Function at 0x10001ee7
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10094040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1009722c], eax
je 0x10001f12
mov eax, 0x10dd
jmp 0x1000217e
mov eax, dword [0x10097228]
test eax, eax
jne 0x1000217e
mov ecx, dword [0x10094098]
test ecx, ecx
jne 0x10001f40
push 6
pop eax
mov dword [0x10097228], eax
mov dword [0x10097234], 0x10094098
jmp 0x1000217e
push ebx
push edi
mov ebx, esi
mov edi, esi
call fcn.10001a62
mov ecx, 0x1000d61f
mov dword [ebp - 0x14], eax
call fcn.10001a62
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x14]
jne 0x10001f71
cmp dword [0x10097198], ebx
jne 0x10002170
jmp 0x10002151
push 0x18
call fcn.10073a0d
pop ecx
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dword [ebp - 0x34], edi
call fcn.1000193a
mov ebx, eax
test ebx, ebx
jne 0x10001f94
push 8
pop esi
jmp 0x10002151
mov edi, dword [ebp - 0x14]
lea eax, [ebx + 0x38]
mov dword [eax], esi
mov ecx, ebx
mov dword [eax + 4], esi
mov edx, edi
mov dword [ebp - 0x28], eax
lea eax, [ebx + 0x1e]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], esi
jmp 0x10001fb7
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x2c], edx
push eax
push esi
push edx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
push ecx
call fcn.10073990
mov ecx, dword [ebp - 0x18]
mov edx, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x2c]
add eax, edx
mov dword [ebp - 0x30], edx
add ecx, eax
sub edx, edi
mov dword [ebp - 0x18], ecx
mov al, dl
sub cl, bl
mov dword [ebp - 0x20], edx
shl cl, 3
and al, 7
or cl, al
mov eax, dword [ebp - 0x28]
mov byte [eax], cl
mov ecx, dword [ebp - 0x1c]
inc ecx
inc eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], eax
cmp ecx, 8
jae 0x1000205e
mov ecx, dword [ebp - 0x2c]
mov al, byte [ecx]
cmp al, 0xeb
je 0x1000205e
cmp al, 0xe9
je 0x1000205e
cmp al, 0xe0
je 0x1000205e
cmp al, 0xc2
je 0x1000205e
cmp al, 0xc3
je 0x1000205e
cmp al, 0xcc
je 0x1000205e
cmp al, 0xf3
jne 0x10002089
cmp byte [ecx + 1], 0xc3
je 0x1000205e
cmp al, 0x26
je 0x10002046
cmp al, 0x2e
je 0x10002046
cmp al, 0x36
je 0x10002046
cmp al, 0x3e
je 0x10002046
cmp al, 0x64
je 0x10002046
cmp al, 0x65
jne 0x10002052
cmp byte [ecx + 1], 0xff
jne 0x10002052
cmp byte [ecx + 2], 0x25
je 0x1000205e
mov ecx, dword [ebp - 0x18]
cmp edx, 5
jb 0x10001fb4
mov edi, dword [ebp - 0x34]
cmp edx, 5
jae 0x10002093
mov ecx, dword [ebp - 0x30]
call fcn.10001561
test eax, eax
je 0x10002145
add ecx, eax
mov eax, dword [ebp - 0x14]
mov edx, ecx
sub edx, eax
mov dword [ebp - 0x20], edx
cmp edx, 5
jb 0x10002069
jmp 0x10002096
cmp al, 0xff
jne 0x1000202e
cmp byte [ecx + 1], 0x25
jmp 0x10002050
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], 8
ja 0x10002145
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0xc]
jbe 0x100020a9
int3
push edx
push eax
lea eax, [ebx + 0x20]
mov byte [ebx + 0x36], dl
sub cl, bl
push eax
mov byte [ebx + 0x1e], cl
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x19
jbe 0x100020ce
push 6
jmp 0x10001f8e
movzx ecx, byte [ebx + 0x1e]
mov edx, dword [ebp - 0x14]
add ecx, ebx
add edx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x40], edx
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub edx, eax
mov dword [ecx + 1], edx
add ecx, 5
mov edx, dword [ebp - 0xc]
call fcn.100014bf
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x40
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000211b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002151
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc], eax
mov dword [edi + 4], esi
mov dword [edi + 8], 0x10094098
mov dword [edi + 0x10], ebx
mov eax, dword [ebp - 8]
mov dword [edi + 0x14], eax
mov eax, dword [0x10097240]
mov dword [edi], eax
xor eax, eax
mov dword [0x10097240], edi
jmp 0x1000217c
cmp dword [0x10097198], 0
push 9
pop esi
jne 0x1000215b
mov dword [0x10097228], esi
test ebx, ebx
je 0x10002162
mov ecx, ebx
call fcn.10001a3f
test edi, edi
je 0x10002170
push 0x18
push edi
call fcn.10073a3d
pop ecx
pop ecx
mov dword [0x10097234], 0x10094098
mov eax, esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100739ff
leave
ret 0xc