Function at 0x416e70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a1538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx]
push ebp
push esi
push edi
add eax, 0xc
push 0x4b84f0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0041fbc0
push str.hex_2_:
lea ecx, [esp + 0x14]
push ecx
mov esi, 7
mov dword [esp + 0x38], 0
call fcn.00419c10
mov byte [esp + 0x30], 1
mov edi, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [edi + 4]
mov ecx, dword [edx + 4]
lea ebp, [ecx + eax + 3]
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 4]
lea ecx, [ecx + ecx + 2]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], 0
test ecx, ecx
jle 0x417064
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
movzx cx, byte [edx + eax]
movzx eax, cx
movzx edx, ax
push edx
lea eax, [esp + 0x24]
push str._02x
push eax
call fcn.0041b640
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call fcn.00402210
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x20]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x416f54
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 4]
lea esi, [ebx + 1]
lea ecx, [esi + esi + 0xe]
cmp dword [eax + 8], ecx
jge 0x416f92
cmp ecx, 0x80
jle 0x416f99
mov ecx, ebx
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
cmp esi, eax
jle 0x416f89
mov eax, esi
lea edx, [esp + 0x10]
push edx
mov ecx, eax
jmp 0x416fa0
mov eax, dword [eax]
cmp eax, 1
je 0x416fa5
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00419f20
mov edi, dword [esp + 0x10]
xor edx, edx
mov word [edi + esi*2 + 0xc], dx
mov ax, word [0x4c0144]
mov word [edi + ebx*2 + 0xc], ax
xor ecx, ecx
add ebp, 3
cmp ebp, 0x4d
mov dword [edi + 4], esi
mov word [edi + esi*2 + 0xc], cx
jl 0x417049
mov ebx, dword [edi + 4]
lea esi, [ebx + 4]
lea eax, [esi + esi + 0xe]
cmp dword [edi + 8], eax
jge 0x41700d
cmp eax, 0x80
jg 0x416fea
lea edx, [esp + 0x10]
push edx
jmp 0x417019
mov edi, ebx
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, edi
cmp esi, eax
jle 0x417004
mov eax, esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
jmp 0x41701b
mov edx, dword [edi]
cmp edx, 1
je 0x417020
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00419f20
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov word [edi + esi*2 + 0xc], cx
mov edx, dword [0x4c0148]
mov dword [edi + ebx*2 + 0xc], edx
mov eax, dword [0x4c014c]
mov dword [edi + ebx*2 + 0x10], eax
mov dword [edi + 4], esi
mov word [edi + esi*2 + 0xc], cx
lea ebp, [ecx + 2]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
jl 0x416efc
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x3c]
cmp dword [eax + 4], 0
je 0x4170d2
mov esi, dword [edi + 4]
lea eax, [esi + esi + 0xe]
cmp dword [edi + 8], eax
lea ebp, [esi - 1]
jge 0x4170aa
cmp eax, 0x80
jg 0x417087
lea edx, [esp + 0x10]
push edx
jmp 0x4170b6
mov edi, esi
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, edi
cmp esi, eax
jle 0x4170a1
mov eax, esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
jmp 0x4170b8
mov edx, dword [edi]
cmp edx, 1
je 0x4170bd
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00419f20
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov word [edi + esi*2 + 0xc], cx
xor edx, edx
mov dword [edi + 4], ebp
mov word [edi + ebp*2 + 0xc], dx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push eax
push ebx
push ecx
call fcn.00417640
mov byte [esp + 0x30], 0
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push edi
call ebp
test eax, eax
jg 0x417101
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov dword [esp + 0x30], 0xffffffff
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x417121
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8