Function at 0x7c82b6cc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x7c841246
movzx eax, word [ebp - 0x18]
push edi
xor edi, edi
xor ecx, ecx
test eax, 0xfffffffe
jbe 0x7c82b714
mov eax, dword [ebp - 0x14]
lea eax, [eax + ecx*2]
cmp word [eax], 0x2f
je 0x7c841254
movzx eax, word [ebp - 0x18]
inc ecx
shr eax, 1
cmp ecx, eax
jb 0x7c82b6f9
mov eax, dword [ebp - 0x18]
push ebx
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
dec eax
je 0x7c84126d
sub eax, 5
jne 0x7c84125e
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x7c82b8bc
lea eax, [ebp - 0x28]
push eax
call esi
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlPrefixString]
test al, al
je 0x7c8413a0
add dword [ebp - 0xc], 0x12
add word [ebp - 0x10], 0xffee
push 0x7c82b898
lea eax, [ebp - 0x20]
push eax
call esi
push 0x20
lea eax, [ebp - 0x20]
mov dword [ebp - 0x48], eax
push 3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x100080
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x50], 0x18
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
cmp dword [ebp - 8], edi
mov esi, eax
jne 0x7c841342
cmp esi, edi
jl 0x7c84135d
movzx ecx, word [ebp - 0x10]
add ecx, 0xe
mov dword [ebp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ecx
push dword [0x7c8856d4]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
je 0x7c84136a
cmp dword [ebp + 0xc], edi
je 0x7c841386
cmp dword [ebp + 0xc], 0xffffffff
je 0x7c84138f
push 0xffffffffffffffff
push 0xffffd8f0
push edi
push dword [ebp + 0xc]
call sub.ntdll.dll__allmul
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebx + 0xc], 1
movzx eax, word [ebp - 0x10]
mov dword [ebx + 8], eax
movzx ecx, word [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0xe]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
xor esi, esi
push esi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x38]
push ebx
push 0x110018
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, esi
jl 0x7c84139d
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
leave
ret 8
test al, 0x21
push ecx
mov ah, 0x1b
or eax, 0x2db64ca1
in eax, dx
mov ebx, dword [edx - 0x53]
lodsd eax, dword [esi]
je 0x7c841267
mov ah, 0x77
xor al, 0x27
enter 0xffffffffffffcc19, 0xffffffffffffff9a
jmp 0x7c8411f0
movsd dword es:[edi], dword [esi]
les ebx, [eax + 0x1a]
mul dword [ecx]
jl 0x7c8411fa
salc
sbb di, 0xcdc7
sal dword [eax + ebx - 0x1b], 1
and ch, byte [eax + 0x39]
ljmp 0xca0c
int 0xd1
je 0x7c841270
in eax, 0x22
push 0x958aea39
xchg ebp, eax
push edx
salc
or al, 0xca
ficomp dword [ebx + 0x5e]
push 0xbec94712
fcmovu st(0), st(0)
adc al, byte [edi - 0x37]
mov esi, 0x770bd8da
popal
or esi, dword [edi + 0x61]
out dx, eax
call 0xa55602ab
inc esi
stosb byte es:[edi], al
push ebx
mov dword [0x4ff8f0d4], eax
cmc
dec esi
inc ebx
cwde
inc esp
scasb al, byte es:[edi]
mov al, 0x23
jmp [ebx + 0x2e2847ca]
and dl, byte [edx - 0x52e1bc32]
mov ebx, 0x862e9100
jmp 0x2ba9ecb7
xchg cl, ch
fldenv [0xa35893af]
sub dword [0xe6072dca], edi
das
fisubr dword [0xeaa4bb55]
inc edx
sub dl, byte [edi - 0x74]
pop ebx
push ecx
push edi
mov word [ebx + 0x51], ds
idiv byte [ecx]
aam 0x9c
inc edi
mov esi, 0xe10fb94f
int1
loope 0x7c8412d7
invalid
test byte [ebx - 0x7b], bl
cld
pop ebx
test esp, edi
insb byte es:[edi], dx
jecxz 0x7c841321
mov ebp, dword [edi - 0x493e06e5]
mov dword [edi + esi*2], esp
insb byte es:[edi], dx
jbe 0x7c8412b5
dec esi
insd dword es:[edi], dx
ja 0x7c8412be
mov ah, 0x8e
rcr dword [esi - 3], cl
js 0x7c8412e4
fisttp word [ecx + 0x5d6fe7d0]
outsd dx, dword [esi]
pop ebp
invalid
sahf
xor dh, dh
cmp ah, byte [edx]
in eax, dx
stosb byte es:[edi], al
push ss
dec ebx
xchg ebp, eax
mov esp, ebp
retf
scasb al, byte es:[edi]
xchg esp, eax
out 0x5c, al
sub dword [edi - 0x37dbd6fb], eax
jmp 0x7c8413ed
aas
fcmovnu st(0), st(7)
xor al, 0x78
or dword [eax + esi*8 - 0x7285044e], 0x61137906
mov dl, 0xfb
jp 0x7c841320
push es
jns 0x7c8413a9
popal
xchg ebp, eax
lea ebp, [ebp - 0x2c]
enter 0x6a1e, 0xffffffffffffff84
push 0xffffffffffffff84
scasb al, byte es:[edi]
adc dh, 0xa3
bound ebp, qword [ebx - 0x15]
mov byte es:[0xc0ef5a2e], al
aas
dec byte [eax + 0x6f875a51]
pop ecx
pop edx
out dx, eax
sar byte [edi], 0xfe
mov byte [ecx + 0x5a], dl
xchg dword [edi + 0x59], ebp
shl dword ss:[ecx + edi], 1
push 0xfd8251b8
scasd eax, dword es:[edi]
mov dl, 0xc2
pushal
jae 0x7c84141d
out 0x58, eax
adc eax, 0xeafbfa01
push ds
cmp al, byte [eax + 0x31]
jns 0x7c84140d
and eax, 0x8a7921db
mov ebx, 0xd49e2aca
sbb dh, byte [edx - 0x7330d605]
sahf
lahf
or al, 0x64
insb byte es:[edi], dx
pop ebx
imul eax, dword [ebp + 0x12], 0x691cb2e5
sbb al, 0x69
dec esi
mov ds, word [esi + ecx*8]
xchg ebp, eax
inc edx