Function at 0x12348
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebx + 0x34]
movzx eax, byte [edi + 4]
add edi, 0x1e
test eax, eax
mov dword [ebp - 8], eax
jbe 0x123a7
mov ecx, dword [esi + 4]
movzx eax, byte [edi]
movzx edx, byte [edi + 1]
shl eax, 8
add eax, edx
movzx edx, byte [edi + 2]
shl eax, 8
add eax, edx
movzx edx, byte [edi + 3]
shl eax, 8
add eax, edx
cmp ecx, eax
je 0x123a7
cmp eax, 0xffffffff
je 0x123a7
test eax, eax
je 0x123a7
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add edi, 4
cmp eax, dword [ebp - 8]
jb 0x1236e
cmp dword [ebp - 8], 0
jne 0x123b9
mov dword [ebp - 4], 1
lea eax, [edi + 4]
jmp 0x123c6
mov ecx, dword [ebp + 0xc]
cmp ecx, 8
mov dword [ebp - 4], ecx
mov eax, edi
jae 0x123f2
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
add ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
add ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
add ecx, edx
jne 0x123f2
inc dword [ebp - 4]
add eax, 4
cmp dword [ebp - 4], 8
jb 0x123c6
mov eax, dword [ebp - 8]
cmp dword [ebp + 0xc], eax
jne 0x12546
cmp dword [ebp - 4], 8
jne 0x12546
cmp dword [0x16968], 0
je 0x12439
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x12439
push 0
push eax
mov eax, dword [ebx + 0x34]
movzx cx, byte [eax + 2]
movzx dx, byte [eax + 3]
shl ecx, 8
add ecx, edx
movzx ecx, cx
push ecx
push eax
call fcn.000113b8
jmp 0x1243b
xor eax, eax
xor ecx, ecx
inc ecx
test eax, eax
jne 0x124bf
lea eax, [esi + 0x58]
lock xadd dword [eax], ecx
xor ecx, ecx
lea eax, [esi + 0x48]
inc ecx
lock xadd dword [eax], ecx
mov al, byte [esi + 7]
mov byte [edi], al
mov al, byte [esi + 6]
mov byte [edi + 1], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [edi + 2], al
mov al, byte [esi + 4]
mov byte [edi + 3], al
mov eax, dword [ebx + 0x34]
inc byte [eax + 4]
lea edi, [ebx + 0x4a]
mov esi, 0x16710
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
and dword [ebx + 0x3c], 0
and dword [ebx + 0x30], 0
mov esi, 0x16b30
mov ecx, esi
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [0x16b3c]
add ebx, 0x40
mov dword [ebx + 4], ecx
mov dword [ebx], 0x16b38
mov dword [ecx], ebx
mov dl, al
mov ecx, esi
mov dword [0x16b3c], ebx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov esi, dword [ebp + 8]
jmp 0x125f3
mov eax, 0x16b14
lock xadd dword [eax], ecx
xor ecx, ecx
lea eax, [esi + 0x3c]
inc ecx
lock xadd dword [eax], ecx
mov edi, dword [ebx + 0x24]
mov eax, dword [edi + 8]
mov dword [ebp - 8], eax
add eax, 0x78
mov ecx, eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [edi + 0xc]
mov dword [ebx], ecx
mov dword [edi + 0xc], ebx
mov ebx, dword [ebp - 8]
inc dword [ebx + 0xc]
dec dword [edi + 0x10]
mov byte [ebp + 0xb], al
jne 0x1253e
cmp byte [ebx + 0x1c], 0
je 0x1251a
add edi, 0x20
push edi
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp + 0xc]
jmp 0x125ed
xor edx, edx
mov ecx, 0x16964
inc edx
lock xadd dword [ecx], edx
cmp byte [0x16960], 0
jne 0x12536
call fcn.00010a2e
jmp 0x1250f
mov ecx, dword [ebp + 0xc]
jmp 0x125c0
mov ecx, dword [ebp + 0xc]
jmp 0x125eb
xor ecx, ecx
mov eax, 0x16b14
inc ecx
lock xadd dword [eax], ecx
xor ecx, ecx
lea eax, [esi + 0x44]
inc ecx
lock xadd dword [eax], ecx
mov edi, dword [ebx + 0x24]
mov eax, dword [edi + 8]
mov dword [ebp - 8], eax
add eax, 0x78
mov ecx, eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, dword [edi + 0xc]
mov dword [ebx], ecx
mov dword [edi + 0xc], ebx
mov ebx, dword [ebp - 8]
inc dword [ebx + 0xc]
dec dword [edi + 0x10]
mov byte [ebp + 0xb], al
jne 0x125e8
cmp byte [ebx + 0x1c], 0
je 0x125a1
add edi, 0x20
push edi
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
mov dl, byte [ebp + 0xb]
mov ecx, dword [ebp + 0xc]
jmp 0x125ed
xor edx, edx
mov ecx, 0x16964
inc edx
lock xadd dword [ecx], edx
cmp byte [0x16960], 0
jne 0x125bd
call fcn.00010a2e
jmp 0x12599
mov ecx, dword [ebp + 0xc]
mov dl, al
mov byte [ebx + 0x1c], 1
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
lea eax, [ebx + 0x58]
push eax
push dword [0x16724]
add ebx, 0x30
push dword [0x16720]
push ebx
call dword [sym.imp.ntoskrnl.exe_KeSetTimer]
jmp 0x125f3
mov ecx, dword [ebp + 0xc]
mov dl, al
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
lea eax, [esi + 0xa8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jns 0x12608
push esi
call fcn.00015038
pop edi
pop esi
pop ebx
leave
ret 8