Function at 0x1800963f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x180120040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r8
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov r8d, 0x30
lea rdx, [rsp + 0x38]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009673c
mov ecx, dword [rsp + 0x5c]
test cl, 0xee
sete al
test ecx, 0x101
movzx ecx, al
mov eax, 1
cmovne ecx, eax
test cl, cl
jne 0x18009673c
mov r12, qword [rbx + 8]
sub r12, qword [rbx]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r15d, 0
mov r14d, r15d
mov qword [rsp + 0x48], r15
je 0x1800964cb
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.180003180
mov r8, r12
xor edx, edx
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
add r12, rsi
mov qword [rsp + 0x40], r12
mov r14, qword [rsp + 0x48]
jmp 0x1800964d5
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r8, qword [rbx + 8]
sub r8, qword [rbx]
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
sub r12, rsi
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
mov qword [rsp + 0x68], rax
cmp r12, rax
jne 0x1800965f8
mov r8, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800965f3
cmp qword [rdi + 0x10], 0
je 0x180096566
mov ecx, dword [0x180148094]
cmp dword [0x18014a598], ecx
cmovg ecx, dword [0x18014a598]
test ecx, ecx
js 0x180096566
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180096540
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.Instruction_for__s_at_instructionAddr:__p_is_already_equal_to_the_desired_value__no_overwrite_needed.
mov r8d, 0x6f
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICMemHelperMemHelper.cpp
xor ecx, ecx
call fcn.1800aa8b0
nop
test rsi, rsi
je 0x18009659f
sub r14, rsi
mov rax, rsi
cmp r14, 0x1000
jb 0x180096593
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800966b5
mov rdx, r14
mov rcx, rsi
call fcn.1800ad3b4
nop
mov rcx, rdi
call fcn.180002fc0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800965ec
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800965dc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180096735
mov rcx, r8
call fcn.1800ad3b4
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x1800967d7
mov rax, qword [rsp + 0x68]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp qword [rdi + 0x10], 0
je 0x18009668c
mov ecx, dword [0x180148094]
cmp dword [0x18014a598], ecx
cmovg ecx, dword [0x18014a598]
test ecx, ecx
js 0x18009668c
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180096666
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.Successfully_overwritten_Instruction_for__s_at_instructionAddr:__p
mov r8d, 0x7c
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICMemHelperMemHelper.cpp
xor ecx, ecx
call fcn.1800aa8b0
nop
test rsi, rsi
je 0x1800966c8
sub r14, rsi
mov rax, rsi
cmp r14, 0x1000
jb 0x1800966bc
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800966bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rsi
call fcn.1800ad3b4
nop
mov rcx, rdi
call fcn.180002fc0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x180096711
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180096701
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180096735
mov rcx, r8
call fcn.1800ad3b4
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x1800967d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, dword [0x180148094]
cmp dword [0x18014a598], ecx
cmovg ecx, dword [0x18014a598]
cmp ecx, 0xfffffffe
jl 0x180096789
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180096761
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str.overwriteInstruction:__s_:can_not_overwrite_cause_instructionAddr_is_a_bad_ptr:__p
mov r8d, 0x65
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICMemHelperMemHelper.cpp
lea ecx, [r8 - 0x67]
call fcn.1800aa8b0
nop
mov rcx, rdi
call fcn.180002fc0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800967d5
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800967c2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800967fa
mov rcx, r8
call fcn.1800ad3b4
xor r15d, r15d
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800acfe0
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3