Function at 0x14014fb60
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
movzx ebx, dl
mov rdi, rcx
test rcx, rcx
jne 0x14014fba0
test dl, dl
je 0x14014fe94
lea rcx, str.Aborting_UnhookFunc_because_pRealFunctionAddr_is_null_n
call fcn.14029c740
jmp 0x14014fe94
lea rsi, [0x1405d7e68]
mov qword [rbp + 0x67], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [0x1405d7e48]
mov rax, qword [rcx + 8]
mov rdx, rcx
cmp byte [rax + 0x19], 0
jne 0x14014fbe8
nop dword [rax]
cmp qword [rax + 0x20], rdi
jae 0x14014fbdc
mov rax, qword [rax + 0x10]
jmp 0x14014fbe2
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14014fbd0
cmp byte [rdx + 0x19], 0
jne 0x14014fe7a
cmp rdi, qword [rdx + 0x20]
jb 0x14014fe7a
cmp rdx, rcx
je 0x14014fe7a
movups xmm0, xmmword [rdx + 0x28]
movaps xmmword [rbp - 0x59], xmm0
movups xmm1, xmmword [rdx + 0x38]
movaps xmmword [rbp - 0x49], xmm1
movups xmm0, xmmword [rdx + 0x48]
movaps xmmword [rbp - 0x39], xmm0
movups xmm1, xmmword [rdx + 0x58]
movaps xmmword [rbp - 0x29], xmm1
movups xmm0, xmmword [rdx + 0x68]
movaps xmmword [rbp - 0x19], xmm0
lea rcx, [0x1405d7e48]
call fcn.140145ab0
mov edx, 0x78
mov rcx, rax
call fcn.14031dc44
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x1405d7ed8]
test esi, esi
jne 0x14014fc7f
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rbp - 5]
mov dword [0x1405d7ed8], edx
lea rcx, str.System_page_size:__u_n
call fcn.14029c740
mov esi, dword [0x1405d7ed8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rax
mov qword [rbp - 0x61], rax
movsxd r14, dword [rbp - 0x41]
mov rdi, qword [rbp - 0x59]
lea r12, [rdi - 1]
add r12, r14
mov ecx, esi
xor edx, edx
mov rax, r12
div rcx
mov rsi, rax
xor edx, edx
mov rax, rdi
div rcx
mov r15, rax
mov byte [rbp + 0x67], 0xeb
movzx ecx, byte [rbp - 0x51]
mov r13, qword [rbp - 0x49]
sub cl, r13b
sub cl, 2
mov byte [rbp + 0x68], cl
movzx ecx, word [rbp + 0x67]
mov word [r13], cx
mov r8d, 2
mov rdx, r13
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, 0x30
lea rdx, [rbp - 9]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14014fe68
cmp dword [rbp + 0x17], 0x1000
jne 0x14014fe68
cmp byte [rdi], 0xe9
je 0x14014fd2a
test bl, bl
je 0x14014fe94
lea rcx, str.UnhookFunc_not_restoring_original_bytes___jump_instruction_not_found_n
call fcn.14029c740
jmp 0x14014fe94
movsxd rax, dword [rdi + 1]
lea rcx, [rdi + 5]
add rcx, rax
cmp rcx, r13
je 0x14014fd53
test bl, bl
je 0x14014fe94
lea rcx, str.UnhookFunc_not_restoring_original_bytes___jump_target_has_changed_n
call fcn.14029c740
jmp 0x14014fe94
xor eax, eax
mov dword [rbp + 0x77], eax
mov dword [rbp + 0x7f], eax
lea r9, [rbp + 0x77]
lea r8d, [rax + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14014fd8c
test bl, bl
je 0x14014fe94
lea rcx, str.Warning:_VirtualProtect_call_failed_during_unhook_n
call fcn.14029c740
jmp 0x14014fe94
cmp r15, rsi
je 0x14014fdd8
lea r9, [rbp + 0x7f]
mov edx, 1
lea r8d, [rdx + 0x3f]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14014fdd8
lea r9, [rbp - 0x69]
mov r8d, dword [rbp + 0x77]
lea edx, [rax + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, bl
je 0x14014fe94
lea rcx, str.Warning:_VirtualProtect__2__call_failed_during_unhook_n
call fcn.14029c740
jmp 0x14014fe94
mov r8, r14
lea rdx, [rbp - 0x3d]
mov rcx, rdi
call fcn.140320ff0
mov r8, r14
mov rdx, rdi
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp r15, rsi
je 0x14014fe31
mov r8d, dword [rbp + 0x7f]
lea eax, [r8 - 0x40]
test eax, 0xffffffbf
je 0x14014fe31
lea r9, [rbp - 0x69]
mov edx, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14014fe31
test bl, bl
je 0x14014fe31
lea rcx, str.Warning:_VirtualProtect__2__call_failed_to_restore_protection_flags_during_unhook_n
call fcn.14029c740
mov r8d, dword [rbp + 0x77]
lea eax, [r8 - 0x40]
test eax, 0xffffffbf
je 0x14014fe94
lea r9, [rbp - 0x69]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14014fe94
test bl, bl
je 0x14014fe94
lea rcx, str.Warning:_VirtualProtect_call_failed_to_restore_protection_flags_during_unhook_n
call fcn.14029c740
jmp 0x14014fe94
test bl, bl
je 0x14014fe94
lea rcx, str.UnhookFunc_not_restoring_original_bytes___function_is_unmapped_n
call fcn.14029c740
jmp 0x14014fe94
test bl, bl
je 0x14014fe8b
lea rcx, str.Aborting_UnhookFunc_because_pRealFunctionAddr_is_not_hooked_n
call fcn.14029c740
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret