Function at 0x1a97459
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0x3c
push 0x1ab0d50
call fcn.01a36178
mov edi, edx
mov dword [ebp - 0x24], edi
mov esi, ecx
mov dword [ebp - 0x40], esi
xor ebx, ebx
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x28], ebx
test dword [esi + 0x44], 0x1000000
je 0x1a9749a
push dword [ebp + 8]
push edi
push esi
mov esi, dword [0x1ac52e8]
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x1a9779b
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 1
mov edx, 0x19ce7a0
mov ecx, esi
call fcn.019d213f
test al, al
je 0x1a97786
mov eax, dword [esi + 0x44]
or eax, 0x10000100
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x1a974d6
mov edx, edi
jmp 0x1a974d9
xor edx, edx
inc edx
mov eax, dword [esi + 0x94]
add eax, edx
and eax, dword [esi + 0x98]
cmp eax, 0x10
jae 0x1a974ef
push 0x10
pop eax
add eax, 8
mov dword [ebp - 0x44], eax
cmp eax, edi
jb 0x1a97706
cmp eax, dword [esi + 0x78]
ja 0x1a97706
test cl, 1
jne 0x1a97525
push dword [esi + 0xc8]
call fcn.019fbe50
mov byte [ebp - 0x1d], 1
mov edi, dword [ebp - 0x24]
or edi, 1
mov dword [ebp - 0x38], edi
jmp 0x1a97528
mov edi, dword [ebp - 0x24]
xor dl, dl
mov ecx, esi
call fcn.01a98b78
push dword [ebp + 8]
push edi
push esi
call fcn.019f3940
mov edi, eax
mov dword [ebp - 0x28], edi
mov dl, 1
mov ecx, esi
call fcn.01a99077
test edi, edi
je 0x1a97789
add edi, 0xfffffff8
cmp byte [edi + 7], 5
jne 0x1a97563
movzx eax, byte [edi + 6]
shl eax, 3
sub edi, eax
mov dword [ebp - 0x3c], edi
cmp dword [esi + 0x4c], ebx
je 0x1a97587
mov eax, dword [esi + 0x50]
xor dword [edi], eax
mov al, byte [edi + 2]
xor al, byte [edi + 1]
xor al, byte [edi]
cmp byte [edi + 3], al
je 0x1a97587
push ecx
mov edx, edi
mov ecx, esi
call fcn.01a915a8
test byte [edi + 2], 2
je 0x1a975bb
mov ecx, edi
call fcn.01a110bd
mov dword [ebp - 0x30], eax
xor ecx, ecx
test dword [esi + 0x40], 0x8000000
je 0x1a975b2
inc ecx
call fcn.019e058b
mov ecx, dword [ebp - 0x30]
mov word [ecx], ax
mov eax, ecx
jmp 0x1a975b5
mov word [eax], cx
mov ax, word [eax + 2]
jmp 0x1a975c4
mov al, byte [edi + 3]
mov byte [ebp - 0x29], al
movzx eax, al
mov word [ebp - 0x24], ax
cmp dword [esi + 0x4c], ebx
je 0x1a975e4
movzx ecx, byte [edi + 1]
movzx eax, byte [edi + 2]
xor ecx, eax
movzx eax, byte [edi]
xor ecx, eax
mov byte [edi + 3], cl
mov eax, dword [esi + 0x50]
xor dword [edi], eax
test dword [esi + 0x40], 0x20000000
je 0x1a975f6
xor dl, dl
mov ecx, esi
call fcn.01a98b78
mov eax, dword [ebp - 0x28]
cmp eax, dword [0x1ac6260]
mov eax, dword fs:[0x30]
jne 0x1a97673
cmp dword [eax + 0xc], ebx
je 0x1a97629
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a97633
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push dword [ebp + 8]
push dword [0x1ac6260]
push 0x19ce7e0
call fcn.019dafb0
add esp, 0xc
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x1a97789
mov byte [0x1ac6255], 1
mov dword [0x1ac60a0], ebx
int3
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x48], eax
test eax, 0x800
je 0x1a97789
mov ax, word [ebp - 0x24]
test ax, ax
je 0x1a97789
cmp ax, word [0x1ac6264]
jne 0x1a97789
mov ax, word [esi + 0x7c]
cmp ax, word [0x1ac6266]
jne 0x1a97789
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], ebx
je 0x1a976d7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a976e1
push 0x19b4dbc
call fcn.019dafb0
pop ecx
mov dx, word [ebp - 0x24]
mov ecx, esi
call fcn.01a8081a
push eax
push dword [ebp + 8]
push dword [ebp - 0x28]
push 0x19ce80c
call fcn.019dafb0
add esp, 0x10
jmp 0x1a9764a
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], ebx
je 0x1a9772e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a97738
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push dword [esi + 0x78]
push edi
push 0x19ce7b0
call fcn.019dafb0
add esp, 0xc
jmp 0x1a97786
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.01a977a3
mov eax, dword [ebp - 0x28]
call fcn.01a361c0
ret 4