Function at 0xf14c20
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword fs:[0x30]
push ebx
push edx
call fcn.01251492
push esi
mov eax, dword [eax + 0xc]
push edi
mov dword [ebp - 0x20], ecx
mov edi, dword [eax + 0x10]
mov esi, edi
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf14c59
push 0xb9a3c4
push dword [esi + 0x30]
call ebx
test eax, eax
je 0xf14c5d
cmp edi, esi
jne 0xf14c43
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9c320
call eax
mov edx, 0x3d95e230
mov ecx, eax
call fcn.00f155d0
push 0
call eax
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + 0x10]
mov esi, edi
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf14ca9
push 0xb9a3c4
push dword [esi + 0x30]
call ebx
test eax, eax
je 0xf14cad
cmp edi, esi
jne 0xf14c93
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9c320
call eax
mov edx, 0x3d95e230
mov ecx, eax
call fcn.00f155d0
push 1
call eax
push 1
push 0x20
mov esi, eax
call fcn.00f18c20
mov edi, eax
push 1
push 0x20
mov dword [ebp - 0x1c], edi
call fcn.00f18c20
push 0xa
push edi
push dword [ebp - 0x10]
mov ebx, eax
mov dword [ebp - 4], ebx
call fcn.00f1e60c
add esp, 0x1c
push 0xa
push ebx
push esi
call fcn.00f1e60c
add esp, 0xc
push 1
push 0x1000
call fcn.00f18c20
add esp, 8
mov ebx, eax
mov ecx, 0xb9c338
mov dword [ebp - 0x10], ebx
call fcn.00f14a30
mov edx, eax
mov esi, eax
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0xf14d30
sub edx, esi
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf14d40
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xb9c358
call fcn.00f14a30
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0xf14d64
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf14d70
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf14d90
mov ecx, 8
mov esi, 0xb9b154
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx - 1]
movsb byte es:[edi], byte [esi]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0xf14da8
mov ax, word [0xb9c370]
mov word [ecx], ax
mov al, byte [0xb9c372]
push 1
push 0x8000
mov byte [ecx + 2], al
call fcn.00f18c20
mov ecx, dword fs:[0x30]
mov edi, eax
mov dword [ebp - 0x14], 0x8000
add esp, 8
mov dword [ebp - 8], edi
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + 0x10]
mov esi, eax
mov dword [ebp - 0xc], eax
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf14e0d
push 0xb9a3c4
push dword [esi + 0x30]
push eax
call fcn.0127b4ba
test eax, eax
je 0xf14e11
mov eax, dword [ebp - 0xc]
cmp eax, esi
jne 0xf14df0
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9a3c4
call eax
mov edx, 0xa2f80070
mov ecx, eax
call fcn.00f155d0
lea ecx, [ebp - 0x14]
push ecx
push edi
call eax
lea ecx, [ebx - 1]
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0xf14e40
mov eax, dword [0xb9c374]
mov edx, dword [ebp - 8]
mov esi, edx
mov dword [ecx], eax
mov ax, word [0xb9c378]
mov word [ecx + 4], ax
mov al, byte [0xb9c37a]
mov byte [ecx + 6], al
mov al, byte [edx]
inc edx
test al, al
jne 0xf14e68
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf14e74
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0xf14e90
mov ax, word [0xb98f90]
push 1
push 0x8000
mov word [edi], ax
call fcn.00f18c20
mov ecx, dword fs:[0x30]
mov edi, eax
mov dword [ebp - 0x18], 0x8000
add esp, 8
mov dword [ebp - 0xc], edi
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + 0x10]
mov esi, eax
mov dword [ebp - 8], eax