Function at 0x1f025000
Capabilities:
Allocate thread local storage
Create thread
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x1f0564a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6f0
mov eax, dword [esp + 0x704]
push ebx
push ebp
xor ebx, ebx
sub eax, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
je 0x1f026593
sub eax, 1
je 0x1f02504c
sub eax, 2
jne 0x1f026667
call fcn.1f019be0
jmp 0x1f026667
mov edi, dword [esp + 0x710]
push 0x104
push 0x1f083020
xor eax, eax
push edi
mov dword [0x1f0836c8], edi
mov word [0x1f083020], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f083020
call fcn.1f0340f0
push 0x3c
mov dword [0x1f06c3a0], eax
call fcn.1f03e9a2
add esp, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], ebx
cmp eax, ebx
je 0x1f0250a3
mov ecx, eax
call fcn.1f009520
jmp 0x1f0250a5
xor eax, eax
or esi, 0xffffffff
mov dword [esp + 0x708], esi
mov dword [0x1f083720], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x38
mov dword [0x1f0836f0], eax
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 1
cmp eax, ebx
je 0x1f0250e7
push 1
mov ecx, eax
call fcn.1f02ddf0
jmp 0x1f0250e9
xor eax, eax
mov dword [esp + 0x708], esi
push 0x38
mov dword [0x1f0837cc], eax
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 2
cmp eax, ebx
je 0x1f02511d
push 1
mov ecx, eax
call fcn.1f02ddf0
jmp 0x1f02511f
xor eax, eax
mov dword [esp + 0x708], esi
push 0x1f0829f8
mov dword [0x1f0837d0], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x1f082a00
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x18]
push edx
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0x1f0836cc
mov dword [0x1f0834b4], ecx
mov dword [0x1f0834b0], edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1f0836d0]
mov esi, dword [sym.imp.KERNEL32.dll_HeapCreate]
push ebx
push eax
push 0x40002
mov dword [0x1f06c374], eax
call esi
mov dword [0x1f0837b0], eax
mov eax, dword [0x1f06c374]
push ebx
push eax
push 2
call esi
mov ecx, dword [0x1f06c374]
push ebx
push ecx
push 2
mov dword [0x1f0837b4], eax
call esi
mov edx, dword [0x1f06c374]
push ebx
push edx
push 2
mov dword [0x1f0837b8], eax
call esi
push 0x80000
push ebx
push eax
mov dword [0x1f0837bc], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push 1
mov dword [0x1f0837d8], eax
push ebx
add eax, 0x80000
push ebx
mov dword [0x1f0837dc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [0x1f06c39c]
push 0x104
mov dword [0x1f0837e0], eax
mov eax, dword [0x1f06c398]
push 0x1f0834b8
push edi
mov dword [0x1f0836c0], eax
mov dword [0x1f0836c4], ecx
call fcn.1f034580
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + 0x1f0834b8]
mov word [eax + 0x1f082a08], cx
add eax, 2
cmp cx, bx
jne 0x1f025220
mov edi, 0x1f082a08
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x1f025240
mov ecx, 6
mov esi, str.UserDefines_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x1f0834b8]
mov word [eax + 0x1f0832a8], cx
add eax, 2
cmp cx, bx
jne 0x1f025260
mov eax, 0x1f0832a8
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x1f025280
mov edx, dword [str.UserTypes_]
mov ecx, dword [0x1f05e700]
mov dword [eax], edx
mov edx, dword [0x1f05e704]
mov dword [eax + 4], ecx
mov ecx, dword [0x1f05e708]
mov dword [eax + 8], edx
mov edx, dword [0x1f05e70c]
mov dword [eax + 0xc], ecx
mov cx, word [0x1f05e710]
mov dword [eax + 0x10], edx
mov edx, dword [0x1f0836f0]
push edx
push str.0x_X
mov word [eax + 0x14], cx
lea eax, [esp + 0x28]
push 0x32
push eax
call fcn.1f03ea51
mov eax, dword [0x1f06c3a0]
lea edx, [esp + 0x94]
add esp, 0x10
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x1f0252f0
lea eax, [esp + 0x84]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025310
sub eax, edx
sar eax, 1
cmp eax, 4
jbe 0x1f025349
lea eax, [esp + eax*2 + 0x7c]
xor ecx, ecx
mov word [eax], cx
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x84]
mov word [eax + 0x1f083228], cx
add eax, 2
cmp cx, bx
jne 0x1f025330
jmp 0x1f025367
xor eax, eax
jmp 0x1f025350
movzx ecx, word [esp + eax + 0x84]
mov word [eax + 0x1f083228], cx
add eax, 2
cmp cx, bx
jne 0x1f025350
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_ERROR]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025370
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0253a2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0253c0
mov ebp, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
push ebx
push 1
push ebx
push ebx
mov dword [0x1f083794], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x1f083734], eax
call fcn.1f0138d0
mov dword [0x1f0837c0], eax
call fcn.1f0138d0
mov dword [0x1f0837c4], eax
call fcn.1f0138d0
cmp dword [0x1f0837c0], 0xffffffff
mov dword [0x1f0837c8], eax
je 0x1f0264fb
cmp dword [0x1f0837c4], 0xffffffff
je 0x1f0264fb
cmp eax, 0xffffffff
je 0x1f0264fb
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x1f083228]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025450
lea eax, [esp + 0x20]
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025470
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
jmp 0x1f025490
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025490
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 8
rep movsb byte es:[edi], byte [esi]
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 3
cmp eax, ebx
je 0x1f0254da
lea ecx, [esp + 0x84]
push ecx
mov ecx, eax
call fcn.1f02a050
jmp 0x1f0254dc
xor eax, eax
mov dword [esp + 0x708], 0xffffffff
mov ecx, eax
mov dword [0x1f083710], eax
call fcn.1f02a0a0
test eax, eax
je 0x1f025562
mov eax, dword [0x1f083794]
cmp eax, ebx
je 0x1f025507
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x20]
push edx
push str.Error_API_override_already_loaded_for_Process_Id__s
lea eax, [esp + 0x2f8]
push 0x208
push eax
call fcn.1f03ea51
mov ecx, dword [0x1f083710]
add esp, 0x10
mov esi, ecx
cmp ecx, ebx
je 0x1f025540
call fcn.1f02a080
push esi
call fcn.1f03e97c
add esp, 4
mov ecx, dword [0x1f0837c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
push ecx
call esi
mov edx, dword [0x1f0837c4]
push edx
call esi
mov eax, dword [0x1f0837c8]
jmp 0x1f026554
xor eax, eax
jmp 0x1f025570
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_START_MONITORING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025570
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0255a2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0255c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083750], eax
xor eax, eax
jmp 0x1f025600
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_STOP_MONITORING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025600
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025632
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025650
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push ebx
push 0x1f0003
call ebp
mov dword [0x1f083754], eax
xor eax, eax
jmp 0x1f025690
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_START_FAKING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025690
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0256c2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0256e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083758], eax
xor eax, eax
jmp 0x1f025720
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_STOP_FAKING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025720
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025752
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025770
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08375c], eax
xor eax, eax
jmp 0x1f0257b0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_FREE_PROCESS]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0257b0
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0257e2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025800
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push ebx
push 0x1f0003
call ebp
mov dword [0x1f083760], eax
xor eax, eax
jmp 0x1f025840
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_END_SMS_LOOP]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025840
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025872
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025890
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083764], eax
xor eax, eax
jmp 0x1f0258d0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_DLLPROCESS_ATTACH_COMPLETED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0258d0
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025902
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025920
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08376c], eax
xor eax, eax
jmp 0x1f025960
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_DLLPROCESS_DETACHED_COMPLETED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025960
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025992
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0259b0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x1f0003
call ebp
mov dword [0x1f083770], eax
xor eax, eax
jmp 0x1f0259f0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_PROCESS_FREE]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0259f0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025a22
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025a40
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08377c], eax
xor eax, eax
jmp 0x1f025a80
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_MONITORING_FILE_LOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025a80
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025ab2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025ad0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083780], eax
xor eax, eax
jmp 0x1f025b10
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_MONITORING_FILE_UNLOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025b10
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025b42
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025b60
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x1f0003
call ebp
mov dword [0x1f083784], eax
xor eax, eax
jmp 0x1f025ba0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_FAKE_API_DLL_LOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025ba0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025bd2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025bf0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083788], eax
xor eax, eax
jmp 0x1f025c30
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_FAKE_API_DLL_UNLOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025c30
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025c62
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025c80
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08378c], eax
xor eax, eax
jmp 0x1f025cc0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_MAILSLOT_OPEN]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025cc0
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025cf2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025d10
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x1f0003
call ebp
mov dword [0x1f083790], eax
xor eax, eax
jmp 0x1f025d50
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_PROCESS_FREEING_START]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025d50
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025d82
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025da0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083774], eax
xor eax, eax
jmp 0x1f025de0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_PROCESS_FREEING_CLOSE_REMOTE_GUI]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025de0
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025e12
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025e30
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083778], eax
cmp dword [0x1f083750], ebx
je 0x1f0264b5
cmp dword [0x1f083754], ebx
je 0x1f0264b5
cmp dword [0x1f083758], ebx
je 0x1f0264b5
cmp dword [0x1f08375c], ebx
je 0x1f0264b5
cmp dword [0x1f083760], ebx
je 0x1f0264b5
cmp dword [0x1f08376c], ebx
je 0x1f0264b5
cmp dword [0x1f083770], ebx
je 0x1f0264b5
cmp dword [0x1f08377c], ebx
je 0x1f0264b5
cmp dword [0x1f083780], ebx
je 0x1f0264b5
cmp dword [0x1f083784], ebx
je 0x1f0264b5
cmp dword [0x1f083788], ebx
je 0x1f0264b5
cmp dword [0x1f08378c], ebx
je 0x1f0264b5
cmp dword [0x1f083790], ebx
je 0x1f0264b5
cmp dword [0x1f083774], ebx
je 0x1f0264b5
cmp eax, ebx
je 0x1f0264b5
cmp dword [0x1f083794], ebx
je 0x1f0264c5
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str..mailslotAPIOVERRIDE_TO_INJECTOR]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025f20
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025f52
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025f70
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x408
rep movsb byte es:[edi], byte [esi]
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 4
cmp eax, ebx
je 0x1f025fbd
lea ecx, [esp + 0x84]
push ecx
mov ecx, eax
call fcn.1f02f160
jmp 0x1f025fbf
xor eax, eax
or ebp, 0xffffffff
mov dword [esp + 0x708], ebp
mov ecx, eax
mov dword [0x1f083708], eax
call fcn.1f02f1a0
test eax, eax
jne 0x1f02601f
mov edx, dword [0x1f083794]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x84]
push eax
push str.Cant_open_MailSlot__s
lea ecx, [esp + 0x2f8]
push 0x208
push ecx
call fcn.1f03ea51
push ebx
call fcn.1f0245b0
push 0x1f083770
call fcn.1f02a010
add esp, 0x18
xor eax, eax
jmp 0x1f02666c
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f083798], eax
call esi
push ebx
push ebx
push 1
push ebx
mov dword [0x1f083724], eax
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f083728], eax
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f08372c], eax
call esi
mov dword [0x1f083730], eax
xor eax, eax
movzx ecx, word [eax + str..mailslotAPIOVERRIDE_FROM_INJECTOR]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f026060
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f007e70
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f026092
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0260b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x84]
mov word [eax + 0x1f082c10], cx
add eax, 2
cmp cx, bx
jne 0x1f0260d0
cmp dword [0x1f083764], ebx
jne 0x1f026142
push 0x1f082c10
call fcn.1f024b70
add esp, 4
test eax, eax
jne 0x1f026142
mov eax, dword [0x1f083794]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f082c10
push str.Cant_create_MailSlot_server_for__s
lea ecx, [esp + 0x2f8]
push 0x208
push ecx
call fcn.1f03ea51
push ebx
call fcn.1f0245b0
push 0x1f083770
call fcn.1f02a010
add esp, 0x18
xor eax, eax
jmp 0x1f02666c
push ebx
push fcn.1f023860
call fcn.1f035a70
push 0x3c
call fcn.1f03e9a2
add esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 5
cmp eax, ebx
je 0x1f02617a
push 1
push 0x1b78
mov ecx, eax
call fcn.1f02d060
jmp 0x1f02617c
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f0836f4], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f03dab0
push 0x3c
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 6
cmp eax, ebx
je 0x1f0261c8
push 1
push 0x208
mov ecx, eax
call fcn.1f02d060
jmp 0x1f0261ca
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f0836f8], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f03dab0
push 0x3c
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 7
cmp eax, ebx
je 0x1f026213
push 1
push 0x10
mov ecx, eax
call fcn.1f02d060
jmp 0x1f026215
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f0836fc], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f03dab0
push 0x3c
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 8
cmp eax, ebx
je 0x1f02625e
push 1
push 0xc
mov ecx, eax
call fcn.1f02d060
jmp 0x1f026260
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f083700], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f03dab0
push 0x3c
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 9
cmp eax, ebx
je 0x1f0262ac
push 1
push 0x20c
mov ecx, eax
call fcn.1f02d060
jmp 0x1f0262ae
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f083704], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f03dab0
push 0x10c020
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 0xa
cmp eax, ebx
je 0x1f0262f6
mov ecx, eax
call fcn.1f026c30
jmp 0x1f0262f8
xor eax, eax
mov dword [esp + 0x708], ebp
push 0x890
mov dword [0x1f083714], eax
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 0xb
cmp eax, ebx
je 0x1f02632d
mov ecx, eax
call fcn.1f01f8e0
jmp 0x1f02632f
xor eax, eax
mov dword [esp + 0x708], ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f083718], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x2a8
mov dword [0x1f0837ac], eax
call fcn.1f03e9a2
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 0xc
cmp eax, ebx
je 0x1f026373
mov ecx, eax
call fcn.1f027920
jmp 0x1f026375
xor eax, eax
mov dword [esp + 0x708], ebp
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f083740
push ebx
push ebx
push 0x1f024e50
push 0x100000
push ebx
mov dword [0x1f08371c], eax
call esi
push 0x1f0837a8
push ebx
push ebx
push 0x1f01d780
push 0x100000
push ebx
mov dword [esp + 0x2c], eax
call esi
mov dword [0x1f0837a4], eax
cmp dword [esp + 0x14], ebx
je 0x1f026490
cmp eax, ebx
je 0x1f026490
lea edx, [esp + 0x14]
push edx
call fcn.1f02a010
add esp, 4
cmp dword [0x1f083764], ebx
je 0x1f026474
mov eax, dword [0x1f0837d0]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1f0837a0], 1
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov esi, dword [edx + eax]
add esi, 0x10
call edi
mov edx, dword [esi]
push eax
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call edx
push 0x1f082c10
call fcn.1f024c90
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov esi, dword [edx + eax]
add esp, 4
push ebx
add esi, 0x34
call edi
mov edx, dword [esi]
push eax
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call edx
push 0x1f082c10
call fcn.1f024b70
add esp, 4
test eax, eax
jne 0x1f026667
mov eax, dword [0x1f083794]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f082c10
push str.Cant_create_MailSlot_server_for__s
jmp 0x1f0264cf
mov edx, dword [0x1f08376c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0x1f0837a0], 1
jmp 0x1f026667
mov eax, dword [0x1f083794]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [esp + 0x20]
push ecx
push str.Error_creating_watching_thread_for_Process_Id__s
push 0x208
lea edx, [esp + 0x2fc]
push edx
jmp 0x1f0264dc
mov eax, dword [0x1f083794]
cmp eax, ebx
je 0x1f0264c5
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x20]
push eax
push str.Error_opening_named_events_for_Process_Id__s
push 0x208
lea ecx, [esp + 0x2fc]
push ecx
call fcn.1f03ea51
push ebx
call fcn.1f0245b0
push 0x1f083770
call fcn.1f02a010
add esp, 0x18
xor eax, eax
jmp 0x1f02666c
mov eax, dword [0x1f083794]
cmp eax, ebx
je 0x1f02650b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x20]
push edx
push str.Error_Allocating_Tls_for_Process_Id__s
lea eax, [esp + 0x2f8]
push 0x208
push eax
call fcn.1f03ea51
mov eax, dword [0x1f0837c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
add esp, 0x10
cmp eax, 0xffffffff
je 0x1f02653d
push eax
call esi
mov eax, dword [0x1f0837c4]
cmp eax, 0xffffffff
je 0x1f02654a
push eax
call esi
mov eax, dword [0x1f0837c8]
cmp eax, 0xffffffff
je 0x1f026557
push eax
call esi
mov ecx, dword [0x1f083720]
cmp ecx, ebx
je 0x1f02658c
push 0x3e8
push ebx
call fcn.1f009580
mov ecx, dword [0x1f083720]
mov esi, ecx
cmp ecx, ebx
je 0x1f026586
call fcn.1f008ff0
push esi
call fcn.1f03e97c
add esp, 4
mov dword [0x1f083720], ebx
xor eax, eax
jmp 0x1f02666c
mov dword [0x1f0837d4], 1
cmp dword [0x1f0837a0], ebx
je 0x1f026667
mov eax, dword [0x1f083798]
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, ebx
je 0x1f0265bb
push eax
call esi
push ebx
call fcn.1f0245b0
mov ecx, dword [0x1f083770]
add esp, 4
push ecx
call esi
push 0x1f083770
call fcn.1f02a010
mov edx, dword [0x1f0837b0]
mov esi, dword [sym.imp.KERNEL32.dll_HeapDestroy]
add esp, 4
push edx
call esi
mov eax, dword [0x1f0837b4]
push eax
call esi
mov ecx, dword [0x1f0837b8]
push ecx
call esi
mov edx, dword [0x1f0837e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1f0837bc]
push eax
call esi
mov eax, dword [0x1f0837d0]
cmp eax, ebx
je 0x1f02662e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x1f0837d0], ebx
mov eax, dword [0x1f0837cc]
cmp eax, ebx
je 0x1f02664d
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x1f0837cc], ebx
mov ecx, dword [0x1f083710]
cmp ecx, ebx
je 0x1f026667
mov esi, ecx
call fcn.1f02a080
push esi
call fcn.1f03e97c
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x700]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6fc
ret 0xc