Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs al, byte [0xd4d81b8aa2fbb474]
or cl, byte [rcx + 0x3bc7d701]
sbb bh, byte [0x1be62e8f3]
sub cl, cl
popfq
movsd dword [rdi], dword [rsi]
sbb dword [rdi + rsi + 0x58], eax
scasb al, byte [rdi]
jne 0x1400a0797
invalid
cli
push rax
jns 0x1400a0778
add bl, byte [rbp - 0x56575356]
jno 0x1400a07f5
cmp byte [rdx + rax*8], dl
invalid
pop rdi
push rax
invalid
invalid
out 0x23, eax
invalid
and esp, dword [rdx + 8]
jge 0x1400a07ea
cmp al, 0xf7
clc
jge 0x1400a07d5
xchg edi, eax
adc edi, esi
loope 0x1400a07b1
cdq
mov edi, edi
pop rbp
test dword [rbx + 0xcbf1c1f], 0x523f37b
invalid
or al, 0x7b
and eax, dword [0x1bc9d33e6]
xchg edi, eax
in eax, dx
in eax, 0xeb
jl 0x1400a089d
invalid
pshufw mm7, qword [rdi - 0x35], 0x1e
mov ebx, 0x64454997
pushfq
or eax, 0xc0df743d
je 0x1400a080f
sar bh, 0xc3
retf
je 0x1400a080f
sar bh, 0xc3
sub bl, byte [rsi + 0x6cf06415]
dec eax
jmp rcx
invalid
loope 0x1400a0824
jg 0x1400a0833
xchg ebp, eax
add byte [rbp + 0x46], bh
invalid
sub dword [rsi - 0x3b], ebx
mov edx, 0x6193a4af
call rax
jge 0x1400a07f6
jp 0x1400a08c0
std
out 0x5d, al
test dword [rax + r14*8 - 0x66805586], r9d
stosb byte [rdi], al
jg 0x1400a07fe
stosb byte [rdi], al
jg 0x1400a07fe
cmp ebx, dword [rdi]
mov dl, 0x99
cmp esp, dword [rdi - 0x7b]
invalid
loope 0x1400a08ca
add byte [rcx + 0x42], 0x48
adc ebx, dword [rcx - 0x2f1b18c]
int 0x1e
mov esi, ecx
jno 0x1400a0821
cmp eax, 0x3e1746f1
int3
imul edx, dword [rax + rbx*2 - 0x50], 0x68b67ab
mov al, 0xab
mov eax, dword [esi]
mov eax, dword [rsi]
jle 0x1400a091c
jne 0x1400a0922
jp 0x1400a0927
jle 0x1400a08f1
retf
retf
invalid
push rbx
adc cl, bl
iretd
add bh, al
hlt
int3
jl 0x1400a08a6
push rdi
movabs al, byte [0x3e2fa9ab62bc2b1e]
shr dword [rdx - 0x5a], 0xd3
cmpsb byte [rsi], byte [rdi]
shr dword [rdi + 0x7b], cl
invalid
cmpsb byte [rsi], byte [rdi]
shr dword [rdi + 0x7b], cl
sal al, 1
jnp 0x1400a0939
invalid
invalid
enter 0x10ab, 0x67
test al, 0xbe
add byte [0x116ef99ad], bh
cmp eax, 0xd6e590b7
adc al, 0xf
jg 0x1400a08f1
jbe 0x1400a0936
or ch, bl
xlatb
and dword [rsi - 0x7f84003e], edi
mov esi, 0x807bffc2
mov esi, 0x807bffc2
and al, 0xda
jle 0x1400a08a3
stosb byte [rdi], al
sbb byte [rsi], 0xff
or byte [rbx + 0x16558a53], 0xa0
mov dl, byte [rbp + 0x16]
movabs al, byte [0x734a00d8ba2bfa4]
mov dl, byte [rbp + 0x16]
movabs al, byte [0x734a00d8ba2bfa4]
invalid
int3
imul edi, dword [rdi - 0x66], 0x3d
mov bh, 0x99
cdq
cdq
xchg edi, eax
mov edi, 0xc433f0fe
xchg esp, eax
invalid
out dx, eax
ret 0x3467
xor al, 0x15
cmp esi, dword [rcx]
invalid
adc eax, 0x4dea313b
add eax, 0x3677673c
push rdi
invalid
jnp 0x1400a0991
lea ebp, [rax + 0x40331488]
iretd
loop 0x1400a09e1
invalid
invalid
fnstenv [rax + 0x1befde8]
sub al, 0xb9
xchg dword [rdx - 0x52], ebx
mov al, 0xe8
std
mov esi, 0x87b92c01
pop rdx
scasb al, byte [rdi]
mov edx, 0x11d2bc69
sub ecx, dword [rax]
invalid
invalid
or byte [rbp - 0x10], ah
jnp 0x1400a09bd
sub dword [rax - 0x698ba797], edi
pushfq
and eax, 0xe7e8ff8f
in eax, 0x85
cli
pushfq
invalid
pop rbx
jp 0x1400a095a
hlt
or byte [0x148d73edb], al
js 0x1400a09dd
movabs al, byte [0xea581cafd116f47f]
scasd eax, dword [rdi]
sbb al, 0x58
invalid
xchg edx, eax
xor al, 0x21
invalid
xor byte [rbx + rsi*8 + 0x4c8db422], 0xd5
and al, 0x9c
or bh, byte [rbx + 0x5091f658]
adc eax, 0xbf42562f
loopne 0x1400a0a70
mov esi, 0x7bdbf0f2
rol byte [rbp + 0x50416ae3], 1
hlt
invalid
invalid
pop rdi
idiv ebx
in eax, dx
retf 0xdc42
invalid
and al, byte [rax + rdi*8 - 0x2d]
adc byte [rbx], bl
xor byte [rbx], 0xf7
xchg edi, eax
rcr byte [rsi - 0x115ff3aa], cl
and ebx, eax
invalid
pushfq
invalid
invalid
invalid
invalid
invalid
out 0xed, al
adc al, 0x11
lodsd eax, dword [rsi]
sub dl, byte [rax + riz*2 - 0x75]
cmpsd dword [rsi], dword [rdi]
in eax, 0x8a
cmp byte [rbx - 0x5c21f3f4], dh
std
cld
test eax, 0x22ff5f36
pop rdi
jmp qword [rdx]
invalid
pop rdi
jmp qword [rdx]
movsd dword [rdi], dword [rsi]
invalid
sbb esp, dword [rbp + 0x76ed7ecf]
cmp dword [rdi], edx
add ah, byte [rsi]
and al, 0xff
fstp xword [rdi + 0x51]
xchg ecx, eax
invalid
jmp 0x1400a0b55
mov edi, dword [rdi]
mov dl, 0xbf
test al, 0xda
retf
mov eax, 0x3b6f99a7
idiv cl
cmpsd dword [rsi], dword [rdi]
cdq
outsd dx, dword [rsi]
cmp esi, esi
stc
fnstcw word [rdi + 0x108baa16]
or eax, 0xa1b1aa13
invalid
xchg ebp, eax
cmp eax, 0x118cffeb
push 0x43
fild qword [rax + rbp*4 + 0x4aa9dd14]
xor eax, 0xf9ff047c
invalid
outsb dx, byte [rsi]
invalid
mov dword [rbx], ebp
invalid
insb byte [rdi], dx
cmpsd dword [rsi], dword [rdi]
hlt
cwde
jo 0x1400a0b86
xlatb
out dx, al
mov al, 0x6c
invalid
lahf
fst dword [rsi + 0x3a]
push 0x4b0a69c8
mov esp, 0x331a14a0
invalid
and dh, dl
invalid
lodsb al, byte [rsi]
cmp al, 0x10
movabs al, byte [0x9e9fcde2cc673e12]
mov esi, 0x3b9e8316
invalid
retf 0x7f4
mov cl, 0xe8
lahf
scasd eax, dword [rdi]
invalid
ror ah, 1
pop rsi
bnd jnp 0x1400a0c9a
invalid
jl 0x1400a0c67
mov dl, byte [rcx + 0x30]
jge 0x1400a0c7d
push rcx
xor byte [rbp + 0x3f], bh
jg 0x1400a0c37
sahf
invalid
invalid
nop
jbe 0x1400a0c98
or byte [0x129d25314], dl
mov rsi, qword [rbx]
mov dh, byte [0x1a32b620d]
invalid
and dword [rbx + 0x61], esp
invalid
stc
jmp [rax - 0x22afdb57]
and al, 0x4a
std
invalid
jge 0x1400a0cda
int3
cmp dword [rcx], edx
ror byte [rdx + rdx*4 + 0x7a], 0x15
invalid
adc eax, 0x9b6ff3fe
rep outsd dx, dword [rsi]
wait
loope 0x1400a0cdf
sar rax, 0xc
je 0x1400a0c57
jmp 0x1400a0d22
wait
or al, 0x4f
div dword [rdx]
stc
stc
xchg edi, eax
movabs dword [0x7921d689f5becb8f], eax
lahf
invalid
invalid
je 0x1400a0ced
jnp 0x1400a0d22
loop 0x1400a0d12
sti
push rbp
mov eax, 0xd2066d6
cmp byte [rbp + 0x1e], bh
fdivrp st(4)
invalid
mov bl, 0x16
or eax, 0x3625db1f
jbe 0x1400a0ccd
cdq
imul edi, dword [rbp - 0x14], 0xffffffa7
cmpsd dword [rsi], dword [rdi]
cmpsd dword [rsi], dword [rdi]
push rsp
jmp 0x11b8e0bd4
popfq
add eax, 0x5e633c3e
in eax, dx
out dx, al
invalid
out dx, eax
std
sbb eax, 0xbf161f8a
wait
cmp ebx, dword [rdi - 0x4e8b8402]
retf 0x4339
sub byte [r14 + r13*2], dil
clc
std
std
std
mov al, byte [rdx - 0x10]
jnp 0x1400a0d7c
mov word [rbx + 0x5d], es
test eax, 0xc33fb2eb
jb 0x1400a0d72
mov ebp, 0x43455703
invalid
invalid
xchg ebx, eax
cmp byte [rdx], ah
xor byte [rdi - 0x4f], ah
in al, dx
xchg byte [rdi + 0x14], ah
nop
invalid
leave
mov ch, byte [rbx - 0x100cf479]
add ebp, edi
sub al, 0x7d
test al, 0xa8
cmp ebp, eax
cmp ebp, eax
cmp ebp, eax
or ebx, dword [rdx]
jae 0x1400a0dba
invalid
xor dword [rsi - 0x2e75c081], ebx
sahf
jg 0x1400a0dbf
mov dl, cl
jge 0x1400a0d7d
invalid
jno 0x1400a0dd0
invalid
outsb dx, byte [rsi]
movsb byte [rdi], byte [rsi]
stosb byte [rdi], al
test dword [rdx + 0x32], 0x454280c5
enter 0x7431, 0xffffffffffffffb6
retfq
mov bh, bh
push 0xfffffffffffffff0
sbb eax, 0x73bc3079
sub ebp, edi
cmp byte [rsi + 0x694de51d], bh
ror dword [rsp + rsi*4 - 0x26], cl
sub al, 0x6b
jo 0x1400a0e05
and ebx, esp
out 0x8b, eax
and eax, 0x95522658
fsubr st(7), st(0)
mov esp, dword [0xd55c3430]
movabs eax, dword [0xf9c9ef84eb1ee21f]
invalid
loop 0x1400a0dfa
jmp 0x1400a0d62
sbb eax, 0xa796411d
or edx, dword [rdx]
fninit
xor esp, dword [rdx]
je 0x1400a0dd0
and dh, byte [rbx + rdx*8 - 0x7d]
push rdi
pop rcx
mov dl, al
in eax, dx
adc dword [rdi + 0x59], 0xffffff8a
shr ch, 1
invalid
fisubr word [rdi + 0x6e]
outsd dx, dword [rsi]
outsb dx, byte [rsi]
jb 0x1400a0d93
cmp al, 0xc1
movsd dword [rdi], dword [rsi]
adc dl, byte [rsi - 0x28]
imul edx, dword [0x146b0ad69], 0x13
sub byte [rsi], bh
call rdi
mov dh, byte [rdx + 0x638bff14]
invalid
ret 0xd197
invalid
cmp byte [rdx], 0xac
cli
out dx, eax
movabs dword [0xcc2df27a519cf98b], eax
out 0x9d, al
retf 0x106d
invalid
adc byte [rax + 0x357c276c], bh
pop rsi
out dx, al
jge 0x1400a0ec6
jne 0x1400a0eb3
iretd
invalid
sbb al, 0x5e
push 0x18
invalid
invalid
mov esi, 0x88068ab7
cli
jle 0x1400a0e9c
mov word [rcx + 0x5e], ds
enter 0xffffffffffffe101, 0xffffffffffffffa6
adc al, 0xf7
invalid
xor dword [rbp + 0x66], 0x60
invalid
mov edx, 0x875c8a35
ror byte [rbp + 0x53dfd193], cl
out 0xdd, al
nop
xchg edi, eax
cmp bl, al
or al, 0xe9
xor eax, 0xf031d34b
xor eax, esi
fist word [rbx - 0x1a]
fst qword [rax + 0xcc33897]
jmp 0x171dd59f6
invalid
xor eax, esi
out dx, al
mov ebx, 0xf0f5dbff
fiadd dword [rbx]
lea eax, [rbp*2 + 0x634e071d]
invalid
movsxd r8, dword [rdx]
cmp byte [rdx - 0x25], 0xc5
iretd
cmpsb byte [rsi], byte [rdi]
and byte [rsi + rax - 0x25], ch
in al, dx
fcompi st(5)
out dx, eax
scasd eax, dword [rdi]
invalid
cmc
invalid
invalid
mov fs, word [rbp + 0x2e]
mov edx, 0x40ed6385
push rsp
fcomp qword [rcx]
loop case.0x140002106.82
invalid
jbe 0x1400a0f03
invalid
mov ecx, 0xf2bc5ee7
stc
out dx, eax
je 0x1400a0f34
or ch, byte [rax]
rol dh, 1
sub al, dl
invalid
invalid
ficomp word [rdi + 0xf]
mov esi, 0xed687b39
js 0x1400a0f0e
lahf
push rcx
invalid
cmp byte [rdi - 0x6201413], dl
invalid
invalid
invalid
jnp case.0x140002106.85
lahf
jbe 0x1400a0f11
retf
movabs byte [0x28c1dcacc46ffb73], al
ficomp dword [rax + 0x54]
sti
out dx, eax
sbb al, ch
movabs al, byte [0xe914839ff35ca65a]
cmpsb byte [rsi], byte [rdi]
pop rsp
lahf
adc dword [rcx + rbp*8], 0xffffffae
cmpsb byte [rsi], byte [rdi]
pop rsp
lahf
adc dword [rcx + rbp*8], 0xffffffae
invalid
movabs byte [0x728098a4e103240c], al
sbb bl, dl
cwde
xor byte [rdx + 0x18], 0xd3
push rbx
sahf
and dh, byte [rdi]
jrcxz 0x1400a0fa7
scasd eax, dword [rdi]
invalid
std
invalid
not eax
xor eax, 0x4870c03a
cmp al, al
jo case.0x140002106.93
jb 0x1400a0f3f
xchg edi, edi
cdq
jl 0x1400a0faa
rdtscp
mov ebp, dword [rbx]
invalid
xlatb
minps xmm6, xmm7
cdq
stosd dword [rdi], eax
add al, 0x4d
invalid
test al, 0xdf
shl byte [rcx + 0x5e], 1
ror bl, 1
je 0x1400a0faa
xchg edi, eax
ror byte [rcx + 0x60], cl
je 0x1400a0f93
push rdx
cmpsb byte [rsi], byte [rdi]
invalid
add byte [rsi - 0x659594c7], bh
out dx, eax
test eax, 0xff72d969
sti
insd dword [rdi], dx
push rax
int 0xe3
mov ebp, dword [rdi]
invalid
js case.0x140045520.3
invalid
cmp byte [rcx], dh
adc byte [0x1b4a282ed], bh
xor dword [rax], edx
cmp eax, 0x749872b4
wait
mov esi, 0x47ff05f7
test eax, 0xfee7ff9f
test eax, 0xfee7ff9f
pop rcx
outsb dx, byte [rsi]
stosb byte [rdi], al
shl byte [rsi], 0xf0
xchg edi, eax
jnp 0x1400a1031
movsb byte [rdi], byte [rsi]
push rbx
or ch, byte [rcx + rcx*2 - 4]
std
shl byte [rdx], 1
xchg edi, eax
movabs byte [0xec8e36cbdd5fb0ea], al
in al, dx
invalid
mov ah, 0x87
jle 0x1400a1147
push qword [rsi - 0x63]
or eax, 0xfc7d5635
jge 0x1400a10b5
and eax, 0xbd32e355
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
invalid
pop rsp
mov esi, 0xa006ce7a
in al, dx
or al, 0x7a
mov eax, 0xae22cbe1
in al, dx
call 0x14c211087
cld
int1
int1
int1
mov edi, dword [rax - 0x4e]
scasb al, byte [rdi]
lahf
int3
jnp 0x1400a1145
sub eax, dword [rdx + rbp*4 + 0x720b3b09]
hlt
invalid
invalid
add esp, esp
neg byte [rbx]
popfq
or al, 0xd5
sub eax, 0x5bf0ad0e
xchg esi, eax
pop rax
invalid
invalid
invalid
jmp 0x18884e4a1
jp 0x1400a11cb
xor ch, byte ds:[rbp - 0x64]
stc
std
add al, 0xb5
pop rsi
jl 0x1400a117c
adc ebp, dword [rdx + riz*4 + 0x6d]
fnstcw word [rbp + 0x733ae47c]
or dword [rsi - 0x65638d21], ebp
fbstp tbyte [rdx - 0x64]
invalid
or cl, dh
adc al, 0x1e
insd dword [rdi], dx
pop rdx
int 0x14
invalid
fbstp tbyte [rdx - 0x64]
invalid
mov dh, 0x22
loop 0x1400a11dd
invalid
sub al, 0xc3
out dx, eax
ret
insb byte [rdi], dx
loope 0x1400a120c
cmp esi, dword [rbx - 0x62400530]
push rbx
jl 0x1400a1181
invalid
mov dl, pe_nt_image_headers64
jbe 0x1400a117b
invalid
int1
push rsp
invalid
outsd dx, dword [rsi]
invalid
movsd dword [rdi], dword [rsi]
call 0xd30525b2
jne 0x1400a11ad
jne 0x1400a11df
adc dl, ah
xor ecx, ebp
mov ebp, esi
mov ah, 0xa5
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
or al, 0xdc
mov al, 0x53
xchg ecx, eax
jb 0x1400a11dd
jmp 0x1400a11eb
in eax, dx
fucomp st(7)
jne 0x1400a11b4
int 0x7a
imul edx, dword [rbp + rax + 0x61], 0x13
invalid
invalid
sbb al, 0xf5
scasd eax, dword [rdi]
jbe 0x1400a1256
mov ebx, 0x140f8a17
retf 0x421
ror dword [rcx], 1
fisttp word [rdi - 2]
invalid
clc
ror byte [rbx], 0x66
invalid
invalid
pop rbx
jnp 0x1400a12cb
sbb eax, 0xad87ffa
mov edi, 0xf110bb8b
or bh, byte [rdi - 0xeef4475]
jmp 0x1400a123b
xchg esi, eax
xchg dword [rdi - 0x1ea15df3], esp
mov esp, 0x666395cb
and eax, 0x5ff9fbad
jrcxz 0x1400a12d6
cmc
invalid
mov dword [rsi - 0x14], esi
or dword [rax], 0x4f
ja 0x1400a12c5
movabs eax, dword [0xece67de95fc896fe]
invalid
pop rdi
jmp 0x167f6f90b
cli
fcmovu st(0), st(5)
sbb byte [rdx], ch
retf 0x6214
invalid
mov esi, dword ss:[rbp + 0x61]
cdq
test al, 0x57
std
invalid
jp 0x1400a1300
and edx, dword [rdx]
invalid
call rdi
out 0x97, eax
fidivr word [rdi + 0x17effa07]
in al, 0x7e
or bh, byte cs:[rbx + rdx*2 - 0xc]
jl 0x1400a1363
hlt
invalid