Function at 0x18000bb80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x640
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x638], rbx
mov qword [rbp + 0x640], rsi
mov qword [rbp + 0x648], rdi
mov rax, qword [0x1801724e0]
xor rax, rbp
mov qword [rbp + 0x5f0], rax
mov qword [rbp + 0x10], rcx
mov ebx, 0xc0000026
lea rcx, [rbp + 0x20]
call fcn.18009e920
mov rdi, qword [rbp + 0x118]
lea r8, [rbp + 0x510]
and dword [rbp + 0x510], 0
lea rdx, [rbp + 8]
or qword [rbp + 0x518], 0xffffffffffffffff
mov rcx, rdi
and qword [rbp + 0x520], 0
mov dword [rbp + 0x514], 0x1000000
call sym.ntdll.dll_RtlLookupFunctionEntry
mov r13, rax
test rax, rax
je 0x1800a70f4
mov ebx, dword [rax + 8]
xor r12d, r12d
mov r11, qword [rbp + 8]
add rbx, r11
movzx r10d, byte [rbx]
mov r15d, r10d
and r15d, 7
cmp r15d, 2
jae 0x18000bc44
xor edx, edx
lea rax, [rbx + 2]
mov rcx, rbx
cmp byte [rax], dl
je 0x18000c240
mov esi, edi
sub esi, dword [r13]
sub esi, r11d
test byte [rbx + 3], 0xf
jne 0x18000c094
mov rdx, qword [rbp + 0xb8]
mov qword [rbp], rdx
test r12d, r12d
jne 0x18000bd01
xor r9d, r9d
cmp r15d, 2
jae 0x18000c0fe
xor r14d, r14d
mov r8, rdi
cmp byte [rdi], 0x48
mov r15b, 0xf8
je 0x18000c026
mov al, byte [rdi]
and al, 0xfe
cmp al, 0x48
je 0x18000bfd4
mov r12b, 0x58
mov al, byte [r8]
and al, r15b
cmp al, r12b
je 0x18000c280
mov al, byte [r8]
and al, 0xf0
cmp al, 0x40
je 0x18000bf29
mov cl, byte [r8]
cmp cl, 0xf2
je 0x1800a6f8e
cmp byte [r8], 0xf2
lea r9, [r8 + 1]
lea eax, [rcx + 0x3e]
cmovne r9, r8
cmp al, 1
jbe 0x18000bf5c
cmp cl, 0xf3
je 0x18000c335
lea eax, [rcx + 0x17]
test al, 0xfd
je 0x18000c04c
cmp cl, 0xff
je 0x18000c2b6
and cl, r15b
cmp cl, 0x48
je 0x18000bf43
mov rax, qword [rbp + 8]
xor r12d, r12d
sub edi, eax
mov esi, dword [r13 + 8]
mov r14d, edi
sub r14d, dword [r13]
add rsi, rax
xor ebx, ebx
xor r15b, r15b
mov cl, byte [rsi + 2]
test cl, cl
je 0x18000bd84
movzx ecx, byte [rsi + rbx*2 + 5]
movzx eax, byte [rsi + rbx*2 + 4]
mov r9d, ecx
shr r9d, 4
cmp r14d, eax
jb 0x18000c389
and ecx, 0xf
cmp ecx, 5
ja 0x18000c0ee
je 0x1800a7051
test ecx, ecx
jne 0x18000beb4
mov rax, qword [rdx]
mov qword [rbp + r9*8 + 0x98], rax
mov rdx, qword [rbp + 0xb8]
add rdx, 8
mov ecx, r9d
mov qword [rbp + 0xb8], rdx
inc ebx
movzx eax, byte [rsi + 2]
mov cl, al
cmp ebx, eax
jb 0x18000bd24
test byte [rsi], 0x20
jne 0x18000c201
test r15b, r15b
jne 0x18000bda7
mov rax, qword [rdx]
add rdx, 8
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
lea rcx, [rbp + 0x118]
mov rdi, qword [rbp + 0x10]
mov qword [rdi + 0x10], rax
call fcn.18009ef30
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x1800a70e3
cmp qword [0x7ffe03d8], 0
je 0x18000be8e
mov eax, dword [0x7ffe03e8]
lea ecx, [rax - 0x1c0]
sub rcx, 0x10
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x18000be08
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call sym.ntdll.dll___chkstk
sub rsp, rax
xor edx, edx
lea rax, [rbp + 0x4f0]
lea rbx, [rsp + 0x40]
add rbx, 0x3f
lea r8d, [rdx + 0x40]
and rbx, 0xffffffffffffffc0
mov ecx, ebx
sub ecx, eax
mov dword [rbp + 0x500], ecx
mov eax, dword [0x7ffe03e8]
sub eax, 0x200
mov dword [rbp + 0x4f0], ecx
mov dword [rbp + 0x504], eax
mov eax, 0x18
sub eax, ecx
mov dword [rbp + 0x4f8], 0xfffffb30
mov rcx, rbx
mov dword [rbp + 0x4f4], eax
mov dword [rbp + 0x4fc], 0x4d0
call sym.ntdll.dll_memset
test byte [0x7ffe03ec], 2
jne 0x1800a70c0
or dword [rbp + 0x50], 0x100040
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.18000d490
test al, al
je 0x1800a70de
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.18009ea60
nop
jmp 0x1800a70fc
sub ecx, 1
je 0x18000bf09
sub ecx, 1
je 0x18000bef9
sub ecx, 1
je 0x18000c0c9
cmp ecx, 1
jne 0x1800a70aa
inc ebx
movzx eax, word [rsi + rbx*2 + 4]
shl eax, 3
mov rdx, qword [rbp]
mov ecx, r9d
mov rax, qword [rax + rdx]
mov qword [rbp + r9*8 + 0x98], rax
mov rdx, qword [rbp + 0xb8]
jmp 0x18000bd78
lea ecx, [r9*8 + 8]
add rdx, rcx
jmp 0x18000bd71
inc ebx
movzx r8d, word [rsi + rbx*2 + 4]
test r9d, r9d
jne 0x1800a703f
shl r8d, 3
mov eax, r8d
add rdx, rax
jmp 0x18000bd71
mov al, byte [r8 + 1]
and al, r15b
cmp al, r12b
jne 0x18000bcb5
mov eax, 2
jmp 0x18000c285
cmp byte [r9 + 1], 0xff
jne 0x18000bd01
mov al, byte [r9 + 2]
and al, 0x38
cmp al, 0x20
jne 0x18000bd01
mov al, byte [rdi]
and al, r15b
cmp al, 0x48
jne 0x18000bf83
mov al, byte [rdi + 1]
cmp al, 0x83
jne 0x18000c352
movsx rax, byte [rdi + 3]
add rdx, rax
add rdi, 4
mov qword [rbp + 0xb8], rdx
mov al, byte [rdi]
and al, r15b
cmp al, r12b
je 0x18000c28d
mov al, byte [rdi]
and al, 0xf0
cmp al, 0x40
jne 0x18000bd92
mov al, byte [rdi + 1]
and al, r15b
cmp al, r12b
jne 0x18000bd92
movzx eax, byte [rdi + 1]
movzx ecx, byte [rdi]
and eax, 7
and ecx, 1
shl ecx, 3
or rcx, rax
mov rax, qword [rdx]
mov qword [rbp + rcx*8 + 0x98], rax
mov eax, 2
jmp 0x18000c2a3
cmp byte [rdi + 1], 0x8d
jne 0x18000bc96
movzx ecx, byte [rdi + 2]
movzx r14d, byte [rdi]
mov eax, ecx
and r14d, 1
and eax, 7
shl r14d, 3
or r14d, eax
je 0x18000bc96
movzx eax, byte [rbx + 3]
and eax, 0xf
cmp r14d, eax
jne 0x18000bc96
and cl, r15b
cmp cl, 0x60
je 0x18000c3a1
cmp cl, 0xa0
jne 0x18000bc96
jmp 0x1800a6f85
mov al, byte [rdi + 1]
cmp al, 0x83
je 0x18000c22d
cmp al, 0x81
jne 0x18000bc8a
cmp byte [rdi + 2], 0xc4
jne 0x18000bc8a
add r8, 7
jmp 0x18000bc96
mov r8, r9
sub r8, r11
cmp cl, 0xeb
jne 0x18000c1b2
movsx eax, byte [r9 + 1]
add eax, 2
mov ecx, dword [r13]
movsxd rsi, eax
add rsi, r8
cmp rsi, rcx
jb 0x18000c306
mov eax, dword [r13 + 4]
cmp rsi, rax
jae 0x18000c306
cmp rsi, rcx
jne 0x18000bd01
test byte [rbx], 0x20
jmp 0x18000bf56
movzx eax, byte [rbx + 1]
cmp esi, eax
jb 0x1800a6f27
movzx ecx, byte [rbx + 3]
movzx eax, byte [rbx + 3]
mov rdx, qword [rbp + 0xb8]
and ecx, 0xf
and eax, 0xfffffff0
mov rcx, qword [rbp + rcx*8 + 0x98]
sub rcx, rax
mov qword [rbp], rcx
jmp 0x18000bc62
movzx eax, byte [rsi + 3]
and eax, 0xf
mov rdx, qword [rbp + rax*8 + 0x98]
mov qword [rbp + 0xb8], rdx
movzx eax, byte [rsi + 3]
and eax, 0xfffffff0
sub rdx, rax
jmp 0x18000bd71
sub ecx, 6
jne 0x18000c1be
inc ebx
jmp 0x18000bd78
cmp byte [rbx + 2], r9b
je 0x18000bd01
movzx ecx, word [rbx + 4]
shr cx, 8
mov al, cl
and al, 0xf
cmp al, 6
jne 0x18000bd01
movzx esi, byte [rbx + 4]
mov r8d, edi
sub r8d, r11d
test cl, 0x10
je 0x1800a7009
mov ecx, dword [r13 + 4]
mov eax, r8d
sub ecx, esi
sub eax, ecx
cmp eax, esi
setb r9b
test r9d, r9d
jne 0x1800a7010
movzx r11d, byte [rbx + 2]
lea r10d, [r9 + 1]
cmp r11d, r10d
jbe 0x18000bd01
mov eax, r10d
movzx r14d, word [rbx + rax*2 + 4]
movzx ecx, r14w
shr cx, 8
mov al, cl
and al, 0xf
cmp al, 6
jne 0x18000bd01
movzx r9d, cl
shr r9d, 4
shl r9d, 8
movzx eax, r14b
add r9d, eax
je 0x18000bd01
mov ecx, dword [r13 + 4]
mov eax, r8d
sub ecx, r9d
sub eax, ecx
cmp eax, esi
jb 0x18000c3aa
inc r10d
cmp r10d, r11d
jb 0x18000c15b
jmp 0x18000bd01
mov eax, dword [r9 + 1]
add eax, 5
jmp 0x18000c063
sub ecx, 1
je 0x1800a70a2
sub ecx, 1
jne 0x18000c2c8
inc ebx
mov ecx, r9d
movzx edx, word [rsi + rbx*2 + 4]
shl edx, 4
add rdx, qword [rbp]
shl rcx, 4
mov rax, qword [rdx]
mov qword [rbp + rcx + 0x1c0], rax
mov rax, qword [rdx + 8]
mov qword [rbp + rcx + 0x1c8], rax
jmp 0x18000beed
movzx ecx, cl
test cl, 1
lea r13d, [rcx + 1]
cmove r13d, ecx
inc r12d
add r13, 2
lea r13, [rsi + r13*2]
cmp r12d, 0x20
ja 0x1800a70b5
mov rax, qword [rbp + 8]
jmp 0x18000bd0a
cmp byte [rdi + 2], 0xc4
jne 0x18000c031
add r8, 4
jmp 0x18000bc96
test byte [rcx], 0x20
je 0x18000c347
movzx r9d, byte [rax]
inc edx
mov r8d, r9d
and r8d, 1
cmp edx, 0x20
ja 0x1800a6f1c
lea eax, [r9 + 1]
test r8d, r8d
cmove eax, r9d
mov ecx, dword [rcx + rax*2 + 0xc]
add rcx, r11
lea rax, [rcx + 2]
cmp byte [rax], r12b
jne 0x18000bc44
jmp 0x18000c240
mov eax, 1
add r8, rax
jmp 0x18000bc99
movzx ecx, byte [rdi]
mov rax, qword [rdx]
and ecx, 7
mov qword [rbp + rcx*8 + 0x98], rax
mov eax, 1
mov rdx, qword [rbp + 0xb8]
add rdx, 8
add rdi, rax
jmp 0x18000bf7c
cmp byte [r9 + 1], 0x25
mov cl, 0xff
jne 0x18000bcf5
jmp 0x18000bf5c
sub ecx, 1
je 0x1800a706b
cmp ecx, 1
jne 0x1800a70aa
test r9d, r9d
lea rax, [rdx + 8]
mov r15b, cl
lea rcx, [rdx + 0x18]
cmove rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x118], rax
lea rax, [rcx + 8]
cmove rax, rcx
mov rdx, qword [rax]
jmp 0x18000bd71
lea r8, [rsi + r11]
mov rdx, r11
mov rcx, r13
call fcn.18000b108
test rax, rax
je 0x1800a6f97
mov eax, dword [rax]
cmp rsi, rax
je 0x1800a6f97
mov rdx, qword [rbp + 0xb8]
jmp 0x18000bd01
cmp byte [r9 + 1], 0xc3
mov cl, 0xf3
jne 0x18000bce1
jmp 0x18000bf5c
mov r12d, 1
jmp 0x18000bc44
cmp al, 0x81
jne 0x1800a6fa3
movzx eax, byte [rdi + 5]
movzx ecx, byte [rdi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 3]
shl ecx, 8
movsxd rcx, ecx
or rcx, rax
add rdx, rcx
add rdi, 7
jmp 0x18000bf7c
movzx ecx, word [rsi + rbx*2 + 4]
call fcn.180003f70
mov rdx, qword [rbp + 0xb8]
add ebx, eax
jmp 0x18000bd7a
lea r8, [rdi + 4]
jmp 0x18000bc96
mov r11, qword [rbp + 8]
jmp 0x1800a7010
mov ecx, 0xc00000ff
call sym.ntdll.dll_RtlRaiseStatus
int3
test r10b, 0x20
jne 0x18000c0a0
xor r14d, r14d
cmp byte [rbx + 2], r14b
jbe 0x1800a6f62
movzx ecx, word [rbx + r14*2 + 4]
movzx eax, cx
shr ax, 8
and al, 0xf
cmp al, 3
je 0x1800a6f5e
call fcn.180003f70
add r14d, eax
movzx eax, byte [rbx + 2]
cmp r14d, eax
jb 0x1800a6f3a
mov r11, qword [rbp + 8]
movzx ecx, byte [rbx + r14*2 + 4]
mov rdx, qword [rbp + 0xb8]
mov eax, r14d
cmp esi, ecx
jb 0x18000bc5e
movzx eax, byte [rbx + 3]
mov ecx, eax
jmp 0x18000c0af
lea r8, [rdi + 7]
jmp 0x18000bc96
mov cl, byte [r8 + 1]
jmp 0x18000bcc1
mov rdx, qword [rbp + 0xb8]
jmp 0x18000bf5c
cmp al, 0x8d
jne 0x18000bf83
mov al, byte [rdi + 2]
and al, r15b
cmp al, 0x60
jne 0x1800a6fd1
mov rcx, qword [rbp + r14*8 + 0x98]
mov qword [rbp + 0xb8], rcx
movsx rdx, byte [rdi + 3]
add rdx, rcx
jmp 0x18000bf78
cmp al, 0xa0
jne 0x18000bf83
movzx eax, byte [rdi + 5]
movzx ecx, byte [rdi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 3]
shl ecx, 8
movsxd rdx, ecx
or rdx, rax
add rdx, qword [rbp + r14*8 + 0x98]
jmp 0x18000c380
xor ecx, ecx
jmp 0x18000c140
and qword [rsp + 0x38], 0
lea rax, [rbp + 0x20]
and qword [rsp + 0x30], 0
sub r8d, ecx
and qword [rsp + 0x28], 0
mov r9, r13
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.18009a230
nop
jmp 0x18000bda7
inc ebx
movzx ecx, word [rsi + rbx*2 + 4]
shl ecx, 0x10
add r8d, ecx
jmp 0x18000bf1e
add ebx, 2
movzx edx, word [rsi + rbx*2 + 4]
lea eax, [rbx - 1]
movzx eax, word [rsi + rax*2 + 4]
shl edx, 0x10
add eax, edx
jmp 0x18000beda
add ebx, 2
mov ecx, r9d
movzx r8d, word [rsi + rbx*2 + 4]
lea eax, [rbx - 1]
movzx eax, word [rsi + rax*2 + 4]
shl r8d, 0x10
add r8d, eax
add r8, qword [rbp]
shl rcx, 4
mov rax, qword [r8]
mov qword [rbp + rcx + 0x1c0], rax
mov rax, qword [r8 + 8]
jmp 0x18000c1f4
add ebx, 2
jmp 0x18000bd78
mov ecx, 0xc00000ff
call sym.ntdll.dll_RtlRaiseStatus
int3
mov ecx, 0xc00000ff
call sym.ntdll.dll_RtlRaiseStatus
int3
mov rax, qword [0x7ffe03d8]
movabs rcx, 0x8000000000000000
or rax, rcx
mov qword [rbx + 8], rax
jmp 0x18000be87
xor r8d, r8d
jmp 0x1800a70e6
mov r8b, 1
lea rdx, [rbp + 0x20]
mov rcx, rdi
call sym.ntdll.dll_NtRaiseException
mov ebx, eax
mov ecx, ebx
call sym.ntdll.dll_RtlRaiseStatus
int3
mov rcx, qword [rbp + 0x5f0]
xor rcx, rbp
call fcn.18008b0e0
mov rbx, qword [rbp + 0x638]
mov rsi, qword [rbp + 0x640]
mov rdi, qword [rbp + 0x648]
lea rsp, [rbp + 0x600]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret