Function at 0xbeddc2
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x24], ecx
xor ecx, ecx
test byte [edx], 1
push ebx
mov dword [eax], ecx
mov ebx, ecx
mov eax, dword [ebp + 0x20]
push esi
mov esi, ecx
mov dword [esp + 0x20], edx
push edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
mov dword [eax], ecx
jne 0xbede34
mov ecx, edx
call fcn.00beeea1
test eax, eax
jne 0xbede2e
push 0xa1e204
push 0x694
xor edi, edi
push 0xa1e22c
inc edi
push edi
call fcn.00a32ac8
add esp, 0x10
xor ecx, ecx
jmp 0xbee0ae
mov edx, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [edx + 0x24]
xor edi, edi
inc edi
mov dword [esp + 0x34], eax
mov ebx, ecx
cmp dword [eax], ecx
jle 0xbee0a7
add eax, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [ebp + 8]
lea eax, [ecx + 2]
mov dword [esp + 0x2c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x28]
jne 0xbede59
sub ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
sar ecx, 1
push ecx
push dword [ebp + 8]
mov ecx, dword [esp + 0x40]
call fcn.00bef1c0
test eax, eax
je 0xbee081
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
sub esp, 0xc
call fcn.00a3222e
mov esi, dword [esp + 0x10]
mov ecx, eax
test ecx, ecx
js 0xbedead
mov ecx, esi
call fcn.00a31fbd
mov ecx, eax
call fcn.00c5c53e
test eax, eax
je 0xbedf03
mov ecx, esi
call fcn.00a32a08
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov esi, ecx
mov dword [esp + 0x10], esi
test eax, eax
je 0xbedee4
push eax
mov eax, dword fs:[0x30]
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x34]
inc ebx
add dword [esp + 0x1c], 0x18
mov edx, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
cmp ebx, dword [eax]
jl 0xbede4f
jmp 0xbee0a7
test ecx, ecx
jns 0xbedf28
push ecx
push 0xa1e270
push 0x6cc
xor edi, edi
push 0xa1e22c
inc edi
push edi
call fcn.00a32ac8
add esp, 0x14
jmp 0xbee09c
test ebx, ebx
jle 0xbedf31
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
test esi, esi
je 0xbee0a5
mov eax, dword [esi + 0x18]
mov dword [esp + 0x34], eax
xor eax, eax
mov ebx, eax
cmp eax, dword [esi + 0x14]
jb 0xbedf5b
ja 0xbedf53
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [esi + 0x10]
jb 0xbedf5e
mov ecx, dword [esi + 0x10]
mov dword [ebp + 0x18], ecx
jmp 0xbedf5e
mov ecx, dword [ebp + 0x18]
cmp dword [ebp + 0x10], ecx
ja 0xbee0a5
xor eax, eax
cmp dword [ebp + 0x14], 3
sete al
inc eax
mov dword [esp + 0x30], eax
test ecx, ecx
je 0xbee041
cmp ebx, dword [ebp + 0x10]
jbe 0xbedf87
sub eax, dword [ebp + 0x10]
add ebx, eax
mov esi, ecx
sub esi, ebx
cmp esi, 0x1000
jbe 0xbedf98
mov esi, 0x1000
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x18]
lea eax, [esi + 2]
push eax
push 8
push ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x1c], eax
test eax, eax
je 0xbee075
mov edx, dword [esp + 0x34]
lea ecx, [ebx + edx]
cmp ecx, edx
jb 0xbee069
push esi
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
je 0xbee04e
cmp eax, 2
jbe 0xbedffd
cmp eax, 3
jne 0xbee04e
mov eax, dword [ebp + 0x10]
mov edx, esi
mov ecx, dword [esp + 0x1c]
shr eax, 1
push eax
push dword [ebp + 0xc]
shr edx, 1
call fcn.00c5cccc
jmp 0xbee00e
push dword [ebp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, esi
push dword [ebp + 0xc]
call fcn.00c5cc57
test eax, eax
je 0xbee016
mov dword [esp + 0x20], edi
push dword [esp + 0x1c]
xor eax, eax
add ebx, esi
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp + 0x18]
mov eax, dword [esp + 0x30]
cmp ebx, ecx
jb 0xbedf7d
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
xor ecx, ecx
jmp 0xbee0ac
push 0xa1e2c8
push 0x73c
push 0xa1e22c
push edi
call fcn.00a32ac8
mov esi, dword [esp + 0x20]
jmp 0xbee099
push 0xa1e2a8
push 0x71a
jmp 0xbee058
push 0xa1e288
push 0x713
jmp 0xbee058
push 0xa1e248
push 0x6ac
xor edi, edi
inc edi
push 0xa1e22c
push edi
call fcn.00a32ac8
add esp, 0x10
mov ebx, dword [esp + 0x14]
jmp 0xbede27
xor ecx, ecx
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ebx, edi
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp eax, 0x25
je 0xbee0c3
cmp eax, 0x5c
je 0xbee0c3
cmp eax, 0x2e
jne 0xbee0c8
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0xbee0e5
push eax
mov eax, dword fs:[0x30]
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x10]
test esi, esi
je 0xbee0f0
mov ecx, esi
call fcn.00a32a08
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c