Function at 0x1000b570
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x258
mov eax, dword [ecx + 8]
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x234], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x238], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x23c], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x22c], eax
test byte [0x1000e048], 8
jne 0x1000b840
cmp word [edx + 0xc], 0
lea ecx, [edx + 0xc]
je 0x1000bb31
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000b5e0
sub eax, ecx
sar eax, 1
cmp word [esi], 0
je 0x1000b607
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x1000b5f8
sub ecx, esi
sar ecx, 1
add eax, ecx
lea eax, [eax + eax + 2]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x234], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x23c], eax
call eax
mov edx, dword [ebp - 0x234]
mov ebx, eax
sub esp, 0xc
xor eax, eax
mov esi, esi
lea edi, [edi]
movzx ecx, word [edx + eax + 0xc]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x1000b650
movzx ecx, word [esi]
movzx eax, word [ebx]
cmp cx, 0x2f
je 0x1000b7f0
cmp cx, 0x5c
je 0x1000b7f0
test ax, ax
je 0x1000b837
mov ecx, ebx
lea esi, [esi]
lea edi, [edi]
add ecx, 2
cmp word [ecx], 0
jne 0x1000b690
xor eax, eax
nop
lea esi, [esi]
movzx edi, word [esi + eax]
mov word [ecx + eax], di
add eax, 2
test di, di
jne 0x1000b6a0
movzx ecx, word [ebx]
mov eax, ebx
test cx, cx
je 0x1000b6da
lea esi, [esi]
cmp cx, 0x5c
jne 0x1000b6ce
mov esi, 0x2f
mov word [eax], si
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1000b6c0
cmp word [eax - 2], 0x2f
jne 0x1000b6e7
xor ecx, ecx
mov word [eax - 2], cx
test byte [0x1000e048], 8
jne 0x1000b960
mov eax, dword [ebp - 0x22c]
mov dword [esp + 4], ebx
mov dword [ebp - 0x238], edx
mov dword [esp + 8], eax
mov eax, dword [edx + 8]
mov esi, dword fs:[0x18]
mov dword [esp], eax
call sym._chm_resolve_object
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x234], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x238]
sub esp, 0xc
test edi, edi
jne 0x1000bd7b
mov dword [esp + 8], 0x230
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x238], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x23c]
call eax
mov edx, dword [ebp - 0x238]
mov esi, dword [ebp - 0x22c]
mov ecx, 0x86
mov dword [eax], sym._ITSS_IStream_QueryInterface_12
lea edi, [eax + 0x18]
mov ebx, eax
sub esp, 0xc
mov dword [eax + 4], 1
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 8], edx
mov eax, dword [edx]
mov dword [esp], edx
call dword [eax + 4]
sub esp, 4
lock add dword [section..bss], 1
test byte [0x1000e048], 8
jne 0x1000b930
mov eax, dword [ebp - 0x230]
mov dword [eax], ebx
mov eax, dword [ebp - 0x234]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
test ax, ax
je 0x1000b837
mov eax, ebx
mov esi, esi
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x1000b800
sub eax, 2
cmp ebx, eax
jbe 0x1000b825
jmp 0x1000b684
sub eax, 2
xor edi, edi
mov word [eax + 2], di
cmp ebx, eax
ja 0x1000b82b
cmp word [eax], 0x2f
je 0x1000b818
movzx eax, word [ebx]
test ax, ax
jne 0x1000b684
mov ecx, ebx
jmp 0x1000b699
test esi, esi
je 0x1000bd2f
mov eax, esi
mov dword [ebp - 0x240], edx
shr eax, 0x10
je 0x1000baa8
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x240]
mov ecx, str._invalid_
sub esp, 8
test eax, eax
jne 0x1000bac3
cmp word [esi], 0
je 0x1000bd5a
lea esi, [esi]
mov ecx, eax
lea eax, [eax + 1]
cmp word [esi + ecx*2 + 2], 0
jne 0x1000b890
mov ebx, 0x224c
mov dword [ebp - 0x22c], edx
mov edi, esi
mov word [ebp - 0x228], bx
lea ebx, [ebp - 0x226]
jmp 0x1000b8fb
cmp ax, 9
je 0x1000bb40
cmp ax, 0xa
jne 0x1000bba6
mov eax, 0x6e5c
add ebx, 2
mov word [ebx - 2], ax
lea eax, [ecx - 1]
test ecx, ecx
jle 0x1000bcd0
lea edx, [ebp - 0x106]
cmp ebx, edx
ja 0x1000bcd0
mov ecx, eax
movzx eax, word [edi]
add edi, 2
cmp ax, 0xd
je 0x1000bb88
jbe 0x1000b8c0
cmp ax, 0x22
je 0x1000bc00
cmp ax, 0x5c
jne 0x1000bb99
mov eax, 0x5c5c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x1000b8e0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._____p_n
mov dword [esp + 8], str.ITSS_create_stream
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000b7ce
mov eax, ebx
mov dword [ebp - 0x234], edx
shr eax, 0x10
je 0x1000ba50
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x234]
mov ecx, str._invalid_
sub esp, 8
test eax, eax
jne 0x1000ba6b
cmp word [ebx], 0
je 0x1000bd39
lea esi, [esi]
mov ecx, eax
lea eax, [eax + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x1000b9a8
mov esi, 0x224c
mov dword [ebp - 0x234], ebx
mov edi, ebx
mov word [ebp - 0x228], si
lea esi, [ebp - 0x226]
jmp 0x1000ba1b
cmp ax, 9
je 0x1000bb70
cmp ax, 0xa
jne 0x1000bc1e
mov eax, 0x6e5c
add esi, 2
mov word [esi - 2], ax
nop
lea esi, [esi]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x1000bc88
lea ebx, [ebp - 0x106]
cmp esi, ebx
ja 0x1000bc88
mov ecx, eax
movzx eax, word [edi]
add edi, 2
cmp ax, 0xd
je 0x1000bb58
jbe 0x1000b9d8
cmp ax, 0x22
je 0x1000bc70
cmp ax, 0x5c
jne 0x1000bc11
mov ebx, 0x5c5c
add esi, 2
mov word [esi - 2], bx
jmp 0x1000ba00
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x234]
mov ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Resolving__s_n
mov dword [esp + 8], str.ITSS_IStorageImpl_OpenStream
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
mov dword [ebp - 0x234], edx
call sym._wine_dbg_log.constprop.0_3
mov edx, dword [ebp - 0x234]
jmp 0x1000b6f4
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x240]
mov ecx, eax
mov eax, dword [ebp - 0x230]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 0xc], str._p__s__p__lu__lu__p_n
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 8], str.ITSS_IStorageImpl_OpenStream
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x234]
mov dword [esp + 4], 0x1000e048
mov dword [esp + 0x18], eax
mov dword [esp], 3
mov dword [ebp - 0x234], edx
call sym._wine_dbg_log.constprop.0_3
mov edx, dword [ebp - 0x234]
cmp word [edx + 0xc], 0
lea ecx, [edx + 0xc]
jne 0x1000b5d7
xor eax, eax
jmp 0x1000b5ed
mov eax, 0x745c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x1000b8e0
mov eax, 0x725c
add esi, 2
mov word [esi - 2], ax
jmp 0x1000ba00
mov eax, 0x745c
add esi, 2
mov word [esi - 2], ax
jmp 0x1000ba00
mov eax, 0x725c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x1000b8e0
lea edx, [eax - 0x20]
cmp dx, 0x5e
jbe 0x1000bd25
mov edx, eax
mov byte [ebx], 0x5c
add ebx, 5
shr dx, 0xc
movzx edx, dx
movzx edx, byte [edx + str.0123456789abcdefITSS_StgOpenStorage]
mov byte [ebx - 4], dl
mov edx, eax
shr dx, 8
and edx, 0xf
movzx edx, byte [edx + str.0123456789abcdefITSS_StgOpenStorage]
mov byte [ebx - 3], dl
mov edx, eax
and eax, 0xf
shr dx, 4
movzx eax, byte [eax + str.0123456789abcdefITSS_StgOpenStorage]
and edx, 0xf
movzx edx, byte [edx + str.0123456789abcdefITSS_StgOpenStorage]
mov byte [ebx - 1], al
mov byte [ebx - 2], dl
jmp 0x1000b8e0
mov eax, 0x225c
add ebx, 2
mov word [ebx - 2], ax
jmp 0x1000b8e0
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x1000bd1b
mov ebx, eax
mov byte [esi], 0x5c
add esi, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefITSS_StgOpenStorage]
mov byte [esi - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefITSS_StgOpenStorage]
mov byte [esi - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefITSS_StgOpenStorage]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefITSS_StgOpenStorage]
mov byte [esi - 1], al
mov byte [esi - 2], bl
jmp 0x1000ba00
mov eax, 0x225c
add esi, 2
mov word [esi - 2], ax
jmp 0x1000ba00
mov byte [esi], 0x22
mov ebx, dword [ebp - 0x234]
test eax, eax
jle 0x1000bd52
mov ecx, 0x2e2e
mov byte [esi + 3], 0x2e
lea eax, [esi + 4]
mov word [esi + 1], cx
mov byte [eax], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x234], edx
mov dword [esp], eax
call sym.___wine_dbg_strdup
mov edx, dword [ebp - 0x234]
mov ecx, eax
jmp 0x1000ba6b
mov byte [ebx], 0x22
mov edx, dword [ebp - 0x22c]
test eax, eax
jle 0x1000bd73
mov ecx, 0x2e2e
mov byte [ebx + 3], 0x2e
lea eax, [ebx + 4]
mov word [ebx + 1], cx
mov byte [eax], 0
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x22c], eax
call sym.___wine_dbg_strdup
mov edx, dword [ebp - 0x240]
mov ecx, eax
jmp 0x1000bac3
mov byte [esi], al
add esi, 1
jmp 0x1000ba00
mov byte [ebx], al
add ebx, 1
jmp 0x1000b8e0
mov ecx, str._null_
jmp 0x1000bac3
mov edi, 0x224c
mov byte [ebp - 0x226], 0x22
lea esi, [ebp - 0x226]
mov word [ebp - 0x228], di
lea eax, [esi + 1]
jmp 0x1000bca9
mov eax, 0x224c
mov byte [ebp - 0x226], 0x22
lea ebx, [ebp - 0x226]
mov word [ebp - 0x228], ax
lea eax, [ebx + 1]
jmp 0x1000bcf1
mov dword [ebp - 0x234], 0x80030002
test byte [0x1000e048], 4
je 0x1000b7d6
mov dword [esp + 0xc], str.Could_not_resolve_object_n
mov dword [esp + 8], str.ITSS_IStorageImpl_OpenStream
mov dword [esp + 4], 0x1000e048
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000b7d6