Function at 0x42ecb0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b13b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x4dca08]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov esi, dword [esp + 0x38]
xor edx, edx
lea ecx, [esp + 0xc]
push 0xa
mov dl, byte [esi]
push ecx
push edx
mov dword [esp + 0x3c], 0
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
xor edx, edx
lea ecx, [esp + 0xc]
mov dl, byte [esi + 1]
push 0xa
and edx, 0x8000001f
push ecx
jns 0x42ed27
dec edx
or edx, 0xffffffe0
inc edx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
xor edx, edx
lea ecx, [esp + 0xc]
mov dl, byte [esi + 2]
push 0xa
push ecx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
xor edx, edx
lea ecx, [esp + 0xc]
mov dl, byte [esi + 3]
push 0xa
add edx, 0x3e8
push ecx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xd]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 0x4d3e78
lea ecx, [esp + 0xc]
call fcn.00493926
xor edx, edx
lea ecx, [esp + 0xc]
mov dl, byte [esi + 1]
push 0xa
shr edx, 5
push ecx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push ecx
push str._08X
push edx
call fcn.0047eebf
add esp, 0xc
lea ecx, [esp + 8]
push 0x4d3e6c
call fcn.00493926
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
xor edx, edx
lea ecx, [esp + 0xc]
mov dl, byte [esi + 8]
push 0xa
push ecx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
xor edx, edx
lea ecx, [esp + 0xc]
mov dl, byte [esi + 9]
push 0xa
push ecx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 0xa
push ecx
push edx
call fcn.00481d46
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
call fcn.004a8348
mov eax, dword [eax + 4]
mov edx, dword [esi + 0x10]
push edx
mov ecx, dword [eax + 0x1c]
add ecx, 0x1be0
call fcn.00492945
add eax, 8
lea ecx, [esp + 8]
push eax
call fcn.00493962
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0xc]
push 0xa
push eax
push ecx
call fcn.00481d46
add esp, 0xc
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0xc]
push 0xa
push eax
push ecx
call fcn.00481d46
add esp, 0xc
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
push 0xa
lea eax, [esp + 0x10]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call fcn.00481d46
add esp, 0xc
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
call fcn.00493926
push 9
lea ecx, [esp + 0xc]
call fcn.0049394d
lea eax, [esi + 0x20]
lea ecx, [esp + 8]
push eax
call fcn.00493926
mov edx, dword [esp + 8]
lea ecx, [esp + 0x18]
add edi, 0xc4
push ecx
push edx
mov ecx, edi
mov word [esp + 0x20], 3
mov dword [esp + 0x28], 1
call fcn.00429ac0
xor eax, eax
xor ecx, ecx
mov al, byte [esi]
mov cl, byte [esi + 1]
shl eax, 8
add eax, ecx
xor edx, edx
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, byte [esi + 3]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov ecx, edi
push eax
push 1
call fcn.004299d0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0049354a
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4