Function at 0x1006e240
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cb797
push eax
mov dword fs:[0], esp
sub esp, 0x4b4
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
jne 0x1006e288
push str.Aborting_HookFunc_because_pRealFunctionAddr_is_null_n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
jne 0x1006e2ae
push str.Aborting_HookFunc_because_pHookFunctionAddr_is_null_n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call fcn.1006f1a0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
test ecx, ecx
jle 0x1006e2f2
lea esp, [esp]
mov dl, byte [ebx]
cmp dl, 0xeb
jne 0x1006e2e0
movsx eax, byte [ebx + 1]
add ebx, 2
jmp 0x1006e2eb
cmp dl, 0xe9
jne 0x1006e2f2
mov eax, dword [ebx + 1]
add ebx, 5
dec ecx
add ebx, eax
test ecx, ecx
jg 0x1006e2d0
push 5
push ebx
call fcn.1006df60
add esp, 8
test al, al
jne 0x1006e30f
push ebx
push str.Warning:_hook_target_starting_at__p_covers_a_non_executable_page_n
call fcn.10081660
add esp, 8
cmp byte [ebx], 0xeb
jne 0x1006e335
push ebx
push str.Warning:_hook_target_starting_at__p_begins_with_uncoditional_2_byte_jump__skipping_n
call fcn.10081660
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x24], 0xe9
mov edi, ebx
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.10073450
add esp, 0xc
test al, al
je 0x1006e8dd
cmp byte [ebp - 0xd], 0
je 0x1006e381
mov cl, byte [edi]
cmp cl, 0xcc
je 0x1006e381
cmp cl, 0x90
je 0x1006e381
push ebx
push str.Warning:_hook_target_starting_at__p_contains_early_RET_n
call fcn.10081660
add esp, 8
xor al, al
mov cl, byte [edi]
cmp cl, 0xc3
je 0x1006e38d
cmp cl, 0xc2
jne 0x1006e391
mov byte [ebp - 0xd], 1
test al, al
je 0x1006e8dd
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x1006e3b8
cmp eax, 1
je 0x1006e3b8
cmp eax, 2
je 0x1006e3b8
cmp eax, 4
je 0x1006e3b8
cmp eax, 3
jne 0x1006e8dd
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 0x14]
push esi
add eax, ecx
push edi
push eax
call fcn.100a37a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, esi
add edi, esi
mov dword [ebp - 0x14], eax
cmp eax, 5
jb 0x1006e346
cmp eax, 0x30
jle 0x1006e406
push str.Copied_more_than_MAX_HOOKED_FUNCTION_PREAMBLE_LENGTH_bytes_to_make_room_for_E9_jmp_of_5_bytes___Bad_opcode_parsing__n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.1006e170
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1006e44c
push ebx
call fcn.1006da80
push ebx
call fcn.1006e170
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1006e44c
push str.Error_allocating_trampoline_memory__no_memory_within___2gb__prior_failures___n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
lea esi, [ebp - 0x70]
lea edi, [ebp - 0xac]
mov dword [ecx], eax
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
test esi, esi
jle 0x1006e553
mov edi, edi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
add eax, edi
push ecx
push eax
call fcn.10073450
add esp, 0xc
test al, al
je 0x1006e685
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1006e4cd
cmp eax, 1
je 0x1006e4cd
cmp eax, 2
je 0x1006e4cd
cmp eax, 4
je switch.0x1006e4d6
cmp eax, 3
jne 0x1006e685
cmp eax, 4
ja case.default.0x1006e4d6
jmp dword [eax*4 + 0x1006ead8]
lea ecx, [ebp - 0x6e]
jmp 0x1006e540
lea ecx, [ebp - 0x6d]
jmp 0x1006e540
mov al, byte [ebp + edi - 0x70]
cmp al, 0xeb
jne 0x1006e640
cmp dword [ebp - 0x14], 2
jne 0x1006e640
cmp esi, 0x2d
jg 0x1006e620
mov eax, esi
mov byte [ebp + edi - 0x70], 0xe9
sub eax, edi
sub eax, 2
push eax
lea eax, [ebp - 0x6e]
add eax, edi
push eax
lea eax, [ebp - 0x6b]
add eax, edi
push eax
call fcn.100a37a0
movsx eax, byte [ebp + edi - 0x6f]
add esp, 0xc
sub eax, 3
mov dword [ebp - 0x14], 5
mov dword [ebp + edi - 0x6f], eax
add esi, 3
lea ecx, [ebp - 0x6f]
mov eax, ebx
sub eax, dword [ebp - 0x1c]
add dword [edi + ecx], eax
add edi, dword [ebp - 0x14]
cmp edi, esi
jl 0x1006e490
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x70]
push esi
push eax
push edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xb8], edi
call fcn.100a37a0
add edi, esi
add esp, 0xc
sub esi, edi
lea eax, [esi - 5]
add eax, ebx
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov al, byte [ebp - 0x20]
mov byte [edi + 4], al
add edi, 5
mov eax, dword [ebp + 0xc]
mov esi, edi
sub eax, edi
mov dword [ebp - 0xb4], edi
sub eax, 5
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov al, byte [ebp - 0x20]
mov byte [edi + 4], al
add edi, 5
mov eax, dword [ebp - 0x1c]
sub edi, eax
push edi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
sub esi, ebx
sub esi, 5
mov dword [ebp - 0x23], esi
call fcn.1006e130
mov ecx, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov dword [ebp - 0x2c], 0
lea eax, [ebx + 4]
mov dword [ebp - 0x30], 0
div ecx
xor edx, edx
mov edi, eax
mov eax, ebx
div ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 1
push ebx
call esi
test eax, eax
jne 0x1006e70b
push str.Warning:_VirtualProtect_call_failed_during_hook_attempt_n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Cant_fixup_EB_jmp_because_there_isnt_enough_room_to_expand_to_E9_jmp_n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, al
push eax
push str.Opcode__x_of_type_k_EBYTEOffsetAtByteTwo_cant_be_converted_to_larger_relative_address_n
call fcn.10081660
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.Unknown_opcode_relative_offset_enum_value__d_n
call fcn.10081660
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [ebp - 0x5d]
push eax
movzx eax, byte [ebp - 0x5e]
push eax
movzx eax, byte [ebp - 0x5f]
push eax
movzx eax, byte [ebp - 0x60]
push eax
movzx eax, byte [ebp - 0x61]
push eax
movzx eax, byte [ebp - 0x62]
push eax
movzx eax, byte [ebp - 0x63]
push eax
movzx eax, byte [ebp - 0x64]
push eax
movzx eax, byte [ebp - 0x65]
push eax
movzx eax, byte [ebp - 0x66]
push eax
movzx eax, byte [ebp - 0x67]
mov ecx, dword [ebp - 0x6d]
push eax
movzx eax, byte [ebp - 0x68]
push eax
movzx eax, byte [ebp - 0x69]
push eax
movzx eax, byte [ebp - 0x6a]
push eax
movzx eax, byte [ebp - 0x6b]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [ebp - 0x6e]
push eax
movzx eax, byte [ebp - 0x6f]
push eax
movzx eax, byte [ebp - 0x70]
push eax
push edi
push str.Failed_parsing_copied_bytes_during_detour____shouldnt_happen_as_this_is_a_second_pass:_position__d_n_02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X_n
call fcn.10081660
add esp, 0x58
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], edi
je 0x1006e74e
lea eax, [ebp - 0x30]
push eax
push 0x40
push 1
lea eax, [ebx + 4]
push eax
call esi
test eax, eax
jne 0x1006e74e
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2c]
push 1
push ebx
call esi
push str.Warning:_VirtualProtect__2__call_failed_during_hook_attempt_n
call fcn.10081660
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 0xd], 0
mov dword [eax], ecx
lea eax, [ebp - 0x7c]
push eax
push 5
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1006e779
push str.WriteProcessMemory___call_failed_trying_to_overwrite_first_5_bytes_of_function_body_during_hook_n
jmp 0x1006e79b
mov eax, dword [ebp + 0x14]
push 5
push ebx
push dword [ebp - 0x18]
mov dword [eax], 0
mov byte [ebp - 0xd], 1
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1006e7a3
push str.FlushInstructionCache___call_failed_trying_to_overwrite_first_5_bytes_of_function_body_during_hook_n
call fcn.10081660
add esp, 4
cmp dword [ebp - 0x14], edi
je 0x1006e7d5
mov eax, dword [ebp - 0x30]
cmp eax, 0x40
je 0x1006e7d5
cmp eax, 0x80
je 0x1006e7d5
lea ecx, [ebp - 0x34]
push ecx
push eax
push 1
lea eax, [ebx + 4]
push eax
call esi
test eax, eax
jne 0x1006e7d5
push str.Warning:_VirtualProtect__2__call_failed_to_restore_protection_flags_during_hook_attempt_n
call fcn.10081660
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp eax, 0x40
je 0x1006e7ff
cmp eax, 0x80
je 0x1006e7ff
lea ecx, [ebp - 0x34]
push ecx
push eax
push 1
push ebx
call esi
test eax, eax
jne 0x1006e7ff
push str.Warning:_VirtualProtect_call_failed_to_restore_protection_flags_during_hook_attempt_n
call fcn.10081660
add esp, 4
mov bl, byte [ebp - 0xd]
test bl, bl
je 0x1006e8ca
push 0x10107afc
mov dword [ebp - 0x28], 0x10107afc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 3
push eax
mov ecx, 0x10107aec
mov dword [ebp + 8], esi
call fcn.1004f820
mov eax, dword [ebp - 0x38]
cmp byte [eax + 0xd], 0
jne 0x1006e849
cmp esi, dword [eax + 0x10]
jae 0x1006e8af
cmp dword [0x10107af0], 0x30c30c3
je 0x1006eacc
mov edi, dword [0x10107aec]
mov dword [ebp - 0x78], 0x10107aec
push 0x54
mov byte [ebp - 4], 4
mov dword [ebp - 0x74], 0
call fcn.100a19fe
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x40
push 0
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
push ecx
call fcn.100a3330
add esp, 0x10
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, 0x10107aec
mov dword [esi + 8], edi
mov word [esi + 0xc], 0
push esi
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.10050f60
lea edi, [eax + 0x14]
mov ecx, 0x10
lea esi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
push 0x10107afc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10107afc
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x1c], 0x10107afc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], ebx
push eax
mov ecx, 0x10107b30
call fcn.1004f820
mov eax, dword [ebp - 0x38]
mov esi, dword [0x10107b30]
cmp byte [eax + 0xd], 0
jne 0x1006e927
cmp ebx, dword [eax + 0x10]
jb 0x1006e927
cmp eax, esi
jne 0x1006e9a2
lea eax, [ebp - 0x18]
mov byte [ebp + 0xb], 0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], ebx
push eax
mov ecx, 0x10107b30
call fcn.1004f820
mov ecx, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], ecx
cmp byte [eax + 0xd], 0
jne 0x1006e956
cmp ebx, dword [eax + 0x10]
jae 0x1006e9a2
cmp dword [0x10107b34], 0xccccccc
je 0x1006ead1
mov dword [ebp - 0x3c], 0x10107b30
push 0x14
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0
call fcn.100a19fe
add esp, 4
mov ecx, 0x10107b30
mov dword [eax + 0x10], ebx
push eax
push dword [ebp - 0x18]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
push edi
mov word [eax + 0xc], 0
call fcn.10050f60
push 0x10107afc
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [ebx + 0xf]
push eax
movzx eax, byte [ebx + 0xe]
push eax
movzx eax, byte [ebx + 0xd]
push eax
movzx eax, byte [ebx + 0xc]
push eax
movzx eax, byte [ebx + 0xb]
push eax
movzx eax, byte [ebx + 0xa]
push eax
movzx eax, byte [ebx + 9]
push eax
movzx eax, byte [ebx + 8]
push eax
movzx eax, byte [ebx + 7]
push eax
movzx eax, byte [ebx + 6]
push eax
movzx eax, byte [ebx + 5]
push eax
movzx eax, byte [ebx + 4]
push eax
movzx eax, byte [ebx + 3]
push eax
movzx eax, byte [ebx + 2]
push eax
movzx eax, byte [ebx + 1]
push eax
movzx eax, byte [ebx]
push eax
mov eax, dword [ebp - 0x14]
push ebx
push eax
push 0x100d5a2c
push str.Unknown_opcodes_for__s_at__d_bytes_for_func__p:__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X_n
lea eax, [ebp - 0x4bc]
push 0x400
push eax
call fcn.10057be0
lea eax, [ebp - 0x4bc]
push eax
call fcn.10081660
add esp, 0x5c
cmp byte [ebp + 0xb], 0
jne 0x1006eab9
lea ecx, [ebp - 0x4bc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ea45
mov esi, dword [0x10107ae8]
sub ecx, edx
mov dword [ebp - 0x4c0], ecx
test esi, esi
jne 0x1006eaa7
push 0x13c
call fcn.100a19fe
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x1006ea92
push esi
push esi
push 0x32
push 0x8000
push str.GameOverlayRender_DetourErrorStream
mov ecx, eax
call fcn.10094970
mov esi, eax
jmp 0x1006ea94
xor esi, esi
mov ecx, dword [ebp - 0x4c0]
mov dword [ebp - 4], 0xffffffff
mov dword [0x10107ae8], esi
mov edx, dword [esi]
lea eax, [ecx + 4]
push eax
lea eax, [ebp - 0x4c0]
mov ecx, esi
push eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10051250
call fcn.10051250
mov edi, edi
dec eax
in eax, 6
adc byte [0xdd1006e5], bh
in al, 6
adc dl, ah
in al, 6
adc bh, ah
in al, 6
adc ah, cl
int3