Function at 0x140006b98
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r13b, r8b
mov qword [rbp - 0x41], rdx
xor r14d, r14d
mov edi, r14d
mov dword [rbp - 0x49], r14d
lea r9, [rbp - 0x49]
xor r8d, r8d
xor edx, edx
lea ebx, [rdx + 0xb]
mov ecx, ebx
call qword [0x1400f6be8]
mov esi, 0xc0000004
jmp 0x140006c31
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [0x1400f6280]
mov edx, dword [rbp - 0x49]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [0x1400f6270]
mov rdi, rax
lea r9, [rbp - 0x49]
mov r8d, dword [rbp - 0x49]
mov rdx, rax
mov ecx, ebx
call qword [0x1400f6be8]
cmp eax, esi
je 0x140006bf5
test eax, eax
js 0x140006f15
mov r15d, r14d
cmp dword [rdi], r14d
jbe 0x140006f15
mov eax, r15d
imul r12, rax, 0x128
movzx edx, word [r12 + rdi + 0x2e]
add rdx, 0x30
add rdx, r12
add rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140006c76
lea rcx, [rbp - 0x19]
call fcn.140004df0
nop
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rcx, qword [rbp - 0x19]
lea rdx, str.ntoskrnl.exe
call qword [0x1400f6b30]
test eax, eax
jne 0x140006ece
lea rdx, [rdi + 0x30]
add rdx, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140006cc6
lea rcx, [rbp - 0x39]
call fcn.140004df0
nop
lea rcx, str.SYSTEMROOT
call qword [0x1400f6860]
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x140006cf9
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140004df0
nop
lea rdx, [0x140115984]
lea rcx, [rbp + 7]
call fcn.140003dd8
mov rbx, rax
lea rsi, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rsi, qword [rbp - 0x39]
mov rax, qword [rbp - 0x29]
cmp rax, 0xc
jb 0x140006d8c
lea r14, [rax + rsi]
lea r8, [r14 - 0xb]
sub r8, rsi
mov rcx, rsi
jmp 0x140006d6f
movabs rcx, 0x526d65747379535c
cmp qword [rax], rcx
jne 0x140006d62
cmp dword [rax + 8], 0x5c746f6f
je 0x140006d87
inc rax
lea r8, [r14 - 0xb]
sub r8, rax
mov rcx, rax
mov edx, 0x5c
call fcn.1400f119b
test rax, rax
jne 0x140006d4a
or rax, 0xffffffffffffffff
xor r14d, r14d
jmp 0x140006d90
sub rax, rsi
jmp 0x140006d82
or rax, 0xffffffffffffffff
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140006d9e
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140008164
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140006dee
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f55
call fcn.1400e7af4
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rcx, qword [rbp - 0x39]
xor edx, edx
lea r8d, [rdx + 1]
call qword [0x1400f6268]
mov rdx, rax
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140006f87
movsxd rcx, dword [rdx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140006f87
mov eax, dword [rcx + rdx + 0x88]
test eax, eax
je 0x140006f87
mov esi, dword [rax + rdx + 0x1c]
lea rbx, [rdx + rsi]
mov r11d, dword [rax + rdx + 0x20]
add r11, rdx
mov r14d, dword [rax + rdx + 0x24]
add r14, rdx
xor r8d, r8d
test esi, esi
je 0x140006e90
mov ecx, dword [r11]
add rcx, rdx
mov rax, qword [rbp - 0x41]
sub rcx, rax
movzx r10d, byte [rax]
movzx r9d, byte [rax + rcx]
sub r10d, r9d
jne 0x140006e7b
inc rax
test r9d, r9d
jne 0x140006e65
test r10d, r10d
je 0x140006f5c
inc r8d
add r11, 4
cmp r8d, esi
jb 0x140006e58
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140006ecb
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ec6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fbc
call fcn.1400e7af4
xor r14d, r14d
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140006f09
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000701e
call fcn.1400e7af4
inc r15d
cmp r15d, dword [rdi]
jb 0x140006c49
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [0x1400f6280]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400e7a90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [0x1400f6960]
nop
movsxd rax, r8d
movzx ecx, word [r14 + rax*2]
xor r14d, r14d
mov ebx, dword [rbx + rcx*4]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
test r13b, r13b
jne 0x140006f7f
add rbx, qword [r12 + rdi + 0x18]
call qword [0x1400f6280]
jmp 0x140006f8a
mov rbx, r14
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140006fc8
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006fc3
call qword [0x1400f6960]
int3
call fcn.1400e7af4
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], r14b
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140007016
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007011
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007011
call qword [0x1400f6960]
int3
call fcn.1400e7af4
mov rax, rbx
jmp 0x140006f28
call qword [0x1400f6960]
int3