Function at 0x420b26
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
shr ecx, 0x18
push esi
mov esi, edx
and ecx, 0xf
xor edx, edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov ebx, edx
push edi
sub ecx, 1
je 0x420de1
sub ecx, 1
je 0x420d54
sub ecx, 1
je 0x420d1d
sub ecx, 1
je 0x420c17
sub ecx, 1
je 0x420bec
sub ecx, 1
je 0x420bc0
mov ebx, dword [ebp + 8]
sub ecx, 1
je 0x420bb1
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x420b9f
mov ebx, 0xc0000017
jmp 0x420e3e
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor esi, esi
jmp 0x420eb5
test bl, 7
je 0x420b7e
mov ebx, 0xc0000024
jmp 0x420e3e
mov eax, dword [ebp + 8]
xor ebx, ebx
dec eax
inc ebx
cmp eax, ebx
ja 0x420bb6
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x420b95
cmp byte [esi], 0
setne al
mov byte [edi], al
jmp 0x420baa
push 8
pop ebx
cmp dword [ebp + 8], ebx
jne 0x420bb6
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x420b95
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
jmp 0x420baa
mov eax, dword [ebp + 8]
test al, 0xf
jne 0x420bb6
shr eax, 4
mov esi, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
test eax, eax
je 0x420c7f
mov edi, dword [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x420e3e
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x28]
add ecx, 2
push eax
add esi, ecx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [esp + 0x1c]
add edi, 0x10
inc eax
push 0
mov dword [esp + 0x20], eax
pop edx
cmp eax, dword [esp + 0x20]
jb 0x420c33
mov eax, dword fs:[0x30]
add esi, 2
push esi
push edx
mov dword [esp + 0x20], esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x420b95
xor esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], esi
cmp dword [esp + 0x20], esi
jbe 0x420d13
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x420ec6
movzx esi, word [esp + 0x28]
add esi, 2
push esi
push dword [esp + 0x30]
push dword [esp + 0x24]
call sub.msvcrt.dll_memcpy
add dword [esp + 0x28], esi
lea eax, [esp + 0x34]
add esp, 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
inc esi
add eax, 0x10
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], eax
cmp esi, dword [esp + 0x20]
jb 0x420cb5
mov eax, dword [esp + 0x1c]
xor esi, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x420ead
cmp dword [ebp + 8], 0x10
jne 0x420bb6
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x420e3e
movzx esi, word [esp + 0x28]
mov edi, dword [esp + 0x2c]
add esi, 2
mov dword [esp + 0x18], esi
xor esi, esi
jmp 0x420ead
mov ebx, dword [ebp + 8]
test bl, 1
jne 0x420bb6
mov eax, ebx
mov cl, dl
shr eax, 1
mov byte [esp + 0xf], cl
je 0x420d81
cmp word [esi], dx
je 0x420d7b
add esi, 2
sub eax, 1
jne 0x420d6c
jmp 0x420d81
mov cl, 1
mov byte [esp + 0xf], cl
mov esi, ebx
mov dword [esp + 0x18], esi
test cl, cl
jne 0x420da0
lea esi, [ebx + 2]
mov dword [esp + 0x18], esi
cmp esi, ebx
jae 0x420da0
mov ebx, 0xc0000095
jmp 0x420e3e
mov eax, dword fs:[0x30]
push esi
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x420b95
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp byte [esp + 0xf], 0
jne 0x420dd8
xor eax, eax
mov word [esi + edi - 2], ax
xor esi, esi
mov ebx, esi
jmp 0x420ead
cmp dword [esi], 6
lea eax, [esp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, esi
push eax
jne 0x420df7
call fcn.00420eff
jmp 0x420dff
push dword [ebp + 0xc]
call fcn.0042598c
mov ebx, eax
test ebx, ebx
js 0x420e21
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov esi, dword [eax + 8]
add esi, 0x10
mov dword [esp + 0x18], esi
cmp esi, 0x10
jae 0x420e49
mov ebx, 0xc000000d
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x420e3e
push dword [esp + 0x10]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword fs:[0x30]
push esi
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x20], eax
test eax, eax
jne 0x420e6b
mov ebx, 0xc0000017
jmp 0x420e23
mov esi, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x24]
lea esi, [esi + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [eax + 8]
mov edi, dword [esp + 0x24]
push dword [esp + 0x14]
lea eax, [edi + 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword fs:[0x30]
add esp, 0xc
xor esi, esi
push dword [esp + 0x10]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esp + 0x10], esi
test ebx, ebx
js 0x420ec8
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov ebx, esi
jmp 0x420e23
xor esi, esi
test edi, edi
je 0x420e3e
mov eax, dword fs:[0x30]
push edi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x420e23