Function at 0x1a98b78
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov bl, dl
mov edi, ecx
xor dl, dl
mov dword [ebp - 0x10], edi
call fcn.01a99077
xor ecx, ecx
inc ecx
test al, al
je 0x1a98eb9
test bl, bl
jne 0x1a98bb5
test dword [edi + 0x40], 0x20000000
je 0x1a98fbb
and dword [ebp - 0x14], 0
lea ecx, [edi + 0xc0]
mov ebx, dword [ecx]
and dword [ebp - 0x1c], 0
jmp 0x1a98c31
cmp dword [edi + 0x4c], 0
lea esi, [ebx - 8]
je 0x1a98bf2
mov eax, dword [edi + 0x50]
xor dword [esi], eax
mov al, byte [esi + 2]
xor al, byte [esi + 1]
xor al, byte [esi]
cmp byte [esi + 3], al
je 0x1a98bf2
push ecx
mov edx, esi
mov ecx, edi
call fcn.01a915a8
lea ecx, [edi + 0xc0]
movzx eax, word [esi]
mov ebx, dword [ebx]
mov dword [ebp - 8], eax
mov dl, byte [esi + 2]
mov dword [ebp - 0x10], esi
test dl, 1
jne 0x1a98d5e
movzx eax, word [esi]
cmp ax, word [ebp - 0x1c]
jb 0x1a98cfd
cmp dword [edi + 0x4c], 0
mov dword [ebp - 0x1c], eax
je 0x1a98c2e
mov al, byte [esi + 1]
xor al, dl
xor al, byte [esi]
mov byte [esi + 3], al
mov eax, dword [edi + 0x50]
xor dword [esi], eax
inc dword [ebp - 0x14]
cmp ecx, ebx
jne 0x1a98bc7
cmp byte [0x1ac6254], 0
movzx eax, word [edi + 0x84]
lea eax, [eax*4 + 0x208]
mov dword [ebp - 8], eax
je 0x1a98c7f
cmp dword [edi + 0xbc], 0
je 0x1a98c7f
push 4
push 0x1000
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
call fcn.01a22ac0
test eax, eax
js 0x1a98c7f
mov eax, dword [ebp - 4]
add eax, 0x204
mov dword [ebp - 0xc], eax
lea eax, [edi + 0x9c]
mov ecx, 0x81
mov esi, dword [eax]
cmp eax, esi
je 0x1a98e20
cmp dword [edi + 0x4c], 0
lea ebx, [esi + 0x18]
je 0x1a98cbe
mov eax, dword [edi + 0x50]
xor dword [ebx], eax
mov al, byte [ebx + 2]
xor al, byte [ebx + 1]
xor al, byte [ebx]
cmp byte [ebx + 3], al
je 0x1a98cbe
push ecx
mov edx, ebx
mov ecx, edi
call fcn.01a915a8
mov ecx, 0x81
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x1a98dc0
movzx eax, word [esi + 0xa]
test ax, ax
je 0x1a98dc0
jns 0x1a98da5
and eax, 0x7fff
cmp ax, cx
jae 0x1a98dc0
mov ecx, dword [ebp - 4]
mov edx, eax
mov eax, dword [esi + 0x10]
shr eax, 3
add dword [ecx + edx*4], eax
jmp 0x1a98dc0
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a98d26
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a98d30
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push esi
push 0x19cec34
call fcn.019dafb0
pop ecx
pop ecx
xor ecx, ecx
cmp dword [edi + 0x4c], ecx
je 0x1a98eb8
mov al, byte [esi + 2]
xor al, byte [esi + 1]
xor al, byte [esi]
mov byte [esi + 3], al
mov eax, dword [edi + 0x50]
xor dword [esi], eax
jmp 0x1a98eb8
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a98d87
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a98d91
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push esi
push dword [ebp - 8]
push 0x19cebfc
call fcn.019dafb0
add esp, 0xc
jmp 0x1a98d3e
test eax, 0x800
jne 0x1a98dc0
cmp ax, word [edi + 0x84]
jae 0x1a98dc0
mov ecx, eax
mov eax, dword [esi + 0x10]
shr eax, 3
add dword [edx + ecx*4], eax
test byte [esi + 0x1a], 4
je 0x1a98dd3
mov edx, ebx
mov ecx, edi
call fcn.01a8428f
test al, al
je 0x1a98dff
cmp dword [edi + 0x4c], 0
je 0x1a98de9
mov al, byte [ebx + 2]
xor al, byte [ebx + 1]
xor al, byte [ebx]
mov byte [ebx + 3], al
mov eax, dword [edi + 0x50]
xor dword [ebx], eax
mov esi, dword [esi]
lea eax, [edi + 0x9c]
cmp eax, esi
je 0x1a98e20
mov ecx, 0x81
jmp 0x1a98c94
cmp dword [edi + 0x4c], 0
je 0x1a98eee
mov al, byte [esi + 0x1a]
xor al, byte [esi + 0x19]
xor al, byte [esi + 0x18]
mov byte [esi + 0x1b], al
mov eax, dword [edi + 0x50]
xor dword [esi + 0x18], eax
jmp 0x1a98eee
lea ebx, [edi + 0xa4]
xor eax, eax
mov esi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
cmp esi, ebx
je 0x1a98e63
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push dword [ebp - 0xc]
lea edx, [esi - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, edi
call fcn.01a991c1
test al, al
je 0x1a98eb6
mov esi, dword [esi]
cmp esi, ebx
jne 0x1a98e36
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
cmp esi, eax
je 0x1a98ef7
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a98e9a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a98ea4
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push esi
push dword [ebp - 0x18]
push 0x19cec68
call fcn.019dafb0
add esp, 0xc
xor ecx, ecx
inc ecx
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x1a98ed3
mov byte [0x1ac6255], cl
int3
cmp dword [ebp - 4], 0
je 0x1a98eee
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0x8000
push eax
lea edx, [ebp - 4]
call fcn.019e05d2
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x74], ecx
je 0x1a98f40
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a98f25
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a98f2f
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push dword [edi + 0x74]
push dword [ebp - 0x1c]
push 0x19cecc0
jmp 0x1a98eae
cmp dword [ebp - 4], 0
je 0x1a98fb8
mov ebx, dword [edi + 0xbc]
xor edx, edx
inc edx
test ebx, ebx
je 0x1a98f74
mov esi, edx
mov eax, dword [ebp - 4]
lea ebx, [ebx + 0xc]
movzx ecx, si
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + ecx*4]
cmp eax, dword [ebx + 8]
jne 0x1a98fc2
inc esi
mov eax, 0x81
cmp si, ax
jb 0x1a98f55
mov esi, dword [edi + 0x88]
test esi, esi
je 0x1a98fa3
movzx ecx, word [edi + 0x84]
mov ebx, edx
cmp dx, cx
jae 0x1a98fa3
mov eax, dword [ebp - 0xc]
lea esi, [esi + 0x40]
movzx edi, bx
mov eax, dword [eax + edi*4]
cmp eax, dword [esi + 8]
jne 0x1a9901c
inc ebx
cmp bx, cx
jb 0x1a98f8c
and dword [ebp - 8], 0
lea ecx, [ebp - 8]
push 0x8000
push ecx
lea edx, [ebp - 4]
call fcn.019e05d2
xor ecx, ecx
inc ecx
mov al, cl
jmp 0x1a98ef0
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a98feb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a98ff5
push 0x19b4dbc
call fcn.019dafb0
mov eax, dword [ebp - 0x14]
pop ecx
mov ecx, dword [ebp - 4]
movzx edx, si
lea eax, [ecx + eax*4]
push eax
push dword [ecx + edx*4]
push dword [ebx + 8]
push edx
push 0x19ced1c
call fcn.019dafb0
add esp, 0x14
jmp 0x1a98eb6
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a99045
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a9904f
push 0x19b4dbc
call fcn.019dafb0
mov edx, dword [ebp - 0xc]
pop ecx
movzx ecx, bx
lea eax, [edx + edi*4]
push eax
push dword [edx + ecx*4]
lea eax, [esi + 0x10]
push dword [esi + 8]
push eax
push ecx
push 0x19ced4c
call fcn.019dafb0
add esp, 0x18
jmp 0x1a98eb6