Function at 0x10001820
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7610
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100d9180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x100efa08
call fcn.1004a51e
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
cmp ecx, eax
jge 0x10001ac3
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ecx*8]
test edi, edi
je 0x10001abd
cmp dword [edx + ecx*8 + 4], 0
je 0x10001abd
mov edi, dword [edi]
test edi, edi
je 0x100018ca
mov al, byte [edi]
cmp al, 0xff
jne 0x100018b5
cmp byte [edi + 1], 0x25
jne 0x100018ca
mov esi, dword [edi + 2]
push esi
push edi
call fcn.10001b70
add esp, 8
test al, al
je 0x100018ca
mov edi, dword [esi]
jmp 0x100018ca
cmp al, 0xeb
jne 0x100018ca
movsx eax, byte [edi + 1]
add edi, 2
add edi, eax
cmp byte [edi], 0xe9
jne 0x100018ca
add edi, dword [edi + 1]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x100018e0
mov dword [ebp - 0x14], esi
jmp 0x10001925
mov al, byte [esi]
cmp al, 0xff
jne 0x1000190a
cmp byte [esi + 1], 0x25
jne 0x10001925
mov eax, dword [esi + 2]
push eax
push esi
mov dword [ebp - 0x28], eax
call fcn.10001b70
add esp, 8
test al, al
je 0x10001925
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
jmp 0x10001925
cmp al, 0xeb
jne 0x10001925
movsx eax, byte [esi + 1]
add esi, 2
add esi, eax
mov dword [ebp - 0x14], esi
cmp byte [esi], 0xe9
jne 0x10001925
add esi, dword [esi + 1]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
jne 0x10001946
mov eax, dword [ebp + 0x10]
push 0x40
push 0x3000
shl eax, 5
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi], eax
mov ecx, dword [ebp - 0x18]
mov edx, edi
movaps xmm0, xmmword [0x100bd4e0]
shl ecx, 5
add ecx, eax
mov dword [ebp - 0x1c], ecx
movups xmmword [ecx], xmm0
movups xmmword [ecx + 0x10], xmm0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 5
jge 0x100019f6
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
mov eax, dword [ebp - 0x1c]
mov esi, edx
push 0
push edx
add eax, ecx
push eax
call fcn.10033b20
add esp, 0x18
mov edx, eax
cmp dword [ebp - 0x28], 0
jne 0x100019f3
mov al, byte [esi]
mov ecx, edx
sub ecx, edi
mov dword [ebp - 0x20], ecx
cmp al, 0xe9
je 0x100019f6
cmp al, 0xe0
je 0x100019f6
cmp al, 0xc2
je 0x100019f6
cmp al, 0xc3
je 0x100019f6
cmp al, 0xcc
je 0x100019f6
cmp al, 0xff
jne 0x100019c2
cmp byte [esi + 1], 0x25
jne 0x10001966
jmp 0x100019f6
cmp al, 0x26
je 0x100019da
cmp al, 0x2e
je 0x100019da
cmp al, 0x36
je 0x100019da
cmp al, 0xe3
je 0x100019da
cmp al, 0x64
je 0x100019da
cmp al, 0x65
jne 0x10001966
cmp byte [esi + 1], 0xff
jne 0x10001966
cmp byte [esi + 2], 0x25
jne 0x10001966
jmp 0x100019f6
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
lea edx, [ecx + edi]
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], edx
add esi, 0x17
mov byte [esi], cl
add ecx, dword [ebp - 0x1c]
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub edx, eax
mov eax, esi
mov dword [ecx + 1], edx
add ecx, 5
sub eax, ecx
xor edx, edx
cmp ecx, esi
cmova eax, edx
test eax, eax
je 0x10001a39
push eax
push 0xcc
push ecx
call fcn.10068bc0
add esp, 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 0x40
push dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x1c]
lea eax, [edi + 5]
lea edx, [edi + 5]
mov dword [ebp - 0x28], 0
mov ecx, dword [esi + 0x1c]
sub ecx, eax
mov byte [edi], 0xe9
mov dword [edi + 1], ecx
mov ecx, dword [esi + 0x18]
sub ecx, edx
cmp edx, dword [esi + 0x18]
cmova ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x10001a8a
push ecx
push 0xcc
push edx
call fcn.10068bc0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ecx + eax*8]
mov dword [eax], esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
movzx eax, byte [esi + 0x17]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [esi + 0x17]
push eax
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
inc ecx
jmp 0x1000186a
lea ecx, [ebp + 0x10]
shl eax, 5
push ecx
push 0x20
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x100efa08
mov dword [ebp - 4], 0xffffffff
call fcn.1004a74c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret