Function at 0x40d9b0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb18
mov rax, qword [r8 + 0x118]
mov rcx, qword [rax + 0x10]
lea r12, [r8 + 0x248]
mov rbx, r8
lea r8, [rsp + 0x480]
mov dword [rsp + 0x480], 0x690
call sym.SymGetModuleInfo64
mov r8d, 0xf
lea rdx, str._library_name_
mov rcx, r12
call sym.reply_buffer_append
movabs rax, 0x732e5d6f7364765b
cmp qword [rsp + 0x5c4], rax
je 0x40dc29
cmp byte [rsp + 0x5c4], 0x2f
je 0x40dc65
lea rbp, [rsp + 0x80]
lea r14, [rsp + 0x5c4]
lea r13, [rsp + 0x50]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8d, 1
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
mov rcx, qword [rsp + 0x58]
call sym.wine_get_unix_file_name
mov rdi, rax
test rax, rax
je 0x40dd26
mov rax, qword [rbx + 0x118]
lea r14, [rsp + 0x34]
mov rsi, qword [sym.imp.kernel32.dll_IsWow64Process]
mov rdx, r14
mov rcx, qword [rax + 0x10]
call rsi
test eax, eax
je 0x40daa0
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x40dcb1
mov rdx, rdi
mov rcx, r12
call sym.reply_buffer_append_xmlstr
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov r8d, 2
lea rdx, [0x0043a2bb]
mov rcx, r12
call sym.reply_buffer_append
mov rax, qword [rbx + 0x118]
mov rdx, qword [rsp + 0x488]
mov r8, r13
mov qword [rsp + 0x38], 0x400
mov r9d, 0x30
mov rcx, qword [rax + 0x10]
call qword [sym.imp.kernel32.dll_VirtualQueryEx]
mov rdx, qword [rbx + 0x118]
cmp rax, 0x2f
jbe 0x40db2b
cmp dword [rsp + 0x78], 0x1000000
je 0x40dc6f
mov ecx, pe_nt_image_headers64
xor eax, eax
mov rdi, rbp
rep stosq qword [rdi], rax
mov rdi, rbp
mov rcx, qword [rdx + 0x10]
mov rdx, r14
lea rbx, [rdi + 0x18]
lea r15, [rsp + 0x40]
call rsi
movzx eax, word [rdi + 0x14]
xor esi, esi
lea r14, [0x0043a173]
add rbx, rax
nop dword [rax]
mov rax, qword [rsp + 0x38]
add rax, rbp
cmp rbx, rax
jae 0x40dbfb
lea rdx, str._segment_address_0x
mov r8d, 0x14
mov rcx, r12
call sym.reply_buffer_append
mov edx, dword [rbx + 0xc]
mov rax, r13
add rdx, qword [rsp + 0x488]
nop dword [rax]
mov rcx, rdx
sub rax, 1
shr rdx, 4
and ecx, 0xf
movzx ecx, byte [r14 + rcx]
mov byte [rax], cl
cmp rax, r15
jne 0x40db98
mov r8d, 0x10
mov rdx, r15
mov rcx, r12
add rsi, 1
call sym.reply_buffer_append
mov r8d, 3
mov rcx, r12
add rbx, 0x28
lea rdx, [0x0043a2de]
call sym.reply_buffer_append
cmp word [rdi + 6], 0
mov eax, 1
cmovne ax, word [rdi + 6]
movzx eax, ax
cmp rax, rsi
ja 0x40db60
mov r8d, 0xa
lea rdx, str.__library_
mov rcx, r12
call sym.reply_buffer_append
mov eax, 1
add rsp, 0xb18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp word [rsp + 0x5cc], 0x6f
lea rdx, str.linux_vdso.so.1
jne 0x40da1d
mov rcx, r12
lea r13, [rsp + 0x50]
lea r14, [rsp + 0x34]
call sym.reply_buffer_append_xmlstr
lea rbp, [rsp + 0x80]
mov rsi, qword [sym.imp.kernel32.dll_IsWow64Process]
jmp 0x40dad0
lea rdx, [rsp + 0x5c4]
jmp 0x40dc3f
cmp dword [rsp + 0x70], 0x10000
je 0x40db2b
lea rax, [rsp + 0x38]
mov rcx, qword [rdx + 0x10]
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x488]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
jne 0x40dcdc
mov rdx, qword [rbx + 0x118]
jmp 0x40db2b
lea rdx, str.system32
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_strstr]
test rax, rax
je 0x40daa0
movabs rdx, 0x3436776f77737973
mov qword [rax], rdx
jmp 0x40daa0
mov rax, qword [rsp + 0x38]
mov rdx, qword [rbx + 0x118]
cmp rax, 0x3f
jbe 0x40db2b
cmp word [rsp + 0x80], 0x5a4d
jne 0x40db2b
mov edi, dword [rsp + 0xbc]
cmp rax, rdi
jbe 0x40db2b
add rdi, rbp
cmp dword [rdi], 0x4550
je 0x40db3b
jmp 0x40db2b
mov rdx, r14
mov rcx, r12
lea r14, [rsp + 0x34]
call sym.reply_buffer_append_xmlstr
mov rsi, qword [sym.imp.kernel32.dll_IsWow64Process]
jmp 0x40daab