Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
sub edx, dword [rbp + 0x6098fb95]
invalid
add al, al
int1
invalid
mov esp, 0x971c434a
pop rcx
mov dword [rcx], edx
invalid
add ah, bl
xor byte [rbx + rcx], cl
mov bl, 0xac
pushfq
mov fs, word [rcx + 0x2f0ec592]
adc esi, dword [rbp - 0x35]
scasd eax, dword [rdi]
invalid
nop
invalid
loopne 0x1400a085b
jne 0x1400a08d6
lodsb al, byte [rsi]
cmp dword [rsi - 0x13ef7296], ebp
in al, dx
mov dh, 0xe
invalid
jmp 0x117ef4964
mov cl, byte [rsi - 0x1a000410]
test byte [rbp + 0xab1], 0xe9
mov dh, 0xed
je 0x1400a0891
int3
int3
je case.0x140002106.4
sti
jmp 0x109baab27
test dword [rbx], eax
stosb byte [rdi], al
invalid
int3
invalid
mov dl, byte [rbp + 0x16]
movabs al, byte [0x16b08aae8ba2bfa4]
stosd dword [rdi], eax
add ecx, dword [rdx]
xchg ebp, eax
pop rbx
invalid
cdq
xchg edi, eax
mov edi, 0x725a0dfe
movsd dword [rdi], dword [rsi]
invalid
add bh, dh
movsd dword [rdi], dword [rsi]
jp 0x1400a09b0
mov esi, 0x72ab85eb
ficomp word [rsi - 0x20]
invalid
jnp 0x1400a0991
lahf
rcr edi, cl
invalid
loop 0x1400a09e1
invalid
mov bl, byte [rsi + rcx*8 + 0xd]
mov cl, 0x9a
sub al, 0x1b
or eax, 0x1b2c9ab1
test eax, eax
pop rsi
fbstp tbyte [rsi + 0xe]
xchg edi, eax
call rdi
jg 0x1400a097d
or dword [rcx - 0x1c], edx
add dl, cl
frstor dword [rcx - 0x7c8d80b1]
fistp dword [rax]
sbb byte [rax], cl
ret 0x6c9b
push rcx
in al, 0
retf 0xa1dd
cvtpi2ps xmm7, mm6
imul eax, dword [rdx], 0xffffffa1
popfq
imul eax, dword [rbp + 0x7022d24d], 0xfebf1afe
invalid
shl byte [r10], cl
jo 0x1400a09ae
sbb bh, byte [rdi + 0x5158fefe]
or cl, byte [rcx + 0x5d]
invalid
fdivr dword [rcx + rdx - 0x34]
mov edi, 0x41bd1d2b
add dl, byte [rsi]
faddp st(0)
invalid
out 0x17, eax
in al, 0xff
mov edi, 0x2d8bf6d0
adc dword [rbp + 0x53], esp
sahf
movsb byte [rdi], byte [rsi]
xchg edi, eax
clc
invalid
test eax, 0xc6fe6654
pop rdi
jb 0x1400a09ab
js 0x1400a0a50
mov byte [rsp + rdx + 0x74], ah
adc al, 0x74
jg 0x1400a09ce
invalid
xchg byte [rdi + 0x14], al
xchg dword [rdi + 0x5d], esi
ja 0x1400a0a67
leave
mov ch, 0x2b
adc eax, 0x6245d9ed
test eax, 0xaaf586db
xchg ch, dh
stosb byte [rdi], al
xor eax, edx
ficomp word [rdi + 0x16b78a70]
invalid
scasd eax, dword [rdi]
clc
invalid
clc
add dword [rdx + 0xb], esi
xchg esi, eax
loopne 0x1400a09ef
xor dword [rcx - 0x3add6b2e], esi
and al, ch
mov cl, 0x87
invalid
enter 0x7070, 0xffffffffffffffe4
jge 0x1400a0a21
push rsp
out 0xf7, al
movabs dword [0x10e47ea3f2c752b], eax
mov bl, 0x9b
wait
jne 0x1400a0a7e
invalid
wait
cmpsb byte [rsi], byte [rdi]
pop rsi
jge 0x1400a0a08
jns 0x1400a0a14
push rsi
not dword [rdi - 0x1d5c612e]
jae 0x1400a0ae6
movabs dword [0xcee5e1b0087e73e2], eax
jle 0x1400a0a71
or byte [rax + 0x3ecee5e1], dh
mov al, 0xe1
in eax, 0xce
std
std
invalid
push rcx
je 0x1400a0a64
mov ah, 5
sub bpl, byte [r15 + 0x16ac1954]
fstp qword [rsi - 0x46]
inc dword [rbx + rdx*4 + 0x568b6bfe]
xchg ebx, eax
invalid
invalid
mov edx, dword [rsi + 0x4b]
pop rsi
mov edx, 0xfe9384ff
xchg ebx, eax
invalid
imul ecx, dword [rbx + 0x57824b56], 0x48
pop rsp
in eax, 0x14
int1
xor al, 0x56
mov eax, dword [rax + 0xc28690e]
imul edx, ebx, 0xffffff88
ror dword [rax + 0x15a14415], cl
adc dh, byte [rdx]
adc eax, 0xc66bfbf5
xchg ebx, eax
invalid
ror dword [rax + 0x15a14415], cl
adc dh, byte [rdx]
adc eax, 0xc66bfbf5
nop
or dl, al
sbb al, 0x71
sahf
jno 0x1400a0aab
jl 0x1400a0ad6
add al, 0x86
shr ecx, cl
test dword [0x13f45edb1], ebx
invalid
sub eax, esp
inc byte [rdx + 0x69a1ecfd]
or byte [rax + 0x57], cl
push rdi
out 0x5e, eax
stc
invalid
pop rdi
invalid
add dh, byte [rax + 0x21]
sub eax, 0x3b560bed
invalid
invalid
xor dword [rbx], edi
invalid
invalid
jmp 0x1400a0b55
mov bl, byte [rbx + 0x23]
xor byte [rsi + 0xe], dh
invalid
hlt
je 0x1400a0bb2
or dword [rax + 0x7daa49e5], esi
mov bl, 0xa7
push rdi
lea esp, [rbp + rbp*2 + 0x6f]
je 0x1400a0b9f
sub al, 0xa1
mov r10b, 0x95
xor dword [rsi + 0x38], 0x14
enter 0x546d, 0xffffffffffffffde
add al, 0x94
xchg esp, eax
invalid
push rbp
jl case.0x140002106.40
invalid
jae 0x1400a0b28
invalid
mov esp, dword [0xd7e5e723]
add eax, 0x3f7a4c74
mov edi, 0x2a0ba049
movsb byte [rdi], byte [rsi]
test dword [rdx + rax - 0x74100404], 0xe9077c35
sti
out dx, eax
mov esi, dword [0x1b4f3132c]
outsd dx, dword [rsi]
movabs al, byte [0xfbfc0284f7a42a0b]
sti
out dx, eax
mov esi, dword [0x1b4f3132c]
outsd dx, dword [rsi]
int 0xc9
leave
cdq
and ebx, dword [rdi + 0x2b]
sub edi, ebx
xchg edi, eax
and bl, byte [rsi + 0x2db6ba1a]
sbb bh, byte [rdx + 0x716e2db6]
invalid
sbb bh, byte [rdx + 0x716e2db6]
invalid
movabs dword [0x445fb57aef28d545], eax
jnp 0x1400a0b77
jbe 0x1400a0c01
invalid
movabs eax, dword [0xc66e272075d453ac]
jmp qword [rsi - 0x55e01ed7]
sub eax, ecx
invalid
jbe 0x1400a0b74
and eax, 0x2728e1ad
xor bl, byte [rax - 6]
mov dh, 0x20
push 0xffffffffffffff95
sbb r9b, byte [r15 - 0x57]
xchg ebp, eax
fidivr dword [rbx]
jp 0x1400a0c2b
invalid
sub byte [rcx + 0x168b8a3d], ch
jb 0x1400a0be5
pop rbp
retf 0x318b
or dword [rax - 0x931337a], edx
invalid
xchg ecx, eax
mov dl, 0x71
sub al, 0x1b
mov bl, 0x9f
push 0x21b4a566
jno 0x1400a0c4e
sbb esi, dword [rbx - 0x5a999761]
mov ah, 0x21
fld xword [rsi + 0x1e]
invalid
outsb dx, byte [rsi]
invalid
invalid
invalid
outsd dx, dword [rsi]
inc dword [rbp + 0x45]
jp 0x1400a0c66
and al, 0x4d
jp 0x1400a0c84
xchg edx, eax
fcompi st(3)
mov ch, 0x30
ret
xor bl, al
pop bx
pushfq
adc eax, dword [rbp + rax*2 - 0x6807006]
cmp byte [0xc2073326], bh
std
invalid
invalid
invalid
sbb dword [rdi], 0x8bf47513
invalid
add dword [rdi + 0x30352e09], edi
lahf
jb 0x1400a0c6e
or dword [rsi], ebp
xor eax, 0xe3729f30
push rbx
sub al, 0xf4
loop 0x1400a0c5d
mov ah, 0x4d
sbb eax, edi
cli
invalid
out dx, eax
invalid
movabs byte [0x7dd2ffb7e62cb35], al
xchg ebp, eax
call 0xc761b3fa
out 0x97, al
outsb dx, byte ds:[rsi]
mov al, 0x2b
wait
push qword [rax]
invalid
invalid
pop rcx
invalid
jg 0x1400a0d49
xor dword [rax - 0x7c], ebp
invalid
hlt
test eax, 0xad41ab7e
adc byte [rdx + 0x17], ah
stc
jmp 0x1400a0cf3
push rdi
lodsd eax, dword [rsi]
mov dl, 0xb4
movsd dword [rdi], dword [rsi]
invalid
sub esp, dword [rax - 0x38687fdc]
jns 0x1400a0d38
invalid
or bh, byte [rbp - 0xa]
xchg esp, eax
xchg ecx, eax
sti
xlatb
invalid
movsd dword [rdi], dword [rsi]
invalid
jae 0x1400a0d27
invalid
hlt
invalid
xchg esi, eax
mov esi, 0xd46cb6c
jns 0x1400a0e11
loope 0x1400a0e09
fmul qword [rbx - 0x5c244669]
iretd
xchg esi, eax
or dil, bl
jle 0x1400a0df6
push rsi
invalid
test byte [rdi], 0x27
fld xword [rbp - 0x33]
in al, 0x25
sbb al, 0x75
adc ecx, edx
mov bl, 0xaa
stosb byte [rdi], al
stosb byte [rdi], al
fsub dword [rcx - 0x141bd272]
in al, 0xeb
jp 0x1400a0e09
sbb dl, cl
insd dword [rdi], dx
invalid
in eax, 0x2e
sub byte [rcx + 0x55], ch
invalid
mov dword [rdx], edi
jne 0x1400a0e2f
ret 0xb338
out dx, eax
mov edi, dword [rbx - 0x10]
adc al, 0x31
invalid
add dl, ch
adc byte [rsi], 0x66
push rax
in eax, 8
mov bl, 0x14
stosd dword [rdi], eax
pop rbx
invalid
enter 0x5551, 0xffffffffffffffbe
pop rdi
pushfq
pop rcx
pop rsi
push rcx
push rbp
mov esi, 0x5e599c5f
out dx, al
jge 0x1400a0ec6
push rax
js 0x1400a0ea0
in eax, dx
invalid
fidivr dword [rdi]
adc bl, ah
test eax, 0x77c37eaf
neg byte [0x198a36b93]
lodsd eax, dword [rsi]
hlt
test bl, ah
js 0x1400a0e40
mov ecx, 0x2e16f01d
invalid
add rax, 0xffffffffe407d1ae
sti
sbb al, 0xb1
sbb al, byte [rsi - 0x1e94f60b]
pop rcx
invalid
clc
scasb al, byte [rdi]
stc
push rsi
adc al, 0xf8
int 0x21
invalid
enter 0xffffffffffffed29, 0xffffffffffffffaa
mov ah, byte [rsi + 0x7d]
invalid
jo 0x1400a0e49
clc
invalid
xor eax, esi
out dx, al
mov ebx, 0x13f3e12
out dx, al
stosd dword [rdi], eax
invalid
invalid
in eax, dx
pop rbx
fcmovnbe st(0), st(5)
cmp byte [rbx + 0x7b626a39], bh
jmp qword [rbp + 0xa546fff]
wait
xor eax, 0xa4381acc
fucom st(0)
out 8, eax
sub al, 0xb6
pop r11
fst st(1)
or al, 0xbd
push rbx
sti
pop rsi
movsd dword [rdi], dword [rsi]
push rsp
add eax, 0xa9c336b8
jle 0x1400a0eb1
scasb al, byte [rdi]
xor eax, 0x44d26617
stc
out dx, eax
je 0x1400a0ea6
add esi, dword [rdi - 0x4048d086]
div dword [rsi]
adc al, 0x49
jmp 0x18837d1e9
invalid
invalid
sub eax, 0x161b2b48
jg 0x1400a0f01
movsd dword [rdi], dword [rsi]
fcmovnb st(0), st(0)
mov edi, 0x1cb4eccc
out dx, eax
invalid
cmp al, 0x16
pop rdi
jns 0x1400a0fbb
invalid
invalid
fist dword [rdi + 0x6cc29151]
xchg ebp, eax
invalid
push 0x3f
retf 0xe297
pop rbp
sub dword [rcx - 0x64], edi
add ebx, dword [rdx - 0x4d]
jmp qword ss:[rbx + 0x51797cff]
xchg edx, eax
sbb eax, 0x7f0e6b2f
pop rdx
pop rdx
mov bl, 0x93
shr dword [rdi], 0x15
invalid
sub edi, edi
mov eax, 0x62b088f4
mov al, 0x62
add cl, r13b
sbb al, 0x4f
xlatb
loop 0x1400a0fd9
and edi, dword [rax + 0x465b4896]
invalid
invalid
xchg esi, eax
cmp dword [rdi + 0x3b], eax
jg 0x1400a1053
jo 0x1400a0fb9
outsb dx, byte [rsi]
and bl, byte [rax + rax*2 - 0x60]
sub dh, byte [rcx]
xor dword [rbp*8 - 0x61b47577], ebp
fidivr word es:[rcx - 0x1d]
xor dword [rbp*8 - 0x61b47577], ebp
fidivr word es:[rcx - 0x1d]
adc byte [rsp + rdx*8 - 0x3d], ch
mul qword [0x1937bb78d]
mul dword [0x1937bb78d]
mul dword [0x1937bb78d]
push 0x5a
enter 0xffffffffffffdd9c, 0x18
xchg edx, eax
fnsave dword [rsi]
fsub qword [rdi - 0x6fbdc484]
jl 0x1400a107b
nop
jl 0x1400a107b
nop
mov dword [rbp + 0x696e59cc], edi
add edi, ebp
invalid
pop rbp
jnp case.0x140002106.106
test eax, 0x427e3bad
invalid
scasb al, byte [rdi]
invalid
mov bh, 0x47
invalid
test byte [rbx - 0x637c91b0], dh
add eax, 0x702a7c9a
test byte [rax + 0x4d7e78e8], dh
call 0x13f578f73
jbe 0x1400a10e1
call 0x13f578f73
jbe 0x1400a10e1
pop rbx
call 0x1547db39e
sbb edi, dword [rsi + 0x37]
jg 0x1400a1181
cmp esp, dword [rbx + 0x6bf9dde3]
iretd
jrcxz 0x1400a10e9
stc
imul ecx, edi, 0xfffffffa
outsb dx, byte [rsi]
cli
invalid
pop rsp
std
scasd eax, dword [rdi]
invalid
invalid
int1
mov eax, dword [rbp + 0x6fae18db]
movabs eax, dword [0x97ef807f20508a37]
out dx, eax
xchg edi, eax
and byte [rdi - 0x80], bh
out dx, eax
xchg edi, eax
invalid
xor al, 7
mov bh, 0xfb
movabs byte [0xaf65a494aee4ffae], al
invalid
jmp 0x1400a10d9
xor edi, dword [rdi + 0x1c2e76ee]
xchg esp, eax
rcl dword [rdi], 0x3f
insb byte [rdi], dx
int1
nop
push 0xa
cmp bh, al
lodsb al, byte [rsi]
xchg byte [rbp - 0x32], al
xchg edx, eax
outsb dx, byte [rsi]
outsb dx, byte [rsi]
or eax, 0xf67718fb
loop 0x1400a1145
xchg byte [rsi], bl
invalid
sahf
sbb byte [rax - 0xb], al
cmc
cmp ebx, ecx
loop 0x1400a1153
in eax, dx
add eax, 0x7af0ec3f
int 0x5d
scasb al, byte [rdi]
call qword [rsp + rdi*8 + 0x34955dc]
fist dword [rsi + 0x16fe4c2f]
invalid
invalid
cli
sub ah, al
jrcxz 0x1400a1139
invalid
invalid
in eax, dx
in al, 0xbf
cmc
pop r13
invalid
invalid
int 0x6b
mov edi, 0x67161a28
cmp esp, dword [rdx - 0x34]
jg 0x1400a1232
invalid
invalid
or ebx, esi
test dword ds:[rsi + 0x404d3838], 0x223d575e
cld
in al, 0x33
mov cl, byte [rdi - 9]
jne 0x1400a123b
sbb bh, byte [rsi]
ficom dword [rdi]
invalid
invalid
sar dword [rax - 0x65], 1
ret 0x3162
mov ah, 0x33
int1
mov ecx, 0x17bbeba8
mov cl, byte [rdi]
fdiv dword [rdx]
invalid
imul edx, dword [rax - 0x10], 0x24
invalid
jge 0x1400a11be
loopne 0x1400a11c8
mov esi, 0x272f7ac9
jp 0x1400a1269
invalid
mov ah, byte [rsi - 0x59f36e7a]
xchg edx, eax
ret 0x8660
invalid
mov ebx, 0x1d797b42
cli
std
or eax, 0x77702c1
pop rdi
xchg byte [rsi + riz*8], bh
sbb eax, 0x7dca077b
test eax, 0x841769d8
invalid
invalid
invalid
imul edx, dword [rdi], 0xe500fb84
invalid
sti
add ch, ah
push rax
invalid
out dx, eax
call qword [rdi - 0xf91802b]
jnp 0x1400a129b
stc
ja 0x1400a1267
lodsd eax, dword [rsi]
sar dword [rdx + 0x4edca3f1], cl
cmp byte [rbp - 0x36], r8b
jle 0x1400a1248
in eax, dx
adc byte [rax - 0x3d77cec6], ah
or byte [rsi - 0x6cf8947], ah
mov ecx, 0xa6f93076
ret 0xa608
mov ecx, 0xa6f93076
push rsi
insd dword [rdi], dx
mov eax, 0xb7745ab7
je 0x1400a1261
pop rcx
invalid