Function at 0x140248b78
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, qword [rbp + 0x78]
mov rsi, rdx
mov rdi, qword [rbp + 0x80]
xor edx, edx
mov r12, rcx
mov dword [rbp + 0x48], edx
mov r13d, edx
mov qword [rbp - 0x18], rdx
mov ebx, edx
mov qword [rbp - 0x20], rdx
lea r14d, [rdx + 1]
mov dword [r15], edx
mov dword [rdi], edx
test byte [rsi], r14b
jne 0x140248bff
mov rcx, rsi
call fcn.14024a04c
xor edx, edx
test eax, eax
jne 0x140248bfb
lea r9, str.Failed_to_initialize_SEARCHDBCONTEXT
mov r8d, 0x694
lea rdx, str.SdbpCheckMatchingTextEntry
mov ecx, r14d
call fcn.1400139b4
xor edx, edx
jmp 0x140248ce0
mov r8, qword [rbp + 0x50]
mov r14, qword [rsi + 0x48]
mov edi, edx
cmp dword [r14], edx
jle 0x140248ccd
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
lea rax, [r14 + 8]
add rax, rcx
or r9, 0xffffffffffffffff
inc r9
cmp word [r8 + r9*2], dx
jne 0x140248c24
lea rcx, [rbp - 0x18]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.14024a434
test eax, eax
je 0x140248f32
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.140015914
mov rbx, qword [rbp - 0x20]
xor edx, edx
mov ecx, eax
test eax, eax
js 0x140248c74
mov rcx, rbx
call fcn.14001548c
mov ecx, eax
xor edx, edx
call fcn.1402b16fc
test eax, eax
je 0x140248d56
mov rcx, rbx
call fcn.140013884
xor edx, edx
mov ebx, edx
mov qword [rbp - 0x20], rdx
cmp qword [rbp - 0x18], rdx
je 0x140248cba
mov rcx, qword gs:[0x60]
mov r8, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x20]
xor edx, edx
mov r8, qword [rbp + 0x50]
inc edi
mov qword [rbp - 0x18], rdx
cmp edi, dword [r14]
jl 0x140248c0e
mov dword [r15], edx
mov r14d, 1
mov r13d, r14d
mov rdi, qword [rbp + 0x80]
mov rax, qword [rbp + 0x50]
movzx eax, word [rax]
sub ax, 0x25
cmp ax, 0x37
ja 0x140248d04
movabs rcx, 0x80000000000201
bt rcx, rax
jae 0x140248d04
mov dword [rdi], r14d
cmp qword [rbp - 0x18], rdx
je 0x140248d2d
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x140248d3a
mov rcx, rbx
call fcn.140013884
mov rbx, qword [rsp + 0x90]
mov eax, r13d
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test ecx, ecx
jns 0x140248d87
mov dword [rsp + 0x20], ecx
lea r9, str.Failed_to_map_file___x_
mov r14d, 1
lea rdx, str.SdbpCheckMatchingTextEntry
mov ecx, r14d
mov r8d, 0x6cc
call fcn.1400139b4
xor edx, edx
jmp 0x140248cd9
mov ecx, 1
test edi, edi
jle 0x140248d99
mov rax, qword [rbp + 0x80]
mov dword [rax], ecx
test rbx, rbx
je 0x140248ccd
mov esi, dword [rbp + 0x70]
mov edi, edx
cmp rsi, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
cmovae esi, dword [rbx + 0x18]
mov r14d, dword [rbp + 0x60]
mov qword [rbp - 8], rax
cmp r14d, esi
ja 0x140248ccd
mov r12d, dword [rbp + 0x68]
mov r15d, edx
cmp r12d, 3
sete r15b
add r15d, ecx
test esi, esi
je 0x140248edb
mov ecx, 0x1000
cmp edi, r14d
jbe 0x140248df0
mov eax, r15d
sub eax, r14d
add edi, eax
mov rax, qword gs:[0x60]
mov ebx, esi
sub ebx, edi
mov edx, 8
cmp ebx, ecx
cmova ebx, ecx
mov rcx, qword [rax + 0x30]
mov r8d, ebx
add r8, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140248f23
mov edx, edi
add rdx, qword [rbp - 8]
cmp rdx, qword [rbp - 8]
jb 0x140248f14
mov r8d, ebx
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
test r12d, r12d
je 0x140248ee9
cmp r12d, 2
jbe 0x140248e84
cmp r12d, 3
jne 0x140248ee9
mov r8, qword [rbp + 0x58]
mov edx, ebx
mov rcx, qword [rbp - 0x10]
mov r9d, r14d
shr r9d, 1
shr edx, 1
call fcn.1402b21d0
test rax, rax
je 0x140248ea7
mov dword [rbp + 0x48], 1
jmp 0x140248ea7
mov r8, qword [rbp + 0x58]
mov r9d, r14d
mov rcx, qword [rbp - 0x10]
mov edx, ebx
call fcn.1402b2138
mov ecx, dword [rbp + 0x48]
test rax, rax
mov eax, 1
cmovne ecx, eax
mov dword [rbp + 0x48], ecx
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x10]
add edi, ebx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0x1000
cmp edi, esi
jb 0x140248de3
mov rbx, qword [rbp - 0x20]
xor edx, edx
mov rax, qword [rbp + 0x78]
mov ecx, dword [rbp + 0x48]
mov dword [rax], ecx
jmp 0x140248cd0
lea r9, str.Unknown_file_encoding
mov r8d, 0x73c
mov r14d, 1
lea rdx, str.SdbpCheckMatchingTextEntry
mov ecx, r14d
call fcn.1400139b4
mov rbx, qword [rbp - 0x20]
jmp 0x140248d80
lea r9, str.Overflow_doing_pointer_addition
mov r8d, 0x71a
jmp 0x140248ef6
lea r9, str.Failed_to_allocate_temp_buffer
mov r8d, 0x713
jmp 0x140248ef6
mov r14d, 1
lea r9, str.Failed_to_resolve_matching_text_file
mov ecx, r14d
lea rdx, str.SdbpCheckMatchingTextEntry
mov r8d, 0x6ac
call fcn.1400139b4
jmp 0x140248d80