Function at 0x4e6f11
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66c07d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1720
call fcn.005b4b80
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1730]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 6
mov dword [ebp - 0x16d8], eax
mov dword [ebp - 0x1718], ebx
call fcn.00539837
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edi, eax
mov dword [ebp - 0x16c4], edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push ebx
mov dword [ebp - 0x16e4], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [ebp - 0x16e8], eax
call dword [sym.imp.dbghelp.dll_SymGetOptions]
or eax, 6
push eax
call dword [sym.imp.dbghelp.dll_SymSetOptions]
xor eax, eax
inc eax
push eax
push ebx
push edi
call dword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
jne 0x4e6ff1
mov ecx, dword [ebp - 0x16d8]
lea eax, [ebp - 0x1730]
push eax
call fcn.00539554
lea ecx, [ebp - 0x1730]
call fcn.00539a16
mov eax, dword [ebp - 0x16d8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret
push 0x108
xor edx, edx
lea eax, [ebp - 0x13e8]
inc edx
lea edi, [ebp - 0x16b4]
mov ecx, 0xb3
mov byte [ebp - 4], dl
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005f3980
mov eax, dword [ebp - 0x15fc]
add esp, 0xc
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x13c8], eax
mov eax, dword [ebp - 0x15f0]
push 3
pop ecx
mov dword [ebp - 0x13dc], ecx
mov dword [ebp - 0x13e4], ebx
mov dword [ebp - 0x13bc], ecx
mov dword [ebp - 0x13c4], ebx
mov dword [ebp - 0x13ac], ecx
mov dword [ebp - 0x13b8], eax
mov dword [ebp - 0x13b4], ebx
call fcn.004cf8b3
test eax, eax
mov dword [ebp - 0x16d4], ebx
mov esi, ebx
sete byte [ebp - 0x16b9]
cmp esi, 0x64
mov esi, dword [ebp - 0x16c4]
jae 0x4e757e
push ebx
push dword [sym.imp.dbghelp.dll_SymGetModuleBase64]
lea eax, [ebp - 0x16b4]
push dword [sym.imp.dbghelp.dll_SymFunctionTableAccess64]
push ebx
push eax
lea eax, [ebp - 0x13e8]
push eax
push dword [ebp - 0x16e4]
push esi
push 0x14c
call dword [sym.imp.dbghelp.dll_StackWalk64]
test eax, eax
je 0x4e757e
mov eax, dword [ebp - 0x13e4]
mov edi, dword [ebp - 0x13e8]
push eax
push edi
push esi
mov dword [ebp - 0x16cc], str._unknown_module_
mov dword [ebp - 0x16d0], edi
mov dword [ebp - 0x16c8], eax
call dword [sym.imp.dbghelp.dll_SymGetModuleBase64]
mov esi, eax
test esi, esi
je 0x4e7118
push 0x104
lea eax, [ebp - 0x29c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
lea ecx, [ebp - 0x29c]
cmove ecx, dword [ebp - 0x16cc]
mov dword [ebp - 0x16cc], ecx
xor eax, eax
xor ecx, ecx
inc eax
xorps xmm0, xmm0
cmp esi, dword [ebp - 0x16e8]
movzx eax, al
cmovne eax, ecx
movlpd qword [ebp - 0x16f4], xmm0
movlpd qword [ebp - 0x16fc], xmm0
test al, al
je 0x4e71db
push 0x1c
lea eax, [ebp - 0x12c8]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
mov eax, dword [ebp - 0x12c4]
mov ecx, edi
mov esi, dword [ebp - 0x16c8]
mov edi, ebx
cdq
sub ecx, eax
push 0
sbb esi, edx
and dword [ebp - 0x16b8], 0
mov edx, dword [eax + 0x3c]
add edx, eax
movzx ebx, word [edx + 6]
cmp word [ebp - 0x16b8], bx
movzx eax, word [edx + 0x14]
mov dword [ebp - 0x16ec], ebx
pop ebx
jae 0x4e71db
add eax, 0x28
add eax, edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x16c0], edx
mov edx, dword [eax - 8]
cmp dword [eax], edx
cmova edx, dword [eax]
and dword [ebp - 0x16b8], 0
add edx, dword [eax - 4]
adc dword [ebp - 0x16b8], ebx
cmp esi, ebx
jb 0x4e71ce
ja 0x4e71c0
cmp ecx, dword [eax - 4]
jb 0x4e71ce
cmp esi, dword [ebp - 0x16b8]
jb 0x4e7235
ja 0x4e71ce
cmp ecx, edx
jbe 0x4e7235
inc edi
add eax, 0x28
cmp di, word [ebp - 0x16ec]
jb 0x4e7194
mov eax, dword [ebp - 0x16f0]
mov edi, dword [ebp - 0x16f4]
mov esi, dword [ebp - 0x16f8]
mov ecx, dword [ebp - 0x16fc]
push esi
push ecx
mov dword [ebp - 0x16b8], eax
lea eax, [ebp - 0x94]
push str._08llx
push eax
call fcn.004e6923
xor eax, eax
mov dword [ebp - 0x1298], 7
add esp, 0x10
mov dword [ebp - 0x129c], ebx
mov word [ebp - 0x12ac], ax
cmp word [0x684590], ax
jne 0x4e724e
mov eax, ebx
jmp 0x4e7259
movzx eax, di
cdq
mov edi, eax
mov eax, edx
xor edx, edx
inc edx
add edi, edx
adc eax, ebx
sub ecx, dword [ebp - 0x16c0]
sbb esi, ebx
jmp 0x4e71f3
push 0x684590
call fcn.005ff18e
pop ecx
push eax
push 0x684590
lea ecx, [ebp - 0x12ac]
call fcn.0040a315
cmp byte [ebp - 0x16b9], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movlpd qword [ebp - 0x16e0], xmm0
je 0x4e7343
push str.SymGetSymFromAddr64
push str.Dbghelp.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4e73c6
lea ecx, [ebp - 0x125c]
mov dword [ebp - 0x125c], 0x20
push ecx
lea ecx, [ebp - 0x16e0]
mov dword [ebp - 0x1244], 0x7d0
push ecx
push dword [ebp - 0x16c8]
push dword [ebp - 0x16d0]
push dword [ebp - 0x16c4]
call eax
test eax, eax
je 0x4e73c6
lea eax, [ebp - 0x1240]
push eax
lea ecx, [ebp - 0x12e0]
call fcn.00407874
lea eax, [ebp - 0x12e0]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x12c4]
push eax
call fcn.00410293
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x12ac]
call fcn.0040c133
xor eax, eax
lea ecx, [ebp - 0x12c4]
push ebx
inc eax
push eax
call fcn.00409de7
xor eax, eax
mov byte [ebp - 4], 2
push ebx
inc eax
lea ecx, [ebp - 0x12e0]
push eax
call fcn.00409d92
jmp 0x4e73c6
push str.SymFromAddrW
push str.Dbghelp.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4e73c6
lea ecx, [ebp - 0x1294]
mov dword [ebp - 0x1294], 0x58
push ecx
lea ecx, [ebp - 0x16e0]
mov dword [ebp - 0x1244], 0x7d0
push ecx
push dword [ebp - 0x16c8]
push dword [ebp - 0x16d0]
push dword [ebp - 0x16c4]
call eax
test eax, eax
je 0x4e73c6
cmp word [ebp - 0x1240], 0
jne 0x4e73a6
mov eax, ebx
jmp 0x4e73b3
lea eax, [ebp - 0x1240]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x1240]
push eax
lea ecx, [ebp - 0x12ac]
call fcn.0040a315
push ebx
lea ecx, [ebp - 0x1714]
call fcn.00539837
mov esi, dword [ebp - 0x16d4]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c0], esp
mov byte [ebp - 4], 4
push esi
call fcn.00539740
push 0x686518
lea ecx, [ebp - 0x1714]
mov byte [ebp - 4], 5
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00539a88
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c0], esp
push dword [ebp - 0x16b8]
push edi
call fcn.005398d8
push 0x687848
lea ecx, [ebp - 0x1714]
mov byte [ebp - 4], 6
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00539a88
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c0], esp
push dword [ebp - 0x16dc]
push dword [ebp - 0x16e0]
call fcn.005398d8
push 0x69a308
lea ecx, [ebp - 0x1714]
mov byte [ebp - 4], 7
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00539a88
push dword [ebp - 0x16cc]
lea ecx, [ebp - 0x12c4]
call fcn.004078a3
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x16c0], esp
push eax
call fcn.005396a1
push str.module
lea ecx, [ebp - 0x1714]
mov byte [ebp - 4], 9
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00539a88
xor eax, eax
mov byte [ebp - 4], 4
push ebx
inc eax
lea ecx, [ebp - 0x12c4]
push eax
call fcn.00409de7
sub esp, 0x18
lea eax, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x16c0], esp
push eax
call fcn.005397cb
mov byte [ebp - 4], 0xa
push str.offset
lea ecx, [ebp - 0x1714]
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00539a88
sub esp, 0x18
lea eax, [ebp - 0x12ac]
mov ecx, esp
mov dword [ebp - 0x16c0], esp
push eax
call fcn.005396a1
push str.function
lea ecx, [ebp - 0x1714]
mov byte [ebp - 4], 0xb
call fcn.00539cd8
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00539a88
lea eax, [ebp - 0x1714]
push eax
lea ecx, [ebp - 0x1730]
call fcn.0053a402
lea ecx, [ebp - 0x1714]
call fcn.00539a16
xor eax, eax
lea ecx, [ebp - 0x12ac]
inc eax
push ebx
push eax
mov byte [ebp - 4], al
call fcn.00409de7
inc esi
mov dword [ebp - 0x16d4], esi
jmp 0x4e707a
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x4e6fb2