Function at 0x1400015f0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], r8
mov r13, rdx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x30], r9
lea rcx, [rsp + 0x40]
xor r14d, r14d
call fcn.14000e880
mov r15d, dword [r13]
lea r11d, [r14 + 2]
mov edx, r15d
sub edx, r11d
je 0x1400016ac
sub edx, 1
je 0x1400016ac
sub edx, 1
je 0x140001691
sub edx, 1
je 0x140001691
cmp edx, 1
je 0x140001676
mov eax, 0xc000000d
jmp 0x14000186b
mov r8, qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
lea rdi, [0x1400103b0]
mov edx, 0xf
mov r9d, 0x10b
jmp 0x1400016c5
mov r8, qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
lea rdi, [0x1400103ac]
mov edx, 0xf
mov r9d, 0x9b
jmp 0x1400016c5
mov r8, qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
lea rdi, [0x1400103a8]
mov edx, 0x20
mov r9d, 0xc3
mov esi, 3
lea r12d, [rsi + 4]
test r8, r8
je 0x140001866
test rdx, rdx
je 0x140001866
xor r10d, r10d
test rdx, rdx
je 0x140001866
lea rcx, [0x140000000]
xor ebx, ebx
mov bpl, byte [rbx + rcx + 0x103c0]
cmp bpl, 0xcc
je 0x140001718
lea eax, [rbx + r10]
lea rcx, [0x140000000]
cmp bpl, byte [rax + r8]
jne 0x140001857
inc ebx
mov dword [rsp + 0x20], r14d
cmp ebx, 1
jb 0x1400016f5
mov ecx, r10d
inc rcx
add rcx, r8
je 0x140001866
movsxd rax, dword [rcx]
mov ecx, r10d
lea r10, [rax + 5]
add r10, r8
add r10, rcx
test rdi, rdi
je 0x140001866
test r10, r10
je 0x140001866
test r9, r9
je 0x140001866
xor edx, edx
test r9, r9
je 0x140001866
xor r8d, r8d
xor eax, eax
mov bl, byte [rax + rdi]
cmp bl, 0xcc
je 0x140001784
lea eax, [r8 + rdx]
cmp bl, byte [rax + r10]
jne 0x14000189c
inc r8d
mov eax, r8d
cmp rax, r11
jb 0x14000176e
mov ecx, edx
add rcx, rsi
add rcx, r10
je 0x140001866
movsxd rax, dword [rcx]
add rax, r10
mov r14d, edx
add r14, rax
test r9, r9
je 0x140001866
xor edx, edx
test r9, r9
je 0x140001866
lea rbx, [0x140000000]
xor r8d, r8d
mov r11b, byte [r8 + rbx + 0x103c4]
cmp r11b, 0xcc
je 0x1400017e3
lea eax, [r8 + rdx]
cmp r11b, byte [rax + r10]
jne 0x1400018ab
inc r8d
cmp r8d, 3
jb 0x1400017c7
mov ecx, edx
add rcx, 3
add rcx, r10
je 0x140001866
mov r8d, 0xb
cmp r15d, 3
je 0x14000180e
cmp r15d, 5
cmove r12, r8
mov r8, r12
movsxd rax, dword [rcx]
xor edi, edi
mov r15, qword [rsp + 0x28]
add rax, r8
mov r12, qword [rsp + 0x30]
mov ecx, edx
add rcx, rax
mov esi, dword [rcx + r10]
test esi, esi
je 0x140001937
xor ebx, ebx
mov rax, qword [r14 + rdi*8 + 7]
and rax, 0xfffffffffffffff8
test r12, r12
je 0x1400018ba
test r15, r15
je 0x1400018ba
cmp qword [rax], r12
jne 0x1400018fe
mov qword [rax], r15
jmp 0x1400018fe
inc r10d
mov eax, r10d
cmp rax, rdx
jb 0x1400016f3
mov eax, 0xc0000225
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000e590
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
inc edx
mov eax, edx
cmp rax, r9
jb 0x140001769
jmp 0x140001866
inc edx
mov eax, edx
cmp rax, r9
jb 0x1400017c4
jmp 0x140001866
mov rcx, qword [r13 + 8]
lea r8, [rsp + 0x40]
mov rax, qword [rax]
mov qword [rbx + rcx], rax
mov rdx, qword [r13 + 8]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdx + rbx]
call fcn.140001cac
test eax, eax
js 0x1400018fe
mov rcx, qword [r13 + 8]
lea r8, [rsp + 0x40]
add rcx, 8
mov edx, 0x100
add rcx, rbx
call sub.ntoskrnl.exe_strcpy_s
test eax, eax
jne 0x140001930
inc rdi
add rbx, 0x108
cmp rdi, rsi
jb 0x140001833
mov eax, dword [rsp + 0x20]
test r12, r12
jne 0x14000186b
test r15, r15
jne 0x14000186b
mov dword [r13 + 4], esi
jmp 0x14000186b
mov eax, 0x80
jmp 0x140001915
mov eax, edi
jmp 0x140001915