Function at 0x14023c158
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, qword [rbp + 0x78]
mov rsi, rdx
mov rdi, qword [rbp + 0x80]
xor edx, edx
mov r12, rcx
mov dword [rbp + 0x48], edx
mov r13d, edx
mov qword [rbp - 0x18], rdx
mov ebx, edx
mov qword [rbp - 0x20], rdx
lea r14d, [rdx + 1]
mov dword [r15], edx
mov dword [rdi], edx
test byte [rsi], r14b
jne 0x14023c1df
mov rcx, rsi
call fcn.14023d62c
xor edx, edx
test eax, eax
jne 0x14023c1db
lea r9, str.Failed_to_initialize_SEARCHDBCONTEXT
mov r8d, 0x694
lea rdx, str.SdbpCheckMatchingTextEntry
mov ecx, r14d
call fcn.140013f14
xor edx, edx
jmp 0x14023c2c0
mov r8, qword [rbp + 0x50]
mov r14, qword [rsi + 0x48]
mov edi, edx
cmp dword [r14], edx
jle 0x14023c2ad
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
lea rax, [r14 + 8]
add rax, rcx
or r9, 0xffffffffffffffff
inc r9
cmp word [r8 + r9*2], dx
jne 0x14023c204
lea rcx, [rbp - 0x18]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.14023da14
test eax, eax
je 0x14023c512
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.140015e74
mov rbx, qword [rbp - 0x20]
xor edx, edx
mov ecx, eax
test eax, eax
js 0x14023c254
mov rcx, rbx
call fcn.1400159ec
mov ecx, eax
xor edx, edx
call fcn.1402a4d6c
test eax, eax
je 0x14023c336
mov rcx, rbx
call fcn.140013de4
xor edx, edx
mov ebx, edx
mov qword [rbp - 0x20], rdx
cmp qword [rbp - 0x18], rdx
je 0x14023c29a
mov rcx, qword gs:[0x60]
mov r8, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x20]
xor edx, edx
mov r8, qword [rbp + 0x50]
inc edi
mov qword [rbp - 0x18], rdx
cmp edi, dword [r14]
jl 0x14023c1ee
mov dword [r15], edx
mov r14d, 1
mov r13d, r14d
mov rdi, qword [rbp + 0x80]
mov rax, qword [rbp + 0x50]
movzx eax, word [rax]
sub ax, 0x25
cmp ax, 0x37
ja 0x14023c2e4
movabs rcx, 0x80000000000201
bt rcx, rax
jae 0x14023c2e4
mov dword [rdi], r14d
cmp qword [rbp - 0x18], rdx
je 0x14023c30d
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x14023c31a
mov rcx, rbx
call fcn.140013de4
mov rbx, qword [rsp + 0x90]
mov eax, r13d
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test ecx, ecx
jns 0x14023c367
mov dword [rsp + 0x20], ecx
lea r9, str.Failed_to_map_file___x_
mov r14d, 1
lea rdx, str.SdbpCheckMatchingTextEntry
mov ecx, r14d
mov r8d, 0x6cc
call fcn.140013f14
xor edx, edx
jmp 0x14023c2b9
mov ecx, 1
test edi, edi
jle 0x14023c379
mov rax, qword [rbp + 0x80]
mov dword [rax], ecx
test rbx, rbx
je 0x14023c2ad
mov esi, dword [rbp + 0x70]
mov edi, edx
cmp rsi, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
cmovae esi, dword [rbx + 0x18]
mov r14d, dword [rbp + 0x60]
mov qword [rbp - 8], rax
cmp r14d, esi
ja 0x14023c2ad
mov r12d, dword [rbp + 0x68]
mov r15d, edx
cmp r12d, 3
sete r15b
add r15d, ecx
test esi, esi
je 0x14023c4bb
mov ecx, 0x1000
cmp edi, r14d
jbe 0x14023c3d0
mov eax, r15d
sub eax, r14d
add edi, eax
mov rax, qword gs:[0x60]
mov ebx, esi
sub ebx, edi
mov edx, 8
cmp ebx, ecx
cmova ebx, ecx
mov rcx, qword [rax + 0x30]
mov r8d, ebx
add r8, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14023c503
mov edx, edi
add rdx, qword [rbp - 8]
cmp rdx, qword [rbp - 8]
jb 0x14023c4f4
mov r8d, ebx
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
test r12d, r12d
je 0x14023c4c9
cmp r12d, 2
jbe 0x14023c464
cmp r12d, 3
jne 0x14023c4c9
mov r8, qword [rbp + 0x58]
mov edx, ebx
mov rcx, qword [rbp - 0x10]
mov r9d, r14d
shr r9d, 1
shr edx, 1
call fcn.1402a5840
test rax, rax
je 0x14023c487
mov dword [rbp + 0x48], 1
jmp 0x14023c487
mov r8, qword [rbp + 0x58]
mov r9d, r14d
mov rcx, qword [rbp - 0x10]
mov edx, ebx
call fcn.1402a57a8
mov ecx, dword [rbp + 0x48]
test rax, rax
mov eax, 1
cmovne ecx, eax
mov dword [rbp + 0x48], ecx
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x10]
add edi, ebx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0x1000
cmp edi, esi
jb 0x14023c3c3
mov rbx, qword [rbp - 0x20]
xor edx, edx
mov rax, qword [rbp + 0x78]
mov ecx, dword [rbp + 0x48]
mov dword [rax], ecx
jmp 0x14023c2b0
lea r9, str.Unknown_file_encoding
mov r8d, 0x73c
mov r14d, 1
lea rdx, str.SdbpCheckMatchingTextEntry
mov ecx, r14d
call fcn.140013f14
mov rbx, qword [rbp - 0x20]
jmp 0x14023c360
lea r9, str.Overflow_doing_pointer_addition
mov r8d, 0x71a
jmp 0x14023c4d6
lea r9, str.Failed_to_allocate_temp_buffer
mov r8d, 0x713
jmp 0x14023c4d6
mov r14d, 1
lea r9, str.Failed_to_resolve_matching_text_file
mov ecx, r14d
lea rdx, str.SdbpCheckMatchingTextEntry
mov r8d, 0x6ac
call fcn.140013f14
jmp 0x14023c360