Function at 0x406aa0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Enumerate pe sections
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x463598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push 0x4879fc
lea ecx, [esp + 0x18]
call fcn.004157d0
xor eax, eax
mov al, byte [esi]
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
push eax
push str.UseLocalCursor
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 1]
push ecx
push str.UseDesktopResize
lea ecx, [esp + 0x1c]
call fcn.00414f20
xor edx, edx
mov dl, byte [esi + 2]
lea ecx, [esp + 0x14]
push edx
push str.FullScreen
call fcn.00414f20
xor eax, eax
mov al, byte [esi + 3]
lea ecx, [esp + 0x14]
push eax
push str.FullScreenChangeResolution
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 4]
push ecx
push str.UseAllMonitors
lea ecx, [esp + 0x1c]
call fcn.00414f20
xor edx, edx
mov dl, byte [esi + 5]
lea ecx, [esp + 0x14]
push edx
push str.RelativePtr
call fcn.00414f20
xor eax, eax
mov al, byte [esi + 6]
lea ecx, [esp + 0x14]
push eax
push str.FullColour
call fcn.00414f20
mov ecx, dword [esi + 8]
push ecx
push str.LowColourLevel
lea ecx, [esp + 0x1c]
call fcn.00414ec0
mov edx, dword [esi + 0xc]
push edx
call fcn.00429b85
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], bl
push eax
push str.PreferredEncoding
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 1
call fcn.00414de0
xor eax, eax
mov al, byte [esi + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
push eax
push str.AutoSelect
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 0x11]
push ecx
push str.Shared
lea ecx, [esp + 0x1c]
call fcn.00414f20
xor edx, edx
mov dl, byte [esi + 0x12]
lea ecx, [esp + 0x14]
push edx
push str.SendPointerEvents
call fcn.00414f20
xor eax, eax
mov al, byte [esi + 0x13]
lea ecx, [esp + 0x14]
push eax
push str.SendKeyEvents
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 0x14]
push ecx
push str.ClientCutText
lea ecx, [esp + 0x1c]
call fcn.00414f20
xor edx, edx
mov dl, byte [esi + 0x15]
lea ecx, [esp + 0x14]
push edx
push str.ServerCutText
call fcn.00414f20
xor eax, eax
mov al, byte [esi + 0x16]
lea ecx, [esp + 0x14]
push eax
push str.ShareFiles
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 0x17]
push ecx
push str.DisableWinKeys
lea ecx, [esp + 0x1c]
call fcn.00414f20
xor edx, edx
mov dl, byte [esi + 0x20]
lea ecx, [esp + 0x14]
push edx
push str.Protocol3.3
call fcn.00414f20
xor eax, eax
mov al, byte [esi + 0x21]
lea ecx, [esp + 0x14]
push eax
push str.AcceptBell
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 0x18]
push ecx
push str.Emulate3
lea ecx, [esp + 0x1c]
call fcn.00414f20
mov edx, dword [esi + 0x1c]
push edx
push str.PointerEventInterval
lea ecx, [esp + 0x1c]
call fcn.00414ec0
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x406cab
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], bl
push eax
push str.Monitor
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 2
call fcn.00414de0
mov eax, dword [esi + 0x38]
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], bl
push eax
push str.Scaling
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 3
call fcn.00414de0
mov edi, dword [esi + 0x4c]
sub edi, 0x6f
cmp edi, 1
mov byte [esp + 0x30], bl
jl 0x406d02
cmp edi, 0xc
jg 0x406d02
push ebp
push 4
call fcn.00447107
push edi
mov ebp, eax
push 0x469efc
push ebp
call fcn.00447d0e
push ebx
call fcn.004470fd
add esp, 0x14
mov edi, ebp
pop ebp
jmp 0x406d13
push 0xffffffffffffffff
push 0x4699b4
call fcn.00442cf0
add esp, 8
mov edi, eax
mov dword [esp + 0xc], edi
push edi
push str.MenuKey
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 4
call fcn.00414de0
push edi
mov byte [esp + 0x34], bl
call fcn.004470fd
xor eax, eax
mov al, byte [esi + 0x58]
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str.AutoReconnect
call fcn.00414f20
xor ecx, ecx
mov cl, byte [esi + 0x59]
push ecx
push str.SingleSignOn
lea ecx, [esp + 0x1c]
call fcn.00414f20
mov edx, dword [esi + 0x5c]
push edx
push str.VerifyId
lea ecx, [esp + 0x1c]
call fcn.00414ec0
call fcn.00415e20
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00414f70
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret