Function at 0x14005b284
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rax - 0x68], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r12, rcx
mov r13, rdx
mov qword [rsp + 0x48], rdx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r14d, r14d
mov dword [rsp + 0x38], r14d
xor r15d, r15d
mov dword [rsp + 0x3c], r15d
test rbx, rbx
je 0x14005b2ed
test r14d, r14d
je 0x14005b2ed
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call fcn.140060530
nop
and dword [rsp + 0xe8], 0
mov eax, dword [0x1400921a4]
mov dword gs:[0x68], eax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbx
mov r8d, 1
mov edx, r15d
mov rcx, qword [r12]
call fcn.14005fa20
nop
mov dword [rsi], eax
cmp eax, 0xc0000023
je 0x14005b33f
cmp eax, 0x80000005
jne 0x14005b3eb
mov ecx, dword [rsp + 0xe8]
test ecx, ecx
je 0x14005b4ee
add ecx, 2
mov dword [rsp + 0xe8], ecx
mov r8d, ecx
mov rax, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rax + 0x30]
test rbx, rbx
je 0x14005b383
mov r9d, r8d
mov r8, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop
jmp 0x14005b38a
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop
mov qword [rsp + 0x30], rax
mov rbx, rax
test rax, rax
jne 0x14005b3a2
mov dword [rsi], 0xc000009a
jmp 0x14005b4f8
mov r14d, dword [rsp + 0xe8]
mov dword [rsp + 0x38], r14d
mov eax, dword [0x1400921a4]
mov dword gs:[0x68], eax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbx
mov r8d, 1
mov edx, r15d
mov rcx, qword [r12]
call fcn.14005fa20
nop
mov dword [rsi], eax
mov eax, dword [r13]
test eax, eax
js 0x14005b4dc
cmp dword [rbx + 0x10], 0
jbe 0x14005b4dc
mov eax, dword [rbx + 8]
mov dword [rsp + 0x40], eax
lea r9, [rbx + rax]
mov qword [rsp + 0x68], r9
mov eax, dword [rbx + 4]
mov dword [rsp + 0x44], eax
lea rcx, [rbx + 0x14]
mov qword [rsp + 0x70], rcx
mov edx, dword [rbx + 0x10]
shr rdx, 1
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdx
cmp eax, 4
jne 0x14005b4ae
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x80], xmm0
call fcn.1400287ac
nop
xor eax, 0x66d29210
cmp eax, 0xe75f051
je 0x14005b49c
cmp eax, 0x1dce15b7
je 0x14005b48c
cmp eax, 0x23fbb7fc
je 0x14005b47c
cmp eax, 0xb269da5a
jne 0x14005b4ae
mov eax, dword [r9]
neg eax
sbb cl, cl
and cl, 4
mov al, byte [rdi]
and al, 0xfb
jmp 0x14005b4aa
mov eax, dword [r9]
neg eax
sbb cl, cl
and cl, 8
mov al, byte [rdi]
and al, 0xf7
jmp 0x14005b4aa
mov eax, dword [r9]
neg eax
sbb cl, cl
and cl, 0x10
mov al, byte [rdi]
and al, 0xef
jmp 0x14005b4aa
mov eax, dword [r9]
neg eax
sbb cl, cl
and cl, 2
mov al, byte [rdi]
and al, 0xfd
or cl, al
mov byte [rdi], cl
jmp 0x14005b4dc
inc r15d
mov dword [rsp + 0x3c], r15d
mov eax, dword [rsi]
test eax, eax
jns 0x14005b2d5
cmp eax, 0x8000001a
jne 0x14005b4f8
and dword [rsi], 0
test rbx, rbx
je 0x14005b51e
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
and qword [rsp + 0x30], 0
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret