Function at 0x75dd3aba
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0x2e0
push 0x75e32da8
call fcn.75dc7370
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], edx
mov eax, dword [ebp + 8]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov edx, dword [ebp + 0x14]
mov dword [ebp - reloc.ntdll.dll_NtClose], edx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov ebx, dword [ebp + 0x24]
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], 0xc0000001
xor ebx, ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov esi, str..pif
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
test eax, eax
je 0x75dd4d33
mov esi, 0x8000
cmp word [eax], si
ja 0x75dd4d33
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
xor eax, eax
mov word [ebp - 0x284], ax
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov word [ebp - 0x2a4], ax
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov word [ebp - 0x29c], ax
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov word [ebp - 0x2ac], ax
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov word [ebp - 0x2b4], ax
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
and esi, 0xfffffff0
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x10], ebx
je 0x75dd3be4
test byte [ebp + 0x1c], 0x10
mov byte [ebp - 0x249], bl
je 0x75dd3beb
mov byte [ebp - 0x249], 1
mov dword [ebp - 4], ebx
cmp esi, 0x10
jne 0x75dd3d51
mov edi, dword fs:[0x30]
mov dword [ebp - reloc.ntdll.dll_NtClose], edi
test ecx, ecx
je 0x75dd3c40
test dword [ecx + 0x2c], reloc.ntdll.dll_NtClose
je 0x75dd3c40
lea ecx, [edx + 0x48]
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov edi, dword [ebp - reloc.ntdll.dll_NtClose]
mov eax, dword [edi + 0x38]
mov dword [ecx], eax
lea esi, [edx + 0x4c]
mov eax, dword [edi + 0x3c]
mov dword [esi], eax
lea edi, [edx + 0x50]
mov edx, dword [ebp - reloc.ntdll.dll_NtClose]
mov eax, dword [edx + 0x40]
mov dword [edi], eax
jmp 0x75dd3d1e
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x18]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
lea ecx, [edx + 0x48]
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov dword [ecx], eax
lea esi, [edx + 0x4c]
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x1c]
mov dword [esi], eax
lea edi, [edx + 0x50]
mov edx, dword [ebp - reloc.ntdll.dll_NtClose]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 0x20]
mov dword [edi], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov eax, dword [edx + 0x10]
test dword [eax + 0x68], 0x600
je 0x75dd3d1e
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
test eax, eax
je 0x75dd3cad
lea ecx, reloc.ntdll.dll_NtClose
push ecx
push eax
call dword [0x75e212cc]
test eax, eax
jne 0x75dd3cad
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov dword [ecx], ebx
cmp dword [esi], 0
je 0x75dd3ccf
lea eax, reloc.ntdll.dll_NtClose
push eax
push dword [esi]
call dword [0x75e212cc]
test eax, eax
jne 0x75dd3ccf
mov eax, dword [edi]
cmp eax, dword [esi]
jne 0x75dd3ccd
mov dword [edi], ebx
mov dword [esi], ebx
mov edx, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, edx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
cmp dword [edi], 0
je 0x75dd3d1e
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x75dd3d1e
mov dword [ebp - reloc.ntdll.dll_NtClose], edx
lea eax, reloc.ntdll.dll_NtClose
push eax
mov eax, dword [edi]
push eax
call dword [0x75e212cc]
test eax, eax
jne 0x75dd3d18
mov dword [edi], ebx
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
jmp 0x75dd3d1e
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [ecx]
call fcn.75dd544a
test al, al
je 0x75dd3d31
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov dword [eax], ebx
mov ecx, dword [esi]
call fcn.75dd544a
test al, al
je 0x75dd3d3e
mov dword [esi], ebx
mov ecx, dword [edi]
call fcn.75dd544a
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
test al, al
je 0x75dd3d51
mov dword [edi], ebx
cmp esi, 0x40
je 0x75dd3d5e
cmp esi, 0x80
jne 0x75dd3d65
mov byte [ebp - 0x249], 1
push 0x20
pop esi
push 9
pop edx
push 2
pop edi
mov dword [ebp - reloc.ntdll.dll_NtClose], edi
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
movzx eax, word [ecx]
cmp ax, si
je 0x75dd4c02
cmp ax, dx
je 0x75dd4c02
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x75dd3d92
sub ecx, edx
sar ecx, 1
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
lea esi, reloc.ntdll.dll_NtClose
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
call dword [0x75e20cf0]
mov ecx, dword [eax]
lea eax, [esi + esi]
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221e0]
mov esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
test esi, esi
jne 0x75dd3def
mov dword [ebp - reloc.ntdll.dll_NtClose], 0xc0000017
jmp 0x75dd4beb
push dword [ebp - 0x25c]
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
push esi
push dword [ebp - 0x278]
call sym.KERNEL32.dll_GetShortPathNameW
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
je 0x75dd4be1
cmp eax, dword [ebp - reloc.ntdll.dll_NtClose]
ja 0x75dd4be1
push esi
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21d6c]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
movzx edx, word [ebp - 0x294]
mov dword [ebp - reloc.ntdll.dll_NtClose], edx
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
xor esi, esi
inc esi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov eax, edx
dec edx
mov dword [ebp - reloc.ntdll.dll_NtClose], edx
test eax, eax
je 0x75dd3ea1
mov al, byte [ecx]
cmp al, 0x2e
je 0x75dd3ea1
cmp al, 0x5c
jne 0x75dd3e91
xor esi, esi
inc esi
jmp 0x75dd3e92
inc esi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
inc ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
jmp 0x75dd3e75
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x75dd3eaa
sub ecx, edx
sar ecx, 1
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
push 0x22
pop edx
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
cmp dx, word [esi]
jne 0x75dd3f1a
add esi, 2
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
movzx eax, word [esi]
test ax, ax
je 0x75dd3ef0
add esi, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
cmp dx, ax
jne 0x75dd3edb
push 9
pop ecx
push 0x20
pop edx
movzx eax, word [esi]
test ax, ax
je 0x75dd3fe0
cmp dx, ax
je 0x75dd3f10
cmp cx, ax
jne 0x75dd3fe0
add esi, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
jmp 0x75dd3ef6
mov edx, esi
lea eax, [edx + 2]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov ax, word [edx]
add edx, edi
cmp ax, bx
jne 0x75dd3f25
sub edx, dword [ebp - reloc.ntdll.dll_NtClose]
sar edx, 1
cmp ecx, edx
ja 0x75dd3f61
push ecx
push esi
push dword [ebp - 0x278]
call dword [0x75e21e54]
add esp, 0xc
test eax, eax
jne 0x75dd3f61
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
lea esi, [esi + eax*2]
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
jmp 0x75dd3ef0
push 0x20
pop ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
movzx eax, word [esi]
test ax, ax
je 0x75dd3f83
cmp ax, cx
je 0x75dd3f7f
push 9
pop edx
cmp ax, dx
jne 0x75dd3f86
add esi, edi
jmp 0x75dd3f64
push 9
pop edx
push 0x22
pop ecx
cmp ax, cx
jne 0x75dd3fb5
add esi, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
movzx eax, word [esi]
test ax, ax
je 0x75dd3ef0
add esi, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
cmp ax, cx
je 0x75dd3ef0
jmp 0x75dd3f96
push 0x20
pop ecx
test ax, ax
je 0x75dd3ef0
cmp ax, cx
je 0x75dd3ef0
cmp ax, dx
je 0x75dd3ef0
add esi, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
movzx eax, word [esi]
jmp 0x75dd3fb8
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x75dd3fe5
sub ecx, edx
sar ecx, 1
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
lea eax, [ecx + ecx]
mov word [ebp - 0x258], ax
add eax, 2
mov word [ebp - 0x256], ax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21d6c]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
mov ecx, 0x80
sub ecx, dword [ebp - reloc.ntdll.dll_NtClose]
movzx eax, word [ebp - 0x28c]
cmp eax, ecx
jb 0x75dd405c
mov dword [ebp - reloc.ntdll.dll_NtClose], 0xc000000d
jmp 0x75dd4beb
call dword [0x75e20cf0]
mov eax, dword [eax]
push 0x208
add eax, 0x200000
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221e0]
mov esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
test esi, esi
je 0x75dd3de0
call dword [0x75e20cf0]
mov eax, dword [eax]
push 0x208
add eax, 0x200000
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221e0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
je 0x75dd3de0
push 0x20
pop eax
cmp dword [ebp - reloc.ntdll.dll_NtClose], eax
jne 0x75dd40e9
push str.wowexec.pif
mov edx, 0x104
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
call fcn.75dcf1ae
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
jmp 0x75dd41a2
mov eax, 0x104
cmp dword [ebp - reloc.ntdll.dll_NtClose], eax
jae 0x75dd404d
push dword [ebp - 0x278]
mov edx, eax
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, esi
call fcn.75dcf1ae
push 0x2e
push esi
call dword [0x75e21d78]
pop ecx
pop ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
je 0x75dd404d
mov ecx, esi
sub ecx, eax
sar ecx, 1
add ecx, 0x104
cmp ecx, 5
jb 0x75dd404d
lea ecx, [ebp - 0x28]
push ecx
push 0xa
pop edx
mov ecx, eax
call fcn.75dcbf72
push esi
call dword [0x75e21230]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
cmp eax, reloc.ntdll.dll_NtClose
je 0x75dd4192
test al, 0x10
jne 0x75dd4192
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, edi
cmp ax, bx
jne 0x75dd4164
sub esi, ecx
sar esi, 1
inc esi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
push esi
push dword [ebp - 0x260]
mov edx, 0x104
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
call fcn.75db8871
jmp 0x75dd419a
mov esi, ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
test esi, esi
jne 0x75dd4266
push 0x5c
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
push esi
call dword [0x75e21d78]
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
test ecx, ecx
jne 0x75dd41d2
push 0x3a
push esi
call dword [0x75e21d78]
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov eax, ecx
add ecx, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
test eax, eax
je 0x75dd4225
movzx edx, word [ecx]
test dx, dx
je 0x75dd4219
push 0x20
pop eax
cmp dx, ax
je 0x75dd4219
push 9
pop eax
cmp dx, ax
je 0x75dd4219
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov word [eax + esi*2], dx
inc esi
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
add ecx, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
jmp 0x75dd41e6
xor ecx, ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov word [eax + esi*2], cx
test esi, esi
je 0x75dd425b
push ebx
push dword [ebp - 0x27c]
mov edi, 0x104
push edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x260]
push ebx
call dword [0x75e21670]
mov esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
cmp esi, edi
jae 0x75dd3de0
test esi, esi
jne 0x75dd4266
xor ecx, ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov word [eax], cx
mov edi, dword [ebp - reloc.ntdll.dll_NtClose]
lea eax, reloc.ntdll.dll_NtClose
test edi, edi
jne 0x75dd4352
push eax
mov edi, 0x20a
push edi
call dword [0x75e21d9c]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
and eax, 0xfffffffe
cmp eax, edi
jae 0x75dd434d
xor ecx, ecx
mov word [ebp + eax - 0x238], cx
mov esi, 0x105
push esi
lea eax, reloc.ntdll.dll_NtClose
push eax
push eax
call sym.KERNEL32.dll_GetShortPathNameW
mov ecx, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
cmp ecx, esi
ja 0x75dd4beb
test ecx, ecx
jne 0x75dd42ee
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
movzx ecx, word [ebp - 0x258]
shr ecx, 1
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
jmp 0x75dd430b
lea eax, [ecx + ecx]
mov word [ebp - 0x258], ax
lea eax, reloc.ntdll.dll_NtClose
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov word [ebp - 0x256], di
lea eax, [ecx - 2]
cmp eax, 0x40
ja 0x75dd4331
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21db0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
jmp 0x75dd433b
mov dword [ebp - reloc.ntdll.dll_NtClose], 0xc000000d
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
jge 0x75dd43f6
jmp 0x75dd4beb
call fcn.75dbdebc
push ebx
push eax
mov esi, 0x105
push esi
push edi
call dword [0x75e21200]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
je 0x75dd4387
cmp eax, esi
ja 0x75dd4beb
push esi
lea eax, reloc.ntdll.dll_NtClose
push eax
push eax
call sym.KERNEL32.dll_GetShortPathNameW
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
cmp eax, esi
ja 0x75dd4beb
test eax, eax
je 0x75dd43b6
lea ecx, reloc.ntdll.dll_NtClose
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
add eax, eax
mov word [ebp - 0x258], ax
mov eax, 0x20a
mov word [ebp - 0x256], ax
jmp 0x75dd43c4
push edi
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21db0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
cmp word [ebp - 0x284], 0x42
ja 0x75dd404d
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov cl, byte [eax]
movsx ax, cl
movzx eax, ax
mov edi, dword [ebp - reloc.ntdll.dll_NtClose]
cmp cl, 0x5a
jg 0x75dd4415
add eax, 0xffffffbf
jmp 0x75dd4418
add eax, 0xffffff9f
mov word [edi + 0x98], ax
mov edx, dword [ebp - reloc.ntdll.dll_NtClose]
test edx, edx
je 0x75dd44d3
test dword [edx + 0x2c], reloc.ntdll.dll_NtClose
je 0x75dd44d3
mov edx, dword [edx + 4]
test edx, edx
je 0x75dd4457
lea esi, [edx + 2]
push 2
pop ecx
mov ax, word [edx]
add edx, ecx
cmp ax, bx
jne 0x75dd4447
sub edx, esi
sar edx, 1
jmp 0x75dd4459
mov edx, ebx
lea esi, [edx*2 + 0x2a]
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
call dword [0x75e20cf0]
mov eax, dword [eax]
push esi
add eax, 0x200000
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221e0]
mov esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
test esi, esi
je 0x75dd44d3
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x75dd44a2
mov eax, 0x75e24c28
push eax
push dword [ecx + 0x38]
push str.hotkey._u__s
push dword [ebp - 0x2cc]
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
push esi
call fcn.75db7b1d
add esp, 0x14
mov edx, dword [ebp - reloc.ntdll.dll_NtClose]
and dword [edx + 0x2c], 0xfffffdff
mov dword [edx + 0x38], ebx
mov dword [edx + 4], esi
push 2
pop ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
movzx esi, word [ebp - 0x28c]
add esi, 6
push 0xfffffffffffffffc
pop edx
and esi, edx
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
movzx eax, word [ebp - 0x294]
add eax, 4
and eax, edx
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
movzx eax, word [eax]
test ax, ax
je 0x75dd452e
push 3
pop ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
add eax, ecx
and eax, edx
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov ax, word [ebp - 0x284]
test ax, ax
je 0x75dd4557
inc ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
movzx eax, ax
add eax, 4
and eax, edx
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
cmp word [eax], bx
je 0x75dd45b6
inc ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21db0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
movzx eax, word [ebp - 0x29c]
add eax, 4
and eax, 0xfffffffc
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
test ecx, ecx
je 0x75dd470c
add esi, 0x44
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
inc eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
cmp dword [ecx + 8], 0
je 0x75dd4648
inc eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
push dword [ecx + 8]
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21db0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
movzx eax, word [ebp - 0x2a4]
add eax, 4
and eax, 0xfffffffc
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
cmp dword [ecx + 0xc], 0
je 0x75dd46aa
inc eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
push dword [ecx + 0xc]
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21d6c]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
movzx eax, word [ebp - 0x2ac]
add eax, 4
and eax, 0xfffffffc
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
cmp dword [ecx + 4], 0
je 0x75dd470c
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
inc eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
push dword [ecx + 4]
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21ed4]
push 1
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21db0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
test eax, eax
js 0x75dd4beb
movzx eax, word [ebp - 0x2b4]
add eax, 4
and eax, 0xfffffffc
add esi, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
test ecx, ecx
je 0x75dd4745
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
inc eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
lea edx, reloc.ntdll.dll_NtClose
call fcn.75dd53b1
test eax, eax
js 0x75dd404d
add esi, 8
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
push esi
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
push ecx
call dword [0x75e21d70]
mov ecx, eax
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
test ecx, ecx
je 0x75dd3de0
lea esi, [edi + 0x5c]
push esi
movzx eax, word [ebp - 0x28c]
add eax, 6
and eax, 0xfffffffc
push eax
push ecx
call dword [0x75e21da4]
movzx eax, word [ebp - 0x28c]
push eax
push dword [ebp - 0x288]
push dword [esi]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x28c]
mov eax, dword [esi]
mov byte [ecx + eax], 0xd
movzx ecx, word [ebp - 0x28c]
mov eax, dword [esi]
mov byte [ecx + eax + 1], 0xa
movzx ecx, word [ebp - 0x28c]
mov eax, dword [esi]
mov byte [ecx + eax + 2], bl
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
add eax, 3
mov word [edi + 0x90], ax
lea esi, [edi + 0x60]
push esi
movzx eax, word [ebp - 0x294]
add eax, 4
and eax, 0xfffffffc
push eax
push dword [ebp - 0x25c]
call dword [0x75e21da4]
movzx eax, word [ebp - 0x294]
push eax
push dword [ebp - 0x290]
push dword [esi]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x294]
mov eax, dword [esi]
mov byte [ecx + eax], bl
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
inc eax
mov word [edi + 0x92], ax
lea eax, [edi + 0x64]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75dd487a
push eax
movzx eax, word [ebp - 0x29c]
add eax, 4
and eax, 0xfffffffc
push eax
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
push esi
call dword [0x75e21da4]
movzx eax, word [ebp - 0x29c]
push eax
push dword [ebp - 0x298]
push dword [edi + 0x64]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x29c]
mov eax, dword [edi + 0x64]
mov byte [ecx + eax], bl
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
inc eax
mov word [edi + 0x94], ax
jmp 0x75dd488b
xor ecx, ecx
mov word [edi + 0x94], cx
mov dword [eax], ebx
mov esi, dword [ebp - reloc.ntdll.dll_NtClose]
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
movzx ecx, word [eax]
lea eax, [edi + 0x6c]
test cx, cx
je 0x75dd48d1
push eax
add ecx, 3
and ecx, 0xfffffffc
push ecx
push esi
call dword [0x75e21da4]
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
movzx eax, word [ecx]
push eax
push dword [ecx + 4]
push dword [edi + 0x6c]
call fcn.75dc742d
add esp, 0xc
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
movzx eax, word [eax]
mov dword [edi + 0x70], eax
jmp 0x75dd48d6
mov dword [edi + 0x70], ebx
mov dword [eax], ebx
lea eax, [edi + 0x68]
mov cx, word [ebp - 0x284]
test cx, cx
je 0x75dd4926
push eax
movzx eax, cx
add eax, 4
and eax, 0xfffffffc
push eax
push esi
call dword [0x75e21da4]
movzx eax, word [ebp - 0x284]
push eax
push dword [ebp - 0x280]
push dword [edi + 0x68]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x284]
mov eax, dword [edi + 0x68]
mov byte [ecx + eax], bl
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
inc eax
jmp 0x75dd492a
mov dword [eax], ebx
xor eax, eax
mov word [edi + 0x96], ax
lea eax, [edi + 0x74]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75dd49d8
push eax
push 0x44
push esi
call dword [0x75e21da4]
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x10]
lea edx, [edi + 0x74]
mov eax, dword [edx]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x14]
mov eax, dword [edx]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x18]
mov eax, dword [edx]
mov dword [eax + 0x18], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x1c]
mov eax, dword [edx]
mov dword [eax + 0x1c], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x20]
mov eax, dword [edx]
mov dword [eax + 0x20], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x24]
mov eax, dword [edx]
mov dword [eax + 0x24], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x28]
mov eax, dword [edx]
mov dword [eax + 0x28], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov ecx, dword [eax + 0x2c]
mov eax, dword [edx]
mov dword [eax + 0x2c], ecx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
mov cx, word [eax + 0x30]
mov eax, dword [edx]
mov word [eax + 0x30], cx
mov eax, dword [edx]
mov dword [eax], 0x44
jmp 0x75dd49da
mov dword [eax], ebx
lea eax, [edi + 0x78]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75dd4a2f
push eax
movzx eax, word [ebp - 0x2a4]
add eax, 4
and eax, 0xfffffffc
push eax
push esi
call dword [0x75e21da4]
movzx eax, word [ebp - 0x2a4]
push eax
push dword [ebp - 0x2a0]
push dword [edi + 0x78]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x2a4]
mov eax, dword [edi + 0x78]
mov byte [ecx + eax], bl
movzx eax, word [ebp - 0x2a4]
inc eax
mov dword [edi + 0x7c], eax
jmp 0x75dd4a34
mov dword [eax], ebx
mov dword [edi + 0x7c], ebx
lea eax, [edi + 0x80]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75dd4a95
push eax
movzx eax, word [ebp - 0x2ac]
add eax, 4
and eax, 0xfffffffc
push eax
push esi
call dword [0x75e21da4]
movzx eax, word [ebp - 0x2ac]
push eax
push dword [ebp - 0x2a8]
push dword [edi + 0x80]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x2ac]
mov eax, dword [edi + 0x80]
mov byte [ecx + eax], bl
movzx eax, word [ebp - 0x2ac]
inc eax
mov dword [edi + 0x84], eax
jmp 0x75dd4a9d
mov dword [eax], ebx
mov dword [edi + 0x84], ebx
lea eax, [edi + 0x88]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75dd4afe
push eax
movzx eax, word [ebp - 0x2b4]
add eax, 4
and eax, 0xfffffffc
push eax
push esi
call dword [0x75e21da4]
movzx eax, word [ebp - 0x2b4]
push eax
push dword [ebp - 0x2b0]
push dword [edi + 0x88]
call fcn.75dc742d
add esp, 0xc
movzx ecx, word [ebp - 0x2b4]
mov eax, dword [edi + 0x88]
mov byte [ecx + eax], bl
movzx eax, word [ebp - 0x2b4]
inc eax
mov dword [edi + 0x8c], eax
jmp 0x75dd4b06
mov dword [eax], ebx
mov dword [edi + 0x8c], ebx
lea eax, [edi + 0x9c]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75dd4b38
push eax
push 8
push esi
call dword [0x75e21da4]
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov edx, dword [ebp - reloc.ntdll.dll_NtClose]
mov eax, dword [edi + 0x9c]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x75dd4b3a
mov dword [eax], ebx
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
push 0x20
pop ecx
cmp eax, ecx
jne 0x75dd4b4d
or dword [edi + 0x3c], reloc.ntdll.dll_NtClose
jmp 0x75dd4b69
cmp byte [ebp - 0x249], 0
je 0x75dd4b5b
mov dword [edi + 0x3c], ebx
jmp 0x75dd4b69
call fcn.75dd570b
mov dword [edi + 0x3c], eax
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
xor ecx, ecx
mov word [edi + 0x9a], cx
mov dword [edi + 0x40], eax
call dword [0x75e20ef8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x58], eax
push 0x68
push 0x10010005
push esi
push edi
call dword [0x75e21da0]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
cmp eax, 0xc0000022
jne 0x75dd4bae
cmp dword [edi + 0x7c], ebx
jne 0x75dd4bae
push esi
call dword [0x75e21d8c]
jmp 0x75dd4beb
push esi
call dword [0x75e21d8c]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
jl 0x75dd4bd6
cmp dword [edi + 0x30], ebx
jl 0x75dd4bd6
mov eax, dword [edi + 0x38]
mov ecx, dword [ebp - reloc.ntdll.dll_NtClose]
mov dword [ecx], eax
mov dword [ebp - reloc.ntdll.dll_NtClose], ebx
jmp 0x75dd4beb
mov eax, dword [edi + 0x30]
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
jmp 0x75dd4beb
mov dword [ebp - reloc.ntdll.dll_NtClose], 0xc0000039
mov dword [ebp - 4], ?
call fcn.75dd4c11
mov eax, dword [ebp - reloc.ntdll.dll_NtClose]
jmp 0x75dd4d42
add ecx, edi
mov dword [ebp - reloc.ntdll.dll_NtClose], ecx
jmp 0x75dd3d7a
push 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
mov eax, 0xc000000d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x20