Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
insb byte [rdi], dx
invalid
invalid
add eax, 0x1ef67d0b
mov dh, 0xf5
sti
outsb dx, byte [rsi]
sbb ecx, dword [rbx + 0x7ef9ebce]
add ebx, ebp
rcl byte [rbx - 0x741a0b22], 0x7b
jge 0x1400a080f
jge 0x1400a080f
jge 0x1400a080f
jge 0x1400a0813
pop rbp
enter 0xffffffffffff8962, 0x6c
dec eax
call [rcx - 0x6aa96d8d]
cdq
jae 0x1400a07d1
push rsi
xchg ebp, eax
invalid
cdq
jae 0x1400a07d1
push rsi
xchg ebp, eax
add byte [rbp + 0x46], bh
xchg ebx, eax
and qword [r13 + 0x17], r9
call qword [rbx]
fistp word [rbx - 0x686f7349]
wait
mov bh, 0x8c
nop
xchg edi, eax
wait
mov bh, 0x8c
nop
xchg edi, eax
pop rcx
mov edi, edi
sar byte [rbp - 0x62], 1
invalid
loop 0x1400a085d
dec dword [rcx - 0x55850f19]
mov edi, esp
invalid
stosb byte [rdi], al
jg 0x1400a0836
jle 0x1400a085c
cli
invalid
std
dec byte [rdx]
invalid
mov ecx, 0x9671f151
cmp eax, 0xcee4b743
invalid
push 0xffffffffffffffdb
lahf
rdpmc
invalid
cmc
cmpsd dword [rsi], dword [rdi]
fild word [rcx - 0xe827185]
invalid
jge case.0x140002106.6
mov edi, 0xc58518b5
mov ch, 0x18
test ebp, eax
pop rax
clc
cmc
wait
pushfq
jae 0x1400a0915
jnp 0x1400a08e9
sar dword [rdi + 0x770676e4], cl
mov bl, 0xe0
cmc
invalid
out 0x3f, al
clc
invalid
add ah, byte [rbx - 0xddb6eca]
je 0x1400a08c1
xor byte [rsi + rbx], ah
cdq
jmp 0x1400a08ec
movsd dword [rdi], dword [rsi]
and al, 0x85
invalid
hlt
wait
sbb eax, 0xb08aaedb
invalid
cdq
xchg edi, eax
mov edi, 0x884ff0fe
invalid
sbb al, 0x7e
adc byte [rcx + rbp*8 - 0x426f13bc], ah
int 0x96
idiv byte [rbp + 0x74ec8ecd]
invalid
movabs eax, dword [0x31eef562dfae2653]
invalid
lahf
add edi, ebp
invalid
invalid
invalid
cwde
movabs al, byte [0xbff2bc0d29167bf0]
movabs byte [0x5f10c427886abd14], al
outsd dx, dword [rsi]
or byte [rbx], dh
jge 0x1400a0a22
push 0xffffffff8e88fd7e
invalid
jle 0x1400a09b9
mov byte [rsi + 0x5ddf1716], cl
invalid
movsb byte [rdi], byte [rsi]
add eax, 0x67ee5aad
push rax
or esi, dword [rsi]
or esi, dword [rsi]
or esi, dword [rsi]
invalid
fldenv [rbp + rax - 0x11810fee]
jg 0x1400a09c8
mov edi, 0x977ae39a
sub byte [rcx + 0x39d81985], dh
push rsp
leave
fstp qword [rcx]
pop rsp
or al, 0x58
adc dword [rax - 0x53], ecx
invalid
test dword [rdx - 0x6b], 0x1b330fa8
xchg edx, eax
xchg ecx, eax
clc
sahf
ret
rdpmc
sbb edx, dword [rdx - 0x3c61076f]
xor dword [rdx - 0x636c7f73], ecx
lea eax, [rax - 0x3f4636d]
lea eax, [rax - 0x3f4636d]
pop rsp
mov ah, 0x7b
or dword [0xc5d9ff00], edi
test dword [0xf56b520c], ebx
call qword [rax]
and al, 0xde
cdq
rol ecx, cl
in al, dx
clc
pop rsi
call 0x1b52268bc
test byte [rdx + 0xb], bl
and bh, ch
mov bh, 0xe2
sbb eax, 0x11814af5
adc al, 0xe
neg byte [rbx]
pop rsi
jge 0x1400a0a9f
test byte [rax + rsi*4], dh
xchg rsi, rax
sti
invalid
shr byte [rax + 0x43], cl
and al, byte [rcx]
invalid
mov gs, esi
xchg esi, eax
mov al, 0xef
jmp 0x1400a0a4f
mov bl, byte [rdi - 0x4f]
mov byte [rsi + 0x67], al
cmp edi, edi
invalid
add al, 0x34
mov bh, 0x60
adc eax, 0x83a1ecfd
cmp al, 0x6d
pop rdi
push rsi
movsb byte [rdi], byte [rsi]
mov bl, 0xa
adc byte [rax], ah
pop rdi
sbb byte [rdi], bl
int 0x2c
sub al, 0x6a
xchg edi, eax
sub al, 0x6a
xchg edi, eax
invalid
mov eax, 0x9c79d3d4
mov cs, ecx
invalid
xor bh, byte [rsi - 0x23]
mov dword [rdi], edi
hlt
sbb dl, bl
sbb byte [rsi + 0x1739fc68], dh
cmp dword [rdi], edx
add ah, byte [rsi]
lodsb al, byte [rsi]
invalid
jmp 0x1400a0b55
and r12, r11
out dx, eax
scasb al, byte [rdi]
lodsd eax, dword [rsi]
invalid
mov edi, dword [rdi]
mov dl, 0xbf
xchg edi, eax
sub al, 0xd6
ror bl, cl
cmp eax, dword [rax + rcx*8]
cmp al, 0xfc
cld
jg 0x1400a0b53
invalid
jnp 0x1400a0b3d
out 0xdf, eax
jne 0x1400a0b18
fbstp tbyte [rbp - 0x41]
cmp edx, ebx
ja 0x1400a0b1c
invalid
jno 0x1400a0b0e
sub ebx, ebx
jbe 0x1400a0ba6
adc al, 0xc8
and byte [rbp + rbx*4 + 0x42], bh
invalid
add byte [rsi + 0x26], 0x6e
inc byte [rbp + 0x7d711a7]
xor esi, dword [rsi + 0x3c]
cmp eax, 0xc31224a7
invalid
invalid
shr dword [rbp + 0x358beffb], 0x30
enter 0xffffffffffffd4c8, 0xffffffffffffffd8
rol byte [rdx - 0x1a15e955], cl
invalid
sti
out dx, eax
mov esi, dword [0x114d2d3e0]
fcom st(2)
invalid
loope 0x1400a0c02
sar r9, cl
jnp 0x1400a0b51
mov edi, 0x852f682d
xchg ebp, edi
mov esp, 0x727de34d
xchg esi, eax
fild word [rax + riz*8 + 0x33]
cmpsb byte [rsi], byte [rdi]
mov dl, 0xd9
push 0xfffffffff7df2ebf
cli
out dx, al
jge 0x1400a0c0b
jp 0x1400a0c49
adc al, 3
adc al, 3
movabs dword [0x49f15546adc6109b], eax
mov ebp, 0xfe56b1fd
invalid
pushfq
invalid
mov edi, edi
test eax, 0xcbd125db
sbb byte [rsi*4 + 0x14ffe4ff], ch
call qword [rdi + rbx*4]
mov ch, 0xff
in al, 0xff
call qword [rdi + rbx*4]
call qword [rdi + rbx*4]
scasd eax, dword [rdi]
invalid
invalid
popfq
retf
push rcx
xor ch, bh
sbb dl, byte [rbx + 0x47ea9e52]
jle 0x1400a0c61
invalid
and byte [rdi], al
jle 0x1400a0bf5
invalid
adc ebx, dword [rcx + 0x4545ffe3]
jp 0x1400a0c54
jmp rdx
loop 0x1400a0c7d
nop
sbb dl, byte [rbp + 0x7a]
jp 0x1400a0c24
mov edi, edi
mov r9b, byte [rax - 0x75]
jp 0x1400a0c24
mov edi, edi
mov r9b, byte [rax - 0x75]
mov esi, dword [rbx]
mov dh, byte [0x17495cb7f]
mov dh, byte [rsi]
adc al, 0x54
push rsp
xor ecx, dword [rdx - 0x7440e9cb]
xor al, 0x8a
adc al, 0x54
push rsp
imul ebx, dword [rcx], 0xee19cae3
and byte [rax], bh
cmp byte [rcx - 0x2b], ch
cmp sil, r15b
push rdi
cmp byte [rcx - 0x2b], ch
cmp sil, r15b
push rdi
fdivr dword [rdx + rdi + 0xf5a014d]
cmp cl, byte [rbp + 1]
pop rdx
jl 0x1a758168e
mov word [rdi], es
or cl, byte [rsi + 0x67]
mov al, 0x97
je 0x1400a0c89
xchg ebp, eax
int1
insb byte [rdi], dx
or eax, 0xa548633
push rsp
or dl, byte [rbx - 3]
push rsp
or dl, byte [rbx - 3]
mov esp, dword [rcx]
test al, 0x95
push 0x657fb823
add dh, cl
add dh, cl
xor byte [rcx - 0x2a9dbfbf], dl
xchg ebp, eax
fld xword [rbx]
scasd eax, dword [rdi]
mov al, 0x66
stosd dword [rdi], eax
xchg ecx, eax
jg 0x1400a0c57
invalid
pop rsi
invalid
fsubr qword cs:[rdx - 6]
invalid
in eax, dx
pop rsi
ja 0x1400a0d3c
stosd dword [rdi], eax
push rax
faddp st(3)
lahf
cmp eax, 0xa3ca941d
mov edx, 0x76937243
jmp 0x1400a0c9f
out 0xff, eax
invalid
test eax, 0xc960bf7e
movabs eax, dword [0x9a8eb55e29320189]
invalid
int3
invalid
invalid
loope 0x1400a0d4a
mov cl, 0xe7
mov esi, dword [rbx - 0x76]
invalid
retf
sub al, 0x3e
jns 0x1400a0dd6
sub dword [rax + 0x4f], esp
cmp ch, byte [rax + rdi*2 - 0xa780fce]
and eax, dword [rax - 0x35]
invalid
iretd
invalid
int 0x8c
adc dword [rbx], esi
cmp eax, 0xe3832647
and ebx, 0x37
and ebx, 0x37
invalid
sbb eax, 0x3837768c
invalid
xchg ebx, eax
outsb dx, byte [rsi]
add dword [rdi + 0x1d], 0x688c2c2a
sbb eax, 0x688c2c2a
sbb eax, 0x688c2c2a
fucompi st(6)
div eax
jnp 0x1400a0d8d
mov ch, 0xe4
out 6, al
or eax, 0xcb6e2565
invalid
xchg edi, ebp
stc
mov esi, 0x3a22f56
add ebx, dword [rbp - 0x27]
invalid
jo 0x1400a0d93
invalid
sbb dl, byte [rdx]
adc al, 0xf4
movabs al, byte [0xebee7cb1181960fa]
jns 0x1400a0e1e
or byte [rsi + 0x75], bl
fisub dword [rdx + rdx*2 - 0x26]
invalid
or ah, byte [rsi - 0x3d]
mov dword [rdx - 0x309801d0], esp
cli
invalid
invalid
xor dword [rdx], 0xffffffc2
fdivr dword [rdx - 0x2275c36e]
dec byte [rdx - 0x762f59d3]
jns 0x1400a0e07
invalid
mov esp, 0xa8efd3fe
jmp 0x1400a0e3b
invalid
invalid
and bh, al
test al, 0x17
adc al, 0x28
invalid
sbb eax, 0x7f94fd87
movabs dword [0x8bcba8919e311f53], eax
push rcx
or esp, dword [rax + 0x30]
pop rbx
mov esp, dword [rdi + 0x78e09752]
fld qword [rbx + 0x60d0de7f]
cdq
adc esp, dword [rsi]
lea ebp, es:[rcx]
lea ebp, es:[rcx]
xchg edx, eax
rcr dword [rax - 0x5a], cl
ret
loop 0x1400a0e31
pop r10
push rax
sahf
and al, 0x4d
outsb dx, byte [rsi]
mov edx, 0x9d424b68
invalid
xchg byte [rsi - 0x54], dh
outsb dx, byte [rsi]
invalid
vpand xmm2, xmm12, xmm5
cmp byte [rbx + 0x43831e33], bh
pop rbp
lodsd eax, dword [rsi]
fldenv [rdx]
pop rsp
push rdi
or ebx, dword [rcx]
int3
cmp ebx, ebp
hlt
xchg edi, eax
sbb byte [rcx - 0x7a43a119], bh
in al, dx
push rdi
xor al, 0xb2
mov byte [rdi + rdx*8], dh
invalid
mov bh, 0xbf
div dword [rax - 0x5f77cf9e]
sub edi, dword [rax + 0x13]
js 0x1400a0f2f
js 0x1400a0f2f
movsx edi, byte [rcx]
jnp 0x1400a0f11
cmc
loope 0x1400a0ed8
adc eax, dword [rsi]
invalid
add dword [rdi + 0x4c], edi
and dword [rax + rdi - 0x20141269], 0x85da17f9
invalid
stc
invalid
fiadd dword [rbp - 0x29935aa2]
cmp byte [rdi - 0x6201413], dl
invalid
invalid
push rsi
movabs al, byte [0xeff5fe7bf31777ea]
jnp case.0x140002106.85
cmc
out dx, eax
jnp case.0x140002106.85
cmc
out dx, eax
add ch, byte [rdi + rcx*2]
and eax, 0x914ed938
jl 0x1400a0f4c
xor edi, 0x74924bef
invalid
fist dword [rdi - 0x557e46fc]
or dword [rsi], 0x54585570
sti
out dx, eax
jl 0x1400a0f34
invalid
mov dword [rsp + rdi*2 - 0x5b], ecx
mov dl, 0xde
mov dh, 0x8c
invalid
test eax, 0x799eb017
push rbp
std
invalid
shr dword [rsi - 0xf], 1
pop rax
mov ebx, dword [0xd3bd1bc3]
shr dword [rdi], 0xc9
and dword [rdx - 0x7c309009], ecx
invalid
mov word [r11 + rdx*8], ds
iretq
push 0x6623e5d
lodsb al, byte [rsi]
scasd eax, dword [rdi]
stosb byte [rdi], al
hlt
cmpsb byte [rsi], byte [rdi]
test eax, 0xda2478db
shl byte [rdi - 0x2b], cl
or al, 0xf8
test byte [rsi - 0x3dcaa21], bl
cld
cld
invalid
shr dword [rbx - 0x44], 0x44
invalid
jns 0x1400a1078
scasb al, byte [rdi]
or eax, dword [rsi + 0x547a6365]
loope 0x1400a1083
invalid
invalid
retf 0x9fa0
invalid
movabs eax, dword [0x7b97f0261826229f]
lahf
and ah, byte [rsi]
sbb byte [rsi], ah
invalid
sar byte [rdi], 0x1a
mov ebp, 0xd8da603a
enter 0xffffffffffffa7af, 0x53
pop rsp
je 0x1400a10ef
jmp rcx
stc
invalid
mov bh, 9
xor esi, dword [rcx]
outsd dx, dword [rsi]
out dx, al
sub byte [rax], ah
in al, dx
invalid
outsb dx, byte [rsi]
mov dh, byte [rdx + 0x1ef3ee01]
mov esi, 0x939cec11
stosb byte [rdi], al
mov ecx, 0xf31983b0
adc byte [rax], bh
imul ebp, dword [rsi], 0x62
ret
invalid
adc edx, edx
mov dword [rbx], edi
wait
fsub qword [rbp + 0x439a98bc]
int1
int1
int1
mov edi, dword [rax - 0x32]
loop 0x1400a10f9
mov esp, 0x918b0e27
out dx, eax
lahf
sti
mov byte [rsi - 0x1853bbd], 0xf1
invalid
int1
outsb dx, byte [rsi]
in al, dx
lodsd eax, dword [rsi]
cmp esp, 0x426a10b4
sbb ecx, 0x7c4817d7
movabs eax, dword [0x69514cdbe79fdf86]
fistp word [rdi + 0x514cdbe7]
invalid
fistp word [rdi + 0x514cdbe7]
imul eax, ebx, 0x38674a67
stosb byte [rdi], al
sal ecx, 1
jp 0x1400a1171
ret
push rsp
rol word [0x18884e505], 0x3e
add eax, 0x487ad381
sub ebp, ebp
add eax, 0x487ad381
sub ebp, ebp
sub eax, 0x7f11cda7
cmp eax, 0x6061acb8
cdq
enter 0xffffffffffffcd10, 0xffffffffffffff8e
test byte cs:[rsi + riz*2], cl
mov esi, 0x623998ab
cli
add eax, 0xcd933344
adc al, 0x3f
push qword [rdx + rdx*8 + 0x6e]
fldcw word [rdi - 6]
mov edi, 0x857c7f17
jg 0x1400a122e
test dword [rbx], ebx
jnp 0x1400a11f6
jg 0x1400a122e
test dword [rbx], ebx
jnp 0x1400a11f6
invalid
invalid
invalid
push rsi
xchg dword [rdx + rbx*8 + 0x24], eax
cmp byte [rcx - 0x332bfb46], ch
fisub dword [rax + rdi]
test eax, 0xccd404ba
jbe 0x1400a11b9
mov edx, 0x1ceb8bff
mov spl, 0xc9
dec dword [rbx - 0x4bbde315]
leave
cld
shr dword [rbp - 0x39], 0x5b
jp 0x1400a11f6
movsb byte [rdi], byte [rsi]
invalid
add cl, byte [rsi]
or ebx, dword [rdi + 0x47597b69]
sbb esi, dword [rcx - 0x5a1a00a]
pop rsi
cli
pop rsi
cli
pop rdi
xchg dword [rsi + 0x6143e2bf], eax
add byte [rcx + 0x1e], cl
adc eax, 0x5aed1ca9
jge 0x1400a1242
int1
out 0x3c, al
xchg ebp, eax
and eax, 0xd749d47b
and edx, 0xffffffbb
insd dword [rdi], dx
movabs r12, 0x2efe4fdf40260fff
fisttp word es:[rdi - 2]
rcr byte cs:[rsi + 0x13], cl
fisttp word es:[rdi - 2]
rcr byte cs:[rsi + 0x13], cl
adc ebp, dword [rbx + rsi + 0x6e1abaf6]
std
mov edx, 0x62ac0b1d
invalid
lodsb al, byte [rsi]
invalid
jrcxz 0x1400a11d5
lodsb al, byte [rsi]
xor esi, esi
mov edx, 0xbafd6e1a
sbb eax, 0xe362ac0b
invalid
lodsb al, byte [rsi]
invalid
jrcxz 0x1400a11d5
or ebp, dword [rdx + riz*2 + 0x1ee998e3]
cmp byte [rdi - 0x414e68a5], bl
jmp 0x19ba94a60
xchg edi, eax
mov cl, 0xbe
in al, 0x28
add byte [rdx - 0x39], dl
invalid
invalid
or cl, byte [rsp + rdx + 0x16]
jge 0x1400a12a6
jge 0x1400a1213
or bl, byte [rdx - 0x3105e851]
invalid
invalid
push 0x2e
cmp eax, 0xffaeef7b
invalid
jnp 0x1400a1305
sub dh, dl
mov edi, 0x3938e258
adc dword [rsi + 0x67429aa0], esi
ror dword [ecx], cl
ror dword [ecx], cl
wait
pop rbx
ficom dword [rdx - 0x727eec2f]
invalid
leave
mov cl, 0x3d
adc eax, dword [rcx + 0x3db1c98d]
lea edi, [rsi + rbp - 0x65]
invalid
mov edi, 0xce88fa07
invalid