Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
jb 0x1400a07f1
jno 0x1400a07dc
adc dword [rdx + 0x2da9a8ac], ebp
cmp esp, dword [rdx - 0x5c50d724]
fild qword [rax + 0x64]
push rax
sbb edi, dword [rdi - 0x4d]
sbb eax, 0xafac06b9
xchg edi, eax
and ebp, dword [rbp + 0x34831eab]
invalid
cmpsd dword [rsi], dword [rdi]
sub edi, dword [rax - 0x16719fb4]
mov eax, 0xe98e604c
invalid
jle case.0x140002106.0
push rax
pushfq
bsr ecx, edx
jge 0x1400a081d
jrcxz 0x1400a07da
mov dword [rax], ebp
nop
mov eax, 0x747bdbf0
invalid
invalid
mov dl, byte [rdi + 0x6e]
push rdi
outsb dx, byte [rsi]
ja 0x1400a07d8
movabs eax, dword [0x7eadfeb8bd2a634d]
loopne 0x1400a0809
jnp 0x1400a07b2
jle 0x1400a0849
xchg dword [rcx], edi
int1
mov esp, 0xd2bf6e35
fnstsw word [rbx]
push rbx
mov eax, 0x8fff675b
jp 0x1400a08ac
jl 0x1400a0817
out 0x8b, al
sbb eax, 0xa80e763b
mov ebx, dword [0xe8187e72]
invalid
imul esi, esp, 0xffffff83
ret
jge 0x1400a080a
invalid
fldcw word [rax + rbp]
invalid
sar byte [rbp - 0x62], 1
jp 0x1400a08c0
std
out 0xca, al
xor bl, bh
invalid
invalid
or edx, esp
out 0xc8, al
jg 0x1400a0855
jbe 0x1400a082f
sub eax, 0xa67229af
sub dword [rdx - 0x5a], esi
lodsb al, byte [rsi]
or esp, dword [rcx - 0x5d989b9e]
or ah, dh
js 0x1400a08a7
int1
mov ebx, 0xc5678dff
sub dword [rsp + rbp*8 - 0x5bb263e9], ecx
sahf
sbb esp, dword [rdx + rdx - 0x49]
invalid
mov bh, 0xf0
adc dh, byte [rdi - 0x7c738410]
rcr dword [rbp + 0x7a73fc0c], 1
popfq
or al, 0xfc
jae 0x1400a0926
cmp r11b, byte [rsi]
adc dword [rcx], 0x47
sub byte [0x16f1a99be], 0xa1
add eax, 0xa12f1091
add eax, 0xa12f1091
cmp byte [rsi + 0x6f7fe6e1], ch
fcomp dword [rdi]
or edi, esp
sbb al, 0x75
jne 0x1400a0882
mul dword [rax]
cmpsb byte [rsi], byte [rdi]
mov ebp, dword [rdi + rbp*2 - 0x23]
invalid
invalid
fcmovnb st(0), st(2)
cmp dword [0x14680ed2d], esp
ja 0x1400a08f2
invalid
invalid
jne 0x1400a0882
mul dword [rax]
cmpsb byte [rsi], byte [rdi]
mov ebp, dword [rdi + rbp*2 - 0x23]
invalid
sbb dword [rax - 0x2f], ebx
test al, 0x17
adc byte [rsi - 8], ah
pop rax
shr dword [rax - 0x799efe9], 1
pushfq
js 0x1400a0938
cli
invalid
invalid
sbb al, byte [rcx - 0x78]
invalid
pop rbx
xor dword [rdx], ebp
jbe 0x1400a0890
xchg ebp, eax
mov dl, byte [rdi - 0xc70c7ba]
std
invalid
push rbp
xchg ebp, eax
jmp 0x1400a092d
push rbp
jmp 0xe12c9df4
jno case.0x140002106.19
insb byte [rdi], dx
leave
leave
leave
pop rbp
push rsi
xlatb
invalid
xchg edi, eax
lodsd eax, dword [rsi]
sbb al, 0x7e
jno 0x1400a097e
mov ch, al
xor al, 0x7d
jle 0x1400a09a9
nop
push rdx
fldenv [rax]
test dword [rax + rdx], ecx
insb byte [rdi], dx
xchg edi, eax
pop rcx
rcl dword [rdx + 0x3f4e8cff], cl
invalid
invalid
sti
jge 0x1400a09d3
invalid
invalid
xchg ebx, eax
pop rax
or byte [r9 + 0x1f9fb34d], r8b
xor dh, al
wait
jb 0x1400a09cd
mov edx, 0xfd5ebe84
and eax, esp
mov esp, 0x24d9dfe0
ja 0x1400a0915
xor al, 0x60
stosd dword [rdi], eax
invalid
invalid
invalid
invalid
add al, 0x6f
invalid
cmpsd dword fs:[rsi], dword [rdi]
fdivr qword [rdx]
sbb cl, al
xchg esp, eax
invalid
jl 0x1400a0962
call 0x114e6be5e
pop rbx
std
mov dword [rdx], 0x16f47fa0
pop rsi
mov dh, byte [rsp + rbx*8 - 0x3802a42c]
add ah, byte [rax + 0x4616f47f]
pop rsi
invalid
ret
jp 0x1400a0a51
adc al, byte [rcx + 0x71]
invalid
clc
invalid
add word [rsi], dx
pop rbp
sahf
out dx, al
movabs dword [0x333ced3538dcbda1], eax
xor esi, dword [rsi + 0x3c]
xor eax, 0x76333ced
cmp al, 0x5e
xor esi, dword [rsi + 0x3c]
pop rsi
mov esp, 0x1530c23
fnstenv [rsi + rdi + 0x7e4d5f02]
jle 0x1400a0a97
cwde
xor al, 0x5f
sub ebx, dword [rdx]
mov bl, 0xb2
xchg edi, eax
mov eax, dword [rdi - 0x69]
cdq
jne 0x1400a0a7e
sub al, 0x3f
invalid
invalid
invalid
push r15
mov edx, 0x9e9b77cb
retf
ja 0x1400a0a0c
sahf
mov esp, dword [rax + 0x3e]
leave
or dword [rsi + 0x73171f1c], ebx
pop rsi
mul ah
repne lodsb al, byte [rsi]
retf
in al, 0xf2
lodsb al, byte [rsi]
fsub qword [rcx + 0x36]
invalid
invalid
mov esp, dword [rbx - 0x56]
frstor dword [rsi + 0x5d76ad97]
jg 0x1400a0ad1
je 0x1400a0a29
invalid
fdivr dword [rcx]
jle 0x1400a0a86
pop rsp
xlatb
invalid
invalid
jp 0x1400a0b0c
mov ch, 0xf0
jnp 0x1400a0ab4
jge case.0x140002106.34
invalid
invalid
jbe 0x1400a0b3f
iretd
invalid
push r12
mov eax, 0xe56bbd0c
imul esp, ebp, 0x42
adc al, 0x30
imul esp, ebp, 0x42
adc al, 0x30
jbe 0x1400a0b59
invalid
shl dword [rdi + 0x6f0a029d], 0xc2
sub al, 0xdc
xchg esp, eax
mov cs, word [rsi + 0x4c]
cmpsb byte [rsi], byte [rdi]
loopne 0x1400a0b7d
outsd dx, dword [rsi]
ret 0xdc2c
movabs eax, dword [0xefae8e78fb908c6d]
sti
js 0x1400a0af9
scasb al, byte [rdi]
out dx, eax
out 0x8c, eax
sub byte [rax - 0x1ff8d14f], dh
mov bl, 0x19
mov ch, 0xc6
xchg esp, eax
iretd
mov cl, 0x2e
invalid
stosd dword [rdi], eax
mov ch, byte [rbp + 0x169cb018]
clc
adc al, 0x75
and esi, dword [0x1be3f774b]
pop rsp
invalid
mov edi, 0xe74fd3ee
fisttp dword [rbx + rax*8]
test eax, 0x7cd24b4f
invalid
js 0x1400a0b6c
add r14, 0x358beffb
mov al, 0x9b
xchg ecx, eax
retf
sti
out dx, eax
mov esi, dword [0x10b9ba760]
mov byte [rbx], dh
leave
invalid
scasd eax, dword [rdi]
movabs dword [0x597c603b52a01f43], eax
movabs dword fs:[0x3176a97b306abb70], eax
movabs al, byte [0x70a364597c603b52]
mov ebx, 0xa97b306a
jbe 0x1400a0c01
rcl byte [rdi - 0x76], cl
lodsd eax, dword [rsi]
jae 0x1400a0b71
mov ch, byte [rbp + 0x60f09b73]
mov rsi, rbx
call qword [rbx - 0x1e1cffd6]
rcl eax, 0x56
push rsi
invalid
push rsi
out dx, al
push rsp
cdq
js 0x1400a0bc0
mov ah, 0x22
std
or ebp, edi
mov esi, 0xfe9e8316
invalid
invalid
push rax
cmp eax, 0xbbbe8f2e
xchg ebp, eax
mov edx, 0x676d1f29
jo 0x1400a0ba2
xchg ebx, eax
jo 0x1400a0ba2
xchg ebx, eax
sub dword [rdi + 0x1ef08976], eax
inc dword [rcx]
add byte [rbx - 0x4417544], cl
hlt
xor eax, 0x6252751b
enter 0xffffffffffffbe6e, 0xfffffffffffffff1
test al, 0xd8
stc
js 0x1400a0ca7
int1
xchg ecx, eax
sahf
mov al, 0x4a
or al, 0x1f
dec dword [rax]
invalid
cmpsd dword [rsi], dword [rdi]
jg 0x1400a0c0c
wait
test byte [rdi - 0x3c7bb751], bh
invalid
ret
int3
or byte [0x1bb3e3d03], dl
pop rcx
push rdx
scasb al, byte [rdi]
xor rax, 0xffffffffff8bbf16
or al, 0x72
mov edi, 0x55e3614f
invalid
invalid
jrcxz 0x1400a0cc5
invalid
invalid
stc
jmp [rax - 0x662b2f57]
cwde
retf
popfq
movsb byte [rdi], byte [rsi]
shl dword [rcx + 0x391febf], cl
sbb eax, 0x82687dc
jp 0x1400a0c43
pop rdi
cli
dec byte [rdi + rcx*2 - 0x63]
popfq
out dx, eax
invalid
fmul dword [rcx + 0x35c30ad9]
jns 0x1400a0d07
and rax, 0xfffffffffe95ffea
mov edx, dword [rdi - 0x47]
mov ecx, 0xf0fcbea7
jp case.0x14002b41b.1
xchg ecx, eax
cdq
stosb byte [rdi], al
leave
and ch, ch
popfq
sub bh, byte [rcx - 7]
cld
insb byte [rdi], dx
in al, 0x94
stc
mov r14d, dword [r15 - 0x22d175d4]
sub al, 0x8a
frstor dword cs:[rdi + rcx]
sub al, 0x8a
frstor dword cs:[rdi + rcx]
not byte [rcx - 0xb]
mov cl, byte [rcx]
push 0xffffffffffffffd6
invalid
invalid
mov al, byte [rdx]
js 0x1400a0d30
add eax, 0x55eb900d
adc r15b, byte [r14 + rax*2 - 0x39b09375]
mov eax, 0x570ab795
mov eax, 0x570ab795
mov eax, 0x570ab795
push rdi
add esi, edi
xchg edi, eax
jle 0x1400a0d1e
scasb al, byte [rdi]
cmp eax, 0xb6fb0d24
sti
mov dh, 0x44
mov ebx, 0x49c87972
sti
mov dh, 0x44
mov ebx, 0x49c87972
and byte [r8 - 0x75e6f2df], 0x4f
and byte [rax - 0x75e6f2df], 0x4f
mov dh, 0x6f
outsd dx, dword [rsi]
cli
sti
jg 0x1400a0d31
sub dword [rsi - 0x404fd991], 0x1d118b8c
and dword [rdi], edi
ror byte [rcx - 0x17], cl
invalid
add ch, dh
cmc
in eax, dx
loop 0x1400a0d53
retf 0xeff7
ret
sbb ebx, dword [rdx - 0x1e]
add byte [rax], cl
mov dl, byte [rsi - 0xa]
in eax, dx
push 0x5b
sub ecx, eax
xor dword [rsi + rsi*4 - 0x69], esi
cmpsb byte [rsi], byte [rdi]
xor rax, rsi
jnp 0x1400a0d39
or bh, bh
and byte [rdx - 0x12], ah
out dx, al
out dx, al
add cl, dh
mov edi, 0x26fa6aa
invalid
loop 0x1400a0dfa
invalid
stosb byte [rdi], al
add byte [rsi + rdx + 0x1c01a2a8], al
pop rbp
mov edx, 0x7f4d8b4d
mov r9, qword [r13 + 0x7f]
mov ecx, esi
lahf
cdq
rol dword [rdx - 0x2c], cl
invalid
mov byte [rsi], dh
out dx, al
call 0x17f7c8a06
cmp dword [rsi], edx
ficomp word [rcx]
je 0x1400a0e1f
invalid
lodsd eax, dword [rsi]
ret 0x6861
and al, 0xa1
lahf
invalid
movabs eax, dword [0x743d2031a97ea9f]
invalid
leave
out 0x27, al
mov bh, 0x67
invalid
xchg ecx, eax
ror dword [rcx + 0x90a66af], 0xa6
mov dh, 0x18
xor rax, 0xffffffffcf19be6a
jo 0x1400a0e4f
xchg esi, eax
shr edi, cl
test al, 0xeb
pop rsi
out dx, al
jge 0x1400a0ec6
jmp 0x1400a0eaf
mov esi, 0x269b78de
invalid
mov ecx, 0xe3fe5ff7
test eax, 0x40b77eaf
xchg esp, eax
mov ecx, 0x34b00bc6
xor al, 0x70
cmp eax, 0xf293cb23
cli
rcr byte [rbp - 2], cl
fadd dword [rbx - 0x76]
mov sil, byte [r14 + 0x53b5bb8a]
xchg esi, eax
jge 0x1400a0ef9
invalid
mov sil, byte [r14 + 0x53b5bb8a]
xchg esi, eax
jge 0x1400a0ef9
add al, 0xb9
invalid
mov ecx, 0xfffe39ff
call [rsi - 0x741523f1]
cmpsd dword [rsi], dword [rdi]
push rdx
xchg edi, eax
wait
add ebx, dword [rbp + rbp*8 - 0x10f26689]
lahf
in al, 0x60
invalid
sahf
paddusb mm5, mm2
mov esp, dword [rdi + 0x39b9752]
pushfq
in eax, dx
ja 0x1400a0e2f
or eax, 0x60e49fef
invalid
push rbp
invalid
sub dword [rax], ecx
sbb eax, 0x5bdde50
jno 0x1400a0ed2
mov ebp, 0xad1f7105
lodsd eax, dword [rsi]
jg case.0x140002106.82
mov bl, 0xc3
invalid
mov al, 0xf
out 0x2a, eax
invalid
cmc
invalid
test eax, 0xe4a778e
push rbx
fcmovnb st(0), st(5)
iretd
invalid
invalid
mul dword [rbp - 0x59]
jp 0x1400a0efe
mov edi, edx
jl 0x1400a0e9c
mov esi, 0xe0e91ef7
invalid
jmp 0xd3b61dea
invalid
ficomp word [rdi + 0xf]
mov esi, 0x742f7b39
pushfq
jb 0x1400a0f24
invalid
mov edi, 0x75d80a8a
je 0x1400a0f7c
jno 0x1400a0fa8
inc byte [rdi - 0x74]
invalid
pop rbp
cmp eax, 0xfaec5516
jbe 0x1400a0ef9
jge 0x1400a0f73
movabs eax, dword [0x3ffe00597f9c3c77]
mov edi, 0xb075bf3a
leave
pushfq
mov ebp, 0xc0b03bec
mov eax, 0xed0d9c9a
ret 0xa75c
cmpsd dword [rsi], dword [rdi]
pop rbp
scasq rax, qword [rdi]
fadd dword [rdi - 0x5e30a77]
in eax, dx
fidiv dword [rdi + 0x431cefce]
ja 0x1400a0f05
ja 0x1400a0f05
out dx, al
adc ch, byte [rdi - 0x1f]
pop rbx
outsd dx, dword [rsi]
loope 0x1400a0fd1
clc
push rcx
loop 0x1400a0f3e
retf
lodsb al, byte [rsi]
invalid
jnp 0x1400a0f10
sbb dh, byte [rsi]
add esp, edx
push rsp
test al, 0x9a
xor ebp, dword [rbp - 0x32b07fa3]
or byte [rdi - 0x33], 0xa4
or byte [rdi - 0x33], 0xa4
cmp byte [rbx - 0x78a00279], bh
ret
leave
mov ebx, 0x51d03f43
imul esp, dword [rbx + rsi*4 - 0x6d], 0xf5492fc1
mov bl, 0x93
shr dword [rdi], 0x49
cmc
push rdx
out dx, al
invalid
fadd st(3)
loope 0x1400a0fcf
movabs byte [0x3423b81b8dae5b76], al
pop rbx
invalid
invalid
invalid
mov bh, 0x56
je 0x1400a0f5e
fcomp st(7)
mov ecx, 0x4e589fb9
push rcx
xor esp, edi
xchg ecx, eax
pop rbx
fchs
xor esp, ecx
mov cs, ebx
out dx, eax
mov cl, 0xfb
outsd dx, dword [rsi]
lodsb al, byte [rsi]
invalid
cld
invalid
cmpsd dword [rsi], dword [rdi]
push rdx
or esi, ebp
add dword [rcx - 0x25], ebx
pop rdx
rol dword [rbp - 0x55], cl
sub al, 7
retf
invalid
movabs dword [0x8db009bd3f9afc7f], eax
invalid
jg 0x1400a1047
fcmovu st(0), st(3)
mov ah, 0x60
clc
int3
ja 0x1400a1049
mov bl, byte [rbx]
stosb byte [rdi], al
scasd eax, dword [rdi]
xchg edi, eax
in al, 0xb6
and esp, dword ds:[rcx]
invalid
loopne case.0x140002106.104
stosb byte [rdi], al
mov ah, 0xfa
mov esp, 0x686b4345
stc
jrcxz 0x1400a10fb
invalid
adc eax, 0xa8d126f
xor eax, 0x6e54c3ab
push rsp
outsb dx, byte [rsi]
push rsp
outsb dx, byte [rsi]
pop rbp
cwde
fcmovne st(0), st(3)
shr dword [rbp - 0x24a7520e], 1
invalid
test dword [rdi - 0xa], ecx
lock sbb byte [rsi - 0x1f06802c], bh
ret 0xfb05
and al, 0x4a
jbe 0x1400a11a1
std
invalid
invalid
xchg edx, eax
invalid
shl dword [rbp - 0x68a109fb], 0x5d
cld
in al, dx
jg 0x1400a11de
stc
push 0xffffffffdea32a04
cli
cwde
movabs byte [0x52da773e487ad361], al
push rdx
mov esp, 0xc016254b
fimul word [rsi - 0x72]
adc byte [rbp - 0x54], 0x89
out dx, eax
add byte [rbx], al
cmp al, 0x71
loopne 0x1400a1133
sbb eax, 0x6f59a7c9
ret 0x3679
jae 0x1400a11d6
int 0x14
invalid
movabs al, byte [0x953e0ff90a1f2180]
fild word [rbx]
insb byte [rdi], dx
fcomp qword [rcx + 0x3e441969]
or byte ds:[rsp + rsi*2 + 0x5f], ch
or bh, cl
invalid
or byte ds:[rsp + rsi*2 + 0x5f], ch
invalid
sal byte [rsi + 0x5c3344cf], 1
jns 0x1400a1186
xor ebx, dword [rcx + rdi*2 - 0x54]
cli
je 0x1400a11dd
invalid
or byte [rcx], al
ja 0x1400a11b4
imul edx, dword [rdi + 0x17], 0xffffff86
jmp 0x184ff997b
xor dh, al
invalid
invalid
invalid
mov ch, 0xaa
add al, 0x83
adc bh, ah
movabs al, byte [0x640a3c47656097f0]
or ah, byte [rdi + rsi*8 - 0x58]
and byte [rax + 0x4ebc97ee], bl
xchg esp, eax
pop rcx
stosb byte [rdi], al
or ah, byte [rdi + rsi*8 - 0x58]
and byte [rax + 0x4ebc97ee], bl
xchg esp, eax
pop rcx
stosb byte [rdi], al
sub dword [rbp + 0x3b19e633], edx
sbb dword [rbx], edi
sub al, byte [rsi + riz + 0x39]
xchg ebp, eax
movabs eax, dword [0x3024ded90e259ea3]
cmp byte [rbx + rdi + 0x47], bl
invalid
invalid
invalid
test ebx, edx
stosd dword [rdi], eax
xlatb
sub al, 0xf3
add al, 0xb9
je 0x1400a1217
push 0xffffffffffffffcf
jg 0x1400a12db
sub ecx, dword [rdx]
out dx, eax
scasb al, byte [rdi]
invalid
adc al, 0x2c
fidiv word [rdi - 0x32]
invalid
add eax, 0x789b1620
cwde
invalid