Function at 0x140097da0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r14, r9
mov word [r9], bx
mov rsi, r8
mov dword [rdx], ebx
mov r15, rdx
mov byte [r8], bl
mov edi, 1
mov qword [rsp + 0x30], rbx
mov r8d, edi
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140097e2f
mov qword [rsp + 0x28], rbx
lea r8d, [rbx + 2]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140097e36
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140098092
xor r9d, r9d
mov qword [rsp + 0x70], r12
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x140097e76
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14009808d
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x14009806c
movsxd rbx, dword [r12 + 0x3c]
mov eax, 0x100
add rbx, r12
test word [rbx + 0x16], ax
je 0x140097eb5
movzx eax, word [rbx + 4]
mov ecx, 0x8664
cmp ax, cx
je 0x140097eb5
mov ecx, 0x200
cmp ax, cx
movzx eax, dil
jne 0x140097eb7
mov al, 2
mov byte [rsi], al
mov eax, dword [rbx + 8]
mov dword [r15], eax
movzx eax, word [rbx + 0x5e]
or ax, di
mov word [r14], ax
test byte [rbx + 0x16], dil
je 0x140097edc
mov ecx, 0xffbf
and ax, cx
mov word [r14], ax
cmp byte [rsi], 2
jne 0x140097f81
movsxd rbx, dword [r12 + 0x3c]
mov edx, 0x108
add rbx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14009806c
cmp dword [rbx], 0x4550
jne 0x14009806c
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x108]
cmp r8d, edi
jb 0x14009806c
movabs r10, 0x737362747865742e
movabs r9, 0x7373625f7472
cmp dword [rdx + 0x10], 0
jne 0x140097f71
cmp qword [rdx], r10
je 0x140097f71
cmp qword [rdx], 0x736c742e
je 0x140097f71
cmp qword [rdx], 0x7373622e
je 0x140097f71
cmp qword [rdx], r9
je 0x140097f71
mov eax, dword [rdx + 0x24]
test al, 0xc0
setne cl
bt eax, 0x1d
setb al
test al, cl
jne 0x140098069
inc edi
add rdx, 0x28
cmp edi, r8d
jle 0x140097f38
jmp 0x14009806c
mov edx, 0xf8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14009806c
cmp dword [rbx], 0x4550
jne 0x14009806c
movzx r9d, word [rbx + 6]
lea rdx, [rbx + 0xf8]
cmp r9d, edi
jb 0x14009806c
movabs rbx, 0x747865742e
movabs r10, 0x737362747865742e
movabs r11, 0x617461642e
mov r8d, dword [rdx + 0x24]
test r8b, 0x20
je 0x140097ff4
mov eax, dword [rdx + 8]
cmp eax, 0x1000
jbe 0x140097ff4
add eax, 0xfffff000
cmp dword [rdx + 0x10], eax
jb 0x140098069
cmp qword [rdx], rbx
jne 0x14009800d
mov eax, dword [rdx + 8]
cmp eax, 0x1000
jbe 0x14009800d
add eax, 0xfffff000
cmp dword [rdx + 0x10], eax
jb 0x140098069
cmp byte [rdx], bpl
jne 0x14009801a
mov eax, dword [rdx + 8]
cmp dword [rdx + 0x10], eax
jb 0x140098069
cmp dword [rdx + 0x10], 0
jne 0x140098058
cmp dword [rdx + 8], 0x1000
jb 0x140098058
cmp qword [rdx], r10
je 0x140098058
cmp qword [rdx], 0x736c742e
je 0x140098058
cmp qword [rdx], 0x7373622e
je 0x140098058
cmp qword [rdx], r11
je 0x140098058
test r8b, 0xc0
setne cl
bt r8d, 0x1d
setb al
test al, cl
jne 0x140098069
inc edi
add rdx, 0x28
cmp edi, r9d
jle 0x140097fd6
jmp 0x14009806c
mov bpl, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bpl
mov r12, qword [rsp + 0x70]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret