Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, 0xd4
scasb al, byte [rdi]
push rax
xchg byte [rbp - 0x2b7d8bcc], dh
invalid
test dword [rbp + 0x7fb1dfeb], 0xc4c07aea
jbe 0x1400a0766
fbstp tbyte [rcx - 0x3f851581]
invalid
in al, dx
and eax, 0x8ed706e6
cmc
imul edx, dword ss:[rdx + 0x174cb39c], 0xfd8341
invalid
invalid
jge 0x1400a080f
push 0xffffffffa22900e1
cmc
sub eax, 0x97614b15
imul ebp, dword [rdi - 0x28], 0x95e036
outsd dx, dword [rsi]
fdiv dword [rsi]
loopne 0x1400a07d6
add byte [rbp + 0x46], bh
outsd dx, dword [rsi]
fdiv dword [rsi]
loopne 0x1400a07d6
add byte [rbp + 0x46], bh
mov bh, 0x70
xor al, 0x77
invalid
pop rdi
stosb byte [rdi], al
push rbp
jl 0x1400a07d3
sti
jrcxz 0x1400a0890
sub edx, dword ss:[rsi]
adc eax, 0x48fcb6c9
ja 0x1400a08b9
mov dword [rdi], esi
pop rax
xchg byte [rcx - 8], ch
imul edi, eax, 0x720fe1a3
invalid
frstor dword [rdi]
invalid
jb 0x1400a0844
imul edi, eax, 0x720fe1a3
invalid
invalid
mov ecx, 0x1f2ce73e
stc
or dword [rcx], 0x1e
invalid
imul edi, dword [0x124abda7c], 0xfffffff1
invalid
movabs eax, dword [0x4def023e1746f1e4]
invalid
add ch, bh
invalid
invalid
mov cl, byte [rsi + 0x462ffbf0]
push rcx
push rcx
jle 0x1400a086e
or al, byte [rax]
add byte [rsi - 0x11], dl
invalid
int3
sbb dword [rdi + 2], 0x7bf0d0cb
pop rcx
xor edx, dword [rbx]
invalid
invalid
cmp eax, 0x974bc89a
stosd dword [rdi], eax
or al, 0x31
fsub dword [rax - 0x7a97bf62]
movabs al, byte [0x47a1c9c0843987fa]
mov al, 0x14
adc dword ds:[rax + 0x6b], ecx
fmulp st(5)
invalid
imul rbx, rsi, 0xffffffffffffffcd
int 0x3d
jo 0x1400a090d
cmp eax, 0x6327f970
mov ss, word [rbp - 0x5f5dad3]
invalid
invalid
and dword [rbx], ecx
stosb byte [rdi], al
hlt
push 0x27
pop rax
mov ch, 0xcb
pop rcx
cmp eax, 0xbd90ec2e
int 0x96
idiv byte [rbp + 0x380101cd]
mov ebp, 0x380101cd
mov ecx, dword [rcx - 0x76]
or r11, rcx
jrcxz 0x1400a08f1
invalid
jns 0x1400a0946
fist word [rdi]
call [rcx + 0x191a3f9]
outsb dx, byte [rsi]
and eax, 0xacffffbb
out 0xd1, al
adc eax, 0x68f3c6ae
loope 0x1400a0938
push 0x7dfebfe1
push 0x7dfebfe1
invalid
jle 0x1400a0976
fst dword [rax]
movsd dword [rdi], dword [rsi]
push rdx
in eax, 0xc0
or ebx, dword [rsi]
jnp 0x1400a09e2
psrad mm4, mm2
sub dil, r15b
xlatb
jg 0x1400a097d
jg 0x1400a0975
invalid
push 0x2c
cmp bl, dh
push r14
invalid
push rcx
sbb ch, byte [rdi - 0x2041c7e9]
pop rbp
invalid
cmc
iretd
invalid
retf 0x57f6
mov bh, 0xec
xchg esp, eax
sal eax, 1
jle 0x1400a09e1
jg 0x1400a09f3
invalid
mov ss, word [rsi + 0x5d771cce]
leave
mov ch, 0x10
invalid
ret 0x26a2
xor esi, dword [rsi + 0x3c]
pop rsi
invalid
sbb al, 1
sbb dword [rsi], esi
sbb esp, edx
out 0xa4, eax
cmpsd dword [rsi], dword [rdi]
invalid
add byte [rdx - 0x40], dh
out dx, eax
adc ebp, ebp
pop rbp
fstp qword [rax]
pop rdx
invalid
invalid
invalid
invalid
xor bh, ah
pop rsp
xchg edi, eax
adc bl, byte [r14 - 0x58]
enter 0x1d41, 0xffffffffffffff95
nop
cmp eax, 0xef7c7ec
fcom dword [rbx - 0x7a5eacaa]
sbb dl, 0xdd
xor edx, dword [0x15dabf7d2]
fnsave dword [rbx]
adc eax, 0x1da1ecfd
adc edi, esi
sub al, 0xd6
add al, 0x86
add al, 0xea
xor dword [rdi], edx
rol dword [0xd72b09cd], 0xf0
invalid
and byte [rdi + 0x73e3bef0], dl
and dword [rsi + 0x4c35b2f3], ecx
xchg ebx, eax
fild dword [rsp + rsi*4 + 0xb]
invalid
xor eax, 0x44db934c
mov ah, 0xb
cmp byte [rdi + rdx*8 - 0x3a], dl
movsb byte [rdi], byte [rsi]
xlatb
out dx, eax
js 0x1400a0aed
jnp 0x1400a0ab4
jge 0x1400a0b1d
insd dword [rdi], dx
add dword [rax + 0x1faa0676], ecx
sbb eax, dword [rbx - 0x5d]
and al, 0x9d
std
std
iretd
leave
xor byte [rsi], bh
jmp 0xfe1ee7b2
mov esi, 0x2405b8ee
mov edx, 0xedf54377
ror ebx, cl
cmpsd dword [rsi], dword [rdi]
xlatb
push rsi
leave
mov bh, byte [rax - 0xc6220b4]
in eax, 0x6b
adc bh, byte [rcx]
cmp esp, edi
cmp esp, edi
cmp dh, 0x57
adc al, 0xfc
mov esi, 0xf9a97f26
loope 0x1400a0ace
invalid
mov ecx, esi
int1
test eax, 0x565b7aa0
xlatb
cmp esi, ecx
nop
mov dword [rax], esi
invalid
cmp byte [rcx], dl
mov byte [rbx - 0x40017504], cl
invalid
invalid
invalid
retf 0x9d8f
popfq
mov edi, 0x995d9f2c
cmpsd dword [rsi], dword [rdi]
int1
insd dword [rdi], dx
jge 0x1400a0b90
mov word [rbx + 0x45], cs
invalid
in eax, dx
mov ch, 0xce
push rsp
mov dh, bl
invalid
cmp cl, bh
sub r15d, esi
invalid
fild word [rbp + rdi*2 + 0x52]
cli
and al, 0xde
mov bh, byte [rdi]
invalid
outsb dx, byte [rsi]
or edi, edx
rcr ebp, 0x91
invalid
invalid
call qword [rdx*2 + 0x1e5f8af7]
inc dword [rcx]
add byte [rbx - 0x59417544], cl
push rax
cli
add dword [rsi - 0xe], ebx
jnp 0x1400a0c9a
add ah, byte [rsi + 0x37f1a705]
invalid
invalid
invalid
int1
sbb bl, byte [rsi]
pop rbx
pop rdx
add byte [rsi - 0x20], dh
in eax, dx
invalid
loope 0x1400a0c72
add esi, eax
movsb byte [rdi], byte [rsi]
sti
fistp word [0x1ad1f03f0]
insd dword [rdi], dx
xor eax, ebx
xor ecx, dword [rcx + rsi*2]
jle 0x1400a0cb9
ret
invalid
not byte [rdi + rdi*4]
cmp dword [rsi + 0x39cf49de], 0xffffff8c
inc byte [rax]
lahf
std
cmpsb byte [rsi], byte [rdi]
push rax
mov al, 0x4b
mov al, 0x79
invalid
push rsi
jnp 0x1400a0c9a
mov dh, 0x32
outsd dx, dword [rsi]
invalid
cmpsd dword [rsi], dword [rdi]
jmp 0xd08be9f6
test eax, 0x8e0a9243
add byte [r15 - 0x5f93e048], r10b
invalid
insb byte [rdi], dx
movabs al, byte [0x7d365ddd2ffb7e69]
invalid
xchg edx, eax
or cl, byte [rsi - 0x4768ffb9]
mov eax, 0x69a06c1f
jle 0x1400a0cc1
invalid
insb byte [rdi], dx
movabs al, byte [0x7d365ddd2ffb7e69]
add bh, byte [rcx + 0x79]
invalid
add bh, byte [rcx + 0x79]
jns 0x1400a0d48
jne 0x1400a0cb7
xchg edi, eax
outsb dx, byte ds:[rsi]
loopne 0x1400a0c66
push r9
sti
cwde
retf 0x1ecc
invalid
invalid
mov cl, 0xf9
nop
adc al, 0xf6
jne 0x1400a0ccd
ficom word [rdx]
retf
invalid
invalid
adc edx, dword [rdx + 0x6d30fd41]
mov esp, 0xf91d665a
jnp 0x1400a0d05
jp 0x1400a0d40
fdivrp st(6)
retf 0x1c26
clc
test byte cs:[rbx - 0x1b], 0xbe
xor cl, bl
or al, 0x35
invalid
hlt
xor eax, 0x8be7b1f4
jae 0x1400a0ccf
mov cl, 0xe7
mov esi, dword [rbx - 0x76]
invalid
popfq
xor edi, edx
sbb eax, 0x1e90de39
jge 0x1400a0d35
outsb dx, byte [rsi]
pop rdi
or byte [0x10e05332b], cl
mov ebp, edx
retf 0xaeea
and eax, 0xd9da1ca
lea r15d, [rsi - 0x6202d233]
imul esp, edx, 0xd2ce0fe8
sub ch, bh
hlt
pop r15
loopne 0x1400a0db0
invalid
invalid
add bl, byte [rbx - 0x67]
or rdx, rax
insb byte [rdi], dx
sub ah, byte [rdi]
or ah, byte [rdx + 0x28]
invalid
invalid
fisubr dword [rbp + 0x1917d03c]
sbb al, 0x50
out dx, eax
sti
out dx, eax
cmp byte [rsi - 0x5cca0e3], bh
jne 0x1400a0d94
mov ecx, 0xff9c5e5f
or eax, 0x34ada1c1
pop rdi
pop rsi
pushfq
dec dword [0x174b7af94]
or al, 0x18
invalid
loop 0x1400a0dfa
cmp eax, 0xee22183b
div eax
jnp 0x1400a0e16
xchg esi, edx
cmp byte [rdi + 0x4c9d76c6], cl
adc eax, dword [rbx - 0x610783a]
xchg edi, ebp
stc
xchg edi, ebp
stc
mov esi, 0x77f3a781
invalid
pop rax
insd dword [rdi], dx
test edx, esi
pop rsi
push rcx
fsub dword [rax]
mov ebp, 0x263c17a2
movabs byte [0x3f7aebe42d263c17], al
movabs byte [0x3f7aebe42d263c17], al
cmp dword [rsi], edx
fidiv word [rcx - 0x3e141184]
mov r12b, 0xfe
mov ah, 0xfe
push 0xffffffffb0487f89
cmp dl, bl
invalid
wait
sub esp, dword [rax]
int1
fmul st(6), st(0)
invalid
jrcxz 0x1400a0dca
fisub dword [rcx - 0x11]
movabs dword [0xb7ceda937d74f98b], eax
out 0x9b, eax
jae 0x1400a0eac
invalid
mov bl, 0xe6
stc
leave
invalid
cdq
push rbp
invalid
invalid
mov ds, word [rcx - 0x4a]
fsub dword [rsi + 0x61608244]
invalid
je 0x1400a0ebf
mov ecx, 0x4014f2df
invalid
adc esi, dword [rdi + 0x7bd78ede]
cli
sub al, 0x6f
fimul word [rsi + 0x2cfa7bd7]
outsd dx, dword [rsi]
in eax, dx
ja 0x1400a0f0a
invalid
iretd
pop rdi
push rdx
dec byte [rax]
out 0xa9, eax
and byte [rbx - 0x6f6270eb], ah
or ebp, dword [rdx]
invalid
cmp ebx, ebp
hlt
call 0x19ef1c885
mov esp, 0xadb12d0f
mov cl, 0xad
div dword [rdi - 0x48d08905]
mov edi, 0xe13880f7
fidiv word [rsi + 0x22f5a79e]
cmpsd dword [rsi], dword [rdi]
cmc
invalid
sti
jbe 0x1400a0f40
mov bh, 0xbf
test dword [rax - 0x49211ec8], 0x22f5a79e
cmpsd dword [rsi], dword [rdi]
cmc
invalid
cmpsd dword [rsi], dword [rdi]
cmc
and dl, byte [rdi]
invalid
invalid
test dword [rax - 0x4e], esi
push 0xffffffffffffffee
or al, 0x43
mov bh, 0x66
and byte [rsi - 0x64], ah
and byte [rsi - 0x64], ah
cmp dl, ch
int3
fsubr dword [rcx]
mov esi, 0xfb5e1c29
invalid
push rax
sbb dword [rcx], esp
mov al, 0x51
sbb dword [rsi + 0x6ffb9e73], ebp
jae 0x1400a0f0e
sti
outsd dx, dword [rsi]
jae 0x1400a0f0e
sti
outsd dx, dword [rsi]
invalid
lea ebx, [rbp - 0x3bf5e004]
mov esi, edx
invalid
hlt
shr byte [rcx - 0xf171834], 0x48
div dword [0x13164a8bf]
cdq
jbe 0x1400a0fa3
out 0xe8, eax
invalid
in al, 0xec
stosb byte [rdi], al
push rbp
adc dword [rbx + 0x6ba3c1], 0x41
movabs dword [0xff2dfedb6442cbd6], eax
invalid
invalid
invalid
invalid
invalid
invalid
jnp 0x1400a0f66
invalid
sub eax, 0x93a07bff
xchg ebx, eax
mov r10d, 0xb9fd850d
iretd
outsd dx, dword [rsi]
mov edi, 0x27bc8abe
push rdi
xlatb
mov edx, dword [rsi]
sti
sub dword [rbx - 0x62354cab], ecx
mov bl, 0xca
popfq
mov bl, 0xca
popfq
stc
mov ah, 0x52
jbe 0x1400a0fed
invalid
mov ebx, 0xe28943db
stc
invalid
iretd
xchg dword [rdx + 0x57], esp
jb 0x1400a1001
jg 0x1400a1006
mov ah, 0x12
jg 0x1400a0fc2
invalid
or byte [rsi], dh
mov bl, 0xdb
invalid
invalid
shr al, 0x7d
wait
xchg ebx, eax
jne 0x1400a0fdf
jle 0x1400a1012
sub ch, byte [rdi + 0x53ba76ff]
movabs al, byte [0x4dfb49ff2efca4a6]
movsb byte [rdi], byte [rsi]
cld
dec dword cs:[rcx - 5]
invalid
invalid
invalid
sbb eax, 0xfebffad9
invalid
jge 0x1400a1150
scasd eax, dword [rdi]
invalid
and ebp, ebp
dec ecx
sub dword [rdx], edx
enter 0xfffffffffffff2e9, 0xffffffffffffffad
pop rax
fild dword [rdi]
jno 0x1400a1108
outsd dx, dword [rsi]
js 0x1400a10ef
jmp 0xc555a306
test qword [r8], rsi
cld
push rcx
in al, dx
or eax, 0xe1b5899b
ror byte [rcx], 4
loope 0x1400a1177
movabs al, byte [0x2fa317cf2194605d]
ja 0x1400a10fa
invalid
and edi, ecx
invalid
cwde
mov al, 0xe9
int3
invalid
mov al, 4
jrcxz 0x1400a1193
stosd dword [rdi], eax
jp 0x1400a10b2
scasd eax, dword [rdi]
js case.0x140002106.113
pop rsp
cmp eax, 0x67786453
js 0x1400a1197
js 0x1400a1197
add eax, dword [rdx + 0x6c]
movabs eax, dword [0x30db656c74fddf63]
invalid
cmp dword [rdi + rdx*4], 0xf1fe7aad
invalid
adc ecx, dword [rax + riz*2]
out dx, eax
jmp case.0x140002106.108
xor edi, dword [rdi + 0x6e9f76ee]
xor dword [rbp + 0x44], edx
and eax, 0x17d76172
jl 0x1400a1139
sbb byte [rbp - 0x7e], bl
push rcx
jl 0x1400a116e
pop rbp
invalid
dec edi
mov edi, 0x8e30a40f
pop rcx
sub eax, 0xffae9a69
invalid
iretd
imul ebx, dword [rdx - 0x64e90052], 0x85ef5335
sub dword [rax - 0x56], esp
in eax, 0xc3
mov byte [rsi - 0x3a4f87fe], dh
int 0x5d
scasb al, byte [rdi]
push rdx
ja 0x1400a11db
push rbx
out dx, eax
test dword [rcx], ebp
invalid
stosb byte [rdi], al
movsd dword [rdi], dword [rsi]
rcr byte [rdx + 0x27], 0xcc
test ebp, eax
invalid
xchg edx, eax
invalid
pop rdx
invalid
invalid
in eax, dx
in al, 0xbf
cmc
mov ch, byte [0x130effab6]
invalid
invalid
cdq
fld qword [rcx]
invalid
je 0x1400a11ba
and eax, 0x8bfffd8a
jmp 0x1400a1200
dec dword [rbx - 0x7a34e315]
mov ebx, 0xd9274a4e
rol dword [rdx + rax*8], cl
xchg esi, eax
invalid
invalid
movabs r10, 0xb3ddcafd11917665
jle 0x1400a11e6
jbe 0x1400a1196
adc ebp, edi
retf 0xb3dd
invalid
push rbx
sub dh, byte [rcx - 0x58671f28]
xor eax, 0x334c424f
stosb byte [rdi], al
and ebx, dword [rsi]
jrcxz 0x1400a123d
invalid
invalid
fld st(2)
sbb byte [rsi], dh
out dx, al
xchg edi, eax
mov esp, 0x76e6ee4e
invalid
wait
push 0x7d
std
invalid
jne 0x1400a123e
invalid
std
pop rdi
invalid
adc al, 0x67
sub dl, dl
fild word [rsi]
je 0x1400a126e
push 0x67
imul edx, ecx, 0x78eafec
in al, dx
scasd eax, dword [rdi]
mov es, word [rdi]
push rcx
mov byte [rdx - 0x2c], al
jns 0x1400a125c
pushfq
and eax, 0x33f66dd9
sub ecx, edi
ror byte [rcx + rbp*2], cl
push rsi
or eax, dword [0x1a64ad19d]
rol dword [rsi - 0x11], 0xff
out dx, eax
invalid
xchg edi, eax
invalid
out dx, eax
call qword [rdi - 0x625fb52b]
in al, dx
and ebx, edi
stc
and dword [rdi + 7], ebp
outsd dx, dword [rsi]
invalid
cmp r10b, al
invalid
outsd dx, dword [rsi]
invalid
pop rdi
invalid