Function at 0x180001950
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
lea rbp, [rsp - 0x57]
mov eax, 0x90
call fcn.180025560
sub rsp, rax
mov qword [r9], 0
mov rax, qword [rcx + 8]
mov qword [rbp - 9], rax
mov eax, dword [rcx + 0x10]
mov qword [rsp + 0xa0], rbx
mov rbx, rcx
shl eax, 7
cdqe
mov qword [rsp + 0xb0], rdi
mov rdi, rdx
mov qword [rsp + 0x80], r13
mov r13, r8
mov qword [rbp - 1], rax
mov qword [rbp + 7], 0x40
mov byte [rbp + 0xf], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp - 1]
mov r9d, 0x40
mov rdx, qword [rbp - 9]
mov rcx, rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
setne byte [rbp + 0xf]
test eax, eax
je 0x180002061
mov ecx, dword [rbx + 0x14]
cmp ecx, dword [rbx + 0x10]
jge 0x180002061
lea eax, [rcx + 1]
mov qword [rsp + 0x88], r12
shl ecx, 7
movsxd r12, ecx
mov dword [rbx + 0x14], eax
add r12, qword [rbx + 8]
je 0x180002059
mov qword [rsp + 0xa8], rsi
xor ebx, ebx
mov qword [rsp + 0x78], r14
xor esi, esi
mov r11d, 1
mov qword [rsp + 0x70], r15
xor r14d, r14d
mov r15d, r11d
lea r10d, [rbx + 5]
movsxd r9, ebx
mov r8d, ebx
movzx ecx, byte [rdi + r9]
test r14, r14
je 0x180001a59
cmp cl, 0x90
je 0x180001a52
cmp cl, 0xcc
jne 0x180002047
inc ebx
jmp 0x180001f18
cmp cl, 0xf
jne 0x180001ac3
movzx eax, byte [r9 + rdi + 1]
lea rcx, [r9 + 1]
cmp al, 0x1f
jne 0x180001a97
add ebx, 2
movsxd rax, ebx
movzx ecx, byte [rax + rdi]
movzx eax, cl
and al, 0xc0
cmp al, 0x40
jne 0x180002047
and cl, 7
cmp cl, 4
jne 0x180002047
add ebx, 3
jmp 0x180001f18
cmp al, 5
jne 0x180001aa3
add ebx, 2
jmp 0x180001f18
cmp al, 0x84
jne 0x180002047
movsxd rax, dword [rcx + rdi + 1]
mov rsi, r9
add rax, rcx
xor r15d, r15d
lea r14, [rax + rdi + 5]
jmp 0x180001f15
lea eax, [rcx - 0x40]
cmp al, r11b
jbe 0x180001ef5
cmp cl, 0x45
jne 0x180001ae8
cmp byte [rdi + r9 + 1], 0x33
jne 0x180002047
add ebx, 3
jmp 0x180001f18
movzx eax, cl
and al, 0xfb
cmp al, 0x48
jne 0x180001ca0
movsxd r10, ebx
inc r10
movzx edx, byte [r10 + rdi]
cmp dl, 0x81
jne 0x180001b1f
movzx eax, byte [rdi + r9 + 2]
and al, 0xf8
cmp al, 0xe8
jne 0x180001b58
add ebx, 7
mov r10d, 5
jmp 0x180001f18
cmp dl, 0x83
jne 0x180001b58
lea ecx, [rbx + 2]
movsxd rax, ecx
movzx r8d, byte [rax + rdi]
and r8b, 0xf8
cmp r8b, 0xe8
jne 0x180001b47
add ebx, 4
mov r10d, 5
jmp 0x180001f18
cmp r8b, 0x60
jne 0x180001b5b
mov r10d, 5
jmp 0x180001f15
lea ecx, [rbx + 2]
cmp dl, 0x85
jne 0x180001b81
movsxd rax, ecx
movzx ecx, byte [rax + rdi]
and cl, 0xc0
cmp cl, 0xc0
jne 0x180002047
add ebx, 3
mov r10d, 5
jmp 0x180001f18
movzx eax, dl
and al, 0xfd
cmp al, 0x89
jne 0x180001c3a
movsxd rbx, ecx
mov r8, rbx
add r8, rdi
je 0x180002047
movzx edx, byte [r8]
mov ecx, edx
and ecx, 0xc0
je 0x180001be8
sub ecx, 0x40
je 0x180001bcc
sub ecx, 0x40
je 0x180001c04
cmp ecx, 0x40
jne 0x180002047
mov eax, r11d
lea r10d, [rcx - 0x3b]
add ebx, eax
jmp 0x180001f18
mov ecx, 2
and dl, 7
cmp dl, 4
lea eax, [rcx + 1]
cmovne eax, ecx
lea r10d, [rcx + 3]
add ebx, eax
jmp 0x180001f18
movzx eax, dl
and al, 7
cmp al, 5
je 0x180002047
cmp al, 4
jne 0x180001c1f
movzx eax, byte [r8 + 1]
and al, 7
cmp al, 5
jne 0x180001c1f
mov r10d, 5
and dl, 7
cmp dl, 4
lea eax, [r10 + 1]
cmovne eax, r10d
add ebx, eax
jmp 0x180001f18
and dl, 7
lea eax, [r11 + 1]
cmp dl, 4
mov r10d, 5
cmovne eax, r11d
add ebx, eax
jmp 0x180001f18
cmp dl, 0xc7
jne 0x180001c5a
movsxd rax, ecx
cmp byte [rax + rdi], 0x44
jne 0x180002047
add ebx, 9
mov r10d, 5
jmp 0x180001f18
cmp dl, 0xff
jne 0x180002047
movsxd rax, ecx
movzx ecx, byte [rax + rdi]
test cl, 0xc0
jne 0x180002047
and cl, 7
cmp cl, 5
jne 0x180002047
movsxd rax, dword [r10 + rdi + 2]
mov rsi, r9
add rax, r10
mov r15d, r11d
add ebx, 7
mov r10d, 5
mov r14, qword [rax + rdi + 6]
jmp 0x180001f18
cmp cl, 0x66
jne 0x180001d08
inc ebx
movsxd rax, ebx
movzx ecx, byte [rax + rdi]
add cl, 0x78
cmp cl, 3
ja 0x180001f18
movzx edx, byte [rdi + r9 + 2]
movzx eax, dl
and al, 0xc0
cmp al, 0xc0
je 0x180001cff
test al, al
jne 0x180001ce1
movzx ecx, dl
and cl, 7
cmp cl, 4
je 0x180002047
cmp cl, 5
jne 0x180001cff
cmp al, 0x40
jne 0x180002047
xor ebx, ebx
and dl, 7
cmp dl, 4
sete bl
add ebx, 4
add ebx, r8d
jmp 0x180001f18
lea ebx, [r8 + 3]
jmp 0x180001f18
movzx eax, cl
and al, 0xf0
cmp al, 0x50
jne 0x180001d18
inc ebx
jmp 0x180001f18
cmp cl, 0x65
jne 0x180001ddc
cmp byte [rdi + r9 + 1], 0x48
jne 0x180002047
movzx eax, byte [rdi + r9 + 2]
add al, 0x78
cmp al, 3
ja 0x180002047
lea r8, [rdi + r9 + 3]
test r8, r8
je 0x180002047
movzx edx, byte [r8]
mov ecx, edx
and ecx, 0xc0
je 0x180001d92
sub ecx, 0x40
je 0x180001d78
sub ecx, 0x40
je 0x180001dae
cmp ecx, 0x40
jne 0x180002047
mov eax, r11d
lea ebx, [rbx + rax + 3]
jmp 0x180001f18
mov ecx, 2
and dl, 7
cmp dl, 4
lea eax, [rcx + 1]
cmovne eax, ecx
lea ebx, [rbx + rax + 3]
jmp 0x180001f18
movzx eax, dl
and al, 7
cmp al, 5
je 0x180002047
cmp al, 4
jne 0x180001dc5
movzx eax, byte [r8 + 1]
and al, 7
cmp al, 5
jne 0x180001dc5
and dl, 7
lea eax, [r10 + 1]
cmp dl, 4
cmovne eax, r10d
lea ebx, [rbx + rax + 3]
jmp 0x180001f18
and dl, 7
lea eax, [r11 + 1]
cmp dl, 4
cmovne eax, r11d
lea ebx, [rbx + rax + 3]
jmp 0x180001f18
cmp cl, 0x90
jne 0x180001de8
inc ebx
jmp 0x180001f18
cmp cl, 0xb8
jne 0x180001df5
add ebx, 5
jmp 0x180001f18
cmp cl, 0x33
jne 0x180001e02
add ebx, 2
jmp 0x180001f18
cmp cl, 0xf6
jne 0x180001ea8
lea r8, [rdi + r9 + 1]
test r8, r8
je 0x180002047
movzx edx, byte [r8]
mov ecx, edx
and ecx, 0xc0
je 0x180001e5d
sub ecx, 0x40
je 0x180001e46
sub ecx, 0x40
je 0x180001e79
cmp ecx, 0x40
jne 0x180002047
mov ecx, r11d
lea ebx, [rbx + rcx + 2]
jmp 0x180001f18
mov r8d, 2
movzx eax, dl
and al, 7
cmp al, 4
lea ecx, [r8 + 1]
cmovne ecx, r8d
jmp 0x180001e99
movzx eax, dl
and al, 7
cmp al, 5
je 0x180002047
cmp al, 4
jne 0x180001e8a
movzx eax, byte [r8 + 1]
and al, 7
cmp al, 5
jne 0x180001e8a
movzx eax, dl
lea ecx, [r10 + 1]
and al, 7
cmp al, 4
cmovne ecx, r10d
jmp 0x180001e99
movzx eax, dl
lea ecx, [r11 + 1]
and al, 7
cmp al, 4
cmovne ecx, r11d
test dl, 0x38
jne 0x180002047
lea ebx, [rbx + rcx + 2]
jmp 0x180001f18
cmp cl, 0xc3
jne 0x180001eb1
inc ebx
jmp 0x180001f18
cmp cl, 0xcc
jne 0x180001eba
inc ebx
jmp 0x180001f18
cmp cl, 0xe9
jne 0x180001ed7
movsxd rax, dword [rdi + r9 + 1]
mov rsi, r9
add rax, r9
mov r15d, r11d
add ebx, 5
lea r14, [rax + rdi + 5]
jmp 0x180001f18
cmp cl, 0xff
jne 0x180002047
movzx eax, byte [rdi + r9 + 1]
and al, 0xf8
cmp al, 0xf0
jne 0x180002047
add ebx, 2
jmp 0x180001f18
movzx ecx, byte [rdi + r9 + 1]
movzx eax, cl
and al, 0xf0
cmp al, 0x50
jne 0x180001f09
add ebx, 2
jmp 0x180001f18
add cl, 0x48
cmp cl, 7
ja 0x180002047
add ebx, 6
cmp ebx, 0xd
jl 0x180001a34
cmp ebx, 0x64
jg 0x180002047
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EncodePointer]
movsxd rbx, ebx
mov rdx, rdi
mov qword [r12], rax
mov r8, rbx
add r12, 8
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbx + rdi]
test r14, r14
je 0x180001fab
test r15d, r15d
jne 0x180001f78
mov word [rsi + r12], 0xe75
add rsi, 2
mov word [r12 + rsi], 0x25ff
mov dword [r12 + rsi + 2], r15d
mov qword [r12 + rsi + 6], r14
jmp 0x180001f93
mov word [rsi + r12], 0x25ff
mov dword [rsi + r12 + 2], 0
mov qword [rsi + r12 + 6], r14
cmp r15d, 1
je 0x180001fc0
mov word [rsi + r12 + 0xe], 0x25ff
mov dword [rsi + r12 + 0x10], 0
mov qword [rsi + r12 + 0x14], rax
jmp 0x180001fc0
mov word [rbx + r12], 0x25ff
mov dword [rbx + r12 + 2], 0
mov qword [rbx + r12 + 6], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], 0x40
mov qword [rax], r12
mov byte [rbp + 0x2f], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x1f]
mov r9d, 0x40
mov rcx, rax
mov rdx, rdi
lea rax, [rbp + 0x2b]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
setne cl
mov byte [rbp + 0x2f], cl
test eax, eax
je 0x18000201f
mov word [rdi], 0xbb49
mov qword [rdi + 2], r13
mov word [rdi + 0xa], 0xff41
mov byte [rdi + 0xc], 0xe3
test cl, cl
je 0x180002047
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rbp + 0x2b]
mov rcx, rax
mov r8, qword [rbp + 0x1f]
lea rax, [rbp + 0x2b]
mov rdx, qword [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
cmp byte [rbp + 0xf], 0
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
je 0x1800020a3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rbp + 0xb]
mov rcx, rax
mov r8, qword [rbp - 1]
lea rax, [rbp + 0xb]
mov rdx, qword [rbp - 9]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add rsp, 0x90
pop rbp
ret