#include <windows.h>

#include <iostream>

#include <tlhelp32.h>

#include <TlHelp32.h>  // for PROCESSENTRY32 and CreateToolhelp32Snapshot

// Function to unload the KERNELBASE module

bool UnloadKernelBaseFunction(LPCSTR functionName) {

    HMODULE hModule = GetModuleHandleA("KERNELBASE.dll");

    if (!hModule) {

        std::cerr << "Failed to get module handle." << std::endl;

        return false;

    }

    FARPROC pFunction = GetProcAddress(hModule, functionName);

    if (!pFunction) {

        std::cerr << "Failed to get function address." << std::endl;

        return false;

    }

    // Example of function address modification (for educational purposes only)

    DWORD oldProtect;

    if (VirtualProtect(pFunction, sizeof(pFunction), PAGE_EXECUTE_READWRITE, &oldProtect)) {

        memset(pFunction, 0x90, sizeof(pFunction)); // NOP instruction

        VirtualProtect(pFunction, sizeof(pFunction), oldProtect, &oldProtect);

        return true;

    }

    std::cerr << "Failed to change memory protection." << std::endl;

    return false;

}

int main() {

    if (UnloadKernelBaseFunction("NtOpenProcess")) {

        std::cout << "Successfully unloaded function." << std::endl;

    }

    else {

        std::cerr << "Failed to unload function." << std::endl;

    }

    return 0;

}