Malware authors often use various techniques to evade detection by AV/EDR solutions. One such technique involves checking for the presence of AV/EDR DLLs that may be loaded in the malware's address space and attempting to unload them before executing their malicious code.

To do this, the malware first uses the GetModuleHandleA function to retrieve a handle to the DLL, if …