Function at 0x10070c00
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cf5f7
push eax
mov dword fs:[0], esp
sub esp, 0x4b4
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
jne 0x10070c48
push str.Aborting_HookFunc_because_pRealFunctionAddr_is_null_n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
jne 0x10070c6e
push str.Aborting_HookFunc_because_pHookFunctionAddr_is_null_n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call fcn.10071b60
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
test ecx, ecx
jle 0x10070cb2
lea esp, [esp]
mov dl, byte [ebx]
cmp dl, 0xeb
jne 0x10070ca0
movsx eax, byte [ebx + 1]
add ebx, 2
jmp 0x10070cab
cmp dl, 0xe9
jne 0x10070cb2
mov eax, dword [ebx + 1]
add ebx, 5
dec ecx
add ebx, eax
test ecx, ecx
jg 0x10070c90
push 5
push ebx
call fcn.10070940
add esp, 8
test al, al
jne 0x10070ccf
push ebx
push str.Warning:_hook_target_starting_at__p_covers_a_non_executable_page_n
call fcn.10084630
add esp, 8
cmp byte [ebx], 0xeb
jne 0x10070cf5
push ebx
push str.Warning:_hook_target_starting_at__p_begins_with_uncoditional_2_byte_jump__skipping_n
call fcn.10084630
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x24], 0xe9
mov edi, ebx
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.10075e20
add esp, 0xc
test al, al
je 0x1007129d
cmp byte [ebp - 0xd], 0
je 0x10070d41
mov cl, byte [edi]
cmp cl, 0xcc
je 0x10070d41
cmp cl, 0x90
je 0x10070d41
push ebx
push str.Warning:_hook_target_starting_at__p_contains_early_RET_n
call fcn.10084630
add esp, 8
xor al, al
mov cl, byte [edi]
cmp cl, 0xc3
je 0x10070d4d
cmp cl, 0xc2
jne 0x10070d51
mov byte [ebp - 0xd], 1
test al, al
je 0x1007129d
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x10070d78
cmp eax, 1
je 0x10070d78
cmp eax, 2
je 0x10070d78
cmp eax, 4
je 0x10070d78
cmp eax, 3
jne 0x1007129d
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 0x14]
push esi
add eax, ecx
push edi
push eax
call fcn.100a74e0
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, esi
add edi, esi
mov dword [ebp - 0x14], eax
cmp eax, 5
jb 0x10070d06
cmp eax, 0x30
jle 0x10070dc6
push str.Copied_more_than_MAX_HOOKED_FUNCTION_PREAMBLE_LENGTH_bytes_to_make_room_for_E9_jmp_of_5_bytes___Bad_opcode_parsing__n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.10070b30
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10070e0c
push ebx
call fcn.10070460
push ebx
call fcn.10070b30
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10070e0c
push str.Error_allocating_trampoline_memory__no_memory_within___2gb__prior_failures___n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
lea esi, [ebp - 0x70]
lea edi, [ebp - 0xac]
mov dword [ecx], eax
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
test esi, esi
jle 0x10070f13
mov edi, edi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x70]
add eax, edi
push ecx
push eax
call fcn.10075e20
add esp, 0xc
test al, al
je 0x10071045
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10070e8d
cmp eax, 1
je 0x10070e8d
cmp eax, 2
je 0x10070e8d
cmp eax, 4
je switch.0x10070e96
cmp eax, 3
jne 0x10071045
cmp eax, 4
ja case.default.0x10070e96
jmp dword [eax*4 + 0x10071498]
lea ecx, [ebp - 0x6e]
jmp 0x10070f00
lea ecx, [ebp - 0x6d]
jmp 0x10070f00
mov al, byte [ebp + edi - 0x70]
cmp al, 0xeb
jne 0x10071000
cmp dword [ebp - 0x14], 2
jne 0x10071000
cmp esi, 0x2d
jg 0x10070fe0
mov eax, esi
mov byte [ebp + edi - 0x70], 0xe9
sub eax, edi
sub eax, 2
push eax
lea eax, [ebp - 0x6e]
add eax, edi
push eax
lea eax, [ebp - 0x6b]
add eax, edi
push eax
call fcn.100a74e0
movsx eax, byte [ebp + edi - 0x6f]
add esp, 0xc
sub eax, 3
mov dword [ebp - 0x14], 5
mov dword [ebp + edi - 0x6f], eax
add esi, 3
lea ecx, [ebp - 0x6f]
mov eax, ebx
sub eax, dword [ebp - 0x1c]
add dword [edi + ecx], eax
add edi, dword [ebp - 0x14]
cmp edi, esi
jl 0x10070e50
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x70]
push esi
push eax
push edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xb8], edi
call fcn.100a74e0
add edi, esi
add esp, 0xc
sub esi, edi
lea eax, [esi - 5]
add eax, ebx
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov al, byte [ebp - 0x20]
mov byte [edi + 4], al
add edi, 5
mov eax, dword [ebp + 0xc]
mov esi, edi
sub eax, edi
mov dword [ebp - 0xb4], edi
sub eax, 5
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov al, byte [ebp - 0x20]
mov byte [edi + 4], al
add edi, 5
mov eax, dword [ebp - 0x1c]
sub edi, eax
push edi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
sub esi, ebx
sub esi, 5
mov dword [ebp - 0x23], esi
call fcn.10070af0
mov ecx, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov dword [ebp - 0x2c], 0
lea eax, [ebx + 4]
mov dword [ebp - 0x30], 0
div ecx
xor edx, edx
mov edi, eax
mov eax, ebx
div ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 1
push ebx
call esi
test eax, eax
jne 0x100710cb
push str.Warning:_VirtualProtect_call_failed_during_hook_attempt_n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Cant_fixup_EB_jmp_because_there_isnt_enough_room_to_expand_to_E9_jmp_n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, al
push eax
push str.Opcode__x_of_type_k_EBYTEOffsetAtByteTwo_cant_be_converted_to_larger_relative_address_n
call fcn.10084630
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.Unknown_opcode_relative_offset_enum_value__d_n
call fcn.10084630
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [ebp - 0x5d]
push eax
movzx eax, byte [ebp - 0x5e]
push eax
movzx eax, byte [ebp - 0x5f]
push eax
movzx eax, byte [ebp - 0x60]
push eax
movzx eax, byte [ebp - 0x61]
push eax
movzx eax, byte [ebp - 0x62]
push eax
movzx eax, byte [ebp - 0x63]
push eax
movzx eax, byte [ebp - 0x64]
push eax
movzx eax, byte [ebp - 0x65]
push eax
movzx eax, byte [ebp - 0x66]
push eax
movzx eax, byte [ebp - 0x67]
mov ecx, dword [ebp - 0x6d]
push eax
movzx eax, byte [ebp - 0x68]
push eax
movzx eax, byte [ebp - 0x69]
push eax
movzx eax, byte [ebp - 0x6a]
push eax
movzx eax, byte [ebp - 0x6b]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [ebp - 0x6e]
push eax
movzx eax, byte [ebp - 0x6f]
push eax
movzx eax, byte [ebp - 0x70]
push eax
push edi
push str.Failed_parsing_copied_bytes_during_detour____shouldnt_happen_as_this_is_a_second_pass:_position__d_n_02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X_n
call fcn.10084630
add esp, 0x58
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], edi
je 0x1007110e
lea eax, [ebp - 0x30]
push eax
push 0x40
push 1
lea eax, [ebx + 4]
push eax
call esi
test eax, eax
jne 0x1007110e
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2c]
push 1
push ebx
call esi
push str.Warning:_VirtualProtect__2__call_failed_during_hook_attempt_n
call fcn.10084630
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 0xd], 0
mov dword [eax], ecx
lea eax, [ebp - 0x7c]
push eax
push 5
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10071139
push str.WriteProcessMemory___call_failed_trying_to_overwrite_first_5_bytes_of_function_body_during_hook_n
jmp 0x1007115b
mov eax, dword [ebp + 0x14]
push 5
push ebx
push dword [ebp - 0x18]
mov dword [eax], 0
mov byte [ebp - 0xd], 1
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x10071163
push str.FlushInstructionCache___call_failed_trying_to_overwrite_first_5_bytes_of_function_body_during_hook_n
call fcn.10084630
add esp, 4
cmp dword [ebp - 0x14], edi
je 0x10071195
mov eax, dword [ebp - 0x30]
cmp eax, 0x40
je 0x10071195
cmp eax, 0x80
je 0x10071195
lea ecx, [ebp - 0x34]
push ecx
push eax
push 1
lea eax, [ebx + 4]
push eax
call esi
test eax, eax
jne 0x10071195
push str.Warning:_VirtualProtect__2__call_failed_to_restore_protection_flags_during_hook_attempt_n
call fcn.10084630
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp eax, 0x40
je 0x100711bf
cmp eax, 0x80
je 0x100711bf
lea ecx, [ebp - 0x34]
push ecx
push eax
push 1
push ebx
call esi
test eax, eax
jne 0x100711bf
push str.Warning:_VirtualProtect_call_failed_to_restore_protection_flags_during_hook_attempt_n
call fcn.10084630
add esp, 4
mov bl, byte [ebp - 0xd]
test bl, bl
je 0x1007128a
push 0x1010eb14
mov dword [ebp - 0x28], 0x1010eb14
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 3
push eax
mov ecx, 0x1010eb04
mov dword [ebp + 8], esi
call fcn.10051b60
mov eax, dword [ebp - 0x38]
cmp byte [eax + 0xd], 0
jne 0x10071209
cmp esi, dword [eax + 0x10]
jae 0x1007126f
cmp dword [0x1010eb08], 0x30c30c3
je 0x1007148c
mov edi, dword [0x1010eb04]
mov dword [ebp - 0x78], 0x1010eb04
push 0x54
mov byte [ebp - 4], 4
mov dword [ebp - 0x74], 0
call fcn.100a573e
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x40
push 0
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
push ecx
call fcn.100a7070
add esp, 0x10
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, 0x1010eb04
mov dword [esi + 8], edi
mov word [esi + 0xc], 0
push esi
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.100532d0
lea edi, [eax + 0x14]
mov ecx, 0x10
lea esi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
push 0x1010eb14
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1010eb14
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x1c], 0x1010eb14
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], ebx
push eax
mov ecx, 0x1010eb48
call fcn.10051b60
mov eax, dword [ebp - 0x38]
mov esi, dword [0x1010eb48]
cmp byte [eax + 0xd], 0
jne 0x100712e7
cmp ebx, dword [eax + 0x10]
jb 0x100712e7
cmp eax, esi
jne 0x10071362
lea eax, [ebp - 0x18]
mov byte [ebp + 0xb], 0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], ebx
push eax
mov ecx, 0x1010eb48
call fcn.10051b60
mov ecx, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], ecx
cmp byte [eax + 0xd], 0
jne 0x10071316
cmp ebx, dword [eax + 0x10]
jae 0x10071362
cmp dword [0x1010eb4c], 0xccccccc
je 0x10071491
mov dword [ebp - 0x3c], 0x1010eb48
push 0x14
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0
call fcn.100a573e
add esp, 4
mov ecx, 0x1010eb48
mov dword [eax + 0x10], ebx
push eax
push dword [ebp - 0x18]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
push edi
mov word [eax + 0xc], 0
call fcn.100532d0
push 0x1010eb14
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [ebx + 0xf]
push eax
movzx eax, byte [ebx + 0xe]
push eax
movzx eax, byte [ebx + 0xd]
push eax
movzx eax, byte [ebx + 0xc]
push eax
movzx eax, byte [ebx + 0xb]
push eax
movzx eax, byte [ebx + 0xa]
push eax
movzx eax, byte [ebx + 9]
push eax
movzx eax, byte [ebx + 8]
push eax
movzx eax, byte [ebx + 7]
push eax
movzx eax, byte [ebx + 6]
push eax
movzx eax, byte [ebx + 5]
push eax
movzx eax, byte [ebx + 4]
push eax
movzx eax, byte [ebx + 3]
push eax
movzx eax, byte [ebx + 2]
push eax
movzx eax, byte [ebx + 1]
push eax
movzx eax, byte [ebx]
push eax
mov eax, dword [ebp - 0x14]
push ebx
push eax
push 0x100dc164
push str.Unknown_opcodes_for__s_at__d_bytes_for_func__p:__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X_n
lea eax, [ebp - 0x4bc]
push 0x400
push eax
call fcn.10059f50
lea eax, [ebp - 0x4bc]
push eax
call fcn.10084630
add esp, 0x5c
cmp byte [ebp + 0xb], 0
jne 0x10071479
lea ecx, [ebp - 0x4bc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10071405
mov esi, dword [0x1010eb00]
sub ecx, edx
mov dword [ebp - 0x4c0], ecx
test esi, esi
jne 0x10071467
push 0x13c
call fcn.100a573e
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x10071452
push esi
push esi
push 0x32
push 0x8000
push str.GameOverlayRender_DetourErrorStream
mov ecx, eax
call fcn.10097d40
mov esi, eax
jmp 0x10071454
xor esi, esi
mov ecx, dword [ebp - 0x4c0]
mov dword [ebp - 4], 0xffffffff
mov dword [0x1010eb00], esi
mov edx, dword [esi]
lea eax, [ecx + 4]
push eax
lea eax, [ebp - 0x4c0]
mov ecx, esi
push eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100535c0
call fcn.100535c0
mov edi, edi
or byte [edi], cl
pop es
adc ch, bh
push cs
pop es
adc byte [ebp - 0x5deff8f2], bl
push cs
pop es
adc byte [edi - 0x33eff8f2], ah
int3