Function at 0x140002f50
Capabilities:
Access pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push r13
push r14
mov rbp, rsp
sub rsp, 0x70
mov r13d, ecx
mov r14, r8
mov rcx, r8
mov ebx, edx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
test rax, rax
jne 0x140002f97
lea rcx, str.Invalid_PE_header_n
call fcn.140002b10
add rsp, 0x70
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
test ebx, ebx
je 0x140003298
test r13d, r13d
je 0x140003298
lea rax, [rbp + 0x48]
mov qword [rsp + 0xb0], rdi
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x50]
xor edi, edi
mov qword [rsp + 0x60], r15
mov qword [rbp + 0x48], rdi
lea rdx, [rbp - 0x48]
mov eax, dword [rsi + 0x50]
xor r9d, r9d
mov dword [rbp - 0x20], eax
xor ecx, ecx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x38], rax
mov r15, r13
lea rax, [rbp - 0x40]
mov dword [rbp - 0x1c], 0x40
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 0x6283
mov dword [rbp - 0x3c], 3
mov qword [rbp - 0x50], rdi
call qword [0x14000c290]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x14000303a
lea rcx, str.Failed_to_allocate_memory
call fcn.140002b10
mov rdi, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x60]
add rsp, 0x70
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
mov r8, rsi
mov rdx, r14
call fcn.140002b70
test eax, eax
jne 0x140003093
mov rax, qword [rbp + 0x48]
lea r8, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x38], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], 0x6283
xor ecx, ecx
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x3c], 4
mov qword [rbp - 0x48], rdi
call qword [0x14000c290]
lea rcx, str.Failed_to_relocate_image_n
jmp 0x14000301c
mov rdx, rsi
mov rcx, r14
call fcn.140002d00
xor ecx, ecx
test eax, eax
jne 0x1400030ef
mov rax, qword [rbp + 0x48]
lea r8, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x38], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], 0x6283
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x3c], 4
mov qword [rbp - 0x48], rdi
call qword [0x14000c290]
lea rcx, str.Failed_to_resolve_imports_n
jmp 0x14000301c
movzx ebx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rbx, 0x28
mov qword [rsp + 0x68], r12
mov r12, qword [rbp + 0x48]
cmp cx, ax
jae 0x14000317c
add rbx, rsi
xor r13d, r13d
nop
mov eax, dword [rbx - 4]
lea r8, [rbp - 0x48]
add rax, r12
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x50]
mov eax, dword [rbx]
xor r9d, r9d
mov dword [rbp - 0x20], eax
xor ecx, ecx
mov eax, dword [rbx + 4]
add rax, r14
mov dword [rbp - 0x40], 0x6283
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x3c], 1
mov qword [rbp - 0x48], r13
call qword [0x14000c290]
movzx eax, word [rsi + 6]
lea rbx, [rbx + 0x28]
inc di
cmp di, ax
jb 0x140003110
mov r12, qword [rbp + 0x48]
xor ecx, ecx
mov r13d, dword [rbp + 0x30]
movzx edi, word [rsi + 0x14]
movzx r14d, cx
add rdi, 0x28
cmp cx, ax
jae 0x140003238
add rdi, rsi
mov eax, dword [rdi]
test eax, eax
je 0x14000321f
test dword [rdi + 0x14], 0x2000000
je 0x14000321f
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rdi - 4]
lea r8, [rbp - 0x48]
add rcx, r12
mov qword [rbp - 0x18], rax
mov rbx, rax
mov qword [rbp - 0x28], rcx
mov ecx, dword [rdi]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x20], ecx
lea rax, [rbp - 0x40]
xor ecx, ecx
mov qword [rbp - 0x30], r15
xor r9d, r9d
mov dword [rbp - 0x40], 0x6283
mov dword [rbp - 0x3c], 1
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0
call qword [0x14000c290]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14w
add rdi, 0x28
cmp r14w, word [rsi + 6]
jb 0x140003194
mov r12, qword [rbp + 0x48]
xor ecx, ecx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x38], rax
lea r8, [rbp - 0x48]
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], r15
xor r9d, r9d
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x28], r12
xor ecx, ecx
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x40], 0x6283
mov dword [rbp - 0x3c], 8
call qword [0x14000c290]
mov r8, qword [rbp + 0x48]
mov r9, rsi
mov edx, dword [rbp + 0x38]
mov ecx, r13d
call fcn.1400060a0
mov r12, qword [rsp + 0x68]
jmp 0x140003021
lea rcx, str.Invalid_thread_id___process_id_n
call fcn.140002b10
add rsp, 0x70
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret