Function at 0x20000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
jmp 0x2000e
pushal
call 0x20014
lea esp, [esp + 0x24]
jmp 0x2001d
pushal
mov eax, dword [ebp + 0xc]
pushfd
lea esp, [esp + 0x24]
jo 0x42fb6
push ebp
mov dword [esp], eax
jge 0x432ac
call fcn.00012500
shr si, cl
call 0x20043
mov esi, eax
pushfd
pushal
xor ebx, ebx
stc
cmp esi, ebx
push dword [esp + 4]
lea esp, [esp + 0x2c]
jl 0x42c82
pushfd
mov esi, dword [ebp + 8]
lea edi, [edi*4 + 0x5a6fd07a]
not di
movzx cx, al
pushfd
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx ax, al
pushal
mov eax, 0x13500
setbe cl
mov cl, 0x7d
movzx ecx, cl
pushfd
mov dword [esp + 0x28], str.DeviceGpeNetSafe
bswap cx
bswap ecx
setl ch
lea ecx, [ebp - 0x14]
mov word [esp], di
push ebx
mov dword [esi + 0x38], 0x1f000
jmp 0x200aa
call 0x200af
lea esp, [esp + 0x30]
js 0x43618
mov dword [esi + 0x40], section.PAGE
pushal
pushfd
push 0x9c69fca1
jmp 0x200cc
mov dword [esi + 0x70], 0x1f020
mov word [esp], si
pushfd
push 0x2c3d8d5e
mov dword [esi + 0x78], eax
mov byte [esp], al
jmp 0x200e8
call fcn.00044868
push 0x8a35e436
lea esp, [esp + 4]
jge 0x426ec
push 0x1b0b08f5
mov cl, byte [esp]
lea ecx, [ebp*8 - 0x3b024f14]
mov ecx, dword [ebp - 4]
jmp 0x44ede
jmp 0x426f1
pushfd
push eax
lea esp, [esp + 8]
call fcn.000116c0
movzx dx, dl
mov edx, dword [ebp - 4]
jmp 0x446eb
pushal
mov dword [esp + 0x1c], 0x15200
call fcn.000441cb
cmp esi, ebx
pushal
mov byte [esp], 0xa2
jmp 0x441dd
pushfd
mov dword [esp], eax
pushfd
pushal
push ebp
lea esp, [esp + 0x28]
call fcn.00012500
lea esi, [ebx*8 + 0x118543c1]
clc
lea esi, [ebx + 0x28b67230]
mov esi, eax
pushal
sub ebx, ebx
cmp cl, dl
cmp dh, 0x8d
cmp bh, al
pushal
cmp esi, ebx
jmp 0x42fe8
lea esp, [esp + 0x40]
jl 0x42c82
jns 0x44043
push 0xd19ae029
pop esi
mov esi, dword [ebp + 8]
lea ecx, [esp + 0xb561f84]
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x43013
pushfd
not ah
jmp 0x4431b
jmp 0x432b1
call fcn.00012500
sbb esi, 0x618849b3
cmc
sub esi, 0x19b3a81a
rcl si, cl
mov esi, eax
bt dx, 0xa
push ecx
jmp 0x432d3
xor ebx, ebx
bt bx, 7
cmp esi, ebx
call 0x432e1
push eax
jmp 0x43d4e
push ecx
pushal
mov dword [esp], esp
call 0x43622
mov dword [esi + 0x40], 0x1f000
jmp 0x4362e
mov dword [esi + 0x70], 0x1f020
pushfd
push dword [esp + 0x1c]
mov byte [esp], bh
mov dword [esi + 0x78], eax
push dword [esp + 8]
jmp 0x43649
mov dword [0x1e31c], eax
pushfd
push dword [esp + 4]
jmp 0x43658
mov dword [esp + 0x38], ecx
jmp 0x43661
call 0x43666
pushfd
mov dword [esi + 0x34], ebx
mov word [esp], 0x7e45
pushfd
pushfd
push ebp
mov dword [esp + 0x48], 0x43699
pushfd
lea esp, [esp + 0x4c]
jns 0x4451d
push edi
pushfd
mov byte [esp], 0xf8
mov word [esp], 0x640f
push dword [esp + 4]
ret 8
call fcn.000440b9
call 0x4371a
mov dword [esp + 0x24], 0x4373c
pushal
push dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
pop dword [esp + 0x40]
mov dword [esp], eax
pushfd
mov byte [esp], 0x25
push dword [esp + 0x44]
ret 0x48
pushal
lea esp, [esp + 0x2c]
jl 0x42c82
pushfd
xchg si, ax
sete ah
movzx si, al
mov esi, dword [ebp + 8]
movzx edi, bl
movsx di, cl
cwde
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
setne al
not cl
bswap ecx
lahf
mov eax, 0x13500
call fcn.000432ed
lea esp, [esp + 0x2c]
call fcn.000148b0
inc esi
cmp dl, 0xf9
lea esi, [ebx - 0x296be906]
je 0x44794
mov esi, eax
pushfd
mov dword [esp], edx
push eax
jmp 0x43dab
cmp esi, ebx
call 0x43db2
mov dword [esp], ebp
mov word [esp], 0x8bf1
pushal
lea esp, [esp + 0x2c]
jge 0x42b0b
pushal
movzx ecx, al
setl cl
mov ecx, dword [ebp - 4]
call 0x43dd5
mov dword [esp + 0x20], ecx
jmp 0x43dde
jmp 0x43de3
mov dword [esp + 0x1c], 0x43e07
mov byte [esp], dl
push 0x37c65e67
push dword [sym.imp.ntoskrnl.exe_IoUnregisterShutdownNotification]
pop dword [esp + 0x1c]
pushal
push eax
push esp
push dword [esp + 0x44]
ret 0x48
xchg si, di
not di
not di
movzx ax, cl
mov esi, dword [ebp + 8]
cwde
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
bswap eax
jmp 0x44061
lea eax, [ebp + 0xf90d97]
mov eax, 0x13500
push 0xf1e37d99
pushfd
pushal
mov dword [esp + 0x24], str.DeviceGpeNetSafe
push 0x8b257309
call 0x44085
lea ecx, [ebp - 0x14]
call 0x4408d
jmp 0x44092
mov dword [esi + 0x38], section.PAGE
push 0xc4d3c97a
push esi
jmp 0x440a4
mov dword [esi + 0x40], section.PAGE
jmp 0x43710
lea esp, [esp + 0x20]
jl 0x42c82
pushfd
pop ecx
push str.DosDevicesGpeNetSafe
movzx cx, bl
call fcn.00043d28
mov eax, 0x13500
pushal
pushal
movsx cx, cl
pop ecx
mov dword [esp + 0x3c], str.DeviceGpeNetSafe
movzx cx, bl
not ecx
setge ch
call fcn.00043028
jmp 0x44522
push edi
pushfd
mov byte [esp], 0xa6
pushal
push ebp
push dword [esp + 0x28]
ret 0x2c
push edx
call fcn.00042720
not ax
movsx ax, bl
mov eax, dword [ebp - 4]
call 0x44700
pushfd
call fcn.00045440
mov edi, dword [ecx]
inc edx
and eax, ecx
sub eax, 0xcd922e80
dec edx
cmc
xchg byte [ecx - 0x8c6318f], ah
adc al, al
lahf
add eax, 0x573148bb
xchg esi, eax
sbb bl, 0x70
xchg esp, eax
movsb byte es:[edi], byte [esi]
push ss
inc edi
push ss
mov esp, dword [ebx]
push ecx
xchg ebx, eax
fild qword [ecx - 0x41]
dec ebx
sbb eax, 0x40a43fbe
push ss
dec esi
xor bl, bh
outsd dx, dword [esi]
pushal
sub ebp, dword [ecx + 0x3b]
or byte [esi + 0x2b], cl
nop
dec edx
sub esp, dword [esi + 0x47]
mov bh, byte [esp + esi*8 - 0x288e5273]
dec ebp
sbb byte [esi + esi*2 + 0x6a], ch
push eax
clc
leave
int1
jns 0x4476c
or ebx, dword [esi - 0x5a]
mov byte [0xa32949b3], al
push 0xa212ecf0
xchg ebx, eax
cdq
dec bl
ljmp 0x3112
int 0x8c
loope 0x4479b
adc dh, byte [ecx]
lodsd eax, dword [esi]
or ch, byte [edi - 0x492db917]
adc eax, dword [esi - 0xc876e3f]
pop ds
xchg esp, eax
or bh, byte [eax + edi - 0x512249e2]
push esp
mov ebp, 0xf0ef8362
sub al, 0xc7
dec esp
outsd dx, dword [esi]
scasb al, byte es:[edi]
mov eax, dword [0x80c6d366]
sti
inc ebp
rol si, cl
cmp bl, 0x45
push esi
bt esp, 5
mov esi, eax
jmp 0x447a6
jmp 0x447ab
cmp esi, ebx
pushal
lea esp, [esp + 0x24]
jge 0x42b0b
sets cl
setno ch
mov ecx, dword [ebp - 4]
call 0x447c6
mov dword [esp], ecx
call 0x447ce
jmp 0x447d3
pushal
mov dword [esp + 0x20], 0x447fe
push dword [esp + 4]
push dword [sym.imp.ntoskrnl.exe_IoUnregisterShutdownNotification]
pop dword [esp + 0x20]
pushfd
push dword [esp + 4]
push dword [esp]
mov word [esp + 8], sp
push dword [esp + 0x2c]
ret 0x30