Function at 0x6c64b720
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rax, qword [0x6c655fd8]
xor r13d, r13d
mov edi, 0x1b
lea rbp, str.h_el
mov r12, rcx
mov ecx, 0xa
mov qword [rsp + 0x30], rax
mov r14, rdx
mov word [rsp + 0x26], cx
mov dword [rsp + 0x3c], 0x258
jmp 0x6c64b779
lea r13d, [rsi + 1]
cmp r13d, edi
jg 0x6c64b7aa
lea esi, [rdi + r13]
mov rcx, r14
sar esi, 1
movsxd rbx, esi
shl rbx, 4
add rbx, rbp
mov rdx, qword [rbx]
call qword [sym.imp.ucrtbase.dll_strcmp]
mov r15d, eax
test eax, eax
je 0x6c64b888
jg 0x6c64b770
lea edi, [rsi - 1]
cmp r13d, edi
jle 0x6c64b779
mov rcx, r14
call qword [sym.imp.ucrtbase.dll_strlen]
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
lea r8, [rax + rax + 2]
mov rcx, qword [rdx + 0x30]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x6c64b9bf
movsx ax, byte [r14]
mov rdx, rbx
test al, al
je 0x6c64b804
nop dword [rax]
add r14, 1
mov word [rdx], ax
add rdx, 2
movsx ax, byte [r14]
test al, al
jne 0x6c64b7f0
xor eax, eax
mov word [rdx], ax
cmp word [rbx], 0
je 0x6c64ba01
mov rax, rbx
nop word cs:[rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x6c64b820
sub rax, rbx
mov r8, rax
sar r8, 1
mov rdx, rbx
mov rcx, r12
call fcn.6c64b350
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, r12
mov edx, 0x447
call qword [sym.imp.user32.dll_SendMessageW]
lea rdx, [rsp + 0x26]
mov rcx, r12
mov r8d, 1
call fcn.6c64b350
mov r8, rbx
xor edx, edx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x6c64b9bf
mov edx, dword [rbx + 8]
xor r9d, r9d
lea r8, [rsp + 0x28]
lea rdi, [rsp + 0x30]
mov rcx, qword [0x6c663008]
lea r13, [rsp + 0xf0]
call qword [sym.imp.user32.dll_LoadStringW]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [sym.imp.user32.dll_SendMessageW]
movsxd r14, eax
mov rbp, r14
add r14, r14
lea rcx, [rdx + r14]
cmp rdx, rcx
jae 0x6c64b980
nop
mov rbx, rdx
jmp 0x6c64b8e1
cmp rbx, rcx
jae 0x6c64b980
movzx eax, word [rbx]
mov r8, rbx
add rbx, 2
cmp ax, 0xa
jne 0x6c64b8d8
sub r8, rdx
sar r8, 1
lea eax, [r8 + 1]
cmp eax, 1
jbe 0x6c64b9d3
mov eax, r8d
lea r9, [r13 + rax*2]
mov rax, r13
jmp 0x6c64b929
add rax, 2
add rdx, 2
mov word [rax - 2], cx
cmp r9, rax
je 0x6c64b931
movzx ecx, word [rdx]
test cx, cx
jne 0x6c64b918
xor edx, edx
mov word [rax], dx
mov rdx, r13
mov rcx, r12
mov r15d, 1
call fcn.6c64b350
mov r9, rdi
xor r8d, r8d
mov edx, 0x447
mov rcx, r12
call rsi
lea rdx, [rsp + 0x26]
mov rcx, r12
mov r8d, 1
call fcn.6c64b350
mov rdx, rbx
lea rcx, [rdx + r14]
cmp rdx, rcx
jb 0x6c64b8d0
nop word [rax + rax]
test r15d, r15d
jne 0x6c64b9e8
mov rdx, qword [rsp + 0x28]
mov r8d, ebp
mov rcx, r12
call fcn.6c64b350
xor r8d, r8d
mov edx, 0x447
mov rcx, r12
lea r9, [rsp + 0x30]
call qword [sym.imp.user32.dll_SendMessageW]
lea rdx, [rsp + 0x26]
mov r8d, 1
mov rcx, r12
call fcn.6c64b350
nop
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x6c64b936
mov rax, r13
jmp 0x6c64b931
cmp word [rdx], 0
je 0x6c64b9bf
mov rax, rdx
sub rax, qword [rsp + 0x28]
mov r8d, ebp
sar rax, 1
sub r8d, eax
jmp 0x6c64b98d
xor r8d, r8d
jmp 0x6c64b833