Function at 0x401450
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x20], edx
movzx esi, word [eax]
mov dword [ebp - 0x24], ecx
test esi, esi
je 0x401666
mov ebx, eax
mov edx, eax
mov dword [ebp - 0x1c], 0
xor edi, edi
mov esi, esi
lea edi, [edi]
mov eax, edx
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x401490
sub eax, edx
mov ecx, eax
add eax, 2
sar ecx, 1
inc ecx
cmp esi, 0x2b
je 0x4014e8
add edi, ecx
add edx, eax
movzx esi, word [edx]
test esi, esi
jne 0x401480
test edi, edi
jne 0x4014fb
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
test ecx, ecx
mov dword [eax], 0
jne 0x40158d
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [edx + 2], 0
je 0x4014a8
mov esi, dword [ebp - 0x1c]
lea esi, [esi + ecx - 1]
mov dword [ebp - 0x1c], esi
jmp 0x4014aa
lea edx, [edi + edi + 2]
xor esi, esi
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x28], eax
sub esp, 0xc
test eax, eax
je 0x401671
movzx edx, word [ebx]
mov edi, ebx
test edx, edx
je 0x401575
mov dword [ebp - 0x2c], ebx
mov esi, eax
lea esi, [esi]
mov eax, edi
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x401550
sub eax, edi
add eax, 2
cmp edx, 0x2b
jne 0x401618
add edi, eax
movzx edx, word [edi]
test edx, edx
jne 0x401540
mov ebx, dword [ebp - 0x2c]
mov eax, esi
mov word [eax], 0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
test ecx, ecx
mov dword [eax], edi
je 0x4014d2
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [esp + 4], edx
mov esi, dword fs:[0x18]
lea eax, [eax + eax + 2]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x40167b
movzx edx, word [ebx]
test edx, edx
je 0x4015fc
nop
lea esi, [esi]
mov eax, ebx
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x4015e0
sub eax, ebx
cmp edx, 0x2b
lea ecx, [eax + 2]
je 0x401640
add ebx, ecx
movzx edx, word [ebx]
test edx, edx
jne 0x4015d0
mov word [edi], 0
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
mov dword [eax], edi
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, esi
mov edx, edi
lea esi, [esi]
movzx ebx, word [edx]
add edx, 2
add ecx, 2
mov word [ecx - 2], bx
test ebx, ebx
jne 0x401620
add esi, eax
jmp 0x401567
cmp word [ebx + 2], 0
je 0x4015f3
xor edx, edx
lea esi, [esi]
movzx esi, word [ebx + edx + 2]
mov word [edi + edx], si
add edx, 2
test esi, esi
jne 0x401650
add edi, eax
add ebx, ecx
jmp 0x4015f5
mov dword [edx], 0
jmp 0x4014d2
mov eax, 0xe
jmp 0x4014dd
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 0xe
sub esp, 0xc
jmp 0x4014dd