Function at 0x140001290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebx, ebx
lea rcx, [r11 - 0x58]
mov byte [r11 - 0x58], 0x6b
mov byte [r11 - 0x57], 0x65
mov byte [r11 - 0x56], 0x72
mov byte [r11 - 0x55], 0x6e
mov dword [rsp + 0x30], ebx
mov edi, ebx
mov qword [rsp + 0x38], rbx
mov byte [r11 - 0x54], 0x65
mov byte [r11 - 0x53], 0x6c
mov byte [r11 - 0x52], 0x33
mov byte [r11 - 0x51], 0x32
mov byte [r11 - 0x50], 0x2e
mov byte [r11 - 0x4f], 0x64
mov byte [r11 - 0x4e], 0x6c
mov byte [r11 - 0x4d], 0x6c
mov byte [r11 - 0x4c], bl
mov byte [r11 - 0x48], 0x56
mov byte [r11 - 0x47], 0x69
mov byte [r11 - 0x46], 0x72
mov byte [r11 - 0x45], 0x74
mov byte [r11 - 0x44], 0x75
mov byte [r11 - 0x43], 0x61
mov byte [r11 - 0x42], 0x6c
mov byte [r11 - 0x41], 0x50
mov byte [r11 - 0x40], 0x72
mov byte [r11 - 0x3f], 0x6f
mov byte [r11 - 0x3e], 0x74
mov byte [r11 - 0x3d], 0x65
mov byte [r11 - 0x3c], 0x63
mov byte [r11 - 0x3b], 0x74
mov byte [r11 - 0x3a], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0xd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 1
lea r9, [rsp + 0x40]
movzx edx, r8b
mov rcx, rax
mov rsi, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
mov r11, rax
mov eax, 0xcccccccd
mul dword [rsp + 0x40]
shr edx, 4
sub edx, 1
je 0x140001643
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], r13
lea rbp, [r11 + 0x10]
mov eax, edx
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0x58], rax
nop word [rax + rax]
mov ebx, dword [rbp - 4]
lea rcx, str.DLL_name_in_IAT_:__s_n
add rbx, rsi
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_printf]
mov r13d, dword [rbp]
mov r15d, dword [rbp - 0x10]
mov rcx, rbx
add r13, rsi
add r15, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
add rcx, rax
mov qword [rsp + 0x70], rcx
mov eax, dword [rcx + 0x1c]
mov r14d, dword [rcx + 0x20]
add rax, r12
add r14, r12
mov qword [rsp + 0x80], rax
mov eax, dword [rcx + 0x24]
mov rcx, qword [r15]
add rax, r12
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x78], rax
test rcx, rcx
je 0x140001606
lea rax, str.EnterCriticalSection
lea rbp, [rcx + rsi + 2]
mov esi, 7
mov qword [rsp + 0x88], rax
lea rax, str.LeaveCriticalSection
lea rbx, [rsp + 0x88]
mov qword [rsp + 0x90], rax
lea rax, str.DeleteCriticalSection
lea r14d, [rsi - 6]
mov qword [rsp + 0x98], rax
lea rax, str.InitializeSListHead
mov qword [rsp + 0xa0], rax
lea rax, str.HeapAlloc
mov qword [rsp + 0xa8], rax
lea rax, str.HeapReAlloc
mov qword [rsp + 0xb0], rax
lea rax, str.HeapSize
mov qword [rsp + 0xb8], rax
mov rdx, qword [rbx]
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll__stricmp]
test eax, eax
cmove edi, r14d
add rbx, 8
sub rsi, r14
jne 0x1400014e3
mov r14, qword [rsp + 0x60]
test edi, edi
jne 0x1400015e5
mov rax, qword [rsp + 0x70]
xor r10d, r10d
xor r9d, r9d
mov r11d, dword [rax + 0x18]
test r11d, r11d
je 0x140001575
nop
mov r8d, dword [r14 + r9*4]
mov rax, rbp
add r8, r12
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001543
inc rax
test ecx, ecx
jne 0x140001530
test edx, edx
je 0x140001559
inc r10d
inc r9
cmp r10d, r11d
jb 0x140001520
mov rax, qword [rsp + 0x38]
jmp 0x14000157a
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
mov qword [rsp + 0x38], rax
jmp 0x14000157a
mov rax, qword [rsp + 0x38]
lea rbx, [r12 + rax]
cmp qword [r13], rbx
je 0x1400015d5
mov rdi, qword [rsp + 0x68]
mov edx, 8
lea r9, [rsp + 0x30]
lea r8d, [rdx - 4]
mov rcx, r13
mov dword [rsp + 0x30], 0
call rdi
mov r8, qword [r13]
lea rcx, str.Bad_News___Function__s_is_hooked___Address_is__x_and_its_suppose_to_be__x__nUnhook_like_the_captain___n
mov r9, rbx
mov rdx, rbp
call qword [sym.imp.MSVCR90.dll_printf]
mov qword [r13], rbx
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 8
mov rcx, r13
call rdi
jmp 0x1400015e5
lea rcx, str.Good_news___Function__s_is_not_hooked_:D_n
mov rdx, rbp
call qword [sym.imp.MSVCR90.dll_printf]
mov rcx, qword [r15 + 8]
mov rsi, qword [rsp + 0x48]
add r15, 8
add r13, 8
xor edi, edi
test rcx, rcx
jne 0x140001464
mov rbp, qword [rsp + 0x50]
add rbp, 0x14
sub qword [rsp + 0x58], 1
mov qword [rsp + 0x50], rbp
jne 0x1400013f0
mov r15, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
mov r13, qword [rsp + 0x130]
mov r12, qword [rsp + 0x128]
mov rbp, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400027a0
add rsp, 0x100
pop rdi
pop rsi
pop rbx
ret