Function at 0x4052ec
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebx
xor ebx, ebx
push 0x405304
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x4052ff
mov bl, 1
mov eax, ebx
pop ebx
ret

Function at 0x405310
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebx
xor ebx, ebx
push 0x405328
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x405323
mov bl, 1
mov eax, ebx
pop ebx
ret

Function at 0x405334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push esp
push 1
push 0
push 0x40539c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405387
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4053c8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
lea eax, [esp + 8]
cmp eax, 0x4053d4
jne 0x405387
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x4053ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push esp
push 1
push 0
push 0x405454
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40543f
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x405480
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
lea eax, [esp + 8]
cmp eax, 0x40548c
jne 0x40543f
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x4054a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push esp
push 1
push 0
push 0x40550c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4054f7
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x405538
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
lea eax, [esp + 8]
cmp eax, 0x405544
jne 0x4054f7
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x405684
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x40569b
jne 0x4056a2
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x4056b1
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x4056b9
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4056dc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x405732
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x405748
call fcn.00401b58
push 0
push dword [ebp - 4]
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x405715
xor eax, eax
leave
ret
mov eax, 1
leave
ret

Function at 0x405770
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add dword [eax + 0x20], 0x2000
ret