Function at 0x14002538e
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x60]
test rax, rax
je 0x1400253ac
mov r12, qword [rcx + 0x30]
mov r8d, dword [0x1400359ac]
mov rdx, qword gs:[0x60]
mov r9, qword [rdx + 0x18]
add r9, 0x10
mov r9, qword [r9]
mov rbx, qword [r9 + 0x60]
test rbx, rbx
je 0x1400253d4
test r8d, r8d
je 0x14002541a
movzx edi, word [rbx]
test di, di
je 0x140025413
add rbx, 2
xor esi, esi
lea ecx, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp cx, 0x1a
cmovae edx, edi
movzx ecx, dx
add esi, ecx
movzx edi, word [rbx]
add rbx, 2
test di, di
jne 0x1400253f3
jmp 0x140025415
xor esi, esi
cmp esi, r8d
jne 0x1400253d4
mov r15, qword [r9 + 0x30]
mov rcx, qword [0x1400359b0]
mov edx, dword [rcx]
test edx, edx
je 0x14002547e
mov ebx, edx
shr ebx, 8
xor edi, edi
mov esi, edi
inc edi
invalid
cmp word [rax + rsi*2], 0
jne 0x140025432
inc dl
cmp dl, dil
je 0x14002544f
inc bl
cmp bl, dil
jne 0x1400255d9
movzx ebx, word [rax]
xor edx, edx
test bx, bx
je 0x140025470
add rax, 2
xor edx, edx
movzx ebx, bx
add edx, ebx
movzx ebx, word [rax]
add rax, 2
test bx, bx
jne 0x14002545f
cmp edx, dword [rcx + 4]
je 0x14002547e
cmp edx, dword [rcx + 8]
jne 0x1400255d9
mov dword [rsp + 0x24], 0
mov esi, dword [0x1400359a0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
add byte [rbx + 0x1ee53d], al
add byte [rax], al
je 0x1400254c9
mov rcx, qword [str.VirtualProtect]
movsxd rdi, edi
mov ecx, dword [rcx + rdi]
or al, 0x39
mov dword [rax + rdi], ecx
add edi, dword [0x1400359a8]
cmp edi, dword [0x140035954]
jb 0x1400254ab
test r15, r15
je 0x1400255d9
movsxd rcx, dword [r15 + 0x3c]
mov r8d, dword [r15 + rcx + 0x88]
mov r9d, dword [r15 + r8 + 0x18]
test r9, r9
je 0x1400255d9
mov r11d, dword [r15 + r8 + 0x20]
add r11, r15
mov r10b, byte [rax]
xor ecx, ecx
mov edi, dword [r11 + rcx*4]
cmp byte [r15 + rdi], r10b
jne 0x14002551e
add rdi, r15
mov edx, 1
mov ebx, r10d
test bl, bl
je 0x14002552b
mov esi, edx
mov bl, byte [rdi + rsi]
inc edx
cmp bl, byte [rax + rsi]
je 0x14002550e
inc rcx
cmp rcx, r9
jne 0x1400254f9
jmp 0x1400255d9
mov eax, ecx
mov ecx, dword [r15 + r8 + 0x1c]
mov edx, dword [r15 + r8 + 0x24]
add rcx, r15
add rdx, r15
movzx eax, word [rdx + rax*2]
mov r14d, dword [rcx + rax*4]
add r14, r15
mov rsi, qword [0x14003598c]
mov r8d, dword [0x140035954]
mov edx, dword [0x140035964]
lea r9, [rsp + 0x24]
mov rcx, rsi
call r14
mov rax, qword [0x140035994]
mov ecx, eax
mov eax, dword [r12 + rcx + 4]
mov edx, dword [0x140035964]
cmp edx, 9
jb 0x1400255a2
add r12, rcx
mov ecx, 8
movsxd rcx, ecx
mov edx, dword [r12 + rcx]
add edx, eax
mov dword [rsi + rcx], edx
add ecx, dword [0x1400359a8]
cmp ecx, dword [0x140035964]
jb 0x140025588
mov eax, dword [0x14003599c]
mov dword [rsi + 8], eax
or byte [rbp + r9*4 + 0x4c], r9b
and al, 0x24
mov r8d, dword [r9]
mov edx, dword [0x140035964]
add dword [rax], eax
mov rcx, rsi
call r14
mov eax, dword [0x140035968]
add rax, rsi
mov edx, dword [rsi + 0xc]
add rdx, rax
mov ecx, dword [0x140035968]
add byte [rax + 1], cl
int1
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]