Function at 0x140001790
Capabilities:
Access peb ldr_data
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f8
mov r14, qword gs:[0x60]
mov rbx, qword [r14 + 0x18]
add rbx, 0x20
xor edi, edi
lea rsi, str.KERNEL32.DLL
nop dword [rax]
mov rbx, qword [rbx]
mov rax, qword [r14 + 0x18]
add rax, 0x20
cmp rbx, rax
je 0x140001125
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.140003a88
test rax, rax
je 0x140001100
mov rdi, qword [rbx + 0x20]
movzx eax, word [rdi]
cmp eax, 0x5a4d
jne 0x1400011a3
movsxd rax, dword [rdi + 0x3c]
cmp dword [rdi + rax], 0x4550
jne 0x1400011a3
mov ebx, dword [rax + rdi + 0x88]
test rbx, rbx
je 0x1400011a3
cmp dword [rdi + rbx + 0x18], 0
je 0x1400011a3
mov r14d, dword [rdi + rbx + 0x1c]
mov r15d, dword [rdi + rbx + 0x20]
add r14, rdi
mov r12d, dword [rdi + rbx + 0x24]
add r12, rdi
add r15, rdi
lea rsi, str.GetThreadContext
xor r13d, r13d
nop word cs:[rax + rax]
mov ecx, dword [r15 + r13*4]
add rcx, rdi
mov rdx, rsi
call fcn.140005170
test eax, eax
je 0x1400012e3
inc r13
mov eax, dword [rbx + rdi + 0x18]
cmp r13, rax
jb 0x140001180
xor edi, edi
mov r15, qword gs:[0x60]
mov r14, qword [r15 + 0x18]
add r14, 0x20
xor ebx, ebx
lea rsi, str.KERNEL32.DLL
nop
mov r14, qword [r14]
mov rax, qword [r15 + 0x18]
add rax, 0x20
cmp r14, rax
je 0x1400011e5
mov rcx, qword [r14 + 0x40]
mov rdx, rsi
call fcn.140003a88
test rax, rax
je 0x1400011c0
mov rbx, qword [r14 + 0x20]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x140001264
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne 0x140001264
mov r14d, dword [rax + rbx + 0x88]
test r14, r14
je 0x140001264
cmp dword [rbx + r14 + 0x18], 0
je 0x140001264
mov r15d, dword [rbx + r14 + 0x1c]
mov r12d, dword [rbx + r14 + 0x20]
add r15, rbx
mov r13d, dword [rbx + r14 + 0x24]
add r13, rbx
add r12, rbx
lea rsi, str.SetThreadContext
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, dword [r12 + rbp*4]
add rcx, rbx
mov rdx, rsi
call fcn.140005170
test eax, eax
je 0x1400012f4
inc rbp
mov eax, dword [r14 + rbx + 0x18]
cmp rbp, rax
jb 0x140001240
xor ebx, ebx
lea rsi, [rsp + 0x20]
mov r8d, 0x4d0
mov rcx, rsi
xor edx, edx
call fcn.140003700
mov dword [rsp + 0x50], 0x100010
mov rcx, qword [0x14001ca68]
mov rdx, rsi
call rdi
lea rax, [0x1400010c0]
mov qword [rsp + 0x68], rax
mov rax, 0xfffffffffffcfffe
and rax, qword [rsp + 0x90]
or rax, 1
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x50], 0x100010
mov rcx, qword [0x14001ca68]
mov rdx, rsi
call rbx
test eax, eax
setne al
add rsp, 0x4f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [r12 + r13*2]
mov eax, dword [r14 + rax*4]
add rdi, rax
jmp 0x1400011a5
movzx eax, word [r13 + rbp*2]
mov eax, dword [r15 + rax*4]
add rbx, rax
jmp 0x140001266
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [0x14001ca68], rax
mov r14, qword gs:[0x60]
mov rbx, qword [r14 + 0x18]
add rbx, 0x20
xor edi, edi
lea rsi, str.ntdll.dll
mov rbx, qword [rbx]
mov rax, qword [r14 + 0x18]
add rax, 0x20
cmp rbx, rax
je 0x1400017e5
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.140003a88
test rax, rax
je 0x1400017c0
mov rdi, qword [rbx + 0x20]
mov qword [0x14001ca70], rdi
call fcn.140001660
test al, al
je 0x140001821
lea rdx, [0x140001310]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x14001ca60], rax
test rax, rax
je 0x140001821
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400010d0
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret