Function at 0x180003810
Capabilities:
Access peb ldr_data
Get common file path
Resolve function by hash
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x180066bc0]
test rax, rax
jne 0x180003a13
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x20]
test r14, r14
je 0x1800039f0
mov r10, qword [0x180066be0]
xor ebx, ebx
mov r11, qword [0x180066b70]
mov r12d, 0xffff
lea r13d, [rbx + 2]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [r14 + 0x50]
mov rdx, rbx
movzx r9d, word [r14 + 0x48]
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
ror edx, 0xd
mov eax, edx
add rax, rcx
cmp cl, 0x61
lea rdx, [rax - 0x20]
cmovb rdx, rax
add r9w, r12w
jne 0x180003890
cmp edx, 0x6a4abc5b
jne 0x18000395a
mov r9, qword [r14 + 0x20]
movzx ebp, r13w
movsxd rax, dword [r9 + 0x3c]
mov r15d, dword [rax + r9 + 0x88]
mov edi, dword [r15 + r9 + 0x20]
mov esi, dword [r15 + r9 + 0x24]
add rdi, r9
add rsi, r9
mov edx, dword [rdi]
mov eax, ebx
add rdx, r9
movzx ecx, byte [rdx]
nop dword [rax + rax]
ror eax, 0xd
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1800038f0
cmp eax, 0xec0e4e8e
je 0x180003911
cmp eax, 0x7c0dfcaa
jne 0x18000394e
mov ecx, dword [r15 + r9 + 0x1c]
movzx r8d, word [rsi]
lea rdx, [r9 + rcx]
cmp eax, 0xec0e4e8e
jne 0x180003935
mov r10d, dword [rdx + r8*4]
add r10, r9
mov qword [0x180066be0], r10
jmp 0x18000394a
cmp eax, 0x7c0dfcaa
jne 0x18000394a
mov r11d, dword [rdx + r8*4]
add r11, r9
mov qword [0x180066b70], r11
add bp, r12w
add rdi, 4
add rsi, r13
test bp, bp
jne 0x1800038e1
test r10, r10
je 0x180003964
test r11, r11
jne 0x180003972
mov r14, qword [r14]
test r14, r14
jne 0x180003880
jmp 0x1800039f0
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [rsp + 0x20], bl
je 0x180003999
nop dword [rax + rax]
inc ebx
cmp byte [rsp + rbx + 0x20], 0
jne 0x180003990
mov eax, ebx
lea rcx, [rsp + 0x20]
inc ebx
mov byte [rsp + rax + 0x20], 0x5c
mov byte [rsp + rbx + 0x20], 0x56
inc ebx
mov byte [rsp + rbx + 0x20], 0x45
inc ebx
mov byte [rsp + rbx + 0x20], 0x52
inc ebx
mov byte [rsp + rbx + 0x20], 0x53
inc ebx
mov byte [rsp + rbx + 0x20], 0x49
inc ebx
mov byte [rsp + rbx + 0x20], 0x4f
inc ebx
lea eax, [rbx + 1]
mov byte [rsp + rbx + 0x20], 0x4e
mov byte [rsp + rax + 0x20], 0
call qword [0x180066be0]
mov qword [0x180066bc0], rax
test rax, rax
jne 0x180003a13
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, [0x180016508]
mov rcx, rax
call qword [0x180066b70]
mov qword [0x180066b80], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016520]
call qword [0x180066b70]
mov qword [0x180066ba8], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016540]
call qword [0x180066b70]
mov qword [0x180066b50], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016558]
call qword [0x180066b70]
mov qword [0x180066bd8], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016570]
call qword [0x180066b70]
mov qword [0x180066bd0], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016588]
call qword [0x180066b70]
mov qword [0x180066b90], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x1800165a8]
call qword [0x180066b70]
mov qword [0x180066bb0], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x1800165c8]
call qword [0x180066b70]
mov qword [0x180066b58], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x1800165e0]
call qword [0x180066b70]
mov qword [0x180066b78], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x1800165f8]
call qword [0x180066b70]
mov qword [0x180066b88], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016608]
call qword [0x180066b70]
mov qword [0x180066bb8], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016618]
call qword [0x180066b70]
mov qword [0x180066be8], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016628]
call qword [0x180066b70]
mov qword [0x180066b60], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016638]
call qword [0x180066b70]
mov qword [0x180066b98], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016650]
call qword [0x180066b70]
mov qword [0x180066b68], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016668]
call qword [0x180066b70]
mov qword [0x180066ba0], rax
test rax, rax
je 0x180003c6d
mov rcx, qword [0x180066bc0]
lea rdx, [0x180016678]
call qword [0x180066b70]
mov qword [0x180066bc8], rax
test rax, rax
je 0x180003c6d
mov eax, 1
jmp 0x1800039f2
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]