Function at 0x140006133
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x120], xmm7
movaps xmmword [rbp + 0x110], xmm6
mov qword [rbp + 0x108], 0xfffffffffffffffe
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
xor r13d, r13d
lea rsi, str.ntdll.dll
mov rbx, rdi
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x1400061a1
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
call fcn.14000b358
test eax, eax
jne 0x140006185
mov r13, qword [rbx + 0x30]
movsxd rax, dword [r13 + 0x3c]
mov esi, dword [r13 + rax + 0x88]
mov eax, dword [r13 + rsi + 0x1c]
mov edi, dword [r13 + rsi + 0x20]
add rax, r13
mov qword [rbp], rax
add rdi, r13
mov eax, dword [r13 + rsi + 0x24]
add rax, r13
mov qword [rbp + 8], rax
xor r15d, r15d
xorps xmm6, xmm6
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0x10], rdi
cmp r15d, dword [r13 + rsi + 0x18]
jae 0x140006ad4
mov ebx, r15d
mov eax, dword [rdi + rbx*4]
lea r14, [rax + r13]
movzx eax, byte [r13 + rax]
add eax, 0xffffffa6
jne 0x140006206
movzx eax, byte [r14 + 1]
add eax, 0xffffff89
test eax, eax
jne 0x140006ab5
mov qword [rbp + 0x58], r15
add r14, 2
movaps xmmword [rbp + 0xe0], xmm6
movaps xmmword [rbp + 0xd0], xmm6
mov rcx, r14
call fcn.14000b2b0
test rax, rax
js 0x14000702c
mov r15, rax
cmp rax, 0xf
ja 0x14000626e
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 0xf
lea rcx, [rbp + 0xd0]
mov rdx, r14
mov r8, r15
call fcn.14002ad20
add r15, rbp
add r15, 0xd0
jmp 0x1400062c3
mov rax, r15
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
lea rcx, [rdi + 1]
cmp rax, 0xfff
jb 0x140006295
call fcn.140001164
jmp 0x14000629a
call fcn.14000750c
mov r12, rax
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], rdi
mov rcx, rax
mov rdx, r14
mov r8, r15
call fcn.14002ad20
add r15, r12
mov byte [r15], 0
mov r14, qword [rbp + 0xe0]
mov rdi, qword [rbp + 0xe8]
mov rax, rdi
sub rax, r14
cmp rax, 2
jae 0x1400063b2
mov rax, r14
shr rax, 1
movabs rcx, 0x3fffffffffffffff
cmp rax, rcx
je 0x140007036
mov rsi, r13
mov r12, r14
add r12, 2
movabs r13, 0x7fffffffffffffff
movabs rcx, 0x8000000000000000
js 0x140006333
mov rax, rdi
shr rax, 1
mov rdx, rax
xor rdx, r13
cmp rdx, rdi
jae 0x140006486
call fcn.140001164
mov r15, rax
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r13
cmp rdi, 0x10
jb 0x14000645e
mov r12, qword [rbp + 0xd0]
mov word [r15], 0x744e
inc r14
lea rcx, [r15 + 2]
mov rdx, r12
mov r8, r14
call fcn.14002ad20
lea rdx, [rdi + 1]
cmp rdx, 0x1000
mov r13, rsi
jb 0x1400064b5
mov rax, qword [r12 - 8]
add r12, 0xfffffffffffffff8
sub r12, rax
cmp r12, 0x20
mov rsi, qword [rbp + 0xc8]
jae 0x140007054
add rdi, 0x28
mov rdx, rdi
mov r12, rax
jmp 0x1400064bc
lea rax, [r14 + 2]
mov qword [rbp + 0xe0], rax
cmp rdi, 0x10
mov rcx, qword [rbp + 0xd0]
lea r15, [rbp + 0xd0]
cmovae r15, rcx
lea rsi, [0x14003540b]
lea rax, [rsi + 2]
cmp r15, rax
setae al
lea rdx, [r15 + r14]
cmp rdx, rsi
setb dl
or dl, al
mov r12d, 2
jne 0x14000640a
mov r12, r15
sub r12, rsi
ja 0x140006403
xor r12d, r12d
lea rsi, [0x14003540b]
inc r14
cmp rdi, 0x10
lea rax, [rbp + 0xd0]
cmovb rcx, rax
add rcx, 2
mov rdx, r15
mov r8, r14
call fcn.14002ad20
mov rcx, r15
mov rdx, rsi
mov r8, r12
call fcn.14002ad20
mov r8d, 2
sub r8, r12
lea rdx, [r12 + rsi]
add rdx, 2
add r15, r12
mov rcx, r15
call fcn.14002ad20
mov rsi, qword [rbp + 0xc8]
jmp 0x1400064cb
mov word [r15], 0x744e
inc r14
lea rcx, [r15 + 2]
lea rdx, [rbp + 0xd0]
mov r8, r14
call fcn.14002ad20
mov r13, rsi
mov rsi, qword [rbp + 0xc8]
jmp 0x1400064c4
mov rcx, r12
or rcx, 0xf
add rax, rdi
cmp rcx, rax
mov r13, rax
cmova r13, rcx
mov rcx, r13
inc rcx
jne 0x140006abd
mov r13, 0xffffffffffffffff
xor r15d, r15d
jmp 0x14000633b
mov rsi, qword [rbp + 0xc8]
mov rcx, r12
call fcn.140007548
mov qword [rbp + 0xd0], r15
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xd8]
movaps xmm0, xmmword [rbp + 0xe0]
movaps xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rcx
lea rax, [rbp + 0xd8]
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rbp + 0xf0], 0xf
mov rax, qword [rbp + 8]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp]
mov eax, dword [rcx + rax*4]
add rax, r13
mov qword [rbp + 0xd0], rax
mov r14, qword [rbp + 0x80]
cmp qword [rbp + 0x88], 0x10
lea r15, [rbp + 0x70]
jb 0x14000653e
mov r15, qword [rbp + 0x70]
cmp r14, 0xf
jbe 0x140006574
test r14, r14
js 0x14000703b
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
lea rcx, [rdi + 1]
cmp rax, 0xfff
jb 0x140006598
call fcn.140001164
jmp 0x14000659d
mov qword [rbp + 0xe8], r14
lea rcx, [rbp + 0xd8]
mov rdx, r15
mov r8, r14
call fcn.14002ad20
mov byte [rbp + r14 + 0xd8], 0
jmp 0x1400065c8
call fcn.14000750c
mov r12, rax
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], rdi
mov rcx, rax
mov rdx, r15
mov r8, r14
call fcn.14002ad20
mov byte [r12 + r14], 0
mov qword [rbp + 0xd8], r12
mov rbx, qword [0x140040b90]
cmp rbx, qword [0x140040b98]
je 0x14000663e
mov rax, qword [rbp + 0xd0]
mov qword [rbx], rax
movups xmmword [rbx + 8], xmm6
movups xmmword [rbx + 0x18], xmm6
mov rdi, qword [rbp + 0xf0]
lea r14, [rbp + 0xd8]
cmp rdi, 0x10
jb 0x140006605
mov r14, qword [rbp + 0xd8]
mov r15, qword [rbp + 0xe8]
test r15, r15
js 0x140007031
cmp r15, 0xf
ja 0x1400066c4
lea rax, [rbx + 8]
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
mov rax, rbx
jmp 0x140006716
mov rdi, rbx
sub rdi, qword [0x140040b88]
mov rax, rdi
sar rax, 4
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
lea r10, [rax + 1]
mov r8, rax
shr r8, 1
movabs rdx, 0x555555555555555
mov rcx, rdx
sub rcx, r8
add r8, rax
cmp r8, r10
mov qword [rbp + 0x18], r10
cmovbe r8, r10
cmp rax, rcx
cmova r8, rdx
movabs rax, 0x555555555555556
cmp r8, rax
jae 0x140007045
test r8, r8
mov qword [rbp + 0x60], r8
je 0x140006731
mov rax, r8
shl rax, 4
lea rcx, [rax + rax*2]
cmp r8, 0x56
jb 0x140006735
call fcn.140001164
jmp 0x14000673a
mov rax, r15
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
lea rcx, [r12 + 1]
cmp rax, 0xfff
jb 0x1400066ed
call fcn.140001164
jmp 0x1400066f2
call fcn.14000750c
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r12
inc r15
mov rcx, rax
mov rdx, r14
mov r8, r15
call fcn.14002ad20
mov rax, qword [0x140040b90]
mov rcx, qword [rbp + 0xf8]
mov qword [rbx + 0x28], rcx
add rax, 0x30
mov qword [0x140040b90], rax
jmp 0x140006a2d
xor ecx, ecx
jmp 0x14000673d
call fcn.14000750c
mov rcx, rax
mov rax, qword [rbp + 0xd0]
mov qword [rcx + rdi], rax
movups xmmword [rcx + rdi + 8], xmm6
movups xmmword [rcx + rdi + 0x18], xmm6
cmp qword [rbp + 0xf0], 0x10
lea r14, [rbp + 0xd8]
jb 0x14000676a
mov r14, qword [rbp + 0xd8]
lea rax, [rcx + rdi]
add rax, 0x30
mov qword [rbp + 0x68], rax
mov r15, qword [rbp + 0xe8]
test r15, r15
mov qword [rbp + 0xa0], rcx
js 0x140007040
lea r12, [rcx + rdi]
cmp r15, 0xf
ja 0x1400067b6
lea rax, [rcx + rdi]
add rax, 8
mov qword [r12 + 0x18], r15
mov qword [r12 + 0x20], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
jmp 0x140006802
mov rax, r15
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
lea rcx, [rdi + 1]
cmp rax, 0xfff
jb 0x1400067dd
call fcn.140001164
jmp 0x1400067e2
call fcn.14000750c
mov qword [r12 + 8], rax
mov qword [r12 + 0x18], r15
mov qword [r12 + 0x20], rdi
inc r15
mov rcx, rax
mov rdx, r14
mov r8, r15
call fcn.14002ad20
mov rax, qword [rbp + 0xf8]
mov qword [r12 + 0x28], rax
mov r15, qword [0x140040b90]
mov r14, qword [0x140040b88]
cmp r15, rbx
je 0x1400068ea
cmp r14, rbx
mov rdi, qword [rbp + 0xa0]
je 0x140006885
xor eax, eax
lea rcx, [r14 + rax]
add rcx, 0x30
mov rdx, qword [rcx - 0x30]
mov qword [rdi + rax], rdx
movups xmmword [rdi + rax + 0x18], xmm6
movups xmmword [rdi + rax + 8], xmm6
movups xmm0, xmmword [rcx - 0x28]
movups xmm1, xmmword [rcx - 0x18]
movups xmmword [rdi + rax + 0x18], xmm1
movups xmmword [rdi + rax + 8], xmm0
mov qword [rcx - 0x18], 0
mov qword [rcx - 0x10], 0xf
mov byte [rcx - 0x28], 0
mov rdx, qword [rcx - 8]
mov qword [rdi + rax + 0x28], rdx
add rax, 0x30
cmp rcx, rbx
jne 0x140006833
xor eax, eax
mov r8, qword [rbp + 0x68]
lea rcx, [rbx + rax]
add rcx, 0x30
mov rdx, qword [rcx - 0x30]
mov qword [r8 + rax], rdx
movups xmmword [r8 + rax + 0x18], xmm6
movups xmmword [r8 + rax + 8], xmm6
movups xmm0, xmmword [rcx - 0x28]
movups xmm1, xmmword [rcx - 0x18]
movups xmmword [r8 + rax + 0x18], xmm1
movups xmmword [r8 + rax + 8], xmm0
mov qword [rcx - 0x18], 0
mov qword [rcx - 0x10], 0xf
mov byte [rcx - 0x28], 0
mov rdx, qword [rcx - 8]
mov qword [r8 + rax + 0x28], rdx
add rax, 0x30
cmp rcx, r15
jne 0x14000688b
mov r14, qword [0x140040b88]
jmp 0x14000694a
cmp r14, rbx
mov rdi, qword [rbp + 0xa0]
je 0x14000694a
xor eax, eax
lea rcx, [r14 + rax]
add rcx, 0x30
mov rdx, qword [rcx - 0x30]
mov qword [rdi + rax], rdx
movups xmmword [rdi + rax + 0x18], xmm6
movups xmmword [rdi + rax + 8], xmm6
movups xmm0, xmmword [rcx - 0x28]
movups xmm1, xmmword [rcx - 0x18]
movups xmmword [rdi + rax + 0x18], xmm1
movups xmmword [rdi + rax + 8], xmm0
mov qword [rcx - 0x18], 0
mov qword [rcx - 0x10], 0xf
mov byte [rcx - 0x28], 0
mov rdx, qword [rcx - 8]
mov qword [rdi + rax + 0x28], rdx
add rax, 0x30
cmp rcx, rbx
jne 0x1400068f8
test r14, r14
je 0x1400069f3
cmp r14, r15
je 0x1400069bc
mov rax, qword [r14 + 0x20]
cmp rax, 0x10
jb 0x140006997
mov rcx, qword [r14 + 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140006992
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140007027
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140007548
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0xf
mov byte [r14 + 8], 0
add r14, 0x30
cmp r14, r15
jne 0x140006958
mov r14, qword [0x140040b88]
mov rdx, qword [0x140040b98]
sub rdx, r14
cmp rdx, 0x1000
jb 0x1400069eb
mov rax, qword [r14 - 8]
add r14, 0xfffffffffffffff8
sub r14, rax
cmp r14, 0x20
jae 0x140007059
add rdx, 0x27
mov r14, rax
mov rcx, r14
call fcn.140007548
mov qword [0x140040b88], rdi
mov rax, qword [rbp + 0x18]
lea rax, [rax + rax*2]
shl rax, 4
add rax, rdi
mov qword [0x140040b90], rax
mov rax, qword [rbp + 0x60]
lea rax, [rax + rax*2]
shl rax, 4
add rax, rdi
mov qword [0x140040b98], rax
mov rdi, qword [rbp + 0xf0]
mov r15, qword [rbp + 0x58]
cmp rdi, 0x10
jb 0x140006a6f
mov rcx, qword [rbp + 0xd8]
lea rdx, [rdi + 1]
cmp rdx, 0x1000
jb 0x140006a6a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000704f
add rdi, 0x28
mov rdx, rdi
mov rcx, rax
call fcn.140007548
mov rax, qword [rbp + 0x88]
cmp rax, 0x10
mov rdi, qword [rbp + 0x10]
jb 0x140006ab5
mov rcx, qword [rbp + 0x70]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140006ab0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000704a
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140007548
inc r15d
jmp 0x1400061de
cmp rcx, 0x1000
jae 0x140006333
call fcn.14000750c
jmp 0x140006338
mov rax, qword [0x140040b90]
sub rax, qword [0x140040b88]
shr rax, 4
imul edx, eax, 0xaaaaaaab
dec edx
xor ecx, ecx
call fcn.140001419
mov byte [rbp + 0x107], 0xc3
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0xc
mov qword [rbp + 0xc0], 0xf
movabs rax, 0x456563617254744e
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb0], 0x746e6576
lea rcx, [0x14003f620]
lea rdx, str.___Unhooking_function
call fcn.140001b92
mov r8, qword [rbp + 0xb8]
cmp qword [rbp + 0xc0], 0x10
jb 0x140006b65
mov rdx, qword [rbp + 0xa8]
jmp 0x140006b6c
lea rdx, [rbp + 0xa8]
lea rcx, [0x14003f620]
call fcn.140001db5
lea rcx, [0x14003f620]
lea rdx, [0x140035490]
call fcn.140001b92
lea rcx, [0x14003f620]
call fcn.140001fc7
mov qword [rbp + 0xd8], 0
mov ecx, 0x20
call fcn.14000750c
lea rcx, [rbp + 0xd0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 0x16
mov qword [rcx + 0x18], 0x1f
movups xmm7, xmmword [str.NtProtectVirtualMemory]
movups xmmword [rax], xmm7
movabs rdi, 0x79726f6d654d6c61
mov qword [rax + 0xe], rdi
mov byte [rax + 0x16], 0
call fcn.14000379a
mov rsi, rax
mov qword [rbp + 0x78], 0
mov ecx, 0x20
call fcn.14000750c
lea rcx, [rbp + 0x70]
mov qword [rcx], rax
mov qword [rcx + 0x10], 0x14
mov qword [rcx + 0x18], 0x1f
movups xmm6, xmmword [str.NtWriteVirtualMemory]
movups xmmword [rax], xmm6
mov dword [rax + 0x10], 0x79726f6d
mov byte [rax + 0x14], 0
call fcn.14000379a
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x40], xmm0
mov ecx, 0x20
call fcn.14000750c
lea rcx, [rbp - 0x50]
mov qword [rcx], rax
mov qword [rcx + 0x10], 0x16
mov qword [rcx + 0x18], 0x1f
movups xmmword [rax], xmm7
mov qword [rax + 0xe], rdi
mov byte [rax + 0x16], 0
call fcn.1400019fe
mov edi, eax
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov ecx, 0x20
call fcn.14000750c
lea rcx, [rbp - 0x30]
mov qword [rcx], rax
mov qword [rcx + 0x10], 0x14
mov qword [rcx + 0x18], 0x1f
movups xmmword [rax], xmm6
mov dword [rax + 0x10], 0x79726f6d
mov byte [rax + 0x14], 0
call fcn.1400019fe
mov r14d, eax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm0
mov r15, qword [rbp + 0xb8]
cmp qword [rbp + 0xc0], 0x10
jb 0x140006cd5
mov r12, qword [rbp + 0xa8]
jmp 0x140006cdc
lea r12, [rbp + 0xa8]
test r15, r15
js 0x14000705e
cmp r15, 0xf
ja 0x140006d02
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 0xf
movups xmm0, xmmword [r12]
movaps xmmword [rbp + 0x20], xmm0
jmp 0x140006d4c
mov rax, r15
or rax, 0xf
cmp rax, 0x17
mov r13d, 0x16
cmovae r13, rax
lea rcx, [r13 + 1]
cmp rax, 0xfff
jb 0x140006d2a
call fcn.140001164
jmp 0x140006d2f
call fcn.14000750c
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r13
inc r15
mov rcx, rax
mov rdx, r12
mov r8, r15
call fcn.14002ad20
lea rcx, [rbp + 0x20]
call fcn.140003617
mov r15, rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0x1000
mov rcx, rsi
call fcn.1400074e0
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x9c]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x50]
mov rcx, 0xffffffffffffffff
mov r9d, 0x40
call fcn.1400074e8
mov r12d, eax
test eax, eax
js 0x140006ea8
lea rcx, [0x14003f620]
lea rdx, str._____NtProtectVirtualMemory_success_
call fcn.140001b92
lea rcx, [0x14003f620]
call fcn.140001fc7
mov rcx, rbx
call fcn.1400074e0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x107]
mov rcx, 0xffffffffffffffff
mov rdx, r15
mov r9d, 8
call fcn.1400074f9
mov ebx, eax
test eax, eax
js 0x140006ef8
lea rcx, [0x14003f620]
lea rdx, str._____NtWriteVirtualMemory_success_
call fcn.140001b92
lea rcx, [0x14003f620]
call fcn.140001fc7
mov rcx, rsi
call fcn.1400074e0
mov r9d, dword [rbp + 0x9c]
mov dword [rsp + 0x28], edi
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x50]
mov rcx, 0xffffffffffffffff
call fcn.1400074e8
mov esi, eax
test eax, eax
js 0x140006f44
lea rcx, [0x14003f620]
lea rdx, str._____NtProtectVirtualMemory_success_
call fcn.140001b92
lea rcx, [0x14003f620]
call fcn.140001fc7
lea rcx, [0x14003f620]
lea rdx, str.__
call fcn.140001b92
mov r8, qword [rbp + 0xb8]
cmp qword [rbp + 0xc0], 0x10
jb 0x140006f90
mov rdx, qword [rbp + 0xa8]
jmp 0x140006f97
lea rsi, [0x14003f620]
lea rdx, str.____NtProtectVirtualMemory_failed._Status_code:_0x
mov rcx, rsi
call fcn.140001b92
mov rax, qword [0x14003f620]
movsxd rax, dword [rax + 4]
mov ecx, 0xfffff1ff
and ecx, dword [rax + rsi + 0x18]
or ecx, 0x800
mov dword [rax + rsi + 0x18], ecx
mov rcx, rsi
mov edx, r12d
call fcn.14000392c
lea rcx, [0x14003f620]
call fcn.140001fc7
jmp 0x140006fc2
lea rsi, [0x14003f620]
lea rdx, str.____NtWriteVirtualMemory_failed._Status_code:_0x
mov rcx, rsi
call fcn.140001b92
mov rax, qword [0x14003f620]
movsxd rax, dword [rax + 4]
mov ecx, 0xfffff1ff
and ecx, dword [rax + rsi + 0x18]
or ecx, 0x800
mov dword [rax + rsi + 0x18], ecx
mov rcx, rsi
mov edx, ebx
call fcn.14000392c
lea rcx, [0x14003f620]
call fcn.140001fc7
jmp 0x140006fc2
lea rdi, [0x14003f620]
lea rdx, str.____NtProtectVirtualMemory_failed._Status_code:_0x
mov rcx, rdi
call fcn.140001b92
mov rax, qword [0x14003f620]
movsxd rax, dword [rax + 4]
mov ecx, 0xfffff1ff
and ecx, dword [rax + rdi + 0x18]
or ecx, 0x800
mov dword [rax + rdi + 0x18], ecx
mov rcx, rdi
mov edx, esi
call fcn.14000392c
lea rcx, [0x14003f620]
call fcn.140001fc7
jmp 0x140006fc2
lea rdx, [rbp + 0xa8]
lea rcx, [0x14003f620]
call fcn.140001db5
lea rcx, [0x14003f620]
lea rdx, str._Unhooked_
call fcn.140001b92
lea rcx, [0x14003f620]
call fcn.140001fc7
mov rax, qword [rbp + 0xc0]
cmp rax, 0x10
jb 0x140007003
mov rcx, qword [rbp + 0xa8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140006ffe
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140007063
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140007548
xor eax, eax
movaps xmm6, xmmword [rbp + 0x110]
movaps xmm7, xmmword [rbp + 0x120]
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14000a8e8
call fcn.140001153
call fcn.140001153
call fcn.140001153
call fcn.140001153
call fcn.140001153
call fcn.140001191
call fcn.14000a8e8
call fcn.14000a8e8
call fcn.14000a8e8
call fcn.14000a8e8
call fcn.140001153
call fcn.14000a8e8
int3