Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
invalid
invalid
sbb ecx, dword [rbx]
mov edi, 0x7d0095ba
jg 0x1400a0843
invalid
invalid
mov ebx, 0x1bd927bf
mov edx, dword [rcx]
pushfq
cmp edx, esp
dec dword [rcx + 0x108916e7]
adc byte [rbp - 0x50a812f], ah
invalid
adc byte [rbp - 0x50a812f], ah
invalid
cld
adc bh, byte [rcx + 0x25]
jg 0x1400a0855
jbe 0x1400a082f
and al, 0x63
ret 0xbe00
imul edi, dword [0x166aae07f], 0xffffff90
mov esi, 0x52478bdd
clc
pop gs
jl 0x1400a08e9
jo 0x1400a0853
jmp 0x16e140712
xchg ecx, eax
and eax, 0x98fb8050
push rdx
inc edx
stc
jp 0x1400a0903
xchg ebp, eax
xchg ecx, eax
int 0x8d
cdq
mov cl, byte [r14 - 0x71840410]
mov cl, byte [rsi - 0x71840410]
mov cl, byte [rsi - 0x71840410]
jge 0x1400a08ad
mov bh, 0xf5
mov bl, 0x37
sar ebx, 1
jno 0x1400a0901
sub eax, dword [rsi]
invalid
out 8, eax
xor eax, 0x81c1f811
mov byte [r10 - 0x19c77c2d], cl
cdq
pop rsi
cmp byte [rbp + 0x6f77c338], 0
invalid
mov ebp, 0x6f77c338
add bh, al
fnsave dword [rdx - 0x1ce4ade3]
sal dh, cl
stosb byte [rdi], al
mov r15d, dword [rax]
invalid
invalid
lahf
mov ebx, 0xb351c184
push rbp
test cl, al
push rcx
mov bl, 0x55
invalid
mov esi, 0x8430adc
in eax, 0xa5
imul byte [rcx + rdi*8]
adc dword [rbp + 0x6f], esi
mov esi, 0x92aa406c
and eax, ecx
jge 0x1400a098b
invalid
lodsd eax, dword [rsi]
movabs r11, 0xee3e7487fff30040
adc al, 6
jle 0x1400a0986
push rsi
invalid
sal byte [rbx + rdi*8 + 0x7d], 1
jl 0x1400a096f
mov ch, 0x1b
sub byte [rsi + 6], dh
invalid
loop 0x1400a09e1
invalid
lodsb al, byte [rsi]
test dword [rcx + 0x4528ef67], esp
cmpsb byte [rsi], byte [rdi]
pop rsi
mov edi, 0x8b7e7dfe
pop rsp
stosb byte [rdi], al
shl byte [rsi], 1
invalid
invalid
invalid
adc al, 0xff
fbstp tbyte [rsi + 0xe]
xchg edi, eax
xor byte [rdx + 0x1c], ch
add byte [rsi], ah
adc eax, 0xd6411d7d
jge 0x1400a09b1
invalid
invalid
imul ebx, dword [rcx + 0x4edbde8f], 0xffffffe7
invalid
jge 0x1400a09b1
invalid
invalid
iretd
jmp 0x1400a0a0f
loop case.0x140002106.21
and al, 0x2d
cmp byte [rsi], ah
cmp al, 4
movabs al, byte [0xe9fcbf611716f47f]
mov ch, 0x60
invalid
invalid
lahf
sbb dl, byte [rax - 0xd]
rcr byte [rsi + riz*4], 1
push rax
jle 0x1400a09e4
invalid
invalid
mov bh, 0xea
jmp 0x1400a0a54
mov bh, 0x16
invalid
scasd eax, dword [rdi]
xor edx, dword [rdi]
retf 0x5927
shr dword [rcx], 1
invalid
invalid
jle 0x1400a0a1d
invalid
leave
adc eax, 0xbde881e2
call 0xda7ad81a
test ebx, ebp
add esi, dword [rbx + 0x7e]
and dword [rsi], edx
sub dword [rsi], 0x38
invalid
sbb bl, byte [rsi + 0x77]
fnstsw ax
int 0x56
pop rcx
imul eax, dword [0xe5e1c83d], 0xffffffc0
xor esi, dword [rax]
push rbp
in al, 0xf6
fdivr qword [rcx - 0x61]
rcr byte [rbp - 0x2ff02add], cl
invalid
sub dword [rbp + rbx - 0x210b631f], ebx
fdivr dword [rsi + 0x75]
in al, 0x80
cmp dword [rbp + 0x75], edx
add dword [rcx - 0x69], esi
adc esp, dword [rax]
fistp dword [rdx + rcx*4 - 0x19]
pushfq
and al, 0x6f
test byte [rbx + 0xd2d4178], dh
outsd dx, dword [rsi]
cmp byte [rbp + 0x45], dh
invalid
invalid
out 0x5e, eax
stc
mov r13b, r9b
invalid
movsd dword [rdi], dword [rsi]
int1
test eax, 0xf5b814cf
invalid
ret
mov cs, word [rdi + 0x62312a8d]
jbe 0x1400a0ad8
pop rdi
sub al, 0x4f
ret
jmp 0x1400a0b55
invalid
ror dl, 1
and bh, byte [rsi + 0x7d591285]
xor dword [rbx + 0x773f5ce5], 0xffffffbd
cli
invalid
retf 0xbe22
in eax, dx
mov esp, 0xdc57fcaa
out 0x76, al
sub eax, 0x22c835d
sub dword [rax - 0x3c], 0x39dcbaab
mov ebp, dword [rbx + 0x7bf0ad8a]
mov ch, byte [rbp + 0x3f7a7bf0]
mov ch, byte [rbp + 0x3f7a7bf0]
add byte [rdx + 0x763397ae], cl
cmp al, 0x3d
xchg ebx, eax
out 0x38, al
xchg esi, eax
pop rcx
scasd eax, dword [rdi]
js 0x1400a0bb1
invalid
retf 0xe244
cld
invalid
invalid
jb 0x1400a0c3b
invalid
lodsb al, byte [rsi]
jbe case.0x140002106.45
invalid
push 0xffffffffffffffaa
lahf
xchg r10, rax
invalid
mov esp, 0xc1e9ba41
cmp eax, 0x9e8316be
invalid
mov esi, 0xfe9e8316
invalid
out 0xa8, eax
stc
call 0x1502a0daf
out dx, eax
and byte [rbx], dh
imul esp, ecx, 0xffffffb6
out 3, eax
jmp rsp
call qword [rdi + rbx*4]
scasd eax, dword [rdi]
invalid
std
invalid
jnp 0x1400a0c52
xor ecx, dword [rdi]
cmp dh, byte [rdi - 0x404d802d]
mov bh, 0xd3
jg 0x1400a0bf0
invalid
mov dh, 0x9e
invalid
mov bh, 0xd3
jg 0x1400a0bf0
sar dword [rdi - 0x4e], cl
mov edi, 0x47ea9eb6
jle 0x1400a0c35
cmpsb byte [rsi], byte [rdi]
cmp edi, dword [rcx - 0x36744d3a]
mov ecx, ecx
mov ecx, ecx
sbb esp, dword [rax + 0x4f]
invalid
dec edx
mov edi, 0x8f2a3015
cmp dword [rcx + 0x46ff8b0b], edx
xchg ecx, eax
or ecx, dword [rbx - 0x4175b901]
js 0x1400a0bea
invalid
invalid
invalid
xchg ecx, eax
or ecx, dword [rbx - 0x4175b901]
js 0x1400a0bea
invalid
xchg esp, eax
ret
xor dword [rdx - 0x41], ebx
cmp dword [rsi + 0x38d54cde], 0xffffffce
lahf
clc
push rbp
sti
mov bl, 0x9a
invalid
pop r8
sub byte [0x1affe0ab1], al
in al, dx
mov ch, 0xb3
invalid
invalid
fistp qword [rsi - 0x3fa3aa02]
cmp ebp, dword [rdx]
pop rsp
sar byte [rbx], 0x2a
ret
cwde
js 0x1400a0d16
push rbx
jns 0x1400a0d45
out 0x7e, al
xor cl, cl
sub eax, 0x5a722f24
sbb al, 0x48
xor cl, dh
add cl, byte [rcx + rbx*8]
mov esp, 0xc336d120
ret
or cl, byte [rcx + 0x27]
sub dword [rbp + 0xb], esp
jl 0x1400a0cac
ret
sbb al, 0xfe
mov bl, ah
invalid
sub al, 0x8a
fnstsw word cs:[rcx]
invalid
sbb eax, 0xd1583ec0
invalid
sub dword [rsi + rbx*8 - 0xc], ebp
sbb byte [0xfc1a098f], cl
mov cl, 0x7a
xchg esi, eax
cmp eax, 0x764e2b77
mov cl, 0x4f
push rbp
cmpsb byte [rsi], byte [rdi]
invalid
out 0x58, eax
mov esi, 0x8ac46d41
invalid
cmc
cmc
in eax, dx
loop 0x1400a0d53
invalid
invalid
add al, 0x27
invalid
sbb eax, 0xad9cb3d5
push rax
iretd
loop 0x1400a0dfa
std
mov ebp, esp
mov bh, al
test byte [rdx], bh
movabs byte [0x11e43e7f2368e4d5], al
xor al, 0x41
notrack call 0x151a4ba2d
cmp dword [rdx + rbx*4 - 0x8104ef], ebp
cmp dword [rdx + rbx*4 - 0x8104ef], ebp
lodsb al, byte [rsi]
invalid
push rsi
invalid
not dh
mov cl, 0x61
movabs dword [0x16edd08a2b63fd97], eax
invalid
fisubr word [rdi + 0x6e]
outsd dx, dword [rsi]
outsb dx, byte [rsi]
jb 0x1400a0e36
in al, 0xeb
jp 0x1400a0e2f
invalid
test al, 0xd4
jge 0x1400a0ea2
jle 0x1400a0e05
loopne 0x1400a0e36
adc byte [rdi - 0x6cf22dbb], dl
invalid
xchg edi, eax
ror byte [0x102d5fec1], cl
lahf
jae 0x1400a0dbc
jnp 0x1400a0e23
adc al, 0x2f
add eax, esp
mov ecx, 0xfaac3a80
cmp byte [rdx], 0xac
cli
loopne 0x1400a0df1
cmp byte [rdx], 0xac
cli
cmp ch, byte [rdx + rdi*8 + 0x7e3b8818]
lahf
sbb byte [rax - 0x60b981c5], cl
scasb al, byte [rdi]
pop rsi
cld
xchg edx, eax
not dword [rbp - 0x3fc10141]
invalid
invalid
invalid
invalid
invalid
mov ecx, 0xe1fe5ff7
pop rsi
mov ebp, 0xf06ecba5
fiadd word [rax - 0x3d]
cmp ah, byte [rcx - 0x6cf3f1a7]
pop rcx
invalid
or al, 0x93
invalid
pop rcx
invalid
out 0x28, eax
ja 0x1400a0e39
outsd dx, dword [rsi]
sahf
stc
mov ch, 0x91
jg 0x1400a0e80
mov edi, 0xa1872b97
mov ebp, 0x7cc44c35
add bl, byte [rdx + 0x727ddf92]
movabs eax, dword [0x929a027cc44c35bd]
fistp qword [rbp + 0x72]
invalid
xor dword [rsi + 0x14f2dfb9], 0xffffff90
stosd dword [rdi], eax
imul ebx, edi, 0xcf1329be
push rax
mov bh, 0x7b
jnp 0x1400a0ebb
lahf
sbb cl, byte [rdx]
movabs eax, dword [0x1698810f2d371aa7]
invalid
invalid
jnp 0x1400a0ebb
lahf
sbb cl, byte [rdx]
movabs eax, dword [0x1698810f2d371aa7]
xor byte [r15], bpl
sar dword [rcx + 0x71], 0x83
invalid
jns 0x1400a0f30
xor dword [rcx], 0xfffffff0
xor eax, esi
out dx, al
mov ebx, 0xc89815ef
scasd eax, dword [rdi]
push 0xffffffff8a07181e
mov cl, byte [rax - 0x33ff3ee0]
mov cl, byte [rax - 0x33ff3ee0]
and cl, al
add ah, cl
fcmovnb st(0), st(5)
iretd
jae 0x1400a0ed0
pop qword [0x11c6cedcc]
add eax, 0xdc62dee3
stc
wait
loop 0x1400a0ee1
je 0x1400a0f33
sal ebx, 1
invalid
or eax, 0x5ee7b995
mov esp, 0x74eff9f2
ficom dword [rcx + 0x41]
mov eax, eax
out 0xdc, al
mov eax, 0x3da69dd6
adc eax, 0xa07940a0
jns 0x1400a0ebd
adc edx, dword [rcx]
or dh, byte [rax + 0x3d]
sti
sbb bl, byte [rbp - 0x2a729cc3]
invalid
xor dword [rsp + rax*8 - 0x1268c777], ecx
mov dword [rax], edi
xchg edi, eax
in eax, dx
jmp 0x1400a0f18
invalid
mov esp, 0x45d34a67
je case.0x140002106.86
movsb byte [rdi], byte [rsi]
cmp eax, 0x6bfe7b69
xor byte [r13 + 0x1b82c768], 0x86
fistp word [rsi]
invalid
sub dword [rcx], ebp
adc dword [rdx + 0x69039467], ebx
mov dword [rax], esp
invalid
lea ebx, [rbp - 0x430ae004]
invalid
xchg byte [rsp + rdx + 0x69e7920f], al
test al, 0xfb
or byte [rax + rdi], 0xfd
mov edx, 0x795e69ac
retf 0x39bb
invalid
invalid
mov ebx, 0xe8e19439
invalid
add cl, cl
sbb al, 0xd9
mov ah, 0x7c
add eax, 0x15f78b41
test byte [rdi - 0x3f5e79c1], 0xc7
or bl, byte [rbp - 0x3b]
jnp 0x1400a0feb
lea edx, [rdi - 0x55]
stosd dword [rdi], eax
adc al, 0x92
jo 0x1400a0fe3
lodsb al, byte [rsi]
scasd eax, dword [rdi]
out 0x77, eax
pop rsp
xor dword [rdi - 0x2dbd040a], ecx
mov ebp, 0xb8262d1e
sti
sar byte [rbp - 0x47d9d2e2], cl
sub eax, 0xa5b826
sti
movsd dword [rdi], dword [rsi]
add bl, bh
outsd dx, dword [rsi]
lodsb al, byte [rsi]
invalid
cld
invalid
invalid
ficom word [rcx]
retf 0xfc16
invalid
sub ebx, dword [rax + 0x14]
div edx
test byte [rdi + rbx*4], 0xff
out 0xfe, eax
je 0x1400a1039
mov esi, 0x5a6f0ef3
fdiv qword [rax - 0x54]
invalid
sub ch, byte [rdi + 0x59bd76ff]
lahf
call 0x18aee1555
invalid
add al, 0xe4
sbb al, 0x46
clc
sub eax, 0x33c19ad6
invalid
invalid
sal dword [rbx], 0xfc
scasd eax, dword [rdi]
invalid
invalid
outsd dx, dword [rsi]
cli
comiss xmm4, dword [rdi - 0x25]
and al, 0xdd
rcl byte [rdi]
dec byte ds:[rcx + 0x19]
push rbx
pop rdx
outsd dx, dword [rsi]
invalid
pop r10
not dword [rcx + rax*8 + 9]
sbb al, 0xde
hlt
xchg byte [rbp - 0x19], ch
out 0xea, eax
jb 0x1400a116b
jae 0x1400a10dc
lodsq rax, qword [rsi]
or al, 0xec
in al, dx
cmc
xor eax, 0x8c9a7288
stosd dword [rdi], eax
or dword [rbp - 0x37], ebp
sbb al, ah
cli
int3
or al, 0xbc
adc sil, r13b
sub al, byte [rdi]
jnp 0x1400a10e2
pop rdx
jge 0x1400a10ce
cmp bh, al
movabs eax, dword [0xc64cf4f96c8dc37b]
invalid
lea ebp, [rcx + rdi*8 - 0xc]
invalid
invalid
xchg dword [rdi], edx
push rcx
jl 0x1400a116e
invalid
dec edi
pop rsi
fcompi st(5)
jno 0x1400a11e5
iretd
out dx, eax
loopne 0x1400a114e
invalid
in al, dx
sbb dh, bl
cli
pop rdi
in eax, dx
clc
sahf
out 0x57, eax
invalid
cmpsb byte [rsi], byte [rdi]
add dword [0x1b7580570], 0x30
push 0x19
pop rbp
sar byte [rdi + 0x6ed274c9], cl
fst dword [rsi + 0x14e98608]
adc al, 0xaa
adc al, 0xaa
or dword [rsi + 0x11c2a5db], edi
push 0xffffffffffffffbc
xchg rsi, rax
cmp al, 0x38
pop rdx
xor eax, 0x9f4e0393
xor eax, 0x9f4e0393
invalid
xor eax, 0x9f4e0393
jae case.0x140002106.116
add byte [rsi + rbx - 0x6d0a065d], 0x62
mov esi, esi
sbb byte [rdi], cl
mov ah, 0x6e
sbb edx, 0x74faac79
pop rbp
movabs eax, dword [0xe57b013ff0e7af7a]
out 0xf0, eax
invalid
add dword [rbx - 0x1b], edi
fnstsw word [r10]
out 0xf0, eax
invalid
in eax, 0x43
fnstsw word [rdx]
lahf
in al, dx
out dx, eax
push rcx
test ecx, eax
rcr dword [rbx - 0x6b0d3cb], 0x9e
rcr dword [rbx - 0x6b0d3cb], 0x9e
in al, dx
fdivrp st(3)
int1
lea rcx, [rdi]
movabs eax, dword [0xad75efdded4a1db8]
in eax, dx
fucomp st(7)
jne 0x1400a11b4
in eax, dx
fucomp st(7)
jne 0x1400a11b4
int 0xdd
mov bl, 0x7e
fidiv dword [rcx - 0x6f]
xlatb
fcomp qword [rax - 2]
pop rdx
jne 0x1400a126d
mov esi, 0xaff5f43a
cmp dh, ah
cmc
scasd eax, dword [rdi]
jbe 0x1400a1256
mov ebx, 0x590f8a17
fadd qword [rdi]
mov cl, 0xbd
invalid
invalid
clc
ror byte [rbx], 0x66
fdiv dword [rsi + 0x213179c7]
xchg esi, eax
xchg ebp, ecx
sbb al, 0x9e
pop rax
fucom st(6)
out dx, eax
xchg ebp, eax
in eax, dx
in eax, dx
shr byte [rbp - 0x49], 1
cmpsb byte [rsi], byte [rdi]
sub eax, 0xbf0ad87f
xor dh, ah
mov ah, byte [rbx + 0xd]
sti
mov bh, 0xf0
add qword [r11 + 0x7d0de5a6], rsp
invalid
or bh, byte [rdi + 0x638ae630]
or eax, 0x49f0b7fb
add dword [rbx + 0x7d0de5a6], esp
invalid
jge 0x1400a124d
in eax, 0x9d
popfq
invalid
in al, dx
insd dword [rdi], dx
adc eax, 0x49efd59c
xchg ebx, eax
imul edi, dword [0x172ac72f7], 0xf91139e8
cmp dword [rcx], edx
stc
cmp dword [rcx], edx
stc
cmp ah, byte [rbp + rcx - 0x80]
cld
mov edi, 0x428c00b7
invalid
mov word [rdx + 0x6c], es
invalid
add byte [rdx + rax*2 + 0x5575606c], cl
mov ch, 0x26
invalid
pop rdi
invalid