Function at 0x7c80b64e
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
je 0x7c817a52
pop ebp
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x7c8856cc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x414], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x1d4]
mov dword [0x7c8856e4], eax
mov dword [0x7c885054], ecx
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x30]
mov eax, dword [ebp + 0xc]
sub eax, edi
mov dword [ebp - 0x420], ebx
je 0x7c81bf84
dec eax
je 0x7c8175ad
dec eax
jne 0x7c80c177
push edi
push 2
call fcn.7c80b777
test al, al
je 0x7c82a844
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 0xc
dec eax
jne 0x7c80b6dc
call fcn.7c80c18d
jmp 0x7c80b6dc
push edi
call sub.ntdll.dll_RtlEncodePointer
push 0x7c80c280
push 0x7c812ef8
mov dword [0x7c8853ac], eax
call sub.ntdll.dll_RtlSetThreadPoolStartFunc
push 0x7c811788
call sub.ntdll.dll_LdrSetDllManifestProber
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x7c817778
push 0x7c817764
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlCreateTagHeap]
mov dword [0x7c8856d4], eax
mov dword [0x7c8850a4], edi
call fcn.7c816886
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
push 0x7c885028
call esi
mov eax, dword [0x7c8856e4]
cmp eax, edi
mov dword [ebp - 0x418], 4
push 0x7c817750
jne 0x7c840776
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x40d]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
push eax
push 1
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ntdll.dll_CsrClientConnectToServer]
test eax, eax
jl 0x7c82a844
mov eax, dword fs:[0x18]
cmp byte [ebp - 0x40d], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x54]
mov eax, dword [eax + 4]
mov dword [0x7c88503c], eax
jne 0x7c82a838
call dword [sym.imp.ntdll.dll_CsrNewThread]
mov eax, dword [0x7c88503c]
mov byte [0x7c885008], 0
lea ecx, [eax + 0x22]
cmp ecx, edi
mov dword [0x7c88511c], ecx
mov dx, word [eax + 0x1e]
mov word [0x7c885998], dx
mov dx, word [eax + 0x20]
mov word [0x7c885728], dx
je 0x7c8176d0
cmp dword [ebx + 0x1f4], edi
jne 0x7c8176d0
push ecx
add ebx, 0x1f0
push ebx
call esi
mov eax, dword [0x7c88503c]
mov ecx, dword [eax]
mov dword [0x7c885120], ecx
mov ecx, dword [eax + 4]
mov dword [0x7c885124], ecx
mov ecx, dword [eax + 8]
mov dword [0x7c8853b0], ecx
mov eax, dword [eax + 0xc]
mov dword [0x7c8853b4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x40]
push 1
mov dword [section..data], ecx
mov eax, dword [eax + 0x44]
push section..data
push 0x7c8855f0
mov dword [0x7c885004], eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
test eax, eax
jl 0x7c840796
mov ecx, dword [0x7c8853b4]
mov ax, word [ecx]
cmp ax, di
push 2
mov esi, 0x7c887c40
mov word [0x7c887c40], ax
pop ebx
je 0x7c8177dc
sub ecx, esi
jmp 0x7c8177ce
add esi, ebx
mov ax, word [ecx + esi]
cmp ax, di
mov word [esi], ax
jne 0x7c8177ce
mov ecx, dword [0x7c885124]
mov word [esi], 0x3b
mov edx, ecx
mov ax, word [edx]
add esi, ebx
cmp ax, di
mov word [esi], ax
je 0x7c8177fa
add edx, ebx
jmp 0x7c8177e9
mov edx, 0x7c817808
mov word [esi], 0x5c
jmp 0x7c817818
add edx, ebx
mov ax, word [edx]
add esi, ebx
cmp ax, di
mov word [esi], ax
jne 0x7c817818
mov word [esi], 0x3b
mov ax, word [ecx]
add esi, ebx
cmp ax, di
mov word [esi], ax
je 0x7c81783d
add ecx, ebx
jmp 0x7c81782c
mov word [esi], 0x3b
add esi, ebx
test byte [0x7ffe02d0], 0x10
je 0x7c817866
push 0x104
lea eax, [ebp - 0x40c]
push eax
call fcn.7c816fa1
test eax, eax
jne 0x7c8407af
mov eax, 0x7c887c40
mov cx, si
sub cx, ax
mov dword [0x7c88502c], eax
mov word [0x7c885028], cx
mov word [0x7c88502a], 0x1800
mov eax, 0x1800
sub eax, dword [0x7c885028]
mov word [esi], di
mov dword [0x7c8856bc], esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
push 0x7c885700
mov word [0x7c8856b8], di
mov word [0x7c8856ba], ax
call esi
test eax, eax
jge 0x7c8407d9
jmp 0x7c82a844
call fcn.7c817a61
jmp 0x7c80b65d
cmp dword [0x7c8850a4], edi
je 0x7c82a84b
push edi
push edi
push edi
call sym.KERNEL32.dll_WriteProfileStringW
jmp 0x7c82a84b
mov byte [0x7c885008], 1
jmp 0x7c817696
xor al, al
jmp 0x7c80b6de
cmp dword [0x7c88745c], edi
jne 0x7c84085f
jmp 0x7c80b6dc
jb 0x7c84079b
jmp 0x7c8407cd
mov ah, 0x1b
enter 0x404e, 0x45
inc ebp
push ecx
sub edi, dword [edi - 0x78]
ret
adc eax, 0x3b1fc0c7
nop
scasd eax, dword es:[edi]
fcomp qword [edi + 0x74]
cli
dec edx
push es
xchg edi, eax
inc ecx
dec esp
mov ebp, ebp
mov dh, 0xd3
movsd dword es:[edi], dword [esi]
sbb bh, dl
rol edi, 1
test al, 0x65
invalid
inc esp
pop ss
arpl word [eax + 0x64c0264], bx
das
int3
shr dword [edi], 0x33
adc eax, 0x37705aa7
lea eax, [eax - 0x5f]
push eax
jecxz 0x7c840855
cld
cmpsb byte [esi], byte es:[edi]
wait
push ss
jl 0x7c840850
mov byte [0xc23df037], al
pushal
mov eax, dword [0xde6ef847]
inc edi
sar dword [eax + 0x6b], 0xd0
cmp al, 0x1a
stc
pop es
stc
sub eax, 0x754a3979
adc ah, byte [ecx]
imul bl
fadd qword [ecx]
fdivr dword [edx - 0x18]
and dword [0x5a24d076], esp
in al, 0xa5
add eax, 0x712dafb1
push ds
aas
sbb esi, dword [edi + 0x14ceac07]
fsub qword [edi - 0x45b73088]
je 0x7c8407d5
sbb esp, dword [edx - 0xf]
xor esi, dword [ecx + ecx*4]
xchg dword [eax], edi
and cl, ah
push ds
and ebp, dword [esi - 0x3810d330]
mov dword [edx], ecx
mov bl, 0x89
dec eax
mov ebp, 0x6295ccc1
inc esi
arpl word [ecx + eax*4 + 0x11], bx
push 0x1e48fbd3
sar ebx, cl
dec eax
push ds
sub dword [esi - 0x5eeeae3b], ebp
sbb byte [esi + 0x3a], al
and edx, esi
scasb al, byte es:[edi]
lds edx, [ecx + 0x11]
mov eax, dword [0x233a4618]
salc
outsd dx, dword [esi]
adc dword [ebp - 0x743e902d], ebp
nop
hlt