Function at 0x140001fb0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x1400020c4
mov rsi, rcx
call fcn.140002160
test al, al
je 0x1400020cd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x1400020c4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x1400020b3
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1400020aa
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x1400020bd
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x1400020bd
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x1400020bd
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x1400020bd
mov rcx, rbx
call fcn.1400021b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020e0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002136
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140002123
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001ea0
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
imul edx, eax, 0xffffffa9
pop rbx
out dx, eax
mov bl, 0xa5
out dx, eax
pop rdi
invalid
cmc
pop rdx
cdq
sub ecx, dword [rsi - 0x3b0122c3]
stc
sbb ecx, ecx
lahf
lahf
lahf
invalid
sti
invalid
pop rdi
mov eax, dword [rax - 0x60]
jbe 0x1400a2971
fld xword [rax + 0x5d3004e6]
retf 0x5335
rcr edi, 1
test eax, 0xe7efa957
cmc
cwde
fistp word [rsi - 0x5e]
cmp ah, byte [rdx + 0x22a5df3c]
invalid
cmp cl, byte [rbp + 0x5c]
wait
pop rdx
fbld tbyte [ebx]
outsd dx, dword [rsi]
or cl, byte [rax]
pop rsp
mov edi, dword [rsi]
jns 0x1400a294f
invalid
cdq
jbe 0x1400a2a0b
mov edi, 0xb484c808
invalid
not byte [rsi]
invalid
pushfq
mov ecx, 0xdcf85d1f
pop rbx
sahf
cli
invalid
jrcxz 0x1400a2a6f
jl 0x1400a2a06
jle 0x1400a2a85
sti
xchg ebx, eax
cmpsb byte [rsi], byte [rdi]
push rcx
mov dh, 0xcd
invalid
cli
add dword [rax - 0x35], esp
invalid
pushfq
movabs byte [0x985f96f0da2a65ad], al
sub byte [rcx], dh
in al, 0x4d
invalid
invalid
cwde
movsb byte [rdi], byte [rsi]
invalid
pop rbp
invalid
in eax, 0x80
out dx, eax
movabs eax, dword [0x8b270821500ef3a0]
invalid
pop rsi
invalid
push rsp
cmc
invalid
fist dword [rdi]
sbb byte [rsi], 0x33
invalid
stc
invalid
jns 0x1400a2a85
invalid
invalid
xor ebp, edi
shr dword [rax], 1
add dword [rbp - 0x11], ebp
adc esi, edi
xchg edi, eax
push rdi
leave
mov cl, 0x94
push rbx
push 0x19
cmpsb byte [rsi], byte [rdi]
jrcxz 0x1400a2b34
fist word [rdi + 0x19]
cmp eax, 0xa1ae05c2
sbb dword [0xe1b830c4], edi
mov eax, dword [rcx + 0x1e]
jnp 0x1400a2b65
ja 0x1400a2b4e
xor eax, 0x4b40f4da
sub dword [rcx + 7], edi
add rdi, qword [rdi - 0x3f]
rcr edi, 1
fbld tbyte [rdx - 0x5fe60045]
mov dl, 0x7d
pop rbx
invalid
imul esp, dword [0x17dc36424], 0xffffffa1
movabs eax, dword [0xe6439302177d1bf]
invalid
invalid
push rdx
mov byte [rbp - 0x3e], bh
fbld tbyte [rdx - 0x5fe60045]
mov dl, 0x7d
pop rbx
invalid
invalid
jge 0x1400a2af8
ret 0xfd73
jae 0x1400a2b35
jge 0x1400a2b53
invalid
std
out dx, al
movabs byte [0x53339c173c290e23], al
pushfq
xor edx, dword [rbx - 0x13]
pushfq
xor edx, dword [rbx - 0x13]
test al, 0x44
push 0x4b5145af
sub eax, 0x3617c95b
invalid
invalid
push rcx
sub rax, 0x3617c95b
invalid
invalid
invalid
int 0x67
mov bh, 0x8a
mov ecx, 0xb691336f
sub al, dh
invalid
invalid
and byte [rdx - 0x67], al
xor esi, esi
out 0x97, al
je 0x1400a2bb4
mov eax, dword [rdx + 0x16311b1e]
je 0x1400a2bf7
xchg ecx, eax
invalid
invalid
loopne 0x1400a2b42
mov dl, 0x48
wait
popfq
js 0x1400a2bf2
adc dh, byte [rcx]
invalid
cwde
invalid
mov byte [rcx + 2], ch
enter 0xffffffffffffece2, 0xffffffffffffffbd
sbb dh, byte [rcx + 0x58c76041]
add dword [rsi - 0x7254046b], eax
sbb byte [rcx], dl
xor eax, 0x9a029dd9
adc dword [0xda0cc9d1], esi
invalid
sub bl, byte [0x12f3932f1]
invalid
invalid
sbb byte [rsi], bh
out dx, al
movabs dword [0xa5577cf076fffffe], eax
invalid
sub dl, byte [rcx + riz*8]
fistp qword [0x17235e195]
jmp 0x17947ff4e
mov ch, byte [rsi + rsi - 0x62]
scasb al, byte [rdi]
jo case.0x140002136.42
ror dword [rdx + 0x27], cl
movabs eax, dword [0xdc32c20444124fa4]
adc al, byte [rsp + rax - 0x3e]
xor bl, ah
invalid
adc al, byte [rsp + rax - 0x3e]
xor bl, ah
xor byte [rbx + 0x22], bl
mov ebx, 0xf90540ec
sbb bh, ch
add eax, 0xaaef18f9
stosb byte [rdi], al
jmp 0x1553267d0
loopne case.0x140002136.40
mov esp, 0x78fc7beb
or al, 1
invalid
jnp 0x1400a2c96
js 0x1400a2ca8
add esi, eax
idiv esp
mov ch, cl
sti
je 0x1400a2c7c
lodsb al, byte [rsi]
and byte [r10], r12b
shl bl, 1
jrcxz 0x1400a2c6b
mov bh, 0x96
pushfq
invalid
call 0x17284a6d0
mov ch, 0x6c
insd dword [rdi], dx
jge 0x1400a2c45
and dl, al
jrcxz 0x1400a2c6b
mov bh, 0x96
pushfq
invalid
xchg edi, eax
imul esp, dword [rbx - 0x74], 0xffffff8d
invalid
lea esi, [rsi]
jbe 0x1400a2cf4
mov word [rbp - 0x10ce89ca], cs
out dx, eax
jae 0x1400a2c98
sbb rax, 0x680eaa83
imul byte [r14 - 0x13a71b8e]
je 0x1400a2d2d
pop rax
pop rax
mov bl, byte [rdx - 0x69]
sti
test al, 0x6f
sbb eax, 0x95b4be61
cmp eax, 0x648dbe00
mov ah, 0xc1
adc eax, dword [rsi - 0x53]
lodsd eax, dword [rsi]
lodsd eax, dword [rsi]
dec byte [rsi]
mov dl, 0xf
shr bl, 1
int1
mov word [rcx - 0xfef1a23], cs
invalid
in eax, 0x10
invalid
hlt
sbb r15d, r11d
invalid
pop rbp
invalid
invalid
loop 0x1400a2cc6
ret 0x454d
jo 0x1400a2d83
sbb al, cl
mov ebx, esp
sbb ebx, esi
push rcx
xlatb
jns 0x1400a2d53
invalid
or bh, dh
cld
idiv esp
cmpsd dword [rsi], dword [rdi]
insd dword [rdi], dx
invalid
invalid
sub edi, ecx
invalid
jb 0x1400a2d61
mov cs, word [rcx]
invalid
adc dl, al
mov ebx, 0xbcb11f85
invalid
mov ebp, eax
cdq
fild qword [rax + 0x30]
fild qword [rax + 0x30]
pop rdi
fisttp qword [rbx]
jbe 0x1400a2d7f
add dh, cl
invalid
cmp eax, 0x8319e568
test qword [r10 - 0x30], r14
rol byte [rdi + 0x55], 1
js 0x1400a2d3f
add eax, 0xb3f2659d
mov ch, 0x6b
and byte [rcx + 0x51], cl
popfq
mov bl, 0xb5
imul esp, dword [rax], 0x49
push rcx
mov edx, esp
or dh, byte [rdi]
push rbp
push rax
invalid
enter 0x1a1c, 0x25
cmp al, 0x23
xorps xmm6, xmm7
invalid
sti
invalid
push r14
outsd dx, dword [rsi]
invalid
call 0x19e824bea
fld dword [rax + 0x657f93d9]
sub ch, bh
xor ah, byte [0x1a92225e5]
leave
not dword [rdi]
invalid
mov bh, 0xfb
invalid
leave
not dword [rdi]
imul esi, dword [rdi + 0x515937fb], 0x1c2d142f
invalid
cmp eax, 0xd147897b
mov dword [rdi - 0x2f], eax
invalid
add ah, byte [rcx]
jb case.0x140002136.55
push 0x69019225
invalid
movabs eax, dword [0xe46240b603225c9a]
in eax, dx
out 0x3d, eax
cdq
or eax, 0x48634943
sub eax, 0x26f8ccaf
sbb al, 0xfb
sbb al, 0xfb
invalid
out dx, al
invalid
loop 0x1400a2e2c
adc byte [rax + riz*4], 0x4b
invalid
movaps xmm0, xmmword [rcx]
and dword [rcx + 0x23310dc0], 0xffffffe3
or dword ss:[rcx + 0x5cea7ff1], esi
pop rdx
xor eax, 0x575fd291
pushfq
lahf
invalid
lea esi, [rbp + 0x72]
cmp dword [rbx + 0x3b], 0xffffffbe
cmpsb byte [rsi], byte [rdi]
popfq
call rbp
invalid
jbe 0x1400a2f11
xchg ebp, eax
and al, 0xf8
and al, 0x4e
jno 0x1400a2f39
adc dword [rcx + 0x75], edi
fst dword [rdi]
test byte [rax], al
movabs al, byte [0x7068197bd5f0005c]
sbb dword [rax + 0x70], ebp
jne 0x1400a2eec
invalid
sbb dword [rax + 0x70], ebp
and dword [rcx], edx
movabs al, byte [0xa1e1fffefe474bbe]
movabs al, byte [0x6e1f3499bc1945a4]
xor al, 0x1f
outsb dx, byte [rsi]
xor al, 0x1f
outsb dx, byte [rsi]
loopne 0x1400a2ec1
stc
mov dl, 0xf1
xchg dword [rdx], esp
ret
and al, bl
cmpsb byte [rsi], byte [rdi]
scasd eax, dword [rdi]
mov dl, 0xb0
invalid
xchg ebp, eax
out dx, al
jmp qword [rbx - 0x3263f3fe]
invalid
bnd jnp 0x1400a2ff2
sub dword [rbx + 0x7eff5322], esp
push rbx
imul edi, dword [rcx], 0x58b9abba
invalid
movsb byte [rdi], byte [rsi]
push 0x7eab807b
invalid
sti
shr esi, 1
sar ebp, 1
mov eax, 0x7bf0ca14
invalid
invalid
invalid
in eax, 0x9a
push rbp
fld qword [rdx + 0x13]
fcmovne st(0), st(2)
jbe 0x1400a2ffe
mov ecx, 0xae63d6a1
lahf
mov al, 0x4f
pushfq
pop rdi
invalid
rcl dh, cl
movabs byte [0xc6d744f049cbfb2f], al
cmp ch, byte [rbp + 0x2e]
invalid
or cl, byte [rcx + 0x4a]
jg 0x1400a301b
sbb al, 0x44
jbe 0x1400a303d
jbe 0x1400a303d
sbb al, 0xf6
push 0xffffffffffffffce
and al, 0xca
push rcx
ror dword [rcx], cl
invalid
mov esp, 0x2f0b12f
cmpsb byte [rsi], byte [rdi]
test eax, 0xa6cb4918
and eax, 0xf9e07f43
jl 0x1400a301b
retf 0x88fc
nop
outsd dx, dword [rsi]
mov byte [rax - 0x5b], ch
movabs eax, dword [0x79fe02aacb7e044e]
invalid
retf
lahf
test eax, 0xf1d09334
int3
push 0x69
sub esp, esp
cmp eax, dword [rbx + rbp*4 - 3]
loopne 0x1400a2ffd
jae 0x1400a30ca
xor eax, 0x52e669a7
xchg edi, eax
sal dword [rsi], cl
jle 0x1400a305d
or ebx, dword [0x19b21c83e]
invalid
mov eax, 0xaa35f519
clc
adc ch, byte [rdi]
out 0xd8, al
loop 0x1400a3037
or eax, dword [rsp + rbx*8]
mov dh, 0x23
vrcpss xmm13, xmm0, dword [rsi]
mov esp, 0x6913d0c9
invalid
invalid
test eax, 0x71f6490d
cmp eax, 0x3176dffe
invalid
or dl, ch
add eax, dword [rdx + 0x1dd74e93]
mov esi, dword [rsi + rbp*2]
invalid
invalid
sal cl, 0xdc
mov edi, eax
mov bh, dl
mov esi, 0x763cfff9
xor dword [rdi + 0x3597f78b], ebp
invalid
fmul qword [rbx - 0x41057508]
stc
invalid
jmp 0x15e08414c
jmp 0x1400a308d
push 0x4c
and ebx, dword [rsi - 0x6ee90b00]
movabs al, byte [0xadaa5ca582f695c7]
adc dword [rsp + rax + 0x78], 0xffffffb6
mov edx, 0xc011b19a
jb 0x1400a315c
push rsp
add al, 0x78
mov dh, 0xba
invalid
insb byte [rdi], dx
sub esp, dword [rbp - 0x2388f04f]
movsd dword [rdi], dword [rsi]
mov cl, 0xf
ja 0x1400a30f3
movsd dword [rdi], dword [rsi]
mov cl, 0xf
ja 0x1400a30f3
xor eax, 0xe4cbeef8
loop 0x1400a3105
movabs eax, dword [0x90ff26a2e4413f8b]
je 0x1400a30de
in al, 0xa2
call qword es:[rax - 0x4c8b0cb6]
jmp rcx
mov ecx, 0xa8a175f5
jae 0x1400a3172
ror byte [rdx - 0x41d5e92c], cl
invalid
sub byte [rsi + 0x73feb922], bh
call 0x15ec60a69
out 0x7d, eax
movabs dword [0x8a1750158ae8c4b3], eax
mov edx, 0xe13bd269
loope 0x1400a31be
sar byte [rbx], cl
loope 0x1400a31be
cmp rax, 0xffffffff8a6e693f
add eax, 0x25e9ed93
invalid
jns 0x1400a30f3
and eax, 0xb4c98679
stosb byte [rdi], al
leave
mov ah, 0xaa
movsd dword [rdi], dword [rsi]
xchg edi, eax
jno 0x1400a31f0
call 0x121769132
push rbx
insb byte [rdi], dx
loope 0x1400a31cd
cmpsb byte [rsi], byte [rdi]
movsb byte [rdi], byte [rsi]
mov esi, 0xa3ff40b6
imul ebp, dword [rsp + rax*2], 0xffffffd7
cld
and ebx, dword [rax - 0x4580c740]
invalid
fcmovne st(0), st(3)
add dword [rdx + riz*8], esp
cmovb ebp, ecx
xor ebx, dword [rcx]
lahf
idiv edi
xchg edi, eax
jne 0x1400a3177
invalid
adc dword [rdi + 0x61], edi
sti
mov dl, 0x51
in eax, 0x74
insb byte [rdi], dx
invalid
stosb byte [rdi], al
xchg ebx, eax
xchg ebp, eax
push rdx
invalid
pop rbp
jle 0x1400a31ff
cmp eax, 0x94f917
mov edi, 0x7cf0e208
cmp edx, edi
pop rdi
wait
scasb al, byte [rdi]
adc eax, 0x6dc0b861
shr byte [rbp - 0x63], 0x5f
shr byte [rbp - 0x63], 0x5f
add al, 0xfd
invalid
nop
push rsp
push rbx
mov edi, 0x1da4fa78
js 0x1400a3232
movsb byte [rdi], byte [rsi]
sbb eax, 0x147d8985
cwde
invalid
js 0x1400a3232
movsb byte [rdi], byte [rsi]
sbb eax, 0x147d8985
cwde
invalid
mov dh, byte [rax - 0x6b]
xchg ebp, eax
xchg ebp, eax
push rbp
xor bh, cl
xchg r12, rax
out dx, eax
add esp, edi
loopne 0x1400a329b
movsb byte [rdi], byte [rsi]
lodsd eax, dword [rsi]
invalid
xchg esp, eax
invalid
std
imul eax, dword ss:[rdx + rbp*8 - 0x17c005e2], 0xfffffff0
invalid
retf
stosd dword [rdi], eax
adc bh, dl
fist word [rcx - 0x516b5c88]
js 0x1400a3240
xchg esp, eax
scasb al, byte [rdi]
add al, bh
insd dword [rdi], dx
invalid
add bh, 0x68
sub byte [rdi - 0x75d86125], cl
in eax, dx
invalid
js 0x1400a32f5
pop rcx
mov esp, dword [0xd17974ec]
invalid
popfq
in al, dx
invalid
cmp al, 0xac
retf 0x95a2
movabs byte [0xdbb15b3e34b9be95], al
fbld tbyte [rdx - 0x62]
movabs eax, dword [0xefe4113a16af8214]
adc al, 0x82
scasd eax, dword [rdi]
invalid
cmp dl, byte [rcx]
in al, 0xef
invalid
adc al, 0x82
scasd eax, dword [rdi]
invalid
jb case.0x140002136.117
movabs eax, dword [0x78765799e29eb4c4]
xchg esi, eax
invalid
jge 0x1400a3323
push rax
invalid
invalid
sbb byte [rdi - 0x625a572e], dl
invalid
out 0x5e, al
invalid
insb byte [rdi], dx
mov ah, 0x61
and eax, 0xddff5f42
adc eax, 0x95e16e51
cmp byte [rdx], 0x1b
mov r15b, 0x84
call [rcx + 0x1e30f655]
sub byte [rdi], bl
out 0xa4, eax
movabs byte [0x6634a631f4c3f97], al
push rax
push rax
cmovg ebx, edi
invalid
invalid
push rdx
jb case.0x140002136.121
sar byte [rbp - 0x418a95d6], 0x67
in al, dx
cdq
lahf
neg ebp
out 0x3f, eax
invalid
cmpsd dword [rsi], dword [rdi]
adc dword [rcx], ebp
movsb byte [rdi], byte [rsi]
invalid
jle 0x1400a3426
xchg esi, eax
xchg esi, eax
jne 0x1400a33fc
invalid
invalid
invalid
std
jge 0x1400a33bd
mov word [rdx], fs
pushfq
out dx, al
cli
adc byte [rbp - 0x2a36d195], dh
mov eax, 0xc23e35e3
cmpsb byte [rsi], byte [rdi]
movq mm6, qword [rdi + 0x7b]
ja 0x1400a3491
push rsi
and esp, esi
push rsp
invalid
xchg dword [0x1bfb0e9b7], edi
stc
cmpsb byte [rsi], byte [rdi]
jg 0x1400a3422
popfq
ret 0xaebf