Function at 0x1400012c0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x60]
mov rbx, rcx
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax]
mov r9, qword [rdx + 0x20]
test r9, r9
je 0x1400012fb
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400014fe
movsxd rcx, dword [r9 + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
jne 0x1400014fe
xor ebp, ebp
mov qword [rsp + 0x68], rbp
mov esi, ebp
mov qword [rsp + 0x60], rbp
mov r8d, ebp
movzx r11d, word [rcx + 0x14]
movzx r10d, word [rcx + 6]
add r11, rcx
test r10, r10
je 0x140001385
mov edx, ebp
lea rcx, [r11 + 0x18]
nop word [rax + rax]
mov eax, dword [rcx]
or eax, 0x20202020
cmp eax, 0x7865742e
je 0x14000135f
inc r8d
inc rdx
add rcx, 0x28
cmp rdx, r10
jl 0x140001340
jmp 0x140001385
movsxd rax, r8d
lea rcx, [rax + rax*4]
mov eax, dword [r11 + rcx*8 + 0x24]
add rax, r9
mov qword [rsp + 0x68], rax
mov esi, dword [r11 + rcx*8 + 0x24]
mov eax, dword [r11 + rcx*8 + 0x20]
add rsi, rbx
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400013f2
mov r8, rsi
lea rdx, str._t___Unhooked_ntdll.dll_text_section_at:_0x__p__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140001461
mov r8, qword [rsp + 0x60]
lea rdx, str._t___Text_section_of_ntdll.dll_with_size:__d__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], ebp
mov r9d, 0x80
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x68]
call fcn.140001abd
mov ebx, eax
test eax, eax
je 0x14000150d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400014fe
mov r8d, ebx
lea rdx, str.____Sw3NtProtectVirtualMemory_failed:__d_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140001577
lea rdx, str.___Sw3NtProtectVirtualMemory_successfully_executed__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x60]
mov rdx, rsi
mov rcx, qword [rsp + 0x68]
call section..text
mov r9d, dword [rsp + 0x58]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
mov rcx, 0xffffffffffffffff
call fcn.140001abd
mov ebx, eax
test eax, eax
jne 0x140001491
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140001622
lea rdx, str.___Sw3NtProtectVirtualMemory_successfully_executed__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret