Function at 0x180001a60
Capabilities:
Allocate or change rwx memory
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x180026010]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov qword [rsp + 0x38], rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov word [rsp + 0x30], 0xb848
mov word [rsp + 0x34], 0xe0ff
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
call fcn.180002c30
mov qword [rbp + 8], rax
mov rcx, qword [rsp + 0x38]
movsxd rax, dword [rcx + 0x3c]
xor r12d, r12d
cmp dword [rax + rcx + 0x8c], r12d
je 0x180002257
mov r13d, dword [rax + rcx + 0x88]
add r13, rcx
mov qword [rsp + 0x58], r13
mov esi, dword [r13 + 0x20]
add rsi, rcx
mov r14d, dword [r13 + 0x1c]
add r14, rcx
mov r15d, dword [r13 + 0x24]
add r15, rcx
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx + 0x8c], r12d
je 0x180002257
mov eax, dword [rax + rbx + 0x88]
add rax, rbx
mov qword [rsp + 0x48], rax
mov edi, r12d
cmp dword [r13 + 0x18], r12d
jbe 0x180001c8a
nop word [rax + rax]
mov ebx, edi
mov edx, dword [rsi + rbx*4]
add rdx, rcx
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180001b60
lea rcx, [rbp + 0x18]
call fcn.180002420
nop
cmp qword [rbp + 0x28], 0
jne 0x180001bbe
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x180001c78
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800022ac
jmp 0x180001c73
movzx eax, word [r15 + rbx*2]
mov ebx, dword [r14 + rax*4]
add rbx, qword [rsp + 0x38]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x28]
call fcn.180002350
mov qword [rbp - 8], rbx
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 8]
call fcn.180002d20
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 8]
call fcn.180002d70
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x180001c3d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001c37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800022b2
call fcn.180003eb4
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x180001c78
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800022b8
call fcn.180003eb4
inc edi
cmp edi, dword [r13 + 0x18]
jae 0x180001c8a
mov rcx, qword [rsp + 0x38]
jmp 0x180001b40
mov rbx, qword gs:[0x60]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x40]
call fcn.180006530
lea r14, [rbp + 0x40]
mov qword [rbp - 0x78], r14
mov r8d, 0x104
lea rdx, [rbp + 0x40]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, r12d
movzx eax, byte [rbp + 0x40]
test al, al
je 0x180001cf3
nop
cmp al, 0x5c
je 0x180001cd8
cmp al, 0x2f
jne 0x180001ce2
lea ecx, [rdx + 1]
lea r14, [rbp + 0x40]
add r14, rcx
inc edx
mov eax, edx
movzx eax, byte [rbp + rdx + 0x40]
test al, al
jne 0x180001cd0
mov qword [rbp - 0x78], r14
mov r15, qword [rbx + 0x18]
add r15, 0x20
mov qword [rsp + 0x60], r15
mov rsi, qword [r15]
mov qword [rbp - 0x80], rsi
cmp rsi, r15
je 0x180001fc9
mov rdi, qword [rsi + 0x20]
mov qword [rsp + 0x70], rdi
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov qword [rsp + 0x68], rax
cmp dword [rax + 0xec], 0
je 0x180001faf
cmp dword [rax + 0x94], 0
je 0x180001faf
mov ebx, dword [rax + 0x90]
add rbx, rdi
mov ecx, dword [rax + 0xe8]
add rcx, rdi
mov qword [rbp - 0x70], rcx
mov dword [rbp + 4], r12d
mov edx, dword [rax + 0xec]
lea r9, [rbp + 4]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002257
cmp dword [rbx], 0
je 0x180001f8a
mov edx, dword [rbx + 0xc]
add rdx, rdi
mov rcx, r14
call fcn.180008e24
test eax, eax
je 0x180001da0
add rbx, 0x14
cmp dword [rbx], 0
jne 0x180001d80
jmp 0x180001f8a
mov eax, dword [rbx + 0x10]
add rax, rdi
mov qword [rsp + 0x50], rax
mov eax, dword [rbx]
add rax, rdi
mov qword [rsp + 0x78], rax
mov rax, qword [rax]
test rax, rax
je 0x180001f8a
jns 0x180001dd5
lea rcx, str._____Ordinal_import_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x180001f61
add rax, 2
add rax, rdi
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180001e00
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.180002420
mov r12, qword [rbp + 8]
mov rbx, r12
mov rdi, qword [r12 + 8]
mov r13, qword [rbp - 0x48]
mov r15, qword [rbp - 0x60]
cmp byte [rdi + 0x19], 0
jne 0x180001ef3
mov r14, qword [rbp - 0x50]
xor r12d, r12d
nop dword [rax + rax]
lea rdx, [rbp - 0x60]
cmp r13, 0x10
cmovae rdx, r15
lea rcx, [rdi + 0x20]
cmp qword [rdi + 0x38], 0x10
jb 0x180001e5b
mov rcx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x30]
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
call fcn.180006c20
test eax, eax
jne 0x180001e84
cmp rsi, r14
jae 0x180001e7e
mov eax, 0xffffffff
jmp 0x180001e84
mov eax, r12d
seta al
shr eax, 0x1f
test al, al
je 0x180001e91
mov rdi, qword [rdi + 0x10]
jmp 0x180001e97
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], r12b
je 0x180001e40
mov r12, qword [rbp + 8]
cmp rbx, r12
je 0x180001ef3
lea rdx, [rbx + 0x20]
cmp qword [rbx + 0x38], 0x10
jb 0x180001eb5
mov rdx, qword [rbx + 0x20]
lea rcx, [rbp - 0x60]
cmp r13, 0x10
cmovae rcx, r15
mov rdi, qword [rbx + 0x30]
mov r8, r14
cmp rdi, r14
cmovb r8, rdi
call fcn.180006c20
test eax, eax
jne 0x180001eec
cmp r14, rdi
jae 0x180001ee4
mov eax, 0xffffffff
jmp 0x180001eec
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
test al, al
je 0x180001ef6
mov rbx, r12
cmp r13, 0x10
jb 0x180001f31
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x180001f25
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800022a6
mov rcx, r15
call fcn.180003eb4
mov r12, qword [rbp + 8]
cmp rbx, r12
je 0x180001f59
lea rcx, str.___Patching_IAT_for:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbx + 0x40]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rax
mov rdi, qword [rsp + 0x70]
xor r12d, r12d
mov rcx, qword [rsp + 0x78]
add rcx, 8
mov qword [rsp + 0x78], rcx
add qword [rsp + 0x50], 8
mov rax, qword [rcx]
test rax, rax
jne 0x180001dc1
mov rsi, qword [rbp - 0x80]
mov r15, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov edx, dword [rax + 0xec]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002257
mov rsi, qword [rsi]
mov qword [rbp - 0x80], rsi
cmp rsi, r15
je 0x180001fc4
mov r14, qword [rbp - 0x78]
jmp 0x180001d10
mov rdi, qword [rsp + 0x40]
mov dword [rbp], r12d
lea r9, [rbp]
mov edx, 0x40
lea r8d, [rdx - 0x3c]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002257
mov rsi, qword [rsp + 0x58]
mov ecx, dword [rsi + 0x14]
mov r8d, ecx
shl r8d, 4
mov edx, dword [rsi + 0x20]
mov r14, qword [rsp + 0x38]
add rdx, r14
mov qword [rbp - 0x70], rdx
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x18000204f
mov r9d, eax
nop word [rax + rax]
movsxd rcx, dword [rdx]
add rcx, r14
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180002030
inc r8d
add r8d, eax
add rdx, 4
sub r9, 1
jne 0x180002020
mov eax, dword [rsi + 0x18]
mov ecx, dword [rsi + 0x14]
lea eax, [rcx + rax*2]
lea ecx, [r8 + rax*2]
movsxd rax, dword [rdi + 0x3c]
mov ebx, dword [rax + rdi + 0x50]
add rbx, rdi
mov edi, 0xffffffff
add rdi, rbx
cmp rbx, rdi
jae 0x180002257
mov r13d, ecx
mov qword [rsp + 0x60], r13
nop word [rax + rax]
mov r9d, 4
mov r8d, 0x3000
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1800020b6
add rbx, 0x2000
cmp rbx, rdi
jb 0x180002080
jmp 0x180002257
mov r8, r13
xor edx, edx
mov rcx, r15
call fcn.180006530
mov r8d, dword [rsi + 0x14]
shl r8, 2
mov edx, dword [rsi + 0x20]
add rdx, r14
mov rcx, r15
call fcn.180006750
mov eax, dword [rsi + 0x14]
lea rdi, [r15 + rax*4]
mov eax, r15d
mov rbx, qword [rsp + 0x40]
sub eax, ebx
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x1c], eax
mov r10d, dword [rsi + 0x1c]
add r10, r14
mov r9d, r12d
cmp dword [rsi + 0x14], 0
jbe 0x180002142
movzx eax, word [rsp + 0x30]
movzx ecx, word [rsp + 0x34]
nop dword [rax]
mov edx, r9d
lea r8, [rdx*4]
mov edx, edi
sub edx, ebx
mov dword [r8 + r15], edx
mov word [rdi], ax
movsxd rdx, dword [r8 + r10]
add rdx, r14
mov qword [rdi + 2], rdx
mov word [rdi + 0xa], cx
add rdi, 0xc
inc r9d
cmp r9d, dword [rsi + 0x14]
jb 0x180002110
mov r8d, dword [rsi + 0x18]
shl r8, 2
mov edx, dword [rsi + 0x20]
add rdx, r14
mov rcx, rdi
call fcn.180006750
mov eax, dword [rsi + 0x18]
lea rsi, [rdi + rax*4]
mov eax, edi
sub eax, ebx
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x20], eax
mov r14d, r12d
mov rbx, qword [rsp + 0x58]
cmp dword [rbx + 0x18], 0
jbe 0x1800021f1
mov r13, qword [rbp - 0x70]
mov r15, qword [rsp + 0x38]
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
lea r12, [rax*4]
movsxd rdx, dword [r12 + r13]
add rdx, r15
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1800021b0
mov ebx, eax
mov r8d, eax
mov rcx, rsi
call fcn.180006750
mov eax, esi
sub eax, dword [rsp + 0x40]
mov dword [r12 + rdi], eax
inc rbx
add rsi, rbx
inc r14d
mov rbx, qword [rsp + 0x58]
cmp r14d, dword [rbx + 0x18]
jb 0x180002190
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
xor r12d, r12d
mov r8d, dword [rbx + 0x14]
add r8, r8
mov edx, dword [rbx + 0x24]
add rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.180006750
sub esi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x24], esi
mov eax, dword [rbx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rbx + 0x18]
mov dword [rcx + 0x18], eax
lea r9, [rbp]
mov r8d, dword [rbp]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002257
lea r9, [rbp]
mov r8d, 0x20
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002257
mov r12d, 1
mov r9, qword [rbp + 8]
mov r8, qword [r9]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 8]
call fcn.180002580
mov edx, 0x48
mov rcx, qword [rbp + 8]
call fcn.180003eb4
mov eax, r12d
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180003e90
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180008d70
nop
call fcn.180008d70
nop
call fcn.180008d70
nop
call fcn.180008d70
int3