Function at 0x42aeb4
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Enumerate pe sections
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff750
mov eax, 0x4610ac
push ebx
push esi
push edi
mov ebx, 0x4706e4
mov esi, dword [ebp + 8]
call fcn.00455438
mov dx, word [ebx]
lea edi, [ebp - 0x474]
mov word [ebp - 0x4b0], dx
mov cl, byte [ebx + 2]
mov byte [ebp - 0x4ae], cl
mov ax, word [ebx + 4]
mov word [ebp - 0x4ac], ax
mov dx, word [ebx + 6]
mov word [ebp - 0x4aa], dx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x4a8], ecx
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x4a4], eax
mov dl, byte [ebx + 0x10]
mov byte [ebp - 0x4a0], dl
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x49c], ecx
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x498], eax
mov dl, byte [ebx + 0x1c]
mov byte [ebp - 0x494], dl
mov cl, byte [ebx + 0x1d]
mov byte [ebp - 0x493], cl
mov ax, word [ebx + 0x1e]
mov word [ebp - 0x492], ax
mov edx, dword [ebx + 0x20]
mov dword [ebp - 0x490], edx
mov ecx, dword [ebx + 0x24]
mov dword [ebp - 0x48c], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x488], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebp - 0x484], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebp - 0x480], ecx
mov ecx, pe_nt_image_headers32
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x47c], eax
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x478], edx
push esi
lea esi, [ebx + 0x3c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop esi
push esi
or ecx, 0xffffffff
mov edi, 0x470b20
lea esi, [ebp - 0x8b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esi + 0xc504]
push esi
mov edx, eax
lea eax, [edx + eax*2]
shl eax, 4
add eax, edx
lea eax, [edx + eax*4]
shl eax, 4
add eax, esi
mov esi, 0x470b20
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
lea edi, [ebx + 0x3c]
mov eax, dword [esi + 0xc504]
mov edx, eax
lea eax, [edx + eax*2]
shl eax, 4
add eax, edx
lea eax, [edx + eax*4]
shl eax, 4
add eax, esi
add eax, 0x800
mov cx, word [eax]
mov word [ebx], cx
mov dl, byte [eax + 2]
mov byte [ebx + 2], dl
mov cx, word [eax + 4]
mov word [ebx + 4], cx
mov dx, word [eax + 6]
mov word [ebx + 6], dx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov cl, byte [eax + 0x10]
mov byte [ebx + 0x10], cl
mov edx, dword [eax + 0x14]
mov dword [ebx + 0x14], edx
mov ecx, dword [eax + 0x18]
mov dword [ebx + 0x18], ecx
mov dl, byte [eax + 0x1c]
mov byte [ebx + 0x1c], dl
mov cl, byte [eax + 0x1d]
mov byte [ebx + 0x1d], cl
mov dx, word [eax + 0x1e]
mov word [ebx + 0x1e], dx
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x20], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x24], edx
lea edx, [eax + 0x2c]
mov ecx, dword [eax + 0x28]
mov dword [ebx + 0x28], ecx
push esi
lea esi, [eax + 0x3c]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [edx]
mov dword [ebx + 0x2c], ecx
add eax, 0x34
mov edx, dword [edx + 4]
add esp, 0xfffffff8
mov dword [ebx + 0x30], edx
mov ecx, dword [eax]
mov dword [ebx + 0x34], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0xc504]
mov edx, eax
lea eax, [edx + eax*2]
shl eax, 4
add eax, edx
lea eax, [edx + eax*4]
lea edx, [ebx + 0x34]
shl eax, 4
add eax, esi
add eax, 0xc3c
mov ecx, dword [eax]
mov dword [esp], ecx
lea ecx, [ebp - 0x34]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
push edx
push ecx
call fcn.004262f8
lea eax, [ebx + 0x34]
push eax
call fcn.0041844c
mov dword [ebx + 0xc], eax
push 0x20
lea edx, [ebx + 0x34]
push edx
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00426368
lea eax, [ebp - 0x3c]
push eax
call fcn.0041844c
mov dword [ebx + 0x28], eax
cmp dword [esi + 0xc520], 0
je 0x42b3f2
add esp, 0xfffffff8
mov edx, dword [ebx + 0x34]
mov dword [esp], edx
mov ecx, dword [ebx + 0x38]
mov dword [esp + 4], ecx
add esp, 0xfffffff8
mov edi, dword [esi + 0xc520]
add edi, 0x1a0
mov eax, dword [edi]
mov dword [esp], eax
mov edx, dword [edi + 4]
mov dword [esp + 4], edx
call fcn.004267cc
test al, al
je 0x42b3f2
mov ecx, dword [esi + 0xc520]
cmp byte [ecx + 0x184], 0
jne 0x42b3f2
cmp dword [esi + 0xc51c], 0
je 0x42b3f2
mov eax, dword [esi + 0xc518]
cmp byte [eax + 0xd0d], 0
jne 0x42b3f2
cmp byte [0x472328], 0
jne 0x42b3f2
push 0
add esp, 0xfffffff8
add esp, 0xfffffff8
movzx edx, word [ebx + 6]
push edx
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
add esp, 0xfffffff8
lea edi, [esi + 0xc50c]
mov eax, dword [edi]
mov dword [esp], eax
mov edx, dword [edi + 4]
mov dword [esp + 4], edx
lea ecx, [esp + 0x10]
push ecx
call fcn.00426694
mov eax, dword [esi + 0xc518]
push eax
call fcn.00426df8
push 0
add esp, 0xfffffff8
push 0
lea edx, [esp + 4]
push edx
call fcn.004262cc
mov ecx, dword [esi + 0xc51c]
push ecx
call fcn.00426df8
mov eax, dword [esi + 0xc518]
push eax
call fcn.00426ee4
test al, al
je 0x42b3d5
add esp, 0xfffffff8
mov eax, dword [esi + 0xc520]
add eax, 0x1a0
mov edx, dword [eax]
mov dword [esp], edx
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
call fcn.0041998c
add esp, 0xfffffff8
push 0
lea eax, [esp + 4]
push eax
call fcn.004262cc
mov edx, dword [esi + 0xc504]
mov ecx, edx
lea edx, [ecx + edx*2]
shl edx, 4
add edx, ecx
lea edx, [ecx + edx*4]
shl edx, 4
add edx, esi
add edx, 0xc3c
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.004262f8
mov edi, dword [esi + 0xc520]
add esp, 0xfffffff8
mov dword [edi + 0x1b8], 0xffffffff
push 0
lea eax, [esp + 4]
push eax
call fcn.004262cc
add edi, 0x1a0
push edi
lea edx, [ebp - 0x4c]
push edx
call fcn.004262f8
push 0x472328
push 0x14
mov ecx, dword [esi + 0xc520]
push ecx
call fcn.0043c55c
mov eax, dword [esi + 0xc520]
push eax
call fcn.00435c18
mov eax, dword [esi + 0xc504]
lea edi, [ebx + 0x3c]
mov edx, eax
lea eax, [edx + eax*2]
shl eax, 4
add eax, edx
lea eax, [edx + eax*4]
shl eax, 4
add eax, esi
add eax, 0x800
mov cx, word [eax]
mov word [ebx], cx
mov dl, byte [eax + 2]
mov byte [ebx + 2], dl
mov cx, word [eax + 4]
mov word [ebx + 4], cx
mov dx, word [eax + 6]
mov word [ebx + 6], dx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov cl, byte [eax + 0x10]
mov byte [ebx + 0x10], cl
mov edx, dword [eax + 0x14]
mov dword [ebx + 0x14], edx
mov ecx, dword [eax + 0x18]
mov dword [ebx + 0x18], ecx
mov dl, byte [eax + 0x1c]
mov byte [ebx + 0x1c], dl
mov cl, byte [eax + 0x1d]
mov byte [ebx + 0x1d], cl
mov dx, word [eax + 0x1e]
mov word [ebx + 0x1e], dx
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x20], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x24], edx
lea edx, [eax + 0x2c]
mov ecx, dword [eax + 0x28]
mov dword [ebx + 0x28], ecx
push esi
lea esi, [eax + 0x3c]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [edx]
mov dword [ebx + 0x2c], ecx
add eax, 0x34
mov edx, dword [edx + 4]
add esp, 0xfffffff8
mov dword [ebx + 0x30], edx
mov ecx, dword [eax]
mov dword [ebx + 0x34], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0xc504]
mov edx, eax
lea eax, [edx + eax*2]
shl eax, 4
add eax, edx
lea eax, [edx + eax*4]
lea edx, [ebx + 0x34]
shl eax, 4
add eax, esi
add eax, 0xc3c
mov ecx, dword [eax]
mov dword [esp], ecx
lea ecx, [ebp - 0x54]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
push edx
push ecx
call fcn.004262f8
lea eax, [ebx + 0x34]
push eax
call fcn.0041844c
mov dword [ebx + 0xc], eax
push 0x20
lea edx, [ebx + 0x34]
push edx
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00426368
lea eax, [ebp - 0x5c]
push eax
call fcn.0041844c
mov dword [ebx + 0x28], eax
add esp, 0xfffffff8
mov byte [ebx + 0x1d], 0x30
mov edx, dword [ebx + 0x34]
mov dword [esp], edx
lea edx, [ebp - 0x64]
mov ecx, dword [ebx + 0x38]
mov dword [esp + 4], ecx
mov eax, dword [esi + 0xc520]
add eax, 0x190
push eax
push edx
call fcn.0042674c
jmp 0x42b3f2
push 2
add esp, 0xfffffff8
push 0
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
mov eax, dword [esi + 0xc518]
push eax
call fcn.00426df8
push 0
add esp, 0xfffffff8
lea eax, [esi + 0xc50c]
mov edx, dword [eax]
mov dword [esp], edx
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
mov eax, dword [esi + 0xc518]
push eax
call fcn.00426df8
not dword [ebx + 0x14]
mov edi, dword [esi + 0xc520]
test edi, edi
je 0x42b47b
add edi, 0x1a0
push edi
call fcn.0041844c
mov dword [ebx + 8], eax
push 0x20
mov eax, dword [esi + 0xc520]
add eax, 0x1a0
push eax
lea edx, [ebp - 0x6c]
push edx
call fcn.00426368
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0041844c
mov dword [ebx + 0x24], eax
add esp, 0xfffffff8
mov eax, dword [esi + 0xc520]
add eax, 0x1a0
mov edx, dword [eax]
mov dword [esp], edx
lea edx, [ebp - 0x74]
mov ecx, dword [eax + 4]
lea eax, [ebx + 0x2c]
mov dword [esp + 4], ecx
push eax
push edx
call fcn.004262f8
test byte [ebx + 4], 2
je 0x42b48c
and word [ebx + 4], 0xfffd
or word [ebx + 4], 1
test byte [ebx + 5], 1
mov cl, 0x1a
jne 0x42b497
add ecx, 0xfffffffa
mov byte [ebx + 0x1c], cl
push 0x74
mov eax, dword [esi + 0xc518]
push eax
call fcn.004287d8
call fcn.0043ca8c
movzx edx, word [ebx + 0x1e]
add eax, edx
movzx ecx, word [ebx + 6]
cmp eax, ecx
jge 0x42b54c
mov word [ebp - 0x1c], 8
mov eax, dword [esi + 0xc514]
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.00435d74
push 0
add esp, 0xfffffff8
mov eax, dword [esi + 0xc504]
mov edx, eax
lea eax, [edx + eax*2]
shl eax, 4
add eax, edx
lea eax, [edx + eax*4]
shl eax, 4
add eax, esi
add eax, 0xc44
mov ecx, dword [eax]
mov dword [esp], ecx
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov edx, dword [esi + 0xc514]
push edx
call fcn.00426df8
add esp, 0xfffffff8
call fcn.0043ca8c
movzx ecx, word [ebx + 6]
sub ecx, eax
movzx eax, word [ebx + 0x1e]
sub ecx, eax
push ecx
lea edx, [esp + 4]
push edx
call fcn.004262cc
mov ecx, dword [esi + 0xc518]
push ecx
mov eax, dword [esi + 0xc514]
push eax
call fcn.0043fcfc
push 2
lea edx, [ebp - 0xc]
push edx
call fcn.00435dbc
push 2
add esp, 0xfffffff8
push 0
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
mov eax, dword [esi + 0xc518]
push eax
call fcn.00426df8
mov eax, dword [esi + 0xc504]
lea edx, [eax + eax*2]
shl edx, 4
add edx, eax
lea edx, [eax + edx*4]
add edx, edx
cmp byte [esi + edx*8 + 0xc4c], 0
je 0x42b5a9
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
lea ecx, [eax + ecx*4]
shl ecx, 4
add ecx, esi
add ecx, 0x400
push ecx
mov eax, dword [esi + 0xc518]
push eax
call fcn.00425e78
inc dword [esi + 0xc504]
xor eax, eax
lea edi, [ebp - 0x8b0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, 0x470b20
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [ebp - 0x4b0]
lea esi, [ebp - 0x474]
mov word [ebx], ax
lea edi, [ebx + 0x3c]
mov dl, byte [ebp - 0x4ae]
mov byte [ebx + 2], dl
mov cx, word [ebp - 0x4ac]
mov word [ebx + 4], cx
mov ax, word [ebp - 0x4aa]
mov word [ebx + 6], ax
mov edx, dword [ebp - 0x4a8]
mov dword [ebx + 8], edx
mov ecx, dword [ebp - 0x4a4]
mov dword [ebx + 0xc], ecx
mov al, byte [ebp - 0x4a0]
mov byte [ebx + 0x10], al
mov edx, dword [ebp - 0x49c]
mov dword [ebx + 0x14], edx
mov ecx, dword [ebp - 0x498]
mov dword [ebx + 0x18], ecx
mov al, byte [ebp - 0x494]
mov byte [ebx + 0x1c], al
mov dl, byte [ebp - 0x493]
mov byte [ebx + 0x1d], dl
mov cx, word [ebp - 0x492]
mov word [ebx + 0x1e], cx
mov eax, dword [ebp - 0x490]
mov dword [ebx + 0x20], eax
mov edx, dword [ebp - 0x48c]
mov dword [ebx + 0x24], edx
mov ecx, dword [ebp - 0x488]
mov dword [ebx + 0x28], ecx
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x484]
mov dword [ebx + 0x2c], eax
mov edx, dword [ebp - 0x480]
mov dword [ebx + 0x30], edx
mov ecx, dword [ebp - 0x47c]
mov dword [ebx + 0x34], ecx
mov eax, dword [ebp - 0x478]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4