как сделать правильн rip относительный код? на FASM format PE64 console
use64
entry start

section '.text' code readable executable

start:
    sub rsp, 28h

    ; 1. Находим kernel32.dll
    call find_kernel32
    test rax, rax
    jz .fail
    mov rdx, rax ; Сохраняем базу kernel32

    ; 2. Находим ExitProcess
    mov ecx, 0x73E2D87E ; HASH_ExitProcess
    call find_function_by_hash
    test rax, rax
    jz .fail

    ; 3. Выходим с кодом 42
    mov rcx, 42
    call rax

.fail:
    int3
    jmp $

; --- ВСЕ ФУНКЦИИ ПРЯМО ЗДЕСЬ ---

find_kernel32:
    mov rax, [gs:60h]
    mov rax, [rax+18h]
    lea rsi, [rax+10h]
    mov rbx, [rsi]
.walk:
    cmp rbx, rsi
    je .not_found
    mov rcx, [rbx+60h]
    test rcx, rcx
    jz .next
    
    ; Простое, но рабочее сравнение
    cmp word [rcx], 'K'
    jne .next
    cmp word [rcx+2], 'E'
    jne .next
    cmp word [rcx+4], 'R'
    jne .next
    cmp word [rcx+6], 'N'
    jne .next
    cmp word [rcx+8], 'E'
    jne .next
    cmp word [rcx+10], 'L'
    jne .next
    cmp word [rcx+12], '3'
    jne .next
    cmp word [rcx+14], '2'
    jne .next
    
    ; Нашли!
    mov rax, [rbx+30h]
    ret
.next:
    mov rbx, [rbx]
    jmp .walk
.not_found:
    xor rax, rax
    ret

find_function_by_hash:
    push rbp; mov rbp, rsp; sub rsp, 28h; push rbx; push rsi; push rdi
    push r12; push r13; push r14; push r15; mov r12d, ecx; mov rbx, rdx
    mov eax, [rbx+3Ch]; add rax, rbx; mov eax, [rax+88h]; add rax, rbx
    mov rsi, rax; mov eax, [rsi+1Ch]; add rax, rbx; mov r14, rax
    mov eax, [rsi+20h]; add rax, rbx; mov r13, rax; mov eax, [rsi+24h]
    add rax, rbx; mov r15, rax; mov ecx, [rsi+18h]; xor r8, r8
.search_fn_loop:
    cmp r8, rcx; jae .fn_not_found; mov eax, [r13 + r8*4]; add rax, rbx
    mov rdi, rax; xor eax, eax
.hash_loop:
    xor edx, edx; mov dl, byte [rdi]; test dl, dl; jz .hash_done
    ror eax, 13; add eax, edx; inc rdi; jmp .hash_loop
.hash_done:
    cmp eax, r12d; jne .next_fn; movzx eax, word [r15 + r8*2]
    mov eax, [r14 + rax*4]; add rax, rbx; jmp .exit_find_fn
.next_fn:
    inc r8; jmp .search_fn_loop
.fn_not_found:
    xor rax, rax
.exit_find_fn:
    pop r15; pop r14; pop r13; pop r12; pop rdi; pop rsi; pop rbx
    add rsp, 28h; pop rbp; ret; ============================================
; HELPERS.ASM - Библиотека надежных функций
; ============================================

; --- Хэш для ExitProcess ---
HASH_ExitProcess equ 0x73E2D87E

; --- Универсальный поиск DLL ---
find_module_by_name:
    push rbp; mov rbp, rsp; push rsi; push rdi; push rbx; push r12
    mov r12, rcx
    mov rax, [gs:60h]; mov rax, [rax+18h]
    test rax, rax; jz .find_fail
    lea rsi, [rax+10h]; mov rbx, [rsi]
.search_dll_loop:
    cmp rbx, rsi; je .find_fail
    mov rdi, rbx; mov rcx, [rdi+60h]
    test rcx, rcx; jz .next_module
    mov rdx, r12; call compare_names_ci
    test rax, rax; jnz .found_it
.next_module:
    mov rbx, [rbx]; jmp .search_dll_loop
.found_it:
    mov rax, [rdi+30h]; jmp .find_exit
.find_fail:
    xor rax, rax
.find_exit:
    pop r12; pop rbx; pop rdi; pop rsi; mov rsp, rbp; pop rbp; ret

; --- Сравнение имен без учета регистра ---
compare_names_ci:
    push rsi; push rdi
.compare_loop:
    mov ax, [rcx]         ; Простое перемещение, т.к. размеры совпадают (16 бит)
    movzx dx, byte [rdx]  ; Расширяем 8 бит в 16
    cmp al, 'A'; jb .no_lower_ax; cmp al, 'Z'; ja .no_lower_ax; add al, 32
.no_lower_ax:
    cmp dl, 'A'; jb .no_lower_dx; cmp dl, 'Z'; ja .no_lower_dx; add dl, 32
.no_lower_dx:
    cmp al, dl; jne .not_equal
    test dl, dl; jz .equal
    add rcx, 2; inc rdx; jmp .compare_loop
.equal: mov rax, 1; jmp .compare_exit
.not_equal: xor rax, rax
.compare_exit: pop rdi; pop rsi; ret

; --- Поиск функции по хэшу ---
find_function_by_hash:
    push rbp; mov rbp, rsp; sub rsp, 28h; push rbx; push rsi; push rdi
    push r12; push r13; push r14; push r15; mov r12d, ecx; mov rbx, rdx
    mov eax, [rbx+3Ch]; add rax, rbx; mov eax, [rax+88h]; add rax, rbx
    mov rsi, rax; mov eax, [rsi+1Ch]; add rax, rbx; mov r14, rax
    mov eax, [rsi+20h]; add rax, rbx; mov r13, rax; mov eax, [rsi+24h]
    add rax, rbx; mov r15, rax; mov ecx, [rsi+18h]; xor r8, r8
.search_fn_loop:
    cmp r8, rcx; jae .fn_not_found; mov eax, [r13 + r8*4]; add rax, rbx
    mov rdi, rax; xor eax, eax
.hash_loop:
    xor edx, edx; mov dl, byte [rdi]; test dl, dl; jz .hash_done
    ror eax, 13; add eax, edx; inc rdi; jmp .hash_loop
.hash_done:
    cmp eax, r12d; jne .next_fn; movzx eax, word [r15 + r8*2]
    mov eax, [r14 + rax*4]; add rax, rbx; jmp .exit_find_fn
.next_fn:
    inc r8; jmp .search_fn_loop
.fn_not_found:
    xor rax, rax
.exit_find_fn:
    pop r15; pop r14; pop r13; pop r12; pop rdi; pop rsi; pop rbx
    add rsp, 28h; pop rbp; retS C:\Users\dange\Desktop\Twin\__pycache__> fasm test_mini.asm test_mini.exe
flat assembler  version 1.73.32  (1048576 kilobytes memory)
2 passes, 1024 bytes.
PS C:\Users\dange\Desktop\Twin\__pycache__> ./test_mini.exe
PS C:\Users\dange\Desktop\Twin\__pycache__> echo $LASTEXITCODE
-1073741819
PS C:\Users\dange\Desktop\Twin\__pycache__>