Function at 0x1400a0acc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
shr ecx, 0x18
mov r13, r9
and ecx, 0xf
mov r14d, r8d
mov r12, rdx
mov qword [rbp - 0x20], rsi
mov edi, esi
dec ecx
je 0x1400a0dcc
dec ecx
je 0x1400a0d32
dec ecx
je 0x1400a0d02
dec ecx
je 0x1400a0bf9
dec ecx
je 0x1400a0bbe
dec ecx
je 0x1400a0b7f
dec ecx
je 0x1400a0b6f
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov r15d, r14d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x1400a0b5c
mov edi, 0xc0000017
jmp 0x1400a0eb8
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.msvcrt.dll_memcpy
jmp 0x1400a0cee
test r14b, 7
je 0x1400a0b2f
mov edi, 0xc0000024
jmp 0x1400a0eb8
lea eax, [r14 - 1]
cmp eax, 1
ja 0x1400a0b75
mov rcx, qword gs:[0x60]
mov r15d, 1
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov r8d, r15d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
xor eax, eax
test rsi, rsi
je 0x1400a0b52
cmp byte [r12], al
setne al
mov byte [rsi], al
jmp 0x1400a0cee
mov r15d, 8
cmp r14d, r15d
jne 0x1400a0b75
mov rcx, qword gs:[0x60]
mov r8d, r15d
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x1400a0b52
mov rax, qword [r12]
mov qword [rsi], rax
jmp 0x1400a0cee
test r14b, 0xf
jne 0x1400a0b75
shr r14d, 4
mov r15d, esi
mov ebx, esi
test r14d, r14d
je 0x1400a0c55
lea rcx, [rbp - 0x18]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ecx, ebx
lea rdx, [rbp - 0x18]
shl rcx, 4
add rcx, r12
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov edi, eax
test eax, eax
js 0x1400a0eb8
movzx ecx, word [rbp - 0x18]
add ecx, 2
add r15d, ecx
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
inc ebx
cmp ebx, r14d
jb 0x1400a0c11
mov rcx, qword gs:[0x60]
add r15d, 2
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov r8d, r15d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
xor eax, eax
test rsi, rsi
je 0x1400a0b52
xor ecx, ecx
mov r13, rsi
mov dword [rbp + 0x40], eax
test r14d, r14d
je 0x1400a0cdd
mov ecx, eax
lea rdx, [rbp - 0x18]
shl rcx, 4
add rcx, r12
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov edi, eax
test eax, eax
js 0x1400a0e7a
movzx eax, word [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rcx, r13
add eax, 2
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rcx, [rbp - 0x18]
add r13, rbx
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [rbp + 0x40]
inc eax
mov dword [rbp + 0x40], eax
cmp eax, r14d
jb 0x1400a0c8c
xor ecx, ecx
mov word [r13], cx
mov r13, qword [rbp + 0x58]
test edi, edi
js 0x1400a0e7a
mov rax, qword [rbp + 0x60]
mov qword [r13], rsi
mov dword [rax], r15d
xor eax, eax
mov edi, eax
jmp 0x1400a0eb8
cmp r14d, 0x10
jne 0x1400a0b75
lea rdx, [rbp - 0x18]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov edi, eax
test eax, eax
js 0x1400a0eb8
movzx r15d, word [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
add r15d, 2
jmp 0x1400a0ce6
test r14b, 1
jne 0x1400a0b75
mov eax, r14d
mov rcx, rdx
or edx, reloc.ADVAPI32.dll_TraceEvent
shr eax, 1
mov bl, sil
je 0x1400a0d5d
cmp word [rcx], si
je 0x1400a0d5b
add rcx, 2
add eax, edx
jne 0x1400a0d4c
jmp 0x1400a0d5d
mov bl, 1
mov r15d, r14d
test bl, bl
jne 0x1400a0d82
lea eax, [r14 + 2]
cmp eax, r14d
jb 0x1400a0d72
mov r15d, eax
jmp 0x1400a0d7a
mov r15d, edx
mov edi, 0xc0000095
test edi, edi
js 0x1400a0eb8
mov rcx, qword gs:[0x60]
mov r8d, r15d
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov r13d, r15d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x1400a0b52
mov r8, r14
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
xor ecx, ecx
test bl, bl
jne 0x1400a0ce2
mov word [r13 + rsi - 2], cx
jmp 0x1400a0ce2
cmp dword [rdx], 6
mov rcx, r12
mov edx, r14d
jne 0x1400a0de2
lea r8, [rbp - 0x20]
call fcn.1400a1bb0
jmp 0x1400a0dee
lea r9, [rbp - 0x20]
xor r8d, r8d
call fcn.1400a15dc
mov edi, eax
test eax, eax
js 0x1400a0e99
mov rbx, qword [rbp - 0x20]
mov eax, dword [rbx + 8]
add eax, 0x10
mov r15d, eax
cmp eax, 0x10
jae 0x1400a0e14
mov edi, 0xc000000d
jmp 0x1400a0e99
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x1400a0e3b
mov edi, 0xc0000017
jmp 0x1400a0e97
movups xmm0, xmmword [r12 + 4]
mov rdx, qword [rbp - 0x20]
lea rcx, [rsi + 0x10]
movdqu xmmword [rsi], xmm0
mov r8d, dword [rbx + 8]
call sub.msvcrt.dll_memcpy
mov rcx, qword gs:[0x60]
mov r8, qword [rbp - 0x20]
mov rcx, qword [rcx + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ecx, ecx
mov qword [rbp - 0x20], rcx
jmp 0x1400a0ce6
test rsi, rsi
je 0x1400a0eb8
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
cmp qword [rbp - 0x20], rsi
je 0x1400a0eb8
mov rcx, qword gs:[0x60]
mov r8, qword [rbp - 0x20]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret