Function at 0x19800
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
mov ebp, dword [esp + 0xe0]
push esi
push edi
mov edi, edx
mov ebx, ecx
lea ecx, [edi - 0x7801]
cmp ecx, 0x48
ja case.0x1982b.30725
movzx ecx, byte [ecx + 0x1b348]
jmp dword [ecx*4 + 0x1b2a4]
push ebp
lea edx, [esp + 0x58]
call fcn.0002c3b0
mov edi, dword [esp + 0xf0]
mov ebx, 1
mov dword [edi], 0
mov dword [edi + 4], 0
cmp dword [ebp + 0xbc8], ebx
jne 0x1b20f
push edi
mov esi, ebp
call fcn.0001c090
test al, al
jne 0x1b20f
test byte [esp + 0x68], 2
mov edx, dword [esp + 0x54]
mov dword [edi], edx
je 0x19881
or dword [edi + 4], ebx
and dword [esp + 0x68], 0xfffffffd
lea ecx, [esp + 0x54]
mov edx, ebp
mov dword [esp + 0x54], 0
call fcn.0002c390
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xd4
ret 0xc
mov ecx, ebp
call fcn.0002b7a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xec]
mov eax, dword [eax]
cmp eax, 1
mov dword [esp + 0x28], eax
je 0x198f0
test eax, eax
je 0x198f0
cmp eax, 2
je 0x198f0
cmp eax, 3
je 0x198f5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
cmp eax, 3
jne 0x1992a
push ebp
lea edx, [esp + 0x58]
call fcn.0002c3b0
cmp dword [esp + 0x54], 0
je 0x19921
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0x232f0c
push edx
call sub.WIN32K.SYS_EngDeviceIoControl
mov eax, 1
mov dword [esp + 0x28], eax
mov dword [ebp + 0xbc8], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 4
lea ecx, [esp + 0x38]
push ecx
push 0x232f14
jmp 0x1a937
mov eax, dword [esp + 0xec]
mov ecx, dword [eax]
xor edx, edx
sub ecx, edx
je 0x19987
sub ecx, 1
je 0x1997a
mov eax, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [eax + 0x10], edx
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov ebx, dword [esp + 0xf0]
mov dword [esp + 0x24], edx
jmp 0x199a1
mov ebx, dword [esp + 0xf0]
mov ecx, 0x47
mov esi, eax
mov edi, ebx
mov dword [esp + 0x24], 1
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x10], 1
mov ecx, dword [eax + 4]
cmp ecx, 4
je 0x19d1d
cmp ecx, 8
je 0x19c8c
cmp ecx, 0xb
je 0x199d7
pop edi
pop esi
pop ebp
mov dword [ebx + 0x10], edx
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [esp + 0x24], edx
je 0x19bb7
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov ecx, dword [ebp + 0x228]
mov dword [ebx + 0x1c], ecx
mov eax, dword [ebp + 0x22c]
mov dword [ebx + 0x20], eax
mov ecx, dword [ebp + 0xb84]
mov dword [ebx + 8], ecx
mov eax, dword [ebp + 0xb88]
mov dword [ebx + 0x28], eax
mov ecx, dword [ebp + 0xb74]
mov dword [ebx + 0x34], ecx
mov eax, dword [ebp + 0xb78]
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebp + 0xaf8], edx
mov dword [esp + 0x10], eax
jbe 0x19a4e
jmp 0x19a30
mov ecx, dword [ebp + eax*4 + 0xb50]
mov dword [ebx + eax*4 + 0x2c], ecx
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [ebp + 0xaf8]
mov dword [esp + 0x10], eax
jb 0x19a30
xor eax, eax
cmp dword [ebp + 0xaf8], edx
mov dword [esp + 0x10], eax
jbe 0x19d2c
mov ecx, eax
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp + 0xb08]
shl eax, 5
mov dword [eax + ebx + 0x70], ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp + 0xb0c]
shl eax, 5
mov dword [eax + ebx + 0x74], ecx
mov eax, dword [esp + 0x10]
lea ecx, [eax + 0xb1]
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp]
shl eax, 5
mov dword [eax + ebx + 0x78], ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp + 0xb14]
shl eax, 5
mov dword [eax + ebx + 0x7c], ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
lea eax, [eax + eax*2 + 3]
shl ecx, 4
mov ecx, dword [ecx + ebp + 0xb28]
shl eax, 5
mov dword [eax + ebx], ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp + 0xb2c]
shl eax, 5
mov dword [eax + ebx + 0x64], ecx
mov eax, dword [esp + 0x10]
lea ecx, [eax + 0xb3]
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp]
shl eax, 5
mov dword [eax + ebx + 0x68], ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
lea eax, [eax + eax*2]
shl ecx, 4
mov ecx, dword [ecx + ebp + 0xb34]
shl eax, 5
mov dword [eax + ebx + 0x6c], ecx
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + eax*4 + 0xb6c]
shl ecx, 5
mov dword [ecx + ebx + 0x3c], eax
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + eax*4 + 0xb7c]
shl ecx, 5
mov dword [ecx + ebx + 0x44], eax
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 0x230]
shl ecx, 5
mov dword [ecx + ebx + 0x50], eax
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + eax*4 + 0xb00]
shl ecx, 5
mov dword [ecx + ebx + 0x54], eax
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*2]
shl ecx, 5
mov dword [ecx + ebx + 0x58], edx
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
shl eax, 5
mov dword [eax + ebx + 0x5c], edx
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [ebp + 0xaf8]
mov dword [esp + 0x10], eax
jb 0x19a60
jmp 0x19d2c
mov edx, eax
mov ebx, ebp
call fcn.0002b6a0
test al, al
jne 0x19be4
mov ecx, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [ecx + 0x10], 0
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xec]
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 8]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x2c]
lea ecx, [ecx + ecx*2]
shl ecx, 5
mov dword [esp + 0x54], edx
mov ecx, dword [ecx + eax + 0x3c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x30]
cmp ecx, 2
jae 0x19c26
test edx, edx
je 0x19c26
lea edx, [ecx + ecx*2]
shl edx, 5
mov eax, dword [edx + eax + 0x3c]
mov dword [esp + 0x60], eax
jmp 0x19c2e
mov dword [esp + 0x60], 0
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0x64]
push eax
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp + 8]
push 0x232ee0
push ecx
mov dword [esp + 0x34], 0x780f
mov dword [esp + 0x38], 0x18
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x1b137
mov edx, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [edx + 0x10], 0
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [esp + 0x24], edx
je 0x1b137
xor ecx, ecx
cmp dword [ebp + 0xaf8], edx
mov dword [esp + 0x10], ecx
jbe 0x19d2c
jmp 0x19cb0
lea eax, [ecx*8]
sub eax, ecx
mov esi, dword [ebx + eax*4 + 0x4c]
cmp esi, edx
lea eax, [ebx + eax*4]
je 0x19cfe
mov edi, dword [ebp + 0xb78]
and edi, esi
cmp edi, esi
jne 0x19cfe
cmp dword [ebp + 0x18], edx
je 0x19d0f
lea edx, [eax + 0x48]
push edx
lea edx, [eax + 0x40]
push edx
mov edx, dword [eax + 0x44]
mov eax, dword [eax + 0x3c]
push edx
push eax
push esi
push ecx
lea edx, [ecx + 3]
push ebp
mov dword [esp + 0x58], edx
call fcn.0002b130
xor edx, edx
test al, al
je 0x19d14
mov ecx, dword [esp + 0x10]
add ecx, 1
cmp ecx, dword [ebp + 0xaf8]
mov dword [esp + 0x10], ecx
jb 0x19cb0
jmp 0x19d2c
mov dword [ebx + 0x10], edx
jmp 0x19d2c
mov dword [ebx + 0x10], 0
jmp 0x19d2c
mov ecx, dword [esp + 0x24]
push ecx
push ebp
mov ecx, ebx
call fcn.0002c5f0
xor edx, edx
cmp dword [esp + 0x24], edx
je 0x1b137
test byte [ebp + 0xaea], 0x20
je 0x1b137
xor eax, eax
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push 0x10
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
push eax
push edx
push edx
push 0x2320e0
push ecx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], edx
call sub.WIN32K.SYS_EngDeviceIoControl
cmp dword [esp + 0x40], 0
jne 0x1b137
pop edi
pop esi
pop ebp
mov dword [ebx + 8], 0
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp eax, 0xd
jne 0x19db2
mov edi, dword [esp + 0xec]
mov ecx, eax
mov esi, 0x4205c8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x19f7f
push ebp
mov eax, 4
lea ecx, [esp + 0x2c]
mov edx, 0x197b0
mov dword [esp + 0x2c], 0
call fcn.0002bae0
pop edi
xor eax, eax
cmp dword [esp + 0x24], eax
pop esi
pop ebp
setne al
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [ebp + 0xc9c], 0
mov edi, dword [esp + 0xec]
mov eax, dword [edi]
mov dword [esp + 0x10], eax
je 0x19e04
cmp dword [ebp + 0x18], 0
je 0x19eac
test eax, eax
jns 0x19e51
mov ebx, dword [edi + 8]
and ebx, 0xffffff
or ebx, 0x60000000
test eax, 0x1000000
jne 0x19e32
lea eax, [edi + 0x14]
push eax
mov eax, dword [edi + 4]
mov ecx, ebx
mov esi, ebp
call fcn.00017cd0
test eax, eax
je 0x19e4c
mov eax, dword [edi + 4]
lea ecx, [edi + 0x14]
push ecx
mov ecx, ebx
or ecx, 0x80000000
mov esi, ebp
call fcn.00017cd0
test eax, eax
jne 0x19e51
and byte [esp + 0x13], 0x7f
test byte [edi + 3], 0x40
je 0x19e85
movzx edx, word [edi + 0xe]
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
and ecx, 0xffffff
push edx
or ecx, 0x20000000
mov esi, ebp
call fcn.00018330
test eax, eax
jne 0x19e85
mov ebx, dword [esp + 0x10]
and ebx, 0xbfffffff
jmp 0x19e89
mov ebx, dword [esp + 0x10]
test byte [edi + 3], 0x20
je 0x19eaa
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 8]
mov esi, ebp
call fcn.000184d0
test eax, eax
jne 0x19eaa
and ebx, 0xdfffffff
mov eax, ebx
pop edi
pop esi
pop ebp
and eax, 0xe0000000
pop ebx
add esp, 0xd4
ret 0xc
mov ebx, dword [esp + 0xec]
mov edi, dword [esp + 0xf0]
mov ecx, 0x185
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 8]
mov ecx, dword [ebx]
and eax, 0xffffff
or eax, 0x60000000
test ecx, 0x1000000
je 0x19ef1
or eax, 0x80000000
test ecx, ecx
mov esi, dword [esp + 0xf0]
mov edi, ecx
mov dword [esp + 0x24], edi
jns 0x19f1e
mov edx, dword [ebx + 4]
lea ecx, [esi + 0x14]
push ecx
mov ecx, ebp
call fcn.00018070
test eax, eax
jne 0x19f1e
and edi, 0x7fffffff
mov dword [esp + 0x24], edi
test byte [ebx + 3], 0x40
je 0x19f53
mov eax, dword [ebx + 8]
and eax, 0xffffff
lea edi, [esp + 0x30]
mov ecx, ebp
call fcn.00018430
test eax, eax
jne 0x19f40
and byte [esp + 0x27], 0xbf
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov word [esi + 0xe], ax
shr eax, 0x10
mov word [esi + 0xc], ax
test byte [ebx + 3], 0x20
je 0x19f71
mov ecx, dword [ebx + 8]
lea edx, [esi + 0x10]
push edx
mov eax, ebp
call fcn.00018570
test eax, eax
jne 0x19f71
and edi, 0xdfffffff
test edi, 0xe0000000
mov dword [esi], edi
je case.0x1982b.30725
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov edx, dword [esp + 0xf0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push ebx
push edx
push eax
mov eax, dword [esp + 0xfc]
push eax
push 0x232fd0
push ecx
call sub.WIN32K.SYS_EngDeviceIoControl
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
add eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov ecx, dword [esp + 0xf0]
xor edx, edx
mov eax, ecx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov edx, dword [ebp + 0xbb8]
sub edx, 0
mov eax, 1
je 0x1a00b
sub edx, eax
jne 0x1a011
mov dword [ecx], 0x7f
jmp 0x1a011
mov dword [ecx], 4
mov edx, dword [ebp + 0xbbc]
mov dword [ecx + 4], edx
test byte [ebp + 0xbc0], al
je 0x1a02d
cmp dword [ebp + 0xbbc], eax
jne 0x1a02d
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0xae8]
test dl, 0x40
je 0x1a03d
mov dword [ecx + 8], eax
jmp 0x1a057
test dl, 0x10
je 0x1a04b
mov dword [ecx + 8], 2
jmp 0x1a057
test dl, 0x20
je 0x1a057
mov dword [ecx + 8], 4
test byte [ebp + 0xae9], 0x10
je 0x1a064
or byte [ecx + 9], 1
cmp dword [ebp + 0xc9c], 0
je 0x1a085
pop edi
pop esi
mov edx, 2
pop ebp
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
pop ebx
add esp, 0xd4
ret 0xc
pop edi
pop esi
pop ebp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xec]
mov eax, dword [eax]
test eax, eax
je 0x1a0c7
cmp eax, 4
je 0x1a0bd
cmp eax, 0x7f
jne 0x1a2e2
mov dword [esp + 0x28], 1
jmp 0x1a0cf
mov dword [esp + 0x28], 0
jmp 0x1a0cf
mov dword [esp + 0x28], 2
push ebp
mov edx, 0x80000004
lea ecx, [esp + 0x2c]
mov eax, 0x197d8
call fcn.0002bb30
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov edi, dword [esp + 0xf0]
xor ecx, ecx
cmp edi, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], ecx
je 0x1a114
cmp ebx, ecx
je 0x1a17a
jmp 0x1a118
cmp ebx, ecx
jne 0x1a17a
mov edx, dword [esp + 0xec]
mov esi, dword [edx]
test dword [ebp + 0xb78], esi
mov dword [esp + 0x24], esi
je 0x1a17a
cmp esi, ecx
je 0x1a17a
lea eax, [esi - 1]
test esi, eax
jne 0x1a17a
mov edx, dword [ebp + 0xafc]
xor eax, eax
cmp edx, ecx
jbe 0x1a176
lea ecx, [ebp + 0xb50]
lea ebx, [ebx]
mov edi, dword [ecx]
cmp dword [ebp + edi*4 + 0xb6c], esi
mov dword [esp + 0x28], edi
je 0x1a16d
add eax, 1
add ecx, 4
cmp eax, dword [ebp + 0xafc]
jb 0x1a150
mov edi, dword [esp + 0xf0]
xor ecx, ecx
cmp eax, edx
jne 0x1a18c
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0xd4
ret 0xc
cmp edi, ecx
je 0x1a197
shr ebx, 4
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x10]
push ecx
mov edx, ecx
push edx
mov eax, ecx
push eax
push ecx
push edx
mov edx, dword [ebp + 8]
push eax
lea ecx, [esp + 0x54]
push ecx
mov esi, eax
call fcn.00010770
test eax, eax
je 0x1a294
xor esi, esi
test eax, eax
jbe 0x1a294
mov ecx, dword [esp + 0x3c]
lea edx, [edi + 6]
add ecx, 4
mov edi, dword [esp + 0x24]
test dword [ecx + 0x14], edi
je 0x1a27a
test dword [ecx + 0x10], edi
je 0x1a27a
mov ebx, dword [esp + 0x28]
test dword [ecx + ebx*4 + 0x18], edi
je 0x1a27a
cmp dword [ebp + 0xb84], 0
je 0x1a203
cmp dword [ecx + 0x20], 0
je 0x1a27a
mov ebx, dword [ecx - 4]
test bl, 6
jne 0x1a27a
test byte [ebp + 0x244], 3
je 0x1a223
cmp word [ecx], 0x280
jb 0x1a27a
cmp word [ecx + 2], 0x1e0
jb 0x1a27a
lea edi, [edx - 6]
test edi, edi
je 0x1a275
mov edi, dword [esp + 0x38]
cmp edi, dword [esp + 0x30]
jae 0x1a288
test bl, 8
je 0x1a246
movzx edi, word [ecx + 2]
mov word [edx - 2], di
movzx edi, word [ecx]
jmp 0x1a251
movzx edi, word [ecx]
mov word [edx - 2], di
movzx edi, word [ecx + 2]
mov word [edx], di
movzx edi, word [ecx + 4]
mov word [edx + 2], di
movzx edi, word [ecx + 6]
mov word [edx + 4], di
mov edi, dword [esp + 0x24]
mov dword [edx - 6], edi
mov dword [edx + 6], 0
add edx, 0x10
add dword [esp + 0x38], 1
add esi, 1
add ecx, 0x40
cmp esi, eax
jb 0x1a1d0
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x198e3
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x1a2f2
test ebx, ebx
je 0x1a2f6
lea edx, [esp + 0x14]
push edx
mov edx, dword [ebp + 8]
push 4
mov dword [esp + 0x38], eax
lea eax, [esp + 0x44]
push eax
push 8
lea ecx, [esp + 0x40]
push ecx
push 0x233000
push edx
mov dword [esp + 0x50], ebx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x1a308
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xd4
ret 0xc
test ebx, ebx
je 0x1a2b5
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov edx, dword [esp + 0xec]
mov ecx, dword [edx]
xor esi, esi
sub ecx, esi
je 0x1a355
mov edi, 1
sub ecx, edi
je 0x1a34a
mov eax, dword [esp + 0xf0]
mov dword [eax + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov ebx, dword [esp + 0xf0]
xor eax, eax
jmp 0x1a370
mov ebx, dword [esp + 0xf0]
mov ecx, 0x47
mov esi, edx
mov edi, ebx
mov eax, 1
rep movsd dword es:[edi], dword [esi]
mov edi, eax
xor esi, esi
cmp dword [edx + 4], 0xb
jne 0x1a3c0
cmp dword [ebp + 0xb84], edi
je 0x1a3c0
cmp eax, esi
je 0x1a3bb
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x14]
push ecx
push 0x11c
push ebx
push esi
push esi
push 0x232ff8
push edx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x1a44d
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ebx + 0x10], 0
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [edx + 8], edi
je 0x1a3d2
mov eax, edi
pop edi
mov dword [ebx + 0x10], esi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [edx + 0x2c]
lea ecx, [eax + eax*2]
shl ecx, 5
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], esi
mov edx, dword [ecx + edx + 0x3c]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp + 0x60], edx
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], 0x780f
mov dword [esp + 0x1c], 0x18
mov edx, dword [ebp + ecx*4 + 0xb6c]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0xc
mov dword [esp + 0x6c], edx
lea edx, [esp + 0x28]
push edx
push 0x232ee0
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x1a44d
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ebx + 0x10], 0
pop ebx
add esp, 0xd4
ret 0xc
mov dword [ebx + 0x10], edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xec]
mov ecx, ebp
call fcn.0002bde0
test eax, eax
je 0x19f7f
mov edi, dword [esp + 0xf0]
mov esi, eax
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov ecx, dword [esp + 0xec]
mov edi, dword [ecx]
cmp edi, 1
ja case.0x1982b.30725
push edi
mov esi, ebp
call fcn.0002bbb0
xor esi, esi
cmp dword [ebp + 0xc9c], esi
je 0x1b137
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xd0]
push 8
lea edx, [esp + 0x40]
push edx
push eax
mov eax, dword [ebp + 0xa4]
mov edx, 0x1000054
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], esi
call fcn.000353e0
add esp, 0xc
cmp edi, esi
jne 0x1b137
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xa4]
push 8
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [ebp + 0xd0]
push edx
mov edx, 0x1000053
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], esi
call fcn.000353e0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov edx, ebp
call fcn.0002bb70
mov ecx, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
push ebp
lea edx, [esp + 0x58]
call fcn.0002c3b0
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0xf0]
or dword [esp + 0x68], 1
mov dword [eax], edx
lea ecx, [esp + 0x54]
mov edx, ebp
mov dword [esp + 0x64], 0
call fcn.0002c390
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov ecx, dword [esp + 0xec]
mov ebx, dword [ecx]
xor edi, edi
cmp dword [ebp + 0xc9c], edi
je 0x1a5b7
mov esi, ebp
call fcn.0003c9c0
test eax, eax
je 0x1a5b7
mov edi, 1
mov edx, dword [esp + 0xf0]
mov dword [edx], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [ebp + 0xc9c], 0
je 0x1b137
mov edi, dword [esp + 0xec]
mov ebx, dword [edi + 8]
mov esi, ebp
call fcn.0002cee0
cmp dword [edi + 0x10], 0
mov ebx, eax
je 0x1a645
call fcn.00010550
call fcn.00032fc0
test bl, 1
je 0x1a612
mov eax, dword [edi]
push eax
push ebp
xor eax, eax
call fcn.0003a330
test bl, 2
je 0x1a69c
mov ecx, dword [edi]
push ecx
push ebp
mov eax, 1
call fcn.0003a330
call fcn.00032fd0
call fcn.00010560
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp ebx, 3
jne 0x1a662
cmp dword [edi], 0
je 0x1a662
mov edx, dword [ebp + 0xca0]
test byte [edx + 0x2dc], 0x10
je 0x1b137
call fcn.00010550
call fcn.00032fc0
test bl, 1
je 0x1a684
mov eax, dword [edi + 0xc]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
push eax
push 0
push ecx
push edx
push ebp
call fcn.00039e70
test bl, 2
je 0x1a69c
mov eax, dword [edi + 0xc]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
push eax
push 1
push ecx
push edx
push ebp
call fcn.00039e70
call fcn.00032fd0
call fcn.00010560
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [ebp + 0xc9c], 0
je 0x1b137
cmp dword [ebp + 0xd10], 0
je 0x1b137
call fcn.00032fc0
mov eax, dword [esp + 0xec]
cmp dword [eax], 2
jne 0x1b132
mov eax, ebp
call fcn.0002e840
call fcn.00032fd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
push ebp
lea edx, [esp + 0x58]
call fcn.0002c3b0
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0xf0]
mov dword [edx], ecx
lea ecx, [esp + 0x54]
mov edx, ebp
mov dword [esp + 0xac], 0
call fcn.0002c390
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
push ebp
lea edx, [esp + 0x58]
call fcn.0002c3b0
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
mov dword [eax + 4], 0
mov dword [eax], ecx
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xf0]
xor edx, edx
cmp dword [ebp + 0x18], edx
pop edi
sete dl
pop esi
pop ebp
pop ebx
mov dword [eax], edx
mov eax, 1
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xec]
mov eax, dword [esi]
lea ecx, [eax - 1]
xor ecx, eax
and ecx, eax
cmp eax, ecx
jne case.0x1982b.30725
mov edi, ebp
call fcn.00042c60
cmp dword [ebp + 0xc9c], 0
je 0x1a806
call fcn.00032fc0
mov ebx, dword [esi]
mov esi, ebp
call fcn.0003c9c0
test eax, eax
je 0x1a7ff
mov edx, dword [esp + 0xec]
mov eax, dword [edx + 4]
and eax, 0xf
cmp eax, 2
je 0x1a7ff
cmp eax, 1
je 0x1a7ff
call fcn.00032fd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xec]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
mov eax, ebp
call fcn.0003fa60
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 2
push ebp
call fcn.0002c3f0
cmp dword [ebp + 0xc9c], 0
jmp 0x1b130
cmp dword [ebp + 0x18], 0
jne 0x1a86f
push ebp
lea edx, [esp + 0x58]
call fcn.0002c3b0
cmp dword [esp + 0x54], 0
je case.0x1982b.30725
and dword [esp + 0x68], 0xfffffffd
lea ecx, [esp + 0x54]
mov edx, ebp
mov dword [esp + 0x54], 0
call fcn.0002c390
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd4
ret 0xc
mov esi, ebp
call fcn.0002b730
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov edx, dword [esp + 0xec]
cmp dword [edx], 0
je 0x1a8be
mov esi, ebp
call fcn.000402c0
test eax, eax
jne 0x1a8be
mov edx, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [edx], 1
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
push 1
push ebp
call fcn.00040570
mov ecx, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
xor edx, edx
cmp dword [ebp + 0x18], edx
mov byte [esp + 0x2f], 0
je case.0x1982b.30725
mov esi, dword [esp + 0xec]
mov ecx, dword [esi]
cmp ecx, 2
je 0x1aac0
cmp ecx, 3
je 0x1aac0
cmp ecx, 0xffffffff
je 0x1a954
lea edx, [esp + 0x14]
push edx
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xf8]
push eax
push 0xc
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], esi
push 0x232ee0
mov edx, dword [ebp + 8]
push edx
call sub.WIN32K.SYS_EngDeviceIoControl
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
add eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [ebp + 0xb8c], edx
jne 0x1a9b7
test byte [ebp + 0xae0], 6
je 0x1a9a4
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
push 0x14
lea ecx, [esp + 0xd8]
push ecx
push 0xc
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
lea edx, [esp + 0x28]
push edx
push 0x232ee0
push eax
mov dword [esp + 0x34], 0x7823
call sub.WIN32K.SYS_EngDeviceIoControl
xor edx, edx
test eax, eax
jne 0x1a9a4
mov byte [esp + 0x2f], 1
cmp dword [ebp + 0xb8c], edx
jne 0x1a9b7
cmp byte [esp + 0x2f], 0
je case.0x1982b.30725
mov eax, dword [ebp + 0xae0]
mov ebx, eax
and ebx, 2
je 0x1a9ce
cmp dword [esi + 8], edx
jne 0x1a9e4
cmp dword [esi + 4], edx
jne 0x1a9e4
test al, 4
je 0x1b137
cmp dword [esi + 0x10], edx
jne 0x1a9e4
cmp dword [esi + 0xc], edx
je 0x1b137
mov eax, dword [ebp + 0xb54]
mov dword [esp + 0x28], eax
shl eax, 4
cmp ebx, edx
lea ecx, [eax + ebp]
je 0x1aa14
mov eax, dword [ecx + 0xb10]
mov edi, dword [esi + 8]
sub eax, dword [ecx + 0xb08]
cmp edi, edx
je 0x1aa0f
mov edx, edi
jmp 0x1aa3a
mov edx, dword [esi + 4]
jmp 0x1aa2e
mov eax, dword [ecx + 0xb14]
mov edi, dword [esi + 0x10]
sub eax, dword [ecx + 0xb0c]
cmp edi, edx
je 0x1aa2b
mov edx, edi
jmp 0x1aa3a
mov edx, dword [esi + 0xc]
imul edx, eax
shr edx, 0x10
and edx, 0xfff8
cmp edx, eax
jge case.0x1982b.30725
mov esi, eax
sub esi, edx
add eax, esi
test ebx, ebx
je 0x1aa86
mov dword [ecx + 0xb10], eax
mov dword [ecx + 0xb08], esi
mov dword [ecx + 0xb30], eax
mov dword [ecx + 0xb28], esi
mov ecx, dword [esp + 0x28]
push 0
push ecx
xor eax, eax
mov ecx, ebp
call fcn.0003dfa0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov dword [ecx + 0xb14], eax
mov dword [ecx + 0xb0c], esi
mov dword [ecx + 0xb34], eax
mov dword [ecx + 0xb2c], esi
mov ecx, dword [esp + 0x28]
push 0
push ecx
xor eax, eax
mov ecx, ebp
call fcn.0003dfa0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
push edx
mov edx, dword [ebp + 8]
push 0x14
lea eax, [esp + 0xd8]
push eax
push 0xc
lea ecx, [esp + 0x28]
push ecx
push 0x232ee0
push edx
xor ebx, ebx
mov dword [esp + 0x34], 0x7823
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne case.0x1982b.30725
cmp dword [esp + 0xd0], eax
je 0x19f7f
cmp dword [esi], 3
mov edi, dword [ebp + 0xb54]
jne 0x1ab2a
mov ebx, dword [esp + 0xd8]
mov edx, dword [esp + 0xe0]
jmp 0x1ab2e
mov edx, dword [esp + 0x3c]
mov eax, edi
shl eax, 4
add eax, ebp
test byte [ebp + 0xae0], 2
je 0x1ab5a
mov esi, dword [eax + 0xb0c]
lea ecx, [edi + 0xb1]
shl ecx, 4
mov ecx, dword [ecx + ebp]
sub ecx, dword [eax + 0xb08]
sub ecx, ebx
jmp 0x1ab6e
mov esi, dword [eax + 0xb14]
sub esi, dword [eax + 0xb0c]
mov ecx, dword [eax + 0xb08]
sub esi, edx
movzx eax, byte [ebp + 0x19b]
test al, 8
mov edx, 3
jne 0x1ab84
mov edx, dword [ebp + 0x238]
mov ebx, eax
and bl, 4
neg bl
push 0
sbb ebx, ebx
imul ecx, edx
neg ebx
add ebx, 1
imul ebx, dword [ebp + 0x174]
imul ebx, esi
and al, 2
add ebx, ecx
neg al
sbb eax, eax
neg eax
add eax, 1
imul ebx, eax
add ebx, dword [ebp + 0x1a4]
mov eax, ebx
push eax
mov dword [ebp + edi*4 + 0xb48], eax
push edi
mov eax, ebp
call fcn.0003de80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [ebp + 0xbe4], 0
je case.0x1982b.30725
mov edx, dword [esp + 0xf0]
mov esi, dword [esp + 0xec]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push ebx
push edx
push 0xc
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push 0x232ee0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], esi
call sub.WIN32K.SYS_EngDeviceIoControl
mov ecx, dword [esi]
neg eax
sbb eax, eax
add eax, 1
test ecx, ecx
jns 0x1ac3f
mov edi, ebp
call fcn.000405b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
test ecx, 0x800000
je 0x198e3
mov edx, dword [esi + 0x70]
push edx
mov eax, ebp
call fcn.0002e6a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xf0]
push 0
push ebx
push eax
mov ebx, ebp
call fcn.0002c9b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov ecx, dword [esp + 0xec]
push 1
push eax
push ecx
mov ebx, ebp
call fcn.0002c9b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xf0]
mov ecx, dword [esp + 0xec]
xor edx, edx
mov eax, esi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov edx, dword [ecx]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push 0x24
mov dword [esp + 0x58], edx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x58]
push 0xc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0x232ee0
push ecx
mov dword [esp + 0x68], 4
mov dword [esp + 0x34], 0x782e
mov dword [esp + 0x38], 8
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne case.0x1982b.30725
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esi], edx
mov edx, dword [esp + 0x6c]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x74]
pop edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], ecx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov edx, dword [esp + 0xf0]
xor eax, eax
mov dword [edx], 1
mov ecx, 0x17
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xec]
mov ecx, dword [eax + 4]
mov dword [esp + 0x5c], ecx
add eax, 8
mov esi, eax
mov dword [esp + 0x54], 4
mov ecx, 8
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov ecx, 8
lea edi, [esp + 0x88]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
push 0xc
lea edx, [esp + 0x28]
lea eax, [esp + 0x64]
push edx
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
push 0x232ee0
push eax
mov dword [esp + 0x34], 0x7829
mov dword [esp + 0x38], 0x5c
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x19f7f
mov edi, dword [esp + 0xf0]
cmp dword [edi], eax
jne 0x19f7f
mov esi, ebp
call fcn.000402c0
test eax, eax
je 0x1b137
push 1
push ebp
call fcn.00040570
mov dword [edi], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xf0]
lea edx, [esp + 0x14]
push edx
push ebx
push esi
push 0xc
lea ecx, [esp + 0x5c]
lea eax, [esp + 0x28]
push eax
mov dword [esi], 1
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp + 8]
push 0x232ee0
mov dword [esp + 0x64], 5
push ecx
mov dword [esp + 0x34], 0x7829
mov dword [esp + 0x38], 8
call sub.WIN32K.SYS_EngDeviceIoControl
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xec]
mov edx, dword [esi]
xor eax, eax
mov ecx, 0x1f
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push 0x7c
lea eax, [esp + 0x5c]
mov dword [esp + 0xcc], edx
mov edx, eax
push edx
push 0xc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0x232ee0
xor edi, edi
push ecx
mov dword [esp + 0x70], 3
mov dword [esp + 0xe4], 6
mov dword [esp + 0xe8], edi
mov dword [esp + 0x34], 0x782e
mov dword [esp + 0x38], 0x7c
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne case.0x1982b.30725
cmp dword [esp + 0x58], edi
jne case.0x1982b.30725
mov edx, dword [esi]
mov ecx, dword [esp + 0xf0]
mov ax, word [esp + 0x68]
mov dword [ecx + 4], edx
mov dx, word [esp + 0x6a]
mov word [ecx + 0xc], ax
mov eax, dword [esp + 0x80]
mov word [ecx + 0xe], dx
lea edx, [eax + 0x1f4]
mov eax, 0x10624dd3
mul edx
mov dword [ecx + 8], edi
mov word [ecx + 0x10], di
shr edx, 6
mov word [ecx + 0x12], dx
lea edi, [ecx + 0x14]
mov ecx, 8
lea esi, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xf0]
lea ecx, [esp + 0x14]
push ecx
push ebx
push esi
push 0xc
lea eax, [esp + 0x5c]
lea edx, [esp + 0x28]
push edx
mov dword [esi], 1
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
push 0x232ee0
mov dword [esp + 0x64], 6
mov dword [esp + 0x68], 0
push eax
jmp 0x1ae4b
mov eax, dword [esp + 0xec]
mov di, word [eax + 8]
test di, di
je 0x1b149
mov si, word [eax + 0xa]
test si, si
je 0x1b149
mov dx, word [eax + 0xe]
test dx, dx
je 0x1b149
mov cx, word [eax + 0xc]
test cx, cx
je 0x1b149
mov eax, dword [eax]
test eax, eax
je 0x1b149
lea ebx, [eax - 1]
test eax, ebx
jne 0x1b149
xor ebx, ebx
cmp dword [ebp + 0xc9c], ebx
mov word [esp + 0x58], di
mov word [esp + 0x5a], si
mov word [esp + 0x5c], cx
mov word [esp + 0x5e], dx
mov dword [esp + 0x54], eax
mov dword [esp + 0xa4], ebx
je 0x1b01e
call fcn.00032fc0
or dword [esp + 0xa4], 0x20
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push 0x54
lea edx, [esp + 0x5c]
push edx
push 0x54
mov eax, edx
push eax
push 0x232fec
push ecx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x1b053
mov edx, dword [esp + 0xf0]
mov dword [edx], 1
jmp 0x1b12a
xor edx, edx
cmp dword [ebp + 0xafc], ebx
jbe 0x1b0f3
mov esi, dword [esp + 0x54]
lea edi, [ebp + 0xb50]
mov ecx, edi
lea ecx, [ecx]
mov eax, dword [ecx]
cmp dword [ebp + eax*4 + 0xb6c], esi
je 0x1b08b
add edx, 1
add ecx, 4
cmp edx, dword [ebp + 0xafc]
jb 0x1b070
jmp 0x1b0f7
mov si, word [esp + 0x58]
mov ecx, dword [esp + 0xec]
cmp si, word [ecx + 8]
jb 0x1b0a8
mov si, word [esp + 0x5a]
cmp si, word [ecx + 0xa]
jae 0x1b0f7
mov ecx, eax
sub ecx, dword [edi]
lea edi, [eax + 0xb3]
neg ecx
sbb ecx, ecx
and ecx, 0xff0000
add ecx, 0x10000
or dword [ebp + 0xaf4], ecx
mov ecx, eax
shl ecx, 4
add ecx, ebp
mov dword [ecx + 0xb28], ebx
mov dword [ecx + 0xb2c], ebx
movzx esi, word [esp + 0x58]
shl edi, 4
mov dword [edi + ebp], esi
movzx esi, word [esp + 0x5a]
mov dword [ecx + 0xb34], esi
jmp 0x1b0f7
mov eax, dword [esp + 0x3c]
cmp edx, dword [ebp + 0xafc]
jb 0x1b10e
mov edx, dword [esp + 0xf0]
mov dword [edx], 1
jmp 0x1b12a
lea ecx, [esp + 0x54]
push ecx
mov ecx, ebp
call fcn.0003fe00
mov edx, dword [esp + 0xf0]
neg eax
sbb eax, eax
add eax, 1
mov dword [edx], eax
cmp dword [ebp + 0xc9c], ebx
je 0x1b137
call fcn.00032fd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xf0]
pop edi
pop esi
pop ebp
mov dword [eax], 3
mov eax, 1
pop ebx
add esp, 0xd4
ret 0xc
mov eax, dword [esp + 0xec]
mov edi, dword [esp + 0xf0]
mov esi, eax
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, ebp
mov ebx, 1
call fcn.00040b00
test eax, eax
mov ecx, dword [esp + 0xf0]
mov dword [ecx + 4], eax
jne 0x1b20f
push 2
push ebp
call fcn.00040570
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xd4
ret 0xc
mov esi, dword [esp + 0xec]
mov edx, ebp
call fcn.00040b30
xor ebx, ebx
cmp dword [esi + 4], ebx
pop edi
sete bl
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xd4
ret 0xc
cmp dword [ebp + 0x18], 0
je 0x1b20d
mov edi, dword [esp + 0xec]
mov eax, edi
mov esi, ebp
call fcn.00040be0
cmp dword [edi + 4], 0
jne 0x1b20d
push 2
push ebp
call fcn.00040570
pop edi
pop esi
mov ebx, 1
pop ebp
mov eax, ebx
pop ebx
add esp, 0xd4
ret 0xc
xor ebx, ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xd4
ret 0xc
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xec]
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], eax
xor esi, esi
xor eax, eax
cmp dword [0x520bbc], esi
mov dword [esp + 0x18], edi
jbe 0x1b28b
jmp 0x1b250
test eax, eax
jne 0x1b28b
mov edx, dword [esp + 0xf0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x520bb8]
push ebx
push edx
mov edx, dword [ecx + esi*4]
push 0xc
lea eax, [esp + 0x28]
push eax
mov eax, dword [edx + 8]
push 0x232ee0
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
add esi, 1
cmp esi, dword [0x520bbc]
jb 0x1b250
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 0xd4
ret 0xc