Function at 0x4e7d1c
Capabilities:
Check for software breakpoints
Get os information via kuser_shared_data

Disassembly:
mov eax, 0x4eb810
cld
cmp byte [eax], 0
mov edx, 0x4ee09c
je 0x4e7d2d
ret
cmp byte [eax + 1], 0
je 0x4e7d3a
cmp byte [eax], 0
je 0x4e7d33
jmp 0x4e7d2c
inc byte [eax + 1]
push ebx
push ebp
push esi
push edi
push eax
mov esi, 0x4e7f7f
sub eax, eax
mov edi, edx
push 0x4e7f44
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
pop ecx
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, dword fs:[eax + 0x30]
mov edx, ds
test dl, 4
jne 0x4e7ddc
mov edx, 0x7ffe026c
mov ah, byte [edx]
cmp ah, 4
mov al, byte [edx + 4]
jb 0x4e7d7c
cmp ah, 5
jbe 0x4e7d80
mov ax, 0x333
shl eax, 0x10
mov ax, 0x101
stosd dword es:[edi], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0x1c]
mov ebx, dword [eax + 8]
mov eax, 0x4e8004
call esi
stosd dword es:[edi], eax
mov eax, 0x4e801a
call esi
test eax, eax
stosd dword es:[edi], eax
je 0x4e7daa
mov eax, 0x4e80dc
stosd dword es:[edi], eax
mov eax, 0x4e8032
call esi
test eax, eax
stosd dword es:[edi], eax
je 0x4e7dbc
mov eax, 0x4e81a8
stosd dword es:[edi], eax
mov eax, 0x4e8046
call esi
test eax, eax
stosd dword es:[edi], eax
je 0x4e7dce
mov eax, 0x4e8307
stosd dword es:[edi], eax
mov eax, 0x406c00
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x4e7f30
mov ax, 0x840a
mov ebx, 0xbff70000
cmp dl, 0x60
mov edx, 0x5058454b
jae 0x4e7df1
mov al, 3
cmp dword [ebx + 0x1000], edx
je 0x4e7e0b
cmp al, 0x5a
je 0x4e7e07
sub ebx, 0x10000
mov al, 0x5a
jmp 0x4e7df1
sub ebx, ebx
jmp 0x4e7e33
mov edx, dword [ebx + 0x1008]
test dl, 3
jne 0x4e7e07
cmp edx, ebx
jbe 0x4e7e07
push ecx
lea ecx, [ebx + 0x70000]
cmp edx, ecx
pop ecx
jae 0x4e7e07
mov ebp, edx
mov edx, dword [edx]
mov edx, dword [edx]
cmp dword [edx], 6
jne 0x4e7e33
mov al, bl
shl eax, 0x10
mov ax, 0x101
push ecx
stosd dword es:[edi], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
pop ecx
xor eax, ecx
stosd dword es:[edi], eax
test ebx, ebx
je 0x4e7f30
push 0x47
pop eax
call esi
stosd dword es:[edi], eax
mov eax, dword [edx + 0x68]
add eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edx + 0x6c]
add eax, ebx
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x58]
add eax, ebx
lea ecx, [edi + 0x20]
push ecx
call eax
cmp byte [edi - 0xa], bl
jne 0x4e7e77
sub ebp, 8
mov eax, dword [ebp + 0x30]
cmp eax, ebx
jae 0x4e7e81
mov eax, dword [edi + 0x20]
mov dword [edi + 0x24], eax
mov eax, 0x4e8099
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
mov eax, 0x4e8163
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
mov eax, fcn.004e8257
stosd dword es:[edi], eax
mov eax, 0x4e8053
call esi
stosd dword es:[edi], eax
cmp eax, ebx
lea ebp, [ebx + 0x30000]
jb 0x4e7ebf
cmp eax, ebp
jae 0x4e7ebf
sub eax, 0xf1
push 0x5f
pop ecx
call fcn.004e7f5e
test ecx, ecx
jne 0x4e7f25
mov eax, 0x4e8065
call esi
cmp eax, ebx
jb 0x4e7efb
cmp eax, ebp
jae 0x4e7efb
push 0x48
pop ecx
add eax, 0x55
cmp dword [eax], ecx
je 0x4e7ee6
add eax, 0xe
cmp dword [eax], ecx
je 0x4e7ee6
add eax, 0x58
cmp dword [eax], ecx
jne 0x4e7efb
add eax, 0x19
mov cl, byte [eax - 5]
cmp cl, 0xe8
je 0x4e7ef6
cmp cl, 0xcc
jne 0x4e7efb
add eax, dword [eax - 4]
jmp 0x4e7f25
lea eax, [ebx + 0x24f00]
mov ecx, 0x2800
call fcn.004e7f5e
test ecx, ecx
jne 0x4e7f25
lea eax, [ebx + 0x2bd00]
mov ecx, 0x1000
call fcn.004e7f5e
test ecx, ecx
jne 0x4e7f25
sub eax, eax
test eax, eax
stosd dword es:[edi], eax
je 0x4e7f2f
mov eax, 0x4e8361
stosd dword es:[edi], eax
pop dword fs:[0]
pop ecx
pop eax
pop edi
pop esi
pop ebp
pop ebx
inc byte [eax]
jmp fcn.004e7d1c