Function at 0x41d9d4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
shr ecx, 0x18
push esi
mov esi, edx
and ecx, 0xf
xor edx, edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov ebx, edx
push edi
sub ecx, 1
je 0x41dc8f
sub ecx, 1
je 0x41dc02
sub ecx, 1
je 0x41dbcb
sub ecx, 1
je 0x41dac5
sub ecx, 1
je 0x41da9a
sub ecx, 1
je 0x41da6e
mov ebx, dword [ebp + 8]
sub ecx, 1
je 0x41da5f
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x41da4d
mov ebx, 0xc0000017
jmp 0x41dcec
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor esi, esi
jmp 0x41dd63
test bl, 7
je 0x41da2c
mov ebx, 0xc0000024
jmp 0x41dcec
mov eax, dword [ebp + 8]
xor ebx, ebx
dec eax
inc ebx
cmp eax, ebx
ja 0x41da64
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x41da43
cmp byte [esi], 0
setne al
mov byte [edi], al
jmp 0x41da58
push 8
pop ebx
cmp dword [ebp + 8], ebx
jne 0x41da64
mov eax, dword fs:[0x30]
push ebx
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x41da43
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
jmp 0x41da58
mov eax, dword [ebp + 8]
test al, 0xf
jne 0x41da64
shr eax, 4
mov esi, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
test eax, eax
je 0x41db2d
mov edi, dword [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x41dcec
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x28]
add ecx, 2
push eax
add esi, ecx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [esp + 0x1c]
add edi, 0x10
inc eax
push 0
mov dword [esp + 0x20], eax
pop edx
cmp eax, dword [esp + 0x20]
jb 0x41dae1
mov eax, dword fs:[0x30]
add esi, 2
push esi
push edx
mov dword [esp + 0x20], esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x41da43
xor esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], esi
cmp dword [esp + 0x20], esi
jbe 0x41dbc1
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x41dd74
movzx esi, word [esp + 0x28]
add esi, 2
push esi
push dword [esp + 0x30]
push dword [esp + 0x24]
call sub.msvcrt.dll_memcpy
add dword [esp + 0x28], esi
lea eax, [esp + 0x34]
add esp, 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
inc esi
add eax, 0x10
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], eax
cmp esi, dword [esp + 0x20]
jb 0x41db63
mov eax, dword [esp + 0x1c]
xor esi, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x41dd5b
cmp dword [ebp + 8], 0x10
jne 0x41da64
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
js 0x41dcec
movzx esi, word [esp + 0x28]
mov edi, dword [esp + 0x2c]
add esi, 2
mov dword [esp + 0x18], esi
xor esi, esi
jmp 0x41dd5b
mov ebx, dword [ebp + 8]
test bl, 1
jne 0x41da64
mov eax, ebx
mov cl, dl
shr eax, 1
mov byte [esp + 0xf], cl
je 0x41dc2f
cmp word [esi], dx
je 0x41dc29
add esi, 2
sub eax, 1
jne 0x41dc1a
jmp 0x41dc2f
mov cl, 1
mov byte [esp + 0xf], cl
mov esi, ebx
mov dword [esp + 0x18], esi
test cl, cl
jne 0x41dc4e
lea esi, [ebx + 2]
mov dword [esp + 0x18], esi
cmp esi, ebx
jae 0x41dc4e
mov ebx, 0xc0000095
jmp 0x41dcec
mov eax, dword fs:[0x30]
push esi
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x41da43
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp byte [esp + 0xf], 0
jne 0x41dc86
xor eax, eax
mov word [esi + edi - 2], ax
xor esi, esi
mov ebx, esi
jmp 0x41dd5b
cmp dword [esi], 6
lea eax, [esp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, esi
push eax
jne 0x41dca5
call fcn.0041ddad
jmp 0x41dcad
push dword [ebp + 0xc]
call fcn.00423d29
mov ebx, eax
test ebx, ebx
js 0x41dccf
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov esi, dword [eax + 8]
add esi, 0x10
mov dword [esp + 0x18], esi
cmp esi, 0x10
jae 0x41dcf7
mov ebx, 0xc000000d
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x41dcec
push dword [esp + 0x10]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword fs:[0x30]
push esi
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x20], eax
test eax, eax
jne 0x41dd19
mov ebx, 0xc0000017
jmp 0x41dcd1
mov esi, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x24]
lea esi, [esi + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [eax + 8]
mov edi, dword [esp + 0x24]
push dword [esp + 0x14]
lea eax, [edi + 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword fs:[0x30]
add esp, 0xc
xor esi, esi
push dword [esp + 0x10]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esp + 0x10], esi
test ebx, ebx
js 0x41dd76
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov ebx, esi
jmp 0x41dcd1
xor esi, esi
test edi, edi
je 0x41dcec
mov eax, dword fs:[0x30]
push edi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x41dcd1