Function at 0x180095820
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x18011e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r8
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov r8d, 0x30
lea rdx, [rsp + 0x38]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180095b6c
mov ecx, dword [rsp + 0x5c]
test cl, 0xee
sete al
test ecx, 0x101
movzx ecx, al
mov eax, 1
cmovne ecx, eax
test cl, cl
jne 0x180095b6c
mov r12, qword [rbx + 8]
sub r12, qword [rbx]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r15d, 0
mov r14d, r15d
mov qword [rsp + 0x48], r15
je 0x1800958fb
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.180002e40
mov r8, r12
xor edx, edx
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
add r12, rsi
mov qword [rsp + 0x40], r12
mov r14, qword [rsp + 0x48]
jmp 0x180095905
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r8, qword [rbx + 8]
sub r8, qword [rbx]
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
sub r12, rsi
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
mov qword [rsp + 0x68], rax
cmp r12, rax
jne 0x180095a28
mov r8, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180095a23
cmp qword [rdi + 0x10], 0
je 0x180095996
mov ecx, dword [0x180146108]
cmp dword [0x180148698], ecx
cmovg ecx, dword [0x180148698]
test ecx, ecx
js 0x180095996
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180095970
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.Instruction_for__s_at_instructionAddr:__p_is_already_equal_to_the_desired_value__no_overwrite_needed.
mov r8d, 0x8b
lea rdx, str.C:UsersTOTOMAN2_source_reposNewColussus_Qols_ModMemHelperMemHelper.cpp
xor ecx, ecx
call fcn.1800a9a60
nop
test rsi, rsi
je 0x1800959cf
sub r14, rsi
mov rax, rsi
cmp r14, 0x1000
jb 0x1800959c3
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180095ae5
mov rdx, r14
mov rcx, rsi
call fcn.1800ac554
nop
mov rcx, rdi
call fcn.180002f60
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180095a1c
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180095a0c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180095b65
mov rcx, r8
call fcn.1800ac554
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x180095c08
mov rax, qword [rsp + 0x68]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp qword [rdi + 0x10], 0
je 0x180095abc
mov ecx, dword [0x180146108]
cmp dword [0x180148698], ecx
cmovg ecx, dword [0x180148698]
test ecx, ecx
js 0x180095abc
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180095a96
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.Successfully_overwritten_Instruction_for__s_at_instructionAddr:__p
mov r8d, 0x9b
lea rdx, str.C:UsersTOTOMAN2_source_reposNewColussus_Qols_ModMemHelperMemHelper.cpp
xor ecx, ecx
call fcn.1800a9a60
nop
test rsi, rsi
je 0x180095af8
sub r14, rsi
mov rax, rsi
cmp r14, 0x1000
jb 0x180095aec
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180095aec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rsi
call fcn.1800ac554
nop
mov rcx, rdi
call fcn.180002f60
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180095b41
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180095b31
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180095b65
mov rcx, r8
call fcn.1800ac554
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x180095c08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, dword [0x180146108]
cmp dword [0x180148698], ecx
cmovg ecx, dword [0x180148698]
cmp ecx, 0xfffffffe
jl 0x180095bba
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180095b91
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.overwriteInstruction:__s_:can_not_overwrite_cause_instructionAddr_is_a_bad_ptr:__p
mov r8d, 0x7f
lea rdx, str.C:UsersTOTOMAN2_source_reposNewColussus_Qols_ModMemHelperMemHelper.cpp
mov ecx, 0xfffffffe
call fcn.1800a9a60
nop
mov rcx, rdi
call fcn.180002f60
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180095c06
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180095bf3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180095c2b
mov rcx, r8
call fcn.1800ac554
xor r15d, r15d
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800ac180
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3