Function at 0x10101300
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x18
push ebx
push ebp
push esi
xor esi, esi
test eax, eax
je 0x10101312
mov dword [eax], esi
mov ebx, dword [esp + 0x34]
test ebx, ebx
je 0x1010131c
mov dword [ebx], esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x10101326
mov dword [eax], esi
mov ebp, dword [esp + 0x2c]
test ebp, ebp
jne 0x1010133a
pop esi
lea eax, [ebp + 0x57]
pop ebp
pop ebx
add esp, 0x18
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10320e8c], eax
je 0x10101356
pop esi
pop ebp
mov eax, 0x10dd
pop ebx
add esp, 0x18
ret 0x14
mov eax, dword [0x10320e88]
test eax, eax
jne 0x101016ef
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x10101379
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x18
ret 0x14
push edi
mov edi, dword [eax]
test edi, edi
jne 0x1010139c
mov dword [0x10320e94], eax
lea eax, [edi + 6]
pop edi
pop esi
pop ebp
mov dword [0x10320e88], 6
pop ebx
add esp, 0x18
ret 0x14
xor eax, eax
mov dword [esp + 0x38], esi
cmp byte [edi], 0xff
mov dword [esp + 0x10], eax
jne 0x101013cb
cmp byte [edi + 1], 0x25
jne 0x101013cb
mov eax, dword [edi + 2]
mov ecx, edi
mov edx, eax
mov dword [esp + 0x30], eax
call fcn.10102290
test al, al
je 0x101013cb
mov edi, dword [esp + 0x30]
mov edi, dword [edi]
cmp byte [edi], 0xeb
jne 0x1010140d
movsx eax, byte [edi + 1]
add edi, 2
add edi, eax
mov al, byte [edi]
cmp al, 0xff
jne 0x10101401
cmp byte [edi + 1], 0x25
jne 0x10101401
mov eax, dword [edi + 2]
mov ecx, edi
mov edx, eax
mov dword [esp + 0x30], eax
call fcn.10102290
test al, al
je 0x1010140d
mov edi, dword [esp + 0x30]
mov edi, dword [edi]
jmp 0x1010140d
cmp al, 0xe9
jne 0x1010140d
mov eax, dword [edi + 1]
add edi, 5
add edi, eax
cmp byte [ebp], 0xff
jne 0x10101434
cmp byte [ebp + 1], 0x25
jne 0x10101434
mov eax, dword [ebp + 2]
mov ecx, ebp
mov edx, eax
mov dword [esp + 0x30], eax
call fcn.10102290
test al, al
je 0x10101434
mov ebp, dword [esp + 0x30]
mov ebp, dword [ebp]
cmp byte [ebp], 0xeb
jne 0x10101479
movsx eax, byte [ebp + 1]
add ebp, 2
add ebp, eax
mov al, byte [ebp]
cmp al, 0xff
jne 0x1010146d
cmp byte [ebp + 1], 0x25
jne 0x1010146d
mov eax, dword [ebp + 2]
mov ecx, ebp
mov edx, eax
mov dword [esp + 0x30], eax
call fcn.10102290
test al, al
je 0x10101479
mov ebp, dword [esp + 0x30]
mov ebp, dword [ebp]
jmp 0x10101479
cmp al, 0xe9
jne 0x10101479
mov eax, dword [ebp + 1]
add ebp, 5
add ebp, eax
cmp ebp, edi
jne 0x1010148e
cmp dword [0x10320ea4], esi
jne 0x101016e3
jmp 0x101016ad
test ebx, ebx
je 0x10101494
mov dword [ebx], edi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1010149e
mov dword [eax], ebp
push 0x18
call fcn.1006e6a7
add esp, 4
mov dword [esp + 0x10], eax
mov ecx, edi
call fcn.10101da0
mov dword [esp + 0x38], eax
test eax, eax
jne 0x101014c3
lea esi, [eax + 8]
jmp 0x101016ad
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x101014cd
mov dword [ecx], eax
lea ecx, [eax + 0x38]
mov ebx, eax
add eax, 0x1e
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
xor eax, eax
movq qword [ecx], xmm0
mov edx, edi
mov dword [esp + 0x3c], eax
nop dword [eax]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
push edx
lea eax, [esp + 0x3c]
mov esi, edx
push eax
push ebx
call sym.WMCommon.dll__DetourCopyInstruction_20
mov edx, eax
mov eax, dword [esp + 0x14]
sub eax, esi
mov dword [esp + 0x20], edx
add eax, edx
add ebx, eax
mov dword [esp + 0x30], ebx
mov ebx, edx
mov cl, byte [esp + 0x30]
sub ebx, edi
sub cl, byte [esp + 0x38]
mov al, bl
mov edx, dword [esp + 0x1c]
and al, 7
shl cl, 3
or cl, al
mov eax, dword [esp + 0x3c]
mov byte [edx + eax], cl
inc eax
mov edx, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
cmp eax, 8
jae 0x101015af
mov al, byte [esi]
cmp al, 0xeb
je 0x101015af
cmp al, 0xe9
je 0x101015af
cmp al, 0xe0
je 0x101015af
cmp al, 0xc2
je 0x101015af
cmp al, 0xc3
je 0x101015af
cmp al, 0xcc
je 0x101015af
cmp al, 0xf3
jne 0x10101573
cmp byte [esi + 1], 0xc3
je 0x101015af
cmp al, 0xff
jne 0x1010157d
cmp byte [esi + 1], 0x25
je 0x101015af
cmp al, 0x26
je 0x10101595
cmp al, 0x2e
je 0x10101595
cmp al, 0x36
je 0x10101595
cmp al, 0x3e
je 0x10101595
cmp al, 0x64
je 0x10101595
cmp al, 0x65
jne 0x101015a1
cmp byte [esi + 1], 0xff
jne 0x101015a1
cmp byte [esi + 2], 0x25
je 0x101015af
cmp ebx, 5
jae 0x101015d5
mov ebx, dword [esp + 0x30]
jmp 0x101014f0
cmp ebx, 5
jae 0x101015d5
mov ecx, edx
call fcn.10056ba0
test eax, eax
je 0x101015cc
add edx, eax
mov ebx, edx
sub ebx, edi
cmp ebx, 5
jb 0x101015b4
jmp 0x101015d5
cmp ebx, 5
jb 0x1010169f
cmp dword [esp + 0x3c], 8
ja 0x1010169f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jbe 0x101015ed
int3
mov eax, dword [esp + 0x38]
sub cl, al
push ebx
push edi
mov byte [edx], cl
mov byte [eax + 0x36], bl
add eax, 0x20
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp ebx, 0x19
jbe 0x10101615
mov esi, 6
jmp 0x101016ad
mov eax, dword [esp + 0x38]
lea esi, [edi + ebx]
movzx ecx, byte [eax + 0x1e]
lea edx, [eax + 0x1e]
add ecx, eax
mov dword [eax + 0x40], esi
mov dword [eax + 0x44], ebp
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub esi, eax
mov dword [ecx + 1], esi
add ecx, 5
call fcn.10056b60
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10101663
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x101016ad
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0
mov eax, dword [esp + 0x14]
pop esi
mov dword [ecx + 0x14], eax
mov eax, dword [0x10320ea8]
pop ebp
mov dword [ecx], eax
xor eax, eax
mov dword [0x10320ea8], ecx
pop ebx
add esp, 0x18
ret 0x14
cmp dword [0x10320ea4], 0
mov esi, 9
jne 0x101016b3
mov dword [0x10320e88], esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x101016d0
mov ecx, eax
call fcn.10101d70
mov eax, dword [esp + 0x34]
test eax, eax
je 0x101016d0
mov dword [eax], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x101016e3
push 0x18
push eax
call fcn.1006e6d7
add esp, 8
mov eax, dword [esp + 0x2c]
mov dword [0x10320e94], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x14