Function at 0x100001650
Capabilities:
Allocate or change rwx memory
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor esi, esi
xor r8d, r8d
mov r14, rcx
and qword [rax - 0x58], rsi
and qword [rax - 0x50], rsi
mov qword [rax - 0x60], rsi
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
test r9d, r9d
je 0x100001691
mov r8d, dword [r9 + rcx + 0x18]
test r8d, r8d
je 0x100001978
xor r9d, r9d
mov eax, r8d
xor r10d, r10d
mov qword [rsp + 0xc8], r10
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], rax
movsxd rax, dword [r14 + 0x3c]
xor r11d, r11d
xor r15d, r15d
mov ecx, dword [rax + r14 + 0x88]
mov qword [rsp + 0x50], rsi
test ecx, ecx
je 0x100001705
mov eax, dword [rcx + r14 + 0x20]
add rax, r10
mov r11d, dword [rax + r14]
mov eax, dword [rcx + r14 + 0x24]
add rax, r9
add r11, r14
movzx edx, word [rax + r14]
mov eax, dword [rcx + r14 + 0x1c]
lea rcx, [r14 + rax]
mov ebx, dword [rcx + rdx*4]
mov rdx, qword [rsp + 0xb8]
add rbx, r14
jmp 0x100001707
xor ebx, ebx
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
mov ecx, dword [rax + 0x88]
test ecx, ecx
je 0x100001779
lea rax, [rdx + rcx]
xor r10d, r10d
xor r9d, r9d
mov ebp, dword [rax + 0x1c]
mov r13d, dword [rax + 0x20]
mov r12d, dword [rax + 0x24]
mov edi, dword [rax + 0x18]
add rbp, rdx
add r13, rdx
add r12, rdx
test edi, edi
je 0x100001779
mov r8d, dword [r13 + r9*4]
mov rax, r11
add r8, rdx
sub r8, r11
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x10000175e
inc rax
test ecx, ecx
jne 0x10000174b
test edx, edx
mov rdx, qword [rsp + 0xb8]
je 0x10000189e
inc r10d
inc r9
cmp r10d, edi
jb 0x10000173d
xor edi, edi
test rbx, rbx
je 0x10000194a
test rdi, rdi
je 0x10000194a
mov al, byte [rbx]
mov rbp, rbx
cmp al, 0xe9
je 0x10000185b
mov cl, 0x90
cmp al, cl
jne 0x1000017aa
cmp byte [rbx + 1], 0xe9
je 0x10000185b
mov r8b, 0xff
cmp al, 0x8b
jne 0x1000017c1
cmp byte [rbx + 1], r8b
jne 0x1000017c1
cmp byte [rbx + 2], 0xe9
je 0x10000185b
cmp al, 0x68
jne 0x1000017cf
cmp byte [rbx + 5], 0xc3
je 0x10000185b
cmp al, cl
jne 0x1000017df
cmp byte [rbx + 1], 0x68
jne 0x1000017df
cmp byte [rbx + 6], 0xc3
je 0x10000185b
cmp al, r8b
jne 0x1000017ea
cmp byte [rbx + 1], 0x25
je 0x10000185b
cmp al, 0x8b
jne 0x100001800
cmp byte [rbx + 1], r8b
jne 0x100001800
cmp byte [rbx + 2], r8b
jne 0x100001800
cmp byte [rbx + 3], 0x25
je 0x10000185b
cmp al, 0xb8
jne 0x10000181c
cmp byte [rbx + 5], r8b
jne 0x100001810
cmp byte [rbx + 6], 0xe0
je 0x10000185b
cmp byte [rbx + 5], 0x50
jne 0x10000181c
cmp byte [rbx + 6], 0xc3
je 0x10000185b
cmp al, 0xa1
jne 0x100001838
cmp byte [rbx + 5], r8b
jne 0x10000182c
cmp byte [rbx + 6], 0xe0
je 0x10000185b
cmp byte [rbx + 5], 0x50
jne 0x100001838
cmp byte [rbx + 6], 0xc3
je 0x10000185b
cmp al, cl
jne 0x100001847
cmp byte [rbx + 1], cl
jne 0x100001847
cmp byte [rbx + 3], 0xe9
je 0x10000185b
cmp byte [rbx + 5], r8b
jne 0x10000194a
cmp byte [rbx + 6], 0x25
jne 0x10000194a
mov cl, byte [rdi]
cmp al, cl
je 0x10000194a
sub rdi, rbx
mov byte [rsp + 0x38], cl
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8d, 1
mov rdx, rsi
mov qword [rsp + 0x30], rbp
call fcn.100001b48
inc rbp
inc r15d
mov cl, byte [rdi + rbp]
cmp byte [rbp], cl
je 0x1000018af
mov rsi, qword [rsp + 0x50]
jmp 0x100001868
movzx eax, word [r12 + r9*2]
mov edi, dword [rbp + rax*4]
add rdi, rdx
jmp 0x10000177b
test r15d, r15d
je 0x10000193d
lea r9, [rsp + 0xb0]
mov r8d, 0x40
mov edx, r15d
mov rcx, rbx
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000018e6
lea rcx, [0x1000012b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
cmp rsi, qword [rsp + 0x50]
je 0x100001909
mov r8, qword [rcx]
mov al, byte [rcx + 8]
add rcx, 0x10
mov byte [r8], al
cmp rcx, qword [rsp + 0x50]
jne 0x1000018f5
mov r8d, dword [rsp + 0xb0]
lea r9, [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100001936
lea rcx, [0x1000012d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov qword [rsp + 0x50], rsi
jmp 0x100001942
mov rsi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0xb8]
mov r10, qword [rsp + 0xc8]
mov r9, qword [rsp + 0x20]
add r10, 4
add r9, 2
sub qword [rsp + 0x28], 1
mov qword [rsp + 0xc8], r10
mov qword [rsp + 0x20], r9
jne 0x1000016b5
mov rcx, rsi
call fcn.100002128
mov eax, 1
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret