Function at 0x170025e50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
and rsp, 0xfffffffffffffff0
mov rsi, rcx
test byte [0x17008d370], 8
je 0x170025e92
mov qword [rsp + 0x20], rsi
lea r8, str.RtlDestroyHeapOrig
lea r9, str.handle__p_n
mov ecx, 3
call fcn.1700261b0
mov rcx, rsi
call fcn.170026230
mov r15, rax
test rax, rax
jne 0x170025ed1
test rsi, rsi
je 0x170025ed1
test byte [rsi + 0x73], 0x40
je 0x170025ed1
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
cmp byte [rax + 2], 0
je 0x170025ed1
lea rcx, str.Attempt_to_destroy_an_invalid_heap_n
call sym.ntdll.dll_DbgPrint
call sym.ntdll.dll_DbgBreakPoint
test r15, r15
je 0x170026191
mov r12, qword [r15 + 0xc8]
test r12, r12
je 0x170026012
mov qword [rsp + 0x40], rsi
mov qword [r15 + 0xc8], 0
mov r8, qword [r12]
test r8, r8
je 0x170025fbb
lea r13, [r15 + 0x90]
xor r14d, r14d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rax, qword [r13]
cmp r13, rax
je 0x170025fa0
lea r9, [r8 + 8]
jmp 0x170025f38
mov rax, qword [rax]
cmp r13, rax
je 0x170025fa0
mov rcx, qword [rax - 8]
test rcx, rcx
js 0x170025fa0
mov rbx, qword [rax - 0x10]
lea rdx, [rax + rbx]
add rdx, 0x18
lea rdi, [rax + rcx]
add rdi, 0x20
cmp rdi, rdx
ja 0x170025fa0
lea rdx, [rax - 0x20]
lea rdi, [rax + 0x18]
cmp rdi, r8
ja 0x170025f77
lea rsi, [rax + 0x20]
add rcx, rsi
add rcx, 0xfffffffffffffff8
cmp rcx, r9
jae 0x170025f8d
and rdx, 0xffffffffffff0000
cmp rdx, r8
ja 0x170025f30
add rbx, rdi
cmp rbx, r8
jb 0x170025f30
jmp 0x170025fa0
mov rcx, r15
call fcn.170026300
nop word cs:[rax + rax]
nop
mov r8, qword [r12 + r14*8 + 8]
test r8, r8
je 0x170025fbb
add r14, 1
cmp r14, 0x400
jne 0x170025f20
movzx eax, word [r12 - 4]
cmp eax, 0x464c
jne 0x170025ff4
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x170026008
cmp dword [rsi + 0xc0], 0x50414548
jne 0x170026008
mov rcx, qword [rsi + 0x340]
test rcx, rcx
je 0x170026008
mov rdx, r12
call fcn.170028c40
jmp 0x170026012
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
xor edx, edx
mov r8, r12
call fcn.170026eb0
jmp 0x170026012
mov ecx, 0xc0000008
call sym.ntdll.dll_RtlSetLastWin32ErrorAndNtStatusFromNtStatus
mov rcx, qword [0x17008dcb0]
cmp r15, rcx
je 0x170026191
add rcx, 0xd0
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword [r15 + 0x80]
mov rcx, qword [r15 + 0x88]
mov qword [rax + 8], rcx
mov rax, qword [r15 + 0x80]
mov rcx, qword [r15 + 0x88]
mov qword [rcx], rax
mov ecx, 0xd0
add rcx, qword [0x17008dcb0]
call sym.ntdll.dll_RtlLeaveCriticalSection
lea rcx, [r15 + 0xd0]
mov rax, qword [r15 + 0xd0]
mov qword [rax + 0x28], 0
call sym.ntdll.dll_RtlDeleteCriticalSection
lea rsi, [r15 + 0xa0]
mov rax, qword [r15 + 0xa0]
cmp rsi, rax
je 0x1700260e7
lea r14, [rsp + 0x30]
lea rbx, [rsp + 0x38]
nop word [rax + rax]
lea rcx, [rax - 0x10]
mov rdi, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rdi + 8], rdx
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rcx
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, rbx
mov r9d, 0x8000
call sym.ntdll.dll_NtFreeVirtualMemory
mov rax, rdi
cmp rsi, rdi
jne 0x1700260a0
lea rsi, [r15 + 0x90]
mov rax, qword [r15 + 0x90]
cmp rsi, rax
je 0x170026165
mov rdi, r15
add rdi, 0x350
lea r14, [rsp + 0x30]
lea r12, [rsp + 0x38]
jmp 0x170026118
mov rax, rbx
cmp rsi, rbx
je 0x170026165
lea rcx, [rax - 0x20]
mov rbx, qword [rax]
cmp rdi, rcx
je 0x170026110
mov rdx, qword [rax + 8]
mov qword [rbx + 8], rdx
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x38], 0
and rcx, 0xffffffffffff0000
mov qword [rsp + 0x30], rcx
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, r12
mov r9d, 0x8000
call sym.ntdll.dll_NtFreeVirtualMemory
jmp 0x170026110
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], r15
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov r9d, 0x8000
call sym.ntdll.dll_NtFreeVirtualMemory
xor esi, esi
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret