Find the first occurrence of pattern in any function body of module
(restricted to ranges from the RUNTIME_FUNCTION table — anything else
might be data or alignment padding). Returns the address and the size of
the function that contains it.
Scan a function body for call qword ptr [rip+0] (48 FF 15 00 00 00 00).
Returns the offset past the gadget — that’s the address the unwinder
will treat as the post-call site when the spoofed frame is on the stack.
Fisher-Yates shuffle using rdtsc as a cheap entropy source. The goal is
not cryptographic randomness, it is reducing the chance that an EDR
signature pinned to a specific gadget address survives across runs.