Function at 0x7ff2f949cec
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
shr ecx, 0x18
mov eax, r9d
lea esi, [r15 + 1]
and ecx, 0xf
mov ebp, r8d
sub ecx, esi
mov r13, rdx
mov qword [r11 - 0x48], r15
mov edi, r15d
je 0x7ff2f94a056
sub ecx, esi
je 0x7ff2f949fb9
sub ecx, esi
je 0x7ff2f949f83
sub ecx, esi
je 0x7ff2f949e92
sub ecx, esi
je 0x7ff2f949e53
sub ecx, esi
je 0x7ff2f949e13
cmp ecx, esi
je 0x7ff2f949e02
mov rax, qword gs:[0x30]
mov r8, rbp
xor edx, edx
mov rcx, qword [rax + 0x60]
mov r12d, ebp
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r15
jne 0x7ff2f949def
mov edi, 0xc0000017
cmp rsi, r15
je 0x7ff2f949daa
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp qword [rsp + 0x20], r15
je 0x7ff2f949dcf
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8, rbp
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x7ff2f94a111
test bpl, 7
je 0x7ff2f949d5d
mov edi, 0xc0000024
jmp 0x7ff2f949dcf
lea eax, [rbp - 1]
cmp eax, esi
ja 0x7ff2f949e0c
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov r12d, esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r15
je 0x7ff2f949d84
cmp byte [r13], r15b
setne al
mov byte [rsi], al
jmp 0x7ff2f94a111
mov r12d, 8
cmp ebp, r12d
jne 0x7ff2f949e0c
mov rax, qword gs:[0x30]
mov r8, r12
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r15
je 0x7ff2f949d84
mov rax, qword [r13]
mov qword [rsi], rax
jmp 0x7ff2f94a111
test bpl, 0xf
jne 0x7ff2f949e0c
shr ebp, 4
mov r12d, r15d
mov ebx, r15d
cmp ebp, r15d
jbe 0x7ff2f949ef1
lea rcx, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ecx, ebx
lea rdx, [rsp + 0x28]
shl rcx, 4
add rcx, r13
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
cmp eax, r15d
mov edi, eax
jl 0x7ff2f949dcf
movzx ecx, word [rsp + 0x28]
lea r12d, [r12 + rcx + 2]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
add ebx, esi
cmp ebx, ebp
jb 0x7ff2f949eaa
mov rax, qword gs:[0x30]
add r12d, 2
xor edx, edx
mov rcx, qword [rax + 0x60]
mov r8d, r12d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r15
je 0x7ff2f949d84
mov r14, rax
test ebp, ebp
je 0x7ff2f949f6f
mov ecx, r15d
lea rdx, [rsp + 0x28]
shl rcx, 4
add rcx, r13
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov edi, eax
test eax, eax
js 0x7ff2f949f7b
movzx eax, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, r14
add eax, 2
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x28]
add r14, rbx
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
inc r15d
cmp r15d, ebp
jb 0x7ff2f949f24
xor r15d, r15d
mov word [r14], r15w
jmp 0x7ff2f94a108
xor r15d, r15d
jmp 0x7ff2f949d89
cmp ebp, 0x10
jne 0x7ff2f949e0c
lea rdx, [rsp + 0x28]
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
cmp eax, r15d
mov edi, eax
jl 0x7ff2f949dcf
movzx r12d, word [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
add r12d, 2
jmp 0x7ff2f94a108
test sil, bpl
jne 0x7ff2f949e0c
mov eax, ebp
mov rcx, rdx
or edx, 0xffffffff
shr eax, 1
mov bl, r15b
je 0x7ff2f949fe4
cmp word [rcx], r15w
je 0x7ff2f949fe1
add rcx, 2
add eax, edx
jne 0x7ff2f949fd1
jmp 0x7ff2f949fe4
mov bl, sil
mov r12d, ebp
cmp bl, r15b
jne 0x7ff2f94a009
lea eax, [rbp + 2]
cmp eax, ebp
jb 0x7ff2f949ff8
mov r12d, eax
jmp 0x7ff2f94a000
mov r12d, edx
mov edi, 0xc0000095
cmp edi, r15d
jl 0x7ff2f949dcf
mov rax, qword gs:[0x30]
mov r8d, r12d
xor edx, edx
mov rcx, qword [rax + 0x60]
mov r14d, r12d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r15
je 0x7ff2f949d84
mov r8, rbp
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
cmp bl, r15b
jne 0x7ff2f94a108
mov word [r14 + rsi - 2], r15w
jmp 0x7ff2f94a108
cmp dword [rdx], 6
mov rcx, r13
mov edx, ebp
jne 0x7ff2f94a06c
lea r8, [rsp + 0x20]
call fcn.7ff2f94ae5c
jmp 0x7ff2f94a079
lea r9, [rsp + 0x20]
mov r8d, eax
call fcn.7ff2f94a864
cmp eax, r15d
mov edi, eax
jl 0x7ff2f949daa
mov rbx, qword [rsp + 0x20]
mov eax, dword [rbx + 8]
add eax, 0x10
mov r12d, eax
cmp eax, 0x10
jae 0x7ff2f94a0a1
mov edi, 0xc000000d
jmp 0x7ff2f949daa
mov rax, qword gs:[0x30]
mov r8, r12
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r15
je 0x7ff2f949d84
movdqu xmm0, xmmword [r13 + 4]
mov rdx, qword [rsp + 0x20]
lea rcx, [rax + 0x10]
movdqu xmmword [rax], xmm0
mov r8d, dword [rbx + 8]
call sub.msvcrt.dll_memcpy
mov r11, qword gs:[0x30]
mov r8, qword [rsp + 0x20]
mov rcx, qword [r11 + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rsp + 0x20], r15
cmp edi, r15d
jl 0x7ff2f949d89
mov rax, qword [rsp + 0x90]
mov edi, r15d
mov qword [rax], rsi
mov rax, qword [rsp + 0x98]
mov dword [rax], r12d
jmp 0x7ff2f949dcf