Function at 0x40b810
Capabilities:
Check for sandbox and av modules

Disassembly:
sub esp, 0x36c
mov eax, dword [0x49c23c]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push ebp
push esi
push edi
push 0x3200
mov ebx, ecx
call fcn.0044037f
add esp, 4
mov ebp, eax
push 0x4628d0
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp eax, edi
je 0x40b8a9
push str.SymLoadModuleExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x40b8a9
mov eax, dword [0x4628b4]
mov cx, word [0x4628b8]
push 0x202
lea edx, [esp + 0x17a]
push edi
push edx
mov dword [esp + 0x17c], eax
mov word [esp + 0x180], cx
call fcn.00440500
add esp, 0xc
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x188]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebx + 0x614]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x64
push ebp
push edi
push edi
push edi
push edi
push edi
push edi
push eax
mov eax, dword [ecx + 0x7c]
call eax
test eax, eax
jge 0x40b8d9
push ebp
call fcn.004404db
add esp, 4
xor eax, eax
jmp 0x40ba89
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax*4]
shl ecx, 4
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, edi
je 0x40b8c9
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x4b4], eax
mov dword [ebx + 0x4b8], esi
mov dword [esp + 0x10], edi
cmp eax, edi
jbe 0x40ba7b
jmp 0x40b920
push 0x150
lea edx, [esp + 0x24]
push 0
push edx
call fcn.00440500
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
add esp, 0xc
push esi
lea eax, [esp + 0x24]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00409e20
test eax, eax
je 0x40baa2
push esi
mov ecx, ebx
call fcn.00409690
test eax, eax
jne 0x40baba
push 0x21
push esi
call fcn.00440e90
add esp, 8
test eax, eax
jne 0x40b996
mov ecx, dword [esp + 0x160]
lea eax, [esp + 0x124]
push eax
push ecx
push str._08x__s
lea edx, [ebx + 0x5c0]
push 0x28
push edx
call fcn.00409840
add esp, 0x14
test edi, edi
jne 0x40b9f2
lea edi, [ebx + 0x4bc]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x220]
mov ecx, 0x54
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
sub eax, dword [esp + 0x150]
lea edi, [ebx + 0x3b0]
sbb ecx, dword [esp + 0x154]
lea esi, [esp + 0x20]
mov dword [ebx + 0x3ac], ecx
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
mov dword [ebx + 0x3a8], eax
mov edi, 1
lea edx, [esp + 0x20]
push 0x5c
push edx
call fcn.00440f50
add esp, 8
test eax, eax
je 0x40ba08
inc eax
jmp 0x40ba0c
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call fcn.0040b620
test eax, eax
jne 0x40baba
mov eax, dword [esp + 0x10]
lea edi, [ebx + 0x4bc]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x220]
mov ecx, 0x54
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
shl eax, 7
mov edx, dword [eax + ecx]
mov eax, dword [eax + ecx + 4]
sub edx, dword [esp + 0x150]
lea edi, [ebx + 0x3b0]
sbb eax, dword [esp + 0x154]
mov ecx, 0x41
lea esi, [esp + 0x20]
mov dword [ebx + 0x3a8], edx
mov dword [ebx + 0x3ac], eax
rep movsd dword es:[edi], dword [esi]
mov ebp, dword [esp + 0x14]
push ebp
call fcn.004404db
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x378]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004404e6
add esp, 0x36c
ret
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
push ecx
push str.0x_I64x
push 0x50
push esi
call fcn.00409840
add esp, 0x14
mov eax, dword [esp + 0x10]
inc eax
add esi, 0x50
sub ebp, 0xffffff80
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x18]
jb 0x40b920
jmp 0x40ba77