Function at 0x100720e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd0
mov esi, esp
mov dword [esi + 0xb8], ebp
mov dword [esi + 0x14], esp
lea edx, [ebp + 8]
mov dword [esi + 0xbc], esp
mov dword [esi + 0xc8], 0xffffffff
lea eax, [esi + 0xc0]
mov dword [esi + 0xc4], 0x1007fd20
mov ecx, dword fs:[0]
mov dword [esi + 0xc0], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov dword [eax + 8], 0
mov dword [esi + 8], eax
add eax, 8
mov dword [esi + 0x10], eax
push eax
sub esp, 0x38
mov edi, esp
mov ebx, edi
mov al, byte [ebp + 0x38]
mov byte [esi + 2], al
mov al, byte [ebp + 0x3c]
mov byte [esi + 3], al
mov dword [edi + 0x30], 0
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1007218b
mov dword [esi + 4], ebx
add edi, 0xc
mov dword [esi + 0xc], edi
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [esi + 0xc8], 1
push edi
call eax
mov ebx, dword [esi + 4]
mov dword [ebx + 0x30], eax
lea edx, [ebp + 8]
mov eax, dword [edx + 4]
mov edi, dword [eax]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], eax
lea eax, [esi + 0x18]
mov dword [ebx], eax
mov al, byte [esi + 2]
mov byte [ebx + 0x34], al
mov al, byte [esi + 3]
mov byte [ebx + 0x38], al
mov dword [esi + 0xc8], 0
call fcn.1007ace0
add esp, 0x3c
mov esp, dword [esi + 0x14]
mov dword [esi + 0xc8], 2
lea ecx, [esi + 0x18]
push dword [esi + 8]
push 1
call fcn.1007ae10
mov eax, dword [esi + 0x88]
cmp eax, 0x10
jb 0x10072219
mov ecx, dword [esi + 0x74]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x1007220f
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x100722c4
add eax, 0x24
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.102e53ef
add esp, 8
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], 0
mov ecx, dword [esi + 0x68]
test ecx, ecx
lea edi, [ebp + 8]
je 0x10072278
mov eax, dword [esi + 0x70]
sub eax, ecx
cmp eax, 0x1000
jb 0x10072259
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x100722c4
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.102e53ef
add esp, 8
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x1007228f
xor eax, eax
lea edx, [esi + 0x18]
cmp ecx, edx
setne al
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100722ad
xor eax, eax
lea edx, [ebp + 0x10]
cmp ecx, edx
setne al
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov dword [edi + 0x2c], 0
mov eax, dword [edi]
mov ecx, dword [esi + 0xc0]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop word [eax + eax]
push ebp
sub esp, 0x3c
lea esi, [ebp - 0xcc]
mov ebp, dword [esi + 0xb8]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x10072304
xor eax, eax
cmp ecx, edx
setne al
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov eax, dword [esi + 4]
mov dword [eax + 0x30], 0
add esp, 0x3c
pop ebp
ret