Function at 0x140075aac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xf8
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x77]
mov rbx, r8
mov qword [rbp - 0x21], rax
xor r8d, r8d
mov r15, r9
mov rax, qword [rbp + 0x7f]
mov rdi, rcx
mov qword [rbp - 0x29], rax
mov qword [rsp + 0x58], r9
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x39], rcx
cmp byte [rcx + 0x38], r8b
jne 0x140075b1a
mov rdx, qword [rdx]
lea r8, [rcx + 0x40]
call fcn.14007de74
mov dword [rdi + 0x3c], eax
xor r8d, r8d
mov word [rdi + 0x38], 0x101
mov ecx, dword [rdi + 0x3c]
test ecx, ecx
js 0x14007642c
mov byte [rsp + 0x30], r8b
or rdi, 0xffffffffffffffff
mov qword [rbp - 0x79], r8
mov qword [rbp - 0x71], r8
mov r13d, r8d
mov esi, 0x8007000e
mov dword [rsp + 0x34], r13d
mov r12d, r8d
mov dword [rbp - 0x61], r8d
mov r14, r8
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r8
test r15, r15
je 0x1400763e9
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r8w
jne 0x140075b68
cmp rax, 3
jb 0x140075c2f
add rax, 0xfffffffffffffffd
lea rdx, [0x1400ac5d0]
lea rcx, [r15 + rax*2]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
mov ecx, r8d
sete cl
test ecx, ecx
je 0x140075c2f
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r8w
jne 0x140075bad
lea r14, [rax - 3]
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r8w
jne 0x140075bbe
cmp r14, rax
ja 0x1400763f9
mov rcx, qword gs:[0x60]
lea r15, [r14 + 1]
lea r8, [r15 + r15]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r8d, r8d
mov rdi, rax
test rax, rax
je 0x140075c1a
mov r8, qword [rsp + 0x58]
mov r9, r14
mov rdx, r15
mov rcx, rax
call fcn.14000107c
mov esi, eax
xor r8d, r8d
test esi, esi
js 0x1400763fe
mov r14, rdi
mov qword [rsp + 0x38], rdi
jmp 0x1400761db
cmp r8w, word [r15]
je 0x1400763f9
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r8w
jne 0x140075c3c
cmp rax, 1
jb 0x1400760ca
dec rax
lea rdx, [0x1400ac5cc]
lea rcx, [r15 + rax*2]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
jne 0x1400760ca
mov r14d, r8d
mov dword [rsp + 0x64], r8d
mov rax, r15
xor r12d, r12d
mov edx, 0x5b
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov edi, r12d
mov dword [rsp + 0x40], r12d
test rax, rax
je 0x140075cd0
mov edx, 0x5d
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140075cc7
inc r14d
mov dword [rsp + 0x64], r14d
jmp 0x140075c83
mov edi, 1
mov dword [rsp + 0x40], edi
mov edx, 0x5b
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x1400760af
test edi, edi
jne 0x1400760af
sub rax, r15
sar rax, 1
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], r12w
jne 0x140075cff
cmp rax, rcx
ja 0x140075d53
mov rcx, qword gs:[0x60]
lea rdi, [rax + 1]
lea r8, [rdi + rdi]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x140075d5c
lea r9, [rdi - 1]
mov r8, r15
mov rdx, rdi
mov rcx, rax
call fcn.14000107c
mov esi, eax
jmp 0x140075d5c
mov esi, 0x80070057
mov qword [rbp - 0x51], r12
mov rcx, qword gs:[0x60]
mov edx, 8
mov edi, r14d
shl rdi, 3
mov r8, rdi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
test rax, rax
mov qword [rbp - 0x59], rax
mov r12, rax
mov edx, 8
mov eax, 0x8007000e
mov rcx, qword [rcx + 0x30]
cmove esi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov rdi, rax
test rax, rax
jne 0x140075dd1
mov esi, 0x8007000e
jmp 0x140076064
test esi, esi
js 0x140076064
mov ecx, dword [rsp + 0x40]
mov edi, r8d
mov dword [rsp + 0x60], r8d
mov rax, r15
mov r13, r8
mov qword [rbp - 0x49], r8
mov rbx, r12
mov dword [rsp + 0x40], ecx
mov edx, 0x5b
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor r8d, r8d
mov r12, rax
test rax, rax
je 0x140076028
cmp edi, r14d
jae 0x140076028
mov r15d, edi
lea edx, [r8 + 0x5d]
mov rdi, qword [rsp + 0x68]
mov rcx, rax
mov qword [rbp - 0x31], r15
mov qword [rbx + r15*8], r8
mov qword [rdi + r15*8], r8
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp - 0x41], rax
test rax, rax
je 0x14007602d
mov r14, rax
lea edx, [r8 + 0x3d]
sub r14, r12
mov rcx, r12
sar r14, 1
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor ecx, ecx
mov rdi, rax
test rax, rax
je 0x140075f97
cmp rax, qword [rbp - 0x41]
jae 0x140075f97
sub rdi, r12
mov esi, 0x8007000e
sar rdi, 1
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], cx
jne 0x140075e9c
cmp rdi, 1
jb 0x140075ffd
cmp rax, 1
jb 0x140075ffd
cmp rdi, rax
ja 0x140075ffd
mov rcx, qword gs:[0x60]
lea r8, [rdi + rdi]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r11d, r11d
mov r13, rax
test rax, rax
je 0x140075f06
lea r9, [rdi - 1]
mov rdx, rdi
lea r8, [r12 + 2]
mov rcx, rax
call fcn.14000107c
mov esi, eax
mov qword [rbx + r15*8], r13
test esi, esi
js 0x140076006
inc rdi
mov esi, 0x8007000e
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r11w
jne 0x140075f1e
cmp r14, rdi
jb 0x140075f83
cmp rdi, rax
ja 0x140075f83
cmp r14, rax
ja 0x140075f83
mov rcx, qword gs:[0x60]
sub r14, rdi
mov edx, 8
mov rcx, qword [rcx + 0x30]
lea r15, [r14 + 1]
lea r8, [r15 + r15]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x49], rax
test rax, rax
je 0x140075f7d
lea r8, [r12 + rdi*2]
mov r9, r14
mov rdx, r15
mov rcx, rax
call fcn.14000107c
mov esi, eax
mov r15, qword [rbp - 0x31]
jmp 0x140075f88
mov esi, 0x80070057
mov rcx, qword [rsp + 0x68]
mov rax, qword [rbp - 0x49]
mov qword [rcx + r15*8], rax
jmp 0x140076006
mov esi, 0x8007000e
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], cx
jne 0x140075fa0
cmp r14, 1
jb 0x140075ffd
cmp rax, 1
jb 0x140075ffd
cmp r14, rax
ja 0x140075ffd
mov rcx, qword gs:[0x60]
lea r8, [r14 + r14]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x140076002
lea r9, [r14 - 1]
mov rdx, r14
lea r8, [r12 + 2]
mov rcx, rax
call fcn.14000107c
mov esi, eax
jmp 0x140076002
mov esi, 0x80070057
mov qword [rbx + r15*8], r13
mov edi, dword [rsp + 0x60]
xor r8d, r8d
mov ecx, dword [rsp + 0x40]
inc edi
mov r14d, dword [rsp + 0x64]
mov rax, qword [rbp - 0x41]
mov dword [rsp + 0x60], edi
test ecx, ecx
je 0x140075df2
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rbp - 0x69]
mov r15, qword [rsp + 0x58]
test esi, esi
js 0x14007605b
mov rax, qword [rbp - 0x51]
mov esi, r8d
mov rdx, qword [rbp - 0x59]
mov r12d, 1
mov r13d, r14d
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov r14, rax
jmp 0x1400760d8
mov r12, qword [rbp - 0x59]
mov r13d, dword [rsp + 0x34]
mov rax, qword [rbp - 0x51]
test rax, rax
je 0x14007608b
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edx, r14d
mov rcx, r12
call fcn.140073650
mov edx, r14d
mov rcx, rdi
call fcn.140073650
mov r12d, dword [rbp - 0x61]
mov r14, qword [rsp + 0x38]
xor r8d, r8d
jmp 0x1400760d2
mov edx, r14d
xor ecx, ecx
mov esi, 1
call fcn.140073650
mov edx, r14d
xor ecx, ecx
call fcn.140073650
jmp 0x1400760a5
mov esi, 1
mov r12d, r8d
mov rcx, r14
mov rdx, r14
mov dword [rsp + 0x34], r13d
mov eax, r12d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdx
test esi, esi
js 0x1400763fe
test eax, eax
je 0x1400761c4
mov rdi, r14
test r13d, r13d
je 0x1400761ba
mov rax, qword [rsp + 0x38]
mov r14, rcx
mov qword [rsp + 0x38], rax
mov ebx, 0x8007000e
mov r15d, r13d
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x34], r13d
cmp qword [r14], r8
jne 0x1400761a3
mov rcx, qword gs:[0x60]
mov edx, 8
mov esi, ebx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx - 6]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r8d, r8d
mov r11, rax
test rax, rax
je 0x140076179
xor r9d, r9d
lea r8, [0x14009b48c]
mov rcx, rax
lea edx, [r9 + 1]
call fcn.14000107c
mov esi, eax
xor r8d, r8d
test esi, esi
js 0x1400761a3
test r11, r11
je 0x1400761a3
mov rcx, qword gs:[0x60]
mov r8, r11
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r8d, r8d
add r14, 8
sub r15, 1
jne 0x14007612a
mov rbx, qword [rbp - 0x69]
mov r14, qword [rsp + 0x38]
test esi, esi
js 0x1400763fe
jmp 0x1400761db
mov rdi, r15
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x34], r13d
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.1400734f0
xor r15d, r15d
mov esi, eax
test eax, eax
js 0x140076346
mov rdi, qword [rbp - 0x39]
lea rax, [rbp - 0x71]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov rdx, qword [rdi + 0x40]
call fcn.14007e058
test eax, eax
js 0x14007631c
mov rax, qword [rbp - 0x71]
mov r9, rbx
mov rcx, qword [rdi + 0x40]
mov qword [rsp + 0x20], rax
call fcn.14007e704
test eax, eax
js 0x14007631c
mov byte [rsp + 0x30], r15b
test r12d, r12d
je 0x140076317
test r13d, r13d
je 0x14007633d
mov r15, qword [rsp + 0x50]
mov rbx, rdi
mov r12, qword [rsp + 0x48]
sub r12, r15
xor eax, eax
mov rdi, qword [r15]
mov r14d, eax
mov rsi, qword [r12 + r15]
test rdi, rdi
jne 0x1400762be
mov rcx, qword gs:[0x60]
lea edx, [rdi + 8]
lea r8d, [rdi + 2]
mov r14d, 0x8007000e
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400762b7
xor r9d, r9d
lea r8, [0x14009b48c]
mov rcx, rax
lea edx, [r9 + 1]
call fcn.14000107c
mov r14d, eax
not r14d
shr r14d, 0x1f
mov rdx, qword [rbp - 0x71]
mov r9, rdi
mov r8, rsi
mov rcx, rbx
call fcn.140075274
mov esi, eax
xor eax, eax
test r14d, r14d
je 0x1400762fe
test rdi, rdi
je 0x1400762fe
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor eax, eax
add r15, 8
sub r13, 1
jne 0x140076261
mov rbx, qword [rbp - 0x69]
mov r14, qword [rsp + 0x38]
jmp 0x14007633d
mov esi, r15d
jmp 0x14007633d
mov ecx, eax
mov byte [rsp + 0x30], 1
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rcx, [rbp - 0x19]
call fcn.140073614
test r14, r14
je 0x140076369
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
call fcn.140073650
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
call fcn.140073650
xor r8d, r8d
test esi, esi
js 0x1400763fe
cmp qword [rbp - 0x79], r8
je 0x1400763b7
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x79]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x21]
call fcn.1400732c8
xor r8d, r8d
mov esi, eax
cmp eax, 1
je 0x1400763fe
test eax, eax
js 0x1400763fe
mov r15, qword [rbp - 0x79]
mov rbx, qword [rbp - 0x71]
mov al, byte [rsp + 0x30]
mov qword [rsp + 0x58], r15
mov qword [rbp - 0x69], rbx
jmp 0x140076409
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], 0x57
mov esi, 0x80070057
mov r15, qword [rsp + 0x58]
mov al, 1
mov byte [rsp + 0x30], al
mov rdi, 0xffffffffffffffff
test al, al
je 0x140075b36
test esi, esi
js 0x140076446
mov rcx, qword [rbp - 0x29]
mov esi, r8d
mov rax, qword [rbp - 0x71]
mov qword [rcx], rax
jmp 0x140076446
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140096bd0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret