Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005940]
mov dword [rax], 1
mov rax, qword [0x140005950]
mov dword [rax], 1
mov rax, qword [0x140005960]
mov dword [rax], 1
mov rax, qword [0x140005900]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a90
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp word [rcx], 0x5a4d
mov rsi, rcx
mov rbp, rdx
jne 0x140001b4f
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001b4f
mov edi, dword [rax + 0x88]
add rdi, rcx
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x140001b40
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
xor ebx, ebx
jmp 0x140001ae9
add rbx, 1
cmp ebx, dword [rdi + 0x18]
jae 0x140001b40
mov eax, dword [rdi + 0x20]
lea rdx, [rsi + rbx*4]
mov ecx, dword [rdx + rax]
mov rdx, rbp
add rcx, rsi
call r12
test eax, eax
jne 0x140001ae0
mov eax, dword [rdi + 0x24]
lea rdx, [rsi + rbx*2]
lea rcx, str._GetExportAddress____s__address:__p_n
movzx edx, word [rdx + rax]
mov eax, dword [rdi + 0x1c]
lea rdx, [rsi + rdx*4]
mov eax, dword [rdx + rax]
mov rdx, rbp
add rsi, rax
mov r8, rsi
call sym.printf
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rbp
lea rcx, str._GetExportAddress____s__failed_to_find_address_n
call sym.printf
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400021b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop