Function at 0x1800677b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov r13, qword gs:[0x60]
lea r9, [0x18016f3b8]
mov eax, r8d
lea rbx, [r9 + 8]
xor sil, sil
mov qword [rsp + 0x38], r13
add r8d, 2
mov byte [rsp + 0xb0], sil
mov dword [rsp + 0x30], r8d
lea r12, [rax + rax*2]
mov eax, dword [r13 + 0x50]
bt eax, r8d
lea rbx, [rbx + r12*8]
jae 0x180067961
mov qword [r11 - 0x58], rcx
xor edi, edi
mov rcx, qword [r9 + r12*8]
mov qword [r11 - 0x50], rdx
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov r14, qword [rbx]
lea rbp, [0x18015bf98]
cmp r14, rbx
je 0x180067948
xor esi, esi
mov r15, r14
cmp qword [0x18016f380], rsi
jne 0x180067975
lea rbp, [r14 + 0x10]
inc dword [rbp]
cmp qword [0x18016f380], rsi
jne 0x1800679c6
lea rcx, [0x18016f3b8]
mov rcx, qword [rcx + r12*8]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov rbx, qword [r14 + 0x18]
lea r8, [rsp + 0xb8]
mov r9d, 4
mov qword [rsp + 0x20], rsi
or rcx, 0xffffffffffffffff
lea edx, [r9 + 0x20]
call sym.ntdll.dll_NtQueryInformationProcess
test eax, eax
js 0x1800bbb10
mov ecx, dword [rsp + 0xb8]
mov eax, 0x40
and ecx, 0x3f
sub eax, ecx
mov cl, al
mov eax, dword [rsp + 0xb8]
ror rbx, cl
xor rbx, rax
test dword [r13 + 0xbc], 0x800000
jne 0x1800bba42
lea rcx, [rsp + 0x40]
mov rax, rbx
call qword [section..00cfg]
mov r13d, eax
test rsi, rsi
jne 0x1800bba65
lea rbx, [0x18016f3b8]
mov rcx, qword [rbx + r12*8]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
cmp qword [0x18016f380], 0
mov r14, qword [r14]
jne 0x180067a1c
add dword [rbp], 0xffffffff
je 0x1800bba79
cmp qword [0x18016f380], 0
lea rbp, [0x18015bf98]
jne 0x180067a7b
cmp r13d, 0xffffffff
je 0x1800bbb08
lea rax, [r12 + 1]
lea rax, [rbx + rax*8]
cmp r14, rax
jne 0x1800bbac1
mov sil, byte [rsp + 0xb0]
lea rcx, [0x18016f3b8]
mov rcx, qword [rcx + r12*8]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
test rdi, rdi
jne 0x1800bbb18
mov al, sil
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test byte [0x18016f36c], 1
jne 0x180067849
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov ebx, dword [rax]
test ebx, ebx
jne 0x1800679a5
mov rcx, qword [0x18016f270]
xor edx, edx
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
cmp ebx, 0xffffffff
je 0x1800bbacb
mov rax, qword [0x18016f280]
inc ebx
mov dword [rax], ebx
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
jmp 0x180067849
test byte [0x18016f36c], 1
jne 0x18006785d
lea rbx, [0x18015bf98]
mov rcx, rbx
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov ecx, dword [rax]
test ecx, ecx
je 0x1800bbad7
mov rax, qword [0x18016f280]
add ecx, 0xffffffff
mov dword [rax], ecx
jne 0x180067a0f
mov rcx, qword [0x18016f270]
mov dl, 1
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbx
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
jmp 0x18006785d
test byte [0x18016f36c], 1
jne 0x180067905
lea rsi, [0x18015bf98]
mov rcx, rsi
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov ebx, dword [rax]
test ebx, ebx
jne 0x180067a53
mov rcx, qword [0x18016f270]
xor edx, edx
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rsi
cmp ebx, 0xffffffff
je 0x1800bbae6
mov rax, qword [0x18016f280]
inc ebx
mov dword [rax], ebx
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
lea rbx, [0x18016f3b8]
jmp 0x180067905
test byte [0x18016f36c], 1
jne 0x180067924
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov ecx, dword [rax]
test ecx, ecx
je 0x1800bbaf9
mov rax, qword [0x18016f280]
add ecx, 0xffffffff
mov dword [rax], ecx
jne 0x180067abd
mov rcx, qword [0x18016f270]
mov dl, 1
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
jmp 0x180067924
mov rdx, qword [rsp + 0xa8]
mov r9, rbx
mov rcx, qword [rsp + 0xa0]
xor r8d, r8d
call fcn.1800f640c
mov rsi, rax
jmp 0x1800678ca
xor eax, eax
cmp r13d, 0xffffffff
setne al
mov dword [rsi + 0x574], eax
jmp 0x1800678e4
xor ecx, ecx
call fcn.1800259b4
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
cmp qword [rcx + 8], r15
jne 0x1800bbaf2
cmp qword [rax], r15
jne 0x1800bbaf2
mov qword [rax], rcx
mov qword [rcx + 8], rax
cmp rax, rcx
jne 0x1800bbaac
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
lock btr dword [rax + 0x50], ecx
mov ecx, 1
call fcn.1800259b4
mov qword [r15], rdi
mov rdi, r15
jmp 0x18006790f
mov r13, qword [rsp + 0x38]
jmp 0x180067837
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov rcx, rbx
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov ecx, 3
int 0x29
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov sil, 1
jmp 0x180067948
mov ecx, eax
call sym.ntdll.dll_RtlRaiseStatus
int3
cmp qword [0x18016f380], 0
je 0x1800bbb72
test byte [0x18016f36c], 1
jne 0x1800bbb72
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov ebx, dword [rax]
test ebx, ebx
jne 0x1800bbb4e
mov rcx, qword [0x18016f270]
xor edx, edx
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
cmp ebx, 0xffffffff
jne 0x1800bbb62
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov ecx, 0xe
int 0x29
mov rax, qword [0x18016f280]
inc ebx
mov dword [rax], ebx
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov rbx, rdi
mov rdi, qword [rdi]
call sym.ntdll.dll_LdrControlFlowGuardEnforced
xor edx, edx
mov r8, rbx
test eax, eax
jne 0x1800bbb95
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
jmp 0x1800bbb9c
mov rcx, qword [0x18016f270]
call sym.ntdll.dll_RtlFreeHeap
test rdi, rdi
jne 0x1800bbb72
cmp qword [0x18016f380], rdi
je 0x180067961
test byte [0x18016f36c], 1
jne 0x180067961
mov rcx, rbp
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [0x18016f280]
mov edx, dword [rax]
test edx, edx
jne 0x1800bbbe2
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
lea ecx, [rdi + 0xe]
int 0x29
mov rcx, qword [0x18016f280]
add edx, 0xffffffff
mov dword [rcx], edx
jne 0x1800bbbfe
mov rcx, qword [0x18016f270]
mov dl, 1
call sym.ntdll.dll_RtlProtectHeap
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
nop
jmp 0x180067961