Function at 0x1401d7e00
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push r12
push r13
push r14
push rbp
sub rsp, 0x28
mov eax, SHRestricted
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x10
mov rax, qword [rax]
mov rdx, qword [rax + 0x60]
test rdx, rdx
je 0x1401d7e1c
mov r13, qword [rax + 0x30]
mov eax, SHRestricted
mov r9d, dword [0x14022ff54]
mov rax, qword gs:[rax]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x60]
test rax, rax
je 0x1401d7e44
test r9d, r9d
je 0x1401d7fb8
movzx r10d, word [rax]
xor r8d, r8d
test r10d, r10d
je 0x1401d7fa4
add rax, 0x10
movzx r11d, word [rax - 0x10]
cmp r11d, 0x41
jl 0x1401d7e84
cmp r11d, 0x5a
lea r10d, [r11 + 0x20]
cmovle r11d, r10d
movzx r10d, r11w
movzx r12d, word [rax - 0xe]
add r8d, r10d
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7eb0
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
add r8d, r12d
movzx r12d, word [rax - 0xc]
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7ed8
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
add r8d, r12d
movzx r12d, word [rax - 0xa]
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7f00
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
add r8d, r12d
movzx r12d, word [rax - 8]
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7f28
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
add r8d, r12d
movzx r12d, word [rax - 6]
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7f4c
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
add r8d, r12d
movzx r12d, word [rax - 4]
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7f70
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
add r8d, r12d
movzx r12d, word [rax - 2]
test r12d, r12d
je 0x1401d7fa4
cmp r12d, 0x41
jl 0x1401d7f94
cmp r12d, 0x5a
lea r10d, [r12 + 0x20]
movzx r11d, r10w
cmovle r12d, r11d
movzx r10d, word [rax]
add r8d, r12d
test r10d, r10d
jne 0x1401d7e69
nop dword [rax]
nop dword [rax]
cmp r9d, r8d
jne 0x1401d7e44
mov r12, qword [rcx + 0x30]
mov r8, qword [0x14022ff60]
cmp dword [r8], 0
je 0x1401d80e3
movzx eax, word [rdx]
test eax, eax
je 0x1401d8257
xor ecx, ecx
add ecx, 8
lea eax, [rcx - 7]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
lea eax, [rcx - 6]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
lea eax, [rcx - 5]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
lea eax, [rcx - 4]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
lea eax, [rcx - 3]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
lea eax, [rcx - 2]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
lea eax, [rcx - 1]
movzx r9d, word [rdx + rax*2]
test r9d, r9d
je 0x1401d8044
mov eax, ecx
movzx r9d, word [rdx + rcx*2]
test r9d, r9d
jne 0x1401d7fda
movzx eax, al
cmp al, byte [r8]
je 0x1401d8056
cmp al, byte [r8 + 1]
jne 0x1401d8190
xor eax, eax
xor ecx, ecx
add rcx, 0x10
movzx r9d, word [rcx + rdx - 0x10]
add eax, r9d
movzx r9d, word [rcx + rdx - 0xe]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx - 0xc]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx - 0xa]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx - 8]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx - 6]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx - 4]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx - 2]
test r9d, r9d
je 0x1401d80d3
add eax, r9d
movzx r9d, word [rcx + rdx]
test r9d, r9d
jne 0x1401d805a
cmp eax, dword [r8 + 4]
je 0x1401d80e3
cmp eax, dword [r8 + 8]
jne 0x1401d8190
mov edx, dword [0x14022ff9c]
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
mov edx, dword [0x14022ff98]
xor eax, eax
test edx, edx
jbe 0x1401d812c
mov rdx, qword [str.VirtualProtect]
mov ecx, dword [rdx + rax]
mov dword [r14 + rax], ecx
movsxd r8, dword [0x14022ffa0]
add rax, r8
movsxd r9, dword [0x14022ff98]
cmp rax, r9
jb 0x1401d8108
test r12, r12
je 0x1401d8190
movsxd rax, dword [r12 + 0x3c]
xor r11d, r11d
mov r10d, dword [rax + r12 + 0x88]
mov r8d, dword [r10 + r12 + 0x20]
mov r9d, dword [r10 + r12 + 0x18]
add r8, r12
test r9d, r9d
jbe 0x1401d8190
mov cl, byte [r14]
mov edx, dword [r8 + r11*4]
xor eax, eax
add rdx, r12
mov bpl, byte [rdx]
cmp bpl, cl
jne 0x1401d8180
cmp byte [rdx + rax], 0
je 0x1401d8198
cmp byte [r14 + rax], 0
je 0x1401d8198
inc eax
mov bpl, byte [rax + rdx]
cmp bpl, byte [r14 + rax]
je 0x1401d8167
nop dword [rax + rax]
inc r11d
cmp r11d, r9d
jb 0x1401d8156
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [r10 + r12 + 0x1c]
mov r10d, dword [r10 + r12 + 0x24]
add rax, r12
add r10, r12
movzx edx, word [r10 + r11*2]
mov ecx, dword [rax + rdx*4]
add r12, rcx
je 0x1401d8190
mov r14, qword [fcn.1401cf070]
mov rcx, r14
mov edx, dword [0x14022ffb4]
lea r9, [rsp + 0x20]
mov r8d, dword [0x14022ff98]
call r12
mov eax, dword [0x14022ff90]
add r13, rax
mov r8d, dword [0x14022ffb4]
mov eax, 8
mov edx, dword [r13 + 4]
cmp r8d, 8
jbe 0x1401d8215
mov r8d, dword [r13 + rax]
add r8d, edx
mov dword [r14 + rax], r8d
movsxd r9, dword [0x14022ffa0]
add rax, r9
movsxd r10, dword [0x14022ffb4]
cmp rax, r10
jb 0x1401d81f3
mov eax, dword [0x14022ff74]
mov rcx, r14
mov dword [r14 + 8], eax
lea r9, [rsp + 0x20]
mov r8d, dword [r9]
mov edx, dword [0x14022ffb4]
call r12
mov eax, dword [0x14022ff8c]
mov edx, dword [0x14022ff8c]
mov r8d, dword [r14 + 0xc]
add r8, r14
add r14, rdx
add r8, rax
mov rcx, r14
call r8
jmp 0x1401d8190
cmp byte [r8], 0
je 0x1401d8268
cmp byte [r8 + 1], 0
jne 0x1401d8190
xor eax, eax
jmp 0x1401d80d3