Function at 0x988e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x48c2
mov esi, eax
call fcn.00049640
mov ecx, eax
push 0x31b
mov dword [esp + 0x1c], ecx
call fcn.00049640
mov dword [esp + 0x20], eax
test ecx, ecx
je 0x98e0a
test eax, eax
je 0x98e0a
test esi, esi
je 0x98e0a
push esi
call ecx
test al, al
je 0x98e0a
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [eax]
mov ecx, 0x23f0
cmp cx, ax
jbe 0x989ea
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp dword [ebp + 8], ebx
jbe 0x98b2c
add esi, 8
mov dword [esp + 0x14], esi
jmp 0x98960
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
mov dword [esp + 0x10], 0
test edi, edi
je 0x989cd
cmp edi, dword [esp + 0x14]
je 0x989cd
push edi
call dword [esp + 0x1c]
test al, al
je 0x989cd
cmp dword [ebp + 0x14], 0
jbe 0x989cd
cmp dword [esp + 0x10], 0x10000
ja 0x989cd
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov esi, edi
sub esi, dword [esp + 0x20]
call fcn.000988c0
test al, al
jne 0x989c3
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
call fcn.00097fe0
test al, al
je 0x98b2c
mov edi, dword [edi]
inc dword [esp + 0x10]
test edi, edi
jne 0x98972
cmp dword [ebp + 8], ebx
je 0x98b2c
add dword [esp + 0x14], 0x3c
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x98960
jmp 0x98b2c
jne 0x98a9a
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp dword [ebp + 8], ebx
jbe 0x98b2c
add esi, 8
mov dword [esp + 0x14], esi
jmp 0x98a10
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
mov dword [esp + 0x10], 0
test edi, edi
je 0x98a7d
cmp edi, dword [esp + 0x14]
je 0x98a7d
push edi
call dword [esp + 0x1c]
test al, al
je 0x98a7d
cmp dword [ebp + 0x14], 0
jbe 0x98a7d
cmp dword [esp + 0x10], 0x10000
ja 0x98a7d
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov esi, edi
sub esi, dword [esp + 0x20]
call fcn.000988c0
test al, al
jne 0x98a73
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
call fcn.00097fe0
test al, al
je 0x98b2c
mov edi, dword [edi]
inc dword [esp + 0x10]
test edi, edi
jne 0x98a22
cmp dword [ebp + 8], ebx
je 0x98b2c
add dword [esp + 0x14], 0x38
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x98a10
jmp 0x98b2c
xor ebx, ebx
mov dword [esp + 0x14], esi
cmp dword [ebp + 8], ebx
jbe 0x98b2c
add esi, 8
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx]
mov dword [esp + 0x10], 0
test edi, edi
je 0x98b19
cmp edi, dword [esp + 0x1c]
je 0x98b19
push edi
call dword [esp + 0x1c]
test al, al
je 0x98b19
cmp dword [ebp + 0x14], 0
jbe 0x98b19
cmp dword [esp + 0x10], 0x10000
ja 0x98b19
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
mov esi, edi
sub esi, dword [esp + 0x20]
call fcn.000988c0
test al, al
jne 0x98b0f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
lea edx, [ebp + 0xc]
push edx
push ebx
push esi
call fcn.00097fe0
test al, al
je 0x98b2c
mov edi, dword [edi]
inc dword [esp + 0x10]
test edi, edi
jne 0x98ac2
cmp dword [ebp + 8], ebx
je 0x98b2c
add dword [esp + 0x1c], 0x1ac
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x98ab0
mov ebx, dword [esp + 0x14]
push 0x494c
call fcn.00049640
push 0x28
mov esi, eax
call fcn.00049640
push 0x31d
mov edi, eax
call fcn.00049640
mov dword [esp + 0x14], eax
test esi, esi
je 0x98e0a
test edi, edi
je 0x98e0a
test eax, eax
je 0x98e0a
push 0x877
call fcn.00049640
push eax
push 0x2712c
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x98e0a
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
push 0x2712c
mov dword [esp + 0x38], eax
mov eax, dword [eax + edi]
push ecx
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x3c], eax
mov byte [esp + 0x38], 1
call fcn.00069190
cmp al, 1
jne 0x98df4
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x98df8
add ecx, 0x10
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov esi, dword [eax]
push esi
call dword [esp + 0x1c]
cmp al, 1
jne 0x98ddc
mov ecx, dword [esp + 0x14]
lea edx, [ecx + esi + 3]
push edx
call dword [esp + 0x1c]
cmp al, 1
jne 0x98ddc
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi]
test eax, eax
je 0x98ddc
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx ecx, word [ecx]
mov edx, 0x23f0
cmp dx, cx
jbe 0x98c5e
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jne 0x98c38
xor edi, edi
jmp 0x98db4
lea edx, [ecx + 0x3c]
cmp eax, edx
jne 0x98c49
mov edi, 1
jmp 0x98db4
add ecx, 0x78
cmp eax, ecx
jne 0x98ddc
mov edi, 2
jmp 0x98db4
jne 0x98cda
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jne 0x98c6f
xor edi, edi
jmp 0x98db4
lea edx, [ecx + 0x38]
cmp eax, edx
jne 0x98c80
mov edi, 1
jmp 0x98db4
lea edx, [ecx + 0x70]
cmp eax, edx
jne 0x98c91
mov edi, 2
jmp 0x98db4
lea edx, [ecx + 0xa8]
cmp eax, edx
jne 0x98ca5
mov edi, 3
jmp 0x98db4
lea edx, [ecx + 0xe0]
cmp eax, edx
jne 0x98cb9
mov edi, 4
jmp 0x98db4
lea edx, [ecx + 0x118]
cmp eax, edx
jne 0x98ccd
mov edi, 5
jmp 0x98db4
add ecx, 0x150
cmp eax, ecx
jmp 0x98dad
cmp eax, ebx
jne 0x98ce5
xor edi, edi
jmp 0x98db4
lea ecx, [ebx + 0x1ac]
cmp eax, ecx
jne 0x98cf9
mov edi, 1
jmp 0x98db4
lea edx, [ebx + 0x358]
cmp eax, edx
jne 0x98d0d
mov edi, 2
jmp 0x98db4
lea ecx, [ebx + 0x504]
cmp eax, ecx
jne 0x98d21
mov edi, 3
jmp 0x98db4
lea edx, [ebx + 0x6b0]
cmp eax, edx
jne 0x98d35
mov edi, 4
jmp 0x98db4
lea ecx, [ebx + 0x85c]
cmp eax, ecx
jne 0x98d46
mov edi, 5
jmp 0x98db4
lea edx, [ebx + 0xa08]
cmp eax, edx
je 0x98daf
lea ecx, [ebx + 0x1b8]
cmp eax, ecx
jne 0x98d61
mov edi, 1
jmp 0x98db4
lea edx, [ebx + 0x370]
cmp eax, edx
jne 0x98d72
mov edi, 2
jmp 0x98db4
lea ecx, [ebx + 0x528]
cmp eax, ecx
jne 0x98d83
mov edi, 3
jmp 0x98db4
lea edx, [ebx + 0x6e0]
cmp eax, edx
jne 0x98d94
mov edi, 4
jmp 0x98db4
lea ecx, [ebx + 0x898]
cmp eax, ecx
jne 0x98da5
mov edi, 5
jmp 0x98db4
lea edx, [ebx + 0xa50]
cmp eax, edx
jne 0x98ddc
mov edi, 6
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
call fcn.000988c0
test al, al
jne 0x98ddc
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
lea eax, [ebp + 0xc]
push eax
push edi
push esi
call fcn.00097fe0
test al, al
je 0x98df4
mov eax, dword [esp + 0x10]
add dword [esp + 0x20], 0x20
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x28]
jb 0x98bdf
mov ecx, dword [esp + 0x1c]
push 0x877
call fcn.00049640
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10