Function at 0x18e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c270
push 0x3f72f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 0xffff88ff
cmp edx, 0x2f
ja case.0x18edd.30466
movzx edx, byte [edx + 0x19758]
jmp dword [edx*4 + 0x196fc]
mov dword [ebx], 0x3031564e
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi], 0
jne 0x18f26
and dword [esi + 0x320], 0xfffffffd
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or dword [esi + 0x320], 2
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x80
push 0x4e6d60
push 0
push 0
push 0x232058
mov ecx, dword [esi + 8]
push ecx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne case.0x18edd.30466
cmp dword [ebp - 0x1c], eax
je 0x193c1
cmp byte [0x4e6d60], al
je 0x18fa4
mov esi, ebx
sub esi, 0x4e6d60
cmp eax, 0x7f
jge 0x18fa4
mov dl, byte [eax + 0x4e6d60]
mov byte [esi + eax + 0x4e6d60], dl
add eax, 1
cmp byte [eax + 0x4e6d60], 0
jne 0x18f86
mov byte [eax + ebx], 0
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx], 0x6e80
lea ecx, [ebx + 4]
mov edx, esi
call fcn.0001c060
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [esi + 0xe74]
mov eax, dword [edi]
push eax
mov eax, esi
call fcn.0003f780
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [edi + 8]
test edi, edi
je case.0x18edd.30466
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x19022
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x100
ja case.0x18edd.30466
push 0x2020564e
push 0x200
push 1
call sub.WIN32K.SYS_EngAllocMem
mov dword [ebp - 0x20], eax
test eax, eax
je case.0x18edd.30466
push esi
push edi
lea ecx, [ebp - 0x58]
push ecx
push 0x200
mov edx, eax
push edx
call sub.WIN32K.SYS_EngMultiByteToUnicodeN
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov edx, eax
and edx, 0xff
mov dword [ebp - 0x5c], edx
and eax, 0xff0000
mov dword [ebp - 0x44], eax
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], edx
mov dword [ebx + 0x20], 0x81000000
lea eax, [edx - 1]
cmp eax, 6
ja case.0x190a1.3
jmp dword [eax*4 + 0x19788]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x28]
push edx
push eax
push ecx
push 0xc
lea eax, [ebp - 0x40]
push eax
push 0x232064
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x1929c
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x20], 0
mov edx, dword [ebp - 0x20]
push edx
call sub.WIN32K.SYS_EngFreeMem
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebx + 0x18]
push ecx
mov edx, dword [ebx + 0x1c]
push edx
mov eax, dword [ebx + 0x10]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0x23205c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x1929c
mov dword [ebx + 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
call sub.WIN32K.SYS_EngFreeMem
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x30], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x34]
push ecx
push 0x232060
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x1929c
mov dword [ebx + 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
call sub.WIN32K.SYS_EngFreeMem
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx + 0x20], 0x83000000
mov edi, dword [ebp + 0x14]
mov esi, dword [edi + 8]
push 0x3f75d0
mov ecx, esi
push ecx
call fcn.003f3660
add esp, 8
xor edx, edx
cmp esi, eax
sete dl
mov eax, edx
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x1921a
mov esi, dword [edi + 8]
push 0x3f75c0
push esi
call fcn.003f3660
add esp, 8
cmp esi, eax
je 0x1921a
xor edi, edi
jmp 0x1921f
mov edi, 1
cmp dword [ebp - 0x50], 0
jne 0x19233
push 0x3f75b0
push esi
call fcn.003f3660
add esp, 8
test edi, edi
je 0x1929c
mov eax, dword [ebx + 0x20]
mov ecx, eax
and ecx, 0x80000000
je 0x19250
and eax, 0x7f000000
cmp eax, 0x3000000
je 0x19254
test ecx, ecx
jne 0x1929c
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x19262
cmp eax, 0x10000
jne 0x1929c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x978]
push ecx
mov esi, dword [ebp - 0x5c]
call fcn.000452e0
mov edx, dword [ebp - 0x20]
push edx
call sub.WIN32K.SYS_EngFreeMem
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx + 0x20], 0x83000000
mov edx, dword [ebp - 0x20]
push edx
call sub.WIN32K.SYS_EngFreeMem
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp edi, ecx
je 0x193b8
cmp ebx, ecx
je 0x193b8
cmp dword [edi], 0x11223344
jne 0x193b8
mov eax, dword [esi + 0x168]
mov dword [ebx + 0x10], eax
mov edx, dword [esi + 0x16c]
mov dword [ebx + 0x14], edx
test byte [esi + 0x19b], 8
mov eax, 0x18
jne 0x19304
mov eax, dword [esi + 0x230]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x174]
mov dword [ebx + 0x1c], eax
movzx edx, byte [esi + 0x19b]
and dl, 2
neg dl
sbb edx, edx
neg edx
mov eax, 1
add edx, eax
mov dword [ebx + 0x20], edx
movzx edx, byte [esi + 0x19b]
and dl, 4
neg dl
sbb edx, edx
neg edx
add edx, eax
mov dword [ebx + 0x24], edx
mov edx, dword [esi + 0x190]
and edx, 0x7f
mov dword [ebx + 0x28], edx
mov edx, dword [esi + 0x1a4]
mov dword [ebx + 0x30], edx
mov edx, dword [esi + 0xaf8]
mov dword [ebx + 0x34], edx
mov edx, dword [esi + 0xafc]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x48], ecx
mov ecx, dword [esi + 0x198]
shr ecx, 0x1d
and ecx, eax
mov dword [ebx + 0x2c], ecx
mov dword [ebx + 0xc], eax
mov edx, dword [esi + 0xaf0]
mov dword [ebx + 0x3c], edx
mov ecx, dword [esi + 0x168]
mov dword [ebx + 0x40], ecx
mov edx, dword [esi + 0xaec]
mov dword [ebx + 0x44], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [edi]
cmp edi, 1
ja case.0x18edd.30466
mov eax, dword [esi + edi*4 + 0xb00]
mov dword [ebx], eax
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi], 0
je 0x19406
call fcn.0002b730
mov ecx, dword [esi + 0xb78]
mov dword [ebx], ecx
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x1c]
push edx
push ecx
push ebx
push eax
push edi
push 0x233070
mov eax, dword [esi + 8]
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x19455
cmp dword [ebp - 0x1c], eax
mov eax, 1
jne 0x193c1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
je 0x19487
cmp eax, 0x84
je 0x19487
cmp eax, 0x104
je 0x19487
cmp ecx, 4
jne case.0x18edd.30466
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x1c]
push edx
push ecx
push ebx
push eax
push edi
push 0x233074
mov eax, dword [esi + 8]
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x19455
cmp dword [ebp - 0x1c], eax
je 0x19455
call fcn.0002b730
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [edi]
mov dword [ebp - 0x54], ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 4
lea eax, [ebp - 0x54]
push eax
push 0x232f30
mov ecx, dword [esi + 8]
push ecx
call sub.WIN32K.SYS_EngDeviceIoControl
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], ebx
cmp dword [edi], 0
je 0x19531
lea edx, [ebp - 0x1c]
push edx
push 8
lea eax, [ebp - 0x4c]
push eax
push 8
mov ecx, eax
push ecx
push 0x232f20
mov edx, dword [esi + 8]
push edx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x19537
mov dword [ebx], 0
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x50
lea ecx, [ebp - 0xac]
push ecx
push 0
push 0
push 0x232044
mov edx, dword [esi + 8]
push edx
call sub.WIN32K.SYS_EngDeviceIoControl
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x78]
mov dword [ebx], eax
test al, 0x10
je 0x1958e
and al, 0xfc
mov dword [ebx], eax
mov ecx, dword [esi + 0x244]
and ecx, 3
or ecx, eax
mov dword [ebx], ecx
mov edx, dword [esi + 0x244]
and edx, 3
mov dword [ebx + 4], edx
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ebx], 0x10
push esi
call fcn.00041320
mov dword [ebx + 4], eax
mov eax, esi
call fcn.00045a30
mov dword [ebx + 8], eax
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, ecx
jne case.0x18edd.30466
push ebx
push eax
mov eax, edi
mov edx, esi
call fcn.0001c8b0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi + 8]
mov dword [ebx], edx
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00010550
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, edi
call fcn.00046310
mov esi, eax
call fcn.00010560
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [esi + 0x978]
mov eax, dword [ebx + 8]
call fcn.000126f0
push ebx
call fcn.00046620
call fcn.00010550
mov ecx, dword [edi + 0x20]
push ecx
mov eax, esi
call fcn.00046a60
mov esi, eax
call fcn.00010560
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00010550
push esi
mov edx, dword [edi + 0x20]
call fcn.00046a90
mov esi, eax
call fcn.00010560
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [ebp - 0x1c]
push edx
push ecx
push ebx
push eax
push edi
push 0x233098
mov eax, dword [esi + 8]
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10