Function at 0x1800d3a40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r14d, edx
lea r15, [0x18016f3b8]
mov rbp, rcx
lea rdi, [r15 + 8]
lea rsi, [r14 + r14*2]
mov rcx, qword [r15 + rsi*8]
lea rdi, [rdi + rsi*8]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1800c596a
cmp rbx, rbp
jne 0x1800c58de
or r13d, 0xffffffff
lea rbp, [0x18015bf98]
xor r15d, r15d
cmp qword [0x18016f380], r15
jne 0x180080f2c
add dword [rbx + 0x10], r13d
jne 0x1800c58f9
xor ecx, ecx
call fcn.1800259b4
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
cmp qword [rcx + 8], rbx
jne 0x1800c58f2
cmp qword [rax], rbx
jne 0x1800c58f2
mov qword [rax], rcx
mov qword [rcx + 8], rax
cmp rax, rcx
jne 0x180080eb0
mov rax, qword gs:[0x60]
lea ecx, [r14 + 2]
lock btr dword [rax + 0x50], ecx
mov rdi, rbx
lea rcx, [0x18016f3b8]
mov rcx, qword [rcx + rsi*8]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
test rdi, rdi
je 0x180080ef9
call sym.ntdll.dll_LdrControlFlowGuardEnforced
xor edx, edx
mov r8, rbx
test eax, eax
je 0x180080f1d
mov rcx, qword [0x18016f270]
call sym.ntdll.dll_RtlFreeHeap
mov ecx, 1
call fcn.1800259b4
cmp qword [0x18016f380], r15
jne 0x180080f7d
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
jmp 0x180080edd
test byte [0x18016f36c], 1
jne 0x180080e67
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov edi, dword [rax]
test edi, edi
jne 0x180080f5c
mov rcx, qword [0x18016f270]
xor edx, edx
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
cmp edi, r13d
je 0x1800c58e6
mov rax, qword [0x18016f280]
inc edi
mov dword [rax], edi
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
jmp 0x180080e67
test byte [0x18016f36c], 1
jne 0x180080ef9
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov edx, dword [rax]
test edx, edx
je 0x1800c595b
mov rcx, qword [0x18016f280]
add edx, r13d
mov dword [rcx], edx
jne 0x180080fbf
mov rcx, qword [0x18016f270]
mov dl, 1
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
jmp 0x180080ef9
mov rbx, qword [rbx]
jmp 0x180080e3a
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov ecx, 3
int 0x29
cmp qword [0x18016f380], r15
je 0x1800c5953
test byte [0x18016f36c], 1
jne 0x1800c5953
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov ecx, dword [rax]
test ecx, ecx
jne 0x1800c592f
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov rax, qword [0x18016f280]
add ecx, r13d
mov dword [rax], ecx
jne 0x1800c594b
mov rcx, qword [0x18016f270]
mov dl, 1
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov rdi, r15
jmp 0x180080eb3
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov rcx, qword [r15 + rsi*8]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
xor eax, eax
jmp 0x180080efe
mov edx, 1
jmp 0x180080df8