Function at 0x7fff25d8cd68
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x98
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp - 9], rax
mov eax, dword [rbp + 0x77]
xor r13d, r13d
add eax, 0xffffff00
mov qword [rbp - 0x21], r8
mov byte [r9], r13b
mov rsi, r9
mov dword [r9 + 2], r13d
mov r12, rdx
mov dword [r9 + 8], r13d
mov r14, rcx
test eax, 0xfffffeff
jne 0x7fff25df0929
movzx ecx, word [rbp + 0x7f]
sub ecx, 0x14c
jne 0x7fff25df08be
lea r15, [0x7fff25e56308]
movzx ecx, word [r15]
mov edx, 0x18
movzx ebx, word [r12 + 2]
mov eax, edx
sub ax, cx
mov qword [rbp - 0x41], r15
movzx r8d, cx
sub r8w, dx
cmp cx, dx
cmovbe r8w, ax
movzx eax, word [r12]
xor edx, edx
div ecx
xor edx, edx
movzx ecx, ax
movzx eax, r8w
imul eax, ecx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
movzx edi, ax
lea r8, [rdi + rbx]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
add bx, di
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
mov word [rbp - 0x4f], bx
mov qword [rbp - 0x49], rax
test rax, rax
je 0x7fff25df08f7
mov rdx, r12
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
nop dword [rax + rax]
lea r8, [rbp - 0x51]
mov rcx, r15
lea rdx, [0x7fff25e56308]
call fcn.7fff25d8d3d0
xor r10d, r10d
mov r12d, eax
test eax, eax
js 0x7fff25d8d0b5
mov rax, qword [rbp - 0x49]
lea ebx, [r10 + 1]
movzx r15d, word [rbp - 0x51]
movzx edi, r10w
mov qword [rbp - 0x29], rax
shr r15w, 1
mov word [rbp - 0x19], r10w
test r14, r14
je 0x7fff25d8cf39
lea rcx, [rbp - 0x59]
movzx r8d, r15w
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x55]
mov rcx, r14
mov rdx, rax
call fcn.7fff25d8d1a0
xor r10d, r10d
mov r14, rax
test rax, rax
je 0x7fff25d8cf2e
movzx edx, word [rbp - 0x55]
lea r8d, [r10 + 2]
mov rax, qword [rbp - 0x29]
sub r15w, dx
add di, dx
lea rax, [rax + rdx*2]
mov edx, dword [r14 + 0x24]
mov qword [rbp - 0x29], rax
test r8b, dl
je 0x7fff25d8d13c
movzx ecx, bx
mov word [rbp + rcx*2 - 0x19], di
add bx, r8w
mov word [rbp + rcx*2 - 0x17], di
mov r13b, dl
mov ecx, 1
and r13b, cl
test dl, 8
jne 0x7fff25d8d134
mov r14, qword [r14 + 8]
test r14, r14
jne 0x7fff25d8cea7
bts dword [rsi + 8], 0xa
jmp 0x7fff25d8ce9e
cmp byte [rbp - 0x59], r10b
je 0x7fff25d8cf39
bts dword [rsi + 8], 0xa
movzx ecx, word [rbp - 0x51]
mov r15d, 1
movzx eax, bx
add bx, r15w
shr cx, 1
lea edi, [r15 + 1]
mov word [rbp + rax*2 - 0x19], cx
movzx edx, di
cmp di, bx
jae 0x7fff25d8cf79
movzx ecx, dx
movzx eax, word [rbp + rcx*2 - 0x19]
cmp word [rbp + rcx*2 - 0x1b], ax
jne 0x7fff25d8d17e
add dx, di
cmp dx, bx
jb 0x7fff25d8cf5e
mov r11d, dword [rbp + 0x77]
mov dl, byte [rsi]
movzx r8d, di
movzx r9d, bx
lea r14d, [r9 - 2]
cmp r14d, edi
jle 0x7fff25d8cfb2
movzx ecx, r8w
movzx edx, dl
movzx eax, word [rbp + rcx*2 - 0x19]
cmp word [rbp + rcx*2 - 0x1b], ax
cmovne edx, r15d
add r8w, di
movzx eax, r8w
cmp eax, r14d
jl 0x7fff25d8cf90
mov byte [rsi], dl
test r13b, r13b
je 0x7fff25d8d159
cmp r11d, 0x200
jne 0x7fff25d8d159
cmp di, bx
jae 0x7fff25d8cfe4
movsxd rcx, r9d
movzx eax, word [rbp + rcx*2 - 0x1d]
cmp word [rbp + rcx*2 - 0x1f], ax
jne 0x7fff25d8cfe4
mov byte [rsi], r15b
mov dl, r15b
mov al, dl
test al, al
je 0x7fff25d8d0b5
movzx edi, r15w
cmp r15w, bx
jae 0x7fff25d8d07f
mov r15, r9
movzx r8d, di
movzx eax, di
mov ecx, r8d
movzx r9d, word [rbp + r8*2 - 0x1b]
movzx r10d, word [rbp + rax*2 - 0x19]
movzx edx, r10w
sub dx, r9w
sub ecx, 1
je 0x7fff25d8d03e
sub ecx, 1
je 0x7fff25d8d0fe
sub ecx, 1
je 0x7fff25d8d03e
sub ecx, 1
je 0x7fff25d8d0fe
cmp ecx, 1
jne 0x7fff25d8d055
mov rax, qword [rbp - 0x49]
add dx, dx
mov word [rbp - 0x37], dx
mov word [rbp - 0x39], dx
lea rcx, [rax + r9*2]
mov qword [rbp - 0x31], rcx
mov rcx, qword [rbp - 0x21]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
xor r10d, r10d
mov r12d, eax
test eax, eax
js 0x7fff25d8d0b5
mov r11d, dword [rbp + 0x77]
inc di
cmp di, bx
jb 0x7fff25d8cfff
mov rcx, qword [rbp - 0x21]
movzx r9d, word [rbp - 0x17]
mov r8, rcx
mov rdx, qword [rbp - 0x41]
add r9w, r9w
mov word [rsi + 2], r9w
movzx eax, word [rcx]
lea rcx, [0x7fff25e56308]
sub ax, r9w
mov word [rsi + 4], ax
call fcn.7fff25d8d3d0
mov r12d, eax
xor r10d, r10d
cmp qword [rbp - 0x49], r10
je 0x7fff25d8d0da
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x49]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, r12d
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test r13b, r13b
je 0x7fff25df0918
cmp r8d, r14d
jne 0x7fff25d8d073
cmp r11d, 0x200
jne 0x7fff25d8d073
lea rax, str.WOW6432Node
mov dword [rbp - 0x39], 0x180018
mov qword [rbp - 0x31], rax
jmp 0x7fff25d8d055
or dword [rsi + 8], ecx
jmp 0x7fff25d8cf1b
test dl, 4
je 0x7fff25d8cf07
lea eax, [rdi - 0xc]
movzx ecx, bx
mov word [rbp + rcx*2 - 0x19], ax
mov rax, qword [rbp - 0x29]
jmp 0x7fff25d8cefe
mov al, dl
cmp di, bx
jae 0x7fff25d8cfe6
movsxd rcx, r9d
movzx r8d, word [rbp + rcx*2 - 0x1d]
cmp word [rbp + rcx*2 - 0x1f], r8w
je 0x7fff25d8cfe6
jmp 0x7fff25df0901
or dword [rsi + 8], 0xa00
mov r11d, 0x200
mov dword [rbp + 0x77], r11d
jmp 0x7fff25d8cf7d
sub ecx, 0x78
je 0x7fff25df08eb
sub ecx, 0x84a0
je 0x7fff25df08df
cmp ecx, 0x2400
jne 0x7fff25df0929
lea r15, [0x7fff25f02210]
jmp 0x7fff25d8cdd4
lea r15, [0x7fff25f02260]
jmp 0x7fff25d8cdd4
lea r15, [0x7fff25f02240]
jmp 0x7fff25d8cdd4
mov eax, 0xc0000017
jmp 0x7fff25d8d0dd
cmp r8w, word [rbp + rcx*2 - 0x1b]
je 0x7fff25d8cfe6
mov byte [rsi], r15b
mov al, r15b
jmp 0x7fff25d8cfe6
cmp r10w, word [rbp + r15*2 - 0x1b]
jne 0x7fff25d8d073
jmp 0x7fff25d8d03e
mov eax, 0xc000000d
jmp 0x7fff25d8d0dd