Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dword [rdx + 0x40fd625d], esp
xchg dh, al
pushfq
invalid
push rsi
jnp 0x1400a0805
and eax, dword [0x17975272f]
std
and ecx, dword [rax + 0x35]
mov edi, 0xdfeffa05
xchg ebx, eax
sar byte [rax + rdx - 0x55], 0x4b
sbb al, 0xd4
invalid
jge 0x1400a080f
fist word [rax - 0x7c]
push rax
test bh, ah
sub byte [rcx + rsi*2 - 5], dl
out 0x28, eax
push rsp
jno 0x1400a0832
invalid
invalid
invalid
xor dword [rdx], edx
invalid
stosb byte [rdi], al
jg 0x1400a08e1
stosd dword [rdi], eax
ja 0x1400a0875
invalid
invalid
jnp 0x1400a08bd
or al, 0x89
jg 0x1400a0855
jbe 0x1400a082f
mov esp, 0x5fb59b27
imul rsi, qword [r13 - 0x3dc2b2e5], 0xffffffffffffffe1
imul esi, dword [rbp - 0x3dc2b2e5], 0xffffffe1
imul esi, dword [rbp - 0x3dc2b2e5], 0xffffffe1
mov edi, 0x86fd9e11
inc bl
mov edi, 0x69fe89d9
cmp al, 0xc2
jno 0x1400a08db
invalid
insd dword [rdi], dx
push rsp
sub edx, dword [rbx + 0x6cb70fa9]
mov ebp, 0x5639ecf
in eax, dx
xchg esi, eax
sub eax, 0x38d05ed8
lodsd eax, dword [rsi]
or dword [rdx - 0x2f], 0x75
jnp case.0x140002106.10
pop rbx
scasb al, byte [rdi]
invalid
and rdi, r12
invalid
xlatb
push rdi
ror byte [rdx - 0x24e2cc33], 0xc8
mov cl, ch
xor ebx, dword [0xde0cd1be]
add bl, byte [rsi - 0x61b403c6]
cmp bh, ah
sahf
rcr dword [0x1039bf0b0], 0x77
outsd dx, dword [rsi]
add byte [rdx - 0x30], bl
iretd
out 0x91, eax
ret
in al, 0xc6
in al, 0x3f
mov edx, dword [rbp - 0x52f06876]
xchg byte [rdx + rax*2 + 0x68], bh
sbb eax, 0x9fcfff39
dec edi
lahf
dec edi
lahf
js 0x1400a08e3
int1
sbb dword [rcx - 9], eax
adc eax, 0x17f6b370
test bh, dh
fisttp word [rcx - 0x2ded6b00]
int 0xdf
fnstenv [rax - 0x68663802]
cdq
xchg edi, eax
cdq
xchg edi, eax
mov edi, 0xe344fefe
ret
shr esi, cl
retf 0xa398
jnp 0x1400a0991
movabs rbx, 0x22d0b4a0e61d2338
test edx, edi
sub dword [rsi + rbx*8], ebp
mov eax, 0x20a1c87
movabs eax, dword [0xb255171d308490ff]
or edi, dword [rdx + riz*4]
out 0x80, al
movabs eax, dword [0xc70b94275ff9e1b8]
test eax, 0x27267c0
shl byte [rdi + 0x72], 2
shl byte [rdi + 0x72], 2
xor al, 0x9d
test dl, bh
fbstp tbyte [rsi + 0xe]
jbe 0x1400a0999
xchg edi, eax
fld xword [rbx - 0x75]
or dword [rdx], ecx
jrcxz 0x1400a0989
idiv byte [rdi - 0x4044f5a1]
mov edi, 0xbfbb0a5f
or bh, byte [rbx - 0x2c1a0f41]
invalid
in eax, 0xd3
jnp 0x1400a0984
invalid
mov bl, cl
and byte [rsp + rbp*2 - 0xd43f236], bh
mov edi, 0x6abd14a2
push rbp
push 0x55
invalid
mov ah, 0xb8
js 0x1400a09e0
xchg esp, eax
mov bl, 0xdf
pop rbp
invalid
pop rcx
invalid
or esi, edi
sbb eax, esp
invalid
ja 0x1400a0a2b
sahf
invalid
mov eax, 0x594c9753
out 0x49, eax
paddq mm4, qword [rsi]
scasb al, byte [rdi]
jne 0x1400a0995
invalid
test al, 0xfa
cli
adc al, 0x85
in al, 0xf0
idiv edi
adc bh, byte [rax - 6]
cli
cli
in eax, dx
mov esi, 0xc96d699e
jl 0x1400a09f6
invalid
je 0x1400a0a2a
mov cl, 0xf4
jns 0x1400a09d9
xchg ebp, eax
sub dl, byte [rax]
invalid
mov ebx, 0x9e5d1683
out dx, al
cli
jle 0x1400a09c8
invalid
jle 0x1400a0a97
imul esi, dword [rcx + rbx*4 - 0x4f], 0xffffffbb
je 0x1400a09c7
mov cl, 0xbb
invalid
invalid
invalid
test eax, 0x550b8378
shl byte [rdi], 0
invalid
invalid
fucomp st(1)
invalid
jmp 0xe52460b3
invalid
outsb dx, byte [rsi]
mov byte [rdi], dl
or dl, byte [0xcbabf7d2]
cmpsd dword [rsi], dword [rdi]
in eax, 0x8a
invalid
jns 0x1400a0b50
xlatb
sbb bh, dl
movabs al, byte [0xbe80fe5b07b95ba4]
div dword [rax - 0x5a1102c1]
bnd ret
ret
ret
invalid
invalid
invalid
invalid
sti
invalid
xchg ebp, eax
cmp eax, 0x65b2ffeb
invalid
js 0x1400a0be5
adc esi, dword [rdx - 0x75ffd66d]
scasb al, byte [rdi]
xchg edi, eax
xor esi, dword [rsi + 0x3c]
cmp eax, 0x64f4a067
jl 0x1400a0ba5
insd dword [rdi], dx
add bl, bh
iretd
jb 0x1400a0b53
invalid
test eax, 0x8dfe21f7
inc dword [rax + 0x76]
invalid
fild word [rdi + rbx - 0x7b]
div dword [rdi]
fimul word [rdx - 0x1cc939c1]
ret
mov bh, byte [rdi]
invalid
invalid
xor al, 0xf5
movsb byte [rdi], byte [rsi]
stosb byte [rdi], al
push rdi
rol byte [rax], cl
popfq
movabs al, byte [0xd3679e8316bedefe]
xchg ecx, eax
call 0x12b6c3387
xor edx, dword [rsi - 0x38]
mov r11b, byte [0x170e4ad1a]
jle 0x1400a0bd9
out 0x5c, al
js 0x1400a0b95
mov dh, 0x42
sbb dword [rdx], esi
lahf
scasd eax, dword [rdi]
invalid
std
invalid
cld
invalid
sbb ebx, edi
outsb dx, byte [rsi]
add cl, byte [rdi + 0x18]
cld
mov r12b, r15b
invalid
invalid
std
jg 0x1400a0ccb
mov edi, 0x3ffb5785
fisttp word [ecx]
or dword [rdi], ecx
pop rsi
adc eax, 0x4a7556be
or dword [rdi], ecx
pop rsi
adc eax, 0x4a7556be
invalid
invalid
ficom dword [rdx + riz - 0x63e4339e]
mov ch, dh
invalid
invalid
pop rdi
nop
ret 0xd0f4
ror bl, 1
sbb eax, 0x52393b42
or eax, esp
push rcx
xchg ecx, eax
mov byte [rbx + rax - 0x4fce6de3], cl
add ebx, dword [0x11fba3e74]
invalid
jrcxz 0x1400a0d1d
add ebx, dword [0x11fba3e74]
invalid
sub byte [rsi - 0x639f5d50], ah
shr byte [rdx + rcx*4], cl
sub al, 0x8a
sub al, 0x8a
frstor dword cs:[rsi + rbp*2 - 0x155a6a5d]
pop rsi
jnp 0x1400a0ccf
invalid
jnp 0x1400a0d13
invalid
sbb dl, byte [rbp + 0x27]
popfq
mov dh, 0xa5
adc dword [rcx - 0x25], ebp
imul ebx, ebx, 0x6be7d5f6
imul ebx, ebx, 0x6be7d5f6
invalid
out 0x71, al
jae 0x1400a0d35
or al, 0x98
mov ebx, 0xb20a5ba3
pop rbx
or dh, byte [rdx + 0x4d7bf03c]
pop rbx
or dh, byte [rdx + 0x4d7bf03c]
mov word [rbp + 0x2a], cs
invalid
or al, 1
jno 0x1400a0d7d
clc
xor eax, 0xab25f86b
stosd dword [rdi], eax
stosd dword [rdi], eax
and eax, 0xd0cd8d84
invalid
sar byte [r14], cl
push rcx
push rdi
mov esi, 0xa2914b29
xchg ecx, eax
adc dword [rax], esp
adc ebp, dword [rcx - 0x45]
invalid
add ebp, dword [rax + 0x44352db2]
out 0xd3, eax
retf 0x7e0
add al, 0x14
lahf
adc al, 0x9f
adc al, 0x4c
or eax, ebp
invalid
jnp case.0x140002106.66
imul edi, dword [rdi - 0x56], 0x1a79ca1d
mov esi, 0xf618ffc7
invalid
invalid
invalid
or ebp, edx
fdiv qword [rbp - 0x11]
cmp byte [rsi - 0x1f4ccde3], bh
in eax, dx
pop rbx
js 0x1400a0da2
invalid
invalid
xchg ebx, eax
invalid
pop rax
mov ebx, 0x7623fd04
mov bh, 0xe5
invalid
movabs eax, dword [0xa5fecedc4397ea9f]
sbb dword [rax + 0x6b], edi
outsb dx, byte [rsi]
xor dh, byte [rbx]
invalid
xchg edi, eax
fmul st(6), st(0)
invalid
jrcxz 0x1400a0dbc
jnp 0x1400a0e23
adc al, 0xb0
and dword [rdx + 0xbbd51ee], ebx
push rcx
invalid
invalid
xchg edx, eax
invalid
push rcx
mov ebp, 0x14fe920b
ret
ja 0x1400a0e93
shr byte [rcx + rdx*4 + 0x30], 1
pop rsi
out dx, al
jge 0x1400a0ec6
jne 0x1400a0eb3
iretd
mov ecx, 0xe3fe5ff7
test eax, 0x6ecb7eaf
invalid
invalid
test byte [rdi + rbx*2], al
sub al, 0xb3
add byte [rdx + rbx*2 - 0x4d91946d], bh
xchg esp, eax
or esp, ecx
xchg r15d, eax
pushfq
ret
invalid
pop rsp
ja 0x1400a0e2f
or eax, 0x38c1b0ef
test ebp, ecx
jb 0x1400a0e22
cmp byte [rbp + 0x608372cd], al
invalid
invalid
mov dl, 0x51
fimul word [rsi + 0x2147bd7]
cli
invalid
invalid
adc al, 0x74
test dword [rcx - 0x32], ebx
invalid
add al, 0x55
fcmovnbe st(0), st(5)
cmp byte [rbx - 0x59303a25], bh
mov esp, 0xec439431
fcompi st(5)
out dx, eax
cwde
invalid
xor eax, dword [rdi]
jrcxz 0x1400a0e69
invalid
mov ecx, 0x916ff22d
invalid
jbe 0x1400a0ee5
test byte [rsi + 0x74eff9f2], bpl
xor byte [rsi - 0x64], bh
xchg ebx, eax
invalid
mov edi, 0x2ea54ff7
int3
call [rax + 0xf]
mov esi, 0xfefb7b39
idiv edi
mov edi, 0x33420a8a
xor byte [rcx], ah
scasd eax, dword [rdi]
std
invalid
cmpsb byte [rsi], byte [rdi]
invalid
xchg esp, edi
mov cl, 0xd5
invalid
invalid
jbe 0x1400a0f12
adc dword [rcx - 0xb], ecx
mov esp, 0xce12ce
sti
adc al, 0x69
imul edx, dword [rbx + 0x5bf54092], 0x76b1155
imul edx, dword [rbx + 0x5bf54092], 0x76b1155
cwde
and byte [0x120be38b9], cl
sbb edx, edi
invalid
std
invalid
int1
outsb dx, byte [rsi]
invalid
outsd dx, dword [rsi]
mov edi, 0x2f0f8abe
fdivr qword [rsp + rbx*4 - 0x14]
fcom st(3)
sbb ch, al
cwde
stosd dword [rdi], eax
invalid
fistp qword [rax + 0x42]
xchg ebx, eax
pop rcx
addps xmm1, xmmword [rbx]
sub cl, byte [rbp - 0xd]
test eax, 0x402232a1
and al, byte [rax + 0x17]
and al, byte [rax + 0x17]
pop rbp
xor al, byte [rbp + 0x2cb6d33e]
pop rcx
mov bl, 0xf5
cdq
jbe 0x1400a106f
imul edx, edx, 0x54a8de66
mov ah, bh
in eax, dx
fisubr word [rax - 0x120377ac]
scasd eax, dword [rdi]
invalid
adc eax, 0xa0ff312
call 0x147993a64
xchg byte [rax - 0x23], ah
fstp qword [rcx]
lahf
jmp rdi
invalid
mov al, 0x1c
invalid
invalid
fstp qword [rcx]
lahf
jmp rdi
adc byte [rbp - 0x5a685db9], ah
sar byte [rdi], 0x1a
mov ebp, 0x7087e027
mov dl, 0x2e
invalid
jmp 0x1400a10c9
invalid
shr dword [rsi + 1], cl
outsd dx, dword [rsi]
ror byte [rax], 0x50
or al, 0xda
fcmovbe st(0), st(4)
fcmovbe st(0), st(4)
invalid
test eax, 0x17aecefa
retf
fild qword [rdi + 0x7e]
push qword [r14 - 0x68]
outsd dx, dword [rsi]
jle 0x1400a1147
push qword [rsi - 0x68]
add eax, 0x8d254ea6
or ch, byte [rsi]
in al, 0xb3
fld xword [rax]
xchg r11d, eax
xchg ebx, eax
xchg ebx, eax
out dx, eax
jge 0x1400a10e8
xchg ecx, eax
sbb ebp, dword [rbx]
loopne 0x1400a117c
jae 0x1400a112f
invalid
pop rax
mov edx, 0x167e1afb
lodsb al, byte [rsi]
rcr dword [rcx + 0x34], 1
xor byte [rbx - 0x740ec199], al
int1
mov esi, dword [rsi - 0x3b]
int1
mov esi, dword [rsi - 0x3b]
mov eax, ecx
fsub dword [0x1b86e036c]
push rax
imul eax, dword [rax - 0x441d3a8b], 0x76
xor byte [rbp - 0x3b], 0xe2
mov ebx, 0x35536776
imul esi, dword [rdi - 0x515d043e], 0xffffffff
push rsp
cmp esi, dword [rcx - 0x6d]
scasd eax, dword [rdi]
xor byte [rbp - 0x3b], 0xe2
mov ebx, 0x35536776
imul esi, dword [rdi - 0x515d043e], 0xffffffff
push rsp
cmp esi, dword [rcx - 0x6d]
scasd eax, dword [rdi]
ret 0xa2fb
invalid
sbb dword [rsi + 0x5b], esp
popfq
and byte [0x1acfec387], dl
jo 0x1400a1166
scasd eax, dword [rdi]
sahf
mov ebx, 0x8016e029
loope 0x1400a1147
and cl, 0xda
sahf
invalid
or esp, esi
or esp, esi
adc eax, 0xfbe0dda2
in eax, 0xb1
movabs eax, dword [0x1b5ae1e97af0ec3f]
xchg edi, eax
invalid
scasb al, byte [rdi]
mov dh, 5
invalid
invalid
invalid
invalid
mov edx, 0xcda6b61e
pop rsi
mov dl, 0xb
mov dword [rsi - 0x39], 0x1716cff5
jmp 0x1400a1263
mov bh, 0x83
imul esp, dword [rcx + 0x21d342c7], 0xbaf04522
or dword [rsi - 0x1ce28b38], edx
xor edx, eax
sbb sil, bpl
scasd eax, dword [rdi]
jbe 0x1400a1256
adc cx, word [rax + 0x23]
invalid
invalid
fnstenv [rsi]
lodsb al, byte [rsi]
mov esi, 0x36d14f43
cmpsb byte [rsi], byte [rdi]
push rsp
imul ebp, dword [rbx - 0x7aacc1fa], 0xa5968218
invalid
lodsb al, byte [rsi]
stosb byte [rdi], al
sub edi, dword [rbx + 0x79]
sbb eax, 0xad87ffa
mov edi, 0x2b00e6b2
or bh, byte [rdi + 0x2b00e6b2]
or eax, 0x7bf0b7fb
invalid
jge 0x1400a124a
or eax, 0xbd95e57d
mov edi, dword [rcx - 0x1a]
jge 0x1400a124d
xchg ebp, eax
mov ebp, 0xe6798bf2
invalid
invalid
and eax, 0xf0550f7a
sub eax, 0x2bc296d3
rcl dword [rsi + 0x1bf32bc2], cl
invalid
invalid
invalid