Function at 0x1800085d4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
lea rbp, [rsp + 0x20]
mov rax, qword [0x1801724e0]
xor rax, rbp
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x38], r9
mov dword [rbp + 8], r8d
mov r12d, edx
mov dword [rbp + 0xc], edx
mov rdx, rcx
mov qword [rbp + 0x18], rcx
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x30], rax
mov rsi, qword gs:[0x30]
mov qword [rbp + 0x20], rsi
cmp r12d, 0xffffffff
je 0x18000867a
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x1800a6060
mov edx, r8d
mov ecx, r12d
call sym.ntdll.dll_NtQueryDebugFilterState
test eax, eax
jne 0x180008676
xor eax, eax
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.18008b0e0
lea rsp, [rbp + 0x100]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rbp + 0x18]
movzx eax, word [rsi + 0x17ee]
mov r8d, 2
test r8b, al
jne 0x180008652
or ax, r8w
mov word [rsi + 0x17ee], ax
xor r15d, r15d
xor edi, edi
xor r13d, r13d
or r14, 0xffffffffffffffff
cmp r13d, 0x200
jae 0x180008784
mov eax, dword [rsp]
sub rsp, 0x80
lea r15, [rsp + 0x20]
mov eax, dword [r15]
sub r13d, 0xffffff80
mov rdi, r14
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1800086c9
lea ecx, [r13 - 1]
cmp rdi, rcx
cmova rdi, rcx
mov r8, rdi
mov rcx, r15
call sym.ntdll.dll_RtlCopyMemory
lea rcx, [rdi + r15]
mov qword [rbp + 0x10], rcx
mov edx, r13d
sub rdx, rdi
xor edi, edi
lea rax, [rdx - 1]
mov r8d, 0xc000000d
cmp rax, 0x7ffffffe
cmova edi, r8d
mov dword [rbp + 4], edi
test edi, edi
js 0x18000875a
xor edi, edi
mov dword [rbp], edi
lea r12, [rdx - 1]
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp + 0x38]
mov rdx, r12
call sym.ntdll.dll__vsnprintf
test eax, eax
js 0x180008748
cdqe
cmp rax, r12
ja 0x180008748
je 0x18000873e
mov dword [rbp + 4], edi
jmp 0x180008762
mov rax, qword [rbp + 0x10]
mov byte [r12 + rax], dil
jmp 0x180008739
mov rax, qword [rbp + 0x10]
mov byte [r12 + rax], dil
mov edi, 0x80000005
mov dword [rbp], edi
jmp 0x180008739
test rdx, rdx
je 0x180008762
mov byte [rcx], 0
mov dword [rbp + 0x28], edi
jmp 0x18000877c
test edi, edi
js 0x1800a606f
cmp edi, 0x80000005
je 0x1800a6084
inc r14
cmp byte [r15 + r14], 0
jne 0x180008790
mov qword [rbp + 0x48], r15
mov word [rbp + 0x40], r14w
mov rax, qword gs:[0x60]
cmp qword [rax + 0x38], 0
je 0x1800a609e
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x1800087d7
mov al, byte [0x7ffe02d4]
and al, 3
cmp al, 3
je 0x1800a609e
mov dword [rbp + 0x50], 0x40010006
and qword [rbp + 0x58], 0
mov dword [rbp + 0x68], 2
and dword [rbp + 0x54], 0
movzx eax, r14w
inc eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], r15
lea rcx, [rbp + 0x50]
call sym.ntdll.dll_RtlRaiseException
cmp r12d, 0x65
je 0x18000867a
jmp 0x180008643
cmp edi, 0x80000005
mov rdx, qword [rbp + 0x18]
je 0x1800086a3
jmp 0x180008784
lea eax, [r13 - 2]
mov byte [rax + r15], 0xa
lea eax, [r13 - 1]
mov r14d, eax
mov byte [rax + r15], 0
jmp 0x18000879a
mov r8d, dword [rbp + 8]
mov edx, dword [rbp + 0xc]
lea rcx, [rbp + 0x40]
call fcn.18009e3c0
mov ecx, eax
cmp byte [rbp + 0x168], 1
jne 0x1800a60cc
cmp eax, 0x80000003
jne 0x1800a60cc
mov ecx, 1
call 0x18009e3b0
xor ecx, ecx
mov eax, 0xfffd
and word [rsi + 0x17ee], ax
mov eax, ecx
jmp 0x180008654