Function at 0x7d221ae1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x7d23bd50
sub esp, 0x48
push ebx
push ebp
push esi
push edi
push 0
call fcn.7d2216ef
cmp dword [0x7d2ddaac], 0
mov ebp, eax
mov edi, dword [esp + 0x64]
setne byte [esp + 0x24]
mov dword [esp + 0x1c], ebp
xor eax, eax
mov word [esp + 0x34], ax
mov dword [edi], eax
mov eax, dword [esp + 0x68]
mov dword [eax], 0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x7d23bd95
mov dword [eax], 0
xor eax, eax
cmp dword [esp + 0x60], 0xffffffff
cmovne eax, dword [esp + 0x60]
test eax, eax
je 0x7d23bdb0
movzx ebx, word [eax]
mov esi, dword [eax + 4]
and ebx, 0xfffffffe
jmp 0x7d23bdb4
xor ebx, ebx
xor esi, esi
cmp dword [esp + 0x5c], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0
mov byte [esp + 0x17], 0
je 0x7d23bfe8
lea eax, [ebx + 0x100]
mov dword [esp + 0x18], 0x100
push eax
push 0
push ebp
call fcn.7d221e1f
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x64]
call fcn.7d2214e7
mov ebx, eax
cmp ebx, 0xc0000039
jne 0x7d23be30
cmp dword [esp + 0x20], 0
jne 0x7d23be70
push dword [esp + 0x5c]
call fcn.7d221aaa
cmp eax, 2
jne 0x7d23be70
xor eax, eax
mov dword [esi], eax
mov dword [edi], esi
pop edi
pop esi
pop ebp
mov eax, 0xc000000a
pop ebx
add esp, 0x48
ret 0x14
cmp ebx, 0x80000005
je 0x7d23be48
cmp ebx, 0xc0000023
je 0x7d23be48
cmp ebx, 0xc0000004
jne 0x7d23be6c
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x20]
push eax
push 0
push ebp
call fcn.7d221e1f
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x64]
call fcn.7d2214e7
mov ebx, eax
test ebx, ebx
jns 0x7d23be7c
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x48
ret 0x14
lea ebp, [esi + 4]
mov eax, esi
mov dword [esp + 0x64], ebp
mov ebp, dword [ebp]
mov dword [esp + 0x30], eax
test ebp, ebp
je 0x7d23bf82
cmp byte [esp + 0x24], 0
je 0x7d23bf82
movzx eax, word [eax]
mov esi, ebp
mov ecx, dword [0x7d2ddaac]
and eax, 0xfffffffe
xor edx, edx
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x18], eax
mov word [esi + eax*2], dx
cmp dword [esp + 0x18], ebx
jb 0x7d23bee8
push ebx
lea eax, [ecx + 0x1c]
push eax
push esi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23bee8
movzx eax, word [esi + ebx*2]
cmp eax, 0x5c
je 0x7d23bf7d
test ax, ax
je 0x7d23bf7d
push esi
call fcn.7d239f20
test eax, eax
je 0x7d23bf82
mov edx, dword [esp + 0x18]
lea esi, [eax*2]
sub edx, eax
add esi, ebp
mov dword [esp + 0x18], edx
cmp edx, 0xa
jb 0x7d23bf4d
push 9
push dword [0x7d2b6278]
lea eax, [esi + 2]
push eax
call fcn.7d221b09
test eax, eax
jne 0x7d23bf49
lea eax, [esi + 0x14]
push 0x5c
push eax
call sub.ntdll.dll_wcschr
add esp, 8
test eax, eax
je 0x7d23bf49
mov edx, dword [esp + 0x18]
mov ecx, eax
sub ecx, esi
mov esi, eax
sar ecx, 1
sub edx, ecx
mov dword [esp + 0x18], edx
jmp 0x7d23bf4d
mov edx, dword [esp + 0x18]
mov eax, dword [0x7d2ddaa0]
cmp edx, eax
jb 0x7d23bf82
push eax
push dword [0x7d2dda9c]
push esi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23bf82
mov eax, dword [0x7d2ddaa0]
movzx eax, word [esi + eax*2]
cmp eax, 0x5c
je 0x7d23bf7d
test ax, ax
jne 0x7d23bf82
mov byte [esp + 0x24], 0
mov edx, dword [esp + 0x64]
mov eax, dword [edx]
test eax, eax
je 0x7d23bf9e
mov dword [edi], eax
mov eax, dword [esp + 0x30]
movzx ecx, word [eax]
mov eax, dword [edx]
shr ecx, 1
lea esi, [eax + ecx*2]
jmp 0x7d23bfa0
mov dword [edi], esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x7d23bfcf
mov eax, dword [esp + 0x28]
cmp word [eax], 0x3a
je 0x7d23bfbd
mov ecx, 0x5c
mov word [esi], cx
add esi, 2
push ebx
push eax
push esi
call sub.ntdll.dll_memcpy
mov eax, ebx
add esp, 0xc
shr eax, 1
lea esi, [esi + eax*2]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
xor eax, eax
push edi
push ebp
mov word [esi], ax
call fcn.7d23d0f0
jmp 0x7d23c14d
test ebx, ebx
je 0x7d23ccf3
cmp ebx, 0xc
jb 0x7d23c0a7
cmp word [esi], 0x5c
jne 0x7d23c0a7
cmp word [esi + 2], 0x3f
jne 0x7d23c0a7
cmp word [esi + 4], 0x3f
jne 0x7d23c0a7
cmp word [esi + 6], 0x5c
jne 0x7d23c0a7
cmp word [esi + 0xa], 0x3a
jne 0x7d23c0a7
movzx eax, word [esi + 8]
push eax
call fcn.7d23a660
mov ebp, eax
mov dword [esp + 0x2c], ebp
test ebp, ebp
jne 0x7d23c04e
pop edi
pop esi
pop ebp
mov eax, 0xc000003a
pop ebx
add esp, 0x48
ret 0x14
mov eax, dword [ebp + 0x18]
sub ebx, 0xc
inc eax
mov dword [esp + 0x20], ebx
add esi, 0xc
mov dword [esp + 0x28], esi
lea eax, [ebx + eax*2]
push eax
push 0
push dword [esp + 0x24]
call fcn.7d221e1f
mov esi, eax
mov dword [edi], esi
mov ecx, dword [ebp + 0x18]
add ecx, ecx
push ecx
lea ecx, [ebp + 0x1c]
push ecx
push esi
call sub.ntdll.dll_memcpy
mov eax, dword [ebp + 0x18]
push ebx
push dword [esp + 0x38]
lea esi, [esi + eax*2]
push esi
call sub.ntdll.dll_memcpy
mov ebp, dword [esp + 0x34]
mov eax, ebx
shr eax, 1
add esp, 0x18
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x7d23c0e3
shr ebx, 1
push ebx
push esi
call fcn.7d23a6e0
mov dword [esp + 0x2c], eax
test eax, eax
je 0x7d23c0fc
mov eax, dword [esp + 0x20]
add eax, 2
push eax
push 0
push ebp
call fcn.7d221e1f
push dword [esp + 0x20]
mov esi, eax
push dword [esp + 0x2c]
mov dword [edi], esi
push esi
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [esi + ebx*2], ax
push dword [esp + 0x24]
push edi
push ebp
call fcn.7d23d0f0
push dword [0x7d2ddad8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x7d23c14d
lea eax, [esp + 0x64]
mov byte [esp + 0x64], 0
push eax
push dword [esp + 0x24]
push esi
push ebp
call fcn.7d23dc50
mov dword [edi], eax
test eax, eax
je 0x7d23ccf3
push dword [esp + 0x24]
push edi
push ebp
call fcn.7d23d0f0
or byte [esp + 0x64], al
jne 0x7d23c14d
push 0xc
push dword [0x7d2b6258]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x7d23c14d
cmp byte [esp + 0x64], 0
je 0x7d23be21
mov esi, dword [edi]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c154
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x18], ecx
movzx eax, word [esi]
test ax, ax
je 0x7d23c1b1
nop
cmp ax, 0x5c
jne 0x7d23c1a4
cmp word [esi + 2], ax
lea edx, [esi + 2]
jne 0x7d23c1a4
mov eax, esi
sub eax, dword [edi]
sar eax, 1
sub ecx, eax
lea eax, [ecx*2 + 2]
push eax
push edx
push esi
call sub.ntdll.dll_memmove
mov ecx, dword [esp + 0x24]
add esp, 0xc
dec ecx
mov dword [esp + 0x18], ecx
jmp 0x7d23c1a7
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x7d23c170
mov esi, dword [edi]
test ecx, ecx
je 0x7d23c1de
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x7d23c1de
dec ecx
mov byte [esp + 0x15], 1
xor eax, eax
mov dword [esp + 0x18], ecx
mov word [esi + ecx*2], ax
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x18]
test eax, eax
je 0x7d23c1e3
or dword [eax], 2
jmp 0x7d23c1e3
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
cmp ecx, 8
jb 0x7d23ccf3
push 8
push dword [0x7d2b6258]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23ccf3
cmp dword [esp + 0x2c], eax
jne 0x7d23c221
push eax
push dword [edi]
call fcn.7d241da0
test eax, eax
jne 0x7d23be21
push 0x7e
push dword [edi]
call sub.ntdll.dll_wcschr
add esp, 8
test eax, eax
je 0x7d23c25a
push dword [edi]
mov byte [esp + 0x18], 1
push ebp
call fcn.7d23d550
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x7d23c243
sub edx, esi
mov dword [edi], eax
sar edx, 1
mov dword [esp + 0x18], edx
jmp 0x7d23c25f
mov byte [esp + 0x14], 0
mov ebp, dword [edi]
xor al, al
xor bl, bl
mov byte [esp + 0x64], bl
mov byte [esp + 0x13], al
nop dword [eax]
mov eax, dword [0x7d2b7330]
cmp dword [esp + 0x18], eax
jb 0x7d23c2b8
push eax
push dword [0x7d2b7324]
push dword [edi]
call fcn.7d221b09
test eax, eax
jne 0x7d23c2b8
mov eax, dword [0x7d2b7330]
add eax, eax
add dword [edi], eax
mov eax, dword [0x7d2b7330]
sub dword [esp + 0x18], eax
je 0x7d23c736
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x7d23c2b0
or dword [esi], 1
mov bl, 1
mov byte [esp + 0x64], bl
jmp 0x7d23c2bc
mov esi, dword [esp + 0x6c]
mov ecx, dword [0x7d2ddad0]
test ecx, ecx
je 0x7d23c301
mov eax, dword [0x7d2ddad4]
cmp dword [esp + 0x18], eax
jb 0x7d23c301
push eax
push ecx
push dword [edi]
call fcn.7d221b09
test eax, eax
jne 0x7d23c301
mov ecx, dword [0x7d2ddad4]
lea eax, [ecx + ecx]
add dword [edi], eax
sub dword [esp + 0x18], ecx
je 0x7d23c736
test esi, esi
je 0x7d23c2fa
or dword [esi], 1
mov byte [esp + 0x64], 1
jmp 0x7d23c305
test bl, bl
je 0x7d23c37b
cmp dword [esp + 0x18], 0xa
jb 0x7d23c37b
mov eax, dword [edi]
push 9
push dword [0x7d2b6278]
add eax, 2
push eax
call fcn.7d221b09
test eax, eax
jne 0x7d23c37b
mov eax, dword [edi]
add eax, 0x14
push 0x5c
push eax
call sub.ntdll.dll_wcschr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x7d23c736
cmp dword [esp + 0x60], 0xffffffff
jne 0x7d23c36f
mov eax, dword [edi]
mov esi, ebx
sub esi, eax
sub esi, 0x14
sar esi, 1
cmp esi, 0x11
jae 0x7d23c36f
add esi, esi
add eax, 0x14
push esi
push eax
lea eax, [esp + 0x3c]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [esp + esi + 0x34], ax
mov eax, ebx
sub eax, dword [edi]
sar eax, 1
sub dword [esp + 0x18], eax
mov dword [edi], ebx
cmp dword [esp + 0x18], 6
jb 0x7d23c416
push 6
push dword [0x7d2b62b0]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c416
mov eax, dword [edi]
cmp word [eax + 0xc], 0x5c
jne 0x7d23c736
movzx eax, word [eax + 0xe]
push eax
call fcn.7d23a660
mov ebx, eax
test ebx, ebx
je 0x7d23c736
cmp byte [0x7d2dda55], 0
mov esi, 8
je 0x7d23c3e5
mov ecx, dword [edi]
add ecx, 0x10
push 0x5c
push ecx
call sub.ntdll.dll_wcschr
add esp, 8
test eax, eax
je 0x7d23c3e5
mov esi, eax
sub esi, dword [edi]
sar esi, 1
push dword [ebx + 0x18]
lea eax, [ebx + 0x1c]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0x30]
call fcn.7d23d7b0
push dword [0x7d2ddad8]
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov bl, byte [esp + 0x64]
jmp 0x7d23c270
cmp dword [esp + 0x18], 5
jb 0x7d23c527
push 5
push dword [0x7d2b62b4]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c527
cmp dword [0x7d2ddabc], eax
je 0x7d23c486
mov ecx, dword [esp + 0x18]
cmp ecx, 9
jb 0x7d23c48a
push 9
push dword [0x7d2b62b8]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c486
push dword [0x7d2ddabc]
lea eax, [esp + 0x1c]
push dword [0x7d2ddab8]
push 9
push eax
push edi
push dword [esp + 0x30]
call fcn.7d23d7b0
mov bl, 1
jmp 0x7d23c56c
mov ecx, dword [esp + 0x18]
cmp dword [0x7d2ddac4], 0
je 0x7d23c4d6
cmp ecx, 0xd
jb 0x7d23c4d6
push 0xd
push dword [0x7d2b62bc]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c4d2
push dword [0x7d2ddac4]
lea eax, [esp + 0x1c]
push dword [0x7d2ddac0]
push 0xd
push eax
push edi
push dword [esp + 0x30]
call fcn.7d23d7b0
mov bl, 1
jmp 0x7d23c56c
mov ecx, dword [esp + 0x18]
cmp dword [0x7d2ddacc], 0
je 0x7d23c74b
cmp ecx, 0xc
jb 0x7d23c74b
push 0xc
push dword [0x7d2b62c0]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c747
push dword [0x7d2ddacc]
lea eax, [esp + 0x1c]
push dword [0x7d2ddac8]
push 0xc
push eax
push edi
push dword [esp + 0x30]
call fcn.7d23d7b0
mov bl, 1
jmp 0x7d23c56c
cmp dword [esp + 0x18], 7
jb 0x7d23c568
push 7
push dword [0x7d2b62ac]
push dword [edi]
call sub.ntdll.dll__wcsnicmp
mov ebp, dword [esp + 0x28]
add esp, 0xc
test eax, eax
jne 0x7d23c562
push 0xc
push dword [0x7d2b6258]
lea eax, [esp + 0x20]
push 7
push eax
push edi
push ebp
call fcn.7d23d7b0
mov bl, 1
jmp 0x7d23c570
mov bl, byte [esp + 0x13]
jmp 0x7d23c570
mov bl, byte [esp + 0x13]
mov ebp, dword [esp + 0x1c]
cmp byte [esp + 0x14], 0
je 0x7d23c599
push dword [edi]
push ebp
call fcn.7d23d550
mov ecx, eax
mov dword [edi], ecx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c586
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x18], ecx
test bl, bl
je 0x7d23c5c5
push dword [esp + 0x24]
push edi
push ebp
call fcn.7d23d0f0
mov esi, dword [edi]
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c5b0
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x18], ecx
jmp 0x7d23c5c7
mov esi, dword [edi]
cmp byte [esp + 0x24], 0
je 0x7d23c670
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c5d7
mov eax, dword [0x7d2ddaa8]
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x18], ecx
cmp ecx, eax
jb 0x7d23c670
push eax
push dword [0x7d2ddaa4]
push esi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c670
mov eax, dword [0x7d2ddaa8]
movzx eax, word [esi + eax*2]
cmp eax, 0x5c
je 0x7d23c61e
test ax, ax
jne 0x7d23c670
lea eax, [esp + 0x2c]
push eax
call dword [0x7d2ddab0]
push dword [esp + 0x2c]
call dword [0x7d2ddab4]
cmp dword [esp + 0x2c], 1
je 0x7d23c670
mov eax, dword [edi]
mov dword [esp + 0x30], eax
mov eax, dword [0x7d2ddaac]
mov dword [esp + 0x2c], 0
push dword [eax + 0x10]
add eax, 0x1c
push eax
push dword [0x7d2ddaa8]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x40]
push eax
push ebp
call fcn.7d23d7b0
mov eax, dword [esp + 0x30]
mov dword [edi], eax
push 1
push dword [edi]
call fcn.7d24c200
mov ebx, eax
test ebx, ebx
je 0x7d23c7e4
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c690
mov eax, dword [0x7d2b7330]
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x18], ecx
cmp ecx, eax
jb 0x7d23c6c4
push eax
push dword [0x7d2b7324]
push ebx
call fcn.7d221b09
test eax, eax
jne 0x7d23c6c4
mov byte [esp + 0x64], 1
jmp 0x7d23c6f7
mov ecx, dword [0x7d2ddad0]
test ecx, ecx
je 0x7d23c6ec
mov eax, dword [0x7d2ddad4]
cmp dword [esp + 0x18], eax
jb 0x7d23c6ec
push eax
push ecx
push ebx
call fcn.7d221b09
test eax, eax
jne 0x7d23c6ec
mov byte [esp + 0x64], 1
jmp 0x7d23c6f7
cmp byte [esp + 0x64], 0
je 0x7d23c7ac
mov eax, dword [esp + 0x18]
lea eax, [eax*2 + 2]
push eax
push 0
push ebp
call fcn.7d221e1f
mov ecx, dword [esp + 0x18]
mov ebp, eax
lea ecx, [ecx*2 + 2]
push ecx
push ebx
push ebp
call sub.ntdll.dll_memcpy
add esp, 0xc
push ebx
call fcn.7d221537
mov bl, byte [esp + 0x64]
xor al, al
mov dword [edi], ebp
jmp 0x7d23c269
mov dword [edi], ebp
mov eax, 0xc000000a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0x14
mov ecx, dword [esp + 0x18]
mov eax, dword [0x7d2b7330]
add eax, ecx
lea eax, [eax*2 + 2]
push eax
push 0
push dword [esp + 0x24]
call fcn.7d221e1f
mov ecx, dword [esp + 0x18]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
mov ecx, dword [0x7d2b7330]
push dword [edi]
lea ecx, [esi + ecx*2]
push ecx
call sub.ntdll.dll_memmove
mov eax, dword [0x7d2b7330]
add eax, eax
push eax
push dword [0x7d2b7324]
push esi
call sub.ntdll.dll_memcpy
add esp, 0x18
mov dword [edi], esi
mov eax, 0xc000000a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0x14
mov esi, dword [esp + 0x6c]
mov byte [esp + 0x17], 1
test esi, esi
je 0x7d23c7ed
push 1
push 1
push esi
push ebx
call fcn.7d242c60
test al, 0x10
je 0x7d23c7ce
or dword [esi], 0x100
test al, 0x20
je 0x7d23c7d8
or dword [esi], 0x200
test al, 0x40
je 0x7d23c7ed
or dword [esi], 0x400
jmp 0x7d23c7ed
cmp byte [esp + 0x64], 0
mov ebx, dword [edi]
jne 0x7d23c854
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x7d23c854
cmp dword [esp + 0x60], 0xffffffff
je 0x7d23c854
push dword [esp + 0x20]
push eax
call fcn.7d22164f
test eax, eax
je 0x7d23c854
mov ebx, eax
mov dword [edi], eax
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c813
sub ecx, edx
sar ecx, 1
lea eax, [ebx + ecx*2]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x7d23c84f
push ecx
push dword [esp + 0x2c]
lea esi, [eax + 2]
mov edx, 0x5c
push esi
mov word [eax], dx
call sub.ntdll.dll_memcpy
mov eax, dword [esp + 0x2c]
add esp, 0xc
shr eax, 1
lea eax, [esi + eax*2]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x7d2b7330]
add eax, dword [esp + 0x18]
push eax
push 1
push ebp
call fcn.7d221e1f
mov esi, eax
mov eax, dword [esp + 0x68]
mov dword [eax], esi
mov ecx, dword [0x7d2b7330]
add ecx, ecx
push ecx
push dword [0x7d2b7324]
push esi
call sub.ntdll.dll_memcpy
mov eax, dword [0x7d2b7330]
add esp, 0xc
cmp word [esp + 0x34], 0
lea ebp, [esi + eax*2]
mov esi, ebp
je 0x7d23c8e4
mov eax, 0x5c
lea esi, [esp + 0x34]
mov word [ebp], ax
lea ecx, [esi + 2]
mov eax, dword [str.snapshot_]
movups xmm0, xmmword [eax]
movups xmmword [ebp + 2], xmm0
mov ax, word [eax + 0x10]
mov word [ebp + 0x12], ax
add ebp, 0x14
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x7d23c8c0
sub esi, ecx
lea eax, [esp + 0x34]
sar esi, 1
add esi, esi
push esi
push eax
push ebp
call sub.ntdll.dll_memcpy
add esp, 0xc
add ebp, esi
mov esi, ebp
mov eax, dword [esp + 0x18]
cmp eax, 0x19
jb 0x7d23c90d
push 0x19
push dword [0x7d2b6260]
push ebx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c909
mov eax, 0x32
jmp 0x7d23c97e
mov eax, dword [esp + 0x18]
cmp eax, 0x16
jb 0x7d23c932
push 0x16
push dword [0x7d2b6268]
push ebx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c92e
mov eax, 0x2c
jmp 0x7d23c97e
mov eax, dword [esp + 0x18]
cmp eax, 0x12
jb 0x7d23c957
push 0x12
push dword [0x7d2b626c]
push ebx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23c953
mov eax, 0x24
jmp 0x7d23c97e
mov eax, dword [esp + 0x18]
cmp eax, 0x1e
jb 0x7d23ca08
push 0x1e
push dword [0x7d2b6264]
push ebx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23ca04
mov eax, 0x3c
cmp word [eax + ebx], 0x3b
lea edx, [eax + ebx]
jne 0x7d23c9a0
push 0x5c
push edx
call sub.ntdll.dll_wcschr
mov edx, eax
add esp, 8
test edx, edx
je 0x7d23be21
add edx, 2
mov ecx, dword [str._share_]
add esi, 0xe
movq xmm0, qword [ecx]
movq qword [ebp], xmm0
mov eax, dword [ecx + 8]
mov dword [ebp + 8], eax
mov ax, word [ecx + 0xc]
mov ecx, edx
mov word [ebp + 0xc], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23c9c5
sub ecx, edi
sar ecx, 1
mov dword [esp + 0x18], ecx
lea eax, [ecx + ecx]
push eax
push edx
push esi
call sub.ntdll.dll_memcpy
mov eax, dword [esp + 0x78]
add esp, 0xc
test eax, eax
je 0x7d23cbb3
or dword [eax], 4
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov word [esi + eax*2], cx
jmp 0x7d23ccda
mov eax, dword [esp + 0x18]
cmp eax, 0xc
jb 0x7d23caca
push 0xc
push dword [0x7d2b6258]
push ebx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23cac6
cmp word [ebx + 0x18], 0x3b
lea edi, [ebx + 0x18]
je 0x7d23be21
push 0x5c
push edi
call sub.ntdll.dll_wcschr
mov esi, eax
add esp, 8
test esi, esi
je 0x7d23ca73
push 5
push str.PIPE
push esi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d23ca73
movzx eax, word [esi + 0xa]
cmp eax, 0x5c
je 0x7d23be21
test ax, ax
je 0x7d23be21
mov ecx, dword [str._share_]
movq xmm0, qword [ecx]
movq qword [ebp], xmm0
mov eax, dword [ecx + 8]
mov dword [ebp + 8], eax
mov ax, word [ecx + 0xc]
mov word [ebp + 0xc], ax
add ebp, 0xe
mov eax, dword [esp + 0x18]
sub eax, 0xc
mov dword [esp + 0x18], eax
add eax, eax
push eax
push edi
push ebp
call sub.ntdll.dll_memcpy
mov eax, dword [esp + 0x78]
add esp, 0xc
test eax, eax
je 0x7d23cab6
or dword [eax], 4
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov word [ebp + eax*2], cx
jmp 0x7d23ccda
mov eax, dword [esp + 0x18]
mov ecx, dword [0x7d2ddabc]
test ecx, ecx
je 0x7d23cb0f
cmp eax, ecx
jb 0x7d23cb0f
push ecx
push dword [0x7d2ddab8]
push ebx
call fcn.7d221b09
test eax, eax
jne 0x7d23cb0b
mov eax, dword [str.user_all]
add esi, 0x12
mov ecx, dword [0x7d2ddabc]
movups xmm0, xmmword [eax]
movups xmmword [ebp], xmm0
mov ax, word [eax + 0x10]
mov word [ebp + 0x10], ax
jmp 0x7d23cb99
mov eax, dword [esp + 0x18]
mov ecx, dword [0x7d2ddac4]
test ecx, ecx
je 0x7d23cb5b
cmp eax, ecx
jb 0x7d23cb5b
push ecx
push dword [0x7d2ddac0]
push ebx
call fcn.7d221b09
test eax, eax
jne 0x7d23cb57
mov eax, dword [str.usercurrent]
add esi, 0x1a
mov ecx, dword [0x7d2ddac4]
movups xmm0, xmmword [eax]
movups xmmword [ebp], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp + 0x10], xmm0
mov ax, word [eax + 0x18]
mov word [ebp + 0x18], ax
jmp 0x7d23cb99
mov eax, dword [esp + 0x18]
mov ecx, dword [0x7d2ddacc]
test ecx, ecx
je 0x7d23cbc6
cmp eax, ecx
jb 0x7d23cbc6
push ecx
push dword [0x7d2ddac8]
push ebx
call fcn.7d221b09
test eax, eax
jne 0x7d23cbc2
mov eax, dword [str.userpublic]
add esi, 0x18
mov ecx, dword [0x7d2ddacc]
movups xmm0, xmmword [eax]
movups xmmword [ebp], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp + 0x10], xmm0
mov eax, dword [esp + 0x18]
sub eax, ecx
mov dword [esp + 0x18], eax
add eax, eax
push eax
lea eax, [ebx + ecx*2]
push eax
push esi
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x7d23ccda
mov eax, dword [esp + 0x18]
push eax
push ebx
call fcn.7d23a6e0
mov dword [esp + 0x6c], eax
test eax, eax
je 0x7d23cbda
mov ecx, dword [eax + 0x18]
jmp 0x7d23cbf9
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x1c]
push ebx
call fcn.7d23a780
mov dword [esp + 0x6c], eax
test eax, eax
je 0x7d23be21
mov ecx, dword [esp + 0x5c]
push dword [0x7d2ddad8]
movzx esi, word [eax]
mov dword [esp + 0x60], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [str.drive_]
movq xmm0, qword [ecx]
movq qword [ebp], xmm0
mov eax, dword [ecx + 8]
mov dword [ebp + 8], eax
mov ax, word [ecx + 0xc]
mov word [ebp + 0xc], ax
mov word [ebp + 0xe], si
add ebp, 0x10
cmp byte [0x7d2dda55], 0
mov esi, ebp
je 0x7d23cc75
mov ecx, dword [esp + 0x6c]
add ecx, 2
cmp word [ecx], 0
je 0x7d23cc75
mov eax, 0x7e
lea edx, [ebp + 2]
mov word [ebp], ax
mov ebp, edx
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x7d23cc60
add ebp, 0x12
mov esi, ebp
mov ecx, dword [esp + 0x5c]
xor eax, eax
mov word [ebp], ax
mov eax, dword [esp + 0x18]
cmp eax, ecx
jne 0x7d23cc97
cmp byte [esp + 0x15], 0
je 0x7d23be21
mov byte [esp + 0x16], 1
sub eax, ecx
mov dword [esp + 0x18], eax
add eax, eax
push eax
lea eax, [ebx + ecx*2]
push eax
push esi
call sub.ntdll.dll_memcpy
mov eax, dword [esp + 0x24]
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2], cx
cmp byte [esp + 0x16], cl
je 0x7d23ccda
mov edx, dword [edi]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d23ccc4
sub ecx, esi
sar ecx, 1
mov dword [edx + ecx*2], 0x5c
cmp byte [esp + 0x17], 0
je 0x7d23cce7
push ebx
call fcn.7d221537
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret 0x14
pop edi
pop esi
pop ebp
mov eax, 0xc000003b
pop ebx
add esp, 0x48
ret 0x14