Function at 0x1400034f0
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x78
mov rax, qword [0x14003d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, qword [rcx + 8]
xor ecx, ecx
mov rsi, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add rsi, rax
lea rcx, [0x14003e420]
add r15, rax
mov eax, 0x5a4d
cmp word [rsi], ax
je 0x14000354b
lea rdx, str.Invalid_DOS_Signature
call fcn.140001230
mov rcx, rax
call fcn.140001b30
xor al, al
jmp 0x140003ab3
mov qword [rsp + 0x70], r12
lea rdx, str.Good_signature__
mov qword [rsp + 0x68], r13
call fcn.140001230
mov rcx, rax
call fcn.140001b30
movsxd r13, dword [rsi + 0x3c]
mov rdx, rsi
add r13, rsi
mov rcx, r15
mov qword [rsp + 0x28], r13
movzx r8d, word [r13 + 0x14]
lea rdi, [r13 + 0x18]
movzx ebx, word [r13 + 6]
add rdi, r8
call fcn.14000ae00
lea rdx, str.Sections:
lea rcx, [0x14003e420]
call fcn.140001230
movzx edx, bx
mov rcx, rax
call fcn.140002970
mov rcx, rax
call fcn.140001b30
test rbx, rbx
je 0x14000362f
nop dword [rax]
movups xmm1, xmmword [rdi + 0x10]
mov rcx, qword [rdi + 8]
movups xmm2, xmmword [rdi]
shr rcx, 0x20
movsd xmm0, qword [rdi + 0x20]
movq rdx, xmm1
shr rdx, 0x20
add rcx, r15
movd r8d, xmm1
add rdx, rsi
movups xmmword [rsp + 0x30], xmm2
movups xmmword [rsp + 0x40], xmm1
movsd qword [rsp + 0x50], xmm0
call fcn.14000ae00
lea rdx, str.Mapped:
lea rcx, [0x14003e420]
call fcn.140001230
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001230
mov rcx, rax
call fcn.140001b30
lea rdi, [rdi + 0x28]
sub rbx, 1
jne 0x1400035c0
mov qword [rsp + 0xb0], rbp
lea rdx, str.Importing...
lea rcx, [0x14003e420]
mov qword [rsp + 0x60], r14
call fcn.140001230
mov rcx, rax
call fcn.140001b30
mov rbx, qword [r13 + 0x90]
lea rdx, str.Dir:
lea rcx, [0x14003e420]
mov qword [rsp + 0x20], rbx
call fcn.140001230
mov rdx, r15
mov rcx, rax
call fcn.140002fc0
mov rcx, rax
lea rdx, [0x14002c680]
call fcn.140001230
mov edx, ebx
mov rcx, rax
call fcn.140002b90
mov rcx, rax
lea rdx, [0x14002c680]
call fcn.140001230
mov edx, dword [rsp + 0x24]
mov rcx, rax
call fcn.140002b90
mov rcx, rax
call fcn.140001b30
mov r12d, ebx
lea rcx, [0x14003e420]
add r12, r15
mov rdx, r12
call fcn.140002db0
mov rcx, rax
lea rdx, [0x14002c680]
call fcn.140001230
mov edx, dword [r12]
mov rcx, rax
call fcn.140002b90
mov rcx, rax
call fcn.140001b30
cmp dword [r12], 0
je 0x14000387a
mov r13d, dword [r12 + 0xc]
add r13, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.Imported:
mov rbp, rax
lea rcx, [0x14003e420]
call fcn.140001230
mov rcx, rax
mov rdx, r13
call fcn.140001230
mov rcx, rax
call fcn.140001b30
test rbp, rbp
jne 0x140003765
lea rdx, str.Error:_failed_to_load_DLL_from_import_table:
lea rcx, [0x14003e550]
call fcn.140001230
mov rcx, rax
mov rdx, r13
call fcn.140001230
mov rcx, rax
call fcn.140001b30
mov esi, dword [r12]
mov r14d, dword [r12 + 0x10]
add rsi, r15
add r14, r15
mov rax, qword [rsi]
test rax, rax
je 0x140003866
mov rcx, rbp
test al, 1
je 0x1400037ed
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000384f
lea rdx, str.Error:_failed_ordinal_lookup_for
lea rcx, [0x14003e550]
call fcn.140001230
mov rcx, rax
mov rdx, r13
call fcn.140001230
mov rcx, rax
lea rdx, [0x14002c4d8]
call fcn.140001230
mov edx, ebx
mov rcx, rax
call fcn.140002fc0
lea rdx, [fcn.140001b30]
mov rcx, rax
call fcn.140002da0
lea ecx, [rdi + 5]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rbx, [rax + r15]
lea rax, [rbx + 2]
mov rdx, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Import:
mov rdi, rax
lea rcx, [0x14003e420]
call fcn.140001230
mov rdx, rbx
mov rcx, rax
call fcn.140002db0
mov rcx, rax
lea rdx, [0x14002c680]
call fcn.140001230
mov rdx, rdi
mov rcx, rax
call fcn.140002db0
mov rcx, rax
call fcn.140001b30
test rdi, rdi
je 0x1400038d5
add rsi, 8
mov qword [r14], rdi
add r14, 8
mov rax, qword [rsi]
test rax, rax
jne 0x140003780
add r12, 0x14
cmp dword [r12], 0
jne 0x140003700
mov r13, qword [rsp + 0x28]
lea rdx, str.Relocating...
lea rcx, [0x14003e420]
call fcn.140001230
mov rcx, rax
call fcn.140001b30
test byte [r13 + 0x5e], 0x40
mov eax, dword [r13 + 0xb0]
jne 0x14000392a
lea rdx, str.Error:_image_cannot_be_relocated.
lea rcx, [0x14003e550]
call fcn.140001230
lea rdx, [fcn.140001b30]
mov rcx, rax
call fcn.140002da0
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Error:_failed_named_lookup:
lea rcx, [0x14003e550]
call fcn.140001230
mov rcx, rax
mov rdx, r13
call fcn.140001230
mov rcx, rax
lea rdx, [0x14002c75c]
call fcn.140001230
mov rdx, qword [rsp + 0x20]
mov rcx, rax
call fcn.140001230
lea rdx, [fcn.140001b30]
mov rcx, rax
call fcn.140002da0
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x14000395c
lea rdx, str.Error:_image_can_be_relocated__but_contains_no_relocation_directory.
lea rcx, [0x14003e550]
call fcn.140001230
lea rdx, [fcn.140001b30]
mov rcx, rax
call fcn.140002da0
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbp, r15
lea rsi, [r15 + rax]
sub rbp, qword [r13 + 0x30]
cmp dword [rsi], 0
je 0x140003a3d
mov r12d, 0xf000
mov r13d, 0xa000
nop dword [rax]
mov r14d, dword [rsi + 4]
lea rdx, str.Relocs:
sub r14, 8
lea rcx, [0x14003e420]
shr r14, 1
call fcn.140001230
mov rdx, r14
mov rcx, rax
call fcn.140002fc0
mov rcx, rax
call fcn.140001b30
xor edi, edi
test r14, r14
je 0x140003a29
nop dword [rax + rax]
movzx ecx, word [rsi + rdi*2 + 8]
mov ebx, dword [rsi]
mov eax, ecx
and eax, 0xfff
and cx, r12w
add rax, r15
add rbx, rax
cmp cx, r13w
jne 0x1400039e1
add qword [rbx], rbp
lea rdx, str.Reloc:
lea rcx, [0x14003e420]
call fcn.140001230
mov rdx, rbx
mov rcx, rax
call fcn.140002db0
mov rcx, rax
lea rdx, [0x14002c814]
call fcn.140001230
mov rdx, rbp
mov rcx, rax
call fcn.140002fc0
mov rcx, rax
call fcn.140001b30
inc rdi
cmp rdi, r14
jb 0x1400039c0
mov eax, dword [rsi + 4]
add rsi, rax
cmp dword [rsi], 0
jne 0x140003980
mov r13, qword [rsp + 0x28]
lea rdx, str.Executing...
lea rcx, [0x14003e420]
call fcn.140001230
mov rcx, rax
lea rdx, [0x14002c680]
call fcn.140001230
mov edx, dword [r13 + 0x28]
mov rcx, rax
add rdx, r15
call fcn.140002db0
mov rcx, rax
call fcn.140001b30
mov eax, dword [r13 + 0x28]
add rax, r15
call rax
lea rdx, str.Done_
lea rcx, [0x14003e420]
call fcn.140001230
mov rcx, rax
call fcn.140001b30
mov rbp, qword [rsp + 0xb0]
mov al, 1
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400090b0
add rsp, 0x78
pop r15
pop rdi
pop rsi
pop rbx
ret