Function at 0x5c6f40
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Check os version

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x5c789d
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
mov qword [rsp + 0x128], rax
mov word [rsp + 0x4e], bx
mov rdx, qword [rax + 0x40]
lea rcx, [0x0067a330]
lea rax, [0x005ea920]
mov rbx, rdx
call fcn.0040ea00
mov rax, qword [rax]
movzx ebx, word [rsp + 0x4e]
call fcn.00533740
nop dword [rax]
test rax, rax
je 0x5c7074
movups xmmword [rsp + 0xe8], xmm15
mov rax, qword [rax]
lea rbx, [rsp + 0xe8]
nop dword [rax]
call fcn.00406620
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
test rbx, rbx
je 0x5c7039
cmp dword [rbx + 0x10], 0x81044065
jne 0x5c7005
lea rsi, [0x005deec0]
cmp rbx, rsi
jne 0x5c7005
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov r10, qword [rcx]
xor eax, eax
xor r11d, r11d
nop
jmp 0x5c70b1
lea rax, [0x005eeca0]
call fcn.0040b480
test rax, rax
je 0x5c7039
mov rsi, qword [0x007a0640]
mov r11, qword [0x007a0648]
xor r8d, r8d
xor r10d, r10d
xor r9d, r9d
mov rax, rsi
lea rsi, [0x005deec0]
jmp 0x5c70b1
nop
lea rax, [0x005f2680]
call fcn.0040da20
mov qword [rax + 8], 0xf
lea rcx, [0x00622001]
mov qword [rax], rcx
lea rsi, [0x005deec0]
xor r8d, r8d
xor r10d, r10d
xor r9d, r9d
mov r11, rax
lea rax, [0x0067cbc0]
jmp 0x5c70b1
nop
lea rax, [0x005f2680]
nop dword [rax]
call fcn.0040da20
mov qword [rax + 8], 0xe
lea rcx, [0x00621b34]
mov qword [rax], rcx
lea rsi, [0x005deec0]
xor r8d, r8d
xor r10d, r10d
xor r9d, r9d
mov r11, rax
lea rax, [0x0067cbc0]
test rax, rax
jne 0x5c77e9
nop word [rax + rax]
test r8, r8
jbe 0x5c7892
cmp byte [r10], 5
jne 0x5c77c7
cmp r8, 1
jbe 0x5c7885
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0xc0], r10
mov qword [rsp + 0xb0], r11
mov qword [rsp + 0x58], rax
movzx r12d, byte [r10 + 1]
cmp r12b, 3
ja 0x5c7110
test r12b, r12b
jne 0x5c71a2
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
lea rdx, [0x005e12a0]
mov qword [rsp + 0xf8], rdx
lea rsi, [0x0067bed0]
mov qword [rsp + 0x100], rsi
movzx esi, byte [r10 + 1]
lea rdi, [0x005e1460]
mov qword [rsp + 0x108], rdi
lea r8, [0x00797860]
lea rsi, [r8 + rsi*8]
mov qword [rsp + 0x110], rsi
lea rax, [rsp + 0xf8]
mov ebx, 2
mov rcx, rbx
call fcn.004d88e0
mov rax, qword [rsp + 0x58]
lea rsi, [0x005deec0]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0xc0]
mov r11, qword [rsp + 0xb0]
cmp byte [0x008031e5], 0
je 0x5c726d
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
lea rdx, [0x005e12a0]
mov qword [rsp + 0xf8], rdx
lea rdi, [0x0067bee0]
mov qword [rsp + 0x100], rdi
mov rdi, qword [0x007a0e90]
mov rcx, qword [0x007a0e98]
movzx r12d, byte [r10 + 1]
dec r12d
movzx r12d, r12b
nop dword [rax]
cmp rcx, r12
jbe 0x5c7879
shl r12, 4
mov rax, qword [rdi + r12]
mov rbx, qword [rdi + r12 + 8]
call fcn.0040b080
lea rcx, [0x005e12a0]
mov qword [rsp + 0x108], rcx
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0xf8]
mov ebx, 2
mov rcx, rbx
call fcn.004d88e0
mov rax, qword [rsp + 0x58]
lea rsi, [0x005deec0]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0xc0]
mov r11, qword [rsp + 0xb0]
cmp byte [r10 + 1], 1
jne 0x5c77a5
nop dword [rax + rax]
cmp r8, 3
jbe 0x5c786c
movzx r12d, byte [r10 + 3]
cmp r12b, 1
jne 0x5c72a0
mov r12d, 0xa
jmp 0x5c72d0
cmp r12b, 3
jne 0x5c72c0
cmp r8, 4
jbe 0x5c785f
movzx r12d, byte [r10 + 4]
add r12, 7
jmp 0x5c72d0
cmp r12b, 4
jne 0x5c7783
mov r12d, 0x16
mov qword [rsp + 0x80], r12
nop dword [rax + rax]
cmp r12, r8
je 0x5c74c6
jle 0x5c7761
mov rdx, qword [rsp + 0x128]
mov rbx, qword [rdx + 0x40]
lea rax, [0x005ea920]
lea rcx, [0x0067a330]
call fcn.0040ea00
mov rax, qword [rax]
movzx ebx, word [rsp + 0x4e]
call fcn.00533740
nop dword [rax + rax]
test rax, rax
je 0x5c73db
movups xmmword [rsp + 0xe8], xmm15
mov rax, qword [rax]
lea rbx, [rsp + 0xe8]
nop dword [rax]
call fcn.00406620
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
test rbx, rbx
je 0x5c73ae
cmp dword [rbx + 0x10], 0x81044065
jne 0x5c7385
lea rdx, [0x005deec0]
cmp rbx, rdx
jne 0x5c7385
mov rdx, qword [rcx + 8]
mov r8, qword [rcx]
xor r9d, r9d
xor eax, eax
nop dword [rax + rax]
jmp 0x5c7406
lea rax, [0x005eeca0]
call fcn.0040b480
test rax, rax
je 0x5c73ae
mov r9, qword [0x007a0640]
mov r10, qword [0x007a0648]
xor edx, edx
mov rax, r10
xor r8d, r8d
jmp 0x5c7406
nop
lea rax, [0x005f2680]
call fcn.0040da20
mov qword [rax + 8], 0xf
lea rcx, [0x00622001]
mov qword [rax], rcx
lea r9, [0x0067cbc0]
xor edx, edx
xor r8d, r8d
jmp 0x5c7406
nop
lea rax, [0x005f2680]
call fcn.0040da20
mov qword [rax + 8], 0xe
lea rcx, [0x00621b34]
mov qword [rax], rcx
lea r9, [0x0067cbc0]
xor edx, edx
xor r8d, r8d
test r9, r9
jne 0x5c7747
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x50], r9
mov r10, qword [rsp + 0x68]
lea rbx, [r10 + rdx]
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
jb 0x5c7439
mov rsi, qword [rsp + 0xc0]
jmp 0x5c7472
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0xc8], r8
mov rax, qword [rsp + 0xc0]
mov rdi, rdx
lea rsi, [0x005e1460]
call fcn.0044a920
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0xc8]
mov r10, qword [rsp + 0x68]
mov rsi, rax
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xd8], rsi
lea rax, [rsi + r10]
mov rbx, r8
mov rcx, rdx
call fcn.00466440
mov r12, qword [rsp + 0x80]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x90]
mov rax, qword [rsp + 0x50]
mov r11, qword [rsp + 0xa8]
cmp r8, 3
jbe 0x5c7852
mov qword [rsp + 0xe0], r11
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x98], r9
mov qword [rsp + 0xd8], r10
movzx esi, byte [r10 + 3]
cmp sil, 1
jne 0x5c754c
nop dword [rax + rax]
cmp r9, 8
jb 0x5c7845
lea rcx, [r9 - 4]
lea rax, [r10 + 4]
mov ebx, 4
call fcn.00517080
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xd8]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0x80]
mov rcx, rax
mov rax, qword [rsp + 0xa0]
jmp 0x5c7620
cmp sil, 3
jne 0x5c75c5
cmp r8, 4
jbe 0x5c7838
movzx esi, byte [r10 + 4]
add esi, 5
movzx ecx, sil
cmp r9, rcx
jb 0x5c7830
cmp rcx, 5
jb 0x5c7826
lea rdx, [r9 - 5]
neg rdx
sar rdx, 0x3f
and edx, 5
lea rbx, [rdx + r10]
add rcx, 0xfffffffffffffffb
xor eax, eax
call fcn.0044eb00
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xd8]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0x80]
mov rcx, rax
mov rax, qword [rsp + 0xa0]
jmp 0x5c7620
cmp sil, 4
jne 0x5c7614
cmp r9, 0x14
jb 0x5c7819
lea rcx, [r9 - 4]
lea rax, [r10 + 4]
mov ebx, 0x10
call fcn.00517080
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xd8]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0x80]
mov rcx, rax
mov rax, qword [rsp + 0xa0]
jmp 0x5c7620
xor ebx, ebx
xor ecx, ecx
nop dword [rax + rax]
cmp r9, r12
jb 0x5c780e
lea rdx, [r12 - 2]
cmp r12, rdx
jb 0x5c7803
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0x88], rbx
sub r9, r12
lea rcx, [r9 + 2]
neg rcx
sar rcx, 0x3f
and rdx, rcx
movzx ecx, word [r10 + rdx]
rol cx, 8
movzx eax, cx
mov ebx, 0xa
call fcn.00476720
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [rsp + 0xd0]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00803400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5c76f7
xor eax, eax
lea rbx, [0x0061f606]
mov ecx, 1
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0x88]
lea r8, [0x0061f68e]
mov r9d, 2
mov r10, qword [rsp + 0xb8]
mov r11, qword [rsp + 0x60]
call fcn.0044e8e0
jmp 0x5c7727
xor eax, eax
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x88]
lea rdi, [0x0067a4c0]
mov esi, 1
mov r8, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x60]
call fcn.0044e800
mov rcx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
xor ebx, ebx
mov rcx, r9
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rcx, qword [0x007a02a0]
mov rdi, qword [0x007a02a8]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rcx, qword [0x007a0270]
mov rdi, qword [0x007a0278]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rcx, qword [0x007a0290]
mov rdi, qword [0x007a0298]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rcx, qword [0x007a02b0]
mov rdi, qword [0x007a02b8]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
xor ebx, ebx
mov rcx, rax
mov rdi, r11
xor eax, eax
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rax, rdx
mov rcx, r12
call fcn.00465b60
mov rcx, r12
mov rdx, r9
call fcn.00465b20
mov ecx, 0x14
mov rdx, r9
call fcn.00465b20
mov eax, 5
call fcn.00465b60
mov rdx, r9
call fcn.00465b20
mov eax, 4
mov rcx, rax
call fcn.00465aa0
mov ecx, 8
mov rdx, r9
call fcn.00465b20
mov eax, 3
mov rcx, r8
call fcn.00465aa0
mov eax, 4
mov rcx, rax
call fcn.00465aa0
mov eax, 3
mov rcx, r8
call fcn.00465aa0
mov rax, r12
nop dword [rax]
call fcn.00465aa0
mov eax, 1
mov rcx, rax
call fcn.00465aa0
xor eax, eax
mov rcx, rax
call fcn.00465aa0
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
jmp fcn.005c6f40