Function at 0x100403bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d8664
call fcn.100d39f0
mov eax, 0x1310
call fcn.100d3d60
push ebx
push esi
mov ebx, ecx
mov esi, 0x200
push edi
push esi
mov ecx, dword [ebx + 0x28]
lea edx, [ebp - 0x31c]
call fcn.1006dc5d
test eax, eax
jne 0x1004084f
push 8
lea eax, [ebp - 0x31c]
pop edi
push edi
push str.vhdxfilefw
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1004084c
mov ax, word [ebp + edi - 0x31c]
cmp ax, 0x20
jb 0x10040436
cmp ax, 0x7f
ja 0x10040436
push eax
lea ecx, [ebx + 0x11c]
call fcn.100027bc
inc edi
inc edi
cmp edi, esi
jb 0x10040410
mov esi, 0x10000
mov dword [ebx + 0xf0], 0x100000
and dword [ebx + 0xf4], 0
lea edi, [ebp - 0xac]
mov dword [ebp - 0x10], esi
push 0
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.1003fee8
test eax, eax
jne 0x1004084f
mov ecx, dword [ebx + 0x28]
push 0x1000
lea edx, [ebp - 0x131c]
call fcn.1006dc5d
test eax, eax
jne 0x1004084f
lea eax, [ebp - 0x131c]
mov ecx, edi
push eax
call fcn.1006dc5d
test al, al
je 0x1004084c
add dword [ebp - 0x10], esi
add edi, 0x48
cmp dword [ebp - 0x10], 0x30000
jb 0x10040455
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x64]
cmp ecx, dword [ebp - 0x60]
jb 0x100404c5
ja 0x100404c1
cmp dword [ebp - 0xac], eax
jbe 0x100404c5
xor eax, eax
jmp 0x100404df
cmp ecx, dword [ebp - 0x60]
ja 0x1004084c
jb 0x100404dc
cmp dword [ebp - 0xac], eax
jae 0x1004084c
push 1
pop eax
lea eax, [eax + eax*8]
push 0x12
lea edi, [ebx + 0xa0]
pop ecx
lea eax, [ebp + eax*8 - 0xac]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10040551
add dword [ebx + 0xf0], ecx
adc dword [ebx + 0xf4], 0
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0x10]
xor esi, esi
add edx, ecx
mov ecx, dword [eax + 0x14]
adc ecx, esi
mov esi, dword [ebx + 0x3c]
cmp esi, ecx
ja 0x1004052f
jb 0x10040529
mov esi, dword [ebx + 0x38]
cmp esi, edx
jae 0x1004052f
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], ecx
push 0x10
lea ecx, [eax + 0x38]
pop edx
call fcn.1003fe76
test al, al
jne 0x10040551
push str.non_empty_LOG_was_not_replayed
mov ecx, ebx
mov byte [ebx + 0x128], 1
call fcn.10040c10
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov esi, 0x20000
lea ecx, [ebp - 0x18]
push esi
mov dword [ebp - 4], eax
call fcn.1000446d
push 0
push 0x30000
mov ecx, ebx
call fcn.1003fee8
test eax, eax
je 0x10040586
mov esi, eax
jmp 0x10040610
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebp - 0x18]
push esi
call fcn.1006dc5d
test eax, eax
jne 0x1004057f
mov eax, dword [ebp - 0x18]
push 0x10000
mov dword [ebp - 0x1c], 1
lea ecx, [eax + 0x10000]
push ecx
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x100405cc
push str.Region_tables_mismatch
mov ecx, ebx
call fcn.10040c10
mov dword [ebp - 0x1c], 2
xor esi, esi
cmp dword [ebp - 0x1c], esi
jbe 0x1004060d
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.1006dc5d
test al, al
je 0x100405f3
test edi, edi
jge 0x100405ff
mov edi, esi
jmp 0x100405ff
push str.Incorrect_region_table
mov ecx, ebx
call fcn.10040c10
add dword [ebp - 0x10], 0x38
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x100405dc
test edi, edi
jge 0x10040618
push 1
pop esi
push dword [ebp - 0x18]
jmp 0x100406ed
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.10003419
cmp dword [ebx + 0x3c], 0
pop ecx
ja 0x10040641
jb 0x10040636
cmp dword [ebx + 0x38], 0x100000
jae 0x10040641
mov dword [ebx + 0x38], 0x100000
and dword [ebx + 0x3c], 0
imul edi, edi, 0x38
mov eax, dword [ebp + edi - 0x10c]
mov ecx, dword [ebp + edi - 0x108]
add dword [ebx + 0xf0], eax
lea esi, [ebp + edi - 0x11c]
mov edx, dword [ebx + 0x3c]
adc dword [ebx + 0xf4], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
cmp edx, eax
ja 0x10040681
jb 0x1004067b
mov edx, dword [ebx + 0x38]
cmp edx, ecx
jae 0x10040681
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], eax
cmp byte [esi + 1], 0
je 0x1004084c
cmp dword [esi + 0x30], 0
je 0x1004084c
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
push dword [esi + 0x2c]
mov ecx, ebx
mov dword [ebp - 4], 1
push dword [esi + 0x28]
call fcn.1003fee8
test eax, eax
je 0x100406b9
mov esi, eax
jmp 0x100406ea
mov edi, dword [esi + 0x30]
lea ecx, [ebp - 0x18]
push edi
call fcn.1000446d
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebp - 0x18]
push edi
call fcn.1006dc5d
test eax, eax
jne 0x100406b5
push dword [ebp - 0x14]
lea ecx, [ebx + 0x60]
push dword [ebp - 0x18]
call fcn.1003faf1
test al, al
jne 0x100406fa
push 1
pop esi
push dword [ebp - 0x18]
call fcn.10003419
pop ecx
mov eax, esi
jmp 0x1004084f
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.10003419
cmp byte [esi], 0
pop ecx
je 0x1004084c
cmp dword [esi + 0x20], 0
je 0x1004084c
push dword [esi + 0x1c]
mov ecx, ebx
push dword [esi + 0x18]
call fcn.1003fee8
test eax, eax
jne 0x1004084f
mov edi, dword [esi + 0x20]
lea esi, [ebx + 0x40]
push edi
mov ecx, esi
call fcn.1000446d
mov edx, dword [esi]
mov ecx, dword [ebx + 0x28]
push edi
call fcn.1006dc5d
test eax, eax
jne 0x1004084f
mov ecx, ebx
call fcn.1006dc5d
test al, al
je 0x1004084c
mov ecx, ebx
call fcn.1004024f
test al, al
jne 0x10040776
push str.BAT_overlap
mov ecx, ebx
call fcn.10040c10
xor edi, edi
cmp dword [ebx + 0x94], edi
jbe 0x100407b9
mov eax, dword [ebx + 0x90]
mov edx, str.parent_linkage
mov esi, dword [eax + edi*4]
mov ecx, dword [esi]
call fcn.10001977
test al, al
jne 0x100407a4
inc edi
cmp edi, dword [ebx + 0x94]
jb 0x10040780
jmp 0x100407b9
add esi, 0xc
lea ecx, [ebx + 0x12a]
push esi
call fcn.1006dc5d
mov byte [ebx + 0x13a], al
mov esi, 0x100e60d0
push dword [esi]
lea ecx, [ebx + 0x60]
call fcn.1004094e
test eax, eax
jl 0x100407e4
mov ecx, dword [ebx + 0x90]
mov eax, dword [ecx + eax*4]
lea ecx, [ebx + 0x13c]
add eax, 0xc
push eax
call fcn.10004577
add esi, 4
cmp esi, 0x100e60dc
jb 0x100407be
mov eax, dword [ebx + 0x70]
shr eax, 1
test al, 1
je 0x1004082a
cmp byte [ebx + 0x62], 0
jne 0x10040805
push str.Parent_locator_is_not_defined
jmp 0x10040835
cmp byte [ebx + 0x13a], 0
jne 0x1004081a
push str.Parent_GUID_is_not_defined
mov ecx, ebx
call fcn.10040c10
cmp dword [ebx + 0x140], 0
jne 0x1004083c
push str.Parent_VHDX_file_name_is_not_defined
jmp 0x10040835
cmp byte [ebx + 0x62], 0
je 0x1004083c
push str.Unexpected_parent_locator
mov ecx, ebx
call fcn.10040c10
mov eax, dword [ebx + 0x78]
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x24], eax
xor eax, eax
jmp 0x1004084f
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret