Function at 0x7c80e315
Capabilities:
Check for peb beingdebugged flag

Disassembly:
add dword [ebp - 0x1c], 4
jmp 0x7c80e409
movzx eax, word [0x7c885028]
add dword [ebp - 0x1c], eax
jmp 0x7c80e409
cmp ebx, esi
jne 0x7c8117eb
mov eax, dword fs:[0x18]
mov dword [ebp - 0x3c], eax
cmp dword [eax + 0xc], esi
jne 0x7c843fa5
mov eax, dword [0x7c88534c]
cmp eax, esi
je 0x7c8167df
mov ebx, dword [eax + 0x28]
jmp 0x7c843fcc
movzx ecx, word [0x7c885028]
mov esi, dword [0x7c88502c]
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [0x7c885028]
shr ecx, 1
lea eax, [eax + ecx*2]
jmp 0x7c81680b
cmp ebx, esi
je 0x7c80e2c3
mov edx, dword [ebp - 0x2c]
cmp edx, esi
je 0x7c80e2c3
sub edx, ebx
sar edx, 1
shl edx, 1
mov ecx, edx
mov esi, ebx
mov edi, eax
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, edx
mov dword [ebp - 0x20], eax
mov word [eax], 0x3b
inc eax
inc eax
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
jmp 0x7c80e2c3
shr ecx, 1
lea eax, [eax + ecx*2]
mov dword [ebp - 0x20], eax
mov word [eax], 0x3b
inc eax
inc eax
jmp 0x7c81680b
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
cmp ecx, esi
je 0x7c80e467
dec ecx
je 0x7c84402c
dec ecx
je 0x7c80e23b
dec ecx
je 0x7c80e20d
dec ecx
je 0x7c80e2c9
mov word [eax], 0x2e
inc eax
inc eax
mov dword [ebp - 0x20], eax
mov word [eax], 0x3b
inc eax
inc eax
mov dword [ebp - 0x20], eax
add dword [ebp - 0x28], 4
jmp 0x7c80e28e
cmp word [ebp - 0x54], si
je 0x7c80e2c3
movzx ecx, word [ebp - 0x54]
mov esi, dword [ebp - 0x50]
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [ebp - 0x54]
jmp 0x7c80e27a
cmp ebx, esi
je 0x7c80e409
cmp dword [ebp - 0x2c], esi
je 0x7c80e409
mov eax, dword [ebp - 0x2c]
sub eax, ebx
sar eax, 1
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*2 + 2]
jmp 0x7c80e406
push 0x44
push 0x7c80e418
call fcn.7c8024d6
xor esi, esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
cmp eax, esi
je 0x7c80e430
dec eax
je 0x7c844002
dec eax
je 0x7c80e1de
dec eax
je 0x7c80e1cf
dec eax
jne 0x7c80e1b4
cmp dword [ebp + 0x10], esi
jne 0x7c80e36f
call dword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov dword [ebp - 4], 1
mov word [ebp - 0x52], si
lea eax, [ebp - 0x54]
push eax
mov edi, 0x7c8855f8
push edi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable_U]
call esi
mov dword [ebp - 0x24], eax
cmp eax, 0xc0000023
jne 0x7c80e3de
mov eax, dword [ebp - 0x54]
add eax, 2
mov word [ebp - 0x52], ax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x38], eax
movzx ecx, word [ebp - 0x52]
push ecx
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x7c843f7c
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp + 0x10]
call esi
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
call fcn.7c80e1c2
cmp dword [ebp - 0x24], 0xc0000100
je 0x7c843f88
xor esi, esi
cmp dword [ebp - 0x24], esi
jl 0x7c80e46b
movzx eax, word [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
lea eax, [eax + ecx + 2]
mov dword [ebp - 0x1c], eax
add dword [ebp - 0x28], 4
jmp 0x7c80e33b
mov eax, dword fs:[0x18]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x1c]
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x30], eax
cmp eax, esi
je 0x7c844020
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
jmp 0x7c80e28e
mov word [eax - 2], si
or dword [ebp - 4], 0xffffffff
call fcn.7c80e484
mov eax, dword [ebp - 0x30]
call fcn.7c802511
ret 0xc
cmp ebx, esi
je 0x7c80e409
push ebx
call fcn.7c80e17f
mov dword [ebp - 0x2c], eax
push ebx
call dword [sym.imp.ntdll.dll_wcslen]
jmp 0x7c843fd4
push ebx
call fcn.7c80e17f
mov dword [ebp - 0x2c], eax
cmp ebx, esi
je 0x7c80e1e6
cmp eax, esi
jne 0x7c80e2ec
jmp 0x7c80e1e6
mov eax, dword fs:[0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [eax + 0x30]
push dword [eax + 8]
push 0x7c81673b
push esi
call sub.ntdll.dll_LdrEnumerateLoadedModules
mov eax, dword [0x7c88534c]
cmp eax, esi
jne 0x7c80e205
jmp 0x7c80e4bb
xor esi, esi
jmp 0x7c80e2c0
push edx
pop ss
out dx, al
push cs
js 0x7c843f69
int3
lcall 0x155, 0x66a5270c
fmul st(3)
push 0x66
adc dh, byte [edx]
adc dh, byte [edx]
shr byte [esp + edx*2], 1
aaa
mov bh, 0x94
xchg esp, eax
and ebx, dword [esi - 7]
sub ah, byte ds:[ebx + 0x57b1b94]
sbb dword [ebx + ebx*2 + 0x27], 0xffffffdf
fisttp word [edi + 0x27c3292e]
invalid
sub ebx, eax
daa
lodsb al, byte [esi]
jmp 0x7c843f07
invalid
pop ebx
insb byte es:[edi], dx
sub al, 0xd4
pop esp
mov eax, 0x237737ba
jnp 0x7c843f63
add cl, byte [edx + 0x18]
js 0x7c843f3f
or byte [eax], ah
sbb dl, 0x3a
rcr byte [edi], 0xb
jo 0x7c843f35
js 0x7c843fab
scasd eax, dword es:[edi]
cdq
ret
lds edi, [eax - 3]
inc esi
jecxz 0x7c843f57
stosd dword es:[edi], eax
pop ebx
jmp 0x9323c090
jns 0x7c843f5a
xor edi, dword [eax + 0x4ccec7ca]
out 0x1a, eax
test byte [eax - 0x79c2e2ff], dh
outsb dx, byte [esi]
mov ecx, 0xaf645576
sbb eax, 0xb96e863d
jbe 0x7c844035
scasd eax, dword es:[edi]
push esp
push ebp
and dword [esi - 0x48fe826b], ecx
iretd
cmp eax, 0x75062630
pushfd
stosd dword es:[edi], eax
sub dword [ebx + 0x2e3f9060], 0x20
cmp esi, dword [esi + eax*2 - 0x17188682]
rcr dword [eax + esi*2], 1
invalid
into
dec eax
xlatb
test byte [esi - 0x18], ch
push 0x2dad20cc
int1
enter 0x150d, 0xffffffffffffffe1
cwde
jle 0x7c844021
ficom dword [edx]
dec ebx
in al, 0x9f
ficom dword [ecx]
push eax
mov esp, 0xca00f8b7
test al, 0x25
xchg esp, eax
jnp 0x7c843fd9
mov ebx, dword [eax]
xchg edx, eax
push edi
mov esp, 0xba2f5898
push es
invalid