Function at 0x42e454
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [0x434cb0]
mov esi, dword [0x434c08]
mov edi, dword [0x434c94]
xor eax, eax
push ebp
push 0x42eef4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403e98
cmp al, 1
jne 0x42e707
mov eax, ebx
mov edx, dword [esi]
call fcn.00401788
lea eax, [ebx + 0x100]
mov edx, dword [esi]
add edx, 0x100
call fcn.00401788
lea eax, [ebx + 0x600]
mov edx, dword [esi]
add edx, 0x600
call fcn.00401788
lea eax, [ebx + 0x700]
mov edx, dword [esi]
add edx, 0x700
call fcn.00401788
lea eax, [ebx + 0x800]
mov edx, dword [esi]
add edx, 0x800
call fcn.00401788
lea eax, [ebx + 0x900]
mov edx, dword [esi]
add edx, 0x900
call fcn.00401788
lea eax, [ebx + 0xa00]
mov edx, dword [esi]
add edx, 0xa00
call fcn.00401788
lea eax, [ebx + 0xb00]
mov edx, dword [esi]
add edx, 0xb00
call fcn.00401788
lea eax, [ebx + 0xc00]
mov edx, dword [esi]
add edx, 0xc00
call fcn.00401788
lea eax, [ebx + 0xd00]
mov edx, dword [esi]
add edx, 0xd00
call fcn.00401788
lea eax, [ebx + 0xe00]
mov edx, dword [esi]
add edx, 0xe00
call fcn.00401788
lea eax, [ebx + 0xf00]
mov edx, dword [esi]
add edx, 0xf00
call fcn.00401788
lea eax, [ebx + 0x1000]
mov edx, dword [esi]
add edx, 0x1000
call fcn.00401788
lea eax, [ebx + 0x1100]
mov edx, dword [esi]
add edx, 0x1100
call fcn.00401788
lea eax, [ebx + 0x1200]
mov edx, dword [esi]
add edx, 0x1200
call fcn.00401788
lea eax, [ebx + 0x1300]
mov edx, dword [esi]
add edx, 0x1300
call fcn.00401788
lea eax, [ebx + 0x1400]
mov edx, dword [esi]
add edx, 0x1400
call fcn.00401788
lea eax, [ebx + 0x1500]
mov edx, dword [esi]
add edx, 0x1500
call fcn.00401788
lea eax, [ebx + 0x1600]
mov edx, dword [esi]
add edx, 0x1600
call fcn.00401788
lea eax, [ebx + 0x1700]
mov edx, dword [esi]
add edx, 0x1700
call fcn.00401788
lea eax, [ebx + 0x1800]
mov edx, dword [esi]
add edx, 0x1800
call fcn.00401788
lea eax, [ebx + 0x1900]
mov edx, dword [esi]
add edx, 0x1900
call fcn.00401788
mov eax, dword [esi]
mov eax, dword [eax + 0x1a00]
mov dword [ebx + 0x1a00], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a04]
mov dword [ebx + 0x1a04], eax
mov eax, dword [esi]
mov al, byte [eax + 0x1a0c]
mov byte [ebx + 0x1a0c], al
lea eax, [ebx + 0x200]
mov edx, dword [esi]
add edx, 0x200
call fcn.00401788
mov eax, dword [esi]
mov al, byte [eax + 0x1a10]
mov byte [ebx + 0x1a10], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a0f]
mov byte [ebx + 0x1a0f], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a0d]
mov byte [ebx + 0x1a0d], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a0e]
mov byte [ebx + 0x1a0e], al
lea eax, [ebx + 0x300]
mov edx, dword [esi]
add edx, 0x300
call fcn.00401788
lea eax, [ebx + 0x400]
mov edx, dword [esi]
add edx, 0x400
call fcn.00401788
lea eax, [ebx + 0x500]
mov edx, dword [esi]
add edx, 0x500
call fcn.00401788
mov eax, dword [esi]
mov eax, dword [eax + 0x1a08]
mov dword [ebx + 0x1a08], eax
mov eax, dword [esi]
mov al, byte [eax + 0x1a11]
mov byte [ebx + 0x1a11], al
mov eax, dword [esi]
mov al, byte [eax + 0x1a12]
mov byte [ebx + 0x1a12], al
jmp 0x42e90e
push edi
mov edi, ebx
mov esi, 0x42ef04
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x100]
mov esi, 0x42ef10
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x600]
mov esi, 0x42ef18
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x700]
mov esi, 0x42ef20
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x800]
mov esi, 0x42ef30
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x900]
mov esi, 0x42ef4c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xa00]
mov esi, 0x42ef5c
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xb00]
mov esi, 0x42ef8c
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov dword [ebx + 0x1a00], 0x3e5b
mov dword [ebx + 0x1a04], 5
mov byte [ebx + 0x1a0c], 1
push edi
lea edi, [ebx + 0x200]
mov esi, 0x42ef94
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov byte [ebx + 0x1a10], 1
mov byte [ebx + 0x1a0f], 1
mov byte [ebx + 0x1a0d], 1
mov byte [ebx + 0x1a0e], 1
push edi
lea edi, [ebx + 0x300]
mov esi, 0x42ef10
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov byte [ebx + 0x400], 0
mov byte [ebx + 0x500], 0
xor eax, eax
mov dword [ebx + 0x1a08], eax
mov byte [ebx + 0x1a11], 0
mov byte [ebx + 0x1a12], 0
push edi
lea edi, [ebx + 0xc00]
mov esi, 0x42efa0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xd00]
mov esi, 0x42efa8
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0xe00]
mov esi, 0x42efb0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0xf00]
mov esi, 0x42efb8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1000]
mov esi, 0x42efc8
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1100]
mov esi, 0x42efd0
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1200]
mov esi, 0x42efd8
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x1300]
mov esi, 0x42efe0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1400]
mov esi, 0x42efec
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1500]
mov esi, 0x42eff4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1600]
mov esi, 0x42effc
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
push edi
lea edi, [ebx + 0x1700]
mov esi, 0x42f01c
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x1800]
mov esi, 0x42f034
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
push edi
lea edi, [ebx + 0x1900]
mov esi, 0x42f04c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
lea edx, [ebp - 4]
mov eax, 1
call fcn.004043a4
mov eax, dword [ebp - 4]
mov edx, 0x42f068
call fcn.004026fc
jne 0x42e967
mov ebx, 5
lea edx, [ebp - 8]
mov eax, 2
call fcn.004043a4
mov eax, dword [ebp - 8]
call fcn.0041f290
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.004043a4
mov eax, dword [ebp - 0xc]
call fcn.00405958
test al, al
je 0x42e967
push 0xa
call sub.kernel32.dll_Sleep
dec ebx
jne 0x42e92f
mov eax, dword [0x434d30]
mov word [eax], 0x31
mov eax, dword [0x434d30]
mov word [eax + 2], 1
mov eax, dword [0x434d30]
mov word [eax + 0xe], 0
mov eax, dword [0x434d30]
mov dword [eax + 4], 0x1f40
mov eax, dword [0x434d30]
mov word [eax + 0xc], 0x41
mov eax, dword [0x434d30]
mov dword [eax + 8], 0x659
mov eax, dword [0x434d30]
mov word [eax + 0x10], 2
mov eax, dword [0x434d30]
mov byte [eax + 0x12], 0x40
mov eax, dword [0x434d30]
mov byte [eax + 0x13], 1
mov eax, dword [0x434c60]
mov word [eax], 1
mov eax, dword [0x434c60]
mov word [eax + 2], 1
mov eax, dword [0x434c60]
mov word [eax + 0xe], 8
mov eax, dword [0x434c60]
mov dword [eax + 4], 0x1f40
mov eax, dword [0x434c60]
mov word [eax + 0xc], 1
mov eax, dword [0x434c60]
mov dword [eax + 8], 0x1f40
mov eax, dword [0x434c60]
mov word [eax + 0x10], 0
mov eax, dword [0x434c60]
mov byte [eax + 0x12], 0x40
mov eax, dword [0x434c60]
mov byte [eax + 0x13], 1
mov word [edi], 1
mov word [edi + 2], 1
mov dword [edi + 4], 0x2b11
mov dword [edi + 8], 0x2b11
mov word [edi + 0xc], 1
mov word [edi + 0xe], 8
mov word [edi + 0x10], 0
mov byte [edi + 0x12], 0x40
mov byte [edi + 0x13], 1
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0041ee30
mov edx, dword [ebp - 0x10]
mov eax, dword [0x434d20]
call fcn.00402468
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.0041ee30
mov edx, dword [ebp - 0x14]
mov eax, dword [0x434c88]
call fcn.00402468
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.0041ee30
mov edx, dword [ebp - 0x18]
mov eax, dword [0x434bec]
call fcn.00402468
lea edx, [ebp - 0x1c]
mov eax, 3
call fcn.0041ee30
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x434c10]
call fcn.00402468
mov dl, 1
mov eax, dword [0x426d0c]
call fcn.00401b7c
mov dword [0x437880], eax
mov dl, 1
mov eax, dword [0x40f510]
call fcn.004108e0
mov ebx, eax
mov eax, dword [0x437880]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041074c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d0c
mov edx, eax
mov eax, dword [0x437880]
mov eax, dword [eax + 4]
call fcn.004107ac
mov eax, dword [0x437880]
mov eax, dword [eax + 4]
mov edx, dword [0x437880]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x42da80
mov edx, dword [0x437880]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42da0c
mov edx, dword [0x437880]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42da28
mov edx, dword [0x437880]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x42d990
mov dl, 1
mov eax, dword [0x426e3c]
call fcn.00401b7c
mov dword [0x43788c], eax
mov dl, 1
mov eax, dword [0x40f510]
call fcn.004108e0
mov ebx, eax
mov eax, dword [0x43788c]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041074c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d0c
mov edx, eax
mov eax, dword [0x43788c]
mov eax, dword [eax + 4]
call fcn.004107ac
mov eax, dword [0x43788c]
mov eax, dword [eax + 4]
mov edx, dword [0x43788c]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4271fc
mov edx, dword [0x43788c]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x4271cc
mov edx, dword [0x43788c]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x4271e8
mov edx, dword [0x43788c]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x427194
mov dl, 1
mov eax, dword [0x426dd4]
call fcn.00401b7c
mov dword [0x437884], eax
mov dl, 1
mov eax, dword [0x40f510]
call fcn.004108e0
mov ebx, eax
mov eax, dword [0x437884]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041074c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d0c
mov edx, eax
mov eax, dword [0x437884]
mov eax, dword [eax + 4]
call fcn.004107ac
mov eax, dword [0x437884]
mov eax, dword [eax + 4]
mov edx, dword [0x437884]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x42e068
mov edx, dword [0x437884]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42ddfc
mov edx, dword [0x437884]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42de18
mov edx, dword [0x437884]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x42ddd0
mov dl, 1
mov eax, dword [0x426d70]
call fcn.00401b7c
mov dword [0x437888], eax
mov dl, 1
mov eax, dword [0x40f510]
call fcn.004108e0
mov ebx, eax
mov eax, dword [0x437888]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041074c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d0c
mov edx, eax
mov eax, dword [0x437888]
mov eax, dword [eax + 4]
call fcn.004107ac
mov eax, dword [0x437888]
mov eax, dword [eax + 4]
mov edx, dword [0x437888]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x42de24
mov edx, dword [0x437888]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x42dfdc
mov edx, dword [0x437888]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x42dff8
mov edx, dword [0x437888]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x42df9c
mov dl, 1
mov eax, dword [0x426ca4]
call fcn.00401b7c
mov dword [0x437894], eax
mov dl, 1
mov eax, dword [0x40f510]
call fcn.004108e0
mov ebx, eax
mov eax, dword [0x437894]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041074c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d0c
mov edx, eax
mov eax, dword [0x437894]
mov eax, dword [eax + 4]
call fcn.004107ac
mov eax, dword [0x437894]
mov eax, dword [eax + 4]
mov edx, dword [0x437894]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x427740
mov edx, dword [0x437894]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x427694
mov edx, dword [0x437894]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x4276bc
mov edx, dword [0x437894]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x427498
mov dl, 1
mov eax, dword [0x426c40]
call fcn.00401b7c
mov dword [0x437890], eax
mov dl, 1
mov eax, dword [0x40f510]
call fcn.004108e0
mov ebx, eax
mov eax, dword [0x437890]
mov dword [eax + 4], ebx
mov edx, dword [0x434d20]
mov edx, dword [edx]
mov eax, ebx
call fcn.0041074c
mov eax, dword [0x434c88]
mov eax, dword [eax]
call fcn.00419d0c
mov edx, eax
mov eax, dword [0x437890]
mov eax, dword [eax + 4]
call fcn.004107ac
mov eax, dword [0x437890]
mov eax, dword [eax + 4]
mov edx, dword [0x437890]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x427c1c
mov edx, dword [0x437890]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], 0x427a7c
mov edx, dword [0x437890]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x427a98
mov edx, dword [0x437890]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], 0x4279a0
mov dl, 1
mov eax, dword [0x426ea0]
call fcn.00401b7c
mov dword [0x437898], eax
mov dl, 1
mov eax, dword [0x4158c4]
call fcn.00415a50
mov dword [0x43789c], eax
mov dl, 1
mov eax, dword [0x415cec]
call fcn.00415d40
mov dword [0x4378a0], eax
mov eax, dword [0x4378a0]
mov edx, dword [0x437898]
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa0], 0x42e018
mov eax, dword [0x434c60]
mov edx, dword [0x43789c]
mov esi, eax
lea edi, [edx + 0x15c]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x434d30]
mov edx, dword [0x43789c]
mov esi, eax
lea edi, [edx + 0x1dd]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42eefb
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00402438
ret