Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
invalid
mov dh, 0xf2
mov ch, 0x8b
mov ebp, dword [rax + 0x3a]
sal rsi, 1
mov ebp, dword [rax + 0x3a]
sal rsi, 1
xor cl, dl
push rdi
xchg dword cs:[rax + 0x99f2b81], edi
xor al, bh
push rdi
invalid
invalid
sub al, 0xac
pop rax
invalid
sub eax, 0x44a8affa
cdq
int1
invalid
jno 0x1400a0839
sbb eax, 0x7c83aefc
cdq
or al, 0xfc
jae 0x1400a0926
mov ch, 0x50
jrcxz 0x1400a08d0
invalid
jne 0x1400a08d6
mov ebx, 0x7d8e7b36
int1
invalid
xor dword [rsi + rdx*8 - 0x3fd8fdb6], 0xfb8fe250
pop rcx
ret
lodsb al, byte [rsi]
push rbp
invalid
jmp 0x1400a0967
invalid
adc rax, 0xf436dd1
mov ecx, 0xb8faa244
adc dword [rdx - 0x22], ebp
rcl edi, 0x4e
invalid
invalid
invalid
xchg esp, eax
xchg byte [rdx - 0x2dad89ef], dh
sar bh, cl
invalid
wait
sar bh, cl
imul ebx, dword [rbx + 0x4f106a96], 0xf67ee8bc
idiv dword [rsi]
mov ecx, 0x68f1ad87
invalid
invalid
jg 0x1400a08e7
mov ah, 0xf7
adc dword [rdi], edx
outsb dx, byte [rsi]
fmul qword [rdx - 0x69d237a4]
insb byte [rdi], dx
shr byte fs:[r14 + 0x29b8b02c], 0xd9
or esp, dword [rbp - 0x6a77f786]
insb byte [rdi], dx
fucomp st(3)
pop rbp
lodsb al, byte [rsi]
movsd dword [rdi], dword [rsi]
invalid
idiv byte [rdi - 0x6f1026ed]
insd dword [rdi], dx
xchg byte [rdi + 0x5f], ch
cmpsd dword [rsi], dword [rdi]
invalid
push rdi
sbb byte [rbp + rcx*2 - 0x2b], bh
xchg esp, eax
sub byte [rbx], dh
fdiv st(4), st(0)
movabs byte [0x5f59f27bdf6abd14], al
invalid
push 0x17affd7e
cmp byte [rsi + 0xbef2091], bh
test dword [rdi], eax
xchg ebp, eax
pop rsp
push rdi
insd dword [rdi], dx
sub esi, ebp
push r8
invalid
jle 0x1400a09b9
scasd eax, dword [rdi]
invalid
in al, 0xff
mov edi, 0x55ffa4dc
push qword [rax + 0x6117199c]
mov edi, 0x382f9efc
invalid
invalid
loopne 0x1400a09b5
inc dword [rsi - 0x2d]
lodsb al, byte [rsi]
movabs byte [0x7fee7ef0e026ff30], al
xor bh, bh
loopne 0x1400a09e1
jle 0x1400a09e1
jg 0x1400a0a73
out dx, al
xor bh, bh
loopne 0x1400a09e1
jle 0x1400a09e1
jg 0x1400a0a73
out dx, al
invalid
push rcx
mov eax, dword [rbp - 0x68]
ja 0x1400a0a67
leave
mov ch, 0x4e
clc
invalid
invalid
jns 0x1400a0a60
xor esi, dword [rsi + 0x3c]
jbe 0x1400a0a6b
pop rsi
invalid
int1
jg 0x1400a09e6
fnstsw word [rdx - 0x78f66700]
jmp 0x1400a0a2d
xchg ebx, ebp
fistp word [rax + 0x4ac53774]
mov al, 0x91
push 0x667330c6
jae 0x1400a0ac0
jae 0x1400a0ac0
cmc
mov dl, 0x15
add ah, byte [rdx + 0x6f182f42]
xor al, 0xeb
add esi, dword [rbx + 0x7e]
lea ecx, [rsi - 0x4504ef30]
invalid
jle 0x1400a09f6
mov ss, eax
adc bl, bh
mov edx, 0x2aec2e88
mov byte [rsi], ch
in al, dx
sub ah, byte [rbx]
hlt
add r15d, r10d
or byte [rsi], bl
insb byte [rdi], dx
sbb ah, byte [rdi + 0x292b1b28]
jle 0x1400a0a2a
cmpsd dword [rsi], dword [rdi]
mov byte [rsi], ch
in al, dx
sub ah, byte [rbx]
hlt
cmpsd dword [rsi], dword [rdi]
jg 0x1400a0aa4
dec dword [rbx - 0xf9a759d]
jnp 0x1400a0a8e
cmc
cmpsd dword [rsi], dword [rdi]
cdq
jle 0x1400a0a38
iretd
in eax, 0x7d
test al, 0x78
mov bh, 0x60
adc byte [rax + 0x37], ch
invalid
invalid
sub al, dh
add eax, 0xffb83d29
stosd dword [rdi], eax
pop rbp
invalid
jge 0x1400a0a4b
hlt
push rbp
mov byte [rsi + 0x3e76efae], ah
add byte [rax], al
add dword [rcx + 0xd], esi
mov edx, 0xbe54c4c2
or ch, byte [rcx - 0x48f406ec]
or word [rbp + 0x6346f899], si
out 0x53, eax
test eax, 0xaff5f36
pop rdi
dec dword [rdx]
pop rdi
dec dword [rdx]
xchg ebp, eax
pop rsp
int3
push rbp
lea edi, [rdi + rsi*4 - 0x32428ba4]
retf 0xa973
invalid
je case.0x140002106.31
int 0xca
jae 0x1400a0aa2
invalid
test eax, 0xf0f6ce6e
jnp 0x1400a0ab4
outsb dx, byte [rsi]
invalid
jge 0x1400a0b76
jae 0x1400a0b22
mov rsp, cs
and ch, dl
or eax, 0x7788f
jne 0x1400a0b3a
adc dword [rbp + 0x36], ebx
cmc
mov edi, 0x8b9dff98
call [rbp - 0x21f17775]
out 0xdc, al
imul dword [rsi - 0x74b578c4]
invalid
jl 0x1400a0ad1
call [rbp - 0x21f17775]
out 0xdc, al
imul dword [rsi - 0x74b578c4]
xchg dword [rdx - 0x75], ecx
fstp xword [rcx + rbp*4 - 1]
jp 0x1400a0af3
invalid
movabs rax, 0xbd939eb131e5c243
cld
jmp 0x1400a0b55
shr byte [rdx - 0x3e441456], 0xde
fbstp tbyte [rdx + 0x5f]
pop rdi
pop rdi
mov ebp, 0xa9507e
enter 0xffffffffffff803f, 0xffffffffffffffc3
jnp 0x1400a0aee
cmp al, 0xfc
jg 0x1400a0b53
invalid
out dx, al
invalid
ror ah, 1
push rax
sbb dword [rsi + 0x38], esi
adc al, 0xc8
adc ebp, dword [rdx + 0x55]
push 0x55
test dword [rsi + rdx - 0x7338aa02], edx
push rax
mov ebp, 0x7df15add
int1
jge 0x1400a0b71
invalid
int1
jge 0x1400a0b71
jnp 0x1400a0bfd
invalid
sbb dword [rdi + rbx + 0x52], 0x72148a7f
and ebp, dword [rbx + 0x1a]
sbb dl, byte [rax + 0x62]
sbb dl, byte [rax + 0x62]
invalid
invalid
pushfq
invalid
sub al, 0xd2
mov ebx, 0x1e1b6f5e
cld
invalid
push rdi
ficomp dword [eax - 0x62b1937c]
mov dl, 0x4f
jle 0x1400a0b9f
mov ebx, 0x7b3e439e
adc eax, 0x66138601
or ecx, ebp
jo 0x1400a0b88
jrcxz 0x1400a0bd4
fimul word [rdx - 0x553939c1]
xchg dword [rax + 0x7f8a75fb], edi
push 0xffffffffffffffaa
lahf
cmp al, 0xf9
pop rax
jnp case.0x140002106.44
out dx, eax
invalid
cmp eax, 0x1cc1f1b3
and al, 0x87
mov bl, 0xf1
rcr dword [rsp], 0x87
pop rsp
mov cl, byte [rbx + 0x256d7216]
jrcxz 0x1400a0b99
jmp rsp
call qword [rdi + rbx*4]
scasd eax, dword [rdi]
invalid
invalid
imul esi, dword [rdx], 0x767bf25e
fsubr st(7)
sbb byte [rax], 0x68
invalid
push 0xffffffffffffff85
out dx, eax
invalid
mov ebp, dword [rax + 0x1964233f]
inc dword [rbp + 0x45]
jp 0x1400a0c56
outsd dx, dword [rsi]
loopne 0x1400a0c16
sub dh, byte [rdi + rsi + 0x165278aa]
invalid
invalid
jae 0x1400a0c7f
invalid
invalid
invalid
add al, 0xd0
push rbx
std
mov edx, dword [rax + 0x41b0ba42]
mov edx, dword [rax + 0x41b0ba42]
jge 0x1400a0d10
add dword [rcx], ecx
lodsd eax, dword [rsi]
scasb al, byte [rdi]
jge 0x1400a0ce5
push rax
invalid
out dx, eax
invalid
jg 0x1400a0c97
jge 0x1400a0cc2
sub dword [rdx - 0x4745e839], eax
invalid
mov ebp, 0xcf6fcd10
sub eax, 0x61206958
invalid
int 0x6f
iretd
invalid
lodsd eax, dword [rsi]
lodsb al, byte [rsi]
pop rdi
wait
jge 0x1400a0cad
invalid
invalid
xor ebp, dword [rcx + 0x51d715c0]
pop rsi
cmp cl, byte [rdi + 0x11]
jb 0x1400a0ce1
push rbp
xchg dword [rsi + 0x76], ecx
sbb ah, byte [rcx]
invalid
jbe 0x1400a0d2d
and esp, eax
in eax, 0xac
sbb dword [rax + 0x5a], esp
invalid
xor bl, cl
shl dword [rdi + 0xddc1b7b], 0x47
fld dword [rdi]
invalid
sbb ebx, esp
or eax, 0x4a07d947
invalid
invalid
mov esi, 0x44e7ad35
invalid
xlatb
xlatb
movsd dword [rdi], dword [rsi]
or dword [rbx - 0x15743205], 0x7ef997fb
jns 0x1400a0d4c
cmpsd dword [rsi], dword [rdi]
rcl byte [r15 - 0x2c9ea00c], 0xc2
out 0x7c, eax
push 0xffffffffb8a6ff99
jmp qword [rsi - 0x22806048]
jmp qword [rsi - 0x22806048]
jae 0x1400a0dc5
xchg edi, eax
mov qword [r8 + 5], rbp
jne 0x1400a0d34
push rsi
fstp dword [rcx + 0x6e907e0f]
leave
dec byte [rcx]
or al, 0xcb
cdq
jrcxz 0x1400a0dde
add dh, byte [rsi + 0xf]
movabs eax, dword [0xd57fe6912d815137]
out 0x7f, al
invalid
pop rbx
invalid
out 0x7f, al
invalid
pop rdi
lodsd eax, dword [rsi]
jbe 0x1400a0df1
cmp dh, bh
sbb al, 0x50
out dx, eax
sti
add dword [rbp + 0x4f], 0x7b66392b
invalid
jnp 0x1400a0db8
loop 0x1400a0e08
invalid
scasd eax, dword [rdi]
adc ebp, edi
mov ebp, esp
in al, dx
mov ch, byte [rbp - 0x4586ee02]
sub qword [0xfe2c9595], 0xffffffffffffffc5
and eax, 0xef87d515
xchg edi, ebp
xchg edi, ebp
out dx, eax
stc
mov esi, 0xf6ff7efb
pop rbp
mov edx, 0x7f4d8b4d
mov ecx, esi
add eax, dword [0x14c6fff27]
or al, 0xb3
invalid
or al, 0xb3
movabs eax, dword [0x41b8fe1f7aebe42d]
mov cl, 0x7c
out dx, al
jmp 0x1400a0e4f
sub eax, 0x1f7aebe4
invalid
adc al, 0x8a
sbb al, 0xd0
xor byte [rdi + 0x174943dd], al
invalid
xchg ecx, eax
invalid
mov ebp, 0xdbba0b53
invalid
test byte [rdi + 0x6a777b3], al
add r9, qword [rax + r13]
invalid
invalid
adc rax, 0x12263b0b
invalid
mov byte [rdi + 0x1c], ah
add eax, 0x201c637a
sbb al, 5
jp 0x1400a0ed3
sbb al, 0x20
mov cl, byte [rsi - 0x321d934d]
mov r9b, 0xb
xor cl, byte [rax]
call 0x159049637
add dil, dil
cmp esi, edi
invalid
mov esi, 0x27068ab7
and al, 0xa8
jno 0x1400a0e6a
invalid
xor al, dl
invalid
adc esi, dword [rdi + 0x7bd78ede]
test dword [rsi + 0x63fda640], edx
out 0xeb, eax
invalid
mov bh, 0xde
mov ss, edi
jnp 0x1400a0e36
xchg esi, eax
cmpsb byte [rsi], byte [rdi]
std
invalid
and bh, byte [rax]
mov ah, 0x67
invalid
xlatb
or esi, dword [rax + 0x22]
jge 0x1400a0ee2
invalid
test eax, 0xf14acced
insd dword [rdi], dx
xchg ebx, eax
invalid
invalid
test al, 0x26
ja 0x1400a0ec4
int1
je 0x1400a0eab
hlt
jp 0x1400a0efe
mov edi, edx
clc
xor byte [rbx + rax*2], dh
xor al, 0x43
xor al, 0x43
sub eax, 0x2d0149d6
xchg byte [rax - 0x57d2c096], dl
scasd eax, dword [rdi]
or byte [rbp + 0x3d], dh
jbe 0x1400a0ecf
out 0xef, eax
add edi, edi
cmp eax, 0x7f75d0f7
stosb byte [rdi], al
sub bh, byte [rdi + 0x2fdaab59]
mov byte [rsp + rcx*8], al
insb byte [rdi], dx
std
std
invalid
ret 0x1a96
out dx, eax
jb 0x1400a0efc
or ah, al
sbb eax, 0x709678d9
or ebp, dword [rax]
invalid
jnp case.0x140002106.85
push 0xfffffffffb3b0918
invalid
fist dword [rdi + 0x3d39a937]
xchg ebp, eax
invalid
invalid
lea ebx, [rbp + 0x3d271ffc]
invalid
cmp dword [rbp - 0x4e], 0x52a39c4d
invalid
jge 0x1400a0f41
pushfq
movabs dword [0x2e72915a1a164152], eax
outsd dx, dword [rsi]
and byte [rcx - 0x6f662d4a], ah
nop
nop
sub al, 0x84
jno 0x1400a0f8d
invalid
push rsp
pop rsp
mov ebp, dword [rbx]
invalid
fcom dword [rcx - 0x5f]
invalid
cli
jg 0x1400a0fd9
int1
sub dword [rdx - 0x75414091], 0xffffff9f
outsd dx, dword [rsi]
mov edi, 0xf69f8abe
invalid
jb 0x1400a1020
outsd dx, dword [rsi]
mov edi, 0xf69f8abe
invalid
invalid
sti
jl 0x1400a0f7b
cli
invalid
mov dl, 0x3b
add eax, 0x623c2f8b
push 0x50b5c153
push rax
cmc
invalid
jb 0x1400a1001
jg 0x1400a1006
mov ecx, 0xffd7a94d
cli
mov edi, 0x99f5b3f8
jbe 0x1400a0fb5
and ecx, edi
pop rsi
pop rsi
pop rsi
cmc
scasd eax, dword [rdi]
add al, 0x2e
cmp esp, eax
imul esp, dword [rsi + 0x26019e88], 0xffffff98
pop rcx
jmp 0x131713e4e
mov ds, esp
movabs eax, dword [0x67bdfd1a5733ee27]
push rax
jb 0x1400a0fd2
fisttp dword [rcx]
test al, 0x72
invalid
jp 0x1400a10b1
int1
push 0xffffffffdc98440b
movsb byte [rdi], byte [rsi]
js case.0x140045520.3
int1
cld
sub byte [rsp + rax*2], bl
adc cl, byte [rbx + 0x5d68f4ea]
invalid
hlt
invalid
pop rbp
invalid
ret
sar byte [rdi], 0x1a
mov ebp, 0x20e6f979
sti
xchg byte [rax + 5], bh
xor eax, dword [rdx - 0x3422c29c]
invalid
cmp dword [rdi - 0x22bf44f8], esi
mov bl, 0xf3
repne lodsd eax, dword [rsi]
pop rax
fist dword [rbx + rdi*8]
out dx, al
or byte [rdi], dh
sub ch, bh
invalid
cmp byte [rsi], cl
invalid
invalid
adc al, 0x77
pop rsi
mov bh, 0x8a
jl 0x1400a115d
and bl, byte fs:[rcx + 0x32baec]
invalid
invalid
adc dl, byte [rdx - 0x5d1ce1bb]
xor ah, byte [rdi]
lahf
mov ah, 0xac
mov esi, 0xe3601cc1
outsd dx, dword [rsi]
cli
mov edi, 0xb3202817
sub byte [rax], ah
mov bl, 0x52
sub byte [rax], ah
mov bl, 0x52
mov dh, 0xcf
sub byte [rcx - 0x51], 0x17
fistp qword [rax]
scasd eax, dword [rdi]
mov eax, 0xcf4165e6
iretd
insb byte [rdi], dx
xor cl, byte [rcx - 0xdf6c4c1]
invalid
or ebx, esi
push rax
in al, dx
push 0xffffffffffffffaf
test byte es:[rsi + 0x7aa15dbb], dl
scasd eax, dword [rdi]
pushfq
push 0x17
fcom dword [rdi + rax*2 + 0x68]
invalid
invalid
and dword [rdx], edi
push rsp
invalid
jbe 0x1400a121e
jae 0x1400a127b
clc
mov ebx, 0xc50f8a17
xchg ecx, eax
cmpsb byte [rsi], byte [rdi]
add dl, byte [rbp - 0x80]
mov cl, byte [rdi]
invalid
xchg ebp, eax
imul ebx, dword [rcx - 0x5e], 0x97eedda9
mov esp, 0x7dc4d64e
mov al, byte [rdi + 0x45ea854a]
int 0xab
jge 0x1400a11be
xchg dword [rdx - 0x7b], ecx
invalid
int 0xab
sbb r8, rax
adc byte [r12 + r15*8 - 0x9c14b36], r14b
invalid
invalid
sbb byte [0xe0768a86], 0x90
ja 0x1400a1232
ficomp dword [rcx + 0x44f0901d]
std
add eax, 0xd77788a3
in eax, 0xd
jge 0x1400a124d
or dword [rbx - 0x10], ebx
adc edi, dword [rcx - 0x1d]
invalid
pop rsp
pop rsi
or dl, dl
test eax, 0x74024a94
xchg ecx, eax
push 0xffffffffffffffcf
pop rdi
jmp 0x16d4df90b
sbb al, 0x24
sub ebp, dword [rdx + riz*8 + 1]
shr ebp, 1
mov dl, 0xb3
in eax, 0x71
call qword [rsi]
test al, 0xa9
jle 0x1400a131d
mov al, 0x93
bnd jns 0x1400a1309
jns 0x1400a1309
mov ecx, 0x7a2c2a9a
jg case.0x140002106.125
invalid
sti
push rsp
sub byte [rdx - 0x28018559], dh
xlatb
sti
xlatb
pop cx
sub dl, bh
pop rdx
mov cl, 0xdc
push rbp
mov byte [rdx + 0x21c36e89], ch
outsb dx, byte [rsi]
ret
and ecx, ecx
hlt
setb byte [rsi + 0x2b793f63]
add dword [rcx + 0x55], 0x16f5ff7f
xchg edi, eax
mov ebx, 0x20571c21
fcomp qword [rbp + 0x21]
out dx, al
sub dword [rsi - 0xd], esp
mov ah, 0x9b
outsb dx, byte [rsi]
movabs byte [0x2165efc4081bb389], al
xchg ebp, eax
jg 0x1400a12be
mov bl, 0x1b
or ah, al
out dx, eax
and dword gs:[rbp - 0xb847481], edx
jnp 0x1400a1329
cli
inc dword [rsi - 0x37426f5d]
cmp ebx, dword [rdi]
mov esi, 0xb3feff77
adc al, 0x1d
pop rsp
xor esi, dword [rbx - 7]
clc
invalid