Function at 0x18005cdf0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x88
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rbp - 1], rax
mov eax, dword [rbp + 0x77]
xor r13d, r13d
add eax, 0xffffff00
mov qword [rbp - 0x21], r8
mov byte [r9], r13b
mov r15, rcx
movzx ecx, word [rbp + 0x7f]
mov rsi, r9
mov dword [r9 + 2], r13d
mov r14, rdx
mov dword [r9 + 8], r13d
test eax, 0xfffffeff
je 0x18005ce4f
mov eax, 0xc000000d
jmp 0x18005d196
call fcn.18005cbd8
mov qword [rbp - 0x19], rax
mov r12, rax
test rax, rax
je 0x18005ce45
movzx ecx, word [rax]
xor edx, edx
movzx eax, word [r14]
div ecx
mov r8d, eax
mov eax, 0x18
cmp cx, ax
jbe 0x18005ce7d
sub cx, ax
jmp 0x18005ce83
sub ax, cx
movzx ecx, ax
movzx ebx, word [r14 + 2]
xor edx, edx
movzx ecx, cx
movzx eax, r8w
imul ecx, eax
movzx edi, cx
mov rcx, qword gs:[0x60]
lea r8d, [rdi + rbx]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
add bx, di
mov word [rbp - 0x41], r13w
mov word [rbp - 0x3f], bx
mov qword [rbp - 0x39], rax
test rax, rax
jne 0x18005cecd
mov eax, 0xc0000017
jmp 0x18005d196
mov rdx, r14
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [0x18006d1b0]
call fcn.18005c778
xor r10d, r10d
mov r12d, eax
test eax, eax
js 0x18005d174
movzx r14d, word [rbp - 0x41]
lea ebx, [r10 + 1]
mov r13, qword [rbp - 0x39]
movzx edi, r10w
shr r14w, 1
mov r11b, r10b
mov word [rbp - 0x11], r10w
mov byte [rbp - 0x49], r10b
test r15, r15
je 0x18005cfd7
lea rax, [rbp - 0x48]
movzx r8d, r14w
lea r9, [rbp - 0x45]
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, r15
call fcn.18005cc1c
xor r10d, r10d
mov r15, rax
test rax, rax
je 0x18005cfc8
movzx edx, word [rbp - 0x45]
lea r8d, [r10 + 2]
sub r14w, dx
add di, dx
lea r13, [r13 + rdx*2]
mov edx, dword [rax + 0x24]
test r8b, dl
je 0x18005cf72
movzx ecx, bx
mov word [rbp + rcx*2 - 0x11], di
jmp 0x18005cf82
test dl, 4
je 0x18005cf90
movzx eax, bx
lea ecx, [rdi - 0xc]
mov word [rbp + rax*2 - 0x11], cx
movzx eax, bx
inc eax
add bx, r8w
mov word [rbp + rax*2 - 0x11], di
mov r11b, dl
mov eax, 1
and r11b, al
mov byte [rbp - 0x49], r11b
test dl, 8
je 0x18005cfa7
or dword [rsi + 8], eax
mov r15, qword [r15 + 8]
test r15, r15
jne 0x18005cf25
bts dword [rsi + 8], 0xa
test r15, r15
jne 0x18005cf25
mov byte [rbp - 0x49], r11b
jmp 0x18005cfd7
mov r11b, byte [rbp - 0x49]
cmp byte [rbp - 0x48], r10b
je 0x18005cfd7
bts dword [rsi + 8], 0xa
movzx ecx, word [rbp - 0x41]
mov r14d, 1
movzx eax, bx
add bx, r14w
shr cx, 1
lea edi, [r14 + 1]
mov word [rbp + rax*2 - 0x11], cx
movzx edx, di
cmp di, bx
jae 0x18005d013
movzx ecx, dx
movzx eax, word [rbp + rcx*2 - 0x11]
cmp word [rbp + rcx*2 - 0x13], ax
jne 0x18005d079
add dx, di
cmp dx, bx
jb 0x18005cffc
mov r13d, dword [rbp + 0x77]
mov dl, byte [rsi]
movzx r8d, di
movzx r9d, bx
lea r15d, [r9 - 2]
cmp r15d, edi
jle 0x18005d04c
movzx ecx, r8w
movzx edx, dl
movzx eax, word [rbp + rcx*2 - 0x11]
cmp word [rbp + rcx*2 - 0x13], ax
cmovne edx, r14d
add r8w, di
movzx eax, r8w
cmp eax, r15d
jl 0x18005d02a
mov byte [rsi], dl
test r11b, r11b
je 0x18005d088
cmp r13d, 0x200
jne 0x18005d088
cmp di, bx
jae 0x18005d075
movzx eax, word [rbp + r9*2 - 0x15]
cmp word [rbp + r9*2 - 0x17], ax
jne 0x18005d075
mov byte [rsi], r14b
mov dl, r14b
mov al, dl
jmp 0x18005d0ab
or dword [rsi + 8], 0xa00
mov r13d, 0x200
jmp 0x18005d017
mov al, dl
cmp di, bx
jae 0x18005d0ab
movzx r8d, word [rbp + r9*2 - 0x15]
cmp word [rbp + r9*2 - 0x17], r8w
je 0x18005d0ab
cmp r8w, word [rbp + r9*2 - 0x13]
je 0x18005d0ab
mov byte [rsi], r14b
mov al, r14b
test al, al
je 0x18005d174
movzx edi, r14w
cmp r14w, bx
jae 0x18005d142
mov r14, r9
movzx r8d, di
movzx eax, di
mov ecx, r8d
movzx r9d, word [rbp + r8*2 - 0x13]
movzx r10d, word [rbp + rax*2 - 0x11]
movzx edx, r10w
sub dx, r9w
sub ecx, 1
je 0x18005d103
sub ecx, 1
je 0x18005d1b6
sub ecx, 1
je 0x18005d103
sub ecx, 1
je 0x18005d1b6
cmp ecx, 1
jne 0x18005d11e
mov rax, qword [rbp - 0x39]
add dx, dx
movzx ecx, r9w
mov word [rbp - 0x2f], dx
mov word [rbp - 0x31], dx
lea rcx, [rax + rcx*2]
mov qword [rbp - 0x29], rcx
mov rcx, qword [rbp - 0x21]
lea rdx, [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
xor r10d, r10d
mov r12d, eax
test eax, eax
js 0x18005d174
mov r11b, byte [rbp - 0x49]
inc di
cmp di, bx
jb 0x18005d0c4
mov rcx, qword [rbp - 0x21]
movzx edx, word [rbp - 0xf]
mov r8, rcx
add dx, dx
mov word [rsi + 2], dx
movzx eax, word [rcx]
lea rcx, [0x18006d1b0]
sub ax, dx
mov rdx, qword [rbp - 0x19]
mov word [rsi + 4], ax
call fcn.18005c778
mov r12d, eax
xor r10d, r10d
cmp qword [rbp - 0x39], r10
je 0x18005d193
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x39]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, r12d
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.180017170
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test r11b, r11b
jne 0x18005d1cc
cmp r10w, word [rbp + r14*2 - 0x13]
jne 0x18005d13a
jmp 0x18005d103
cmp r13d, 0x200
jne 0x18005d13a
cmp r8d, r15d
jne 0x18005d13a
lea rax, str.WOW6432Node
mov dword [rbp - 0x31], 0x180018
mov qword [rbp - 0x29], rax
jmp 0x18005d11e