Function at 0x1001e6a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], ebx
push edi
cmp ebx, 0x1240
je 0x1001e6e0
cmp ebx, 0x1241
je 0x1001e6e0
cmp ebx, 0x1242
je 0x1001e6e0
cmp ebx, 0x11fc
je 0x1001e6e0
cmp ebx, 0x11fd
je 0x1001e6e0
cmp ebx, 0xffffff9d
jne 0x1001e6e6
or dword [0x1006ef0c], esi
cmp ebx, 0x1250
je 0x1001e70b
cmp ebx, 0x1251
je 0x1001e70b
cmp ebx, 0x1252
je 0x1001e70b
cmp ebx, 0x1253
je 0x1001e70b
cmp ebx, 0xffffff9d
jne 0x1001e711
or dword [0x1006ef10], esi
cmp ebx, 0x1200
je 0x1001e74e
cmp ebx, 0x1201
je 0x1001e74e
cmp ebx, 0x1202
je 0x1001e74e
cmp ebx, 0x1203
je 0x1001e74e
cmp ebx, 0x1204
je 0x1001e74e
cmp ebx, 0x1205
je 0x1001e74e
cmp ebx, 0x1206
je 0x1001e74e
cmp ebx, 0xffffff9d
jne 0x1001e754
or dword [0x1006ef00], esi
mov eax, 0x12aa
lea ecx, [eax - 1]
cmp ebx, 0x1210
je 0x1001e81d
cmp ebx, 0x1211
je 0x1001e81d
cmp ebx, 0x1212
je 0x1001e81d
cmp ebx, 0x1213
je 0x1001e81d
cmp ebx, 0x1214
je 0x1001e81d
cmp ebx, 0x1215
je 0x1001e81d
cmp ebx, 0x1216
je 0x1001e81d
cmp ebx, 0x1217
je 0x1001e81d
cmp ebx, 0x1218
je 0x1001e81d
cmp ebx, 0x1219
je 0x1001e81d
cmp ebx, 0x121a
je 0x1001e81d
cmp ebx, 0x121b
je 0x1001e81d
cmp ebx, 0x121c
je 0x1001e81d
cmp ebx, 0x121d
je 0x1001e81d
cmp ebx, 0x121e
je 0x1001e81d
cmp ebx, 0x121f
je 0x1001e81d
cmp ebx, 0x1220
je 0x1001e81d
cmp ebx, 0x1221
je 0x1001e81d
cmp ebx, 0x1222
je 0x1001e81d
cmp ebx, 0x1223
je 0x1001e81d
cmp ebx, eax
je 0x1001e81d
cmp ebx, ecx
je 0x1001e81d
cmp ebx, 0xffffff9d
jne 0x1001e823
or dword [0x1006ef04], esi
cmp ebx, 0x12a0
je 0x1001e878
cmp ebx, 0x12a1
je 0x1001e878
cmp ebx, 0x12a2
je 0x1001e878
cmp ebx, 0x12a3
je 0x1001e878
cmp ebx, 0x12a4
je 0x1001e878
cmp ebx, 0x12a5
je 0x1001e878
cmp ebx, 0x12a6
je 0x1001e878
cmp ebx, 0x12a8
je 0x1001e878
cmp ebx, ecx
je 0x1001e878
cmp ebx, eax
je 0x1001e878
cmp ebx, 0x12ab
je 0x1001e878
cmp ebx, 0xffffff9d
jne 0x1001e87e
or dword [0x1006ef20], esi
cmp ebx, 0x1270
je 0x1001ea77
cmp ebx, 0x1271
je 0x1001ea77
cmp ebx, 0x1272
je 0x1001ea77
cmp ebx, 0x1273
je 0x1001ea77
cmp ebx, 0x1274
je 0x1001ea77
cmp ebx, 0x1275
je 0x1001ea77
cmp ebx, 0x1276
je 0x1001ea77
cmp ebx, 0x1277
je 0x1001ea77
cmp ebx, 0x1278
je 0x1001ea77
cmp ebx, 0x1279
je 0x1001ea77
cmp ebx, 0x127a
je 0x1001ea77
cmp ebx, 0x127b
je 0x1001ea77
cmp ebx, 0x127c
je 0x1001ea77
cmp ebx, 0x127d
je 0x1001ea77
cmp ebx, 0x127e
je 0x1001ea77
cmp ebx, 0x127f
je 0x1001ea77
cmp ebx, 0x1280
je 0x1001ea77
cmp ebx, 0x1281
je 0x1001ea77
cmp ebx, 0x1282
je 0x1001ea77
cmp ebx, 0x1284
je 0x1001ea77
cmp ebx, 0x1285
je 0x1001ea77
cmp ebx, 0x1286
je 0x1001ea77
cmp ebx, 0x1287
je 0x1001ea77
cmp ebx, 0x1288
je 0x1001ea77
cmp ebx, 0x1289
je 0x1001ea77
cmp ebx, 0x128a
je 0x1001ea77
cmp ebx, 0x128b
je 0x1001ea77
cmp ebx, 0x128c
je 0x1001ea77
cmp ebx, 0x128d
je 0x1001ea77
cmp ebx, 0x128e
je 0x1001ea77
cmp ebx, 0x128f
je 0x1001ea77
cmp ebx, 0x1290
je 0x1001ea77
cmp ebx, 0x1291
je 0x1001ea77
cmp ebx, 0x1292
je 0x1001ea77
cmp ebx, 0x1293
je 0x1001ea77
cmp ebx, 0x1294
je 0x1001ea77
cmp ebx, 0x1295
je 0x1001ea77
cmp ebx, 0x1296
je 0x1001ea77
cmp ebx, 0x1297
je 0x1001ea77
cmp ebx, 0x1298
je 0x1001ea77
cmp ebx, 0x1299
je 0x1001ea77
cmp ebx, 0x129a
je 0x1001ea77
cmp ebx, 0x129b
je 0x1001ea77
cmp ebx, 0x129c
je 0x1001ea77
cmp ebx, 0x129d
je 0x1001ea77
cmp ebx, 0x129e
je 0x1001ea77
cmp ebx, 0x129f
je 0x1001ea77
cmp ebx, 0xffffff9d
jne 0x1001ea7d
or dword [0x1006ef18], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp ebx, 0x1230
je 0x1001eacb
cmp ebx, 0x1231
je 0x1001eacb
cmp ebx, 0x1232
je 0x1001eacb
cmp ebx, 0x1233
je 0x1001eacb
cmp ebx, 0x1234
je 0x1001eacb
cmp ebx, 0x1235
je 0x1001eacb
cmp ebx, 0x1236
je 0x1001eacb
cmp ebx, 0x1237
je 0x1001eacb
cmp ebx, 0xffffff9d
jne 0x1001eca2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10019415
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x18], edi
jbe 0x1001ec85
mov ebx, dword [ebp - 0x10]
mov esi, edi
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
push str.AuditLookupSubCategoryNameA
push dword [0x10070580]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001eb0d
lea ecx, [ebp - 4]
push ecx
push edi
call eax
push 0xc
push str.File_System
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001eb30
push ebx
sub esp, 0x10
xor ecx, ecx
mov edi, esp
jmp 0x1001ec39
push 9
push str.Registry
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001eb54
push ebx
sub esp, 0x10
xor ecx, ecx
mov edi, esp
inc ecx
jmp 0x1001ec39
push 0xe
push str.Kernel_Object
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001eb77
push ebx
sub esp, 0x10
mov edi, esp
push 2
jmp 0x1001ec38
push 4
push 0x10053b3c
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001eb9a
push ebx
sub esp, 0x10
mov edi, esp
push 3
jmp 0x1001ec38
push 0x17
push str.Certification_Services
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ebba
push ebx
sub esp, 0x10
mov edi, esp
push 4
jmp 0x1001ec38
push 0x16
push str.Application_Generated
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ebda
push ebx
sub esp, 0x10
mov edi, esp
push 5
jmp 0x1001ec38
push 0x14
push str.Handle_Manipulation
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ebfa
push ebx
sub esp, 0x10
mov edi, esp
push 6
jmp 0x1001ec38
push 0xb
push str.File_Share
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ec1a
push ebx
sub esp, 0x10
mov edi, esp
push 7
jmp 0x1001ec38
push 0x1b
push str.Other_Object_Access_Events
push dword [ebp - 4]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ec4e
push ebx
sub esp, 0x10
mov edi, esp
push 0xa
pop ecx
add esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1001ee69
mov esi, dword [ebp - 0xc]
add esp, 0x14
mov edi, dword [ebp - 4]
push str.AuditFree
push dword [0x10070580]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ec69
push edi
call eax
mov eax, dword [ebp - 0x14]
add esi, 0x10
inc eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x18]
jb 0x1001eaec
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push str.AuditFree
push dword [0x10070580]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001eca0
push edi
call eax
xor edi, edi
cmp ebx, 0x1420
je 0x1001ecf3
cmp ebx, 0x1421
je 0x1001ecf3
cmp ebx, 0x1422
je 0x1001ecf3
cmp ebx, 0x1423
je 0x1001ecf3
cmp ebx, 0x1424
je 0x1001ecf3
cmp ebx, 0x1425
je 0x1001ecf3
cmp ebx, 0x1426
je 0x1001ecf3
cmp ebx, 0x1427
je 0x1001ecf3
cmp ebx, 0x1547
je 0x1001ecf3
cmp ebx, 0xffffff9d
jne 0x1001edd9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10019415
cmp dword [ebp - 0x18], 0
jbe 0x1001edbe
mov ebx, dword [ebp - 0x10]
mov esi, edi
mov dword [ebp - 4], esi
mov edi, dword [ebp - 8]
push str.AuditLookupSubCategoryNameA
push dword [0x10070580]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ed33
lea ecx, [ebp - 0xc]
push ecx
push edi
call eax
push 0x1f
push str.Filtering_Platform_Packet_Drop
push dword [ebp - 0xc]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ed53
push ebx
sub esp, 0x10
mov edi, esp
push 8
jmp 0x1001ed71
push 0x1e
push str.Filtering_Platform_Connection
push dword [ebp - 0xc]
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x1001ed87
push ebx
sub esp, 0x10
mov edi, esp
push 9
add esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1001ee69
mov esi, dword [ebp - 4]
add esp, 0x14
mov edi, dword [ebp - 0xc]
push str.AuditFree
push dword [0x10070580]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001eda2
push edi
call eax
mov eax, dword [ebp - 0x1c]
add esi, 0x10
inc eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x18]
jb 0x1001ed12
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push str.AuditFree
push dword [0x10070580]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001edd9
push edi
call eax
cmp ebx, 0x1260
je 0x1001ee46
cmp ebx, 0x1261
je 0x1001ee46
cmp ebx, 0x1262
je 0x1001ee46
cmp ebx, 0x1264
je 0x1001ee46
cmp ebx, 0x1265
je 0x1001ee46
cmp ebx, 0x1266
je 0x1001ee46
cmp ebx, 0x1267
je 0x1001ee46
cmp ebx, 0x1268
je 0x1001ee46
cmp ebx, 0x1269
je 0x1001ee46
cmp ebx, 0x126a
je 0x1001ee46
cmp ebx, 0x126b
je 0x1001ee46
cmp ebx, 0x126c
je 0x1001ee46
cmp ebx, 0x1300
je 0x1001ee46
cmp ebx, 0xffffff9d
jne 0x1001ee4c
or dword [0x1006ef14], esi
cmp ebx, 0x1235
je 0x1001ee59
cmp ebx, 0xffffff9d
jne 0x1001ee5f
or dword [0x1006ef1c], esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret