Function at 0x1c790f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1c7921a
prefetcht0 byte [edi]
mov eax, edi
and eax, 0xffe00000
mov esi, dword [eax + 0x1000]
mov ecx, edi
shr ecx, 9
and ecx, 0xfe0
lea ebx, [eax + ecx]
add ebx, 0x1000
movzx eax, byte [eax + ecx + 0x101e]
and eax, 0x3f
shl eax, 5
mov edx, edi
sub edx, dword [esi + 0x10]
sub ebx, eax
mov dword [ebp - 0x10], ebx
prefetcht0 byte [ebx]
cmp byte [esi], 2
je 0x1c7941d
cmp byte [esi + 6], 0
jne 0x1c79222
cmp byte [esi + 3], 0
je 0x1c792ac
mov eax, dword [0x1d31114]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ebx, dword [eax + 0x90]
cmp ebx, 1
jbe 0x1c7940b
cmp ebx, 2
jb 0x1c792ac
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 8]
lea eax, [esi + 0x48]
lea ecx, [esi + 0x1148]
cmp ecx, edi
setae cl
cmp eax, edi
ja 0x1c793ec
test cl, cl
je 0x1c79285
sub edi, eax
sar edi, 5
add dword [ebx + 0x30], 1
adc dword [ebx + 0x34], 0
movzx eax, word [0x1d2feb0]
cmp edi, eax
ja 0x1c7927d
mov eax, dword [ebx + edi*8 + 0x78]
bswap eax
mov dword [edx], eax
mov dword [ebx + edi*8 + 0x78], edx
inc byte [ebx + edi*8 + 0x7c]
movzx eax, word [ebx + edi*8 + 0x7e]
add dword [ebx], eax
add dword [ebx + 0x38], 1
adc dword [ebx + 0x3c], 0
movzx eax, byte [ebx + edi*8 + 0x7d]
cmp byte [ebx + edi*8 + 0x7c], al
ja 0x1c79333
lea edi, [ebx + edi*8]
movzx eax, byte [ebx + 4]
test al, 1
jne 0x1c793f3
movzx eax, word [edi + 0x7e]
sub eax, dword [esi + 0xc]
add dword [ebx + 0x68], 1
adc dword [ebx + 0x6c], 0
add dword [ebx + 0x70], eax
adc dword [ebx + 0x74], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
test edx, 0xfff
je 0x1c7934c
lea ebx, [edx - 4]
mov eax, dword [ebx]
and eax, 0x7fffffff
cmp eax, 1
jne 0x1c7939c
mov eax, dword [ebx]
nop word cs:[eax + eax]
mov ecx, eax
and ecx, 0xfffffffe
lock cmpxchg dword [ebx], ecx
jne 0x1c79250
test al, 1
je 0x1c794fb
and eax, 0x7fffffff
cmp eax, 1
jne 0x1c7936c
cmp byte [esi + 3], 0
jne 0x1c79160
jmp 0x1c792ac
add dword [ebx + 0x40], 1
adc dword [ebx + 0x44], 0
mov eax, dword [ebp - 0x10]
test byte [eax + 0xf], 8
jne 0x1c793e4
mov eax, dword [eax + 8]
add eax, 0xc
mov eax, dword [eax]
sub eax, dword [esi + 0xc]
add dword [ebx + 0x68], 1
adc dword [ebx + 0x6c], 0
add dword [ebx + 0x70], eax
adc dword [ebx + 0x74], 0
mov dword [edx], 0
lea ebx, [esi + 0x40]
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c793ff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0xc]
sub dword [esi + 0x117c], eax
mov eax, dword [ecx]
cmp eax, edi
je 0x1c79503
bswap eax
mov dword [edi], eax
mov dword [ecx], edi
mov eax, dword [ecx + 0xc]
mov edx, eax
and edx, 0xefffffff
mov dword [ecx + 0xc], edx
test eax, 0x3ffe
je 0x1c79506
lea esi, [eax + 0x3ffe]
and esi, 0x3ffe
mov edx, eax
and edx, 0xefffc001
or edx, esi
mov dword [ecx + 0xc], edx
test al, 1
jne 0x1c793d8
test esi, esi
je 0x1c793d8
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1c7921a
lea edx, [ebx + edi*8]
add edx, 0x78
movzx eax, al
shr eax, 1
mov ecx, ebx
push eax
push edx
call fcn.01c803f0
jmp 0x1c791f5
mov eax, edx
and eax, 0xffe00000
mov ecx, edx
shr ecx, 9
and ecx, 0xff8
lea ebx, [ecx + eax]
add ebx, 0x2000
jmp 0x1c79231
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0xc]
lock add dword [esi + 0x1198], eax
lock inc dword [esi + 0x119c]
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0xc]
lock add dword [esi + 0x11a0], eax
lock inc dword [esi + 0x11a4]
jmp 0x1c7921a
cmp byte [esi + 7], 0
je 0x1c79241
mov eax, dword [ebp - 0x10]
test byte [eax + 0xf], 8
mov dword [ebp - 0x14], edx
jne 0x1c79509
mov eax, dword [eax + 8]
add eax, 0xc
mov eax, dword [eax]
sub eax, dword [esi + 0xc]
push eax
push 0xef
push edi
call fcn.01c96470
add esp, 0xc
mov edx, dword [ebp - 0x14]
jmp 0x1c79241
push 1
call fcn.01c6ae10
jmp 0x1c79327
add eax, 0x20
jmp 0x1c79298
xor ecx, ecx
jmp 0x1c791a3
mov ecx, ebx
call fcn.01c80b20
jmp 0x1c79204
mov ecx, ebx
call fcn.01c80d70
jmp 0x1c792c6
mov ecx, esi
mov edi, edx
call fcn.01c5ae40
mov edx, edi
mov ebx, eax
jmp 0x1c7917e
mov dword [ebp - 0x14], edx
mov al, byte [0x1d2fe7d]
test al, 1
jne 0x1c79511
mov edx, dword [ebp - 0x14]
mov eax, edx
shr eax, 0x15
cmp word [eax + eax + 0x1d2feb4], 0xfffe
jne 0x1c7914c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
test byte [ecx + 0xf], 8
jne 0x1c7951b
lea ecx, [eax + 0xc]
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0xc]
cmp byte [0x1d2fe7f], 1
jne 0x1c7947a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub eax, dword [esi + 0xc]
push eax
push 0
push edi
call fcn.01c96470
add esp, 0xc
mov ecx, dword [0x1d2fe68]
and ecx, 1
mov eax, 2
sub eax, ecx
mov edx, dword [ebp - 0x14]
mov ecx, edx
shr cl, 2
and cl, 0x1e
shl eax, cl
mov ecx, edx
and ecx, 0xffe00000
not eax
shr edx, 5
and edx, 0xfffc
lock and dword [edx + ecx + 0x4000], eax
mov eax, ebx
lock xadd dword [0x1d2fe60], eax
add eax, ebx
mov ecx, dword [0x1d2fe64]
cmp eax, ecx
jbe 0x1c7921a
mov ecx, dword [0x1d2fe78]
call fcn.01ced800
test al, al
je 0x1c7921a
mov al, byte [0x1d2fe7c]
test al, al
jne 0x1c7921a
push 1
call fcn.01ce10d0
add esp, 0xc
jmp 0x1c7921d
mov ecx, ebx
push eax
call fcn.01cdd180
int3
int3
add eax, 0x20
jmp 0x1c793bc
call fcn.01ce10f0
jmp 0x1c7942d
add dword [ebp - 0x10], 0x20
jmp 0x1c7945a