Function at 0x4fa170
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5a3ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov edx, dword [esp + 0x7c]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x38]
push edi
mov edi, dword [edx + 4]
add edi, ecx
mov ecx, dword [edx]
add ecx, eax
push edi
push ecx
lea ecx, [esp + 0x18]
call fcn.00591df0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0xc]
call fcn.004017d0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 2]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [ecx + 2]
push edx
add eax, 0xfffffffe
add ecx, 0xfffffffe
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.004edb90
lea ecx, [esp + 0x4c]
call fcn.00576920
lea ecx, [esp + 0x28]
mov dword [esp + 0x78], 0
call fcn.00576920
mov eax, dword [esi]
mov ecx, esi
mov byte [esp + 0x78], 1
call dword [eax + 0x54]
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, eax
call fcn.00576c50
push 1
push 0x200000
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x58]
call fcn.00576db0
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4fa25d
mov ecx, dword [esp + 0x80]
mov esi, dword [ecx + 0xc]
lea ecx, [esp + 0x28]
mov byte [esp + 0x78], 0
call fcn.00576940
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.00576940
jmp 0x4fa4ad
push ebp
mov ecx, 0x11c80e8
call fcn.004537f0
mov ebp, dword [esp + 0x84]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x30]
test eax, eax
mov ecx, eax
je 0x4fa48a
push ebx
mov bl, byte [esp + 0x90]
jmp 0x4fa295
mov ecx, dword [esp + 0x88]
mov edx, dword [ecx]
mov eax, ecx
mov eax, dword [eax + 8]
mov esi, dword [eax + 0x14]
mov eax, dword [eax + 0x1c]
sub eax, 0x14
mov dword [esp + 0x88], edx
je 0x4fa41b
dec eax
je 0x4fa3ad
sub eax, 0xc
jne 0x4fa47a
test esi, esi
je 0x4fa47a
push 0x5b3440
mov ecx, esi
call fcn.00591e20
test eax, eax
mov ecx, esi
je 0x4fa34a
mov eax, dword [esi]
call dword [eax + 0x10]
test eax, eax
je 0x4fa2f5
push 0x5b3440
mov ecx, esi
call fcn.00591e20
test eax, eax
jne 0x4fa2f7
xor esi, esi
push esi
mov ecx, ebp
call fcn.00457770
test eax, eax
jne 0x4fa47a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x30]
mov edi, eax
push edi
call fcn.00404810
add esp, 4
test eax, eax
je 0x4fa46d
cmp edi, dword [esp + 0x8c]
jne 0x4fa46d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
cmp eax, dword [esp + 0x8c]
jne 0x4fa468
test bl, 1
jmp 0x4fa470
push 0x5b4074
call fcn.00591e20
test eax, eax
je 0x4fa47a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
test eax, eax
je 0x4fa377
push 0x5b4074
mov ecx, esi
call fcn.00591e20
test eax, eax
jne 0x4fa379
xor esi, esi
push esi
mov ecx, ebp
call fcn.00457770
test eax, eax
jne 0x4fa47a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov edi, eax
push edi
call fcn.00404810
add esp, 4
test eax, eax
je 0x4fa3a8
cmp edi, dword [esp + 0x8c]
je 0x4fa3ed
test bl, 0x20
jmp 0x4fa400
test esi, esi
je 0x4fa47a
mov ecx, esi
call fcn.0050c790
mov esi, eax
push esi
mov ecx, ebp
call fcn.00457770
test eax, eax
jne 0x4fa47a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov edi, eax
push edi
call fcn.00404810
add esp, 4
test eax, eax
je 0x4fa3a8
cmp edi, dword [esp + 0x8c]
jne 0x4fa3a8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x34]
cmp eax, dword [esp + 0x8c]
jne 0x4fa40c
test bl, 2
je 0x4fa47a
push esi
mov ecx, ebp
call fcn.00457d50
jmp 0x4fa47a
test bl, 8
je 0x4fa47a
push esi
mov ecx, ebp
call fcn.00457d50
jmp 0x4fa47a
test esi, esi
je 0x4fa47a
mov ecx, esi
call fcn.0050b470
mov esi, eax
push esi
mov ecx, ebp
call fcn.00457770
test eax, eax
jne 0x4fa47a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov edi, eax
push edi
call fcn.00404810
add esp, 4
test eax, eax
je 0x4fa46d
cmp edi, dword [esp + 0x8c]
jne 0x4fa46d
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x34]
cmp eax, dword [esp + 0x8c]
jne 0x4fa468
test bl, 1
jmp 0x4fa470
test bl, 4
jmp 0x4fa470
test bl, 0x10
je 0x4fa47a
mov ecx, ebp
push esi
call fcn.00457d00
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x4fa28e
pop ebx
mov esi, dword [ebp + 0xc]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x7c], 0
call fcn.00576940
lea ecx, [esp + 0x50]
mov dword [esp + 0x7c], 0xffffffff
call fcn.00576940
pop ebp
mov ecx, dword [esp + 0x70]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x74
ret 0xc