Function at 0x140001390
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x78
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, qword [rcx + 8]
xor ecx, ecx
mov rsi, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov eax, 0x5a4d
lea rcx, [0x14003f470]
cmp word [rsi], ax
je 0x1400013e5
lea rdx, str.Invalid_DOS_Signature
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
xor al, al
jmp 0x140001954
mov qword [rsp + 0x70], r12
lea rdx, str.Good_signature__
mov qword [rsp + 0x68], r13
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
movsxd r13, dword [rsi + 0x3c]
mov rdx, rsi
add r13, rsi
mov rcx, r15
mov qword [rsp + 0x28], r13
movzx r8d, word [r13 + 0x14]
lea rdi, [r13 + 0x18]
movzx ebx, word [r13 + 6]
add rdi, r8
call fcn.14002a710
lea rdx, str.Sections:
lea rcx, [0x14003f470]
call fcn.140001b90
movzx edx, bx
mov rcx, rax
call fcn.140003aa0
mov rcx, rax
call fcn.140002bc0
test rbx, rbx
je 0x1400014cf
nop word [rax + rax]
movups xmm1, xmmword [rdi + 0x10]
mov rcx, qword [rdi + 8]
movups xmm2, xmmword [rdi]
shr rcx, 0x20
movsd xmm0, qword [rdi + 0x20]
movq rdx, xmm1
shr rdx, 0x20
add rcx, r15
movd r8d, xmm1
add rdx, rsi
movups xmmword [rsp + 0x30], xmm2
movups xmmword [rsp + 0x40], xmm1
movsd qword [rsp + 0x50], xmm0
call fcn.14002a710
lea rdx, str.Mapped:
lea rcx, [0x14003f470]
call fcn.140001b90
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
lea rdi, [rdi + 0x28]
sub rbx, 1
jne 0x140001460
mov qword [rsp + 0xb0], rbp
lea rdx, str.Importing...
lea rcx, [0x14003f470]
mov qword [rsp + 0x60], r14
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
mov rbx, qword [r13 + 0x90]
lea rdx, str.Dir:
lea rcx, [0x14003f470]
mov qword [rsp + 0x20], rbx
call fcn.140001b90
mov rdx, r15
mov rcx, rax
call fcn.1400040f0
mov rcx, rax
lea rdx, [0x14002d484]
call fcn.140001b90
mov edx, ebx
mov rcx, rax
call fcn.140003cc0
mov rcx, rax
lea rdx, [0x14002d480]
call fcn.140001b90
mov edx, dword [rsp + 0x24]
mov rcx, rax
call fcn.140003cc0
mov rcx, rax
call fcn.140002bc0
mov r12d, ebx
lea rcx, [0x14003f470]
add r12, r15
mov rdx, r12
call fcn.140003ee0
mov rcx, rax
lea rdx, [0x14002d490]
call fcn.140001b90
mov edx, dword [r12]
mov rcx, rax
call fcn.140003cc0
mov rcx, rax
call fcn.140002bc0
cmp dword [r12], 0
je 0x14000171c
mov r13d, dword [r12 + 0xc]
add r13, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.Imported:
mov rbp, rax
lea rcx, [0x14003f470]
call fcn.140001b90
mov rcx, rax
mov rdx, r13
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
test rbp, rbp
jne 0x140001605
lea rdx, str.Error:_failed_to_load_DLL_from_import_table:
lea rcx, [0x14003f5a0]
call fcn.140001b90
mov rcx, rax
mov rdx, r13
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
mov esi, dword [r12]
mov r14d, dword [r12 + 0x10]
add rsi, r15
add r14, r15
mov rax, qword [rsi]
test rax, rax
je 0x140001708
mov rcx, rbp
test al, 1
je 0x14000168f
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400016f1
lea rdx, str.Error:_failed_ordinal_lookup_for
lea rcx, [0x14003f5a0]
call fcn.140001b90
mov rcx, rax
mov rdx, r13
call fcn.140001b90
mov rcx, rax
lea rdx, [0x14002d4d8]
call fcn.140001b90
mov edx, ebx
mov rcx, rax
call fcn.1400040f0
lea rdx, [fcn.140002bc0]
mov rcx, rax
call fcn.140003ed0
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rbx, [rax + r15]
lea rax, [rbx + 2]
mov rdx, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Import:
mov rdi, rax
lea rcx, [0x14003f470]
call fcn.140001b90
mov rdx, rbx
mov rcx, rax
call fcn.140003ee0
mov rcx, rax
lea rdx, [0x14002d504]
call fcn.140001b90
mov rdx, rdi
mov rcx, rax
call fcn.140003ee0
mov rcx, rax
call fcn.140002bc0
test rdi, rdi
je 0x140001777
add rsi, 8
mov qword [r14], rdi
add r14, 8
mov rax, qword [rsi]
test rax, rax
jne 0x140001620
add r12, 0x14
cmp dword [r12], 0
jne 0x1400015a0
mov r13, qword [rsp + 0x28]
lea rdx, str.Relocating...
lea rcx, [0x14003f470]
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
test byte [r13 + 0x5e], 0x40
mov eax, dword [r13 + 0xb0]
jne 0x1400017cc
lea rdx, str.Error:_image_cannot_be_relocated.
lea rcx, [0x14003f5a0]
call fcn.140001b90
lea rdx, [fcn.140002bc0]
mov rcx, rax
call fcn.140003ed0
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Error:_failed_named_lookup:
lea rcx, [0x14003f5a0]
call fcn.140001b90
mov rcx, rax
mov rdx, r13
call fcn.140001b90
mov rcx, rax
lea rdx, [0x14002d514]
call fcn.140001b90
mov rdx, qword [rsp + 0x20]
mov rcx, rax
call fcn.140001b90
lea rdx, [fcn.140002bc0]
mov rcx, rax
call fcn.140003ed0
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x1400017fe
lea rdx, str.Error:_image_can_be_relocated__but_contains_no_relocation_directory.
lea rcx, [0x14003f5a0]
call fcn.140001b90
lea rdx, [fcn.140002bc0]
mov rcx, rax
call fcn.140003ed0
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r14, r15
lea rdi, [r15 + rax]
sub r14, qword [r13 + 0x30]
cmp dword [rdi], 0
je 0x1400018de
mov r12d, 0xf000
mov r13d, 0xa000
nop
mov ebp, dword [rdi + 4]
lea rdx, str.Relocs:
sub rbp, 8
lea rcx, [0x14003f470]
shr rbp, 1
call fcn.140001b90
mov rdx, rbp
mov rcx, rax
call fcn.1400040f0
mov rcx, rax
call fcn.140002bc0
xor esi, esi
test rbp, rbp
je 0x1400018ca
nop word [rax + rax]
movzx ecx, word [rdi + rsi*2 + 8]
mov ebx, dword [rdi]
mov rax, rcx
and eax, 0xfff
and cx, r12w
add rax, r15
add rbx, rax
cmp cx, r13w
jne 0x140001882
add qword [rbx], r14
lea rdx, str.Reloc:
lea rcx, [0x14003f470]
call fcn.140001b90
mov rdx, rbx
mov rcx, rax
call fcn.140003ee0
mov rcx, rax
lea rdx, [0x14002d5c4]
call fcn.140001b90
mov rdx, r14
mov rcx, rax
call fcn.1400040f0
mov rcx, rax
call fcn.140002bc0
inc rsi
cmp rsi, rbp
jb 0x140001860
mov eax, dword [rdi + 4]
add rdi, rax
cmp dword [rdi], 0
jne 0x140001820
mov r13, qword [rsp + 0x28]
lea rdx, str.Executing...
lea rcx, [0x14003f470]
call fcn.140001b90
mov rcx, rax
lea rdx, [0x14002d5d0]
call fcn.140001b90
mov edx, dword [r13 + 0x28]
mov rcx, rax
add rdx, r15
call fcn.140003ee0
mov rcx, rax
call fcn.140002bc0
mov eax, dword [r13 + 0x28]
add rax, r15
call rax
lea rdx, str.Done_
lea rcx, [0x14003f470]
call fcn.140001b90
mov rcx, rax
call fcn.140002bc0
mov rbp, qword [rsp + 0xb0]
mov al, 1
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400093c0
add rsp, 0x78
pop r15
pop rdi
pop rsi
pop rbx
ret