Function at 0x6800cae0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xa
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, 0x1b
push ebx
sub esp, 0x4fc
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], edx
mov word [ebp - 0x4da], cx
mov dword [ebp - 0x4d4], 0xbc
mov dword [ebp - 0x4d0], 1
mov dword [ebp - 0x4c8], 0x258
jmp 0x6800cb37
lea edi, [ebx + 1]
cmp edi, esi
jg 0x6800cb67
lea ebx, [esi + edi]
sar ebx, 1
mov eax, dword [ebx*8 + 0x68015060]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4ec]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
je 0x6800cc62
jg 0x6800cb30
lea esi, [ebx - 1]
cmp edi, esi
jle 0x6800cb37
mov esi, dword [ebp - 0x4ec]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 4], 0
mov edx, eax
lea edx, [edx + edx + 2]
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6800cddd
movsx ax, byte [esi]
mov ecx, dword [ebp - 0x4ec]
mov edx, ebx
test al, al
je 0x6800cbcf
lea esi, [esi]
inc ecx
mov word [edx], ax
add edx, 2
movsx ax, byte [ecx]
test al, al
jne 0x6800cbc0
xor eax, eax
mov word [edx], ax
cmp word [ebx], 0
je 0x6800ce14
mov eax, ebx
add eax, 2
cmp word [eax], 0
jne 0x6800cbe0
sub eax, ebx
sar eax, 1
mov ecx, eax
mov edi, dword [ebp - 0x4f0]
mov edx, ebx
mov eax, edi
call sym._add_unformatted_text_to_control
lea eax, [ebp - 0x4d4]
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x447
call dword [sym.imp.user32.dll_SendMessageW]
lea edx, [ebp - 0x4da]
mov eax, edi
mov ecx, 1
sub esp, 0x10
call sym._add_unformatted_text_to_control
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x4d8]
mov dword [esp + 8], eax
mov eax, dword [ebx*8 + 0x68015064]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [0x68024004]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
mov edx, eax
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4d8]
sub esp, 0x10
add edx, edx
mov dword [ebp - 0x4ec], edx
mov edi, dword [ebp - 0x4ec]
mov edx, dword [ebp - 0x4f8]
add edi, eax
cmp eax, edi
jae 0x6800cd88
lea esi, [esi]
mov ebx, eax
jmp 0x6800ccd8
cmp edi, ebx
jbe 0x6800cd88
movzx ecx, word [ebx]
mov esi, ebx
add ebx, 2
cmp cx, 0xa
jne 0x6800ccd0
sub esi, eax
lea ecx, [ebp - 0x418]
mov edi, esi
sar edi, 1
lea edx, [edi + 1]
cmp edx, 1
ja 0x6800cd10
jmp 0x6800cde5
dec edx
add ecx, 2
add eax, 2
mov word [ecx - 2], si
cmp edx, 1
je 0x6800cd18
movzx esi, word [eax]
test si, si
jne 0x6800cd00
xor edx, edx
mov word [ecx], dx
mov ecx, edi
mov edi, dword [ebp - 0x4f0]
lea edx, [ebp - 0x418]
mov eax, edi
call sym._add_unformatted_text_to_control
lea eax, [ebp - 0x4d4]
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x447
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, edi
lea edx, [ebp - 0x4da]
mov ecx, 1
sub esp, 0x10
call sym._add_unformatted_text_to_control
mov edi, dword [ebp - 0x4ec]
mov eax, ebx
mov edx, 1
add edi, eax
cmp eax, edi
jb 0x6800ccc8
lea esi, [esi]
test edx, edx
jne 0x6800cdf8
mov ecx, dword [ebp - 0x4f4]
mov edx, dword [ebp - 0x4d8]
mov edi, dword [ebp - 0x4f0]
mov eax, edi
call sym._add_unformatted_text_to_control
lea eax, [ebp - 0x4d4]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x447
mov dword [esp], edi
call dword [sym.imp.user32.dll_SendMessageW]
mov ecx, 1
lea edx, [ebp - 0x4da]
mov eax, edi
sub esp, 0x10
call sym._add_unformatted_text_to_control
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x6800cd1d
jmp 0x6800cd18
cmp word [eax], 0
je 0x6800cddd
mov ecx, dword [ebp - 0x4f4]
mov edx, eax
sub edx, dword [ebp - 0x4d8]
sar edx, 1
sub ecx, edx
mov edx, eax
jmp 0x6800cd98
xor ecx, ecx
jmp 0x6800cbef