Function at 0x18000a810
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe8
mov dword [rsp + 0x84], 0
cmp qword [rsp + 0x130], 0
je 0x18000a858
mov rax, qword [rsp + 0x130]
mov qword [rax], 0
cmp qword [rsp + 0x138], 0
je 0x18000a872
mov rax, qword [rsp + 0x138]
mov qword [rax], 0
cmp qword [rsp + 0x140], 0
je 0x18000a88c
mov rax, qword [rsp + 0x140]
mov qword [rax], 0
cmp qword [rsp + 0x128], 0
jne 0x18000a8ad
lea rcx, str.empty_detour_n
call fcn.18000bf90
mov eax, 0x57
jmp 0x18000b256
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180054418], eax
je 0x18000a8d6
mov edx, dword [0x180054418]
lea rcx, str.transaction_conflict_with_thread_id_ld_n
call fcn.18000bf90
mov eax, 0x10dd
jmp 0x18000b256
cmp dword [0x18005441c], 0
je 0x18000a8fc
mov edx, dword [0x18005441c]
lea rcx, str.pending_transaction_error_ld_n
call fcn.18000bf90
mov eax, dword [0x18005441c]
jmp 0x18000b256
cmp qword [rsp + 0x120], 0
jne 0x18000a91d
lea rcx, str.ppPointer_is_null_n
call fcn.18000bf90
mov eax, 6
jmp 0x18000b256
mov rax, qword [rsp + 0x120]
cmp qword [rax], 0
jne 0x18000a973
mov dword [rsp + 0x84], 6
mov eax, dword [rsp + 0x84]
mov dword [0x18005441c], eax
mov rax, qword [rsp + 0x120]
mov qword [0x180054420], rax
mov rdx, qword [rsp + 0x120]
lea rcx, str.ppPointer_is_null__ppPointer_p__n
call fcn.18000bf90
int3
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xa0], 0
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.18000b270
mov qword [rsp + 0x78], rax
xor edx, edx
mov rcx, qword [rsp + 0x128]
call fcn.18000b270
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x128], rax
jne 0x18000a9e9
cmp dword [0x180054410], 0
je 0x18000a9e4
jmp 0x18000aa6c
int3
cmp qword [rsp + 0x138], 0
je 0x18000aa04
mov rax, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
cmp qword [rsp + 0x140], 0
je 0x18000aa22
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x128]
mov qword [rax], rcx
mov ecx, 0x30
call fcn.1800132e8
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
jne 0x18000ab29
mov dword [rsp + 0x84], 8
mov eax, dword [rsp + 0x84]
mov dword [0x18005441c], eax
int3
cmp qword [rsp + 0x70], 0
je 0x18000aaa1
mov rcx, qword [rsp + 0x70]
call fcn.1800098a0
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x130], 0
je 0x18000aaa1
mov rax, qword [rsp + 0x130]
mov qword [rax], 0
cmp qword [rsp + 0xa0], 0
je 0x18000aada
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xd0], rax
mov edx, 0x30
mov rcx, qword [rsp + 0xd0]
call fcn.180013324
mov qword [rsp + 0xa0], 0
cmp qword [rsp + 0x140], 0
je 0x18000aaf4
mov rax, qword [rsp + 0x140]
mov qword [rax], 0
cmp qword [rsp + 0x138], 0
je 0x18000ab0e
mov rax, qword [rsp + 0x138]
mov qword [rax], 0
mov rax, qword [rsp + 0x120]
mov qword [0x180054420], rax
mov eax, dword [rsp + 0x84]
jmp 0x18000b256
mov rcx, qword [rsp + 0x78]
call fcn.180009150
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x18000ab51
mov dword [rsp + 0x84], 8
int3
cmp qword [rsp + 0x130], 0
je 0x18000ab6c
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x70]
mov qword [rax], rcx
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x70]
lea rcx, str.detours:_pbTramp_p__pDetour_p_n
call fcn.18000bf90
mov rax, qword [rsp + 0x70]
add rax, 0x40
mov r8d, 8
xor edx, edx
mov rcx, rax
call fcn.180015b40
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
add rax, 0x1e
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x80], 0
mov dword [rsp + 0xa8], 5
mov dword [rsp + 0x88], 0
mov eax, dword [rsp + 0xa8]
cmp dword [rsp + 0x80], eax
jae 0x18000ad90
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xac], 0
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
lea rcx, str._DetourCopyInstruction__p__p__n
call fcn.18000bf90
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
call fcn.1800119e0
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
sub rcx, rax
mov rax, rcx
mov r8d, eax
mov rdx, qword [rsp + 0x98]
lea rcx, str._DetourCopyInstruction_____p___d_bytes__n
call fcn.18000bf90
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
sub rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0xac]
add rcx, qword [rsp + 0x90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x98]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x88]
movzx ecx, byte [rsp + 0x80]
and cl, 7
mov rdx, qword [rsp + 0x70]
movzx eax, byte [rdx + rax + 0x40]
and al, 0xf8
or al, cl
mov ecx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x70]
mov byte [rdx + rcx + 0x40], al
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x90]
sub rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x88]
and al, 0x1f
shl al, 3
mov rdx, qword [rsp + 0x70]
movzx ecx, byte [rdx + rcx + 0x40]
and cl, 7
or cl, al
movzx eax, cl
mov ecx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x70]
mov byte [rdx + rcx + 0x40], al
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x88]
cmp rax, 8
jb 0x18000ad78
jmp 0x18000ad90
mov rcx, qword [rsp + 0xb8]
call fcn.180009520
test eax, eax
je 0x18000ad8b
jmp 0x18000ad90
jmp 0x18000abed
mov eax, dword [rsp + 0xa8]
cmp dword [rsp + 0x80], eax
jae 0x18000adfa
mov rcx, qword [rsp + 0x98]
call fcn.180009aa0
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jne 0x18000adc0
jmp 0x18000adfa
movsxd rax, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x98]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x80], eax
jmp 0x18000ad90
mov eax, dword [rsp + 0xa8]
cmp dword [rsp + 0x80], eax
jb 0x18000ae17
mov eax, dword [rsp + 0x88]
cmp rax, 8
jbe 0x18000ae38
mov dword [rsp + 0x84], 9
cmp dword [0x180054410], 0
je 0x18000ae32
jmp 0x18000aa6c
int3
mov rax, qword [rsp + 0xc0]
cmp qword [rsp + 0x90], rax
jbe 0x18000ae4b
int3
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x90]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 0x1e], al
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rsp + 0x80]
mov byte [rax + 0x3e], cl
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
add rcx, 0x20
mov r8d, eax
mov rdx, qword [rsp + 0x78]
call fcn.180015490
mov eax, dword [rsp + 0x80]
mov ecx, dword [rsp + 0xa8]
mov edx, 0x1e
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x18000aec2
mov dword [rsp + 0x84], 6
int3
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x48], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x128]
mov qword [rax + 0x50], rcx
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 0x1e]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x70]
add rax, 0x48
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.180009a20
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
call fcn.180009980
mov qword [rsp + 0x90], rax
mov dword [rsp + 0xb4], 0
mov eax, dword [rsp + 0x80]
lea r9, [rsp + 0xb4]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x78]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18000af8a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x84], eax
int3
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0xa
mov rdx, qword [rsp + 0x78]
movzx ecx, byte [rdx + rcx]
mov edx, 1
imul rdx, rdx, 9
mov r8, qword [rsp + 0x78]
movzx edx, byte [r8 + rdx]
mov r8d, 1
imul r8, r8, 8
mov r9, qword [rsp + 0x78]
movzx r8d, byte [r9 + r8]
mov r9d, 1
imul r9, r9, 7
mov r10, qword [rsp + 0x78]
movzx r9d, byte [r10 + r9]
mov r10d, 1
imul r10, r10, 6
mov r11, qword [rsp + 0x78]
movzx r10d, byte [r11 + r10]
mov r11d, 1
imul r11, r11, 5
mov rbx, qword [rsp + 0x78]
movzx ebx, byte [rbx + r11]
mov r11d, 1
imul r11, r11, 4
mov rdi, qword [rsp + 0x78]
movzx edi, byte [rdi + r11]
mov r11d, 1
imul r11, r11, 3
mov rsi, qword [rsp + 0x78]
movzx esi, byte [rsi + r11]
mov r11d, 1
imul r11, r11, 2
mov rbp, qword [rsp + 0x78]
movzx ebp, byte [r11 + rbp]
mov r11d, 1
imul r11, r11, 1
mov r14, qword [rsp + 0x78]
movzx r11d, byte [r14 + r11]
mov r14d, 1
imul r14, r14, 0
mov r15, qword [rsp + 0x78]
movzx r14d, byte [r15 + r14]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x48], r9d
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
mov r9d, r11d
mov r8d, r14d
mov rdx, qword [rsp + 0x78]
lea rcx, str.detours:_pbTarget_p:__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x_n
call fcn.18000bf90
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [rsp + 0x70]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0xa
mov rdx, qword [rsp + 0x70]
movzx ecx, byte [rdx + rcx]
mov edx, 1
imul rdx, rdx, 9
mov rbx, qword [rsp + 0x70]
movzx edx, byte [rbx + rdx]
mov ebx, 1
imul rbx, rbx, 8
mov rdi, qword [rsp + 0x70]
movzx ebx, byte [rdi + rbx]
mov edi, 1
imul rdi, rdi, 7
mov rsi, qword [rsp + 0x70]
movzx edi, byte [rsi + rdi]
mov esi, 1
imul rsi, rsi, 6
mov rbp, qword [rsp + 0x70]
movzx esi, byte [rsi + rbp]
mov ebp, 1
imul rbp, rbp, 5
mov r8, qword [rsp + 0x70]
movzx ebp, byte [r8 + rbp]
mov r8d, 1
imul r8, r8, 4
mov r9, qword [rsp + 0x70]
movzx r8d, byte [r9 + r8]
mov r9d, 1
imul r9, r9, 3
mov r10, qword [rsp + 0x70]
movzx r9d, byte [r10 + r9]
mov r10d, 1
imul r10, r10, 2
mov r11, qword [rsp + 0x70]
movzx r10d, byte [r11 + r10]
mov r11d, 1
imul r11, r11, 1
mov r14, qword [rsp + 0x70]
movzx r11d, byte [r14 + r11]
mov r14d, 1
imul r14, r14, 0
mov r15, qword [rsp + 0x70]
movzx r14d, byte [r15 + r14]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r10d
mov r9d, r11d
mov r8d, r14d
mov rdx, qword [rsp + 0x70]
lea rcx, str.detours:_pbTramp__p:__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x_n
call fcn.18000bf90
mov rax, qword [rsp + 0xa0]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x120]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xb4]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [0x180054430]
mov qword [rax], rcx
mov rax, qword [rsp + 0xa0]
mov qword [0x180054430], rax
xor eax, eax
add rsp, 0xe8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret