000103d2
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
test byte [ebx + 0xe], 1
je 0x2797d
push 0
push 1
push ebx
call fcn.00010545
xor esi, esi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x279af
push esi
push dword [ebp + 8]
mov dword [edi + 0x1c], esi
push dword [ebp + 0x10]
mov dword [edi + 0x18], 0xc000023f
push esi
push esi
push esi
push esi
push edi
call fcn.000293d9
mov dl, byte [0x12011]
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
push ebx
call fcn.0001b2e0
xor eax, eax
pop ebx
leave
ret 0xc
lea ecx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x2797f
Function at 0x2b813
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x1c]
lea edx, [ebp - 0xc]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea eax, [edi + 0xb8]
mov esi, dword [eax]
xor ebx, ebx
cmp esi, ebx
lea ecx, [ebp - 0xc]
jne 0x2b846
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x2b8a2
mov dword [esi + 0xc], ebx
mov dword [eax], ebx
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
jne 0x2b86f
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
push edi
call fcn.00025d19
mov dword [edi + 0xbc], ebx
cmp dword [esi + 0x5c], ebx
mov dl, byte [0x12011]
mov ecx, esi
sete byte [ebp + 0xb]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
cmp dword [0x12764], ebx
jbe 0x2b8a2
cmp byte [ebp + 0xb], bl
je 0x2b8a2
call fcn.0002b343
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x2c7ed
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x14]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea ebx, [esi + 0x38]
mov edi, dword [ebx]
cmp edi, ebx
je 0x2c8ae
cmp dword [ebp + 0xc], 0
lea eax, [edi - 0x58]
mov edi, dword [edi]
jl 0x2c82e
cmp dword [eax + 0x40], 0
je 0x2c84d
mov edx, dword [eax + 0x5c]
add eax, 0x58
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 4], eax
jmp 0x2c815
mov ecx, dword [eax + 0x60]
movzx edx, byte [ecx]
push 3
pop edi
sub edx, edi
je 0x2c86e
dec edx
je 0x2c865
mov ebx, dword [eax + 0x48]
mov dword [ebp + 8], edi
jmp 0x2c878
mov dword [ebp + 8], 2
jmp 0x2c875
mov dword [ebp + 8], 1
mov ebx, dword [ecx + 4]
mov ecx, dword [esi + 0x44]
mov edx, dword [ebp + 8]
lea edi, [edx + ecx*8]
mov dword [eax + 0x40], edi
inc dword [esi + 0x44]
lea ecx, [ebp - 0x14]
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
push ebx
push 0
push edi
push esi
call fcn.0001a4ba
test al, al
je 0x2c804
cmp dword [ebp + 8], 3
jne 0x2c804
jmp 0x2c8ea
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [esi + 0x4c], edi
call dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
jmp 0x2c8e0
mov eax, dword [ecx]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov dword [eax + 4], edx
and dword [ecx - 0x3c], 0
add ecx, 0xffffffa8
mov dword [ecx + 0x18], edi
mov dl, byte [0x12011]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
cmp ecx, eax
jne 0x2c8bf
pop edi
pop esi
pop ebx
leave
ret 8