Function at 0x140006450
Capabilities:
Access pe header
Access peb ldr_data
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x58], r9
mov esi, r8d
mov rax, rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x40], rcx
mov r14d, r8d
mov dword [rsp + 0x38], r8d
mov r12, qword [rsp + 0x110]
mov qword [rsp + 0x70], r12
mov r13, qword [rsp + 0x108]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], r9
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x50], rdi
cmp qword [rsp + 0x100], rbx
je 0x1400064dd
mov eax, 0xc00000f3
jmp 0x140006918
mov qword [rcx], rdi
test rax, rax
je 0x1400064e8
mov qword [rdx], rdi
lea rdx, [rsp + 0x100]
mov rcx, r9
call fcn.140008770
mov r15d, 0xc000007b
test al, al
jne 0x14000650e
bt esi, 0x1e
cmovae ebx, r15d
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x58]
jmp 0x140006562
test ebx, ebx
js 0x140006916
and esi, 0x10000000
mov r13d, esi
cmove r13d, r14d
mov rcx, rdi
test esi, esi
cmove rcx, r12
mov qword [rsp + 0x68], rcx
mov rsi, rdi
cmove rsi, rax
mov qword [rsp + 0x48], rsi
test r13b, 4
je 0x1400065a9
test rsi, rsi
je 0x140006875
test rcx, rcx
je 0x140006875
test rsi, rsi
je 0x1400066de
mov r12, 0xffffffffffffffff
nop dword [rax]
inc r12
cmp word [rsi + r12*2], 0
jne 0x1400065c0
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rbx, qword [rdx + 0x18]
add rbx, 0x10
mov qword [rsp + 0x38], rbx
mov r14, qword [rbx]
mov rcx, r9
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140006603
mov eax, r15d
jmp 0x140006918
cmp r14, rbx
je 0x1400066de
mov rax, rbx
nop
mov rbx, r14
mov r14, qword [r14]
cmp qword [rbx + 0x10], 0
je 0x1400066d5
movsxd r8, r12d
movzx eax, word [rbx + 0x58]
shr rax, 1
sub rax, r8
test rax, 0xfffffffffffffffb
jne 0x1400066d0
mov rdx, qword [rbx + 0x60]
mov rcx, rsi
call fcn.140052d84
test eax, eax
jne 0x1400066d0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r15, rax
test rax, rax
je 0x1400066d0
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x1400066a8
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400066a8
movsxd rdx, dword [rsi + 0x3c]
movzx ecx, word [rdx + rsi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
add rcx, 0x108
add rcx, rsi
movabs rax, 0xaabbcc11ffee00
cmp qword [rcx], rax
jne 0x1400066a8
cmp qword [rcx + 0x10], rsi
je 0x1400066ab
mov rcx, rdi
test rcx, rcx
je 0x1400066cb
mov eax, dword [r15 + 0x1c]
mov rdx, qword [rsp + 0x70]
cmp dword [rdx + 0x1c], eax
jne 0x1400066cb
mov eax, dword [r15 + 0x54]
cmp dword [rdx + 0x54], eax
je 0x140006820
mov rsi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
cmp r14, rax
jne 0x140006610
movabs r14, 0xaabbcc11ffee00
mov r8d, dword [rsp + 0x100]
mov rdx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x40]
mov rcx, r15
call fcn.140007490
test eax, eax
js 0x140006918
cmp eax, 0x4000000e
je 0x140006918
mov rbx, qword [r15]
test rbx, rbx
je 0x140006ef6
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140006ef6
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r14
jne 0x140006ef6
cmp qword [rsi + 0x10], rbx
jne 0x140006ef6
or byte [rsi + 0xc], 2
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, rax
mov eax, 0x400
test word [r14 + 0x5e], ax
je 0x140006782
or r13d, 1
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
bt r13d, 0x1c
jae 0x14000692b
mov r8, rsi
mov rdx, r14
call fcn.14000aa50
mov ebx, eax
test eax, eax
js 0x14000687f
mov rdx, r14
mov rcx, qword [r15]
call fcn.140007370
mov ebx, eax
test eax, eax
js 0x14000687f
mov r12, qword [rsi + 0x10]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14000680d
mov r14, qword [rcx + r12 + 0x18]
test r14, r14
je 0x14000680d
mov rax, qword [r14]
test rax, rax
je 0x14000680d
mov r15d, 1
xor r8d, r8d
mov edx, r15d
mov rcx, r12
call rax
lea r14, [r14 + 8]
mov rax, qword [r14]
test rax, rax
jne 0x1400067f1
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400084a0
test eax, eax
jne 0x14000687f
mov ebx, 0xc0000142
jmp 0x140006887
test byte [rcx + 0xe], 8
je 0x140006875
test r13b, 2
jne 0x140006875
mov r8d, dword [rcx + 0x2c]
cmp r8d, 0xffffffff
je 0x140006855
mov rax, qword [rcx + 0x38]
mov edx, 0xffff
cmp word [rax + 0x6c], dx
jne 0x14000684e
mov dword [rcx + 0x2c], 0xffffffff
jmp 0x140006855
lea eax, [r8 + 1]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx + 0x30]
mov r14, qword [rsp + 0x40]
mov qword [r14], rax
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14000686e
mov qword [rax], rbx
xor eax, eax
jmp 0x140006918
mov eax, 0xc00000f1
jmp 0x140006918
test ebx, ebx
jns 0x140006916
mov rsi, qword [r15]
test rsi, rsi
je 0x1400068d7
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400068d7
movsxd rdx, dword [rsi + 0x3c]
movzx ecx, word [rdx + rsi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
movabs rax, 0xaabbcc11ffee00
cmp qword [rcx + rsi + 0x108], rax
jne 0x1400068d7
cmp qword [rcx + rsi + 0x118], rsi
jne 0x1400068d7
lea rdi, [rsi + 0x108]
add rdi, rcx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rdi, rdi
je 0x140006916
movzx eax, byte [rdi + 0xc]
and al, 6
cmp al, 2
je 0x140006916
cmp qword [rdi + 0x20], 0
je 0x1400068fe
mov rcx, rdi
call fcn.14000a990
cmp qword [rdi + 0x10], 0
je 0x140006916
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x48]
mov edx, r13d
call fcn.140006250
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140006bf9
or word [rsi + 0xe], 1
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x38], rax
mov r8, rsi
mov rdx, r14
mov rcx, qword [r15]
call fcn.14000aa50
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140006bf9
mov rdx, r14
mov rcx, qword [r15]
call fcn.140007370
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140006bf9
test r13b, 2
jne 0x1400069a3
or word [rsi + 0xe], 8
test r13b, 1
jne 0x1400069c9
mov edx, dword [r14 + 0x50]
mov rcx, qword [rsi + 0x10]
call fcn.140008ab0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140006bf9
or word [rsi + 0xe], 2
test r13b, 8
jne 0x140006a07
mov rax, qword [0x1400f24f0]
mov rdx, qword [rax + 0x78]
mov rcx, qword [rsp + 0x50]
call qword [rdx + 0x18]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140006a02
bt r13d, 0x1d
jae 0x140006bf9
mov ebx, 0x7fffffff
mov dword [rsp + 0x30], ebx
jmp 0x140006a07
or word [rsi + 0xe], 4
test r13b, 0x10
je 0x140006a12
call fcn.1400099d0
mov r12, qword [rsi + 0x10]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x140006a5a
mov r14, qword [rcx + r12 + 0x18]
test r14, r14
je 0x140006a5a
mov rax, qword [r14]
test rax, rax
je 0x140006a5a
mov r15d, 1
xor r8d, r8d
mov edx, r15d
mov rcx, r12
call rax
lea r14, [r14 + 8]
mov rax, qword [r14]
test rax, rax
jne 0x140006a41
jmp 0x140006a60
mov r15d, 1
mov rcx, rsi
call fcn.1400084a0
test eax, eax
je 0x140006b55
test r13b, 0x10
je 0x140006bff
lea rcx, str.mscoreei.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006bff
lea rdx, str.GetFileVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f24f0]
mov rdx, qword [rcx + 0x68]
mov qword [rdx + 0x98], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x68]
cmp qword [rcx + 0x98], 0
je 0x140006bff
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x68]
cmp byte [rcx + 0x40], 0
je 0x140006b35
cmp byte [rcx + 0x41], 0
jne 0x140006b35
call fcn.14000b440
call fcn.14000bb00
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x68]
add rcx, 0x98
lea rdx, [0x1400098c0]
call fcn.14000bbb0
call fcn.14000b520
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x41], 1
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [rsp + 0x30]
jmp 0x140006bff
mov ebx, 0xc0000142
mov dword [rsp + 0x30], ebx
mov r14, qword [rsp + 0x40]
mov r14, qword [r14]
mov r13d, edi
test r14, r14
je 0x140006bae
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140006bae
movsxd rdx, dword [r14 + 0x3c]
movzx ecx, word [rdx + r14 + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, r14
movabs rax, 0xaabbcc11ffee00
cmp qword [rsi], rax
jne 0x140006bae
cmp qword [rsi + 0x10], r14
je 0x140006bb1
mov rsi, rdi
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test rsi, rsi
je 0x140006ee9
movzx edx, byte [rsi + 0xc]
test dl, 2
je 0x140006ee9
movzx r8d, word [rsi + 0xe]
test r8b, 1
jne 0x140006c22
or dl, 4
mov byte [rsi + 0xc], dl
mov rcx, r14
call fcn.1400078e0
mov rax, qword [rsp + 0x40]
mov qword [rax], rdi
jmp 0x140006916
mov r15d, 1
test ebx, ebx
js 0x140006b5e
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006916
mov rax, qword [rsp + 0x50]
mov qword [rcx], rax
jmp 0x140006916
mov r12, qword [rsi + 0x38]
mov eax, dword [r12 + 0x40]
cmp dword [r9 + 0x50], eax
je 0x140006c38
mov ecx, 7
int 0x29
test r8b, 8
je 0x140006c42
mov r13d, dword [rsi + 0x2c]
test r13d, 0xfffffffe
je 0x140006c92
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
je 0x140006ee9
mov edx, 0xffff
cmp word [r12 + 0x6c], dx
jne 0x140006c78
mov dword [rsi + 0x2c], 0xffffffff
mov rax, qword [rsp + 0x40]
mov qword [rax], rdi
jmp 0x140006916
test eax, eax
je 0x140006ee9
dec eax
mov dword [rsi + 0x2c], eax
mov rax, qword [rsp + 0x40]
mov qword [rax], rdi
jmp 0x140006916
or dl, 4
mov byte [rsi + 0xc], dl
test dl, 1
je 0x140006caf
mov rcx, qword [rsi + 0x10]
mov eax, dword [r9 + 0x28]
add rax, rcx
xor r8d, r8d
xor edx, edx
call rax
movzx eax, word [rsi + 0xe]
test al, 1
je 0x140006e4c
test al, 2
je 0x140006cd2
mov rcx, r14
call fcn.140008c60
test eax, eax
jns 0x140006cd2
mov ecx, 3
int 0x29
test byte [rsi + 0xe], 4
je 0x140006cf4
mov rax, qword [0x1400f24f0]
mov rdx, qword [rax + 0x78]
mov rcx, r12
call qword [rdx + 0x20]
test eax, eax
jns 0x140006cf4
mov ecx, 7
int 0x29
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r13, qword [rcx + 0x30]
mov rdx, qword [0x1400f24f0]
movzx eax, byte [rdx + 0x14]
dec eax
cmp eax, 8
ja case.default.0x140006d2f
cdqe
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x6f10]
add rcx, r8
jmp rcx
mov rcx, r12
call fcn.1400079a0
mov r8, qword [r12 + 0x98]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x1400f24f0]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140006d2f.2
lea rdx, [r12 + 0xc8]
mov rcx, qword [rcx]
call rax
mov rdx, qword [0x1400f24f0]
movzx eax, word [rdx + 0x16]
mov ecx, 0xc8
cmp ax, cx
je 0x140006d8c
mov ecx, 0xe0
cmp ax, cx
jne case.0x140006d2f.1
lea rsi, [r12 + 0x98]
mov rbx, qword [rsi]
cmp rsi, rbx
je case.0x140006d2f.1
nop dword [rax]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov rbx, qword [rbx]
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp rsi, rbx
jne 0x140006da0
mov r8, qword [r12 + 0x60]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [r12 + 0x50]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rdx, qword [r12 + 0x10]
mov rax, qword [r12 + 0x18]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r12 + 0x20]
mov rax, qword [r12 + 0x28]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r12 + 0x70]
mov rax, qword [r12 + 0x78]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov r8, r12
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, r15d
jmp 0x140006e3d
mov eax, edi
test eax, eax
jne 0x140006e48
mov ecx, 7
int 0x29
mov ebx, dword [rsp + 0x30]
test r14, r14
je 0x140006e91
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140006e91
movsxd rdx, dword [r14 + 0x3c]
movzx ecx, word [rdx + r14 + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, r14
movabs rax, 0xaabbcc11ffee00
cmp qword [rsi], rax
jne 0x140006e91
cmp qword [rsi + 0x10], r14
je 0x140006e94
mov rsi, rdi
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rsi, rsi
jne 0x140006ea7
mov r15d, edi
jmp 0x140006edd
movzx eax, byte [rsi + 0xc]
and al, 6
cmp al, 2
jne 0x140006eb6
mov r15d, edi
jmp 0x140006edd
cmp qword [rsi + 0x20], 0
je 0x140006ec5
mov rcx, rsi
call fcn.14000a990
cmp qword [rsi + 0x10], 0
je 0x140006edd
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15d, r15d
jne 0x140006ee9
mov ecx, 7
int 0x29
mov rax, qword [rsp + 0x40]
mov qword [rax], rdi
jmp 0x140006916
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, 0xc0000141
call qword [sym.imp.KERNEL32.dll_ExitProcess]