Function at 0x18004bdf0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r12, r9
mov r9, rcx
xor r10d, r10d
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x60], r10
mov byte [rsp + 0x20], r10b
mov byte [rsp + 0x21], r10b
test r8, r8
je 0x1800b4778
cmp word [rdx], r10w
je 0x1800b4778
mov eax, 1
nop dword [rax + rax]
cmp rax, r8
jae 0x18004be71
movzx ecx, word [rdx + rax*2]
test cx, cx
je 0x1800b4778
cmp cx, 0x3d
je 0x1800b4778
inc rax
jmp 0x18004be50
test r12, r12
je 0x18004be96
mov rax, r10
mov rbx, qword [rsp + 0xe0]
cmp rax, rbx
jae 0x18004be96
cmp word [r12 + rax*2], r10w
je 0x1800b4778
inc rax
jmp 0x18004be81
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x20]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], r10d
mov qword [rsp + 0x68], r10
test r9, r9
je 0x18004c6c4
mov r9, qword [r9]
mov qword [rsp + 0x28], r9
cmp qword [rbx + 0x80], r9
je 0x1800b4782
mov rsi, r9
mov qword [rsp + 0x30], r9
mov r14, r10
mov qword [rsp + 0x48], r10
test r9, r9
je 0x18004bfe1
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r15, qword [0x18015b238]
nop
cmp word [rsi], 0
je 0x18004bfe1
mov r12, rsi
mov rbx, r10
add rsi, 2
mov qword [rsp + 0x30], rsi
movzx eax, word [rsi]
test ax, ax
je 0x18004c503
cmp ax, 0x3d
je 0x18004c4ca
jmp 0x18004bf10
mov r14, rsi
mov qword [rsp + 0x48], rsi
nop dword [rax]
movzx eax, word [r14]
test ax, ax
je 0x18004bf66
nop dword [rax]
add r14, 2
mov qword [rsp + 0x48], r14
test ax, ax
je 0x18004bf64
movzx eax, word [r14]
jmp 0x18004bf50
jmp 0x18004bf40
add r14, 2
mov qword [rsp + 0x48], r14
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x18004c2a3
mov r12, qword [rsp + 0xe0]
cmp r12, rdi
ja 0x18004c1a0
lea rbx, [r12 + r12]
mov r8, rbx
mov rcx, r13
call sym.ntdll.dll_RtlCopyMemory
lea rcx, [rbx + r13]
xor eax, eax
mov word [rcx], ax
add rcx, 2
cmp r12, rdi
jne 0x18004c2a6
cmp byte [rsp + 0x20], 0
je 0x18004bfd1
xor edx, edx
mov r8d, 0x468
lea rcx, [0x18015cb20]
call sym.ntdll.dll_memset
mov r12, qword [rsp + 0xd8]
mov r9, qword [rsp + 0x28]
xor r10d, r10d
mov rax, qword [rsp + 0x68]
test rax, rax
cmovne rsi, rax
mov qword [rsp + 0x30], rsi
test r14, r14
je 0x18004c006
mov rax, qword [rsp + 0x40]
movzx ebx, byte [rsp + 0x20]
jmp 0x18004c69b
test r12, r12
je 0x18004c691
test rsi, rsi
je 0x18004c648
mov qword [rsp + 0x48], rsi
nop dword [rax]
movzx eax, word [rsi]
test ax, ax
je 0x18004c045
nop dword [rax + rax]
add rsi, 2
mov qword [rsp + 0x48], rsi
test ax, ax
je 0x18004c043
movzx eax, word [rsi]
jmp 0x18004c030
jmp 0x18004c020
add rsi, 2
mov qword [rsp + 0x48], rsi
mov rcx, qword gs:[0x60]
mov r8, r9
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlSizeHeap
mov r14, qword [rsp + 0x48]
mov rcx, r14
mov r15, qword [rsp + 0x28]
sub rcx, r15
sar rcx, 1
mov r13, qword [rsp + 0xd0]
add rcx, r13
mov rdi, qword [rsp + 0xe0]
add rcx, rdi
lea r12, [rcx*2 + 4]
mov rsi, qword [rsp + 0x30]
cmp r12, rax
jb 0x18004c3ab
mov rcx, r12
call fcn.18004c724
mov r15, rax
test rax, rax
je 0x18004c689
test rsi, rsi
je 0x18004c671
mov rbx, rsi
sub rbx, qword [rsp + 0x28]
sar rbx, 1
mov ebx, ebx
lea r8, [rbx + rbx]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call sym.ntdll.dll_RtlCopyMemory
lea rdi, [r15 + rbx*2]
lea rbx, [r13*2]
mov r8, rbx
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call sym.ntdll.dll_RtlCopyMemory
add rdi, rbx
mov eax, 0x3d
mov word [rdi], ax
mov rbx, qword [rsp + 0xe0]
add rbx, rbx
mov r8, rbx
mov rdx, qword [rsp + 0xd8]
lea rcx, [rdi + 2]
call sym.ntdll.dll_RtlCopyMemory
xor eax, eax
mov word [rdi + rbx + 2], ax
test rsi, rsi
je 0x18004c67a
sub r14, rsi
sar r14, 1
lea r8d, [r14 + r14]
mov rdx, rsi
lea rcx, [rbx + 4]
add rcx, rdi
call sym.ntdll.dll_RtlCopyMemory
movzx ebx, byte [rsp + 0x20]
test bl, bl
jne 0x18004c2c0
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x18004c2d9
mov qword [rax], r15
cmp byte [rsp + 0x21], 0
jne 0x18004c2f8
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov rax, qword [rsp + 0x40]
jmp 0x18004c69b
mov rcx, qword gs:[0x60]
mov r13, qword [rsp + 0x28]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlSizeHeap
mov r14, qword [rsp + 0x48]
mov r15, r14
sub r15, r13
sar r15, 1
sub r15, qword [rsp + 0x60]
add r15, r12
add r15, r15
cmp r15, rax
jb 0x18004c314
mov rcx, r15
call fcn.18004c724
mov rsi, rax
test rax, rax
je 0x18004c689
mov rax, qword [rsp + 0x50]
sub rax, r13
sar rax, 1
mov eax, eax
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call sym.ntdll.dll_RtlCopyMemory
lea rdi, [rbx + rsi]
lea rbx, [r12 + r12]
mov r8, rbx
mov r12, qword [rsp + 0xd8]
mov rdx, r12
mov rcx, rdi
call sym.ntdll.dll_RtlCopyMemory
xor eax, eax
mov word [rdi + rbx], ax
lea rcx, [rbx + 2]
add rcx, rdi
mov rdx, qword [rsp + 0x30]
sub r14, rdx
sar r14, 1
lea r8d, [r14 + r14]
call sym.ntdll.dll_RtlCopyMemory
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x18004c476
mov qword [rax], rsi
cmp byte [rsp + 0x20], 0
jne 0x18004c495
cmp byte [rsp + 0x21], 0
jne 0x18004c4ae
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
mov r9, r13
jmp 0x18004bfde
mov rcx, r12
mov rax, r14
sub rax, rsi
sar rax, 1
mov rdx, rsi
lea r8d, [rax + rax]
call sym.ntdll.dll_RtlCopyMemory
jmp 0x18004bfb6
xor edx, edx
mov r8d, 0x468
lea rcx, [0x18015cb20]
call sym.ntdll.dll_memset
jmp 0x18004c15e
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x80], r15
mov qword [rax + 0x3f0], r12
inc qword [rax + 0x3f8]
jmp 0x18004c172
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x38]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov byte [rsp + 0x21], 0
jmp 0x18004c17d
lea rbx, [r12 + r12]
mov rdi, qword [rsp + 0x50]
add rdi, rbx
mov rax, r14
mov rsi, qword [rsp + 0x30]
sub rax, rsi
sar rax, 1
lea r8d, [rax + rax]
mov rdx, rsi
lea rcx, [rdi + 2]
call sym.ntdll.dll_RtlCopyMemory
xor eax, eax
mov word [rdi], ax
sub rdi, rbx
mov r8, rbx
mov r12, qword [rsp + 0xd8]
mov rdx, r12
mov rcx, rdi
call sym.ntdll.dll_RtlCopyMemory
mov r9, r13
cmp qword [rsp + 0xc0], 0
jne 0x18004c384
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x80], r13
mov qword [rax + 0x3f0], r15
inc qword [rax + 0x3f8]
cmp byte [rsp + 0x20], 0
je 0x18004bfde
xor edx, edx
mov r8d, 0x468
lea rcx, [0x18015cb20]
call sym.ntdll.dll_memset
mov r9, r13
jmp 0x18004bfde
lea rax, [r13 + 2]
add rax, rdi
lea rcx, [rsi + rax*2]
sub r14, rsi
sar r14, 1
lea r8d, [r14 + r14]
mov rdx, rsi
call sym.ntdll.dll_RtlCopyMemory
lea rbx, [r13*2]
mov r8, rbx
mov rdx, qword [rsp + 0xc8]
mov rcx, rsi
call sym.ntdll.dll_RtlCopyMemory
cmp byte [rsp + 0x20], 0
je 0x18004c3fe
xor edx, edx
mov r8d, 0x468
lea rcx, [0x18015cb20]
call sym.ntdll.dll_memset
add rsi, rbx
mov qword [rsp + 0x30], rsi
mov eax, 0x3d
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x30], rsi
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, qword [rsp + 0xd8]
mov rcx, rsi
call sym.ntdll.dll_RtlCopyMemory
add rsi, rbx
mov qword [rsp + 0x30], rsi
xor eax, eax
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x30], rsi
cmp qword [rsp + 0xc0], rax
jne 0x18004c691
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x80], r15
mov qword [rax + 0x3f0], r12
inc qword [rax + 0x3f8]
movzx ebx, byte [rsp + 0x20]
jmp 0x18004c69b
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x80], rsi
mov qword [rax + 0x3f0], r15
inc qword [rax + 0x3f8]
jmp 0x18004c264
xor edx, edx
mov r8d, 0x468
lea rcx, [0x18015cb20]
call sym.ntdll.dll_memset
jmp 0x18004c26f
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x38]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov byte [rsp + 0x21], 0
jmp 0x18004c27a
mov rbx, rsi
sub rbx, r12
sar rbx, 1
add rsi, 2
mov qword [rsp + 0x30], rsi
mov r13, rsi
mov qword [rsp + 0x50], rsi
cmp word [rsi], 0
je 0x18004c4f5
add rsi, 2
mov qword [rsp + 0x30], rsi
jmp 0x18004c4e4
mov rdi, rsi
sub rdi, r13
sar rdi, 1
mov qword [rsp + 0x60], rdi
add rsi, 2
mov qword [rsp + 0x30], rsi
mov r9, rdx
mov qword [rsp + 0x70], rdx
mov r10, r12
mov qword [rsp + 0x78], r12
mov rax, r8
cmp r8, rbx
cmova rax, rbx
lea r11, [rdx + rax*2]
cmp r9, r11
jae 0x18004c5cd
movzx edx, word [r9]
mov dword [rsp + 0x58], edx
movzx r8d, word [r10]
mov dword [rsp + 0x5c], r8d
cmp edx, r8d
je 0x18004c594
cmp edx, 0x61
jae 0x18004c5a8
mov dword [rsp + 0x58], edx
cmp r8d, 0x61
jae 0x18004c5c1
mov dword [rsp + 0x5c], r8d
cmp edx, r8d
je 0x18004c594
sub edx, r8d
mov r8, qword [rsp + 0xd0]
test edx, edx
je 0x18004bf31
js 0x18004c5b2
mov rdx, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd8]
mov r9, qword [rsp + 0x28]
xor r10d, r10d
jmp 0x18004bf00
add r9, 2
mov qword [rsp + 0x70], r9
add r10, 2
mov qword [rsp + 0x78], r10
jmp 0x18004c52a
cmp edx, 0x7a
ja 0x18004c5dc
add edx, 0xffffffe0
jmp 0x18004c54e
cmp qword [rsp + 0x68], 0
jne 0x18004c577
mov qword [rsp + 0x68], r12
jmp 0x18004c577
cmp r8d, 0x7a
ja 0x18004c610
add r8d, 0xffffffe0
jmp 0x18004c558
mov r8, qword [rsp + 0xd0]
mov edx, r8d
sub edx, ebx
jmp 0x18004c56d
mov rax, rdx
shr rax, 8
movzx ecx, word [r15 + rax*2]
mov eax, edx
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [r15 + rcx*2]
mov eax, edx
and eax, 0xf
add ecx, eax
mov eax, ecx
movzx ecx, word [r15 + rcx*2]
add cx, dx
movzx edx, cx
jmp 0x18004c54e
mov rax, r8
shr rax, 8
movzx ecx, word [r15 + rax*2]
mov eax, r8d
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [r15 + rcx*2]
mov eax, r8d
and eax, 0xf
add ecx, eax
mov eax, ecx
movzx ecx, word [r15 + rcx*2]
add cx, r8w
movzx r8d, cx
jmp 0x18004c558
mov r13, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xe0]
lea rax, [rdi + r13]
lea r12, [rax*2 + 6]
mov rax, r10
mov r15, qword [rsp + 0x28]
jmp 0x18004c09b
xor eax, eax
mov ebx, eax
jmp 0x18004c0df
mov word [rdi + rbx + 4], ax
movzx ebx, byte [rsp + 0x20]
jmp 0x18004c15e
mov dword [rsp + 0x38], 0xc000009a
movzx ebx, byte [rsp + 0x20]
jmp 0x18004c196
cmp dword [rsp + 0x38], 0
jl 0x18004c6a6
test bl, bl
jne 0x18004c704
cmp byte [rsp + 0x21], 0
jne 0x18004c70d
mov eax, dword [rsp + 0x38]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsp + 0x21], 1
mov byte [rsp + 0x20], 1
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x38]
call sym.ntdll.dll_RtlEnterCriticalSection
mov r9, qword [rbx + 0x80]
mov qword [rsp + 0x28], r9
mov r8, qword [rsp + 0xd0]
xor r10d, r10d
mov rdx, qword [rsp + 0xc8]
jmp 0x18004bed4
inc qword [rax + 0x3f8]
jmp 0x18004c6a6
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x38]
call sym.ntdll.dll_RtlLeaveCriticalSection
jmp 0x18004c6ad
mov eax, 0xc000000d
jmp 0x18004c6b1
mov rdx, qword [rcx + 0x38]
test rdx, rdx
je 0x1800b47a2
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
cmp qword [rdx + 0x10], rcx
jne 0x18004c6f7
mov byte [rsp + 0x20], 1
jmp 0x18004c6f7