Function at 0x14001e2a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.wine_get_version
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySection
mov rcx, rdi
mov rbx, rax
lea rax, str.NtPulseEvent
test rbx, rbx
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySection
mov rcx, rdi
movzx esi, byte [rax + 4]
dec sil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
movzx ebp, byte [rax + 4]
dec bpl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rbx, rbx
lea r9, str.water
lea r8, str.We_are_drinking:__s_n
lea rdx, [0x1400388b8]
movzx r14d, byte [rax + 4]
lea rcx, [0x1400bfc50]
lea rax, str.wine
cmovne r9, rax
call fcn.14001d680
lea rdx, str.NtProtectVirtualMemory
mov dword [rsp + 0x68], 0xb8d18b4c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
lea rcx, [0x1400bfc50]
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0x4c
je 0x14001e472
lea r8, str.We_are_about_to_patch_vp._n
lea rdx, [0x1400388dc]
call fcn.14001d680
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
mov edx, 1
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, str.ntp:__x_n
lea rdx, [0x1400388ec]
lea rcx, [0x1400bfc50]
movzx r9d, byte [rax + rbx]
call fcn.14001d680
inc rbx
cmp rbx, 5
jl 0x14001e3b0
movzx ecx, bpl
lea r8, str.patching.__x__x__x_n
mov dword [rsp + 0x28], r14d
lea rdx, [0x140038820]
mov dword [rsp + 0x20], ecx
lea rcx, [0x1400bfc50]
movzx r9d, sil
call fcn.14001d680
mov rcx, qword [rsp + 0x70]
lea r8, str.patched._oldprot:__d_n
mov eax, dword [rsp + 0x68]
lea rdx, [0x140038920]
mov r9d, dword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rcx + 4], sil
lea rcx, [0x1400bfc50]
call fcn.14001d680
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, str.Bypassed_VMP_n
lea rdx, [0x140038938]
lea rcx, [0x1400bfc50]
jmp 0x14001e480
lea r8, str.Nothing_seems_to_be_hooking_NtProtectVirtualMemory_n
lea rdx, [0x140038974]
call fcn.14001d700
xor ecx, ecx
call fcn.1400222f0
test eax, eax
jne 0x14001e4ac
lea r8, str.Disabled_all_hooks_n
lea rdx, [0x14003898c]
lea rcx, [0x1400bfc50]
call fcn.14001dbb0
jmp 0x14001e4d0
mov ecx, eax
call fcn.140022560
mov r9, rax
lea r8, str.Something_went_wrong_while_disabling_hooks:__s_n
lea rdx, [0x1400389c0]
lea rcx, [0x1400bfc50]
call fcn.14001d6c0
xor ecx, ecx
call fcn.1400223b0
test eax, eax
jne 0x14001e4f7
lea r8, str.Removed_all_hooks_n
lea rdx, [0x1400389dc]
lea rcx, [0x1400bfc50]
call fcn.14001dbb0
jmp 0x14001e53c
cmp eax, 4
jne 0x14001e518
lea r8, str.No_hooks_to_remove._n
lea rdx, [0x1400389f8]
lea rcx, [0x1400bfc50]
call fcn.14001dbb0
jmp 0x14001e53c
mov ecx, eax
call fcn.140022560
mov r9, rax
lea r8, str.Something_went_wrong_while_removing_hooks:__s_n
lea rdx, [0x140038a30]
lea rcx, [0x1400bfc50]
call fcn.14001d6c0
call fcn.140022640
test eax, eax
jne 0x14001e561
lea r8, str.MinHook_un_initialized_n
lea rdx, [0x140038a50]
lea rcx, [0x1400bfc50]
call fcn.14001dbb0
jmp 0x14001e585
mov ecx, eax
call fcn.140022560
mov r9, rax
lea r8, str.Something_went_wrong_while_un_initializing_MinHook:__s_n
lea rdx, [0x140038a90]
lea rcx, [0x1400bfc50]
call fcn.14001d6c0
mov rdi, qword [0x1400bf050]
mov rbx, qword [0x1400bf048]
cmp rbx, rdi
je 0x14001e5c6
nop dword [rax + rax]
mov rcx, qword [rbx]
lea r9, [rsp + 0x60]
mov edx, 1
mov byte [rbx + 0x10], 0
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rbx, 0x18
cmp rbx, rdi
jne 0x14001e5a0
lea r8, str.Removed_all_VEH_hooks._n
lea rdx, [0x140038ab0]
lea rcx, [0x1400bfc50]
call fcn.14001dbb0
mov rcx, qword [0x1400bfd00]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]