Function at 0x14000160c
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x1400121b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], r8
mov r13, rdx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x30], r9
lea rcx, [rsp + 0x40]
xor r14d, r14d
call fcn.14000e840
mov r15d, dword [r13]
lea r11d, [r14 + 2]
mov edx, r15d
sub edx, r11d
je 0x1400016c8
sub edx, 1
je 0x1400016c8
sub edx, 1
je 0x1400016ad
sub edx, 1
je 0x1400016ad
cmp edx, 1
je 0x140001692
mov eax, 0xc000000d
jmp 0x140001887
mov r8, qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
lea rdi, [0x140010390]
mov edx, 0xf
mov r9d, 0x10b
jmp 0x1400016e1
mov r8, qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
lea rdi, [0x14001038c]
mov edx, 0xf
mov r9d, 0x9b
jmp 0x1400016e1
mov r8, qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
lea rdi, [0x140010388]
mov edx, 0x20
mov r9d, 0xc3
mov ebp, 3
lea r12d, [rbp + 4]
test r8, r8
je 0x140001882
test rdx, rdx
je 0x140001882
xor r10d, r10d
test rdx, rdx
je 0x140001882
lea rcx, [0x140000000]
xor ebx, ebx
mov sil, byte [rbx + rcx + 0x103a0]
cmp sil, 0xcc
je 0x140001734
lea eax, [rbx + r10]
cmp sil, byte [rax + r8]
jne 0x140001873
lea rcx, [0x140000000]
inc ebx
mov dword [rsp + 0x20], r14d
cmp ebx, 1
jb 0x140001711
mov ecx, r10d
inc rcx
add rcx, r8
je 0x140001882
movsxd rax, dword [rcx]
mov ecx, r10d
lea r10, [rax + 5]
add r10, r8
add r10, rcx
test rdi, rdi
je 0x140001882
test r10, r10
je 0x140001882
test r9, r9
je 0x140001882
xor edx, edx
test r9, r9
je 0x140001882
xor r8d, r8d
xor eax, eax
mov bl, byte [rax + rdi]
cmp bl, 0xcc
je 0x1400017a0
lea eax, [r8 + rdx]
cmp bl, byte [rax + r10]
jne 0x1400018b8
inc r8d
mov eax, r8d
cmp rax, r11
jb 0x14000178a
mov eax, edx
add rax, rbp
add rax, r10
je 0x140001882
movsxd rax, dword [rax]
add rax, r10
mov r14d, edx
add r14, rax
test r9, r9
je 0x140001882
xor edx, edx
test r9, r9
je 0x140001882
lea rbx, [0x140000000]
xor r8d, r8d
mov r11b, byte [r8 + rbx + 0x103a4]
cmp r11b, 0xcc
je 0x1400017ff
lea eax, [r8 + rdx]
cmp r11b, byte [rax + r10]
jne 0x1400018c7
inc r8d
cmp r8d, 3
jb 0x1400017e3
mov ecx, edx
add rcx, 3
add rcx, r10
je 0x140001882
mov r8d, 0xb
cmp r15d, 3
je 0x14000182a
cmp r15d, 5
cmove r12, r8
mov r8, r12
movsxd rcx, dword [rcx]
xor edi, edi
mov r15, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov eax, edx
add rax, r8
add rcx, rax
mov esi, dword [rcx + r10]
test esi, esi
je 0x140001953
xor ebx, ebx
mov rax, qword [r14 + rdi*8 + 7]
and rax, 0xfffffffffffffff8
test r12, r12
je 0x1400018d6
test r15, r15
je 0x1400018d6
cmp qword [rax], r12
jne 0x14000191a
mov qword [rax], r15
jmp 0x14000191a
inc r10d
mov eax, r10d
cmp rax, rdx
jb 0x140001708
mov eax, 0xc0000225
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000e560
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc edx
mov eax, edx
cmp rax, r9
jb 0x140001785
jmp 0x140001882
inc edx
mov eax, edx
cmp rax, r9
jb 0x1400017e0
jmp 0x140001882
mov rcx, qword [r13 + 8]
lea r8, [rsp + 0x40]
mov rax, qword [rax]
mov qword [rbx + rcx], rax
mov rdx, qword [r13 + 8]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rbx + rdx]
call fcn.140001cb0
test eax, eax
js 0x14000191a
mov rcx, qword [r13 + 8]
lea r8, [rsp + 0x40]
add rcx, 8
mov edx, 0x100
add rcx, rbx
call sub.ntoskrnl.exe_strcpy_s
test eax, eax
jne 0x14000194c
inc rdi
add rbx, 0x108
cmp rdi, rsi
jb 0x14000184f
mov eax, dword [rsp + 0x20]
test r12, r12
jne 0x140001887
test r15, r15
jne 0x140001887
mov dword [r13 + 4], esi
jmp 0x140001887
mov eax, 0x80
jmp 0x140001931
mov eax, edi
jmp 0x140001931