looks for process environment block references they usually start with FS:[0x30h]. fs = frame segment, indicates reference to the programs internal header structures 0x68 offset from the peb is ntglobalflag, three flags get set if a process is being debugged FLG_HEAP_ENABLE_TAIL_CHECK (0x10), FLG_HEAP_ENABLE_FREE_CHECK (0x20), FLG_HEAP_VALIDATE_PARAMETERS(0x40)
source not stored for this graph (policy: none)
nothing calls this directly
no outgoing calls
no test coverage detected