Function at 0x180096850
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x180120040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r8
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov r8d, 0x30
lea rdx, [rsp + 0x38]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180096b9c
mov ecx, dword [rsp + 0x5c]
test cl, 0xee
sete al
test ecx, 0x101
movzx ecx, al
mov eax, 1
cmovne ecx, eax
test cl, cl
jne 0x180096b9c
mov r12, qword [rbx + 8]
sub r12, qword [rbx]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r15d, 0
mov r14d, r15d
mov qword [rsp + 0x48], r15
je 0x18009692b
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.180003180
mov r8, r12
xor edx, edx
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
add r12, rsi
mov qword [rsp + 0x40], r12
mov r14, qword [rsp + 0x48]
jmp 0x180096935
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r8, qword [rbx + 8]
sub r8, qword [rbx]
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
sub r12, rsi
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
mov qword [rsp + 0x68], rax
cmp r12, rax
jne 0x180096a58
mov r8, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180096a53
cmp qword [rdi + 0x10], 0
je 0x1800969c6
mov ecx, dword [0x180148094]
cmp dword [0x18014a588], ecx
cmovg ecx, dword [0x18014a588]
test ecx, ecx
js 0x1800969c6
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800969a0
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.Instruction_for__s_at_instructionAddr:__p_is_already_equal_to_the_desired_value__no_overwrite_needed.
mov r8d, 0x6f
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICMemHelperMemHelper.cpp
xor ecx, ecx
call fcn.1800aae50
nop
test rsi, rsi
je 0x1800969ff
sub r14, rsi
mov rax, rsi
cmp r14, 0x1000
jb 0x1800969f3
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180096b15
mov rdx, r14
mov rcx, rsi
call fcn.1800ad954
nop
mov rcx, rdi
call fcn.180002fc0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180096a4c
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180096a3c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180096b95
mov rcx, r8
call fcn.1800ad954
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x180096c37
mov rax, qword [rsp + 0x68]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp qword [rdi + 0x10], 0
je 0x180096aec
mov ecx, dword [0x180148094]
cmp dword [0x18014a588], ecx
cmovg ecx, dword [0x18014a588]
test ecx, ecx
js 0x180096aec
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180096ac6
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.Successfully_overwritten_Instruction_for__s_at_instructionAddr:__p
mov r8d, 0x7c
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICMemHelperMemHelper.cpp
xor ecx, ecx
call fcn.1800aae50
nop
test rsi, rsi
je 0x180096b28
sub r14, rsi
mov rax, rsi
cmp r14, 0x1000
jb 0x180096b1c
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180096b1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rsi
call fcn.1800ad954
nop
mov rcx, rdi
call fcn.180002fc0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180096b71
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180096b61
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180096b95
mov rcx, r8
call fcn.1800ad954
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x180096c37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, dword [0x180148094]
cmp dword [0x18014a588], ecx
cmovg ecx, dword [0x18014a588]
cmp ecx, 0xfffffffe
jl 0x180096be9
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180096bc1
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.overwriteInstruction:__s_:can_not_overwrite_cause_instructionAddr_is_a_bad_ptr:__p
mov r8d, 0x65
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICMemHelperMemHelper.cpp
lea ecx, [r8 - 0x67]
call fcn.1800aae50
nop
mov rcx, rdi
call fcn.180002fc0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180096c35
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180096c22
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180096c5a
mov rcx, r8
call fcn.1800ad954
xor r15d, r15d
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800ad580
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3