Function at 0x100032f0
Capabilities:
Check for hardware breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2d8], 1
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2dc], edi
test ebx, ebx
je 0x1000335b
lea eax, [ebp - 0x2d0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000358d
mov ecx, dword [ebp - 0x210]
test ecx, 0x20000
jne 0x10003352
cmp dword [ebp - 0x214], 0x1b
je 0x1000335b
and dword [ebp - 0x2d8], 0
jmp 0x10003399
lea eax, [ebp - 0x2d4]
push eax
push 0x2cc
lea eax, [ebp - 0x2d0]
push eax
push dword [0x1000544c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1000358d
cmp dword [ebp - 0x2d4], 0x2cc
jne 0x1000358d
mov ecx, dword [ebp - 0x210]
mov edi, dword [esi]
mov edx, 0x10001
mov eax, edi
and eax, edx
cmp eax, edx
jne 0x10003407
mov eax, dword [esi + 0xb4]
mov edx, 0x20000
mov dword [ebp - 0x21c], eax
mov eax, dword [esi + 0xb8]
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0xc0]
and eax, 0x53fd7
test edx, ecx
je 0x100033d6
or eax, edx
mov ecx, dword [esi + 0xbc]
mov dword [ebp - 0x210], eax
test edx, eax
jne 0x100033e9
or ecx, 3
mov eax, dword [esi + 0xc8]
mov dword [ebp - 0x208], eax
mov eax, dword [esi + 0xc4]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x20c], eax
mov ecx, 0x10004
mov eax, edi
and eax, ecx
cmp eax, ecx
jne 0x10003444
mov eax, dword [esi + 0x8c]
mov dword [ebp - 0x244], eax
mov eax, dword [esi + 0x90]
mov dword [ebp - 0x240], eax
mov eax, dword [esi + 0x94]
mov dword [ebp - 0x23c], eax
mov eax, dword [esi + 0x98]
mov dword [ebp - 0x238], eax
mov ecx, 0x10002
mov eax, edi
and eax, ecx
cmp eax, ecx
jne 0x10003499
mov eax, dword [esi + 0x9c]
mov dword [ebp - 0x234], eax
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0x230], eax
mov eax, dword [esi + 0xa4]
mov dword [ebp - 0x22c], eax
mov eax, dword [esi + 0xac]
mov dword [ebp - 0x224], eax
mov eax, dword [esi + 0xa8]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0xb0]
mov dword [ebp - 0x220], eax
mov ecx, 0x10008
mov eax, edi
and eax, ecx
cmp eax, ecx
jne 0x100034fa
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x2b4], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x2b0], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x2ac], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x2a8], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x2a0], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x29c], eax
lea eax, [esi + 0x38]
push 0x50
push eax
lea eax, [ebp - 0x298]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, 0x10010
and edi, eax
cmp edi, eax
jne 0x1000353b
mov eax, dword [esi + 4]
mov dword [ebp - 0x2cc], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c8], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c4], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c0], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x2bc], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2d8], 0
jne 0x10003556
lea eax, [ebp - 0x2d0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1000358d
lea eax, [ebp - 0x2d4]
mov ebx, 0x2cc
push eax
push ebx
lea eax, [ebp - 0x2d0]
push eax
push dword [0x1000544c]
push dword [ebp - 0x2dc]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000358d
cmp dword [ebp - 0x2d4], ebx
jne 0x1000358d
xor eax, eax
inc eax
jmp 0x1000358f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003bb0
mov esp, ebp
pop ebp
ret 0xc