Function at 0x1400037e0
Capabilities:
Allocate or change rwx memory
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov rdi, r8
test rdx, rdx
je 0x140003a44
mov rsi, rdx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140003a44
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
je 0x140003a44
cmp dword [rax], 0x4550
jne 0x140003a44
mov r14d, dword [rax + 0x88]
test r14, r14
je 0x140003a44
add r14, rsi
je 0x140003a44
cmp dword [r14 + 0x18], 0
je 0x140003a44
mov r15, r9
mov rax, qword [rdi]
mov qword [rbp - 0x50], rax
mov eax, dword [r14 + 0x1c]
mov edx, dword [r14 + 0x20]
add rax, rsi
mov qword [rbp - 0x48], rax
add rdx, rsi
mov qword [rbp - 0x40], rdx
mov eax, dword [r14 + 0x24]
add rax, rsi
mov qword [rbp - 0x38], rax
xor r12d, r12d
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rbp - 0x40]
mov edx, dword [rax + r12*4]
add rdx, rsi
mov rax, qword [rbp - 0x38]
movzx eax, word [rax + r12*2]
mov rcx, qword [rbp - 0x48]
mov r13d, dword [rcx + rax*4]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400038d1
inc r12
mov eax, dword [r14 + 0x18]
cmp r12, rax
mov rcx, rbx
jb 0x140003890
jmp 0x140003a44
add rsi, r13
je 0x140003a44
mov rcx, rbx
add r13, r15
mov qword [rbp - 0x30], 0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x5b]
mov r9d, 5
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003af3
cmp qword [rbp - 0x30], 5
jne 0x140003af3
mov eax, dword [rbp + 0x5b]
xor eax, dword [rsi]
movzx ecx, byte [rbp + 0x5f]
xor cl, byte [rsi + 4]
movzx ecx, cl
or ecx, eax
je 0x140003b64
mov dword [rbp + 0x34], 0
lea r14, [rbp + 0x34]
mov qword [rsp + 0x20], r14
mov r8d, 5
mov rcx, rbx
mov rdx, r13
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140003b6c
mov qword [rbp - 0x28], 0
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 5
mov rcx, rbx
mov rdx, r13
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
sete al
cmp qword [rbp - 0x28], 5
setne sil
or sil, al
cmp sil, 1
jne 0x140003bcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], eax
movaps xmm0, xmmword [0x14002c710]
movaps xmmword [rbp], xmm0
mov qword [rbp + 0x38], 2
mov rax, rbp
mov qword [rbp + 0x40], rax
lea rax, str.Failed_to_unhook___error:_
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0x1e
lea rdi, [rbp - 0x20]
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
mov rcx, rdi
call fcn.1400155e0
mov rcx, rdi
mov edx, 2
call fcn.1400250c0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140003c68
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140003c63
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140003c71
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x140003c63
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x18], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x38], 1
lea rax, [rbp - 0x20]
mov qword [rbp + 0x40], rax
lea rax, str.Failed_to_find_mapped_export_for_
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0x23
mov rsi, rbp
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
mov rcx, rsi
call fcn.1400155e0
mov rcx, rsi
mov edx, 2
call fcn.1400250c0
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x140003adb
mov rcx, qword [rbp]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140003ad6
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140003c71
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
xor esi, esi
mov eax, esi
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], eax
movaps xmm0, xmmword [0x14002c710]
movaps xmmword [rbp], xmm0
mov qword [rbp + 0x38], 2
mov rax, rbp
mov qword [rbp + 0x40], rax
lea rax, str.Failed_to_read__bytes_from_remote_process__error:_
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0x36
lea rsi, [rbp - 0x20]
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
mov rcx, rsi
call fcn.1400155e0
mov rcx, rsi
mov edx, 2
call fcn.1400250c0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140003adb
mov rcx, qword [rbp - 0x20]
jmp 0x140003aaa
mov sil, 1
jmp 0x140003add
call qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], eax
movaps xmm0, xmmword [0x14002c710]
movaps xmmword [rbp], xmm0
mov qword [rbp + 0x38], 2
mov rax, rbp
mov qword [rbp + 0x40], rax
lea rax, str.Failed_to_change_protection_of___error:_
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0x2c
lea rsi, [rbp - 0x20]
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
mov rcx, rsi
call fcn.1400155e0
mov rcx, rsi
mov edx, 2
call fcn.1400250c0
jmp 0x140003b51
mov r9d, dword [rbp + 0x34]
mov qword [rsp + 0x20], r14
mov r8d, 5
mov rcx, rbx
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], 0
mov qword [rbp], r13
mov ecx, 5
call fcn.140029c54
movzx ecx, byte [rbp + 0x5f]
mov byte [rax + 4], cl
mov ecx, dword [rbp + 0x5b]
mov dword [rax], ecx
mov rcx, rax
add rcx, 5
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rcx
lea rcx, [0x140059b48]
mov rdx, rbp
call fcn.140004430
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140003c68
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003c63
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140003c71
add rdx, 0x27
mov rcx, rax
call fcn.140029c98
xor sil, 1
jmp 0x140003add
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3