Function at 0x75db99b0
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x344
mov eax, dword [0x75e50140]
xor eax, esp
mov dword [esp + reloc.ntdll.dll_NtClose], eax
or dword [esp + 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 7
pop edx
mov ecx, edx
mov dword [esp + 0x20], 0x20
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x44], eax
lea edi, [esp + 0x74]
mov dword [esp + 0x4c], eax
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x14], eax
lea edi, [esp + 0x90]
mov dword [esp + 0x40], eax
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x48], eax
lea edi, [esp + 0xac]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x1c], edi
test ebx, ebx
je 0x75dca8eb
mov edi, dword [ebx]
lea eax, [ebx + 0xc]
mov dword [esp + 0xc], eax
lea esi, [ebx + edi]
cmp eax, esi
ja 0x75dca8e9
mov edx, dword [ebx + 4]
mov dword [esp + 0x24], edx
test edx, 0xffffff00
jne 0x75dc9f77
test dl, 1
jne 0x75dc9f6c
test dl, 2
jne 0x75dc9f8a
test dl, 4
jne 0x75dc9f96
mov cl, byte [esp + 0x24]
test cl, 8
je 0x75db9a8a
lea eax, [ebx + 0x18]
cmp eax, esi
ja 0x75dc9f77
test cl, 0x20
jne 0x75dc9fa2
mov eax, 0x80
test al, cl
je 0x75db9aa7
lea eax, [ebx + 0x20]
cmp eax, esi
ja 0x75dc9f77
test cl, 0x40
jne 0x75dc9fae
mov eax, edx
and eax, 0x10
jne 0x75dc9fc3
mov edi, dword [ebx + 8]
mov dword [esp + 0x28], edi
test edi, edi
jne 0x75db9acf
test cl, 0x84
je 0x75dc9fb7
test eax, eax
jne 0x75db9aea
call fcn.75db9ea4
test eax, eax
je 0x75dc9fed
mov edx, dword [esp + 0x24]
mov cl, dl
mov edi, dword [esp + 0x28]
test cl, 1
jne 0x75dc9ffe
or edx, 1
mov dword [esp + 0x24], edx
mov cl, dl
push 0xa
pop eax
mov word [esp + 0x2c], ax
test cl, 2
jne 0x75dca07b
mov esi, edx
and esi, 0x80
je 0x75dca089
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0xc], eax
test cl, 0x20
jne 0x75dca092
test edi, edi
jne 0x75dca10a
test esi, esi
je 0x75dca10a
lea eax, [esp + 0xc8]
mov dword [esp + 0x90], 0x1000000
mov ecx, 0x100
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov esi, edi
mov dword [esp + 0x94], eax
xor eax, eax
mov word [esp + 0xc8], ax
lea eax, [ecx - 0x80]
mov dword [esp + 0xa0], ecx
push eax
lea eax, [esp + 0xcc]
mov dword [esp + 0xa8], ecx
push eax
push dword [esp + 0x14]
call dword [0x75e213cc]
mov ecx, eax
test ecx, ecx
je 0x75dca909
mov edx, dword [esp + 0xa0]
mov eax, edx
shr eax, 1
cmp ecx, eax
jae 0x75dca09e
mov edi, dword [esp + 0x94]
lea esi, [ecx + ecx]
mov edx, dword [esp + 0x24]
mov cl, dl
mov word [esp + 0x90], si
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 1
and edx, 4
jne 0x75dca117
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], 2
test cl, 0x40
jne 0x75dca640
test edx, edx
jne 0x75dca123
cmp dword [esp + 0x1c], edx
je 0x75dca52f
lea ecx, reloc.ntdll.dll_NtClose
mov dword [esp + 0x74], 0x1000000
mov eax, ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
mov edi, 0x100
mov dword [esp + 0x78], eax
xor edx, edx
xor eax, eax
mov dword [esp + 0x84], edi
mov word [esp + 0x248], ax
movzx eax, si
add eax, 2
mov dword [esp + 0x88], edi
cmp eax, 0xfffe
ja 0x75dca523
cmp eax, edi
ja 0x75dca614
xor edi, edi
movzx eax, si
push eax
push dword [esp + 0x98]
movzx eax, dx
shr eax, 1
mov dword [esp + 0x80], ecx
lea eax, [ecx + eax*2]
push eax
call fcn.75dc742d
mov eax, dword [esp + 0x9c]
add esp, 0xc
add eax, dword [esp + 0x74]
xor edx, edx
movzx ecx, ax
add eax, 2
mov word [esp + 0x76], ax
mov eax, dword [esp + 0x78]
push dword [0x75e21d48]
mov word [esp + 0x78], cx
shr ecx, 1
mov word [eax + ecx*2], dx
lea eax, [esp + 0x78]
push eax
push 0x1c
push edi
call dword [0x75e21d30]
mov esi, eax
test esi, esi
js 0x75dca909
movzx ecx, word [esp + 0x74]
xor edx, edx
mov eax, dword [esp + 0x78]
shr ecx, 1
mov word [eax + ecx*2], dx
mov eax, dword [esp + 0x78]
or dword [esp + 0x24], 4
mov dword [esp + 0x30], eax
mov cl, byte [esp + 0x24]
mov edi, dword [esp + 0x10]
test cl, 8
je 0x75dca850
cmp dword [ebx + 0x14], 0
je 0x75dca80a
push dword [ebx + 0x14]
call dword [0x75e20dbc]
mov dword [esp + 0x4c], eax
cmp eax, reloc.ntdll.dll_NtClose
je 0x75dca827
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
mov ecx, eax
call fcn.75dba052
mov esi, eax
test esi, esi
js 0x75dca528
cmp dword [esp + 0x14], 0
je 0x75dc9fb7
test byte [esp + 0x24], 0x10
jne 0x75dca858
lea eax, [esp + 0x18]
push eax
xor eax, eax
push eax
push 0x75dbd770
push eax
push dword [esp + 0x24]
push eax
call dword [0x75e21cf0]
mov esi, eax
test esi, esi
js 0x75dca889
xor edi, edi
mov dword [esp + 0x14], edi
mov esi, edi
push dword [esp + 0x4c]
call dword [0x75e20db8]
test esi, esi
js 0x75dca925
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
test eax, eax
je 0x75db9dbb
cmp eax, ecx
jne 0x75dca935
mov eax, dword [esp + 0x88]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x84], eax
mov dword [esp + 0x78], ecx
test ecx, ecx
je 0x75db9dc8
xor eax, eax
mov word [ecx], ax
mov ecx, dword [esp + 0x9c]
xor eax, eax
mov word [esp + 0x74], ax
mov ax, word [esp + 0x88]
mov word [esp + 0x76], ax
mov eax, dword [esp + 0x98]
test eax, eax
je 0x75db9e0b
cmp eax, ecx
jne 0x75dca950
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x98], ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 0x94], ecx
test ecx, ecx
je 0x75db9e1b
xor eax, eax
mov word [ecx], ax
mov ecx, dword [esp + 0xb8]
xor eax, eax
mov word [esp + 0x90], ax
mov ax, word [esp + 0xa4]
mov word [esp + 0x92], ax
mov eax, dword [esp + 0xb4]
test eax, eax
jne 0x75dca96b
mov dword [esp + 0xb0], ecx
test ecx, ecx
jne 0x75db9e97
mov ecx, dword [esp + 0x40]
xor eax, eax
mov word [esp + 0xac], ax
mov ax, word [esp + 0xc0]
mov word [esp + 0xae], ax
test ecx, ecx
jne 0x75dca99f
mov ecx, dword [esp + reloc.ntdll.dll_NtClose]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.75dbdd75
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov word [ecx], ax
jmp 0x75db9e56
lea eax, [ebx + 0xe]
cmp eax, esi
jbe 0x75db9a64
push edi
push edx
push 0x75e2b2b4
push str.SXS:__s___Bad_flags_size_0x_lx_0x_lx_n
xor edi, edi
jmp 0x75dca8f8
lea eax, [ebx + 0x10]
cmp eax, esi
ja 0x75dc9f77
jmp 0x75db9a6d
lea eax, [ebx + 0x14]
cmp eax, esi
ja 0x75dc9f77
jmp 0x75db9a76
lea eax, [ebx + 0x1c]
cmp eax, esi
ja 0x75dc9f77
jmp 0x75db9a93
test cl, 0x88
je 0x75db9ab0
mov esi, 0xc000000d
xor edi, edi
jmp 0x75db9d80
mov ecx, dword fs:[0x30]
xor edi, edi
mov dword [esp + 0x48], ecx
cmp dword [ecx + reloc.ntdll.dll_NtClose], edi
je 0x75dc9fe2
mov esi, 0xc015000e
jmp 0x75db9d80
mov edx, dword [esp + 0x24]
mov cl, dl
jmp 0x75db9abb
xor edi, edi
mov dword [esp + 0x18], ?
mov esi, edi
jmp 0x75dca909
mov eax, dword [esp + 0xc]
movzx eax, word [eax]
mov esi, eax
mov dword [esp + 0xc], esi
test ax, ax
je 0x75db9afc
push 5
pop eax
movzx esi, si
cmp word [esp + 0xc], ax
je 0x75dca04c
mov eax, esi
mov ebx, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0xc], ebx
mov ebx, 0xffff
cmp si, bx
mov ebx, dword [esp + 0x10]
je 0x75db9aff
movzx eax, si
cmp si, 0xa
je 0x75db9aff
movzx eax, word [ebx + 0xc]
xor edi, edi
push eax
push 0x75e2b2b4
push str.SXS:__s___bad_wProcessorArchitecture_0x_x_n
jmp 0x75dca06a
push eax
push 0x75e2b2b4
push str.SXS:__s___Bad_lpAssemblyDirectory__ls_n
push edi
push 0x33
call dword [0x75e21d44]
add esp, 0x14
jmp 0x75dca904
mov ax, word [ebx + 0xe]
mov word [esp + 0x2e], ax
jmp 0x75db9b0d
mov eax, dword [esp + 0x3c]
jmp 0x75db9b22
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x38], eax
jmp 0x75db9b2f
lea ecx, [ecx*4 + 2]
lea eax, [edx - 2]
mov word [esp + 0x90], ax
cmp ecx, 0xfffe
ja 0x75dca4eb
cmp ecx, edx
jbe 0x75dca0df
push ecx
lea eax, [esp + 0x9c]
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0x98]
mov ax, word [esp + 0xa0]
shr edx, 1
push edx
push ecx
push dword [esp + 0x44]
mov dword [esp + 0xa0], ecx
mov word [esp + 0x9e], ax
jmp 0x75db9b95
mov si, word [esp + 0x90]
jmp 0x75db9bdc
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x30], eax
jmp 0x75db9be9
xor edi, edi
mov dword [esp + 0xc], edi
test eax, eax
je 0x75dca05f
cmp word [eax], di
je 0x75dca05f
push eax
call dword [0x75e21d18]
mov esi, dword [esp + 0x10]
cmp eax, 1
je 0x75dca157
cmp eax, esi
je 0x75dca157
cmp eax, 6
jne 0x75dca904
cmp dword [esp + 0x28], edi
je 0x75dca2cf
push dword [esp + 0x28]
call dword [0x75e21d18]
cmp eax, 1
je 0x75dca19f
cmp eax, esi
je 0x75dca19f
cmp eax, 6
je 0x75dca19f
cmp eax, 5
jne 0x75dca18b
mov eax, dword [esp + 0x28]
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], eax
jmp 0x75dca1a1
push eax
push dword [esp + 0x2c]
push 0x75e2b2b4
push str.SXS:__s___Bad_lpSource_PathType__ls__0x_lx_n
jmp 0x75dca8f8
mov ecx, edi
test ecx, ecx
je 0x75db9cec
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
mov edi, edx
lea esi, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, word [esp + 0x44]
jne 0x75dca1b6
sub edi, esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
sar edi, 1
lea eax, [edi + edi]
movzx edx, word [eax + edx - 2]
mov eax, edx
mov dword [esp + 0x50], eax
lea eax, [esi + 2]
mov dword [esp + 0x1c], eax
mov ax, word [esi]
add esi, ecx
cmp ax, word [esp + 0x44]
jne 0x75dca1e2
sub esi, dword [esp + 0x1c]
xor eax, eax
push 0x5c
pop ecx
sar esi, 1
cmp dx, cx
setne al
mov dword [esp + 0x1c], eax
call dword [0x75e20cf0]
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
add eax, esi
add eax, edi
lea eax, [eax*2 + 2]
push eax
mov eax, dword fs:[0x30]
push ecx
push dword [eax + 0x18]
call dword [0x75e221e0]
mov ecx, eax
mov dword [esp + 0x40], ecx
test ecx, ecx
je 0x75dca51c
lea eax, [edi + edi]
push eax
push dword [esp + 0x34]
push ecx
call fcn.75dc7421
add esp, 0xc
lea eax, [edi + edi]
add eax, dword [esp + 0x40]
mov dword [esp + 0x44], eax
push 0x5c
pop ecx
cmp word [esp + 0x50], cx
je 0x75dca26a
mov word [eax], cx
add eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
add esi, esi
push esi
push dword [esp + 0x10]
push eax
call fcn.75dc7421
mov eax, dword [esp + 0x50]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
mov esi, dword [esp + 0x40]
push esi
call dword [0x75e21cf8]
test al, al
jne 0x75dca513
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xb0]
jne 0x75dca513
mov ecx, dword [esp + 0x40]
xor eax, eax
push 0x14
pop esi
push ecx
push eax
mov eax, dword fs:[0x30]
mov dword [esp + 0x14], str.Application.Manifest
push dword [eax + 0x18]
call dword [0x75e221d0]
jmp 0x75dca203
test byte [esp + 0x24], 0x20
je 0x75dca4f5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x75dca503
cmp word [eax], di
je 0x75dca503
push eax
lea eax, [esp + 0x58]
push eax
call dword [0x75e21ed4]
mov esi, dword [esp + 0x54]
lea ecx, reloc.ntdll.dll_NtClose
mov eax, ecx
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], eax
mov edx, 0x80
mov dword [esp + 0xb0], eax
xor eax, eax
mov word [esp + 0x1c8], ax
movzx eax, si
mov dword [esp + 0xbc], edx
add eax, 2
mov dword [esp + 0xc0], edx
xor edx, edx
mov dword [esp + 0xac], 0x800000
cmp eax, 0xfffe
ja 0x75dca4eb
cmp eax, 0x80
jbe 0x75dca38a
push eax
lea eax, [esp + 0xb8]
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov ecx, dword [esp + 0xb4]
mov dx, word [esp + 0xac]
mov esi, dword [esp + 0x54]
movzx eax, si
push eax
push dword [esp + 0x5c]
movzx eax, dx
shr eax, 1
mov dword [esp + 0xb8], ecx
lea eax, [ecx + eax*2]
push eax
call fcn.75dc742d
mov eax, dword [esp + 0xb8]
xor edx, edx
add eax, dword [esp + 0x60]
add esp, 0xc
movzx ecx, ax
add eax, 2
mov word [esp + 0xae], ax
mov eax, dword [esp + 0xb0]
mov word [esp + 0xac], cx
shr ecx, 1
mov word [eax + ecx*2], dx
mov dx, word [esp + 0xac]
movzx eax, dx
add eax, 0x14
cmp eax, 0xfffe
ja 0x75dca4eb
cmp eax, dword [esp + 0xbc]
jbe 0x75dca41c
push eax
lea eax, [esp + 0xb8]
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov dx, word [esp + 0xac]
mov ecx, dword [esp + 0xb4]
push 0x12
movzx eax, dx
pop esi
shr eax, 1
push esi
push str..Manifest
mov dword [esp + 0xb8], ecx
lea eax, [ecx + eax*2]
push eax
call fcn.75dc742d
mov eax, dword [esp + 0xb8]
xor edx, edx
add eax, 0x14
add esp, 0xc
mov word [esp + 0xae], ax
mov ax, word [esp + 0xac]
add ax, si
mov word [esp + 0xac], ax
movzx ecx, ax
mov eax, dword [esp + 0xb0]
shr ecx, 1
mov word [eax + ecx*2], dx
mov dx, word [esp + 0xac]
movzx eax, dx
add eax, 4
cmp eax, 0xfffe
ja 0x75dca4eb
cmp eax, dword [esp + 0xbc]
jbe 0x75dca4b9
push eax
lea eax, [esp + 0xb8]
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov dx, word [esp + 0xac]
mov ax, word [esp + 0xbc]
mov ecx, dword [esp + 0xb4]
mov word [esp + 0xae], ax
movzx eax, dx
shr eax, 1
xor edx, edx
mov dword [esp + 0xb0], ecx
mov word [ecx + eax*2], dx
mov ecx, dword [esp + 0xb0]
jmp 0x75dca4fa
mov esi, 0xc0000106
jmp 0x75dca909
mov ecx, str.Application.Manifest
mov dword [esp + 0xc], ecx
jmp 0x75dca1ad
push eax
push 0x75e2b2b4
push str.SXS:__s___Bad_lpApplication_name__ls_n
jmp 0x75dca06a
mov dword [esp + 0x28], esi
jmp 0x75db9cec
mov esi, 0xc0000017
jmp 0x75dca528
mov esi, 0xc0000106
xor edi, edi
jmp 0x75dca909
lea eax, [esp + 0xc8]
mov dword [esp + 0x90], 0x1000000
mov dword [esp + 0x98], eax
mov ecx, 0x100
mov dword [esp + 0x9c], eax
mov dword [esp + 0x94], eax
xor eax, eax
push eax
mov word [esp + 0xcc], ax
lea eax, [esp + 0xcc]
push eax
push ecx
push edi
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], ecx
call dword [0x75e21d4c]
xor edi, edi
jmp 0x75dca5eb
mov edx, dword [esp + 0xa0]
cmp eax, edx
jbe 0x75dca5f9
add eax, 2
cmp eax, 0xfffe
ja 0x75dca4eb
cmp eax, edx
jbe 0x75dca5c0
push eax
lea eax, [esp + 0x9c]
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0x98]
mov ax, word [esp + 0xa0]
push edi
push ecx
push edx
push dword [esp + 0x34]
mov dword [esp + 0xa4], ecx
mov word [esp + 0xa2], ax
call dword [0x75e21d4c]
test eax, eax
jne 0x75dca588
mov esi, 0xc0000017
jmp 0x75dca909
mov si, ax
mov eax, dword [esp + 0x94]
mov word [esp + 0x90], si
mov dword [esp + 0x28], eax
jmp 0x75db9c0c
push eax
lea eax, [esp + 0x80]
xor edi, edi
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov ecx, dword [esp + 0x7c]
mov dx, word [esp + 0x74]
mov si, word [esp + 0x90]
jmp 0x75db9c66
test eax, eax
jne 0x75db9cf0
lea eax, reloc.ntdll.dll_NtClose
mov dword [esp + 0x74], 0x1000000
mov dword [esp + 0x7c], eax
mov ecx, 0x100
mov dword [esp + 0x80], eax
mov dword [esp + 0x78], eax
xor eax, eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], ecx
mov word [esp + 0x248], ax
call dword [0x75e20cf0]
movzx ecx, word [eax + 8]
movzx eax, word [esp + 0x74]
add eax, 2
add eax, ecx
cmp eax, 0xfffe
ja 0x75dca523
call dword [0x75e20cf0]
movzx ecx, word [esp + 0x74]
add ecx, 2
movzx eax, word [eax + 8]
add eax, ecx
cmp eax, dword [esp + 0x84]
jbe 0x75dca6ed
call dword [0x75e20cf0]
movzx ecx, word [esp + 0x74]
xor edi, edi
add ecx, 2
movzx eax, word [eax + 8]
add eax, ecx
push eax
lea eax, [esp + 0x80]
push eax
push edi
call dword [0x75e21d2c]
test eax, eax
js 0x75dca5ef
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x78], eax
call dword [0x75e20cf0]
lea esi, [eax + 8]
call dword [0x75e20cf0]
lea ecx, [eax + 8]
movzx eax, word [esi]
push eax
push dword [ecx + 4]
movzx ecx, word [esp + 0x7c]
mov eax, dword [esp + 0x80]
shr ecx, 1
lea eax, [eax + ecx*2]
push eax
call fcn.75dc742d
add esp, 0xc
call dword [0x75e20cf0]
mov edi, dword [esp + 0x10]
mov ax, word [eax + 8]
add ax, word [esp + 0x74]
add ax, di
mov word [esp + 0x76], ax
call dword [0x75e20cf0]
mov cx, word [esp + 0x74]
xor edx, edx
add cx, word [eax + 8]
mov eax, dword [esp + 0x78]
mov word [esp + 0x74], cx
movzx ecx, cx
shr ecx, 1
mov word [eax + ecx*2], dx
mov dx, word [esp + 0x74]
movzx eax, dx
add eax, 0x10
cmp eax, 0xfffe
ja 0x75dca523
cmp eax, dword [esp + 0x84]
jbe 0x75dca7a4
push eax
lea eax, [esp + 0x80]
push eax
xor eax, eax
push eax
call dword [0x75e21d2c]
test eax, eax
js 0x75dca51c
mov dx, word [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push 0xe
movzx eax, dx
pop esi
shr eax, 1
push esi
push 0x75e2b288
mov dword [esp + 0x80], ecx
lea eax, [ecx + eax*2]
push eax
call fcn.75dc742d
mov eax, dword [esp + 0x80]
xor edx, edx
add eax, 0x10
add esp, 0xc
mov word [esp + 0x76], ax
mov ax, word [esp + 0x74]
add ax, si
movzx ecx, ax
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x78]
shr ecx, 1
mov word [eax + ecx*2], dx
mov eax, dword [esp + 0x78]
or dword [esp + 0x24], 4
mov cl, byte [esp + 0x24]
mov dword [esp + 0x30], eax
jmp 0x75db9cf4
push 0x75e2b2b4
push str.SXS:__s___ACTCTX_FLAG_RESOURCE_NAME_VALID_set_but_lpResourceName__0_n
xor edi, edi
push edi
push 0x33
call dword [0x75e21d44]
add esp, 0x10
jmp 0x75dca904
push 0x75e2b2b4
push str.SXS:__s___BaseDllMapResourceIdW_failed_n
xor edi, edi
push edi
push 0x33
call dword [0x75e21d44]
mov eax, dword fs:[0x18]
add esp, 0x10
mov esi, dword [eax + reloc.ntdll.dll_NtClose]
jmp 0x75dca909
xor eax, eax
inc eax
jmp 0x75db9d25
mov edx, dword [esp + 0x48]
xor edi, edi
add edx, 0x1f8
cmp dword [edx], edi
jne 0x75dca87f
mov ecx, dword [esp + 0x14]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x75dca87f
mov dword [esp + 0x18], edi
jmp 0x75db9d7a
mov esi, 0xc015000e
jmp 0x75dca909
cmp esi, 0xc0000034
je 0x75dca8cd
cmp esi, 0xc0000089
je 0x75dca8cd
cmp esi, 0xc000008a
je 0x75dca8cd
cmp esi, 0xc000008b
je 0x75dca8cd
cmp esi, 0xc0000204
je 0x75dca8cd
cmp esi, 0xc0150002
je 0x75dca8cd
cmp esi, 0xc0150004
je 0x75dca8cd
cmp esi, 0xc000000f
je 0x75dca8cd
xor eax, eax
mov edi, eax
push esi
push str.SXS:_RtlCreateActivationContext___failed_0x_08lx_n
push edi
push 0x33
call dword [0x75e21d44]
add esp, 0x10
or dword [esp + 0x18], 0xffffffff
jmp 0x75dca528
xor edi, edi
push dword [ebx]
push ebx
push 0x75e2b2b4
push str.SXS:__s___Null__p_or_size_0x_lx_too_small_n
push edi
push 0x33
call dword [0x75e21d44]
add esp, 0x18
mov esi, 0xc000000d
cmp dword [esp + 0x14], 0
je 0x75db9d80
push dword [esp + 0x14]
push 0xffffffffffffffff
call dword [0x75e21cfc]
jmp 0x75db9d80
push esi
call sym.KERNEL32.dll_BaseSetLastNTError
or dword [esp + 0x18], 0xffffffff
jmp 0x75db9d92
mov dword [esp + 0x60], eax
lea eax, [esp + 0x5c]
push eax
call dword [0x75e21e9c]
mov ecx, dword [esp + 0x80]
jmp 0x75db9da9
mov dword [esp + 0x68], eax
lea eax, [esp + 0x64]
push eax
call dword [0x75e21e9c]
mov ecx, dword [esp + 0x9c]
jmp 0x75db9df6
cmp eax, ecx
je 0x75dca985
mov dword [esp + 0x70], eax
lea eax, [esp + 0x6c]
push eax
call dword [0x75e21e9c]
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0xc0]
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xbc], eax
jmp 0x75db9e4b
mov eax, dword [ebx + 8]
mov dword [esp + 0x28], eax
mov eax, dword fs:[0x30]
push ecx
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
jmp 0x75db9e7c