Function at 0x1700149f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x858
mov r14, r9
mov rbx, r8
mov qword [rsp + 0x38], rdx
mov r12, rcx
mov edi, dword [rsp + 0x8c8]
mov r13, qword [rsp + 0x8c0]
test byte [0x17008d130], 8
je 0x170014a68
mov rcx, rbx
mov edx, 0xffffffff
call fcn.170014e40
mov rsi, rax
mov rcx, r13
mov edx, 0xffffffff
call fcn.170014e40
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r8, str.parse_manifest
lea r9, str.parsing_manifest_loaded_from__s_base_dir__s_n
mov ecx, 3
call fcn.17000f350
mov rbp, qword [r12]
cmp edi, 1
mov edi, 2
sbb edi, 0
mov r15d, dword [rbp + 0x30]
mov rsi, qword [rbp + 0x28]
cmp r15d, dword [rbp + 0x34]
jne 0x170014ace
test rsi, rsi
je 0x170014c20
add r15d, r15d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
imul r9, r15, 0x98
mov edx, 8
mov r8, rsi
call sym.ntdll.dll_RtlReAllocateHeap
mov rsi, rax
test rsi, rsi
je 0x170014c53
mov qword [rbp + 0x28], rsi
mov dword [rbp + 0x34], r15d
mov r15d, dword [rbp + 0x30]
lea eax, [r15 + 1]
mov dword [rbp + 0x30], eax
mov eax, r15d
imul rbp, rax, 0x98
mov dword [rsi + rbp], edi
test r13, r13
je 0x170014b30
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x30]
mov rcx, r13
call sym.ntdll.dll_wcslen
lea r8, [rax + rax]
add r8, 2
mov rcx, rdi
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170014b87
mov rcx, rax
mov rdx, r13
call sym.ntdll.dll_wcscpy
mov qword [rsi + rbp + 0x50], rax
test rax, rax
je 0x170014c63
test rbx, rbx
je 0x170014b95
add rbx, 8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x30]
mov rcx, rbx
call sym.ntdll.dll_wcslen
lea r8, [rax + rax]
add r8, 2
mov rcx, rdi
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170014c5a
mov rcx, rax
mov rdx, rbx
call sym.ntdll.dll_wcscpy
mov qword [rsi + rbp + 0x48], rax
test rax, rax
jne 0x170014bb3
jmp 0x170014c63
mov qword [rsi + rbp + 0x50], 0
jmp 0x170014c63
lea rdx, [rsp + 0x40]
mov rcx, r14
xor r8d, r8d
call fcn.17000f3d0
test eax, eax
jne 0x170014c1c
mov rax, qword [rsp + 0x48]
mov qword [rsi + rbp + 0x48], rax
mov rdi, qword [rsp + 0x8d8]
mov rbx, qword [rsp + 0x8d0]
lea r14, [rsi + rbp]
cmp rax, 1
mov eax, 2
sbb eax, 0
mov dword [rsi + rbp + 0x40], eax
mov dword [rsp + 0x34], 0x88
lea r8, [rsp + 0x34]
mov rcx, rbx
mov edx, edi
call sym.ntdll.dll_RtlIsTextUnicode
test al, al
je 0x170014c7e
mov qword [rsp + 0x40], rbx
and rdi, 0xfffffffffffffffe
add rdi, rbx
mov qword [rsp + 0x48], rdi
lea r9, [rsp + 0x40]
mov rcx, r12
mov rdx, r14
mov r8, qword [rsp + 0x38]
call fcn.1700150e0
mov edi, eax
jmp 0x170014c68
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, 0x260
mov edx, 8
call sym.ntdll.dll_RtlAllocateHeap
mov rsi, rax
mov r15d, 4
test rsi, rsi
jne 0x170014ac2
mov edi, 0xc0150002
jmp 0x170014c68
mov qword [rsi + rbp + 0x48], 0
mov edi, 0xc0000017
mov eax, edi
add rsp, 0x858
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsp + 0x34], 0
js 0x170014d0f
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call sym.ntdll.dll_RtlUTF8ToUnicodeN
mov rbp, qword gs:[0x30]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, dword [rsp + 0x30]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170014c63
mov rsi, rax
mov edx, dword [rsp + 0x30]
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9, rbx
call sym.ntdll.dll_RtlUTF8ToUnicodeN
mov qword [rsp + 0x40], rsi
mov eax, dword [rsp + 0x30]
and eax, 0xfffffffe
add rax, rsi
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x40]
mov rcx, r12
mov rdx, r14
mov r8, qword [rsp + 0x38]
call fcn.1700150e0
mov edi, eax
mov rax, qword [rbp + 0x60]
jmp 0x170014daf
mov r13, qword gs:[0x30]
mov rax, qword [r13 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170014c63
mov rsi, rax
mov rax, rdi
shr rax, 1
cmp rdi, 2
jb 0x170014d86
cmp rax, 2
mov edx, 1
mov ebp, 1
cmovae rbp, rax
cmp rbp, 0x10
jae 0x170014dc2
xor ecx, ecx
xor edx, edx
add edx, 1
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebp, word [rbx + rcx*2]
rol bp, 8
mov word [rsi + rcx*2], bp
mov ecx, edx
add edx, 1
cmp rax, rcx
ja 0x170014d70
mov qword [rsp + 0x40], rsi
lea rax, [rsi + rax*2]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x40]
mov rcx, r12
mov rdx, r14
mov r8, qword [rsp + 0x38]
call fcn.1700150e0
mov edi, eax
mov rax, qword [r13 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
jmp 0x170014c68
cmp rax, 2
cmovae rdx, rax
add rdx, 0xffffffffffffffff
xor ecx, ecx
cmp edx, 0xffffffff
je 0x170014d5c
shr rdx, 0x20
mov edx, 0
jne 0x170014d5e
mov rcx, rbp
and rcx, 0xfffffffffffffff0
mov edx, ecx
xor edi, edi
movdqu xmm0, xmmword [rbx + rdi*2]
movdqu xmm1, xmmword [rbx + rdi*2 + 0x10]
movdqa xmm2, xmm0
psrlw xmm2, 8
psllw xmm0, 8
por xmm0, xmm2
movdqa xmm2, xmm1
psrlw xmm2, 8
psllw xmm1, 8
por xmm1, xmm2
movdqu xmmword [rsi + rdi*2], xmm0
movdqu xmmword [rsi + rdi*2 + 0x10], xmm1
add rdi, 0x10
cmp rcx, rdi
jne 0x170014def
cmp rbp, rcx
je 0x170014d86
jmp 0x170014d5e