Function at 0x180075000
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, rdx
mov r13, qword gs:[0x30]
mov qword [rsp + 0xb8], r13
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea esi, [rbx + 1]
mov r15d, 0x2000
xor eax, eax
lock cmpxchg dword [0x18015c3b8], esi
cmp eax, esi
je 0x1800750be
mov r14, qword [r13 + 0x60]
test eax, eax
je 0x1800bf9b6
mov edi, ebx
mov dword [rsp + 0xb0], ebx
cmp byte [r14], bl
jne 0x1800bfbf8
test byte [r13 + 0x17ee], 0x40
jne 0x180075097
cmp byte [0x18015beb9], bl
jne 0x1800bfd21
mov r15, qword [rsp + 0xa0]
cmp dword [0x18015c290], ebx
jne 0x1800750fd
mov rcx, r15
call fcn.180038ed4
mov r15d, 0x2000
test edi, edi
js 0x1800bfd5d
test word [r13 + 0x17ee], r15w
jne 0x1800750ae
call sym.ntdll.dll_NtTestAlert
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test word [r13 + 0x17ee], r15w
jne 0x180075045
mov qword [rsp + 0x40], 0xfffffffffffb6c20
cmp dword [0x18015c3b8], esi
jne 0x180075037
lea rdx, [rsp + 0x40]
xor ecx, ecx
call sym.ntdll.dll_NtDelayExecution
mov dword [rsp + 0xb0], eax
test eax, eax
jns 0x1800750d5
jmp 0x1800bfc5e
mov rcx, r15
mov rax, qword [0x18016f220]
call rax
jmp 0x180075089
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800bfb72
mov ecx, 0x7ffe0384
cmp byte [rcx], bl
jne 0x1800bfb8e
lock add dword [0x18015c3b8], esi
mov edi, dword [rsp + 0xb0]
jmp 0x180075091
or word [r13 + 0x17ee], 0x20
lea rax, [0x1801565b0]
mov qword [r14 + 0x110], rax
mov dword [0x18015cfb8], ebx
lea r15, [r14 + 0x50]
mov qword [rsp + 0x38], r15
lock bts dword [r15], 1
lea rax, [0x18016f2a8]
mov qword [0x18016f2b0], rax
mov qword [0x18016f2a8], rax
mov qword [0x18015b2b0], rbx
mov qword [0x18016f2a0], rbx
call fcn.1800d0ad8
mov edi, eax
test eax, eax
jns 0x1800bfa59
mov eax, dword [0x180156a70]
test al, 3
je 0x1800bfa4b
mov dword [rsp + 0x28], edi
lea rax, str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx_n
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str._LdrpInitialize
mov edx, 0x601
lea rcx, [0x180118390]
call fcn.1800ca394
mov eax, dword [0x180156a70]
test al, 0x10
je 0x180075091
int3
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x48], rax
cmp dword [rax + 8], ebx
jge 0x1800bfa75
mov byte [0x18015c298], sil
mov byte [0x18015c280], sil
mov rdx, r12
mov rcx, qword [rsp + 0xa0]
call fcn.1800cdd30
mov edi, eax
mov dword [rsp + 0xb0], eax
test eax, eax
jns 0x1800bfadd
mov eax, dword [0x180156a70]
test al, 3
je 0x1800bfacd
mov dword [rsp + 0x28], edi
lea rax, str.Process_initialization_failed_with_status_0x_08lx_n
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str._LdrpInitialize
mov edx, 0x619
lea rcx, [0x180118390]
call fcn.1800ca394
mov eax, dword [0x180156a70]
test al, 0x10
je 0x1800bfad2
int3
mov r15d, 0x2000
jmp 0x180075097
mov r8d, 0x14ae
mov rcx, qword [0x18015bf88]
lea rdx, [rcx + 0x48]
mov rcx, qword [rcx + 0x30]
call fcn.18003bc9c
mov rcx, qword [r14 + 0x318]
test rcx, rcx
je 0x1800bfb0f
call fcn.180082050
mov dword [rsp + 0xb0], eax
jmp 0x1800bfb2a
mov dword [0x18015cfb8], 3
lock btr dword [r15], 1
mov rcx, qword [0x18015d110]
call fcn.18005712c
mov edi, dword [rsp + 0xb0]
test edi, edi
js 0x180075091
cmp dword [0x18015c290], ebx
je 0x18007510e
cmp dword [0x18015c3b8], esi
jne 0x180075091
jmp 0x18007510e
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
jmp 0x180075120
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x180075128
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800bfbc6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x1800bfbcb
mov ecx, 0x7ffe0385
test byte [rcx], 0x20
je 0x180075128
mov ecx, 0x1484
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9b, 0xff
mov r8b, r9b
or rdx, 0xffffffffffffffff
call fcn.1800cb8f0
nop
jmp 0x180075128
mov eax, 2
lock cmpxchg dword [0x18015c3b8], esi
jne 0x1800750cc
mov al, byte [r14]
test al, al
je 0x1800bfc3c
mov rax, qword gs:[0x60]
mov qword [0x18015d248], rbx
mov qword [0x18015d250], rbx
mov byte [rax], bl
cmp byte [rax + 2], bl
je 0x1800bfc35
call fcn.1800cc88c
mov dword [rsp + 0xb0], ebx
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800bfca9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
jmp 0x1800bfcae
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800bfc9a
mov dword [rsp + 0x28], eax
lea rax, str.Delaying_execution_failed_with_status_0x_08lx_n
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str._LdrpInitialize
mov edx, 0x5c8
lea rcx, [0x180118390]
call fcn.1800ca394
mov ecx, dword [0x180156a70]
test cl, 0x40
je 0x1800750d5
int3
mov ecx, 0x7ffe0384
cmp byte [rcx], bl
je 0x1800bfd0e
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x1800bfd0e
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800bfce6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x1800bfceb
mov ecx, 0x7ffe0385
test byte [rcx], 0x20
je 0x1800bfd0e
mov qword [rsp + 0x28], rbx
mov r9b, 0xff
mov qword [rsp + 0x20], rbx
mov r8b, r9b
or rdx, 0xffffffffffffffff
mov ecx, 0x1484
call fcn.1800cb8f0
lock add dword [0x18015c3b8], esi
mov edi, dword [rsp + 0xb0]
jmp 0x180075063
lea r14, [0x18015d248]
mov rcx, r14
call sym.ntdll.dll_RtlAcquireSRWLockShared
cmp byte [0x18015beb9], bl
je 0x1800bfd4f
mov r9d, esi
xor r8d, r8d
mov rdx, r14
lea rcx, [0x18015d250]
call sym.ntdll.dll_RtlSleepConditionVariableSRW
jmp 0x1800bfd30
mov rcx, r14
call sym.ntdll.dll_RtlReleaseSRWLockShared
nop
jmp 0x180075079
mov ecx, edi
call fcn.18008964c
mov edx, edi
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtTerminateProcess
cmp dword [rsp + 0x30], ebx
jne 0x1800750ae
mov ecx, edi
call sym.ntdll.dll_RtlRaiseStatus
nop
int3