Function at 0x7d23fa00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
push ebx
push ebp
push esi
push edi
push 0
call fcn.7d2216ef
mov ecx, dword [0x7d2ddad8]
mov ebx, eax
mov dword [esp + 0x44], ebx
test ecx, ecx
jne 0x7d23fa3f
push 0x18
call fcn.7d2217b2
push 0x3e8
push eax
mov dword [0x7d2ddad8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov ecx, dword [0x7d2ddad8]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x7d2ddae0], 0
jne 0x7d23fa8a
push 0xc
call fcn.7d2217b2
xorps xmm0, xmm0
mov dword [0x7d2ddae0], eax
push 0xc
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.7d2217b2
xorps xmm0, xmm0
mov dword [0x7d2ddae4], eax
mov byte [esp + 0x19], 1
movq qword [eax], xmm0
mov dword [eax + 8], 0
jmp 0x7d23fa8f
mov byte [esp + 0x19], 0
push ebx
call fcn.7d221a5a
cmp dword [0x7d2ddadc], 0
jne 0x7d23fab7
push 0x68
call fcn.7d2217b2
push 0x68
push 0
push eax
mov dword [0x7d2ddadc], eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ebp, dword [esp + 0xf8]
lea eax, [esp + 0x24]
xor edx, edx
mov dword [esp + 0x5c], 0x18
mov dword [esp + 0x60], 0
mov dword [esp + 0x68], 0x40
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x14], edx
mov ebx, 1
mov ecx, edx
xor eax, eax
shl ebx, cl
mov dword [esp + 0x38], eax
test ebp, ebx
jne 0x7d23fb96
mov eax, dword [0x7d2ddadc]
mov edi, dword [eax + edx*4]
test edi, edi
je 0x7d23fb8e
lea esi, [edi + 0x1c]
test esi, esi
je 0x7d23fb8e
mov ecx, dword [0x7d2b625c]
mov edx, 4
sub esi, ecx
nop dword [eax + eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x7d23fb8a
add ecx, 2
sub edx, 1
jne 0x7d23fb30
movzx eax, word [edi + 0x24]
test ax, ax
je 0x7d23fb8a
cmp word [edi + 0x26], 0x3a
jne 0x7d23fb8a
cmp word [edi + 0x28], 0x5c
jne 0x7d23fb8a
mov ecx, eax
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x7d23fb66
add ecx, 0x20
mov edx, dword [esp + 0x14]
add ecx, 0xffffff9f
cmp cx, 0x19
ja 0x7d23fb8e
mov eax, 1
shl eax, cl
test ebp, eax
je 0x7d23fb8e
bts ebp, edx
mov dword [esp + 0xf8], ebp
jmp 0x7d23fb8e
mov edx, dword [esp + 0x14]
test ebp, ebx
je 0x7d2401ef
mov eax, dword [0x7d2ddadc]
mov ecx, dword [eax + edx*4]
test ecx, ecx
je 0x7d23fc0f
lea ebp, [ecx + 0x1c]
mov dword [esp + 0x38], ecx
mov esi, ebp
mov dword [eax + edx*4], 0
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x7d23fbb5
mov eax, dword [0x7d2ddae0]
sub esi, ecx
sar esi, 1
mov edi, dword [eax]
test edi, edi
je 0x7d23fc0f
nop
lea ecx, [edi + 0x1c]
mov ebx, dword [edi]
cmp dword [edi + 0x10], esi
jb 0x7d23fc09
movzx eax, word [ecx + esi*2]
cmp eax, 0x5c
je 0x7d23fbe8
test ax, ax
jne 0x7d23fc09
push esi
push ecx
push ebp
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23fc09
push edi
push dword [0x7d2ddae0]
call fcn.7d22193d
push edi
call fcn.7d221537
mov edi, ebx
test ebx, ebx
jne 0x7d23fbd0
push 0x10
mov dword [esp + 0x20], 0x10
call fcn.7d2217b2
mov ebp, dword [esp + 0x14]
mov esi, eax
add ebp, 0x41
push ebp
push str.___c:
push 8
push esi
mov dword [esp + 0x30], ebp
call sym.SbieDll.dll_Sbie_snwprintf
add esp, 0x10
lea eax, [esp + 0x24]
push esi
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x5c]
push eax
push 1
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
mov edi, eax
cmp edi, 0xc0000022
jne 0x7d23fcf1
push 0x800
call fcn.7d221505
mov ebx, eax
mov ecx, esi
mov edx, ebx
sub edx, esi
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x7d23fc80
push 0x800
push ebx
call fcn.7d221785
mov edi, eax
test edi, edi
js 0x7d23fce3
push esi
call fcn.7d221537
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23fcb0
sub ecx, edx
mov dword [esp + 0x28], ebx
sar ecx, 1
mov byte [esp + 0x34], 1
lea eax, [ecx + ecx]
mov word [esp + 0x24], ax
add eax, 2
mov word [esp + 0x26], ax
xor eax, eax
mov dword [esp + 0x30], eax
jmp 0x7d23fec5
push ebx
call fcn.7d221537
push esi
call fcn.7d221537
jmp 0x7d23fd49
mov byte [esp + 0x34], 0
mov ebx, esi
test edi, edi
jns 0x7d23fec1
push esi
call fcn.7d221537
cmp edi, 0xc0000034
je 0x7d23fd49
cmp edi, 0xc000003a
je 0x7d23fd49
cmp edi, 0xc0000024
je 0x7d23fd49
push edi
push ebp
push str._c___08X_
lea eax, [esp + 0xa0]
push 0x10
push eax
call sym.SbieDll.dll_Sbie_snwprintf
lea eax, [esp + 0xa8]
push eax
push 0x903
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x1c
mov eax, dword [esp + 0x38]
test eax, eax
je 0x7d2401e4
mov dl, byte [eax + 0x16]
lea ebp, [eax + 0x1c]
mov edi, ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x13], dl
lea ecx, [edi + 2]
nop dword [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x7d23fd70
sub edi, ecx
sar edi, 1
xor ebx, ebx
mov dword [esp + 0x20], ebx
nop word [eax + eax]
mov eax, dword [0x7d2ddadc]
lea ecx, [ebx*4]
mov dword [esp + 0x3c], ecx
mov eax, dword [ecx + eax]
test eax, eax
je 0x7d23fea4
mov cl, byte [eax + 0x16]
mov byte [esp + 0x1a], cl
test dl, dl
je 0x7d23fdbe
test cl, cl
je 0x7d23fea4
lea edx, [eax + 0x1c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23fdc6
sub ecx, esi
sar ecx, 1
cmp ecx, edi
jb 0x7d23fea0
movzx eax, word [edx + edi*2]
lea esi, [edx + edi*2]
test ax, ax
je 0x7d23fdf2
cmp eax, 0x5c
jne 0x7d23fea0
push edi
push ebp
push edx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23fea0
lea eax, [edi*2 + 0x2c]
push eax
call fcn.7d2217b2
mov ebp, eax
lea ecx, [ebx + 0x41]
mov al, byte [esp + 0x1a]
lea ebx, [ebp + 0x1c]
mov byte [ebp + 0x16], al
mov eax, dword [esp + 0x14]
mov word [ebp], cx
add eax, 0x41
mov ecx, dword [0x7d2b625c]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx], edx
mov dword [ebx + 4], ecx
mov ecx, ebx
mov word [ebx + 8], ax
sub ecx, esi
mov eax, 0x3a
mov word [ebx + 0xa], ax
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [esi + ecx + 0xa], ax
test ax, ax
jne 0x7d23fe50
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23fe65
mov eax, dword [0x7d2ddadc]
sub ecx, edx
mov esi, dword [esp + 0x3c]
sar ecx, 1
mov dword [ebp + 0x18], ecx
push dword [esi + eax]
call fcn.7d221537
mov eax, dword [0x7d2ddadc]
push ebx
push 5
mov dword [esi + eax], ebp
call sym.SbieDll.dll_SbieApi_MonitorPut
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
mov dl, byte [esp + 0x13]
inc ebx
mov dword [esp + 0x20], ebx
cmp ebx, 0x1a
jb 0x7d23fd90
mov eax, dword [esp + 0x38]
push eax
call fcn.7d221537
jmp 0x7d2401e4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x7d23ff5d
mov esi, dword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
xorps xmm0, xmm0
push ecx
push eax
movlpd qword [esp + 0x30], xmm0
call esi
mov edi, eax
cmp edi, 0xc0000023
je 0x7d23fefe
test edi, edi
js 0x7d23ff53
mov edi, 0xc0000001
jmp 0x7d23ff53
push ebx
call fcn.7d221537
mov eax, dword [esp + 0x1c]
add eax, 0x20
push eax
mov dword [esp + 0x20], eax
call fcn.7d2217b2
mov ecx, dword [esp + 0x1c]
mov ebx, eax
push 0
add ecx, 0xfffffff8
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x28]
mov word [esp + 0x2a], cx
push eax
push dword [esp + 0x38]
add ecx, 0xfffffffe
mov word [esp + 0x30], cx
call esi
mov edi, eax
mov ecx, 1
mov eax, dword [esp + 0x34]
test edi, edi
movzx eax, al
cmovns eax, ecx
mov dword [esp + 0x34], eax
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [esp + 0x34], 0
je 0x7d2401a7
movzx eax, word [esp + 0x24]
xor ecx, ecx
shr eax, 1
mov esi, ebx
mov byte [esp + 0x1b], 0
mov byte [esp + 0x40], 0
lea edx, [ecx + 4]
mov word [ebx + eax*2], cx
mov ecx, dword [0x7d2b625c]
sub esi, ecx
nop dword [eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x7d23ffbf
add ecx, 2
sub edx, 1
jne 0x7d23ff90
cmp word [ebx + 8], dx
je 0x7d23ffbf
mov eax, dword [esp + 0x40]
mov ecx, 1
cmp word [ebx + 0xa], 0x3a
movzx eax, al
cmove eax, ecx
mov dword [esp + 0x40], eax
lea eax, [esp + 0x1b]
push eax
movzx eax, word [esp + 0x28]
push eax
push ebx
push dword [esp + 0x50]
call fcn.7d23dc50
mov dword [esp + 0x3c], eax
test eax, eax
je 0x7d2401a1
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23ffe5
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x1c], ecx
lea eax, [ecx*2 + 0x1e]
push eax
call fcn.7d2217b2
mov ecx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x40]
add ecx, 0x41
mov dword [esp + 0x2c], esi
mov word [esi], cx
lea edx, [esi + 0x1c]
mov byte [esi + 0x16], al
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x3c]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x7d240030
xor ecx, ecx
lea eax, [esi + 2]
mov dword [esp + 0x58], eax
mov word [eax], cx
cmp byte [0x7d2dda55], cl
je 0x7d24018a
mov eax, dword [esi + 0x18]
xor ebp, ebp
lea eax, [eax*2 + 8]
push eax
call fcn.7d2217b2
mov ecx, dword [esi + 0x18]
add ecx, ecx
mov dword [esp + 0x4c], eax
push ecx
lea ecx, [esi + 0x1c]
push ecx
push eax
call sub.ntdll.dll_memcpy
mov ecx, dword [esi + 0x18]
mov edx, 0x5c
mov eax, dword [esp + 0x58]
add esp, 0xc
mov word [eax + ecx*2], dx
xor edx, edx
mov eax, dword [esp + 0x4c]
mov ecx, dword [esi + 0x18]
mov word [eax + ecx*2 + 2], dx
mov ax, word [esi + 0x18]
inc ax
mov dword [esp + 0x74], 0x18
add ax, ax
mov dword [esp + 0x78], edx
mov word [esp + 0x48], ax
add eax, 2
mov word [esp + 0x4a], ax
lea eax, [esp + 0x48]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x54]
push eax
push 0x10
mov dword [esp + 0x88], 0x40
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], edx
call sub.ntdll.dll_RtlSetThreadErrorMode
push ebp
push ebp
push 0x21
push 1
push 7
push ebp
push ebp
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x94]
push eax
push 0x80100000
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
push ebp
push dword [esp + 0x58]
mov esi, eax
call sub.ntdll.dll_RtlSetThreadErrorMode
push dword [esp + 0x4c]
call fcn.7d221537
test esi, esi
js 0x7d240182
push 1
push 0x40
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0x98]
push eax
push dword [esp + 0x60]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
push dword [esp + 0x50]
test eax, eax
cmovns ebp, dword [esp + 0xc0]
call dword [sym.imp.ntdll.dll_NtClose]
test ebp, ebp
je 0x7d240182
movzx eax, bp
push eax
shr ebp, 0x10
push ebp
push str._04X__04X
push 0xa
push dword [esp + 0x68]
call sym.SbieDll.dll_Sbie_snwprintf
add esp, 0x14
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
mov eax, dword [0x7d2ddadc]
mov ecx, dword [esp + 0x14]
push dword [esp + 0x3c]
push 5
mov dword [eax + ecx*4], esi
call sym.SbieDll.dll_SbieApi_MonitorPut
push ebx
call fcn.7d221537
mov eax, dword [esp + 0x38]
test eax, eax
je 0x7d2401b5
push eax
call fcn.7d221537
test edi, edi
jns 0x7d2401e4
push edi
push ebp
push str._c___08X_
lea eax, [esp + 0xa0]
push 0x10
push eax
call sym.SbieDll.dll_Sbie_snwprintf
lea eax, [esp + 0xa8]
push eax
push 0x903
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x1c
mov ebp, dword [esp + 0xf8]
mov edx, dword [esp + 0x14]
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x1a
jb 0x7d23faf4
cmp byte [esp + 0x19], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x7d240216
push dword [esp + 0x34]
call fcn.7d240450
call fcn.7d241a00
push dword [esp + 0x34]
call fcn.7d2217a3
push dword [0x7d2ddad8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
add esp, 0xe4
ret 4