Function at 0x14001acc0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x4f]
sub rsp, 0xe8
mov rax, qword [0x14003c010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea rcx, str.___Using_Technique_2__Reads_NTDLL_From_KnownDlls_and_Clean._n_n
call fcn.14001a8b0
lea rcx, [0x140039110]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
jne 0x14001ad1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleHandleA_error:__d_n
call fcn.14001a8b0
xor eax, eax
jmp 0x14001b040
xor eax, eax
lea rdx, str.RtlInitUnicodeString
mov rcx, r15
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001ad13
lea rdx, str.KnownDlls_ntdll.dll
mov qword [rsp + 0x110], rdi
lea rcx, [rbp + 0x2f]
call rax
xor edi, edi
mov dword [rbp - 0x31], 0x30
lea rax, [rbp + 0x2f]
mov qword [rbp - 0x29], rdi
xorps xmm0, xmm0
mov dword [rbp - 0x19], 0x40
lea r8, [rbp - 0x31]
mov qword [rbp - 0x21], rax
lea edx, [rdi + 0xc]
mov qword [rbp - 0x49], rdi
lea rcx, [rbp - 0x49]
movdqu xmmword [rbp - 0x11], xmm0
call qword [0x14003fda0]
test eax, eax
jns 0x14001adac
lea rcx, str.____NtOpenSection_error._n
jmp 0x14001ae0b
mov rdx, qword [rbp - 0x49]
lea rcx, str.___Clean_Section_Handle_Address...........:_0x_p_n_n
call fcn.14001a8b0
mov rcx, qword [rbp - 0x49]
lea rax, [rbp + 0x27]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x41]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rdx, [r9 - 1]
mov qword [rbp - 0x41], rdi
mov qword [rbp + 0x27], rdi
mov qword [rsp + 0x20], rdi
call qword [0x14003fda8]
test eax, eax
jns 0x14001ae21
lea rcx, str.____NtMapViewOfSection_error._n
call fcn.14001a8b0
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14001b038
mov rdx, qword [rbp - 0x41]
lea rcx, str.___Clean_NTDLL_Base_Address...............:_0x_p_n
call fcn.14001a8b0
xor eax, eax
lea r8, [rbp - 1]
mov rdx, r15
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
lea r9d, [rax + 0x18]
lea rcx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x14001ae73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleInformation_error:__d_n
call fcn.14001a8b0
xor eax, eax
jmp 0x14001b038
mov qword [rsp + 0x100], rbx
lea rcx, str.___Hooked_NTDLL_Base_Address..............:_0x_p_n_n
mov rbx, qword [rbp - 1]
mov rdx, rbx
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0xe0], r14
call fcn.14001a8b0
movsxd rcx, dword [rbx + 0x3c]
mov r8, rdi
movzx r9d, word [rcx + rbx + 6]
test r9, r9
je 0x14001afd2
movzx eax, word [rcx + rbx + 0x14]
lea rdx, [rbx + 0x18]
add rdx, rcx
lea r10, str..text
add rdx, rax
nop word [rax + rax]
mov rax, rdi
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14001af73
cmp rax, 6
jne 0x14001aed3
mov ecx, dword [rdx + 0xc]
mov rsi, qword [rbp - 0x41]
add rbx, rcx
mov edi, dword [rdx + 8]
add rsi, rcx
mov rdx, rbx
lea rcx, str.___Hooked_NTDLL_.TEXT_Section_VA..........:_0x_p_n
call fcn.14001a8b0
mov rdx, rsi
lea rcx, str.___Clean_NTDLL_.TEXT_Section_VA...........:_0x_p_n_n
call fcn.14001a8b0
mov edx, edi
lea rcx, str.___Size_of_.TEXT_Section..................:__zd_n
call fcn.14001a8b0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x39], rbx
mov qword [rbp + 0x1f], rdi
call fcn.14001ac10
mov r14, rax
lea r8, [rbp + 0x1f]
lea rax, [rbp + 0x17]
mov r9d, 0x40
lea rdx, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call r14
test eax, eax
jns 0x14001af85
lea rcx, str.____NtProtectVirtualMemory___1:_Error._n
call fcn.14001a8b0
xor eax, eax
jmp 0x14001b020
inc r8
add rdx, 0x28
cmp r8, r9
jb 0x14001aed0
jmp 0x14001afd2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140021790
mov r9d, dword [rbp + 0x17]
lea rax, [rbp + 0x17]
lea r8, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x39]
mov rcx, 0xffffffffffffffff
call r14
test eax, eax
jns 0x14001afc6
lea rcx, str.____NtProtectVirtualMemory___2:_Error._n
call fcn.14001a8b0
xor eax, eax
jmp 0x14001b020
lea rcx, str._n___NTDLL_is_cleaned._Closing_handles..._n_n
call fcn.14001a8b0
lea rdx, str.NtUnmapViewOfSection
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp - 0x41]
mov rcx, 0xffffffffffffffff
call rax
test eax, eax
jns 0x14001b005
mov edx, eax
lea rcx, str.____NtUnmapViewOfSection_error:__X_n
call fcn.14001a8b0
xor eax, eax
jmp 0x14001b020
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___All_done._n
call fcn.14001a8b0
mov eax, 1
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov r14, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x110]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14001fdb0
add rsp, 0xe8
pop r15
pop rbp
ret