Function at 0x140011140
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012930
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x140027167]
call fcn.1400113e3
nop
call fcn.1400112a3
mov qword [rbp + 8], rax
mov rdx, qword [rbp + 8]
lea rcx, str.___Hooked_NTDLL_base_address:_0x_p_n
call fcn.1400111cc
nop
mov rdx, qword [rbp + 0x220]
lea rcx, str.___Unhooked_NTDLL_base_address:_0x_p_n
call fcn.1400111cc
nop
lea rcx, str._____Press_ENTER_to_continue___n
call fcn.1400111cc
nop
call qword [sym.imp.ucrtbased.dll_getchar]
nop
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1400129e0
mov rax, qword [rbp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400129e0
xor eax, eax
jmp 0x140012c9b
mov rax, qword [rbp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x4550
je 0x140012a09
xor eax, eax
jmp 0x140012c9b
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa8], 0
mov rax, qword [rbp + 0x48]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x48]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0xe4], 0
jmp 0x140012a59
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
movzx eax, word [rax + 6]
cmp dword [rbp + 0xe4], eax
jge 0x140012b00
movsxd rax, dword [rbp + 0xe4]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0xc8]
mov eax, dword [rcx + rax]
or eax, 0x20202020
cmp eax, 0x7865742e
jne 0x140012afb
movsxd rax, dword [rbp + 0xe4]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0xc8]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
movsxd rax, dword [rbp + 0xe4]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0xc8]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
movsxd rax, dword [rbp + 0xe4]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0xc8]
mov eax, dword [rcx + rax + 8]
mov qword [rbp + 0xa8], rax
jmp 0x140012b00
jmp 0x140012a4b
mov rdx, qword [rbp + 0x68]
lea rcx, str._i__Hooked___NTDLL_.text_section_address:_0x_p_n
call fcn.1400111cc
nop
mov rdx, qword [rbp + 0x88]
lea rcx, str._i__Unhooked_NTDLL_.text_section_address:_0x_p_n
call fcn.1400111cc
nop
mov rdx, qword [rbp + 0xa8]
lea rcx, str._i__.text_section_size:__d_n
call fcn.1400111cc
nop
lea rcx, str._____Press_ENTER_to_continue___n
call fcn.1400111cc
nop
call qword [sym.imp.ucrtbased.dll_getchar]
nop
cmp qword [rbp + 0x68], 0
je 0x140012b68
cmp qword [rbp + 0x88], 0
je 0x140012b68
cmp qword [rbp + 0xa8], 0
jne 0x140012b6f
xor eax, eax
jmp 0x140012c9b
mov rdx, qword [rbp + 0x68]
lea rcx, str._i__Replacing_the_.text_section_at_address_0x_p..._n
call fcn.1400111cc
nop
mov dword [rbp + 0x104], 0
lea rcx, str._i__Making_the_.text_section_writeable_and_executable_n
call fcn.1400111cc
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x104]
mov qword [rsp + 0x20], rcx
mov r9d, 0x80
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1400113b1
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
je 0x140012beb
mov edx, dword [rbp + 0x124]
lea rcx, str.____NtProtectVirtual_1__memory_could_not_change_memory_permissions_on_the_buffer_STATUS_0x_X_n
call fcn.1400111cc
nop
xor eax, eax
jmp 0x140012c9b
lea rcx, str.___Changed_the_permissions_of_.text_section_to_PAGE_EXECUTE_WRITECOPY_n
call fcn.1400111cc
nop
lea rcx, str._i__Copying_the_new_.text_section_n
call fcn.1400111cc
nop
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
call fcn.1400111ea
nop
lea rcx, str.___Successfully_replaced_the_hooked_NTDLLs_.text_section_n
call fcn.1400111cc
nop
lea rcx, str._i__Restoring_the_old_memory_protection_n
call fcn.1400111cc
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x104]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x104]
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1400113b1
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
je 0x140012c89
mov edx, dword [rbp + 0x124]
lea rcx, str.____NtProtectVirtualMemory_2__could_not_change_memory_permissions_on_the_buffer_STATUS_0x_X_n
call fcn.1400111cc
nop
xor eax, eax
jmp 0x140012c9b
lea rcx, str.___DONE__n
call fcn.1400111cc
nop
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001c1c0]
call fcn.140011366
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret