Function at 0x140002070
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, rdx
mov r8, rcx
mov qword [rbp - 0x40], rcx
test rcx, rcx
jne 0x14000213f
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
lea ecx, [r8 + 0x20]
call fcn.140008bbc
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x10
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [str.hModule_is_null.]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], r13b
lea edx, [r13 + 8]
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x140002204
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
lea ecx, [r13 + 0x20]
call fcn.140008bbc
mov rdx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x1d
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [str.Invalid_DOS_header_signature.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14000b960]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14000b968]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14000b96c]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], r13b
lea edx, [r13 + 8]
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rax, dword [rcx + 0x3c]
add rax, r8
cmp dword [rax], 0x4550
je 0x1400022c1
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
lea ecx, [r13 + 0x20]
call fcn.140008bbc
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x1c
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [str.Invalid_NT_header_signature.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14000b980]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14000b988]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], r13b
lea edx, [r13 + 8]
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [rax + 0xb0]
test ecx, ecx
je 0x14000275a
cmp dword [rax + 0xb4], 0
je 0x14000275a
mov rdx, r8
sub rdx, qword [rax + 0x30]
mov qword [rbp - 0x48], rdx
jne 0x1400023ad
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
lea ecx, [r13 + 0x50]
call fcn.140008bbc
mov rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x41
mov qword [rbp - 0x20], 0x4f
movaps xmm0, xmmword [str.No_relocation_needed__module_is_loaded_at_preferred_base_address.]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14000ba30]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14000ba40]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14000ba50]
movups xmmword [rax + 0x30], xmm1
movzx eax, byte [0x14000ba60]
mov byte [rcx + 0x40], al
mov byte [rcx + 0x41], r13b
xor edx, edx
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400023a6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008bac
mov al, 1
jmp 0x140002801
lea r14, [r8 + rcx]
xor r13d, r13d
cmp dword [r14], r13d
je 0x1400024ac
mov r9d, 0xf000
mov r10d, 0x3000
nop dword [rax]
mov r15d, dword [r14 + 4]
sub r15, 8
shr r15, 1
lea rsi, [r14 + 8]
mov edi, r13d
test r15d, r15d
je 0x14000249c
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx eax, cx
and ax, r9w
cmp ax, r10w
jne 0x14000248d
and ecx, 0xfff
mov ebx, dword [r14]
lea rax, [r8 + rcx]
add rbx, rax
je 0x1400026a2
mov rax, qword [rbx]
mov qword [rbp - 0x50], rax
test r12, r12
je 0x14000248a
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x50]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400025f9
mov rax, qword [rbp - 0x48]
add qword [rbp - 0x50], rax
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x50]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002550
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x40]
mov r9d, 0xf000
mov r10d, 0x3000
jmp 0x14000248d
add qword [rbx], rdx
inc edi
add rsi, 2
cmp edi, r15d
jb 0x1400023f0
mov eax, dword [r14 + 4]
add r14, rax
cmp dword [r14], r13d
jne 0x1400023d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov ecx, 0x20
call fcn.140008bbc
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x16
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [str.Relocation_successful.]
movups xmmword [rax], xmm0
mov ecx, dword [0x14000bae8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14000baec]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], r13b
xor edx, edx
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400023a6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov ecx, 0x30
call fcn.140008bbc
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x22
mov qword [rbp - 0x20], 0x2f
movups xmm0, xmmword [str.Failed_to_write_relocated_address.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14000bac0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x14000bad0]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r13b
mov edx, 8
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov ecx, 0x30
call fcn.140008bbc
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x22
mov qword [rbp - 0x20], 0x2f
movups xmm0, xmmword [str.Failed_to_read_relocation_address.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14000ba98]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x14000baa8]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r13b
mov edx, 8
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov ecx, 0x20
call fcn.140008bbc
mov rdx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x1b
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [str.Relocation_pointer_is_null.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14000ba78]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x14000ba80]
mov word [rax + 0x18], cx
movzx eax, byte [0x14000ba82]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], r13b
mov edx, 8
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
lea ecx, [r13 + 0x20]
call fcn.140008bbc
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x1a
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [str.No_relocation_table_found.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14000ba10]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x14000ba18]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], r13b
lea edx, [r13 + 8]
lea rcx, [rbp - 0x38]
call fcn.140001100
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008bac
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140008b60
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret