Function at 0x4291c3
Capabilities:
Check for debugger via api

Disassembly:
push 0x2b0
mov eax, 0x4848d0
call fcn.00483193
mov esi, edx
mov dword [ebp - 0x280], esi
mov eax, ecx
mov dword [ebp - 0x28c], eax
test esi, esi
je 0x49098e
lea ecx, [ebp - 0x2a4]
call fcn.00475c60
xor edi, edi
lea ecx, [ebp - 0x29c]
mov dword [ebp - 4], edi
call fcn.0046deab
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0047fa9c
lea eax, [ebp - 0x29c]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.00476efe
mov eax, dword [ebp - 0x29c]
mov ecx, 0x429e01
mov dword [ebp - 0x274], ecx
mov dword [eax + 0xe8], esi
lea esi, [eax + 0x20]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x4906ff
lea ecx, [ebp - 0x274]
push ecx
push eax
mov ecx, esi
call fcn.00471998
mov eax, dword [esi + 4]
mov ecx, 0x47cc55
mov dword [ebp - 0x274], ecx
cmp eax, dword [esi + 8]
jne 0x49070a
lea ecx, [ebp - 0x274]
push ecx
push eax
mov ecx, esi
call fcn.00471998
mov ecx, dword [ebp - 0x29c]
lea eax, [ebp - 0x2a4]
push eax
call fcn.0047711b
push dword [ebp - 0x280]
push edi
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov byte [ebp - 0x2b8], 1
mov dword [ebp - 0x2bc], ecx
test ecx, ecx
je 0x4908f8
xor eax, eax
mov dword [ebp - 0x26c], edi
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x268]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x270], eax
lea edx, [ebp - 0x270]
mov byte [ebp - 4], 8
mov ecx, 0x53a178
call fcn.00479c02
mov eax, dword [ebp - 0x270]
push 0x28
mov dword [ebp - 0x274], eax
call fcn.00481a43
pop ecx
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x280], eax
push ecx
mov ecx, eax
call fcn.0047c9e5
mov edx, eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x274], edx
lea ecx, [edx + 0xc]
mov dword [ebp - 0x288], ecx
mov byte [ebp - 4], 9
or esi, 0xffffffff
cmp byte [ecx + 4], 0
je 0x490715
test ecx, ecx
je 0x429383
mov eax, dword [ecx + 8]
mov edx, 0x53a160
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x274], eax
call fcn.0046edef
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 8
jb 0x429370
mov eax, dword [eax]
push eax
call dword [ebp - 0x274]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0043308e
lea eax, [ebp - 0x288]
push eax
call fcn.0047fe5b
lea ecx, [ebp - 0x27c]
call fcn.0042a2bc
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x2ac], edi
test eax, eax
je 0x4293b3
call dword [eax + 0x18]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x2b0], edi
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x2b4]
mov ecx, 0x5452d8
push eax
call fcn.004295f8
test al, al
jne 0x42949a
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x4294cc
lea eax, [ebp - 0x27c]
push eax
call fcn.004290af
mov eax, dword [ebp - 0x27c]
or eax, dword [ebp - 0x278]
jne 0x42947b
cmp dword [ebp - 0x288], 0
je 0x4293db
push edi
push dword [ebp - 0x2ac]
push dword [ebp - 0x274]
push dword [ebp - 0x280]
call fcn.004290f1
add esp, 0x10
test al, al
je 0x4293db
mov eax, dword [ebp - 0x288]
call dword [eax + 0xc]
lea ecx, [ebp - 0x294]
call fcn.0042a2bc
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x274], eax
jmp 0x4293db
push dword [ebp - 0x278]
push dword [ebp - 0x27c]
push 5
call fcn.00427ece
add esp, 0xc
test al, al
je 0x429422
jmp 0x490767
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], 2
push eax
mov ecx, 0x545338
mov dword [ebp - 0x290], edi
call fcn.004295f8
test al, al
jne 0x4294d3
cmp dword [0x5454d8], 2
je 0x490824
xor ecx, ecx
call fcn.0048051d
mov ecx, dword [ebp - 0x29c]
call fcn.004805fb
mov eax, dword [ebp - 0x2a4]
lea ecx, [ebp - 0x2b4]
add eax, 0x158
push eax
call fcn.00425c79
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x13
call fcn.00480f5b
lea ecx, [ebp - 0x2a4]
call fcn.00480f5b
mov ecx, dword [ebp - 0x2b4]
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x294], 1
mov dword [ebp - 0x290], edi
call fcn.004295f8
test al, al
je 0x4294cc
mov eax, dword [ebp - 0x288]
test eax, eax
je 0x429542
call dword [eax + 0x10]
mov eax, dword [ebp - 0x28c]
mov dword [eax], edi
mov edi, dword [ebp - 0x2b0]
test edi, edi
je 0x42957b
mov byte [ebp - 4], 0x14
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x42957b
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 0x15
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x42957b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edi, dword [ebp - 0x284]
test edi, edi
je 0x4295a5
mov byte [ebp - 4], 0x16
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4295a5
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 0x17
mov eax, esi
lock xadd dword [edi + 8], eax
je 0x4295ef
mov edi, dword [ebp - 0x5c]
test edi, edi
jne 0x490878
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.0043baa3
mov edi, dword [ebp - 0x298]
test edi, edi
jne 0x49088e
mov dword [ebp - 4], esi
mov edi, dword [ebp - 0x2a0]
test edi, edi
jne 0x4908c2
mov eax, dword [ebp - 0x28c]
call fcn.0048313d
ret
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x4295a5
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x429267
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x42928d
mov ecx, edi
mov eax, edi
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x284], eax
test edx, edx
je 0x429383
mov byte [ebp - 4], 0xa
mov eax, esi
lock xadd dword [edx + 4], eax
jne 0x49075e
mov eax, dword [edx]
mov ecx, edx
call dword [eax]
mov byte [ebp - 4], 0xb
mov eax, esi
mov ecx, dword [ebp - 0x274]
lock xadd dword [ecx + 8], eax
jne 0x490758
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x288]
mov byte [ebp - 4], 9
jmp 0x42934a
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2a8], edi
push eax
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 0x2a8], 0
jne 0x429422
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x429422
mov ecx, dword [0x5454e4]
mov eax, edi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x278], eax
test ecx, ecx
je 0x4907d3
call fcn.0043c406
test al, al
je 0x4907d3
mov edi, dword [0x5454e0]
mov eax, dword [0x5454e4]
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 0x10
test edi, edi
je 0x4907e9
mov eax, dword [edi]
lea ecx, [ebp - 0x274]
push ecx
mov ecx, edi
call dword [eax + 0x20]
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0x278]
test edi, edi
je 0x49081d
mov byte [ebp - 4], 0x11
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x49081d
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 0x12
lock xadd dword [edi + 8], esi
dec esi
jne 0x49081d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, 0xf0000000
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.004bf371
push 0x19
push 0x41d470
push 0x41d440
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.004dac80
add esp, 0xc
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xf
call fcn.0043baa3
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004bf221
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0043baa3
jmp 0x4294cc
mov ecx, edi
call fcn.0043308e
push 0x18
push edi
call fcn.00481cc4
pop ecx
pop ecx
jmp 0x4295b0
mov byte [ebp - 4], 0x18
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4295d2
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 0x19
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x4295d2
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x4295d2
mov dword [ebp - 4], 0x1a
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4295e3
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 0x1b
lock xadd dword [edi + 8], esi
dec esi
jne 0x4295e3
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
jmp 0x4295e3
mov eax, dword [ebp - 0x28c]
push ecx
mov dword [eax], 0x80004005
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.0043baa3
mov edi, dword [ebp - 0x298]
or esi, 0xffffffff
test edi, edi
je 0x490947
mov byte [ebp - 4], 4
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x490947
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 5
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x490947
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], esi
mov edi, dword [ebp - 0x2a0]
test edi, edi
je 0x4295e3
mov dword [ebp - 4], 6
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4295e3
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 4], 7
lock xadd dword [edi + 8], esi
dec esi
jne 0x4295e3
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x4295e3
mov dword [eax], 0x80004005
jmp 0x4295e9