Function at 0x7c81f865
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x7c8856cc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x24c], eax
call sym.KERNEL32.dll_GetDriveTypeW
cmp eax, 4
je 0x7c845599
push esi
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7c8455a7
movzx eax, word [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
shr eax, 1
lea eax, [ecx + eax*2 - 2]
cmp word [eax], 0x5c
jne 0x7c81f8d9
mov word [eax], si
add word [ebp - 0x21c], 0xfffe
mov ecx, dword [ebp - 0x218]
cmp word [ebp - 0x21c], 4
jb 0x7c81f8f8
movzx eax, word [ebp - 0x21c]
shr eax, 1
cmp word [ecx + eax*2 - 2], 0x3a
je 0x7c82d2be
push 0x10
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x23c], eax
push 3
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x244]
push eax
push 0x100080
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x244], 0x18
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], 0x40
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov edi, eax
cmp edi, esi
jl 0x7c82ecda
push esi
lea eax, [ebp - 0x214]
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x4d0008
push dword [ebp - 0x210]
call sym.KERNEL32.dll_DeviceIoControl
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, esi
je 0x7c82d826
push ebx
mov eax, dword fs:[0x18]
push dword [ebp - 0x218]
mov eax, dword [eax + 0x30]
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
push dword [eax + 0x18]
call ebx
mov eax, dword [ebp - 0x20c]
mov word [ebp - 0x21c], ax
add eax, 2
mov word [ebp - 0x21a], ax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x21a]
mov eax, dword [eax + 0x30]
push ecx
push dword [0x7c8856d4]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, esi
mov dword [ebp - 0x218], eax
je 0x7c8455ae
movzx ecx, word [ebp - 0x20c]
mov edi, eax
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x20a]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, word [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
shr eax, 1
and word [ecx + eax*2], 0
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x21c]
mov eax, dword [eax + 0x30]
push 0x18
pop esi
add ecx, esi
push ecx
push dword [0x7c8856d4]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, eax
test edx, edx
mov dword [ebp - 0x228], edx
je 0x7c8455bc
push 6
xor eax, eax
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx + 0x10], esi
mov ax, word [ebp - 0x21c]
mov word [edx + 0x14], ax
movzx ecx, word [ebp - 0x21c]
mov esi, dword [ebp - 0x218]
mov eax, ecx
shr ecx, 2
lea edi, [edx + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword fs:[0x18]
push dword [ebp - 0x218]
mov eax, dword [eax + 0x30]
xor esi, esi
push esi
push dword [eax + 0x18]
call ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x20
push dword [0x7c8856d4]
push dword [eax + 0x18]
call edi
cmp eax, esi
mov dword [ebp - 0x22c], eax
je 0x7c8455d3
push 0xffffffffffffffff
push 0x80
push 3
push esi
push 3
push esi
push 0x7c81ecac
call sym.KERNEL32.dll_CreateFileW
cmp eax, 0xffffffff
mov dword [ebp - 0x210], eax
je 0x7c8455e9
push esi
lea ecx, [ebp - 0x214]
push ecx
movzx ecx, word [ebp - 0x21c]
push 0x20
push dword [ebp - 0x22c]
add ecx, 0x18
push ecx
push dword [ebp - 0x228]
mov esi, 0x6d0008
push esi
push eax
call sym.KERNEL32.dll_DeviceIoControl
test eax, eax
mov dword [ebp - 0x248], eax
je 0x7c81fccb
push dword [ebp - 0x210]
call sym.KERNEL32.dll_CloseHandle
mov eax, dword fs:[0x18]
push dword [ebp - 0x228]
mov eax, dword [eax + 0x30]
xor esi, esi
push esi
push dword [eax + 0x18]
call ebx
cmp dword [ebp - 0x248], esi
je 0x7c845606
mov edi, dword [ebp - 0x22c]
cmp dword [edi + 4], esi
mov dword [ebp - 0x228], esi
jbe 0x7c84567f
lea eax, [edi + 8]
mov esi, dword [eax]
mov dx, word [eax + 4]
add esi, edi
cmp dx, 0x60
jne 0x7c845645
cmp word [esi], 0x5c
jne 0x7c845662
mov cx, word [esi + 2]
cmp cx, 0x3f
jne 0x7c845658
cmp word [esi + 4], 0x3f
jne 0x7c845662
cmp word [esi + 6], 0x5c
jne 0x7c845662
cmp word [esi + 8], 0x56
jne 0x7c845662
cmp word [esi + 0xa], 0x6f
jne 0x7c845662
cmp word [esi + 0xc], 0x6c
jne 0x7c845662
cmp word [esi + 0xe], 0x75
jne 0x7c845662
cmp word [esi + 0x10], 0x6d
jne 0x7c845662
cmp word [esi + 0x12], 0x65
jne 0x7c845662
cmp word [esi + 0x14], 0x7b
jne 0x7c845662
cmp word [esi + 0x26], 0x2d
jne 0x7c845662
cmp word [esi + 0x30], 0x2d
jne 0x7c845662
cmp word [esi + 0x3a], 0x2d
jne 0x7c845662
cmp word [esi + 0x44], 0x2d
jne 0x7c845662
cmp word [esi + 0x5e], 0x7d
jne 0x7c845662
cmp dx, 0x60
jne 0x7c845662
cmp cx, 0x3f
jne 0x7c845662
mov eax, dword [ebp - 0x228]
cmp eax, dword [edi + 4]
je 0x7c845691
movzx eax, dx
mov edx, dword [ebp + 0x10]
lea ecx, [eax + 4]
add edx, edx
cmp edx, ecx
jb 0x7c8456a9
mov edi, dword [ebp - 0x24c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24c]
shr eax, 1
lea eax, [ecx + eax*2]
mov word [ecx + 2], 0x5c
mov word [eax], 0x5c
and word [eax + 2], 0
mov eax, dword fs:[0x18]
push dword [ebp - 0x22c]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call ebx
xor eax, eax
inc eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.7c8097aa
leave
ret 0xc
call fcn.7c8307de
cmp eax, 0xea
jne 0x7c81fb32
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ecx]
mov dword [ebp - 0x214], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ecx
push 0
push dword [eax + 0x18]
call ebx
mov eax, dword fs:[0x18]
push dword [ebp - 0x214]
mov eax, dword [eax + 0x30]
push dword [0x7c8856d4]
push dword [eax + 0x18]
call edi
test eax, eax
mov dword [ebp - 0x22c], eax
je 0x7c845618
push 0
lea ecx, [ebp - 0x214]
push ecx
push dword [ebp - 0x214]
push eax
movzx eax, word [ebp - 0x21c]
add eax, 0x18
push eax
push dword [ebp - 0x228]
push esi
push dword [ebp - 0x210]
jmp 0x7c81fb1f
movzx eax, word [ecx + eax*2 - 4]
push eax
call dword [sym.imp.ntdll.dll_toupper]
mov edx, dword [ebp - 0x218]
pop ecx
movzx ecx, word [ebp - 0x21c]
shr ecx, 1
mov word [edx + ecx*2 - 4], ax
jmp 0x7c81f8f8
xor eax, eax
jmp 0x7c81fcbd
mov eax, dword fs:[0x18]
push dword [ebp - 0x218]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7c82d2fe
mov eax, dword fs:[0x18]
push dword [ebp - 0x218]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
jmp 0x7c82d2fe
xchg edx, eax
clc
bound ebx, qword [edi]
iretd
movsd dword es:[edi], dword [esi]
fadd dword [esi + 0x5d]
ljmp 0xfced
pop ds
invalid
mov bh, 0x8e
into
lahf
aas
sbb al, 0xe3
out 0xcf, eax
out dx, al
invalid
add ch, byte [edi - 0x41]
pop ebx
xchg eax, esi
jbe 0x7c8455d8
cmpsb byte [esi], byte es:[edi]
push esp
cld
das
and dword [ecx - 0x1faf2181], ecx
pop edi
cmp byte [edi], dh
enter 0x197d, 0x4a
loop 0x7c8455a4
arpl word [edx + 0x12], ax
jmp [eax]
inc edx
adc bh, bh
sub ch, al
push ds
push ss
adc al, 0xa8
rcr edi, cl
int1
scasb al, byte es:[edi]
invalid
cmp byte [edi + 0x3d4d2eaa], cl
invalid
invalid
salc
adc al, 0xfe
loopne 0x7c845690
pop esi
retf
pop esp
pop esi
dec esp
ret
stc
mov dword ss:[ebp - 0x28f8076c], eax
movsd dword es:[edi], dword [esi]
rol bl, 0x4f
and dword [0xf0a7f61e], edx
adc eax, 0xf0a7f61e
pop es
jg 0x7c845679
mov ch, 0xee
cmp dl, byte [ebx]
aas
daa
cmp al, 0xe0
invalid
sub dword [esi], esp
bound edi, qword [esi - 0xa]
cmc
insd dword es:[edi], dx
jmp [ebx]