Function at 0x405720
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4634d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], esi
mov al, byte [0x487e0c]
mov byte [esi], al
mov cl, byte [0x487abc]
mov byte [esi + 1], cl
mov dl, byte [0x487d08]
mov byte [esi + 2], dl
mov al, byte [0x487d64]
mov byte [esi + 3], al
mov ecx, dword [0x487ce4]
xor ebx, ebx
cmp ecx, ebx
setne cl
mov byte [esi + 4], cl
mov dl, byte [0x487aa0]
mov byte [esi + 5], dl
mov al, byte [0x487cac]
mov byte [esi + 6], al
mov ecx, dword [0x487b64]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0x10
mov dl, byte [0x487db8]
mov byte [esi + 0x10], dl
mov al, byte [0x487df0]
mov byte [esi + 0x11], al
mov cl, byte [0x487d80]
mov byte [esi + 0x12], cl
mov dl, byte [0x487d48]
mov byte [esi + 0x13], dl
mov al, byte [0x487dd4]
mov byte [esi + 0x14], al
mov cl, byte [0x487b48]
mov byte [esi + 0x15], cl
mov dl, byte [0x487cc8]
mov byte [esi + 0x16], dl
mov al, byte [0x487be4]
mov byte [esi + 0x17], al
mov cl, byte [0x487b10]
mov byte [esi + 0x18], cl
mov edx, dword [0x487d24]
mov dword [esi + 0x1c], edx
mov al, byte [0x487d9c]
mov byte [esi + 0x20], al
mov cl, byte [0x487c38]
mov byte [esi + 0x21], cl
mov edx, dword [0x487bb0]
mov ecx, 0x487bb0
call dword [edx + 0xc]
mov dword [esi + 0x24], eax
lea ecx, [esi + 0x28]
mov dword [esp + 0x20], ebx
call fcn.00405710
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov eax, dword [0x487be8]
mov ecx, 0x487be8
mov byte [esp + 0x20], 3
call dword [eax + 0xc]
mov dword [esi + 0x34], eax
mov edx, dword [0x487c5c]
mov ecx, 0x487c5c
mov byte [esp + 0x20], 4
call dword [edx + 0xc]
mov dword [esi + 0x38], eax
lea edi, [esi + 0x3c]
mov dword [edi], ebx
lea ebp, [esi + 0x40]
mov dword [ebp], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, dword [0x487b70]
mov ecx, 0x487b70
mov byte [esp + 0x20], 7
call dword [eax + 0xc]
mov dword [esi + 0x50], eax
mov edx, dword [0x487b14]
mov ecx, 0x487b14
mov byte [esp + 0x20], 8
call dword [edx + 0xc]
mov dword [esi + 0x54], eax
mov al, byte [0x487ad8]
mov byte [esi + 0x58], al
mov cl, byte [0x487af4]
cmp byte [esi + 0x10], bl
mov byte [esi + 0x59], cl
mov edx, dword [0x487ba4]
mov byte [esp + 0x20], 9
mov dword [esi + 0x5c], edx
je 0x4058b3
mov dword [esi + 0xc], 0x10
jmp 0x4058e4
mov eax, dword [0x487c78]
mov ecx, 0x487c78
call dword [eax + 0xc]
mov dword [esp + 0x10], eax
push eax
mov byte [esp + 0x24], 0xa
call fcn.00429b00
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi + 0xc], eax
mov byte [esp + 0x28], 9
call fcn.004470fd
add esp, 8
mov edx, dword [0x487c04]
mov ecx, 0x487c04
call dword [edx + 0xc]
cmp byte [eax], bl
mov dword [esp + 0x10], eax
jne 0x4058ff
mov dword [esi + 0x4c], ebx
jmp 0x405929
mov dword [esi + 0x4c], 0x77
cmp byte [eax], 0x46
jne 0x405929
inc eax
push eax
call fcn.00447ee0
add esp, 4
cmp eax, 1
jb 0x405925
cmp eax, 0xc
ja 0x405925
add eax, 0x6f
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x10]
push eax
call fcn.004470fd
add esp, 4
push ebp
push edi
mov ecx, 0x487c3c
call fcn.004428c0
lea eax, [esi + 0x48]
push eax
lea eax, [esi + 0x44]
push eax
mov ecx, 0x487a68
call fcn.004428c0
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret