Address      Hex dump        Command                           Comments
--------------------------------------------------------------------------------
Function 00401C98 {
00401C98     64:A1 18000000  MOV EAX, DWORD PTR FS:[18h]       TEB
00401C9E     8B40 30         MOV EAX, DWORD PTR DS:[EAX+30h]   EAX <- адрес PEB из TEB
00401CA1     0FB640 02       MOVZ EAX, BYTE PTR DS:[EAX+2]     EAX <- BeingDebugged
00401CA5     83F8 01         CMP EAX, 1                        EAX == 1 (1 - есть отладка)
004010A8     C3              RETN
}