movzx ecx, [esi+_RTL_HEAP_ENTRY.Size] shl ecx, 3 mov [ebp+ChunkSize], ecx test al, 1000b ; skip cookie check if it is marked as virtually allocated jnz short SkipCookieCheck2 cmp [esi+_RTL_HEAP_FREE_BLOCK.Entry.Index], 0FFh jnb short SkipCookieCheck call _RtlGetNtGlobalFlags@0 ; RtlGetNtGlobalFlags() test ah, 1000b jnz short SkipCookieCheck // if ((((&Chunk/8) ^ Chunk.Cookie) ^ Heap.Cookie) != 0) CORRUPT mov eax, esi shr eax, 3 xor al, [esi+_RTL_HEAP_FREE_BLOCK.Entry.Cookie] xor al, [edi+_RTL_HEAP.Entry.Cookie] jnz HeapCorruption