Function at 0x1f024f60
Capabilities:
Allocate thread local storage
Create thread
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x1f056336
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6f0
mov eax, dword [esp + 0x704]
push ebx
push ebp
xor ebx, ebx
sub eax, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
je 0x1f0264f3
sub eax, 1
je 0x1f024fac
sub eax, 2
jne 0x1f0265c7
call fcn.1f019b40
jmp 0x1f0265c7
mov edi, dword [esp + 0x710]
push 0x104
push 0x1f083020
xor eax, eax
push edi
mov dword [0x1f0836c8], edi
mov word [0x1f083020], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f083020
call fcn.1f033f90
push 0x3c
mov dword [0x1f06c3a0], eax
call fcn.1f03e832
add esp, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], ebx
cmp eax, ebx
je 0x1f025003
mov ecx, eax
call fcn.1f0098d0
jmp 0x1f025005
xor eax, eax
or esi, 0xffffffff
mov dword [esp + 0x708], esi
mov dword [0x1f083720], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x38
mov dword [0x1f0836f0], eax
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 1
cmp eax, ebx
je 0x1f025047
push 1
mov ecx, eax
call fcn.1f02dce0
jmp 0x1f025049
xor eax, eax
mov dword [esp + 0x708], esi
push 0x38
mov dword [0x1f0837cc], eax
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 2
cmp eax, ebx
je 0x1f02507d
push 1
mov ecx, eax
call fcn.1f02dce0
jmp 0x1f02507f
xor eax, eax
mov dword [esp + 0x708], esi
push 0x1f0829f8
mov dword [0x1f0837d0], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x1f082a00
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x18]
push edx
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0x1f0836cc
mov dword [0x1f0834b4], ecx
mov dword [0x1f0834b0], edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1f0836d0]
mov esi, dword [sym.imp.KERNEL32.dll_HeapCreate]
push ebx
push eax
push 0x40002
mov dword [0x1f06c374], eax
call esi
mov dword [0x1f0837b0], eax
mov eax, dword [0x1f06c374]
push ebx
push eax
push 2
call esi
mov ecx, dword [0x1f06c374]
push ebx
push ecx
push 2
mov dword [0x1f0837b4], eax
call esi
mov edx, dword [0x1f06c374]
push ebx
push edx
push 2
mov dword [0x1f0837b8], eax
call esi
push 0x80000
push ebx
push eax
mov dword [0x1f0837bc], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push 1
mov dword [0x1f0837d8], eax
push ebx
add eax, 0x80000
push ebx
mov dword [0x1f0837dc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [0x1f06c39c]
push 0x104
mov dword [0x1f0837e0], eax
mov eax, dword [0x1f06c398]
push 0x1f0834b8
push edi
mov dword [0x1f0836c0], eax
mov dword [0x1f0836c4], ecx
call fcn.1f034420
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + 0x1f0834b8]
mov word [eax + 0x1f082a08], cx
add eax, 2
cmp cx, bx
jne 0x1f025180
mov edi, 0x1f082a08
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x1f0251a0
mov ecx, 6
mov esi, str.UserDefines_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x1f0834b8]
mov word [eax + 0x1f0832a8], cx
add eax, 2
cmp cx, bx
jne 0x1f0251c0
mov eax, 0x1f0832a8
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x1f0251e0
mov edx, dword [str.UserTypes_]
mov ecx, dword [0x1f05e700]
mov dword [eax], edx
mov edx, dword [0x1f05e704]
mov dword [eax + 4], ecx
mov ecx, dword [0x1f05e708]
mov dword [eax + 8], edx
mov edx, dword [0x1f05e70c]
mov dword [eax + 0xc], ecx
mov cx, word [0x1f05e710]
mov dword [eax + 0x10], edx
mov edx, dword [0x1f0836f0]
push edx
push str.0x_X
mov word [eax + 0x14], cx
lea eax, [esp + 0x28]
push 0x32
push eax
call fcn.1f03e8e1
mov eax, dword [0x1f06c3a0]
lea edx, [esp + 0x94]
add esp, 0x10
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x1f025250
lea eax, [esp + 0x84]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025270
sub eax, edx
sar eax, 1
cmp eax, 4
jbe 0x1f0252a9
lea eax, [esp + eax*2 + 0x7c]
xor ecx, ecx
mov word [eax], cx
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x84]
mov word [eax + 0x1f083228], cx
add eax, 2
cmp cx, bx
jne 0x1f025290
jmp 0x1f0252c7
xor eax, eax
jmp 0x1f0252b0
movzx ecx, word [esp + eax + 0x84]
mov word [eax + 0x1f083228], cx
add eax, 2
cmp cx, bx
jne 0x1f0252b0
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_ERROR]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0252d0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025302
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025320
mov ebp, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
push ebx
push 1
push ebx
push ebx
mov dword [0x1f083794], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x1f083734], eax
call fcn.1f013820
mov dword [0x1f0837c0], eax
call fcn.1f013820
mov dword [0x1f0837c4], eax
call fcn.1f013820
cmp dword [0x1f0837c0], 0xffffffff
mov dword [0x1f0837c8], eax
je 0x1f02645b
cmp dword [0x1f0837c4], 0xffffffff
je 0x1f02645b
cmp eax, 0xffffffff
je 0x1f02645b
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x1f083228]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0253b0
lea eax, [esp + 0x20]
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0253d0
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
jmp 0x1f0253f0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0253f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 8
rep movsb byte es:[edi], byte [esi]
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 3
cmp eax, ebx
je 0x1f02543a
lea ecx, [esp + 0x84]
push ecx
mov ecx, eax
call fcn.1f029fc0
jmp 0x1f02543c
xor eax, eax
mov dword [esp + 0x708], 0xffffffff
mov ecx, eax
mov dword [0x1f083710], eax
call fcn.1f02a020
test eax, eax
je 0x1f0254c2
mov eax, dword [0x1f083794]
cmp eax, ebx
je 0x1f025467
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x20]
push edx
push str.Error_API_override_already_loaded_for_Process_Id__s
lea eax, [esp + 0x2f8]
push 0x208
push eax
call fcn.1f03e8e1
mov ecx, dword [0x1f083710]
add esp, 0x10
mov esi, ecx
cmp ecx, ebx
je 0x1f0254a0
call fcn.1f02a000
push esi
call fcn.1f03e80c
add esp, 4
mov ecx, dword [0x1f0837c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
push ecx
call esi
mov edx, dword [0x1f0837c4]
push edx
call esi
mov eax, dword [0x1f0837c8]
jmp 0x1f0264b4
xor eax, eax
jmp 0x1f0254d0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_START_MONITORING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0254d0
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025502
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025520
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083750], eax
xor eax, eax
jmp 0x1f025560
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_STOP_MONITORING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025560
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025592
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0255b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push ebx
push 0x1f0003
call ebp
mov dword [0x1f083754], eax
xor eax, eax
jmp 0x1f0255f0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_START_FAKING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0255f0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025622
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025640
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083758], eax
xor eax, eax
jmp 0x1f025680
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_STOP_FAKING]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025680
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0256b2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0256d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08375c], eax
xor eax, eax
jmp 0x1f025710
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_FREE_PROCESS]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025710
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025742
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025760
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push ebx
push 0x1f0003
call ebp
mov dword [0x1f083760], eax
xor eax, eax
jmp 0x1f0257a0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_END_SMS_LOOP]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0257a0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0257d2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0257f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push ebx
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083764], eax
xor eax, eax
jmp 0x1f025830
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_DLLPROCESS_ATTACH_COMPLETED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025830
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025862
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025880
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08376c], eax
xor eax, eax
jmp 0x1f0258c0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_DLLPROCESS_DETACHED_COMPLETED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0258c0
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f0258f2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025910
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x1f0003
call ebp
mov dword [0x1f083770], eax
xor eax, eax
jmp 0x1f025950
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_PROCESS_FREE]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025950
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025982
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f0259a0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08377c], eax
xor eax, eax
jmp 0x1f0259e0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_MONITORING_FILE_LOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f0259e0
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025a12
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025a30
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083780], eax
xor eax, eax
jmp 0x1f025a70
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_MONITORING_FILE_UNLOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025a70
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025aa2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025ac0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x1f0003
call ebp
mov dword [0x1f083784], eax
xor eax, eax
jmp 0x1f025b00
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_FAKE_API_DLL_LOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025b00
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025b32
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025b50
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083788], eax
xor eax, eax
jmp 0x1f025b90
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_FAKE_API_DLL_UNLOADED]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025b90
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025bc2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025be0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f08378c], eax
xor eax, eax
jmp 0x1f025c20
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_MAILSLOT_OPEN]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025c20
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025c52
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025c70
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x1f0003
call ebp
mov dword [0x1f083790], eax
xor eax, eax
jmp 0x1f025cb0
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_PROCESS_FREEING_START]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025cb0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025ce2
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025d00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x84]
push eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083774], eax
xor eax, eax
jmp 0x1f025d40
movzx ecx, word [eax + str.GlobalAPIOVERRIDE_EVENT_PROCESS_FREEING_CLOSE_REMOTE_GUI]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025d40
lea ecx, [esp + 0x84]
push 0x1f083228
push ecx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025d72
lea edi, [esp + 0x84]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025d90
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x84]
push edx
mov ecx, eax
push 1
and ecx, 3
push 0x1f0003
rep movsb byte es:[edi], byte [esi]
call ebp
mov dword [0x1f083778], eax
cmp dword [0x1f083750], ebx
je 0x1f026415
cmp dword [0x1f083754], ebx
je 0x1f026415
cmp dword [0x1f083758], ebx
je 0x1f026415
cmp dword [0x1f08375c], ebx
je 0x1f026415
cmp dword [0x1f083760], ebx
je 0x1f026415
cmp dword [0x1f08376c], ebx
je 0x1f026415
cmp dword [0x1f083770], ebx
je 0x1f026415
cmp dword [0x1f08377c], ebx
je 0x1f026415
cmp dword [0x1f083780], ebx
je 0x1f026415
cmp dword [0x1f083784], ebx
je 0x1f026415
cmp dword [0x1f083788], ebx
je 0x1f026415
cmp dword [0x1f08378c], ebx
je 0x1f026415
cmp dword [0x1f083790], ebx
je 0x1f026415
cmp dword [0x1f083774], ebx
je 0x1f026415
cmp eax, ebx
je 0x1f026415
cmp dword [0x1f083794], ebx
je 0x1f026425
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str..mailslotAPIOVERRIDE_TO_INJECTOR]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025e80
lea eax, [esp + 0x84]
push 0x1f083228
push eax
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025eb2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f025ed0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x408
rep movsb byte es:[edi], byte [esi]
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 4
cmp eax, ebx
je 0x1f025f1d
lea ecx, [esp + 0x84]
push ecx
mov ecx, eax
call fcn.1f02f050
jmp 0x1f025f1f
xor eax, eax
or ebp, 0xffffffff
mov dword [esp + 0x708], ebp
mov ecx, eax
mov dword [0x1f083708], eax
call fcn.1f02f090
test eax, eax
jne 0x1f025f7f
mov edx, dword [0x1f083794]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x84]
push eax
push str.Cant_open_MailSlot__s
lea ecx, [esp + 0x2f8]
push 0x208
push ecx
call fcn.1f03e8e1
push ebx
call fcn.1f024510
push 0x1f083770
call fcn.1f029f80
add esp, 0x18
xor eax, eax
jmp 0x1f0265cc
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f083798], eax
call esi
push ebx
push ebx
push 1
push ebx
mov dword [0x1f083724], eax
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f083728], eax
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f08372c], eax
call esi
mov dword [0x1f083730], eax
xor eax, eax
movzx ecx, word [eax + str..mailslotAPIOVERRIDE_FROM_INJECTOR]
mov word [esp + eax + 0x84], cx
add eax, 2
cmp cx, bx
jne 0x1f025fc0
lea edx, [esp + 0x84]
push 0x1f083228
push edx
call fcn.1f008220
lea eax, [esp + 0x28]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1f025ff2
lea edi, [esp + 0x84]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x1f026010
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x84]
mov word [eax + 0x1f082c10], cx
add eax, 2
cmp cx, bx
jne 0x1f026030
cmp dword [0x1f083764], ebx
jne 0x1f0260a2
push 0x1f082c10
call fcn.1f024ad0
add esp, 4
test eax, eax
jne 0x1f0260a2
mov eax, dword [0x1f083794]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f082c10
push str.Cant_create_MailSlot_server_for__s
lea ecx, [esp + 0x2f8]
push 0x208
push ecx
call fcn.1f03e8e1
push ebx
call fcn.1f024510
push 0x1f083770
call fcn.1f029f80
add esp, 0x18
xor eax, eax
jmp 0x1f0265cc
push ebx
push fcn.1f00dd10
call fcn.1f035900
push 0x3c
call fcn.1f03e832
add esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 5
cmp eax, ebx
je 0x1f0260da
push 1
push 0x1b78
mov ecx, eax
call fcn.1f02cf40
jmp 0x1f0260dc
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f0836f4], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f02d9e0
push 0x3c
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 6
cmp eax, ebx
je 0x1f026128
push 1
push 0x208
mov ecx, eax
call fcn.1f02cf40
jmp 0x1f02612a
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f0836f8], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f02d9e0
push 0x3c
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 7
cmp eax, ebx
je 0x1f026173
push 1
push 0x10
mov ecx, eax
call fcn.1f02cf40
jmp 0x1f026175
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f0836fc], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f02d9e0
push 0x3c
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 8
cmp eax, ebx
je 0x1f0261be
push 1
push 0xc
mov ecx, eax
call fcn.1f02cf40
jmp 0x1f0261c0
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f083700], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f02d9e0
push 0x3c
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 9
cmp eax, ebx
je 0x1f02620c
push 1
push 0x20c
mov ecx, eax
call fcn.1f02cf40
jmp 0x1f02620e
xor eax, eax
mov dword [esp + 0x708], ebp
mov edx, dword [0x1f0837b0]
mov dword [0x1f083704], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
call fcn.1f02d9e0
push 0x10c020
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 0xa
cmp eax, ebx
je 0x1f026256
mov ecx, eax
call fcn.1f026bb0
jmp 0x1f026258
xor eax, eax
mov dword [esp + 0x708], ebp
push 0x890
mov dword [0x1f083714], eax
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 0xb
cmp eax, ebx
je 0x1f02628d
mov ecx, eax
call fcn.1f01f850
jmp 0x1f02628f
xor eax, eax
mov dword [esp + 0x708], ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x1f083718], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x2a8
mov dword [0x1f0837ac], eax
call fcn.1f03e832
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x708], 0xc
cmp eax, ebx
je 0x1f0262d3
mov ecx, eax
call fcn.1f027880
jmp 0x1f0262d5
xor eax, eax
mov dword [esp + 0x708], ebp
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f083740
push ebx
push ebx
push 0x1f024db0
push 0x100000
push ebx
mov dword [0x1f08371c], eax
call esi
push 0x1f0837a8
push ebx
push ebx
push 0x1f01d6f0
push 0x100000
push ebx
mov dword [esp + 0x2c], eax
call esi
mov dword [0x1f0837a4], eax
cmp dword [esp + 0x14], ebx
je 0x1f0263f0
cmp eax, ebx
je 0x1f0263f0
lea edx, [esp + 0x14]
push edx
call fcn.1f029f80
add esp, 4
cmp dword [0x1f083764], ebx
je 0x1f0263d4
mov eax, dword [0x1f0837d0]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1f0837a0], 1
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov esi, dword [edx + eax]
add esi, 0x10
call edi
mov edx, dword [esi]
push eax
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call edx
push 0x1f082c10
call fcn.1f024bf0
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov esi, dword [edx + eax]
add esp, 4
push ebx
add esi, 0x34
call edi
mov edx, dword [esi]
push eax
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call edx
push 0x1f082c10
call fcn.1f024ad0
add esp, 4
test eax, eax
jne 0x1f0265c7
mov eax, dword [0x1f083794]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f082c10
push str.Cant_create_MailSlot_server_for__s
jmp 0x1f02642f
mov edx, dword [0x1f08376c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0x1f0837a0], 1
jmp 0x1f0265c7
mov eax, dword [0x1f083794]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [esp + 0x20]
push ecx
push str.Error_creating_watching_thread_for_Process_Id__s
push 0x208
lea edx, [esp + 0x2fc]
push edx
jmp 0x1f02643c
mov eax, dword [0x1f083794]
cmp eax, ebx
je 0x1f026425
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x20]
push eax
push str.Error_opening_named_events_for_Process_Id__s
push 0x208
lea ecx, [esp + 0x2fc]
push ecx
call fcn.1f03e8e1
push ebx
call fcn.1f024510
push 0x1f083770
call fcn.1f029f80
add esp, 0x18
xor eax, eax
jmp 0x1f0265cc
mov eax, dword [0x1f083794]
cmp eax, ebx
je 0x1f02646b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x20]
push edx
push str.Error_Allocating_Tls_for_Process_Id__s
lea eax, [esp + 0x2f8]
push 0x208
push eax
call fcn.1f03e8e1
mov eax, dword [0x1f0837c0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
add esp, 0x10
cmp eax, 0xffffffff
je 0x1f02649d
push eax
call esi
mov eax, dword [0x1f0837c4]
cmp eax, 0xffffffff
je 0x1f0264aa
push eax
call esi
mov eax, dword [0x1f0837c8]
cmp eax, 0xffffffff
je 0x1f0264b7
push eax
call esi
mov ecx, dword [0x1f083720]
cmp ecx, ebx
je 0x1f0264ec
push 0x3e8
push ebx
call fcn.1f009930
mov ecx, dword [0x1f083720]
mov esi, ecx
cmp ecx, ebx
je 0x1f0264e6
call fcn.1f0093a0
push esi
call fcn.1f03e80c
add esp, 4
mov dword [0x1f083720], ebx
xor eax, eax
jmp 0x1f0265cc
mov dword [0x1f0837d4], 1
cmp dword [0x1f0837a0], ebx
je 0x1f0265c7
mov eax, dword [0x1f083798]
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, ebx
je 0x1f02651b
push eax
call esi
push ebx
call fcn.1f024510
mov ecx, dword [0x1f083770]
add esp, 4
push ecx
call esi
push 0x1f083770
call fcn.1f029f80
mov edx, dword [0x1f0837b0]
mov esi, dword [sym.imp.KERNEL32.dll_HeapDestroy]
add esp, 4
push edx
call esi
mov eax, dword [0x1f0837b4]
push eax
call esi
mov ecx, dword [0x1f0837b8]
push ecx
call esi
mov edx, dword [0x1f0837e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1f0837bc]
push eax
call esi
mov eax, dword [0x1f0837d0]
cmp eax, ebx
je 0x1f02658e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x1f0837d0], ebx
mov eax, dword [0x1f0837cc]
cmp eax, ebx
je 0x1f0265ad
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x1f0837cc], ebx
mov ecx, dword [0x1f083710]
cmp ecx, ebx
je 0x1f0265c7
mov esi, ecx
call fcn.1f02a000
push esi
call fcn.1f03e80c
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x700]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6fc
ret 0xc