Function at 0x14006a220
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push rbp
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
xor ebx, ebx
mov dword [rsp + 0x20], 0x3651464a
mov dword [rsp + 0x24], 0x75636b47
mov dword [rsp + 0x28], 0x64673975
mov dword [rsp + 0x2c], 0x7a466c5a
mov word [rsp + 0x30], 0x4a26
lea r13d, [rbx + 1]
mov byte [rsp + 0x32], bl
mov dword [rsp + 0x38], 0x65006b
mov dword [rsp + 0x3c], 0x6e0072
mov dword [rsp + 0x40], 0x6c0065
mov dword [rsp + 0x44], 0x320033
mov dword [rsp + 0x48], 0x64002e
mov dword [rsp + 0x4c], 0x6c006c
mov word [rsp + 0x50], bx
mov edx, 0x3d0918
mov eax, ebx
lea rcx, [rbp - 0x59]
mov byte [rcx], al
add eax, r13d
add rcx, r13
cmp eax, 0x70
jb 0x14006a2a2
sub rdx, r13
jne 0x14006a29c
cmp byte [rbp - 0x3c], 0x1d
jne 0x14006a376
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
mov r8, rdi
mov rcx, qword [r8 + 0x60]
mov r9d, ebx
mov rax, rcx
cmp word [rcx], bx
je 0x14006a2ed
lea rax, [rax + 2]
add r9d, r13d
cmp word [rax], bx
jne 0x14006a2e1
lea rax, [rsp + 0x38]
mov edx, ebx
lea rax, [rax + 2]
add edx, r13d
cmp word [rax], bx
jne 0x14006a2f4
cmp r9d, edx
jne 0x14006a35f
lea r11, [rsp + 0x38]
mov r10d, ebx
sub r11, rcx
movzx edx, word [rcx]
mov rax, rcx
mov r9d, ebx
test dx, dx
je 0x14006a370
lea rax, [rax + 2]
add r9d, r13d
cmp word [rax], bx
jne 0x14006a31e
cmp r10d, r9d
jae 0x14006a370
movzx r9d, word [r11 + rcx]
lea eax, [rdx - 0x41]
cmp ax, 0x19
ja 0x14006a341
add dx, 0x20
lea eax, [r9 - 0x41]
cmp ax, 0x19
ja 0x14006a350
add r9w, 0x20
cmp dx, r9w
jne 0x14006a35f
add r10d, r13d
add rcx, 2
jmp 0x14006a310
mov r8, qword [r8]
cmp r8, rdi
jne 0x14006a2d2
mov rdi, rbx
jmp 0x14006a37a
mov rdi, qword [r8 + 0x30]
jmp 0x14006a37a
mov rdi, qword [rbp + 0x6f]
mov edx, 0xe3142
mov rcx, rdi
call fcn.14006a790
mov edx, 0xd5786
mov rcx, rdi
mov rsi, rax
call fcn.14006a790
mov edx, 0x348bfa
mov rcx, rdi
mov qword [rbp - 0x71], rax
call fcn.14006a790
mov r15d, 0x3000
mov r14d, 0x5b000
mov r9d, 4
xor ecx, ecx
mov r8d, r15d
mov edx, r14d
mov edx, esi
mov qword [rbp - 0x69], rax
call rsi
movsx ecx, byte [rbp - 0x59]
mov r10d, ebx
mov r12, rax
mov qword [rbp - 0x79], rax
imul edi, ecx, 0x16
add edi, r14d
je 0x14006a43c
movsx rax, byte [rbp - 0x3c]
movsx rdx, byte [rbp - 0x59]
mov r9, r12
lea rcx, [rax + 1]
lea r11, [rax + 0x71]
imul rcx, rdx
imul r11, rdx
sub r9, rcx
lea rcx, resource.9
sub r11, r12
add r11, rcx
movsxd rcx, r10d
movabs rax, 0xd79435e50d79435f
add r10d, r13d
mul rcx
shr rdx, 4
imul rax, rdx, 0x13
sub rcx, rax
mov al, byte [rsp + rcx + 0x20]
xor al, byte [r11 + r9]
mov byte [r9], al
add r9, r13
cmp r10d, edi
jb 0x14006a40b
movsxd rax, dword [r12 + 0x3c]
movsx r9d, byte [rbp - 0x49]
mov r8d, r15d
mov edx, dword [rax + r12 + 0x50]
shl r9d, 2
loope 0x14006a454
xor ecx, ecx
call rsi
mov rdi, rax
test rax, rax
je 0x14006a778
movsxd r15, dword [r12 + 0x3c]
mov r8d, ebx
add r15, r12
sub rax, qword [r15 + 0x30]
mov r9d, dword [r15 + 0x54]
movzx r10d, word [r15 + 0x14]
mov qword [rbp + 0x77], rax
mov qword [r15 + 0x30], rdi
test r9, r9
je 0x14006a4a3
mov rdx, r12
mov rcx, rdi
sub rdx, rdi
mov al, byte [rdx + rcx]
add r8d, r13d
mov byte [rcx], al
movsxd rax, r8d
add rcx, r13
cmp rax, r9
jb 0x14006a490
mov rax, qword [r15 + 0xb0]
mov rcx, qword [r15 + 0x90]
mov qword [rbp + 0x7f], rbx
mov qword [rsp + 0x58], rax
mov r13, rbx
mov r14d, ebx
cmp bx, word [r15 + 6]
jae 0x14006a778
lea r9, [r10 + 0x24]
add r9, r15
mov r10d, dword [r9]
cmp eax, r10d
jb 0x14006a4ee
mov r8d, dword [r9 - 4]
invalid
invalid