Function at 0x40f6f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x14], edx
xor ebx, ebx
mov dword [ebp - 0x20], eax
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
mov esi, ebx
mov dword [ebp - 0x10], ebx
lea edx, [ebp - 0x10]
mov dword [ebp - 0xc], esi
mov ecx, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
call fcn.00412092
mov edi, eax
test edi, edi
js 0x40fa34
mov edi, dword [ebp - 8]
test edi, edi
jne 0x40f77d
mov eax, dword [0x4c14c0]
mov edi, 0xc0000098
neg eax
sbb eax, eax
and eax, 0x4c14c0
je 0x40f76f
cmp dword [eax], ebx
je 0x40f76f
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40f75d
mov edx, 0x401e08
push ecx
push ecx
push ebx
push ebx
push edi
push 9
pop ecx
call fcn.0041297c
jmp 0x40fa34
push ecx
push ecx
push ebx
push ebx
push edi
mov edx, 0x401e08
push 3
jmp 0x40f764
cmp dword [0x491504], ebx
jne 0x40f79f
push edi
call sym.BootLib.dll_BlMmAllocateHeap
mov dword [0x491504], eax
test eax, eax
je 0x40f79f
push edi
push ebx
push eax
call sym.BootLib.dll_memset
add esp, 0xc
cmp byte [0x4c2e00], bl
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
je 0x40f7dd
mov ecx, ebx
test esi, esi
je 0x40f7dd
mov eax, dword [edi + ecx*4]
test eax, eax
je 0x40f7d8
mov edx, ebx
mov eax, dword [eax + edx*4 + 4]
mov esi, 0x4c2e10
cmp eax, dword [esi + edx*4]
mov esi, dword [ebp - 8]
jne 0x40f7d8
inc edx
cmp edx, 4
je 0x40f84b
mov eax, dword [edi + ecx*4]
jmp 0x40f7bc
inc ecx
cmp ecx, esi
jb 0x40f7b3
push esi
push ecx
mov edx, 0x402178
call fcn.0040e652
cmp byte [0x4c2e30], bl
jne 0x40f813
push 0x491508
push 0x26000020
push dword [0x4c1b74]
call sym.BootLib.dll_BlGetBootOptionBoolean
test eax, eax
sets al
dec al
and byte [0x491508], al
cmp esi, 1
jne 0x40f864
mov esi, dword [edi]
mov edx, esi
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
call fcn.0041032a
cmp byte [0x491508], bl
jne 0x40f96d
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov edi, ebx
mov byte [0x491508], 1
jmp 0x40fa34
mov eax, dword [ebp + 8]
mov esi, dword [edi + ecx*4]
mov edi, ebx
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
jmp 0x40fa34
lea eax, [ebp - 0x1c]
mov edx, esi
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.0040f67c
mov ecx, dword [0x491504]
mov byte [ebp - 1], bl
test ecx, ecx
je 0x40f89f
mov eax, dword [ebp - 0x1c]
cmp byte [ecx + eax], bl
je 0x40f89f
mov eax, ebx
test esi, esi
je 0x40f89f
cmp dword [edi + eax*4], ebx
je 0x40f89a
cmp byte [ecx + eax], bl
je 0x40f903
inc eax
cmp eax, esi
jb 0x40f890
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x1c]
test byte [esi], 4
je 0x40f919
mov ecx, esi
call fcn.00411ce3
cmp eax, 1
jne 0x40f914
cmp edx, ebx
jne 0x40f914
cmp byte [0x491508], bl
jne 0x40f914
mov ecx, dword [0x4c1b74]
lea eax, [ebp - 0x30]
push eax
mov edx, 0x25000004
call fcn.00418208
test eax, eax
js 0x40f8e2
mov eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x2c]
je 0x40f8ef
push ecx
mov edx, 0x16000071
mov ecx, esi
call fcn.00418857
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
jmp 0x40f83d
mov esi, dword [edi + eax*4]
mov edi, eax
mov byte [ebp - 1], 1
mov byte [0x491508], bl
jmp 0x40f8a5
cmp byte [ebp - 1], bl
jne 0x40f8ef
mov ecx, dword [0x4c1b74]
lea eax, [ebp - 0x30]
push eax
mov edx, 0x25000004
call fcn.00418208
test eax, eax
js 0x40f96d
mov eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x2c]
jne 0x40f96d
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, esi
call fcn.0041032a
cmp byte [0x491508], bl
jne 0x40f95d
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x40f83d
mov ecx, dword [0x4c1b74]
mov edx, 0x25000004
call fcn.00418aa5
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x24]
mov dword [ebp - 0xc], ebx
call fcn.004121a9
push dword [ebp - 0x18]
mov edx, 0x401f90
push ecx
call fcn.0040e652
push ecx
mov edx, 0x402158
call fcn.0040e63a
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
rdtsc
mov esi, eax
mov edi, edx
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push dword [ebp - 8]
call fcn.00410a2b
mov dword [ebp + 0xc], eax
rdtsc
sub eax, esi
mov esi, dword [ebp - 0xc]
mov dword [0x4c2e08], eax
sbb edx, edi
add dword [0x4c2e20], eax
mov edi, dword [ebp + 0xc]
adc dword [0x4c2e24], edx
mov dword [0x4c2e0c], edx
test edi, edi
js 0x40f9ea
mov eax, dword [ebp - 0x14]
mov edi, ebx
mov dword [eax], esi
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x40fa34
mov eax, ebx
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x18], eax
jbe 0x40fa2e
mov ebx, dword [ebp + 8]
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x40fa19
cmp eax, esi
jne 0x40fa0d
test edi, edi
jns 0x40fa19
mov ecx, eax
call fcn.00417f70
mov ecx, dword [ebp - 0x24]
jmp 0x40fa20
cmp eax, esi
jne 0x40fa20
or dword [ebx], 0xffffffff
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp - 0x18]
jb 0x40f9fe
xor ebx, ebx
push ecx
call sym.BootLib.dll_BlMmFreeHeap
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x40fa74
mov eax, dword [ebp - 8]
test eax, eax
je 0x40fa6e
mov edx, dword [ecx + ebx*4]
test edx, edx
je 0x40fa60
cmp edx, esi
jne 0x40fa51
test edi, edi
jns 0x40fa60
mov ecx, edx
call fcn.00417f70
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
jmp 0x40fa69
cmp edx, esi
jne 0x40fa69
mov edx, dword [ebp + 8]
mov dword [edx], ebx
inc ebx
cmp ebx, eax
jb 0x40fa42
push ecx
call sym.BootLib.dll_BlMmFreeHeap
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8