Function at 0x8d490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x877
mov byte [ebp - 1], 0
call fcn.00049640
push eax
push 0x400
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, eax
test ecx, ecx
je 0x8da2b
mov eax, 0x6d6574
mov dword [ecx + 0x34], eax
mov dword [ecx + 0xa4], eax
mov eax, 0x20202020
mov edx, 0x61726570
mov ebx, 0x676e6974
mov esi, 0x73797320
mov dword [ecx + 0xfc], eax
mov dword [ecx + 0x100], eax
mov dword [ecx + 0x118], eax
mov dword [ecx + 0x11c], eax
mov dword [ecx + 0x120], eax
mov dword [ecx + 0x134], eax
mov dword [ecx + 0x138], eax
xor eax, eax
mov dword [ecx], 0x766e49c3
mov dword [ecx + 4], 0x64696c61
mov dword [ecx + 8], 0x72617020
mov dword [ecx + 0xc], 0x69746974
mov dword [ecx + 0x10], 0x74206e6f
mov dword [ecx + 0x14], 0x656c6261
mov dword [ecx + 0x18], 0x72724500
mov dword [ecx + 0x1c], 0x6c20726f
mov dword [ecx + 0x20], 0x6964616f
mov dword [ecx + 0x24], 0x6f20676e
mov dword [ecx + 0x28], edx
mov dword [ecx + 0x2c], ebx
mov dword [ecx + 0x30], esi
mov dword [ecx + 0x38], 0x7373694d
mov dword [ecx + 0x3c], 0x20676e69
mov dword [ecx + 0x40], 0x7265706f
mov dword [ecx + 0x44], 0x6e697461
mov dword [ecx + 0x48], 0x79732067
mov dword [ecx + 0x4c], 0x6d657473
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x78], 0x61766e49
mov dword [ecx + 0x7c], 0x2064696c
mov dword [ecx + 0x80], 0x74726170
mov dword [ecx + 0x84], 0x6f697469
mov dword [ecx + 0x88], 0x6174206e
mov dword [ecx + 0x8c], 0x4d656c62
mov dword [ecx + 0x90], 0x69737369
mov dword [ecx + 0x94], 0x6f20676e
mov dword [ecx + 0x98], edx
mov dword [ecx + 0x9c], ebx
mov dword [ecx + 0xa0], esi
mov dword [ecx + 0xa8], 0x7473614d
mov dword [ecx + 0xac], 0x42207265
mov dword [ecx + 0xb0], 0x20746f6f
mov dword [ecx + 0xb4], 0x6f636552
mov dword [ecx + 0xb8], 0x57206472
mov dword [ecx + 0xbc], 0x65746f72
mov dword [ecx + 0xc0], 0x20796220
mov dword [ecx + 0xc4], 0x2052424d
mov dword [ecx + 0xc8], 0x44207942
mov dword [ecx + 0xcc], 0x476b7369
mov dword [ecx + 0xd0], 0x75696e65
mov dword [ecx + 0xd4], 0x73
mov dword [ecx + 0xf0], 0xb5a7d0de
mov dword [ecx + 0xf4], 0xc7d6b7c4
mov dword [ecx + 0xf8], 0x20edb1f8
mov dword [ecx + 0x104], 0xb4002020
mov dword [ecx + 0x108], 0xd7f3ceed
mov dword [ecx + 0x10c], 0xb2d8d4b0
mov dword [ecx + 0x110], 0xcff7d7d9
mov dword [ecx + 0x114], 0x20b3cdb5
mov dword [ecx + 0x124], 0xb1c80020
mov dword [ecx + 0x128], 0xd9b2d9c9
mov dword [ecx + 0x12c], 0xb5cff7d7
mov dword [ecx + 0x130], 0x2020b3cd
mov dword [ecx + 0x13c], 0x2020
mov dword [ecx + 0x140], eax
mov dword [ecx + 0x144], eax
mov dword [ecx + 0x148], eax
mov dword [ecx + 0x14c], eax
mov dword [ecx + 0x168], 0x6c70654e
mov dword [ecx + 0x16c], 0xa06e7461
mov dword [ecx + 0x170], 0x62617420
mov dword [ecx + 0x174], 0x616b6c75
mov dword [ecx + 0x178], 0x64646f20
mov dword [ecx + 0x17c], 0x856ca1
cmp dword [ebp + 0xc], 0x1b0
mov dword [ecx + 0x180], 0x62796843
mov dword [ecx + 0x184], 0xfd702061
mov dword [ecx + 0x188], 0x616e2069
mov dword [ecx + 0x18c], 0xa074a19f
mov dword [ecx + 0x190], 0x6f20a16e
mov dword [ecx + 0x194], edx
mov dword [ecx + 0x198], 0x68a16e9f
mov dword [ecx + 0x19c], 0x7973206f
mov dword [ecx + 0x1a0], 0x6d827473
mov dword [ecx + 0x1a4], 0x704f0075
mov dword [ecx + 0x1a8], 0x9f617265
mov dword [ecx + 0x1ac], 0x7320a16e
mov dword [ecx + 0x1b0], 0x82747379
mov dword [ecx + 0x1b4], 0x656e206d
mov dword [ecx + 0x1b8], 0x656c616e
mov dword [ecx + 0x1bc], 0x6e657a
jbe 0x8da23
mov esi, 0xa0
lea eax, [edi + 0xa1]
xor edx, edx
movsx edi, byte [eax + edx - 1]
movsx ebx, byte [ecx + edx + 1]
sub ebx, edi
jne 0x8d907
movsx edi, byte [eax + edx]
movsx ebx, byte [edx + ecx + 2]
sub ebx, edi
jne 0x8d907
movsx edi, byte [eax + edx + 1]
movsx ebx, byte [edx + ecx + 3]
sub ebx, edi
jne 0x8d907
movsx edi, byte [eax + edx + 2]
movsx ebx, byte [ecx + edx + 4]
sub ebx, edi
jne 0x8d907
movsx edi, byte [eax + edx + 3]
movsx ebx, byte [edx + ecx + 5]
sub ebx, edi
jne 0x8d907
add edx, 5
cmp edx, 0x50
jb 0x8d7f2
cmp esi, 0x170
jb 0x8d85f
mov byte [ebp - 1], 1
mov edi, dword [ebp + 8]
push 0x877
call fcn.00049640
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [ebp - 1], 0
jne 0x8dbdf
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x30
jbe 0x8dab6
xor esi, esi
mov al, 0xbc
mov edi, edi
cmp byte [esi + edi], al
jne 0x8d8a7
cmp byte [esi + edi + 1], 0
jne 0x8d8a7
cmp byte [esi + edi + 2], 0x7c
je 0x8da3e
cmp byte [esi + edi + 1], al
jne 0x8d8bf
cmp byte [esi + edi + 2], 0
jne 0x8d8bf
cmp byte [esi + edi + 3], 0x7c
je 0x8da33
cmp byte [esi + edi + 2], al
jne 0x8d8d7
cmp byte [esi + edi + 3], 0
jne 0x8d8d7
cmp byte [esi + edi + 4], 0x7c
je 0x8da36
cmp byte [esi + edi + 3], al
jne 0x8d8ef
cmp byte [esi + edi + 4], 0
jne 0x8d8ef
cmp byte [esi + edi + 5], 0x7c
je 0x8da3b
add esi, 4
cmp esi, 0x20
jb 0x8d890
pop edi
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edx, edx
lea esp, [esp]
movsx edi, byte [eax + edx - 1]
movsx ebx, byte [ecx + edx + 0x78]
sub edi, ebx
jne 0x8d938
movsx edi, byte [eax + edx]
movsx ebx, byte [edx + ecx + 0x79]
sub edi, ebx
jne 0x8d938
add edx, 2
cmp edx, 0x5e
jb 0x8d910
jmp 0x8d853
xor edx, edx
lea ebx, [ebx]
movsx edi, byte [eax + edx - 1]
movsx ebx, byte [ecx + edx + 0xf0]
sub edi, ebx
jne 0x8d9b2
movsx edi, byte [eax + edx]
movsx ebx, byte [edx + ecx + 0xf1]
sub edi, ebx
jne 0x8d9b2
movsx edi, byte [eax + edx + 1]
movsx ebx, byte [edx + ecx + 0xf2]
sub edi, ebx
jne 0x8d9b2
movsx edi, byte [eax + edx + 2]
movsx ebx, byte [edx + ecx + 0xf3]
sub edi, ebx
jne 0x8d9b2
movsx edi, byte [eax + edx + 3]
movsx ebx, byte [ecx + edx + 0xf4]
sub edi, ebx
jne 0x8d9b2
movsx edi, byte [eax + edx + 4]
movsx ebx, byte [edx + ecx + 0xf5]
sub edi, ebx
jne 0x8d9b2
add edx, 6
cmp edx, 0x60
jb 0x8d940
jmp 0x8d853
xor edx, edx
jmp 0x8d9c0
movsx edi, byte [eax + edx - 1]
movsx ebx, byte [ecx + edx + 0x168]
sub edi, ebx
jne 0x8da10
movsx edi, byte [eax + edx]
movsx ebx, byte [edx + ecx + 0x169]
sub edi, ebx
jne 0x8da10
movsx edi, byte [eax + edx + 1]
movsx ebx, byte [edx + ecx + 0x16a]
sub edi, ebx
jne 0x8da10
movsx edi, byte [eax + edx + 2]
movsx ebx, byte [edx + ecx + 0x16b]
sub edi, ebx
jne 0x8da10
add edx, 4
cmp edx, 0x58
jb 0x8d9c0
jmp 0x8d853
inc esi
inc eax
cmp esi, 0x170
jb 0x8d7f0
jmp 0x8d85b
mov esi, dword [ebp + 8]
jmp 0x8d862
mov esi, dword [ebp + 8]
jmp 0x8d881
inc esi
jmp 0x8da3e
add esi, 2
jmp 0x8da3e
add esi, 3
cmp esi, 0x20
jae 0x8dbdb
cmp byte [edi + esi], 0xbf
jne 0x8da54
cmp byte [edi + esi + 2], 6
je 0x8da6a
inc esi
cmp esi, 0x20
jb 0x8da47
pop edi
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x20
jae 0x8dbdb
cmp esi, 0x2a
jae 0x8dbdb
mov cl, 0xbe
mov al, 7
mov dl, byte [edi + esi]
and dl, 0xf0
cmp dl, 0xb0
jne 0x8da97
cmp byte [edi + esi + 1], cl
jne 0x8da97
cmp byte [edi + esi + 2], al
je 0x8daad
inc esi
cmp esi, 0x2a
jb 0x8da80
pop edi
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x2a
jae 0x8dbdb
cmp ebx, 0x100
jbe 0x8db02
cmp esi, 0x160
jae 0x8dbdb
lea ebx, [ebx]
cmp byte [esi + edi], 0xcd
jne 0x8dadd
cmp byte [esi + edi + 1], 0x10
je 0x8daf6
inc esi
cmp esi, 0x160
jb 0x8dad0
pop edi
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x160
jae 0x8dbdb
cmp ebx, 0x120
jbe 0x8dbdf
xor edx, edx
mov bl, 0x13
mov al, byte [edx + edi]
lea ecx, [edx + edi]
cmp al, 0xbb
jne 0x8db2a
cmp byte [edx + edi + 1], 0
jne 0x8db2a
cmp byte [edx + edi + 2], 0x7c
je 0x8db35
cmp al, 0x8b
jne 0x8db59
cmp byte [edx + edi + 1], 0xdc
jne 0x8db59
mov eax, 3
lea ebx, [ebx]
cmp byte [ecx + eax], 0xcd
jne 0x8db4c
cmp byte [ecx + eax + 1], bl
je 0x8db54
inc eax
cmp eax, 0x10
jb 0x8db40
jmp 0x8db59
cmp eax, 0x10
jb 0x8db72
inc edx
cmp edx, 0x110
jb 0x8db12
pop edi
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp edx, 0x110
jae 0x8dbdb
xor edx, edx
lea ecx, [edi + 1]
mov bl, 0xaa
cmp byte [ecx - 1], 0xfe
jne 0x8dbb9
cmp byte [ecx], 0x7d
jne 0x8dbb9
mov eax, 2
cmp byte [ecx + eax - 1], 0x55
jne 0x8db9d
cmp byte [ecx + eax], bl
je 0x8dbb4
cmp byte [ecx + eax], 0x55
jne 0x8dba9
cmp byte [ecx + eax + 1], bl
je 0x8dbb3
add eax, 2
cmp eax, 0x10
jb 0x8db91
jmp 0x8dbb9
inc eax
cmp eax, 0x10
jb 0x8dbd3
inc edx
inc ecx
cmp edx, 0x110
jb 0x8db81
pop edi
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp edx, 0x110
jb 0x8dbdf
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8