Function at 0x3fe130a3
Capabilities:
Check for hardware breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], 1
mov edi, 0x20000
test eax, eax
je 0x3fe13113
lea ecx, [ebp - 0x2d0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x3fe1334f
test dword [ebp - 0x210], edi
jne 0x3fe1310a
cmp dword [ebp - 0x214], 0x1b
je 0x3fe13113
and dword [ebp - 0x2d8], 0
jmp 0x3fe1314b
lea eax, [ebp - 0x2d4]
push eax
push 0x2cc
lea eax, [ebp - 0x2d0]
push eax
push dword [0x3fe15160]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3fe1334f
cmp dword [ebp - 0x2d4], 0x2cc
jne 0x3fe1334f
mov ebx, dword [esi]
mov eax, 0x10001
mov ecx, ebx
and ecx, eax
cmp ecx, eax
jne 0x3fe131b8
mov eax, dword [esi + 0xb4]
mov dword [ebp - 0x21c], eax
mov eax, dword [esi + 0xb8]
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0xc0]
and eax, 0x53fd7
test dword [ebp - 0x210], edi
je 0x3fe13187
or eax, edi
mov dword [ebp - 0x210], eax
test edi, eax
mov eax, dword [esi + 0xbc]
jne 0x3fe1319a
or eax, 3
mov dword [ebp - 0x214], eax
mov eax, dword [esi + 0xc8]
mov dword [ebp - 0x208], eax
mov eax, dword [esi + 0xc4]
mov dword [ebp - 0x20c], eax
mov eax, 0x10004
mov ecx, ebx
and ecx, eax
cmp ecx, eax
jne 0x3fe131f5
mov eax, dword [esi + 0x8c]
mov dword [ebp - 0x244], eax
mov eax, dword [esi + 0x90]
mov dword [ebp - 0x240], eax
mov eax, dword [esi + 0x94]
mov dword [ebp - 0x23c], eax
mov eax, dword [esi + 0x98]
mov dword [ebp - 0x238], eax
mov eax, 0x10002
mov ecx, ebx
and ecx, eax
cmp ecx, eax
jne 0x3fe1324a
mov eax, dword [esi + 0x9c]
mov dword [ebp - 0x234], eax
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0x230], eax
mov eax, dword [esi + 0xa4]
mov dword [ebp - 0x22c], eax
mov eax, dword [esi + 0xac]
mov dword [ebp - 0x224], eax
mov eax, dword [esi + 0xa8]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0xb0]
mov dword [ebp - 0x220], eax
mov eax, 0x10008
mov ecx, ebx
and ecx, eax
cmp ecx, eax
jne 0x3fe132b7
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x2b4], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x2b0], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x2ac], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x2a8], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x2a0], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x29c], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x248], eax
lea eax, [esi + 0x38]
push 0x50
push eax
lea eax, [ebp - 0x298]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, 0x10010
and ebx, eax
cmp ebx, eax
jne 0x3fe132f8
mov eax, dword [esi + 4]
mov dword [ebp - 0x2cc], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c8], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c4], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c0], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x2bc], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2d8], 0
jne 0x3fe13318
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x3fe1334f
lea eax, [ebp - 0x2d4]
push eax
mov esi, 0x2cc
push esi
lea eax, [ebp - 0x2d0]
push eax
push dword [0x3fe15160]
push dword [ebp - 0x2e0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x3fe1334f
cmp dword [ebp - 0x2d4], esi
jne 0x3fe1334f
xor eax, eax
inc eax
jmp 0x3fe13351
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3fe139e5
leave
ret 0xc