Function at 0x42e504
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [0x434cb0]
mov esi, dword [0x434c08]
mov edi, dword [0x434c94]
xor eax, eax
push ebp
push 0x42efa4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403e90
cmp al, 1
jne 0x42e7b7
mov eax, ebx
mov edx, dword [esi]
call fcn.00401788
lea eax, [ebx + 0x100]
mov edx, dword [esi]
add edx, 0x100
call fcn.00401788
lea eax, [ebx + 0x600]
mov edx, dword [esi]
add edx, 0x600
call fcn.00401788
lea eax, [ebx + 0x700]
mov edx, dword [esi]
add edx, 0x700
call fcn.00401788
lea eax, [ebx + 0x800]
mov edx, dword [esi]
add edx, 0x800
call fcn.00401788
lea eax, [ebx + 0x900]
mov edx, dword [esi]
add edx, 0x900
call fcn.00401788
lea eax, [ebx + 0xa00]
mov edx, dword [esi]
add edx, 0xa00
call fcn.00401788
lea eax, [ebx + 0xb00]
mov edx, dword [esi]
add edx, 0xb00
call fcn.00401788
lea eax, [ebx + 0xc00]
mov edx, dword [esi]
add edx, 0xc00
call fcn.00401788
lea eax, [ebx + 0xd00]
mov edx, dword [esi]
add edx, 0xd00
call fcn.00401788
lea eax, [ebx + 0xe00]
mov edx, dword [esi]
add edx, 0xe00
call fcn.00401788
lea eax, [ebx + 0xf00]
mov edx, dword [esi]
add edx, 0xf00
call fcn.00401788
lea eax, [ebx + 0x1000]
mov edx, dword [esi]
add edx, 0x1000
call fcn.00401788
lea eax, [ebx + 0x1100]
mov edx, dword [esi]
add edx, 0x1100
call fcn.00401788
lea eax, [ebx + 0x1200]
mov edx, dword [esi]
add edx, 0x1200
call fcn.00401788
lea eax, [ebx + 0x1300]
mov edx, dword [esi]
add edx, 0x1300
call fcn.00401788
lea eax, [ebx + 0x1400]
mov edx, dword [esi]
add edx, 0x1400
call fcn.00401788
lea eax, [ebx + 0x1500]
mov edx, dword [esi]
add edx, 0x1500
call fcn.00401788
lea eax, [ebx + 0x1600]
mov edx, dword [esi]
add edx, 0x1600
call fcn.00401788
lea eax, [ebx + 0x1700]
mov edx, dword [esi]
add edx, 0x1700
call fcn.00401788
lea eax, [ebx + 0x1800]
mov edx, dword [esi]
add edx, 0x1800
call fcn.00401788
lea eax, [ebx + 0x1900]
mov edx, dword [esi]
add edx, 0x1900
call fcn.00401788
mov eax, dword [esi]
mov eax, dword [eax + 0x1a00]
mov dword [ebx + 0x1a00], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a04]
mov dword [ebx + 0x1a04], eax
mov eax, dword [esi]
mov al, byte [eax + 0x1a0c]
mov byte [ebx + 0x1a0c], al
lea eax, [ebx + 0x200]
mov edx, dword [esi]
add edx, 0x200
call fcn.00401788
mov eax, dword [esi]
mov al, byte [eax + 0x1a10]
mov byte [ebx + 0x1a10], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a0f]
mov byte [ebx + 0x1a0f], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a0d]
mov byte [ebx + 0x1a0d], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a0e]
mov byte [ebx + 0x1a0e], al
lea eax, [ebx + 0x300]
mov edx, dword [esi]
add edx, 0x300
call fcn.00401788
lea eax, [ebx + 0x400]
mov edx, dword [esi]
add edx, 0x400
call fcn.00401788
lea eax, [ebx + 0x500]
mov edx, dword [esi]
add edx, 0x500
call fcn.00401788
mov eax, dword [esi]
mov eax, dword [eax + 0x1a08]
mov dword [ebx + 0x1a08], eax
mov eax, dword [esi]
mov al, byte [eax + 0x1a11]
mov byte [ebx + 0x1a11], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a12]
mov byte [ebx + 0x1a12], al
jmp 0x42e9be
push edi
mov edi, ebx
mov esi, 0x42efb4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x100]
mov esi, 0x42efc0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x600]
mov esi, 0x42efc8
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x700]
mov esi, 0x42efd0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x800]
mov esi, 0x42efe0
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x900]
mov esi, 0x42effc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xa00]
mov esi, 0x42f00c
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xb00]
mov esi, 0x42f03c
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov dword [ebx + 0x1a00], 0x3e5b
mov dword [ebx + 0x1a04], 5
mov byte [ebx + 0x1a0c], 1
push edi
lea edi, [ebx + 0x200]
mov esi, 0x42f044
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov byte [ebx + 0x1a10], 1
mov byte [ebx + 0x1a0f], 1
mov byte [ebx + 0x1a0d], 1
mov byte [ebx + 0x1a0e], 1
push edi
lea edi, [ebx + 0x300]
mov esi, 0x42efc0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov byte [ebx + 0x400], 0
mov byte [ebx + 0x500], 0
xor eax, eax
mov dword [ebx + 0x1a08], eax
mov byte [ebx + 0x1a11], 0
mov byte [ebx + 0x1a12], 0
push edi
lea edi, [ebx + 0xc00]
mov esi, 0x42f050
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xd00]
mov esi, 0x42f058
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xe00]
mov esi, 0x42f060
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0xf00]
mov esi, 0x42f068
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1000]
mov esi, 0x42f078
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1100]
mov esi, 0x42f080
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1200]
mov esi, 0x42f088
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x1300]
mov esi, 0x42f090
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1400]
mov esi, 0x42f09c
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1500]
mov esi, 0x42f0a4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1600]
mov esi, 0x42f0ac
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1700]
mov esi, 0x42f0cc
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x1800]
mov esi, 0x42f0e4
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x1900]
mov esi, 0x42f0fc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
lea edx, [ebp - 4]
mov eax, 1
call fcn.0040439c
mov eax, dword [ebp - 4]
mov edx, 0x42f118
call fcn.004026fc
jne 0x42ea17
mov ebx, 5
lea edx, [ebp - 8]
mov eax, 2
call fcn.0040439c
mov eax, dword [ebp - 8]
call fcn.0041f340
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.0040439c
mov eax, dword [ebp - 0xc]
call fcn.00405968
test al, al
je 0x42ea17
push 0xa
call fcn.00403900
dec ebx
jne 0x42e9df
mov eax, dword [0x434d30]
mov word [eax], 0x31
mov eax, dword [0x434d30]
mov word [eax + 2], 1
mov eax, dword [0x434d30]
mov word [eax + 0xe], 0
mov eax, dword [0x434d30]
mov dword [eax + 4], 0x1f40
mov eax, dword [0x434d30]
mov word [eax + 0xc], 0x41
mov eax, dword [0x434d30]
mov dword [eax + 8], 0x659
mov eax, dword [0x434d30]
mov word [eax + 0x10], 2
mov eax, dword [0x434d30]
mov byte [eax + 0x12], pe_nt_image_headers32
mov eax, dword [0x434d30]
mov byte [eax + 0x13], 1
mov eax, dword [0x434c60]
mov word [eax], 1
mov eax, dword [0x434c60]
mov word [eax + 2], 1
mov eax, dword [0x434c60]
mov word [eax + 0xe], 8
mov eax, dword [0x434c60]
mov dword [eax + 4], 0x1f40
mov eax, dword [0x434c60]
mov word [eax + 0xc], 1
mov eax, dword [0x434c60]
mov dword [eax + 8], 0x1f40
mov eax, dword [0x434c60]
mov word [eax + 0x10], 0
mov eax, dword [0x434c60]
mov byte [eax + 0x12], pe_nt_image_headers32
mov eax, dword [0x434c60]
mov byte [eax + 0x13], 1
mov word [edi], 1
mov word [edi + 2], 1
mov dword [edi + 4], 0x2b11
mov dword [edi + 8], 0x2b11
mov word [edi + 0xc], 1
mov word [edi + 0xe], 8
mov word [edi + 0x10], 0
mov byte [edi + 0x12], pe_nt_image_headers32
mov byte [edi + 0x13], 1
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0041eee0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x434d20]
call fcn.00402468
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.0041eee0
mov edx, dword [ebp - 0x14]
mov eax, dword [0x434c88]
call fcn.00402468
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.0041eee0
mov edx, dword [ebp - 0x18]
mov eax, dword [0x434bec]
call fcn.00402468
lea edx, [ebp - 0x1c]
mov eax, 3
call fcn.0041eee0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x434c10]
call fcn.00402468
mov dl, 1
mov eax, dword [0x426dbc]
call fcn.00401b7c
mov dword [0x437880], eax
mov dl, 1
mov eax, dword [0x40f520]
call fcn.004108f0
mov ebx, eax
mov eax, dword [0x437880]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041075c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d1c
mov edx, eax
mov eax, dword [0x437880]
mov eax, dword [eax + 4]
call fcn.004107bc
mov eax, dword [0x437880]
mov eax, dword [eax + 4]
mov edx, dword [0x437880]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x42db30
mov edx, dword [0x437880]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42dabc
mov edx, dword [0x437880]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42dad8
mov edx, dword [0x437880]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x42da40
mov dl, 1
mov eax, dword [0x426eec]
call fcn.00401b7c
mov dword [0x43788c], eax
mov dl, 1
mov eax, dword [0x40f520]
call fcn.004108f0
mov ebx, eax
mov eax, dword [0x43788c]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041075c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d1c
mov edx, eax
mov eax, dword [0x43788c]
mov eax, dword [eax + 4]
call fcn.004107bc
mov eax, dword [0x43788c]
mov eax, dword [eax + 4]
mov edx, dword [0x43788c]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4272ac
mov edx, dword [0x43788c]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42727c
mov edx, dword [0x43788c]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x427298
mov edx, dword [0x43788c]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x427244
mov dl, 1
mov eax, dword [0x426e84]
call fcn.00401b7c
mov dword [0x437884], eax
mov dl, 1
mov eax, dword [0x40f520]
call fcn.004108f0
mov ebx, eax
mov eax, dword [0x437884]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041075c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d1c
mov edx, eax
mov eax, dword [0x437884]
mov eax, dword [eax + 4]
call fcn.004107bc
mov eax, dword [0x437884]
mov eax, dword [eax + 4]
mov edx, dword [0x437884]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x42e118
mov edx, dword [0x437884]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42deac
mov edx, dword [0x437884]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42dec8
mov edx, dword [0x437884]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x42de80
mov dl, 1
mov eax, dword [0x426e20]
call fcn.00401b7c
mov dword [0x437888], eax
mov dl, 1
mov eax, dword [0x40f520]
call fcn.004108f0
mov ebx, eax
mov eax, dword [0x437888]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041075c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d1c
mov edx, eax
mov eax, dword [0x437888]
mov eax, dword [eax + 4]
call fcn.004107bc
mov eax, dword [0x437888]
mov eax, dword [eax + 4]
mov edx, dword [0x437888]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x42ded4
mov edx, dword [0x437888]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42e08c
mov edx, dword [0x437888]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42e0a8
mov edx, dword [0x437888]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x42e04c
mov dl, 1
mov eax, dword [0x426d54]
call fcn.00401b7c
mov dword [0x437894], eax
mov dl, 1
mov eax, dword [0x40f520]
call fcn.004108f0
mov ebx, eax
mov eax, dword [0x437894]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041075c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d1c
mov edx, eax
mov eax, dword [0x437894]
mov eax, dword [eax + 4]
call fcn.004107bc
mov eax, dword [0x437894]
mov eax, dword [eax + 4]
mov edx, dword [0x437894]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4277f0
mov edx, dword [0x437894]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x427744
mov edx, dword [0x437894]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42776c
mov edx, dword [0x437894]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x427548
mov dl, 1
mov eax, dword [0x426cf0]
call fcn.00401b7c
mov dword [0x437890], eax
mov dl, 1
mov eax, dword [0x40f520]
call fcn.004108f0
mov ebx, eax
mov eax, dword [0x437890]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041075c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d1c
mov edx, eax
mov eax, dword [0x437890]
mov eax, dword [eax + 4]
call fcn.004107bc
mov eax, dword [0x437890]
mov eax, dword [eax + 4]
mov edx, dword [0x437890]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x427ccc
mov edx, dword [0x437890]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x427b2c
mov edx, dword [0x437890]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x427b48
mov edx, dword [0x437890]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x427a50
mov dl, 1
mov eax, dword [0x426f50]
call fcn.00401b7c
mov dword [0x437898], eax
mov dl, 1
mov eax, dword [0x4158d4]
call fcn.00415a60
mov dword [0x43789c], eax
mov dl, 1
mov eax, dword [0x415cfc]
call fcn.00415d50
mov dword [0x4378a0], eax
mov eax, dword [0x4378a0]
mov edx, dword [0x437898]
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa0], 0x42e0c8
mov eax, dword [0x434c60]
mov edx, dword [0x43789c]
mov esi, eax
lea edi, [edx + 0x15c]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x434d30]
mov edx, dword [0x43789c]
mov esi, eax
lea edi, [edx + 0x1dd]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42efab
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00402438
ret