Function at 0x12ed3d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x13066f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov ecx, dword [esp + 0x68]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
xor eax, eax
xor ebx, ebx
test ebp, ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xd
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [ecx], ebx
je 0x12ed498f
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x12ed498f
push esi
push edi
push 0x20000
call fcn.12e6efc0
add esp, 4
test eax, eax
jne 0x12ed3dd7
push 1
mov ecx, 0x131c0830
call fcn.12ebfbd0
test eax, eax
je 0x12ed4785
push ebp
call fcn.12e34140
add esp, 4
test eax, eax
je 0x12ed467a
push 0x130e1f5c
call fcn.12f5c44d
push eax
push 0x130e1f5c
push ebp
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
je 0x12ed4785
push 0x130e1f3c
call fcn.12f5c44d
push eax
push 0x130e1f3c
push ebp
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
je 0x12ed4785
push 0x130e1f1c
call fcn.12f5c44d
push eax
push 0x130e1f1c
push ebp
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
je 0x12ed4785
mov ebx, ebp
push 0x2f
push ebp
mov dword [esp + 0x2c], ebx
call fcn.12f5cfc9
add esp, 8
test eax, eax
je 0x12ed3edc
mov edx, dword [esp + 0x64]
lea esi, [edx + 1]
lea edi, [esi + esi]
push edi
call fcn.12f5bf8b
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
je 0x12ed3edc
mov ebx, dword [esp + 0x28]
mov ecx, edi
mov edx, ecx
xor eax, eax
mov edi, ebx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push ebx
rep stosb byte es:[edi], al
call fcn.12f5c4ab
add esp, 0xc
test esi, esi
jbe 0x12ed3eb5
mov eax, ebx
cmp word [eax], 0x2f
jne 0x12ed3eaf
mov word [eax], 0x5c
add eax, 2
dec esi
jne 0x12ed3ea4
mov eax, dword [0x13198f68]
mov ebx, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x24], ebx
je 0x12ed3edc
push ebx
push ebp
push 0x1314b68c
push 0x1314b678
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x38]
call fcn.12f4cba0
lea eax, [esp + 0x38]
mov ecx, 0x131c08d8
push eax
mov dword [esp + 0x54], 0
call fcn.12ee74f0
mov eax, dword [esp + 0x3c]
xor esi, esi
test eax, eax
jle 0x12ed3f24
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + esi*4]
push eax
push ebx
call fcn.12f51310
add esp, 8
test eax, eax
jne 0x12ed3f97
mov eax, dword [esp + 0x3c]
inc esi
cmp esi, eax
jl 0x12ed3f06
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12ed4774
mov ecx, 0x131c0830
call fcn.12ec0920
mov edi, eax
test edi, edi
jne 0x12ed3f4d
call fcn.12d92e70
test eax, eax
je 0x12ed400c
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x40]
call fcn.12f4cc10
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0x131c0834
call fcn.12ee73f0
mov eax, dword [esp + 0x3c]
xor esi, esi
test eax, eax
jle 0x12ed400c
mov edx, dword [esp + 0x38]
mov eax, dword [edx + esi*4]
push eax
push ebx
call fcn.12f51310
add esp, 8
test eax, eax
jne 0x12ed3fd0
mov eax, dword [esp + 0x3c]
inc esi
cmp esi, eax
jl 0x12ed3f77
jmp 0x12ed400c
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed3fbe
mov edx, dword [esp + 0x38]
mov eax, dword [edx + esi*4]
push eax
push ebx
push esi
push 0x1314b5f4
push str.SCDT
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x12ed4774
mov eax, dword [0x13198f68]
mov dword [esp + 0x14], 2
test eax, eax
je 0x12ed3fff
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + esi*4]
push ecx
push ebx
push esi
push 0x1314b584
push str.SCDT
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov dword [esp + 0x10], 1
jmp 0x12ed4774
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12ed4774
mov esi, dword [esp + 0x68]
mov ecx, 0x131c0830
push esi
push ebx
call fcn.12ec41b0
mov ebp, dword [esp + 0x6c]
cmp esi, 5
mov dword [esp + 0x14], eax
je 0x12ed403a
cmp esi, 6
jne 0x12ed4076
mov edx, dword [esp + 0x64]
mov ecx, 0x131c12e0
push edx
push ebx
push ebp
call fcn.12ed5490
test eax, eax
je 0x12ed4076
test edi, edi
jne 0x12ed406f
call fcn.12d92e70
test eax, eax
jne 0x12ed406f
test ebp, ebp
je 0x12ed46bd
cmp ebp, 2
je 0x12ed46bd
jmp 0x12ed4076
cmp dword [esp + 0x14], 3
jne 0x12ed3fff
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x78]
push edx
push eax
push ecx
push ebp
push esi
push ebx
call fcn.12ed37d0
mov ecx, dword [0x13198f68]
add esp, 0x20
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x12ed40c3
mov edx, dword [esp + 0x7c]
push edx
push ebp
push eax
push 0x1314b4ec
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
push 0x131911a8
lea ecx, [esp + 0x24]
call fcn.12f46a80
push 0x131911a8
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 1
call fcn.12f46a80
push 0x131911a8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 2
call fcn.12f46a80
push 0x131911a8
lea ecx, [esp + 0x34]
mov byte [esp + 0x54], 3
call fcn.12f46a80
push str.consent.exe
mov byte [esp + 0x54], 4
call fcn.12d8ba90
push eax
lea eax, [esp + 0x28]
push 0x130c4e18
push eax
call fcn.12f4a1a0
add esp, 0x10
push str.svchost.exe
call fcn.12d8ba90
push eax
lea ecx, [esp + 0x24]
push 0x130c4e18
push ecx
call fcn.12f4a1a0
add esp, 0x10
push 0x1314b4cc
call fcn.12d8ba90
push eax
lea edx, [esp + 0x20]
push 0x130c4e18
push edx
call fcn.12f4a1a0
add esp, 0x10
push 0x130c69b8
call fcn.12d8ba90
push eax
lea eax, [esp + 0x38]
push 0x130c4e18
push eax
call fcn.12f4a1a0
mov ecx, dword [0x13196cd0]
add esp, 0x10
push ecx
lea ecx, [esp + 0x64]
call fcn.12f46a80
mov eax, dword [esp + 0x10]
mov byte [esp + 0x50], 5
test eax, eax
je 0x12ed434c
mov eax, dword [esp + 0x7c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, 0x30000000
je 0x12ed4260
mov edx, dword [esp + 0x60]
push ebx
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12ed41de
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.12e5c5e0
add esp, 4
test eax, eax
je 0x12ed41e6
mov dword [esp + 0x10], 0
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4260
call ebp
mov esi, eax
push esi
call fcn.12f8c8a0
mov edi, eax
lea eax, [esp + 0x38]
push edi
push eax
call fcn.12f8c8f0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push eax
mov byte [esp + 0x54], 6
call fcn.12f46920
lea ecx, [esp + 0x34]
mov byte [esp + 0x50], 8
call fcn.12f41ea0
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4252
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push ebx
push edi
push esi
push 0x1314b3ec
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 5
call fcn.12f47220
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12ed434c
test byte [esp + 0x7c], 1
je 0x12ed434c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.12e5c5e0
add esp, 4
test eax, eax
je 0x12ed4297
mov dword [esp + 0x10], 0
jmp 0x12ed431e
call ebp
mov esi, eax
push esi
call fcn.12f8c8a0
mov edi, eax
lea eax, [esp + 0x38]
push edi
push eax
call fcn.12f8c8f0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push eax
mov byte [esp + 0x54], 9
call fcn.12f46920
lea ecx, [esp + 0x34]
mov byte [esp + 0x50], 0xb
call fcn.12f41ea0
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed42fa
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push ebx
push edi
push esi
push 0x1314b30c
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
mov eax, dword [esp + 0x2c]
push ebx
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12ed4310
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 5
call fcn.12f47220
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed434c
mov ecx, dword [esp + 0x7c]
mov edi, dword [esp + 0x6c]
mov edx, dword [esp + 0x10]
push ecx
push edi
push edx
push 0x1314b274
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
jmp 0x12ed4350
mov edi, dword [esp + 0x6c]
call fcn.12d8ccf0
push eax
call fcn.12f5c44d
mov ecx, dword [esp + 0x14]
add esp, 4
test ecx, ecx
jne 0x12ed472e
mov ebp, dword [esp + 0x64]
cmp ebp, eax
jb 0x12ed454f
push eax
call fcn.12d8ccf0
push eax
push ebx
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12ed4543
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed43bc
mov eax, dword [esp + 0x60]
push eax
call fcn.12d8ccf0
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ecx
push 0x1314b1fc
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov edx, dword [0x13196cd0]
lea ecx, [esp + 0x6c]
push edx
call fcn.12f46a80
mov eax, dword [0x13198f68]
mov byte [esp + 0x50], 0xc
test eax, eax
je 0x12ed43f3
push 0x1314b1b4
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
mov eax, dword [0x13198f68]
add esp, 0xc
test byte [esp + 0x7c], 1
je 0x12ed441f
test eax, eax
je 0x12ed4412
push 0x1314b16c
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov dword [esp + 0x10], 0
jmp 0x12ed4535
test eax, eax
je 0x12ed444b
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
push 0x1314b0a8
push 0x1314b080
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov esi, 1
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.12e5c5e0
add esp, 4
test eax, eax
jne 0x12ed44a9
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12ed44a9
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12ed44a9
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12ed44d0
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed44c6
push 0x1314b034
push 0x1314b080
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov dword [esp + 0x10], 0
jmp 0x12ed4518
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12ed4518
call fcn.12d91a00
test eax, eax
je 0x12ed4518
mov eax, dword [esp + 0x5c]
cmp eax, 2
je 0x12ed44f7
cmp eax, 3
mov dword [esp + 0x10], 0
jne 0x12ed44fb
mov dword [esp + 0x10], esi
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4535
push 0x1314b034
push 0x1314b080
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4535
push 0x1314afec
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
lea ecx, [esp + 0x6c]
mov byte [esp + 0x50], 5
call fcn.12f47220
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12ed472e
mov eax, dword [esp + 0x74]
test eax, eax
je 0x12ed472e
call fcn.12d92c40
test eax, eax
je 0x12ed45ef
push edi
call fcn.12ebfa80
mov esi, dword [esp + 0x18]
add esp, 4
cmp eax, 1
jne 0x12ed45b9
mov eax, 1
cmp esi, eax
je 0x12ed45b5
cmp esi, 3
je 0x12ed45b5
cmp esi, 8
je 0x12ed45b9
cmp esi, 9
je 0x12ed45b9
cmp esi, 0xa
je 0x12ed45b9
cmp dword [esp + 0x68], eax
jne 0x12ed45b9
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.12ece9a0
add esp, 8
test eax, eax
jne 0x12ed45b9
mov dword [esp + 0x10], eax
jmp 0x12ed45b9
mov dword [esp + 0x10], eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed45e1
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x10]
push edx
push edi
push eax
push 0x1314af54
push str.procidentifytype
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12ed46ca
jmp 0x12ed45fb
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12ed472e
call fcn.12d91a00
test eax, eax
jne 0x12ed472e
push edi
call fcn.12ebfa80
add esp, 4
cmp eax, 1
jne 0x12ed472e
lea ecx, [esp + 0x7c]
push ecx
mov ecx, 0x131bf358
call fcn.12eb4300
mov eax, dword [esp + 0x7c]
mov byte [esp + 0x50], 0xe
cmp ebp, dword [eax - 8]
jne 0x12ed466c
push ebp
push eax
push ebx
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12ed466c
mov eax, dword [0x131bf428]
test eax, eax
je 0x12ed4662
push ebx
push 0x1314af10
push str.Path_Write_Blocked
call fcn.12eda240
add esp, 0xc
mov edx, dword [esp + 0x78]
mov dword [edx], 1
mov byte [esp + 0x50], 5
lea ecx, [esp + 0x7c]
jmp 0x12ed4729
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4785
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
and ecx, 0xffff
push 0xd
push ecx
push edx
push eax
push ebp
push 0x1314ae6c
push str.NoFile
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x24
jmp 0x12ed4785
mov dword [esp + 0x10], 0
jmp 0x12ed4774
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed46e9
push esi
push ebx
push 0x1314ae08
push str.SCDTRuleLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [0x131bf428]
test eax, eax
je 0x12ed472e
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0x7c]
push ecx
push esi
push edx
call fcn.12ed3b90
add esp, 0xc
mov eax, dword [eax]
mov byte [esp + 0x50], 0xd
push eax
push ebx
push 0x1314adc0
push 0x1314ad9c
call fcn.12eda240
add esp, 0x10
mov byte [esp + 0x50], 5
lea ecx, [esp + 0x7c]
call fcn.12f47220
lea ecx, [esp + 0x60]
mov byte [esp + 0x50], 4
call fcn.12f47220
lea ecx, [esp + 0x30]
mov byte [esp + 0x50], 3
call fcn.12f47220
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], 2
call fcn.12f47220
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 1
call fcn.12f47220
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 0
call fcn.12f47220
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xffffffff
call fcn.12f4cbb0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12ed4978
mov edi, dword [esp + 0x58]
cmp edi, 0x100613
je 0x12ed47b1
cmp edi, 0x100620
je 0x12ed47b1
cmp edi, 0x100621
jne 0x12ed4841
push ebx
call fcn.12e0c970
add esp, 4
test eax, eax
je 0x12ed47f3
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed47db
push 0x1314ad3c
push str.SCDT
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov esi, dword [esp + 0x14]
cmp esi, 2
je 0x12ed47e9
cmp esi, 1
jne 0x12ed47f7
mov dword [esp + 0x10], 0
jmp 0x12ed47f7
mov esi, dword [esp + 0x14]
call fcn.12d92e70
test eax, eax
jne 0x12ed480d
call fcn.12e76610
cmp dword [0x13196cc4], eax
jne 0x12ed4841
cmp esi, 1
je 0x12ed4817
cmp esi, 3
jne 0x12ed4841
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4834
push 0x1314ace4
push str.SCDT
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov dword [esp + 0x10], 0
jmp 0x12ed4978
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12ed4978
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ed4917
mov eax, dword [esp + 0x74]
mov ebp, 0x1313fee4
test eax, eax
jne 0x12ed486c
mov ebp, 0x1314acd8
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x14]
push ecx
lea eax, [esp + 0x68]
push edx
push eax
call fcn.12ed3b90
mov esi, eax
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x78]
and eax, 0xffff
mov dword [esp + 0x5c], 0xf
push eax
push ecx
call fcn.12ed3ad0
mov edi, eax
lea edx, [esp + 0x90]
mov bl, 0x10
push edx
mov byte [esp + 0x68], bl
call fcn.12ec1090
add esp, 0x18
mov ecx, dword [esp + 0x58]
mov edx, dword [esi]
mov eax, dword [eax]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push ebp
push edx
push eax
push 0x1314abf8
push str.SCDTRuleLog
push 0xffffffffffffffff
mov byte [esp + 0x74], 0x11
call fcn.12dad750
add esp, 0x24
lea ecx, [esp + 0x7c]
mov byte [esp + 0x50], bl
call fcn.12f47220
lea ecx, [esp + 0x6c]
mov byte [esp + 0x50], 0xf
call fcn.12f47220
lea ecx, [esp + 0x64]
mov dword [esp + 0x50], 0xffffffff
call fcn.12f47220
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x24]
mov eax, dword [0x131bf428]
test eax, eax
je 0x12ed4978
mov eax, dword [esp + 0x74]
mov esi, 0x1314ad9c
test eax, eax
jne 0x12ed4932
mov esi, str.Path_Write_Blocked
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x14]
push ecx
lea eax, [esp + 0x80]
push edx
push eax
call fcn.12ed3b90
add esp, 0xc
mov ecx, dword [eax]
push edi
push ecx
push ebx
push 0x1314aba8
push esi
mov dword [esp + 0x64], 0x12
call fcn.12eda240
add esp, 0x14
lea ecx, [esp + 0x7c]
mov dword [esp + 0x50], 0xffffffff
call fcn.12f47220
mov eax, dword [esp + 0x28]
pop edi
test eax, eax
pop esi
je 0x12ed498b
push eax
call fcn.12f5bf80
add esp, 4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x40]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret