Function at 0x413e53
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
shr ecx, 0x18
push esi
mov esi, edx
and ecx, 0xf
xor edx, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
mov ebx, edx
push edi
sub ecx, 1
je 0x4140fe
sub ecx, 1
je 0x414077
sub ecx, 1
je 0x41402b
sub ecx, 1
je 0x413f43
sub ecx, 1
je 0x413f15
sub ecx, 1
je 0x413ee6
mov ebx, dword [ebp + 8]
sub ecx, 1
je 0x413ed7
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x413ec7
mov ebx, 0xc0000017
jmp 0x414155
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x414064
test bl, 7
je 0x413ea6
mov ebx, 0xc0000024
jmp 0x414155
mov eax, dword [ebp + 8]
xor ebx, ebx
dec eax
inc ebx
cmp eax, ebx
ja 0x413edc
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x413ebd
cmp byte [esi], 0
setne al
mov byte [edi], al
jmp 0x414064
push 8
pop ebx
cmp dword [ebp + 8], ebx
jne 0x413edc
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x413ebd
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
jmp 0x414064
mov eax, dword [ebp + 8]
test al, 0xf
jne 0x413edc
shr eax, 4
mov esi, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
test eax, eax
je 0x413fa1
mov edi, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x414155
movzx ecx, word [ebp - 0x24]
lea eax, [ebp - 0x24]
add ecx, 2
push eax
add esi, ecx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [ebp - 0x14]
add edi, 0x10
inc eax
push 0
mov dword [ebp - 0x14], eax
pop edx
cmp eax, dword [ebp - 0x18]
jb 0x413f5c
mov eax, dword fs:[0x30]
add esi, 2
push esi
push edx
mov dword [ebp - 0x10], esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x413ebd
xor esi, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], esi
jbe 0x414024
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x4141c2
movzx esi, word [ebp - 0x24]
add esi, 2
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call sub.msvcrt.dll_memcpy
add dword [ebp - 0x14], esi
lea eax, [ebp - 0x24]
add esp, 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
inc esi
add eax, 0x10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 0x18]
jb 0x413fd2
mov eax, dword [ebp - 0x14]
xor esi, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x414059
cmp dword [ebp + 8], 0x10
jne 0x413edc
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x414155
movzx esi, word [ebp - 0x24]
mov edi, dword [ebp - 0x20]
add esi, 2
mov dword [ebp - 0x10], esi
xor esi, esi
test ebx, ebx
js 0x4141c4
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
xor edi, edi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov ebx, edi
jmp 0x414155
mov eax, dword [ebp + 8]
test al, 1
jne 0x413edc
mov ecx, eax
mov byte [ebp - 1], dl
xor edi, edi
shr ecx, 1
je 0x4140a1
cmp word [esi], di
je 0x41409c
add esi, 2
sub ecx, 1
jne 0x41408d
jmp 0x4140a1
mov dl, 1
mov byte [ebp - 1], dl
mov esi, eax
mov dword [ebp - 0x10], esi
test dl, dl
jne 0x4140b6
lea esi, [eax + 2]
mov dword [ebp - 0x10], esi
cmp esi, eax
jb 0x4140f7
mov ebx, edi
mov eax, dword fs:[0x30]
push esi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x413ebd
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
push ecx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp byte [ebp - 1], 0
jne 0x414057
xor eax, eax
mov word [esi + edi - 2], ax
jmp 0x414057
mov ebx, 0xc0000095
jmp 0x414155
cmp dword [esi], 6
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
mov ecx, esi
push eax
jne 0x414113
call fcn.00414203
jmp 0x41411b
push dword [ebp + 0xc]
call fcn.00417f62
mov ebx, eax
test ebx, ebx
js 0x41413a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax + 8]
add esi, 0x10
mov dword [ebp - 0x10], esi
cmp esi, 0x10
jae 0x414160
mov ebx, 0xc000000d
xor esi, esi
cmp dword [ebp - 8], 0
je 0x414155
push dword [ebp - 8]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword fs:[0x30]
push esi
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x414181
mov ebx, 0xc0000017
jmp 0x41413c
mov esi, dword [ebp - 0xc]
mov edi, eax
mov eax, dword [ebp - 0x1c]
lea esi, [esi + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [eax + 8]
mov edi, dword [ebp - 0x18]
push dword [ebp - 8]
lea eax, [edi + 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword fs:[0x30]
add esp, 0xc
xor esi, esi
push dword [ebp - 8]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 8], esi
jmp 0x414059
xor esi, esi
test edi, edi
je 0x414155
mov eax, dword fs:[0x30]
push edi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x41413c