Function at 0x40bbd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x456705
mov eax, dword fs:[0]
push eax
sub esp, 0xa90
mov eax, dword [0x479084]
xor eax, esp
mov dword [esp + 0xa88], eax
push ebx
push esi
push edi
mov eax, dword [0x479084]
xor eax, esp
push eax
lea eax, [esp + 0xaa0]
mov dword fs:[0], eax
mov esi, 0x114
push esi
xor edi, edi
push edi
mov ebx, 0x47c5b8
push ebx
call fcn.00412780
add esp, 0xc
mov dword [0x47c5b8], esi
call fcn.0043e595
push ebx
call dword [eax + 0x60]
mov dword [0x47c6d0], edi
mov dword [0x47c6cc], edi
mov dword [esp + 0x14], 0x2b
mov dword [esp + 0x18], 0x12
mov eax, dword [esp + 0x14]
imul eax, eax, 0x4d
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x5a
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
imul ecx, ecx, 0x53
cdq
push 0x13
pop esi
idiv esi
push 0x73
sub eax, ecx
mov ecx, dword [esp + 0x1c]
sub eax, ecx
add eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
pop ecx
sub ecx, eax
add ecx, dword [esp + 0x14]
push 0xffffffffffffffbd
add ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
add dword [esp + 0x18], 2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul eax, ecx
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, eax
add ecx, dword [esp + 0x18]
push 0x20
add ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x1c]
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
imul eax, ecx
mov ecx, dword [esp + 0x18]
imul ecx, ecx, 0x1323
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
imul eax, ecx
mov ecx, dword [esp + 0x14]
imul eax, ecx
imul eax, eax, 0x378
push 0xfffffffffffffffd
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
add ecx, dword [esp + 0x18]
push 0xffffffffffffff8b
add ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x18]
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
add ecx, dword [esp + 0x18]
push 0x4b
add ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x1c]
pop ecx
sub ecx, eax
add ecx, dword [esp + 0x18]
push 5
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
imul ecx, eax
mov eax, dword [esp + 0x18]
cdq
pop esi
idiv esi
sub ecx, eax
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [ecx + eax + 0x2a]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
imul eax, eax, 9
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0xaa8], edi
fld qword [0x473890]
mov eax, 0x20019
fstp qword [esp + 0x1c]
lea ebx, [esp + 0x30]
fld qword [esp + 0x1c]
push dword [0x47a8b4]
fadd qword [0x473888]
push reloc.OLEAUT32.dll_SysReAllocString
fstp qword [esp + 0x24]
call fcn.00404ccb
test eax, eax
jne 0x40bfbc
push 0x7fe
mov word [esp + 0x298], ax
xor ebx, ebx
lea eax, [esp + 0x29a]
push ebx
push eax
call fcn.00412780
fld qword [0x473868]
mov dword [esp + 0x5c], 0x400
fstp qword [esp + 0x30]
fld qword [0x4738f0]
add esp, 0xc
fstp qword [esp + 0x1c]
lea eax, [esp + 0x30]
fld qword [0x4738e8]
lea esi, [esp + 0x50]
fstp qword [esp + 0x44]
lea edi, [esp + 0x294]
fld qword [esp + 0x1c]
fld qword [esp + 0x24]
push dword [0x47a8b8]
fmul qword [0x4738e0]
push eax
fsubp st(1)
fstp qword [esp + 0x24]
call fcn.0040aa50
test eax, eax
jne 0x40bfbc
mov eax, edi
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
call fcn.004051a4
lea eax, [esp + 0x54]
push eax
mov edx, 0xfde9
lea ecx, [esp + 0x74]
mov byte [esp + 0xaac], 1
call fcn.0044af2f
cmp dword [eax + 0x14], 0x10
pop ecx
jb 0x40bebb
mov eax, dword [eax]
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x44]
push ecx
push dword [0x47a270]
push eax
call fcn.00413584
add esp, 0x10
cmp eax, 2
sete bl
push 1
xor edi, edi
lea esi, [esp + 0x74]
call fcn.00404d39
push 1
lea esi, [esp + 0x58]
call fcn.0040507d
test bl, bl
je 0x40bfbc
mov eax, dword [esp + 0x40]
fld qword [0x473868]
mov dword [0x47c6cc], eax
mov dword [esp + 0x24], 0x2c
mov dword [esp + 0x18], 0x1c
mov dword [esp + 0x44], 0x24
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x14], 0x35
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
push 3
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
add eax, 6
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x48]
imul eax, ecx
mov ecx, dword [esp + 0x1c]
imul ecx, ecx, 0x26
add eax, ecx
mov ecx, dword [esp + 0x18]
sub eax, ecx
add eax, dword [esp + 0x18]
add eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
lea eax, [eax + ecx + 0x4a]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
pop ecx
sub ecx, eax
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [0x47c6d0], eax
fstp qword [esp + 0x24]
fld qword [0x4738f0]
fstp qword [esp + 0x1c]
fld qword [0x4738e8]
fstp qword [esp + 0x44]
fld qword [esp + 0x1c]
fld qword [esp + 0x24]
fmul qword [0x4738e0]
fsubp st(1)
fstp qword [esp + 0x1c]
or dword [esp + 0xaa8], 0xffffffff
xor esi, esi
cmp dword [esp + 0x30], esi
je 0x40bfda
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x30], esi
xor eax, eax
push 0x206
mov word [esp + 0x90], ax
lea eax, [esp + 0x92]
push esi
push eax
mov dword [esp + 0x40], esi
call fcn.00412780
add esp, 0xc
push dword [0x47a8bc]
lea eax, [esp + 0x90]
push eax
call fcn.00412e82
fld qword [0x473890]
fstp qword [esp + 0x24]
pop ecx
fld qword [esp + 0x20]
pop ecx
fadd qword [0x473888]
push 0x104
lea eax, [esp + 0x90]
push eax
fstp qword [esp + 0x24]
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
call fcn.0043e595
lea ecx, [esp + 0x8c]
push ecx
call dword [eax + 0x180]
fld qword [0x473880]
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
mov dword [0x47c6d4], eax
fstp qword [esp + 0x1c]
fld qword [0x473878]
mov eax, 0x47c5b8
fstp qword [esp + 0x24]
fld qword [0x473870]
fstp qword [esp + 0x24]
fld qword [0x473868]
fstp qword [esp + 0x24]
fld qword [esp + 0x24]
fmul qword [0x473860]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
mov ecx, dword [esp + 0xaa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa88]
xor ecx, esp
call fcn.004106ae
mov esp, ebp
pop ebp
ret