Function at 0x5c2820
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Enumerate pe sections
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x71599b
push eax
mov eax, 0x2430
mov dword fs:[0], esp
call fcn.00450100
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x2c]
push edi
mov edi, dword [esp + 0x2450]
mov cx, word [eax + 0xa]
push ecx
push edi
call fcn.005afa20
mov edx, dword [ebx + 0x2c]
mov ebp, eax
mov dword [esp + 0x18], ebp
mov ax, word [edx + 0xc]
push eax
push edi
call fcn.005afa20
mov ecx, dword [ebx + 0x30]
mov esi, eax
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ecx
call fcn.0043d900
push edi
call fcn.005c39e0
xor edx, edx
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], edx
mov cx, word [eax]
mov word [esp + 0x38], cx
mov dx, word [eax + 2]
mov word [esp + 0x3a], dx
mov cx, word [eax + 4]
mov word [esp + 0x3c], cx
mov dx, word [eax + 0x12]
mov word [esp + 0x3e], dx
mov cx, word [eax + 0x14]
mov word [esp + 0x40], cx
mov dx, word [eax + 6]
mov word [esp + 0x42], dx
mov cx, word [eax + 8]
mov word [esp + 0x44], cx
mov dx, word [eax + 2]
push edx
push edi
call fcn.005bf5c0
mov eax, dword [ebx + 0x2c]
mov cx, word [eax + 4]
push ecx
push edi
call fcn.005bf5c0
mov edx, dword [ebx + 0x2c]
mov ax, word [edx + 0x12]
push eax
push edi
call fcn.005bf5c0
mov ecx, dword [ebx + 0x2c]
mov dx, word [ecx + 0x14]
push edx
push edi
call fcn.005bf5c0
mov eax, dword [ebx + 0x2c]
mov cx, word [eax + 0x10]
push ecx
push edi
call fcn.005bf5c0
mov edx, dword [ebx + 0x2c]
add esp, 0x40
mov ax, word [edx + 0xe]
push eax
push edi
call fcn.005bf5c0
push ebp
call fcn.005c0ea0
push esi
call fcn.005c0ea0
mov ecx, dword [ebx + 0x2c]
push 0
push 0
mov dx, word [ecx + 0x18]
push edx
push edi
call fcn.005c0660
mov eax, dword [ebx + 0x2c]
add esp, 0x20
mov cx, word [eax + 0x16]
test cx, cx
je 0x5c2979
mov word [esp + 0x2e], cx
mov cx, word [ebx + 0x20]
mov dx, word [eax + 0x18]
push ecx
push 0
push edx
push edi
call fcn.005b0a70
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004136b0
mov ecx, dword [ebx + 0x2c]
mov dx, word [ecx + 4]
push edx
push edi
call fcn.005afa20
push eax
call fcn.005b02d0
push edi
call fcn.006033f0
mov eax, dword [ebx + 0x10]
xor esi, esi
add esp, 0x18
cmp word [eax], si
je 0x5c2bd1
add eax, 5
inc esi
cmp word [eax], 0
jne 0x5c29af
test esi, esi
je 0x5c2bd1
lea ecx, [esp + 0x434]
call fcn.005b08c0
lea eax, [esi + esi*4 + 5]
lea ecx, [esp + 0x434]
push eax
mov dword [esp + 0x244c], 0
call fcn.005b0a40
mov ebp, eax
test ebp, ebp
je 0x5c2bb6
lea ecx, [esi + esi*4]
mov esi, dword [ebx + 0x10]
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, word [ebx + 0x24]
mov ecx, dword [ebx + 4]
push eax
push ecx
mov ecx, ebx
call fcn.005c25a0
mov edx, dword [ebx + 0x34]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 1
push 0x1003
push eax
call esi
mov ecx, dword [ebx + 0x34]
mov edi, dword [esp + 0x18]
push ecx
push 1
push 0x1003
push edi
call esi
mov edx, dword [esp + 0x10]
push 0
push edx
call fcn.005b5f30
mov eax, dword [esp + 0x18]
push str.Explorer
push eax
call fcn.005c0a20
mov ecx, dword [esp + 0x20]
add esp, 0x10
push 0x420
push 0
push 0x1036
push ecx
call esi
push 0
push edi
call fcn.005b5f30
push str.Explorer
push edi
call fcn.005c0a20
add esp, 0x10
push 0x420
push 0
push 0x1036
push edi
call esi
cmp word [ebp], 0
je 0x5c2b59
mov esi, ebp
mov edi, ebp
mov ax, word [esi]
lea edx, [esp + 0x34]
push 0x400
push edx
push eax
call fcn.00414be0
mov si, word [esi]
mov ax, word [ebx + 0x22]
add esp, 0xc
cmp si, ax
jne 0x5c2ad5
mov dword [esp + 0x14], 0
jmp 0x5c2b0c
mov dx, word [edi]
cmp dx, ax
je 0x5c2b0c
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov ax, word [ecx]
test ax, ax
je 0x5c2b0c
mov esi, edx
cmp ax, dx
je 0x5c2b0c
mov eax, dword [esp + 0x14]
add ecx, 2
inc eax
mov dword [esp + 0x14], eax
mov ax, word [ecx]
test ax, ax
jne 0x5c2af3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
cmp word [ecx + edx*2], si
jne 0x5c2b23
mov ax, word [ebx + 0x22]
cmp word [edi], ax
jne 0x5c2b4a
mov ax, word [edi]
push 0
movsx ecx, ax
push ecx
push ebp
push eax
mov ecx, ebx
call fcn.005c27d0
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x40]
push 0xffffffffffffffff
push edx
push eax
call fcn.005b6930
add esp, 0x18
add edi, 5
mov esi, edi
cmp word [edi], 0
jne 0x5c2aa9
mov esi, dword [esp + 0x1c]
mov ax, word [esi]
test ax, ax
je 0x5c2baf
mov edi, esi
lea ecx, [esp + 0x34]
push 0x3ff
push ecx
push eax
call fcn.00414be0
mov ax, word [edi]
add esp, 0xc
movsx edx, ax
push 0
push edx
push ebp
push eax
mov ecx, ebx
call fcn.005c27d0
mov ecx, dword [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push 0xffffffffffffffff
push eax
push ecx
call fcn.005b6930
mov ax, word [esi + 2]
add esi, 2
add esp, 0x18
mov edi, esi
test ax, ax
jne 0x5c2b67
mov edi, dword [esp + 0x2450]
lea ecx, [esp + 0x434]
mov dword [esp + 0x2448], 0xffffffff
call fcn.005b08e0
mov ebp, dword [esp + 0x10]
push ebp
call fcn.005b6180
push 0
push ebp
call fcn.005b6400
mov esi, dword [esp + 0x24]
push esi
call fcn.005b6180
push 0
push esi
call fcn.005b6400
push 0x63
push edi
call fcn.006033f0
mov ecx, dword [esp + 0x2460]
add esp, 0x20
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x243c
ret 4