Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dword [rdi - 0x7c42ee7a], esi
invalid
invalid
jmp 0x134d3af3d
std
cmp dl, byte [rdx + 0xd]
invalid
loope 0x1400a0824
jg 0x1400a0833
xchg dword [rbx + 0x13], eax
ret
fbld tbyte [rcx]
and cl, byte [rdx]
adc ebp, dword [rdx + 0x49e83f0e]
jl 0x1400a07e3
jp 0x1400a08c0
std
out 0x82, al
scasb al, byte [rdi]
or edi, dword [rbx - 0x2cba4bf0]
sar dword [r10 - 0x3013e7fc], cl
sar dword [r10 - 0x3013e7fc], cl
invalid
sal byte [rsi], 0x38
and ch, byte [rbp + rbp*2 - 0x6628fb6c]
outsb dx, byte [rsi]
push rdi
scasd eax, dword [rdi]
push rsi
fdiv dword [rsi]
cmp eax, 0xf180a23b
invalid
adc al, 0x1f
movabs al, byte [0x7ff3247a757e063f]
js 0x1400a0856
mov bh, 0x88
invalid
add dl, byte [rdi - 0x49]
push rbp
pop rcx
xchg ebx, eax
iret
out 9, al
in eax, dx
in eax, dx
in eax, dx
lodsb al, byte [rsi]
movabs al, byte [0x106d8e38ecdcc05c]
invalid
stosb byte [rdi], al
invalid
jle 0x1400a08ad
invalid
outsb dx, byte [rsi]
cmp byte [rsp + rsi*4], al
mov ecx, 0xb73d00e9
nop
js 0x1400a0943
xor eax, 0xe42e9a85
adc cl, cl
or ax, 0x2a15
sub cl, byte [rbp + 0x49]
sal bh, 1
sub cl, byte [rbp + 0x49]
sal bh, 1
adc esi, ebp
or al, 0x45
invalid
cld
invalid
xor eax, 0xfe6b6824
out dx, al
xchg edi, eax
sbb al, 0xbc
call 0x160a8ffb8
stosb byte [rdi], al
fstp qword [rcx]
invalid
fistp word [rdx + 0x77]
xchg esi, eax
ja 0x1400a08db
idiv byte [rbp + 0x3f3d17cd]
invalid
jnp 0x1400a0991
sbb dl, dh
loop 0x1400a0941
invalid
invalid
iretd
cmc
invalid
adc rax, 0xb223570
adc eax, 0xb223570
mov dh, 0x6f
mov edx, 0xc21c6206
xchg esp, eax
jb 0x1400a0a01
mov dil, 0xcb
mov dil, 0xcb
in al, dx
jle 0x1400a09a3
xchg ecx, eax
clc
add al, 0x52
ret
push 0xffffffffee9dfd7e
jle 0x1400a09b9
popfq
out dx, al
lea eax, [rbx + 0x42]
or byte [rax - 0x12084844], 0x17
std
insd dword [rdi], dx
jmp 0x1400a0989
in al, 0xff
mov edi, 0x9d16df63
out dx, eax
mov esp, 0x7aaffeda
insd dword [rdi], dx
scasd eax, dword [rdi]
sbb dword [rdx + 0x1b], 0x58
sbb r13b, byte [rbx]
adc al, 0x35
and ecx, dword [rcx]
adc byte [rsp + rdx + 0x74], ah
adc al, 0x74
adc al, 0x74
jg 0x1400a0a47
cdq
push rbp
call 0x1650697c5
xchg esi, eax
xchg al, ch
sbb byte [rbx - 0x49], al
cmc
add edx, ecx
add ecx, dword [rax]
and dword es:[rdi - 0x95381b8], edx
and dword [rdi - 0x95381b8], edx
and dword [rdi - 0x95381b8], edx
jl 0x1400a0a7e
scasd eax, dword [rdi]
retf
xchg esi, eax
outsd dx, dword [rsi]
int3
pop rsp
invalid
xchg byte [rax + 0x23], cl
or edi, esp
jnp 0x1400a0a94
test al, 0x73
mov word [rbx], gs
adc eax, 0xe946bbfe
invalid
cmp al, 0xab
test byte [eax + 0x62], dl
sub dword [rdi + 0x2b], 0x44
xor dword [0xfca53fe6], esi
lea ecx, [rcx + 0x531b38a8]
xchg edi, eax
inc dword [rax + rcx]
invalid
std
invalid
mov ah, 0x28
jnp 0x1400a0a78
stosb byte [rdi], al
js 0x1400a0aa0
xor byte [rax + 0x6abab1ad], dl
mov eax, 0x44283ba5
lea edi, [rcx + 0x16dbf1a0]
fist dword [rsi]
invalid
sub dil, spl
in al, 0xb1
scasd eax, dword [rdi]
imul eax, dword gs:[rdi - 0x60], 0x4b
imul eax, dword [rdi - 0x60], 0x4b
rol byte [rdx + 1], cl
lodsd eax, dword [rsi]
imul esi, dword [rcx], 0xffffffd4
sti
call 0x18b7101d1
jrcxz 0x1400a0a49
xchg esi, eax
xchg esi, eax
jmp [rax - 0x30]
test byte [rdx - 0x574f0422], ah
leave
repne stosb byte [rdi], al
out dx, eax
jbe 0x1400a0b05
add byte [rbp + 0x7bf0d7e7], ch
paddw mm5, mm4
jnp 0x1400a0add
std
in al, dx
push rbp
push rsi
jb 0x1400a0b3a
or dword [rdx], esp
je 0x1400a0af7
pop rsi
insb byte [rdi], dx
invalid
xor eax, 0x700cbca
movabs eax, dword [0x5ba4a0ec10e66a08]
mov ecx, 0x58c03d66
mov esi, 0xa23fb0f7
invalid
jo 0x1400a0abb
ret 0x888c
mov word [rax - 0x1658c88d], cs
invalid
xchg ebp, eax
leave
nop
cmpsb byte [rsi], byte [rdi]
invalid
xor dil, r9b
jle 0x1400a0b08
jbe 0x1400a0b56
invalid
in eax, 0x97
pop rax
xchg esi, eax
fcmove st(0), st(7)
jmp 0x1400a0b81
invalid
mov eax, 0x6c6f99a7
cdq
outsd dx, dword [rsi]
insb byte [rdi], dx
int1
pop rdx
invalid
xchg ebp, eax
cmp eax, 0x3876ffeb
adc al, 0xc8
fild qword [rax + rbp*4 - 0x1e96bec]
push rbp
push rbx
push rax
out 0x29, al
jrcxz 0x1400a0b87
jne 0x1400a0bf8
xchg ebp, eax
xchg esp, eax
adc al, cl
add byte [rdx - 0x6b6b6852], cl
xchg edi, eax
xchg esp, eax
xchg esp, eax
movabs al, byte [0xab3121468dff5ffe]
pop rdi
dec dword [rbp - 0x54cedeba]
stosd dword [rdi], eax
stosd dword [rdi], eax
sub esp, dword [rax + 0x6dce438b]
cld
cld
scasb al, byte [rdi]
xor dword [rbp + 0x3fd8ef0c], edx
push rbx
invalid
retf 0x9504
invalid
xchg edx, eax
mov ch, 0xa3
loop 0x1400a0bf6
jno 0x1400a0b8c
mov ecx, 0x42cd98d1
retf 0x186
rcr dword [rax - 0x7935bd33], 1
add dword [rbx + 0x14], eax
fcompi st(7)
cli
imul edi
sub al, 0xb2
xlatb
xor dh, al
push rsp
push rdx
pop rbx
mov cl, 0x17
cmp byte [rax + 0x1356c0d5], dil
shr al, 0xca
stc
invalid
invalid
invalid
sti
mov edx, 0xb991fa7c
add al, 0x7b
invalid
jl 0x1400a0bff
xchg ecx, eax
mov ecx, 0xbffe7b04
mov dh, ch
enter 0xffffffffffff9e84, 0xffffffffffffff9f
invalid
sahf
lahf
scasd eax, dword [rdi]
invalid
test byte [rsi + 0x4d17af9f], bl
pop rbp
sub dword [rdi + 4], esp
invalid
or byte [rdi], cl
cli
jne 0x1400a0bcc
in al, dx
mov ebx, 0x3913f011
or bl, ch
invalid
sahf
mov cl, 0x7d
invalid
push rdx
in al, dx
jge 0x1400a0c7d
pop rbp
stosd dword [rdi], eax
cmpsb byte [rsi], byte [rdi]
and cl, byte [rsi - 0x18]
invalid
or byte [0x15858bb39], dl
test al, 0x45
fsub qword [rsi]
push rsi
insd dword [rdi], dx
pop rbx
cdq
xchg dword [rbx], ecx
sbb byte [rdx + 0x21], ah
invalid
and dword [rdx - 0xb], edx
not dword [rbp*2 - 0x5ee82dcd]
rcl byte [rdi], cl
invalid
jg 0x1400a0c7e
rcl byte [rdi], cl
movabs eax, dword [0xdd41842f6536057f]
test byte [rcx - 0x23], al
invalid
fucom st(0)
fucom st(0)
loopne 0x1400a0c03
invalid
push rcx
fnsave dword [rax - 0x6a7a4d52]
xchg edi, eax
cmp byte [rdx], bh
sub dh, bh
add byte [rdi - 0x62a5b203], bl
popfq
popfq
movsb byte [rdi], byte [rsi]
xor al, 0x26
jnp 0x1400a0cae
invalid
mov r8d, 0xe6707703
lea esp, [rsi + rdi*2]
add byte [rax - 0x4b329f99], cl
invalid
invalid
xchg edi, eax
outsb dx, byte ds:[rsi]
mov esi, 0x307af0fc
invalid
invalid
jmp 0x1400a0d37
stosd dword [rdi], eax
or esi, dword [rax + rbx + 0xc]
jne 0x1400a0cd1
test byte [rbx + rbp*8 - 0x5c087409], dl
cld
int1
test al, 0x9a
sbb eax, 0x3c161f8a
stc
stc
stc
add al, ch
cli
sal dword [rcx - 0x3be2a12e], cl
invalid
movabs dword [0x804d199ac85c81c2], eax
movabs al, byte [0x4ce2bff62ef8df21]
pop rax
invalid
idiv byte [rdi + 0x27584ce2]
mov edi, 0x27584ce2
loope 0x1400a0d75
enter 0xffffffffffff890e, 0xffffffffffffff8c
enter 0xffffffffffff890e, 0xffffffffffffff8c
mov ecx, ss
mov ch, byte [rdi]
jne 0x1400a0d38
ror dword [rdx + 0x7bf0752f], 1
or bh, byte [rbp - 0xa]
jnp case.0x140002106.63
jge 0x1400a0d42
wait
push r12
std
sti
xlatb
invalid
and byte [rsi + 0x7c], ah
add eax, 0xea8bcdfb
invalid
loop 0x1400a0dc2
imul ecx, dword [rdx - 0xdc02095], 0x96c95769
leave
xchg esi, eax
wait
nop
mov ebx, 0x73957a0e
add edi, dword [rdi + 0x35b3377c]
clc
jno 0x1400a0d5c
invalid
jbe 0x1400a0d4a
sti
xchg dword [rdi - 0x15], eax
push rbp
in eax, 0x40
shl dword [rbx + 0x22412fe5], cl
imul edi, eax, 0x73
retf 0xb648
cli
movabs al, byte [0x36e35a0aa3595e50]
add al, 0x68
pop qword [rcx - 0x696f8cf9]
lodsd eax, dword [rsi]
enter 0xffffffffffffeab6, 0x76
and eax, 0x2295fe8e
adc eax, 0x76372b40
sub esi, dword [rdi]
jbe 0x1400a0df1
sub esi, dword [rdi]
jbe 0x1400a0df1
cmp dh, bh
xor byte [rsi - 0x5acdfa2a], dh
add eax, 0xdbe8a532
imul edx, dword [rsi - 0x2c], 0xffffffab
call 0x1146079a2
stosd dword [rdi], eax
jb 0x1400a0d66
invalid
jmp 0x1400a0dbf
int3
in eax, dx
test dword [rdx + 0x29420821], ecx
and dword [rax], ecx
invalid
invalid
and dword [rax], ecx
sub dword [rax - 3], edx
or byte [rdx + 0x29], al
push rax
std
add eax, dword [rbp + 0x2d]
pop r11
cmp al, 0x81
or esi, ebp
or bh, bh
xor ecx, dword [rax - 0x49e7ca72]
xor eax, 0xf687b618
xor eax, 0xf687b618
outsd dx, dword [rsi]
pop rdx
lodsd eax, dword [rsi]
adc cl, 0xe7
jb 0x1400a0e27
xchg edi, eax
fbld tbyte [rcx + 0x7d]
stosd dword [rdi], eax
lodsd eax, dword [rsi]
or dword [0xf73215df], ecx
or eax, 0xb72807c2
push 0xffffffff984192ae
cwde
mov bl, 0xce
jmp 0x1400a0ded
invalid
rol byte [rcx], cl
xor eax, 0x7e563b07
invalid
xor si, bp
and al, 0x6d
jo 0x1400a0e24
jno 0x1400a0dcb
invalid
invalid
add dword [rax], ebp
xor al, 0x26
invalid
sbb eax, 0xf03aec5c
cmp al, 0x9d
cmp al, 0x9d
cmp al, 0x9d
mov byte [rsp + rsi], dh
std
je 0x1400a0e18
rcr byte [rbp - 2], cl
fcom st(6)
invalid
outsb dx, byte [rsi]
jmp 0x1400a0eb4
invalid
test dword [rax + 0x10], ebp
invalid
clc
jmp 0x16fbb7dac
sal al, 0x67
nop
mov ah, 0xe6
or eax, 0x710e59ce
mov al, 0x33
cmpsd dword [rsi], dword [rdi]
lahf
push rbx
cmpsb byte [rsi], byte [rdi]
jno 0x1400a0e66
xor esp, dword [rdi - 0x59ac60d2]
or al, 0x9f
push qword [rsi + 0x75]
jne 0x1400a0f3b
invalid
jne 0x1400a0f3b
add byte [rdi + rdi*8 - 0x25], ah
cmc
invalid
invalid
out dx, al
mov bl, 0x8f
jge 0x1400a0ef9
movabs r9, 0xf410012546038a03
clc
rcr eax, 1
cli
add eax, 0xf9c6a6e9
invalid
stc
ficom dword [rsi + 0x6ff22db9]
in al, dx
mov fs, ecx
xchg esi, eax
invalid
invalid
or edi, esp
mov r13d, 0xe743d7dc
mov ebp, 0xe743d7dc
add ecx, dword [rdx]
cwde
mov dh, 0xb4
adc al, 0xf4
or bl, byte [rax - 0xbeb4b4a]
invalid
mov bh, 0xbf
test esp, 0x47de63e4
or esi, ebx
pop rdi
ficomp word [rdi + 0xf]
mov esi, 0xfefb7b39
not dword ds:[rbp + 0x43cf411e]
pop rdx
pop rsp
push rax
fdivr dword es:[rdx - 0x74]
invalid
movsx edi, byte [rcx]
jnp 0x1400a0f1c
invalid
pushfq
retf 0xfdf0
std
test eax, 0xf742c6fc
out dx, eax
jb 0x1400a0efc
pushfq
invalid
jnp case.0x140002106.85
lahf
jbe 0x1400a0f11
cld
invalid
fist dword [rdi - 0x533b9005]
xchg ebp, eax
invalid
sub al, 0xe8
jb 0x1400a0f19
call 0x135f2a5f7
mov esp, 0xe26912ce
xlatb
call 0x152d8cc7d
imul esp, edx, 0xf261d767
invalid
sub esp, dword [rdx]
test al, 0x79
xchg ebx, eax
cmp byte [rbx + rax*8], ch
invalid
invalid
std
invalid
movabs byte [0xaaf873a615c06f14], al
jae 0x1400a0fb8
stosb byte [rdi], al
mov dword [rdi - 0x1c], esp
jl 0x1400a0fcb
mov edx, dword [r13 - 0x4d1dfedb]
loop 0x1400a0f7f
sbb cl, bl
in al, 0xa1
xor byte [rdx + 0x20], ch
sub al, 0xc
jrcxz 0x1400a104f
invalid
xchg ebx, eax
pop rbx
xchg edx, eax
ret
rcr dword [r15 + 0x1ae3fc58], cl
adc eax, 0xc8118ffc
out dx, al
adc ah, byte [rdx]
push rax
js 0x1400a1038
invalid
fstp qword [rax]
invalid
invalid
jp 0x1400a1095
add edx, dword [rbx + 0x6aed56cf]
xor edi, dword [rdx - 0x6831a2ff]
in eax, dx
push 0x33
mov edx, 0x97ce5d01
jnp 0x1400a10d5
add byte [rbx + 0x16fc2c6], dh
js 0x1400a104e
test ah, al
invalid
jae 0x1400a1091
xchg dword [r13 + r15*8 + 8], eax
out dx, al
sub eax, 0xffae9ef9
jnp 0x1400a1076
scasb al, byte [rdi]
invalid
invalid
pop rcx
mov ebx, 0x8c3f8b9c
fdiv st(5), st(0)
je 0x1400a10ff
or dword [rbx], ebx
ror byte [rax], 1
fcom dword [rsi]
invalid
xchg ebp, eax
or eax, 0xd65bd89b
cmp cl, al
imul r10d, dword cs:[r11], 0xffffffcb
imul r10d, dword [r11], 0xffffffcb
invalid
or edi, dword [rbp - 7]
imul ecx, edi, 0xfffffffa
sbb byte [rbp - 0x6800173e], bl
pop rsp
cmp ebx, dword ds:[0xca2d7baa]
cmp ebp, ecx
invalid
iretd
xor edi, dword [rdi + 0x779c76ee]
insd dword [rdi], dx
mov edx, ebp
mov word [rbx], cs
imul byte [rax]
imul ebp, dword [rdx + 0x6a], 0x178777ff
xchg dword [rdi], edx
push qword [rdi - 0x79]
invalid
xchg dword [rdi], edx
mov eax, 0x63fc5e65
fcomp qword [rbp + 0x1a053c23]
int3
movabs al, byte [0xa90badb1ecda1ad7]
out dx, al
xchg edi, eax
add byte [rax + 0x3485c094], 0x35
and bl, ah
cmp eax, 0x4447b445
std
mov edi, 0xfe268be0
mov esp, dword [rsi]
invalid
loopne 0x1400a1125
mov esp, dword [rsi]
invalid
ja 0x1400a120c
sub al, 0x71
mov ah, byte [rsp + rcx*2 + 0x15e3173a]
fbstp tbyte [rdi]
insb byte [rdi], dx
invalid
in eax, dx
in al, 0xbf
cmc
call rsi
jb 0x1400a1168
invalid
invalid
or ebx, esi
out dx, eax
xchg edi, eax
stosd dword [rdi], eax
outsd dx, dword ss:[rsi]
invalid
adc dword [rbp - 0x6e47ce06], 0xc4c51093
loope 0x1400a124d
invalid
pop rcx
sbb ch, ah
xor edi, esp
invalid
mov byte [rbp + 0x24], al
adc dh, byte [rdi + 0x2c]
movabs al, byte [0x6bb03e38ecf4dc7]
imul esi, edi, 0x16
xor ecx, dword [rbp + 0x35]
xor rax, 0x78691156
iretd
xor rax, 0x78691156
scasb al, byte [rdi]
and ecx, dword gs:[rdi]
lahf
invalid
jle 0x1400a1220
adc dword [rax + 0x34819fce], eax
sbb dword [rsi + 0x6e6d697c], edx
xor ah, byte [rdx]
push rdi
or esi, ebp
out dx, al
out dx, al
lodsb al, byte [rsi]
xchg ebp, eax
mov ecx, 0x6d719f2d
lahf
pop rbx
xchg edi, eax
mov cl, 0xc7
bnd call 0x10fa9305a
test dword [rsi], 0xf87c3364
xor edi, dword [rax + rdi*8 + 0x6e]
iretd
xor edi, dword fs:[rax + rdi*8 + 0x6e]
xor edi, dword [rax + rdi*8 + 0x6e]
push 0xffffffffb3a1c6d9
stosd dword [rdi], eax
movabs dword [0xa728dc24b566107b], eax
jnp 0x1400a126b
mov ch, 0x24
fsubr qword [rax]
cmpsd dword [rsi], dword [rdi]
invalid
xchg ecx, eax
push rbp
or dword [rax + rcx*4 + 0x3b], ebx
cdq
jnp 0x1400a1259
cmp ebx, dword [rcx - 0x66491585]
mov dh, 0x99
or eax, 0xf9fb8609
pop rdi
jrcxz 0x1400a12d6
cmc
invalid
mov eax, 0xfb477d61
or al, 0x4e
sti
invalid
out 0x25, eax
invalid
stosb byte [rdi], al
xchg byte [rbx + 0x4b], cl
jns 0x1400a1311
mov dh, 0x1b
ret
test eax, 0x4f23e05d
test eax, 0xfb8f7f7a
cmpsd dword [rsi], dword [rdi]
imul edi, esi, 0xd7fe7aa3
xlatb
sti
jp 0x1400a124a
call rdi
invalid
fiadd word [rcx - 0x7e6b34b7]
loope case.0x14001b157.2
sbb al, 0x19
mov ecx, 0x10728c1
invalid
invalid