Function at 0x140002740
Capabilities:
Access pe header
Access peb ldr_data
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x50], r9
mov esi, r8d
mov qword [rsp + 0x60], rdx
mov rax, rcx
mov qword [rsp + 0x58], rcx
mov r14d, r8d
mov dword [rsp + 0x38], r8d
mov r12, qword [rsp + 0x110]
mov qword [rsp + 0x70], r12
mov r15, qword [rsp + 0x108]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], r9
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x48], rdi
cmp qword [rsp + 0x100], rbx
je 0x1400027cd
mov eax, 0xc00000f3
jmp 0x140002bbf
mov qword [rcx], rdi
test rdx, rdx
je 0x1400027d8
mov qword [rdx], rdi
lea rdx, [rsp + 0x100]
mov rcx, r9
call fcn.140004a20
mov r13d, 0xc000007b
test al, al
jne 0x1400027fe
bt esi, 0x1e
cmovae ebx, r13d
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x50]
jmp 0x140002852
test ebx, ebx
js 0x140002bbd
and esi, 0x10000000
mov r15d, esi
cmove r15d, r14d
mov rcx, rdi
test esi, esi
cmove rcx, r12
mov qword [rsp + 0x68], rcx
mov rsi, rdi
cmove rsi, rax
mov qword [rsp + 0x40], rsi
test r15b, 4
je 0x140002899
test rsi, rsi
je 0x140002b25
test rcx, rcx
je 0x140002b25
test rsi, rsi
je 0x1400029ce
mov r12, 0xffffffffffffffff
nop dword [rax]
inc r12
cmp word [rsi + r12*2], 0
jne 0x1400028b0
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rbx, qword [rdx + 0x18]
add rbx, 0x10
mov qword [rsp + 0x38], rbx
mov r14, qword [rbx]
mov rcx, r9
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1400028f3
mov eax, r13d
jmp 0x140002bbf
cmp r14, rbx
je 0x1400029ce
mov rax, rbx
nop
mov rbx, r14
mov r14, qword [r14]
cmp qword [rbx + 0x10], 0
je 0x1400029c5
movsxd r8, r12d
movzx eax, word [rbx + 0x58]
shr rax, 1
sub rax, r8
test rax, 0xfffffffffffffffb
jne 0x1400029c0
mov rdx, qword [rbx + 0x60]
mov rcx, rsi
call fcn.14004f6b0
test eax, eax
jne 0x1400029c0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r13, rax
test rax, rax
je 0x1400029c0
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x140002998
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140002998
movsxd rdx, dword [rsi + 0x3c]
movzx ecx, word [rdx + rsi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
add rcx, 0x108
add rcx, rsi
movabs rax, 0xaabbcc11ffee00
cmp qword [rcx], rax
jne 0x140002998
cmp qword [rcx + 0x10], rsi
je 0x14000299b
mov rcx, rdi
test rcx, rcx
je 0x1400029bb
mov eax, dword [r13 + 0x1c]
mov rdx, qword [rsp + 0x70]
cmp dword [rdx + 0x1c], eax
jne 0x1400029bb
mov eax, dword [r13 + 0x54]
cmp dword [rdx + 0x54], eax
je 0x140002ad0
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
cmp r14, rax
jne 0x140002900
movabs r12, 0xaabbcc11ffee00
mov r8d, dword [rsp + 0x100]
mov rdx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rcx, r13
call fcn.1400036d0
test eax, eax
js 0x140002bbf
cmp eax, 0x4000000e
je 0x140002bbf
mov rbx, qword [r13]
test rbx, rbx
je 0x14000313e
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000313e
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r12
jne 0x14000313e
cmp qword [rsi + 0x10], rbx
jne 0x14000313e
or byte [rsi + 0xc], 2
mov rcx, qword [r13]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, rax
mov eax, 0x400
test word [r14 + 0x5e], ax
je 0x140002a74
or r15d, 1
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
bt r15d, 0x1c
jae 0x140002bd2
mov r8, rsi
mov rdx, r14
call fcn.140006af0
mov ebx, eax
test eax, eax
js 0x140002b2f
mov rdx, r14
mov rcx, qword [r13]
call fcn.1400035b0
mov ebx, eax
test eax, eax
js 0x140002b2f
mov rcx, rsi
call fcn.1400046e0
test eax, eax
je 0x140002ac9
mov rcx, rsi
call fcn.140004750
test eax, eax
jne 0x140002b2f
mov ebx, 0xc0000142
jmp 0x140002b37
test byte [rcx + 0xe], 8
je 0x140002b25
test r15b, 2
jne 0x140002b25
mov r8d, dword [rcx + 0x2c]
cmp r8d, 0xffffffff
je 0x140002b05
mov rax, qword [rcx + 0x38]
mov edx, 0xffff
cmp word [rax + 0x6c], dx
jne 0x140002afe
mov dword [rcx + 0x2c], 0xffffffff
jmp 0x140002b05
lea eax, [r8 + 1]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140002b1e
mov qword [rax], rbx
xor eax, eax
jmp 0x140002bbf
mov eax, 0xc00000f1
jmp 0x140002bbf
test ebx, ebx
jns 0x140002bbd
mov rsi, qword [r13]
test rsi, rsi
je 0x140002b7e
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140002b7e
movsxd rdx, dword [rsi + 0x3c]
movzx ecx, word [rdx + rsi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
cmp qword [rcx + rsi + 0x108], r12
jne 0x140002b7e
cmp qword [rcx + rsi + 0x118], rsi
jne 0x140002b7e
lea rdi, [rsi + 0x108]
add rdi, rcx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rdi, rdi
je 0x140002bbd
movzx eax, byte [rdi + 0xc]
and al, 6
cmp al, 2
je 0x140002bbd
cmp qword [rdi + 0x20], 0
je 0x140002ba5
mov rcx, rdi
call fcn.140006a30
cmp qword [rdi + 0x10], 0
je 0x140002bbd
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov edx, r15d
call fcn.140002540
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140002dba
or word [rsi + 0xe], 1
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x38], rax
mov r8, rsi
mov rdx, r14
mov rcx, qword [r13]
call fcn.140006af0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140002dba
mov rdx, r14
mov rcx, qword [r13]
call fcn.1400035b0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140002dba
test r15b, 2
jne 0x140002c4c
or word [rsi + 0xe], 8
test r15b, 1
jne 0x140002c72
mov edx, dword [r14 + 0x50]
mov rcx, qword [rsi + 0x10]
call fcn.140004d60
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140002dba
or word [rsi + 0xe], 2
test r15b, 8
jne 0x140002cb0
mov rax, qword [0x14008ac28]
mov rdx, qword [rax + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [rdx + 0x18]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140002cab
bt r15d, 0x1d
jae 0x140002dba
mov ebx, 0x7fffffff
mov dword [rsp + 0x30], ebx
jmp 0x140002cb0
or word [rsi + 0xe], 4
and r15d, 0x10
je 0x140002cbb
call fcn.140005a70
mov rcx, rsi
call fcn.1400046e0
test eax, eax
je 0x140002dd9
mov rcx, rsi
call fcn.140004750
test eax, eax
je 0x140002dd9
test r15d, r15d
je 0x140002dba
lea rcx, str.mscoreei.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002dba
lea rdx, str.GetFileVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008ac28]
mov rdx, qword [rcx + 0x68]
mov qword [rdx + 0x98], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x68]
cmp qword [rcx + 0x98], 0
je 0x140002dba
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x68]
cmp byte [rcx + 0x40], 0
je 0x140002d9f
cmp byte [rcx + 0x41], 0
jne 0x140002d9f
call fcn.140007620
call fcn.140007c90
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x68]
add rcx, 0x98
lea rdx, [0x140005960]
call fcn.140007d40
call fcn.140007700
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x41], 1
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [rsp + 0x30]
test ebx, ebx
js 0x140002de2
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140002bbd
mov rax, qword [rsp + 0x48]
mov qword [rcx], rax
jmp 0x140002bbd
mov ebx, 0xc0000142
mov dword [rsp + 0x30], ebx
mov r14, qword [r13]
mov r12d, edi
test r14, r14
je 0x140002e2e
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140002e2e
movsxd rdx, dword [r14 + 0x3c]
movzx ecx, word [rdx + r14 + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, r14
movabs rax, 0xaabbcc11ffee00
cmp qword [rsi], rax
jne 0x140002e2e
cmp qword [rsi + 0x10], r14
je 0x140002e31
mov rsi, rdi
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test rsi, rsi
je 0x140003135
movzx edx, byte [rsi + 0xc]
test dl, 2
je 0x140003135
movzx r8d, word [rsi + 0xe]
test r8b, 1
jne 0x140002e75
or dl, 4
mov byte [rsi + 0xc], dl
mov rcx, r14
call fcn.140003b20
mov qword [r13], rdi
jmp 0x140002bbd
mov r15, qword [rsi + 0x38]
mov eax, dword [r15 + 0x40]
cmp dword [r9 + 0x50], eax
je 0x140002e8a
mov ecx, 7
int 0x29
test r8b, 8
je 0x140002e94
mov r12d, dword [rsi + 0x2c]
test r12d, 0xfffffffe
je 0x140002edb
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
je 0x140003135
mov edx, 0xffff
cmp word [r15 + 0x6c], dx
jne 0x140002ec5
mov dword [rsi + 0x2c], 0xffffffff
mov qword [r13], rdi
jmp 0x140002bbd
test eax, eax
je 0x140003135
dec eax
mov dword [rsi + 0x2c], eax
mov qword [r13], rdi
jmp 0x140002bbd
or dl, 4
mov byte [rsi + 0xc], dl
test dl, 1
je 0x140002ef8
mov rcx, qword [rsi + 0x10]
mov eax, dword [r9 + 0x28]
add rax, rcx
xor r8d, r8d
xor edx, edx
call rax
movzx eax, word [rsi + 0xe]
test al, 1
je 0x140003092
test al, 2
je 0x140002f1b
mov rcx, r14
call fcn.140004f10
test eax, eax
jns 0x140002f1b
mov ecx, 3
int 0x29
test byte [rsi + 0xe], 4
je 0x140002f3d
mov rax, qword [0x14008ac28]
mov rdx, qword [rax + 0x78]
mov rcx, r15
call qword [rdx + 0x20]
test eax, eax
jns 0x140002f3d
mov ecx, 7
int 0x29
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r12, qword [rcx + 0x30]
mov rdx, qword [0x14008ac28]
movzx eax, byte [rdx + 0x14]
dec eax
cmp eax, 8
ja case.default.0x140002f78
cdqe
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x3158]
add rcx, r8
jmp rcx
mov rcx, r15
call fcn.140003be0
mov r8, qword [r15 + 0x98]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x14008ac28]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140002f78.2
lea rdx, [r15 + 0xc8]
mov rcx, qword [rcx]
call rax
mov rdx, qword [0x14008ac28]
movzx eax, word [rdx + 0x16]
mov ecx, 0xc8
cmp ax, cx
je 0x140002fd3
mov ecx, 0xe0
cmp ax, cx
jne case.0x140002f78.1
lea rsi, [r15 + 0x98]
mov rbx, qword [rsi]
cmp rsi, rbx
je case.0x140002f78.1
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov rbx, qword [rbx]
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp rsi, rbx
jne 0x140002fe2
mov r8, qword [r15 + 0x60]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [r15 + 0x50]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rdx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x18]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r15 + 0x20]
mov rax, qword [r15 + 0x28]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r15 + 0x70]
mov rax, qword [r15 + 0x78]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov r8, r15
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r15d, 1
mov eax, r15d
jmp 0x140003081
mov eax, edi
mov r15d, 1
test eax, eax
jne 0x14000308c
mov ecx, 7
int 0x29
mov ebx, dword [rsp + 0x30]
jmp 0x140003098
mov r15d, 1
test r14, r14
je 0x1400030dd
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400030dd
movsxd rdx, dword [r14 + 0x3c]
movzx ecx, word [rdx + r14 + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, r14
movabs rax, 0xaabbcc11ffee00
cmp qword [rsi], rax
jne 0x1400030dd
cmp qword [rsi + 0x10], r14
je 0x1400030e0
mov rsi, rdi
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rsi, rsi
jne 0x1400030f3
mov r15d, edi
jmp 0x140003129
movzx eax, byte [rsi + 0xc]
and al, 6
cmp al, 2
jne 0x140003102
mov r15d, edi
jmp 0x140003129
cmp qword [rsi + 0x20], 0
je 0x140003111
mov rcx, rsi
call fcn.140006a30
cmp qword [rsi + 0x10], 0
je 0x140003129
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15d, r15d
jne 0x140003135
mov ecx, 7
int 0x29
mov qword [r13], rdi
jmp 0x140002bbd
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, 0xc0000141
call qword [sym.imp.KERNEL32.dll_ExitProcess]