Function at 0x100bcf00
Capabilities:
Check for software breakpoints

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
xor ebp, ebp
xor r15d, r15d
lea rax, [rsp + 0x80]
mov rbx, rcx
mov byte [rsp + 0x50], 0xff
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov byte [rsp + 0x51], 0x15
mov dword [rsp + 0x52], 2
mov byte [rsp + 0x56], 0xeb
mov byte [rsp + 0x57], 8
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x40], 0xff
mov byte [rsp + 0x41], 0x25
mov dword [rsp + 0x42], 0
mov qword [rsp + 0x46], 0
mov byte [rsp + 0x60], 0x70
mov byte [rsp + 0x61], 0xe
mov byte [rsp + 0x62], 0xff
mov byte [rsp + 0x63], 0x25
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0
mov dword [rcx + 0x20], 0
mov dword [rcx + 0x24], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
jmp 0x100bd06e
mov edx, eax
and edx, 0xfffffffd
cmp dl, 0xe9
je 0x100bd100
mov edx, eax
and edx, 0xfffffff0
cmp dl, 0x70
je 0x100bd235
mov edx, eax
and edx, 0xfffffffc
cmp dl, 0xe0
je 0x100bd2a0
movzx edx, byte [rsp + 0x8c]
and edx, 0xfffffff0
cmp dl, 0x80
je 0x100bd170
and eax, 0xfffffffe
xor r14d, r14d
cmp al, 0xc2
je 0x100bd301
nop
cmp qword [rsp + 0x20], rsi
jbe 0x100bd017
movzx eax, byte [rsp + 0x80]
cmp edi, eax
jne 0x100bd262
movzx eax, bpl
add eax, edi
cmp eax, 0x32
ja 0x100bd262
mov eax, dword [rbx + 0x24]
cmp eax, 7
ja 0x100bd262
mov edx, eax
mov rcx, r12
add eax, 1
mov byte [rbx + rdx + 0x28], r15b
mov r8d, edi
mov byte [rbx + rdx + 0x30], bpl
add rcx, qword [rbx + 0x10]
mov rdx, r13
add ebp, edi
mov dword [rbx + 0x24], eax
call sub.ntdll.dll_memcpy
mov eax, r15d
add al, byte [rsp + 0x80]
test r14d, r14d
mov r15d, eax
jne 0x100bd312
movzx esi, r15b
add rsi, qword [rbx]
movzx r12d, bpl
mov rdx, qword [rsp + 0x28]
mov r14, qword [rbx + 0x10]
mov rcx, rsi
mov r13, rsi
call fcn.100bd7b0
mov r11d, dword [rsp + 0xa1]
mov edi, eax
test r11d, 0x1000
jne 0x100bd262
cmp r15b, 4
ja 0x100bd280
movzx eax, byte [rsp + 0x8d]
and eax, 0xffffffc7
cmp al, 5
je 0x100bd1c4
movzx eax, byte [rsp + 0x8b]
cmp al, 0xe8
jne 0x100bcfb3
movzx edx, byte [rsp + 0x80]
lea r13, [rsp + 0x50]
mov edi, 0x10
xor r14d, r14d
movsxd rax, dword [rsp + 0x95]
add rax, rdx
add rax, rsi
mov qword [rsp + 0x58], rax
jmp 0x100bd000
movzx edx, byte [rsp + 0x80]
add rdx, rsi
cmp al, 0xeb
je 0x100bd2f0
movsxd rax, dword [rsp + 0x95]
add rax, rdx
mov rdx, qword [rbx]
cmp rax, rdx
jb 0x100bd150
add rdx, 5
cmp rax, rdx
jae 0x100bd150
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
cmovae rax, rcx
xor r14d, r14d
mov qword [rsp + 0x20], rax
jmp 0x100bd000
xor r14d, r14d
cmp qword [rsp + 0x20], rsi
mov qword [rsp + 0x46], rax
mov edi, 0xe
lea r13, [rsp + 0x40]
setbe r14b
jmp 0x100bd000
movzx edx, byte [rsp + 0x80]
movsxd rcx, dword [rsp + 0x95]
add rdx, rsi
add rdx, rcx
mov rcx, qword [rbx]
cmp rdx, rcx
jb 0x100bd19b
add rcx, 5
cmp rdx, rcx
jb 0x100bd2c8
cmp al, 0xf
je 0x100bd2e1
and eax, 0xf
mov qword [rsp + 0x68], rdx
mov edi, 0x10
xor r14d, r14d
lea r13, [rsp + 0x60]
xor eax, 0x71
mov byte [rsp + 0x60], al
jmp 0x100bd000
mov r13, qword [rsp + 0x38]
mov rdx, rsi
mov r8d, edi
mov dword [rsp + 0x34], r11d
add r14, r12
mov rcx, r13
call sub.ntdll.dll_memcpy
mov r11d, dword [rsp + 0x34]
movzx eax, byte [rsp + 0x80]
mov edx, dword [rsp + 0x9d]
shr r11, 2
and r11d, 0xf
sub rax, 4
add edx, esi
sub rax, r11
sub edx, r14d
xor r14d, r14d
cmp byte [rsp + 0x8b], 0xff
mov dword [rsp + rax + 0x70], edx
jne 0x100bd000
xor r14d, r14d
cmp byte [rsp + 0x8f], 4
mov r13, qword [rsp + 0x38]
sete r14b
jmp 0x100bd000
movzx edx, byte [rsp + 0x80]
movsx rcx, byte [rsp + 0x95]
add rdx, rsi
add rdx, rcx
mov rcx, qword [rbx]
cmp rdx, rcx
jae 0x100bd2bf
mov ecx, eax
and ecx, 0xfffffffc
cmp cl, 0xe0
jne 0x100bd19b
xor eax, eax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x46], rsi
lea r13, [rsp + 0x40]
mov edi, 0xe
mov r14d, 1
jmp 0x100bd000
movzx edx, byte [rsp + 0x80]
movsx rcx, byte [rsp + 0x95]
add rdx, rsi
add rdx, rcx
mov rcx, qword [rbx]
cmp rdx, rcx
jb 0x100bd262
add rcx, 5
cmp rdx, rcx
jae 0x100bd254
mov rax, qword [rsp + 0x20]
cmp rax, rdx
cmovae rdx, rax
xor r14d, r14d
mov qword [rsp + 0x20], rdx
jmp 0x100bd000
movzx eax, byte [rsp + 0x8c]
jmp 0x100bd1a3
movsx rax, byte [rsp + 0x95]
add rax, rdx
jmp 0x100bd11e
xor r14d, r14d
cmp qword [rsp + 0x20], rsi
setbe r14b
jmp 0x100bd000
cmp al, 4
ja 0x100bd3a0
mov r11, qword [rbx]
movzx r10d, al
add r10, r11
movzx ecx, byte [r10]
cmp cl, 0x90
setne r8b
test cl, cl
setne dl
test r8b, dl
je 0x100bd3d7
cmp cl, 0xcc
je 0x100bd3d7
cmp al, 1
jbe 0x100bd262
lea rcx, [r11 - 5]
call fcn.100bd770
test eax, eax
je 0x100bd262
mov rcx, qword [rbx]
movzx edx, byte [rcx - 5]
test dl, dl
setne r8b
cmp dl, 0x90
setne al
test r8b, al
je 0x100bd380
cmp dl, 0xcc
jne 0x100bd262
lea rax, [rcx - 4]
cmp dl, byte [rax]
jne 0x100bd262
add rax, 1
cmp rcx, rax
jne 0x100bd384
mov dword [rbx + 0x20], 1
nop dword [rax]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x46], rax
movzx eax, bpl
mov rdx, qword [rsp + 0x40]
add rax, qword [rbx + 0x10]
mov qword [rbx + 0x18], rax
mov qword [rax], rdx
mov edx, dword [rsp + 0x48]
mov dword [rax + 8], edx
movzx edx, word [rsp + 0x4c]
mov word [rax + 0xc], dx
mov eax, 1
jmp 0x100bd264
movzx r9d, al
cmp r9d, 4
je 0x100bd3a0
movzx esi, byte [r10 + 1]
cmp cl, sil
jne 0x100bd410
mov r8d, 3
mov rdx, r10
sub r8d, r9d
add r8, r10
jmp 0x100bd409
add rdx, 1
cmp cl, byte [rdx + 1]
jne 0x100bd410
cmp r8, rdx
jne 0x100bd400
jmp 0x100bd3a0
cmp al, 1
ja 0x100bd34e
mov eax, 2
sub eax, r9d
cmp eax, 1
jbe 0x100bd34e
cmp cl, sil
jne 0x100bd262
mov edx, r9d
mov rax, r10
neg edx
mov edx, edx
add rdx, r10
nop
cmp rdx, rax
je 0x100bd34e
add rax, 1
cmp cl, byte [rax + 1]
je 0x100bd440
jmp 0x100bd262