Function at 0x140001fb0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x1400020c4
mov rsi, rcx
call fcn.140002160
test al, al
je 0x1400020cd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x1400020c4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x1400020b3
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1400020aa
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x1400020bd
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x1400020bd
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x1400020bd
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x1400020bd
mov rcx, rbx
call fcn.1400021b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020e0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002136
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140002123
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001ea0
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
jp 0x1400a2927
cmpsd dword [rsi], dword [rdi]
leave
sub eax, 0xefbc02b5
xchg rsi, rax
movsq qword [rdi], qword [rsi]
jbe 0x1400a2936
invalid
test dword [rax - 0x4b41f48f], edi
invalid
pushfq
sti
add al, byte [rsi + 0x75e6db01]
movabs byte [0x125a0804049f711d], al
sbb eax, 0x4049f71
or byte [rdx + 0x12], bl
call [rbx + 0x5f]
jns 0x1400a2994
invalid
xor byte [rbp + 0x3b], bh
invalid
imul eax, dword [rax], 0xf73bf629
in al, dx
jmp 0x1400a298b
outsb dx, byte [rsi]
retf
ror byte [rbx - 0x508a758d], 0x37
invalid
jae 0x1400a2919
mov dh, byte [rbp - 0x51]
jne 0x1400a2940
invalid
invalid
push 0x73
mov esp, 0x54baefd8
invalid
or byte [rsi + 0x767af0f3], al
pop rdi
xor ah, byte [rcx + 0x31]
jns 0x1400a29c9
in eax, 0x13
pop rsi
invalid
test al, 0x17
and edi, ebx
sti
sti
invalid
stosb byte [rdi], al
xchg byte [rcx + 0x71], al
test byte [0x1a22b0c02], dh
invalid
invalid
mov byte [rax], al
je 0x1400a2a19
push rsi
invalid
lodsd eax, dword [rsi]
int1
sbb esp, dword [rsi - 0xc]
jge 0x1400a298d
jmp 0x16ec2e562
in eax, 0x2e
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword cs:[rsi]
xchg edi, eax
movabs al, byte [0x5eaa547b108c3d2e]
mov word [rax], ss
jnp 0x1400a2a71
stosb byte [rdi], al
pop rsi
outsd dx, dword [rsi]
popfq
mov bh, 0xa5
cmp ebp, edi
mov ah, 0x8a
sbb eax, 0x52142a5f
push rdx
adc al, 0x52
push rdx
sbb edx, dword [rsi + 0x17]
xor al, 0xf
xor al, 0x1f
imul ebx, dword [rax + 0x1026b709], 0x15e90690
jmp 0x157800356
adc eax, dword ss:[rsi + 0x731c7ef1]
loop 0x1400a29e9
jmp 0x157800356
xchg cl, dh
jle 0x1400a2a63
jae 0x1400a2a2b
lahf
xlatb
sub eax, 0x35364b61
sti
invalid
jns 0x1400a2a12
invalid
mov edi, 0x68d67dbb
xor bl, bh
push 0xfffffffffffffff9
or dword [rbp - 0x14], eax
mov esp, 0x5282a527
lodsb al, byte [rsi]
invalid
invalid
movsd dword [rdi], dword [rsi]
invalid
sbb ebx, dword [rsi - 0x7c]
mov esi, 0xdd305226
jne 0x1400a2a98
insd dword [rdi], dx
jge 0x1400a2a13
jle 0x1400a2a43
jle 0x1400a2a43
xchg byte [rbx], dl
invalid
adc esp, dword [rbp + 0x36]
invalid
cli
in eax, dx
je 0x1400a2a2b
jmp 0x19ca44f38
or edx, dword [rax]
cmp dh, byte [rdx - 0x4f86dad5]
leave
jrcxz 0x1400a2a8f
out dx, al
clc
pop rcx
invalid
pop rbx
invalid
call 0x132e7bf6a
sub esi, dword [rdi - 0x4c]
cmpsb byte [rsi], byte [rdi]
ret
adc cl, byte [0x13491d3fe]
cmp edx, dword [rbx]
wait
invalid
invalid
cwde
invalid
stc
stc
invalid
pop rbx
out dx, al
xchg esp, eax
sbb eax, edx
sbb esp, 0x12fedddb
mov edx, 0x8c4ccc48
invalid
invalid
invalid
invalid
cli
xor esp, dword [rcx + 0x7b]
call 0x1570e6760
popfq
jmp 0x1400a2b87
adc byte gs:[rdx + 0x7ecf8a3f], bl
imul dword ds:[rax + rbp*4 + 0x5fba9a9]
invalid
jle 0x1400a2bca
imul dword [rax + rbp*4 + 0x5fba9a9]
int3
sal ebp, 1
imul edx, dword [rbp + 0x2c8914ed], 0x265421af
imul eax, eax, 0x4a
jmp 0x1400a2b8a
xchg r9d, eax
jbe 0x1400a2be1
sahf
adc byte [rdi - 0x5c], dh
xor eax, dword [rsi - 0x5a752f53]
and eax, 0x3edb953b
push rax
cmp ebx, edi
enter 0xffffffffffffe2a6, 0x5f
sbb edx, edx
cmp al, ah
adc ebx, dword [rdi + 0x7a16bfd7]
sub edx, dword [rdi]
insb byte [rdi], dx
shl qword [r15 + r12 + 0x489014b5], 1
mov ecx, 0x1d18578c
mov word [rdi + 0x18], ss
sbb eax, 0x214c7713
invalid
adc al, 5
xchg dword [rdi - 0x25da8e09], esi
mov ch, 0xcf
cmp ch, bh
mov ch, 0x14
nop
movabs rcx, 0x214c77131d18578c
mov word [rdi + 0x18], ss
sbb eax, 0x214c7713
mov word [rdi + 0x18], ss
sbb eax, 0x214c7713
invalid
mov esi, dword [rdx - 0x6c]
pop rbp
invalid
invalid
push rcx
lodsd eax, dword [rsi]
and bh, al
lodsd eax, dword [rsi]
pop rbp
or dword [0xc510f943], edi
nop
in al, dx
pop rbp
xchg esp, eax
std
test dword [rbx + 0x42448421], ecx
sahf
sahf
je 0x1400a2c40
mov dl, 0x99
sahf
cmpsd dword [rsi], dword [rdi]
idiv esi
out 0x47, al
jp 0x1400a2c43
stosd dword [rdi], eax
adc byte [rsi], ch
xor ecx, dword [rdi + 0x1234b20b]
stc
movabs dword [0xaba705de811447d7], eax
adc al, 0x81
fiadd word [0xcf7ed7f1]
xlatb
adc al, 0x81
adc al, 0x81
adc al, 0x81
sbb esi, 0x74aba705
invalid
fiadd word [0xcf7ed7f1]
cli
invalid
xor dword [rax + 0x7d9572c3], esi
sbb al, 5
loope 0x1400a2bf3
cmp al, 0x2d
jbe 0x1400a2ce0
fldenv [rdx - 0x4e5d37be]
movsb byte [rdi], byte [rsi]
movabs dword [0x9fa6e14ff98af78b], eax
lahf
lahf
invalid
movabs byte [0xbee776d0f8ece2f5], al
add ebx, dword [rsi + 0x60]
mov bh, cl
fnstsw word [rax + rcx*8]
mov edi, 0x8af28bfc
hlt
loopne 0x1400a2d29
mov dl, 7
jnp 0x1400a2ca5
xchg byte [rdi + 2], ch
lahf
movabs eax, dword [0x538ab090a2369a4b]
invalid
xchg edi, eax
push rdx
xchg r12, rax
std
call qword [rsi + 0x71818188]
ja 0x1400a2cd9
mov cl, 0xd6
or dword [rbp + 0x48990025], esp
invalid
cdq
invalid
add byte [rcx - 0x75e4b4b8], bl
sbb eax, 0x97a87bf0
sbb rcx, qword [r10 - 0x57840fe3]
xchg edi, eax
mov esi, dword [rax]
mov bl, byte [rsi + 0x7f]
sbb eax, 0x2c9be757
invalid
invalid
invalid
shr byte [rax - 0x5bd14498], 1
test byte [rdx + 0x3a6ed86f], 0x2c
cmp ch, byte [rsp + rbx*8]
popfq
jg 0x1400a2d1d
adc edi, ecx
cmp ch, byte [rsp + rbx*8]
sub al, 0xdc
popfq
jg 0x1400a2d1d
adc edi, ecx
xor dword [rdi - 0x67], ebp
mov dl, 0xb6
std
fisttp dword [rbx + rcx*2]
out 0x3d, eax
cmp eax, 0x971eca80
cmp eax, 0x971eca80
jp 0x1400a2cc9
jrcxz 0x1400a2ceb
je 0x101b29d63
fucomi st(6)
out dx, al
sbb al, 0xd2
scasd eax, dword [rdi]
movabs dword [0x2da696a19d0e94fd], eax
sahf
popfq
movabs eax, dword [0xfb5c455c9e2da696]
pop rsp
pop r12
sti
invalid
iretd
add bh, byte [rsi]
invalid
fdiv qword [0x1054544f0]
or edx, ebx
invalid
xchg esp, eax
out 9, al
xor dword [rbx], edi
outsb dx, byte [rsi]
or al, 0x97
out dx, al
xlatb
mov edx, dword [rbp - 0x3f]
mov esi, dword [rbx - 0x5e]
jae 0x1400a2d52
jae 0x1400a2d52
fidivr dword [rdi]
int 0x15
invalid
and dl, bh
xchg edx, eax
add bl, byte [rsi]
jge 0x1400a2d58
pop rbx
sub dword [rsp + rdi*2 + 0x3b], ebp
mov edi, 0xb1e7d65b
retf
invalid
invalid
xchg edi, eax
cli
xor dl, byte [rdx]
retf
adc cl, bl
invalid
invalid
invalid
outsw dx, word [rsi]
insb byte [rdi], dx
movabs al, byte [0x96fd89bde9ceaf04]
invalid
int 0x6b
jae 0x1400a2def
cmp dword [rax], r13d
jns 0x1400a2eaa
mov dl, 0xb5
jp 0x1400a2dfc
rcl edi, 0x71
sbb al, 0x3c
jo 0x1400a2dd6
xlatb
jno 0x1400a2e5a
cmp al, 0x70
xchg ebp, eax
add al, 0xf4
cmc
cdq
lahf
sub eax, 0x4fc44291
push rsi
int1
invalid
jo 0x1400a2e7a
fsub qword [rdi]
jnp 0x1400a2e81
xchg ebx, eax
out 0x47, eax
mov ebx, dword [rdi + rdx*4]
pop rbx
imul ecx, dword [rdx - 0x4e4d14d4], 0xffffffde
invalid
fld qword [rax]
jne 0x1400a2eb1
mov ds, word [rdi]
jo 0x1400a2e3a
and byte [rax + 0x65112ac7], al
add al, 0xa1
xor byte [rsi + rcx*4 + 0x53], cl
and dh, byte [rsi]
mov bl, 0x13
movabs byte [0x84ee7d8f6a9c5759], al
pop r9
rcr byte [rbx], cl
push rcx
add ebp, dword [rax - 0xca07373]
jns 0x1400a2eaf
adc esp, dword [rdx + 0x6a9c5759]
invalid
mov esp, dword [rcx + 0x3d16a38a]
jg 0x1400a2e9b
movabs dword [0x5ab43037fb7f3d16], eax
mov eax, 0xc6b4b4bb
xlatb
invalid
invalid
retf
jno 0x1400a2ecb
sbb dword [rdx + 0x6680e13b], ebp
xchg edi, eax
push rcx
stosb byte [rdi], al
cmp esp, ecx
and byte [rsi - 0x69], 0x43
push rcx
cmp ebp, eax
or eax, 0x2dfbb5bf
mov ecx, 0x7629ee60
out dx, al
sub dword [rsi - 5], esi
out dx, al
sub dword [rsi - 5], esi
hlt
or dh, byte [rsi + 0x31]
jp 0x1400a2f0f
xchg edx, eax
push 0xffffffffb8d947f4
jb 0x1400a2ef5
jbe 0x1400a2f20
rcl byte [rdi - 0x2e]
mov ch, 0xc5
xor eax, dword [rsi + rdx*8 + 0x79309158]
pop rax
xchg ecx, eax
xor byte [rcx + 6], bh
pop rax
xchg ecx, eax
xor byte [rcx + 6], bh
cmpsd dword [rsi], dword [rdi]
push rdx
stc
invalid
sub byte [rcx], dl
and ebp, dword [rbp + 0x1f]
invalid
mov bl, 0xd1
inc ch
and dword es:[rax], esi
xchg esp, eax
enter 0xffffffffffffb168, 0xfffffffffffffffe
invalid
fdiv st(5), st(0)
adc al, 0xfd
leave
invalid
mov bh, 0xe
cmpsb byte [rsi], byte [rdi]
invalid
pop rsi
xor ebp, edi
jmp 0x1400a2eec
stosb byte [rdi], al
push rbx
adc esi, ebp
adc al, 0x76
stc
jbe 0x1400a2f1b
mov edi, edi
sbb dword [rbx + 0x20548a75], ecx
not dword [rcx + 0x69]
xor byte [rsi + rbp*8], ch
test eax, 0xbe8b3176
fisttp word [rdx - 0x43840f40]
jg case.0x140002136.67
retf 0x5382
xchg ebp, eax
or al, 0x8b
invalid
outsb dx, byte [rsi]
add eax, 0x7433bd1c
je 0x1400a2f5f
je 0x1400a2f5f
cld
pop rbx
retf 0x642d
and byte [rcx - 0x54], ch
pushfq
in al, 0x66
popfq
enter 0xffffffffffff9d03, 0xffffffffffffffb6
adc byte [r10 - 0x146b072d], r12b
invalid
popfq
mov dh, 0x45
adc byte [rdx - 0x146b072d], ah
invalid
jmp 0x1400a2f89
push qword [rbx + riz*4 - 0x25]
out dx, eax
jl 0x1400a2f16
sub cl, byte [rdi]
or eax, 0x9a8078f5
or bl, byte [rbx - 0x16a50bb4]
wait
hlt
pop rdx
jmp 0xed993be5
and ecx, dword [rdx + 0x5b]
wait
hlt
pop rbx
push rbx
add edi, dword [0xc25f2dc1]
xchg ebx, eax
mov dl, 0xb6
cmp dword [rax + 0x23308990], esi
invalid
and edx, dword [rdi - 0x4d]
invalid
push rdi
mov bl, 0xe
sahf
jl 0x1400a2f80
mov ecx, 0xc20487c1
adc eax, 0xfc968a62
xchg dword [rdx - 0x13], esi
jb 0x1400a2fb5
jb 0x1400a2fb5
std
cmp dword [rbp - 6], edi
mov ebp, dword [rdx - 0x4cf5376]
fstp dword [rbx]
pushfq
mov ecx, 0x75ee3e83
cmp dword [rsi], 0xffffffee
jne 0x1400a3021
jmp 0xfd8a1b55
cmp dword [rsi], 0xffffffee
jne 0x1400a3021
jmp 0xfd8a1b55
loope 0x1400a3050
call [r13 - 0x625101f9]
invalid
adc al, 0xe4
invalid
add byte [rcx + rdi*4 + 0x54], bl
fistp word [rax + 0x68]
xchg esp, eax
invalid
add ebp, dword [rbx + 0x11]
or al, 0xe9
cmc
movsd dword [rdi], dword [rsi]
cli
sti
push 0x1f062d2b
invalid
pop rbp
pop rax
mov word [rdx + 0xa], fs
ret 0xbbb2
mov r12b, r15b
sub byte [rax], dl
js 0x1400a3020
mov edi, 0xf13f1b42
in al, dx
lodsb al, byte [rsi]
std
and eax, ebx
jbe 0x1400a30c2
scasb al, byte [rdi]
cwde
push rax
invalid
jno 0x1400a30a5
mov ecx, 0x6ee07bc8
jae 0x1400a30c1
cmp ecx, dword [rcx - 0x4d]
mov ah, 0x6b
rol byte [rsi + 0x19], 0xf6
mov cl, 0xc6
invalid
insd dword [rdi], dx
jnp 0x1400a3002
invalid
sbb qword [rax + 8], r11
invalid
invalid
invalid
lodsd eax, dword ds:[rsi]
adc al, 0xa8
adc al, 0xf7
wait
push rcx
jmp [rdi - 0x63]
call 0xdb2ae0e7
insb byte [rdi], dx
cli
not dword [rbx]
adc ebx, dword [rdi + 0x6dae5377]
lahf
ja 0x1400a3118
scasb al, byte [rdi]
insd dword [rdi], dx
mov al, byte [r15 + 0x4b477e66]
invalid
invalid
xor cl, byte [rbp + 0x19]
invalid
invalid
lahf
pop rbp
std
mov eax, dword [rsi - 0x6f]
xchg ecx, eax
add ch, byte [rdi + 0x39]
invalid
movsb byte [rdi], byte [rsi]
adc eax, 0x5f8bf38a
movsd dword [rdi], dword [rsi]
sub al, 0x2d
mov ss, word [r14]
cmp ebp, esp
push rsp
sub ecx, dword [rcx + rbp - 0x6e]
invalid
mov dl, 0xba
clc
add r9d, dword [r14]
invalid
invalid
adc ch, 0x8b
cdq
xchg edi, eax
and bl, ah
movabs byte [0x12638dd075f6fde4], al
invalid
mov edx, 0xaf2617f7
mov ebx, 0xbe62ad33
mov al, 0x53
jl 0x1400a3198
invalid
jmp 0x1343a9e08
xor ecx, dword [rax]
invalid
invalid
out 0xd1, eax
cmp al, 0x46
rcl byte [rbx]
and al, 0xe8
iretd
test dword [rsi + rsi*8 - 0x54026162], 0xde075f12
cmc
pop rsp
invalid
mov fs, esi
jno 0x1400a3248
stc
sub byte [0x6d7eeafe], cl
sub eax, 0xede3f897
jb 0x1400a32b4
imul ebp, dword [rax], 0xffffff82
add eax, 0x4385e1e3
jrcxz 0x1400a322f
test dword [rbx + 0x66], eax
in eax, 0xef
sub byte [rdx - 0x7a1e1cfb], al
in ax, 0xef
jrcxz 0x1400a322f
test dword [rbx + 0x66], eax
in eax, 0xef
cmp al, 0x8a
invalid
cmpsd dword [rsi], dword [rdi]
xchg esi, eax
out dx, eax
invalid
jmp qword [rax + rbp - 0x63]
adc eax, 0xf435ec81
and dh, byte fs:[rsi - 0x2576aff7]
in al, 0x3f
retf
pushfq
jmp [rcx - 0x1824448c]
insb byte [rdi], dx
jns 0x1400a32c8
rcr cl, 1
mov ecx, 0xa3b45237
wait
invalid
call 0x153327210
cmp dword [rdi], 0x2f
invalid
invalid
adc eax, 0xa9d25181
out 0x65, al
xor dh, byte [rbx - 0x2a]
ja 0x1400a32b4
adc eax, 0xd88b4f7a
or dl, bpl
sub qword [r11 + r15 - 0x2513443], rbx
pushfq
cmp edi, dword [rbp + 0x53fdaecb]
pushfq
cmp edi, dword [rbp + 0x53fdaecb]
call 0x129702559
retf
cmp byte [rsi + 0x23], 0xd4
outsb dx, byte [rsi]
mov edi, ecx
xchg edi, eax
hlt
pushfq
mov ebp, 0x3afc34cd
sti
invalid
mov edi, 0x6d7af0f0
jl 0x1400a3370
nop
insd dword [rdi], dx
retf 0x3b02
invalid
mov dl, byte [rdi]
fnstsw word [rsi + rsi*4 - 0x18a3eed6]
movsd dword [rdi], dword [rsi]
std
mov cl, 0x9a
xchg byte [rdi], bl
std
in eax, dx
invalid
fucompi st(1)
scasd eax, dword [rdi]
invalid
invalid
retf 0x244a
imul ecx, esp, 0xeb85f7b4
adc eax, 0xa64252ca
pop rsi
and dword [rsi], r11d
invalid
invalid
pop rdi
out dx, eax
xchg edi, eax
jg 0x1400a334d
sub esi, dword [rbp + 0x68]
movabs byte [0x7b66abd23fa5a8f9], al
invalid
invalid
invalid
out dx, al
jbe 0x1400a342c
std
je 0x1400a3388
xor eax, dword [rbx]
mov dl, 0x13
sbb al, 0x6f
pcmpeqw mm0, mm6
lodsb al, byte [rsi]
jg 0x1400a33de
and byte [rbp - 6], 0x88
cli
mov byte [rdx], bh
cmp ch, al
cmp eax, 0xde82ea27
in eax, dx
cmp ch, al
cmp eax, 0xde82ea27
in eax, dx
invalid
movabs eax, dword [0xa13199735ecbd3a]
xor al, byte [rbx - 0x4a]
add al, al
mov dl, 0x45
invalid