Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, dl
inc cl
add eax, 0xcc9dee8a
xchg dword [rbx + rdi*2 - 0xd], ebx
pop rsp
jnp 0x1400a0805
and eax, dword [0x12088b616]
cld
movabs al, byte [0x4641a236992cc105]
lodsd eax, dword [rsi]
sbb eax, 0x788b5658
sub ebp, dword [rbx]
xchg edx, eax
jnp 0x1400a0871
jge 0x1400a080f
in eax, 0xb
rdmsr
sbb eax, esi
invalid
xor bl, byte [rcx]
invalid
loope 0x1400a0824
jg 0x1400a0833
cli
fist dword [rsi + 0x5866f6b7]
invalid
invalid
invalid
lodsb al, byte [rsi]
invalid
outsd dx, dword [rsi]
ret 0x944f
adc al, 0x7b
cmpsb byte [rsi], byte [rdi]
ret
invalid
invalid
pop rbx
mov edx, 0x1efe74e9
invalid
outsb dx, byte [rsi]
and dword [rbx - 0x1e2da191], edx
out 0xc, eax
cld
jae 0x1400a0926
cmp ebp, edi
std
pop rcx
jle 0x1400a08aa
mov ecx, dword [rcx + rbp + 0x7bb57f0f]
invalid
sub dword [rdi], ecx
jg 0x1400a086d
jnp 0x1400a0848
jge 0x1400a08ad
sub dh, byte [rbp - 0x9db37e4]
mov ss, word [rbp - 0x44e8b34]
int3
je case.0x140002106.4
sti
rcl dword [rdi + rbp*4 - 0x3b], cl
lodsb al, byte [rsi]
adc byte [rbp + 0x49], ch
cmpsd dword [rsi], dword [rdi]
bnd retf 0xba78
int3
stosb byte [rdi], al
invalid
invalid
cmp ebx, ecx
push rdx
jbe 0x1400a0926
mov dl, byte [rdx - 0x61329d05]
add byte [rdx + 0x7a], bl
sub al, 0x7d
pop rcx
or byte [rax], bh
jno 0x1400a0897
mov edx, dword [rbp - 0x61a86876]
mov esp, 0x8b80ff54
push rbx
mov esi, 0x254e4f04
and eax, 0xbb93792d
cmp al, 0x39
invalid
cdq
invalid
stosb byte [rdi], al
xor dh, bh
push rsi
invalid
sbb al, 0x7e
test eax, 0x2e7a23ed
sub ah, cl
and dword [rsi + 7], edi
sbb dword [rax], esp
invalid
or dword [rax + 0x177c7dfb], ecx
add ebp, ebp
in al, 0xa9
mov ah, 0xe0
jno 0x1400a08ef
loop 0x1400a09e1
invalid
dec byte [rbp + 0x19]
pop rbp
ja 0x1400a09f3
iretd
scasd eax, dword [rdi]
xchg ebx, eax
xchg ebx, eax
js 0x1400a09a1
invalid
invalid
invalid
jns 0x1400a09e8
invalid
jg 0x1400a0983
loope 0x1400a0983
adc eax, 0x2aa3eb2e
cmp byte [rax - 0x69], bh
movsb byte [rdi], byte [rsi]
mov edi, ebp
insd dword [rdi], dx
jmp 0x1400a0989
xor dword [rdx], ecx
cmp edi, dword [rcx + 0x50]
or bh, byte [rbx]
jns 0x1400a0a25
sbb eax, 0xc52ee329
xor al, 0x3d
and dword [rdi], 0x5075d61d
push rax
mov bh, 0x4e
push rbp
mov dh, 0x18
add eax, 0x55cb1730
xor byte [rdi], dl
retf
invalid
mov es, word [rdx]
jbe 0x1400a09ea
fucom st(6)
jg 0x1400a09f9
scasd eax, dword [rdi]
mov edx, ebx
mov dl, ch
mov edi, 0xf4be6de0
hlt
xor dword [rax + rax + 0x38], esp
not byte [rcx]
mov byte [rcx - 0x3742170a], cl
jg 0x1400a0a48
hlt
stosd dword [rdi], eax
cmp al, byte [rax - 0x74db1f95]
jg 0x1400a09d1
shr dword [rax + 0x42], 1
pushfq
movsd dword [rdi], dword [rsi]
push rbp
cdq
or esp, dword [rdi + rbp + 0x1f28d384]
mov cl, 0x8b
mov byte [rax + 0x794a80df], dh
jns 0x1400a0a12
jns 0x1400a0a14
cli
je 0x1400a0ac3
jp 0x1400a0a71
invalid
invalid
std
xchg edx, eax
shl edx, cl
call 0xc1c1f31e
jno case.0x140002106.29
invalid
jle 0x1400a0adb
sbb eax, 0xc93e4af5
sbb eax, 0xc93e4af5
or dword [rsi - 0x67612158], ebx
invalid
xchg esp, eax
invalid
cld
out 0x5e, al
lodsb al, byte [rsi]
imul eax, dword [rcx], 0xffffff8b
stosb byte [rdi], al
clc
sbb al, 0xd5
mov ah, 0xbd
mov esi, 0xb83d68ba
jmp [rbx + 0x265222ba]
sbb byte [rsi - 0x59], ch
or eax, 0xff3bc70e
invalid
out dx, eax
xlatb
outsd dx, dword [rsi]
invalid
mov al, 3
invalid
jno 0x1400a0b17
lodsd eax, dword [rsi]
fcomp qword [rdi - 0x3d]
retf 0x2a69
invalid
invalid
imul ebp, dword [rdx], 0x11e9f28c
movabs al, byte [0xbb8d55fc7eb95ba4]
xor dword [rcx], edi
leave
ja 0x1400a0ac0
and ecx, ecx
leave
scasd eax, dword [rdi]
mov ds, word [rbx - 0x1b5c33c4]
invalid
invalid
pop rdx
iretd
rol cx, cl
stc
cmp eax, 0xf7829b5e
pushfq
adc ah, byte [rbp + 0x21d2c8e4]
shl byte [rcx], cl
shl byte [rcx], cl
int3
stosd dword [rdi], eax
xchg esi, eax
sbb esi, ebp
int1
add al, 0xaf
rol dword [rdx], cl
mov edx, dword [rbx + 0x5def8aed]
pop rsp
test al, 0xdd
and dword [rdi - 0x13], ecx
in eax, dx
in eax, dx
sti
stosb byte [rdi], al
invalid
pop rsi
invalid
mov edi, 0x77ada2ee
cli
imul ebp, dword [rax], 0xd94105fb
sahf
retf
add al, 0x14
out 0xcb, eax
cmp eax, ebx
scasb al, byte [rdi]
xchg esi, eax
invalid
cli
invalid
fild word [rcx + rsi + 2]
xchg edx, eax
xchg esp, eax
jo 0x1400a0c34
sub ah, byte [rdi]
fcompi st(7)
cli
xchg ebx, eax
movsb byte [rdi], byte [rsi]
add al, 0xc6
imul esp, dword [rcx + 0x45], 0x997bf0f6
fnstsw word [rbx - 0x4b]
push 0xffffffff8316be4c
sahf
lodsb al, byte [rsi]
or dword [rsi - 0x64], edx
add eax, 0xd8096cf
or eax, 0x3e73835f
mov dh, 0xa9
add ecx, dword [rdx + 0x4572168b]
or eax, 0x3e73835f
mov dh, 0xa9
add ecx, dword [rdx + 0x4572168b]
sal ecx, 0x8d
jb 0x1400a0c88
invalid
jns 0x1400a0c48
cmp byte [rdi + 0x1e4d17af], bl
inc dword [rcx]
add byte [rcx + 3], ah
lodsd eax, dword [rsi]
invalid
lahf
scasd eax, dword [rdi]
invalid
invalid
xchg ebp, eax
invalid
nop
cmc
mov eax, 0x518a2e5d
push rcx
pop rbp
mov dl, byte cs:[rcx + 0x30]
push rcx
xor byte [rbp + 0x3f], bh
push rcx
xor byte [rbp + 0x3f], bh
jg 0x1400a0c37
div ecx
int1
int1
retf
jmp 0x1400a0c3f
or al, 0xc5
movabs dword [0x379abfb426d6cd7f], eax
add dh, byte [rdx - 0x55]
xlatb
jg 0x1400a0c1d
invalid
xchg edx, eax
and byte [rbp + 0x69269567], al
call 0x1ba6dae22
push rbx
cmp eax, 0xddb66da3
invalid
jns 0x1400a0c12
xchg ebp, eax
cmp byte [rcx + 0x57d8b9da], ah
push rdi
sti
invalid
jbe 0x1400a0c10
cmpsb byte [rsi], byte [rdi]
fld dword [rcx + 0x2f05e87f]
insd dword [rdi], dx
add eax, 0x5f53d557
mov eax, 0x330b1cf0
invalid
sbb al, 0xb
xor edi, dword [rdx]
adc eax, 0x36ff3fe
xchg edi, eax
sar byte [rax + 6], cl
invalid
call 0x145773b92
push rdi
invalid
invalid
out dx, eax
invalid
fnsave dword [rsp + rbp*2 - 0x7d]
jle 0x1400a0cc1
je 0x1400a0d2f
cmp dword [rsi - 5], 0x2f
invalid
invalid
invalid
xchg ecx, eax
xchg edi, eax
fcomp dword [rbp + rcx*8 + 0xb]
push rdx
not dword [r14]
invalid
adc ebp, dword [rax - 0x759370f2]
xchg ebx, eax
invalid
ret 0x39d4
sar esi, 0xad
invalid
and al, 0x4d
and byte [rax + 0x2ef8df21], 0xf6
mov dh, 0x6f
cli
sti
wait
push rax
sub edi, dword [rbx + rsi*2]
pop rdi
jae 0x1400a0da1
cli
lahf
mov cl, dh
invalid
std
jnp case.0x140002106.63
jge 0x1400a0d42
add dword [rbx + 0xa1c8bf5], esp
invalid
invalid
cmc
in eax, dx
loop 0x1400a0d53
invalid
ret 0x7547
push rdx
jrcxz 0x1400a0d40
jae 0x1400a0d47
sbb eax, 0x7e7879ca
xor al, 0x62
invalid
jle 0x1400a0dd7
invalid
xor al, dl
rcr dword [rdx - 0x728b393b], 0x5e
invalid
jae 0x1400a0e06
and eax, 0xfc9b3547
out dx, eax
invalid
xor eax, 0x47effc9b
invalid
xor ebx, dword [rdx]
mov ebp, 0xae6874f
cmp al, 0x5d
mov edx, 0x7f4d8b4d
mov ecx, esi
mov dl, al
in eax, dx
invalid
or byte [rbx + 0x6f8209d1], dh
out dx, eax
ret 0xf0a6
ror dword [rcx], 1
invalid
mov bh, 0
push rax
cld
clc
imul edx, dword [rbx - 0x75c80531], 1
pop gs
in al, dx
insb byte [rdi], dx
or cl, byte [rbp - 0x72c16417]
paddsw mm7, qword [0xcbadfd46]
stc
invalid
leave
invalid
mov ecx, 0x95fe5ff7
pop rdi
xchg byte [rdx + 0x1c2f8ce3], dil
invalid
cmp dword [0x1681e4dfb], 0xffffff8e
mov al, 0xd2
pop rbp
invalid
iretd
mov esi, 0x8b068ab7
cmpsd dword [rsi], dword [rdi]
push rdx
xchg edi, eax
jge 0x1400a0eef
pop rbp
adc bh, bl
popfq
invalid
invalid
adc esi, dword [rdi - 0x59f06dc7]
xlatb
movabs dword [0xff9dec0b6dae7f45], eax
sti
invalid
mov esp, 0xa47f7d87
sub eax, 0xff3d43aa
fdivp st(4)
cmp edx, dword [rbx]
adc al, 0x50
fcmovnbe st(0), st(5)
cmp byte [rbx - 0x59303a25], bh
outsd dx, dword [rsi]
cmp eax, 0x712c407b
in al, 0x6c
mov ebp, 0xe8c8b1c9
call 0xf9c6c2ee
invalid
repne outsd dx, dword [rsi]
enter 0x5e8, 0xffffffffffffffb4
mov esp, 0x6ff22db9
call 0xf9c6c2ee
sub eax, 0x4ff46ff2
je 0x1400a0f33
hlt
fisub word [r13 - 0x6a]
fisub word [rbp - 0x6a]
or eax, 0x6c8786f2
mov gs, word [rbx + riz*8]
lea esi, [rsi - 0x649c6249]
invalid
js 0x1400a0e91
sub bh, byte [rbx]
out 0x1f, al
test byte [rdx], dl
jae 0x1400a0ebb
xchg dword [rax + 0x194ef5a3], edx
or bl, al
out 0x54, al
jns 0x1400a0f40
or r14d, r11d
pop rdi
pop rsp
ficomp word [rdi + 0x5c]
and al, byte [rcx + 0x77]
invalid
invalid
cli
imul ebx, dword [rax + 0x79], 0x75
xchg ebx, eax
jnp 0x1400a0f6d
cmp ebp, dword [rcx + rcx*2]
add al, byte [rcx + 0x717bef1a]
je 0x1400a0f40
movabs byte [0xfe7bf31767bea4d4], al
jnp case.0x140002106.85
and eax, 0x81ab3e9f
sbb al, byte ss:[rax - 0x5d5c3547]
jmp 0x1400a0ee3
sbb rax, 0x7e1ffb65
invalid
invalid
jle 0x1400a0f76
push rax
push 0x2915a63c
ret
sub ebx, eax
ret 0x7ff3
lea ebx, [rbp - 0x430ae004]
invalid
ret 0xd04a
std
invalid
push 0x31d2d1ad
jo 0x1400a0f69
rcl edx, 1
xor dword [rax - 0x47], esi
xchg edi, edi
cdq
jl 0x1400a1017
mov edx, 0x73a6d954
or byte [rax], dl
adc al, 0x24
je 0x1400a0fab
mov byte [rcx + 0x67], bh
pop rbp
mov esp, 0x74e13ff4
loope case.0x140002106.97
mov ecx, 0x209d46fb
mov esp, 0xf62ed6f6
invalid
shr dword [rdi - 0x55], 0x6b
invalid
jmp 0x17b1dc0e7
movsb byte [rdi], byte [rsi]
sub al, 0xbc
cmp cl, byte [rsi - 0x1f6dd75c]
je 0x1400a0fa8
invalid
jb 0x1400a1001
jg 0x1400a1006
invalid
xchg ecx, eax
lea eax, [rdi - 0x46a372c5]
push rsp
mov bl, 0xf5
cdq
jbe 0x1400a0fc8
fcmovnb st(0), st(7)
mov edi, 0x58acc8dd
test byte [rbx + riz*8 + 0xe], al
stosb byte [rdi], al
sub eax, 0xf37ef28e
jae 0x1400a1007
invalid
and byte [rcx - 4], dl
cld
sub edi, dword [rax + 0x7479468e]
wait
mov esi, 0x47ff05f7
test eax, 0xff2bdcf0
test eax, 0xff2bdcf0
std
push 0x28233af0
jle 0x1400a1030
sal dword [rbp + 0x7e532edc], 1
invalid
int1
sub byte [rsi + 0x26], ah
stosb byte [rdi], al
scasb al, byte [rdi]
invalid
invalid
pop rbx
invalid
test eax, 0xcf6bf9c7
cli
movabs byte [0x2a7a6b4cf340c711], al
imul edi, dword [rdx + 0x2a], 0x6e
imul r15, qword [rdx + 0x2a], 0x6e
imul edi, dword [rdx + 0x2a], 0x6e
push rbp
cmp al, 0x97
xor byte [rax - 0x13], dh
jge 0x1400a1122
push rax
xor eax, 0x782ed2
mov edi, 0x54372c28
cdq
mov al, 0x23
jbe 0x1400a11a1
std
invalid
jrcxz 0x1400a113e
sti
mov eax, 0x991c8046
invalid
sbb eax, 0xe480a36d
adc edi, eax
invalid
test al, 0x95
mov ebp, esi
add byte [rdx + 0x10778264], cl
pop rbx
js 0x1400a11a7
jne 0x1400a1113
scasb al, byte [rdi]
call qword [rsi]
invalid
and esi, dword [rcx + rsi + 0x3efbb892]
mov dh, 0xfc
mul byte [rax + 0x4aafb139]
cdq
invalid
loope 0x1400a11d7
add eax, 0xec4df3ce
and bl, byte [rbx + rdi*2]
sub dword [rdx + rbx*4], esi
or eax, 0x73873c39
outsd dx, dword [rsi]
cmp al, 0x87
jae 0x1400a121c
cli
mov edi, 0x671db517
mov ch, 0x1d
pop rdx
mov ch, 0x1d
pop rdx
or dl, byte [r10 + 0xb]
mov byte [rdx + 0x24e18c1e], bh
xchg byte [ebx + 0x745ea852], bl
wait
push rdx
test al, 0x5e
je 0x1400a1225
wait
push rdx
test al, 0x5e
je 0x1400a1225
invalid
iretd
cmp al, 0x55
cwde
fistp qword cs:[rbx]
out 0x61, eax
and esi, dword [rdi + 0x1d]
ja 0x1400a11ff
ja 0x1400a11ff
xchg esi, eax
movsb byte [rdi], byte [rsi]
leave
sub eax, 0xb8c00181
movabs dword [0x5809bbba1995afa7], eax
mov ebx, 0x336a5809
mov ebx, 0x336a5809
invalid
pop rbp
sbb eax, 0xf7dded4a
in eax, dx
invalid
imul dword [rdx + rdx*4 + 0x5c9fd2ae]
invalid
invalid
invalid
in eax, dx
invalid
or byte [rcx - 0x5bb16dca], al
jne 0x1400a11a9
insd dword [rdi], dx
loopne 0x1400a120e
scasd eax, dword [rdi]
jbe 0x1400a1256
in eax, dx
std
enter 0x868, 0xffffffffffffffda
int1
int1
and edi, dword [rcx + 0x2efe4fdf]
invalid
scasd eax, dword [rdi]
xchg esp, eax
sti
and bh, byte [rbp + 0x17]
cwde
xchg esp, eax
xor al, byte [rdi - 0x6465e889]
ja 0x1400a1251
invalid
wait
invalid
xchg dword [rdi + 0x17], esi
ja 0x1400a1251
invalid
frstor dword [0x13a278bcf]
jns 0x1400a1270
cli
jg 0x1400a122e
or bh, byte [rdi - 0x3b839c9c]
or eax, 0xfdf0b7fb
add dword [rax], ebp
xchg dword [rax + 0x79290044], esp
add byte [rcx], ch
jns 0x1400a1237
outsd dx, dword [rsi]
add byte [rcx], ch
jns 0x1400a1237
outsd dx, dword [rsi]
invalid
scasd eax, dword [rdi]
invalid
out dx, eax
call qword [rdi + 0x375affd5]
pop rbp
wait
mov dl, 4
jl case.0x14001b157.5
pop rdi
pop rdi
jmp 0xeef9f90b
and bh, ch
fstp qword [rax]
sub cl, dl
invalid
invalid