Function at 0x1400037f0
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400301c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Iniciando_unhooking_de_ntdll.dll
call fcn.1400076b0
mov rcx, rax
lea rdx, [0x140007890]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x140026240]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140003873
lea rdx, str.Error_al_obtener_el_handle_de_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
mov rcx, rax
lea rdx, [0x140007890]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001ed00
add rsp, 0x70
pop rbx
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x1400038ac
lea rdx, str.Error_al_obtener_la_informaci
jmp 0x140003844
xor ebx, ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x30], rbx
lea rcx, str.C:WindowsSystem32_ntdll.dll
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003913
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_abrir_ntdll.dll_en_el_disco
call fcn.1400076b0
mov rcx, rax
lea rdx, [0x140007890]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003ad0
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0x1000002
mov qword [rsp + 0x88], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
jne 0x140003971
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_crear_el_mapa_de_memoria_para_ntdll.dll
call fcn.1400076b0
mov rcx, rax
lea rdx, [0x140007890]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003ac8
xor r9d, r9d
mov qword [rsp + 0x80], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
jne 0x1400039d4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_mapear_ntdll.dll_en_la_memoria
call fcn.1400076b0
mov rcx, rax
lea rdx, [0x140007890]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003ac0
mov ebx, dword [rsp + 0x50]
mov rdx, rbp
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003a5f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0x48]
mov r9d, ebx
mov rcx, rax
mov r8, rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140003a3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_escribir_la_memoria_del_proceso:
mov ebx, eax
call fcn.1400076b0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140003a72
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Unhooking_exitoso__bytes_escritos:
call fcn.1400076b0
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
jmp 0x140003a72
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.No_se_detectaron_hooks_en_ntdll.dll
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Unhooking_de_ntdll.dll_completado
call fcn.1400076b0
mov rcx, rax
lea rdx, [0x140007890]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001ed00
add rsp, 0x70
pop rbx
ret