Function at 0x15e28
Capabilities:
Check for software breakpoints

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x00022ec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov byte [rsp + 0x40], 0
mov ebp, r8d
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x16156
test rdx, rdx
je 0x16156
lea eax, [r8 - 0xc8]
cmp eax, 0xc7
ja 0x16142
lea rdx, [0x00020450]
xor r8d, r8d
call fcn.00015b00
or rsi, 0xffffffffffffffff
cmp eax, esi
je 0x15fca
lea rdx, [0x00020480]
xor r8d, r8d
mov rcx, rbx
call fcn.00015b00
cmp eax, esi
je 0x15fca
and dword [rsp + 0x30], 0
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x30]
mov rax, qword [rax]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToSecondsSince1970]
mov r9d, dword [rsp + 0x30]
lea r8, [0x00020490]
lea edx, [rsi + 0x21]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__snprintf]
xor eax, eax
mov rcx, rsi
mov rdi, rbx
lea r8, [0x000204a0]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.00011494
mov r12, rax
test rax, rax
je 0x15fca
xor eax, eax
mov rcx, rsi
mov rdi, r12
repne scasb al, byte [rdi]
lea r8, [0x000204b0]
not rcx
lea rdx, [rcx - 1]
mov rcx, r12
call fcn.00011494
mov rdx, rax
test rax, rax
je 0x15fb0
xor eax, eax
mov rdi, rdx
mov rcx, rsi
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
add rcx, r12
call fcn.0001f770
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call fcn.0001f770
jmp 0x15fca
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x40]
sub r12, rax
mov al, byte [rcx]
mov byte [r12 + rcx], al
inc rcx
test al, al
jne 0x15fbd
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
add ecx, 0x1ff
mov r13d, ecx
call fcn.00017d34
mov r12, rax
test rax, rax
je 0x16156
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.0001fc70
cmp ebp, 0xc8
jne 0x16023
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
lea r8, [0x000204c0]
not rcx
lea r9d, [rcx + 0x4f]
jmp 0x1610b
cmp ebp, 0xc9
jne 0x1604b
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
lea r8, [0x00020590]
not rcx
lea r9d, [rcx + 0xee]
jmp 0x1610b
cmp ebp, 0xca
jne 0x16073
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
lea r8, [0x00020700]
not rcx
lea r9d, [rcx + 0xee]
jmp 0x1610b
cmp ebp, 0xcc
jne 0x16095
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
lea r8, [0x00020870]
not rcx
lea r9d, [rcx + 0x4f]
jmp 0x1610b
cmp ebp, 0x12e
jne 0x160ba
lea r8, [0x00020940]
mov r9, rbx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe__snprintf]
jmp 0x1611c
cmp ebp, 0x12f
jne 0x160da
lea r8, [0x00020990]
mov r9, rbx
mov rdx, r13
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__snprintf]
jmp 0x1611c
cmp ebp, 0xd3
jne 0x160eb
lea r8, [0x000209c0]
jmp 0x160fa
cmp ebp, 0xd4
jne 0x1611c
lea r8, [0x00020a80]
mov rcx, rsi
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe__snprintf]
xor eax, eax
mov qword [r14], r12
mov rcx, rsi
mov rdi, r12
mov edx, 0x4d784b5f
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x16156
mov qword [rdx], rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx - 1]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0001f710
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret