Function at 0x140004d4e
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x530
movaps xmmword [rsp + 0x520], xmm6
mov rdi, rcx
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rsp + 0x518], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov rcx, qword [0x1400396f8]
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400051ac
mov rbx, rax
lea rdx, str.__c:windows_system32_
lea r14, [rsp + 0x310]
mov r8d, 0x208
mov rcx, r14
call fcn.140005660
xor esi, esi
lea r15, [rsp + 0x100]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.140005730
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, 0x104
mov rcx, r14
mov r8, r15
mov r9, 0xffffffffffffffff
call fcn.140013ffc
lea rcx, str.___dllNameW:__ls_n
mov rdx, r14
call fcn.1400051ee
lea r15, [rsp + 0xc0]
mov rcx, r15
mov rdx, r14
call rbx
lea r8, [rsp + 0xd0]
mov dword [r8], 0x30
mov qword [r8 + 8], rsi
mov dword [r8 + 0x18], 0x40
mov qword [r8 + 0x10], r15
movaps xmmword [r8 + 0x20], xmm6
lea rcx, [rsp + 0xa8]
mov qword [rcx], rsi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0xb0]
mov edx, 0x80000001
call fcn.14000bfb0
test eax, eax
js 0x140005042
mov rdx, qword [rsp + 0xa8]
lea rcx, str.___Clean_DLL_Handle_Address.............:_0x_p_n
call fcn.1400051ee
lea rcx, [rsp + 0xa0]
mov qword [rcx], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
xor esi, esi
mov edx, 0xf0005
xor r8d, r8d
xor r9d, r9d
call fcn.14000bffd
test eax, eax
js 0x140005058
mov rdx, qword [rsp + 0xa0]
lea rcx, str.___Clean_Section_Handle_Address...........:_0x_p_n_n
call fcn.1400051ee
xor esi, esi
lea r8, [rsp + 0x98]
mov qword [r8], rsi
lea rax, [rsp + 0x90]
mov qword [rax], rsi
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
xorps xmm6, xmm6
movups xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov rdx, 0xffffffffffffffff
xor r9d, r9d
call fcn.14000c04a
test eax, eax
js 0x140005061
mov rdx, qword [rsp + 0x98]
lea rcx, str.___Clean_DLL_Base_Address...............:_0x_p_n
call fcn.1400051ee
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x80], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140005080
mov rsi, rax
lea rcx, str.___GetModuleHandleA_result:_0x_p_n
mov rdx, rax
call fcn.1400051ee
lea r8, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x140005092
mov rsi, qword [rsp + 0x70]
lea rcx, str.___Hooked_DLL_Base_Address..............:_0x_p_n_n
mov rdx, rsi
call fcn.1400051ee
movsxd rax, dword [rsi + 0x3c]
movzx r14d, word [rax + rsi + 6]
test r14, r14
je 0x140005158
lea rcx, [rsi + rax]
movzx eax, word [rsi + rax + 0x14]
lea rbx, [rax + rcx]
add rbx, 0x18
lea rdi, str..text
mov rcx, rbx
mov rdx, rdi
call fcn.140013e20
test eax, eax
je 0x1400050a4
add rbx, 0x28
dec r14
jne 0x140005025
jmp 0x140005158
lea rcx, str.____NtOpenFile_error.
call fcn.140013b50
mov rcx, qword [rsp + 0xa8]
jmp 0x140005075
lea rcx, str.____NtCreateSection_error.
jmp 0x140005068
lea rcx, str.____NtMapViewOfSection_error.
call fcn.140013b50
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400051ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____GetModuleHandleA_error:__d_n
jmp 0x1400051a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____GetModuleInformation_error:__d_n
jmp 0x1400051a5
mov edi, dword [rbx + 8]
mov ebx, dword [rbx + 0xc]
add rsi, rbx
add rbx, qword [rsp + 0x98]
lea rcx, str.___Hooked_DLL_.TEXT_Section_VA..........:_0x_p_n
mov rdx, rsi
call fcn.1400051ee
lea rcx, str.___Clean_DLL_.TEXT_Section_VA...........:_0x_p_n_n
mov rdx, rbx
call fcn.1400051ee
lea rcx, str.___Size_of_.TEXT_Section..................:__zd_n
mov rdx, rdi
call fcn.1400051ee
lea rdx, [rsp + 0x68]
mov qword [rdx], rsi
lea r8, [rsp + 0x60]
mov qword [r8], rdi
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffffffffffff
mov r9d, 0x40
call fcn.14000c097
test eax, eax
js 0x1400051d7
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140005660
mov r9d, dword [rsp + 0x5c]
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call fcn.14000c097
test eax, eax
js 0x1400051e0
lea rcx, str._n___DLL_is_cleaned._Closing_handles..._n
call fcn.140013b50
mov rdx, qword [rsp + 0x98]
mov rcx, 0xffffffffffffffff
call fcn.14000c0e4
test eax, eax
js 0x14000519e
mov rcx, qword [rsp + 0xa0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0xa8]
call rsi
lea rcx, str.___All_done._n_n
call fcn.140013b50
mov esi, 1
jmp 0x1400051ae
lea rcx, str.____NtUnmapViewOfSection_error:__X_n
mov edx, eax
call fcn.1400051ee
xor esi, esi
mov rcx, qword [rsp + 0x518]
xor rcx, rsp
call fcn.1400186e0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x520]
add rsp, 0x530
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.____NtProtectVirtualMemory___1:_Error.
jmp 0x1400051e7
lea rcx, str.____NtProtectVirtualMemory___2:_Error.
call fcn.140013b50
jmp 0x1400051ac