Function at 0x140002680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140008060], 0
mov rsi, rdx
mov ebp, ecx
jne 0x14000273c
mov ecx, 0xf87b6f6b
call fcn.140001000
mov qword [0x140008058], rax
mov r8, rax
test rax, rax
je 0x1400029db
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400029db
mov ecx, dword [rax + r8 + 0x88]
add rcx, r8
mov edx, dword [rcx + 0x18]
mov dword [0x140008050], edx
mov r10d, dword [rcx + 0x20]
add r10, r8
mov qword [0x140008040], r10
mov r9d, dword [rcx + 0x1c]
add r9, r8
mov qword [0x140008038], r9
mov ecx, dword [rcx + 0x24]
add rcx, r8
mov qword [0x140008048], rcx
test edx, edx
je 0x1400029db
test r10, r10
je 0x1400029db
test r9, r9
je 0x1400029db
test rcx, rcx
je 0x1400029db
mov byte [0x140008060], 1
mov dword [rsi + 4], ebp
test ebp, ebp
je 0x1400029db
xor edi, edi
cmp dword [0x140008050], edi
jbe 0x140002928
mov rax, qword [0x140008040]
mov ecx, dword [rax + rdi*4]
mov rax, qword [0x140008048]
add rcx, qword [0x140008058]
movzx edx, word [rax + rdi*2]
mov rax, qword [0x140008038]
mov ebx, dword [rax + rdx*4]
add rbx, qword [0x140008058]
call fcn.1400014c0
cmp eax, ebp
je 0x14000279a
inc edi
cmp edi, dword [0x140008050]
jb 0x140002755
jmp 0x140002928
movzx eax, byte [rbx]
mov r8d, 1
mov r10d, 0xff
cmp al, 0x4c
jne 0x1400027ec
cmp byte [rbx + 1], 0x8b
jne 0x14000288e
cmp byte [rbx + 2], 0xd1
jne 0x14000288e
cmp byte [rbx + 3], 0xb8
jne 0x14000288e
cmp byte [rbx + 6], 0
jne 0x14000288e
cmp byte [rbx + 7], 0
jne 0x14000288e
movzx ecx, byte [rbx + 5]
movzx eax, byte [rbx + 4]
jmp 0x140002921
cmp al, 0xe9
jne 0x14000288e
movzx ecx, r8w
nop dword [rax + rax]
movzx r9d, cx
mov edx, r9d
shl edx, 5
add rdx, rbx
cmp byte [rdx], 0x4c
jne 0x140002830
cmp byte [rdx + 1], 0x8b
jne 0x140002830
cmp byte [rdx + 2], 0xd1
jne 0x140002830
cmp byte [rdx + 3], 0xb8
jne 0x140002830
cmp byte [rdx + 6], 0
jne 0x140002830
cmp byte [rdx + 7], 0
je 0x14000286c
mov eax, r9d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, rbx
cmp byte [rdx], 0x4c
jne 0x140002861
cmp byte [rdx + 1], 0x8b
jne 0x140002861
cmp byte [rdx + 2], 0xd1
jne 0x140002861
cmp byte [rdx + 3], 0xb8
jne 0x140002861
cmp byte [rdx + 6], 0
jne 0x140002861
cmp byte [rdx + 7], 0
je 0x14000287c
inc cx
cmp cx, r10w
jbe 0x140002800
jmp 0x14000288e
movzx ecx, byte [rdx + 5]
movzx eax, byte [rdx + 4]
shl ecx, 8
sub eax, r9d
jmp 0x14000288a
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
add ecx, r9d
shl eax, 8
or ecx, eax
mov dword [rsi], ecx
cmp byte [rbx + 3], 0xe9
jne 0x140002928
nop dword [rax + rax]
movzx r9d, r8w
mov edx, r9d
shl edx, 5
add rdx, rbx
cmp byte [rdx], 0x4c
jne 0x1400028d0
cmp byte [rdx + 1], 0x8b
jne 0x1400028d0
cmp byte [rdx + 2], 0xd1
jne 0x1400028d0
cmp byte [rdx + 3], 0xb8
jne 0x1400028d0
cmp byte [rdx + 6], 0
jne 0x1400028d0
cmp byte [rdx + 7], 0
je 0x14000290d
mov eax, r9d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, rbx
cmp byte [rdx], 0x4c
jne 0x140002901
cmp byte [rdx + 1], 0x8b
jne 0x140002901
cmp byte [rdx + 2], 0xd1
jne 0x140002901
cmp byte [rdx + 3], 0xb8
jne 0x140002901
cmp byte [rdx + 6], 0
jne 0x140002901
cmp byte [rdx + 7], 0
je 0x140002916
inc r8w
cmp r8w, r10w
jbe 0x1400028a0
jmp 0x140002928
movzx eax, byte [rdx + 4]
sub eax, r9d
jmp 0x14000291d
movzx eax, byte [rdx + 4]
add eax, r9d
movzx ecx, byte [rdx + 5]
shl ecx, 8
or ecx, eax
mov dword [rsi], ecx
cmp dword [rsi], 0
jne 0x1400029f2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400029db
lea rbx, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerHellsHall.c
mov edx, 0x5c
mov rcx, rbx
call fcn.140002650
test rax, rax
je 0x140002981
mov edx, 0x5c
mov rcx, rbx
call fcn.140002650
lea rbx, [rax + 1]
mov r9, rbx
mov dword [rsp + 0x20], 0xf3
mov r8d, ebp
lea rdx, str.____FetchNtSyscall_Failed_To_Fetch_The_Syscall_Number_Of_Syscall_Of_Hash:_0x_0.8X____s._d__n
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, [rsi + 8]
call fcn.140002a00
jmp 0x1400029dd