Function at 0x42d7b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
test byte [0x4ce644], 1
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x130], edi
jne 0x42d804
or dword [0x4ce644], 1
push 0x4ce62c
call dword [sym.imp.___total_physical_size__lu_MB_InitializeCriticalSection]
push 0x468562
call fcn.00451fe0
pop ecx
mov eax, dword [0x4d4790]
cmp eax, edi
je 0x42d814
push eax
call dword [sym.imp.ical_size__lu_MB_ImpersonateLoggedOnUser]
mov dword [ebp - 0x128], edi
cmp dword [0x4d659c], edi
jne 0x42dc58
push ebx
push esi
rdtsc
mov ecx, dword [0x4ce4d8]
push 0xffffffffffffffff
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x120], eax
call fcn.004288ce
mov ebx, eax
lea eax, [ebp - 0x120]
push eax
call fcn.0041dfd7
add dword [0x4ac264], eax
cmp ebx, edi
je 0x42dc56
cmp dword [0x4cd314], edi
je 0x42d8b0
push ebx
call fcn.004199f6
test eax, eax
je 0x42da1f
xor esi, esi
cmp esi, dword [ebx + 0x10]
jae 0x42d8b0
xor eax, eax
mov ecx, esi
shr ecx, 0xc
inc eax
shl eax, cl
movzx ecx, word [ebx + 0x1a]
test ecx, eax
jne 0x42d8a2
push 0x1000
lea eax, [esi + ebx + 0x1c]
push 0x75
push eax
call fcn.00450230
add esp, 0xc
add esi, 0x1000
cmp esi, 0x10000
jb 0x42d877
cmp byte [0x4cd33c], 0
je 0x42d975
cmp dword [0x4cd314], edi
jne 0x42d975
push 0x100
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00450230
mov edi, dword [ebx + 0x10]
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], eax
lea eax, [ebx + 0x1c]
add esp, 0xc
and dword [ebp - 0x108], 0
mov dword [ebp - 0x124], eax
test edi, edi
jle 0x42d93e
mov esi, 0x1000
mov eax, edi
cmp edi, esi
jl 0x42d90e
mov eax, esi
push dword [ebp - 0x10c]
push eax
push dword [ebp - 0x124]
call fcn.0041dc38
add dword [ebp - 0x10c], 0x10
add dword [ebp - 0x124], esi
sub edi, esi
inc dword [ebp - 0x108]
cmp dword [ebp - 0x108], 0x10
jb 0x42d8fd
mov esi, 0x4ce62c
push esi
call dword [sym.imp.___total_physical_size__lu_MB_EnterCriticalSection]
push 0x10
lea eax, [ebp - 0x104]
push eax
push dword [ebx + 0xc]
push dword [ebx + 8]
call fcn.00416fc2
test eax, eax
jns 0x42d96c
mov dword [0x4d659c], 1
push esi
call dword [sym.imp.___total_physical_size__lu_MB_LeaveCriticalSection]
xor edi, edi
test dword [0x4cd29c], 0x4000
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x124], edi
je 0x42d9a2
push 1
push eax
lea eax, [ebx + 0x1c]
push eax
call fcn.0040b3a7
mov dword [ebp - 0x124], eax
xor eax, eax
mov word [ebx + 0x18], ax
test byte [0x4cd29c], 1
je 0x42da13
rdtsc
push dword [ebx + 0x10]
mov dword [ebp - 0x150], eax
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebp - 0x110]
push 0x10000
add eax, 0x1c
push eax
mov dword [ebp - 0x14c], edx
call fcn.004423b7
mov esi, eax
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x12c], esi
cmp esi, dword [ebx + 0x10]
jb 0x42d9fa
or dword [ebp - 0x108], 0xffffffff
mov esi, dword [ebp - 0x108]
lea eax, [ebp - 0x150]
push eax
call fcn.0041dfd7
add dword [0x4bcbd8], eax
cmp esi, 0xffffffff
jne 0x42da3a
xor edi, edi
mov eax, dword [ebx + 0x10]
and dword [ebx + 0x18], 0xfffffffe
mov dword [ebx + 0x14], eax
jmp 0x42da6e
and dword [ebx + 0x18], 0xfffffffe
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov ecx, dword [0x4ce0dc]
push ebx
call fcn.0042888a
jmp 0x42dc44
mov edi, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
push 5
lea esi, [ebx + 8]
add edi, 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x108]
or dword [eax + 0x18], 1
mov dword [ebp - 0x110], ebx
mov dword [eax + 0x14], ecx
mov dword [ebp - 0x10c], ecx
mov ebx, eax
xor edi, edi
and dword [ebx + 0x18], 0xfffffffd
test byte [0x4cd29c], 2
je 0x42db51
cmp dword [ebp - 0x10c], 0x400
jbe 0x42db51
mov edi, dword [ebp - 0x110]
push 5
lea esi, [ebx + 8]
add edi, 8
pop ecx
rep movsd dword es:[edi], dword [esi]
rdtsc
push dword [ebp - 0x10c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x110]
lea edi, [ebx + 0x1c]
push edi
add eax, 0x1c
push 0x10000
push eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x108], eax
call fcn.0041a580
mov esi, eax
mov dword [ebp - 0x130], esi
cmp esi, dword [ebp - 0x10c]
jb 0x42dae5
or esi, 0xffffffff
lea eax, [ebp - 0x138]
push eax
call fcn.0041dfd7
add dword [0x4bcb84], eax
cmp esi, 0xffffffff
je 0x42db4f
test dword [0x4cd29c], 0x8000
je 0x42db3a
rdtsc
push dword [ebp - 0x10c]
mov dword [ebp - 0x13c], edx
push edi
push dword [ebp - 0x108]
mov dword [ebp - 0x140], eax
call fcn.0041a120
lea eax, [ebp - 0x140]
push eax
call fcn.0041dfd7
add dword [0x4bc39c], eax
mov eax, dword [ebp - 0x110]
or dword [eax + 0x18], 2
mov dword [ebp - 0x110], ebx
mov dword [eax + 0x14], esi
mov ebx, eax
xor edi, edi
and dword [ebx + 0x18], 0xfffffffb
test dword [0x4cd29c], 0x4000
je 0x42db80
push dword [ebp - 0x124]
lea eax, [ebx + 0x14]
push eax
lea eax, [ebx + 0x1c]
push eax
call fcn.0043e60d
shl eax, 2
xor eax, dword [ebx + 0x18]
and eax, 4
xor dword [ebx + 0x18], eax
and dword [ebx + 0x18], 0xffffffef
mov eax, dword [0x4a3024]
cmp eax, edi
je 0x42dbca
cmp byte [eax], 0
je 0x42dbca
rdtsc
push dword [ebx + 8]
or dword [ebx + 0x18], 0x10
push dword [ebx + 0x14]
mov dword [ebp - 0x148], eax
lea eax, [ebx + 0x1c]
push eax
mov ecx, 0x4a301c
mov dword [ebp - 0x144], edx
call fcn.0040d3c6
lea eax, [ebp - 0x148]
push eax
call fcn.0041dfd7
add dword [0x4cce84], eax
cmp dword [0x4ce4e8], edi
je 0x42dbf1
push dword [ebp - 0x130]
push dword [ebp - 0x12c]
push dword [ebp - 0x128]
push str._compressed__u_to__x__x_n
call fcn.00450f5c
add esp, 0x10
rdtsc
mov ecx, dword [0x4ce0dc]
push ebx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], eax
call fcn.0042888a
lea eax, [ebp - 0x118]
push eax
call fcn.0041dfd7
add dword [0x4cddac], eax
cmp dword [0x4ce4e8], edi
je 0x42dc44
push dword [ebp - 0x130]
push dword [ebp - 0x12c]
push dword [ebp - 0x128]
push str._compressed__u_to__x__x_n
call fcn.00450f5c
add esp, 0x10
inc dword [ebp - 0x128]
cmp dword [0x4d659c], edi
je 0x42d828
pop esi
pop ebx
push 0x4ce4ec
call dword [sym.imp.___total_physical_size__lu_MB_InterlockedDecrement]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00450b32
leave
ret