Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xe56744c3
in eax, dx
in eax, 0xed
push rsp
int 0x63
push rsi
popfq
cwde
sbb esp, dword [rbx - 0x6c]
jg 0x1400a087f
invalid
out 0x22, eax
ror byte [rax + 0x4b4d02b9], 1
xor dl, byte [rbx]
sbb ebp, ebx
jno 0x1400a0838
sti
adc ebx, dword [rbx]
jmp 0x1400a08ad
sti
xor esi, dword [rax + 0x56f8a316]
sar dword [rdi - 3], cl
invalid
mov ebp, 0x3a30987
div ah
loope 0x1400a0854
call rax
jge 0x1400a07f6
sar byte [rbp - 0x62], 1
jbe 0x1400a07f3
jae case.0x140002106.1
je 0x1400a08d0
cdq
invalid
invalid
ret
or cl, bh
retf
invalid
invalid
test dword [rbx + 0x13], 0x902fee11
nop
fsub qword [rsi + 0x34e00521]
invalid
div byte [rdi]
push rax
mov ecx, 0x2f5bcadb
pop rsi
cmp al, 0x6d
movabs dword [0x770676e45f2faedf], eax
fild qword [rsi + 0x76e45f2f]
invalid
push rdi
call [rdi - 0x53]
sal al, 1
jnp 0x1400a0939
invalid
mov esi, 0x6f77c333
add byte [rcx - 0x2f], ch
shl dword [rdi - 0x35], 1
xor esp, dword [rbx + 0x3bbef1a0]
nop
xor dl, cl
invalid
mov esi, 0x3c7bffc2
invalid
push 0x49e71ec1
out 0x49, eax
xor al, 0xdc
scasb al, byte [rdi]
mov dh, byte [rax + 0xf0c0816]
sar dh, 1
jg 0x1400a0914
jbe 0x1400a0994
and eax, 0x73613a6a
or dh, byte [rsp + rbp*4 + 0x27]
lodsb al, byte [rsi]
invalid
xchg esi, eax
and al, byte [rdx]
fsub dword [rsi]
invalid
lodsb al, byte [rsi]
invalid
invalid
scasd eax, dword [rdi]
out dx, eax
adc byte [rax - 0x26], dh
shr ah, 1
nop
mov ebp, 0xcf3a75cd
or ecx, dword [rdi]
xchg esp, eax
add eax, 0x8ce60602
test byte [rcx + riz], bl
sub byte [0x17028bca2], dl
mov esp, 0x59ded186
stosb byte [rdi], al
loop 0x1400a0938
loop 0x1400a09e1
invalid
invalid
jp 0x1400a099d
shl byte [rbx], cl
insb byte [rdi], dx
xchg esp, eax
push rbp
sub ah, byte [rbp + 0x268aea0]
sbb ebx, esi
mov ch, 0xed
lodsd eax, dword [rsi]
invalid
or eax, ebx
jns 0x1400a0968
jg 0x1400a0a0c
sbb ebx, 0xffffff85
sub byte [rbx - 0x67], dh
mov edx, edi
mov bl, cl
jmp 0x14da3f377
sti
invalid
fistp word [rbp + 0x1e]
cmp eax, 0x7c9137ac
cwde
jb 0x1400a09f7
adc al, 0x88
adc dword [rax + rax*4 + 0x6c8a4922], edx
and cl, byte [rcx - 0x76]
insb byte [rdi], dx
and cl, byte [rcx - 0x76]
insb byte [rdi], dx
loopne 0x1400a0a24
and byte [rbx + rbx*4 + 0x74], bh
movsd dword [rdi], dword [rsi]
enter 0xffffffffffff8aa2, 0xe
or esp, dword [rcx + 0x47]
push rdx
push rdx
mov dl, 0x57
mov esp, 0x24fb1c2
jnp 0x1400a0a67
invalid
jp 0x1400a09c0
sar byte [rdx + rbp*8 - 0x2ad64609], cl
fsubr dword [rbx]
fdivr dword [rsi]
cmpsb byte [rsi], byte [rdi]
mov esp, 0x29b9f7ea
invalid
cmpsb byte ds:[rsi], byte [rdi]
mov ebp, 0xd38b2368
mov dl, ch
mov dh, 0x7c
iretd
invalid
adc esp, esi
mov r9b, 0xde
invalid
hlt
jae 0x1400a0a3e
loop 0x1400a0a0d
push rax
mov dl, bh
cli
jle 0x1400a09c8
invalid
mov esp, 0xfed5a3b5
mov esi, 0x97bf0db
cmp eax, 0xb39925c5
mov bl, 0x4e
sti
invalid
mov ebp, 0x58e52c80
popfq
jg 0x1400a09e6
fnstsw word [rdx - 0x23039765]
wait
movabs al, byte [0x5d3752cde2aa47f3]
invalid
invalid
invalid
std
invalid
adc eax, 0x77b29c86
push rdi
invalid
invalid
and ebx, dword [rsp + rcx*8 + 0x1d]
repne lodsd eax, dword [rsi]
xor al, 0x60
cmp esp, 0xbebd7ece
mov edx, 0x82171f68
invalid
stc
invalid
jnp 0x1400a0add
std
in al, dx
invalid
jbe 0x1400a0b13
add edi, dword [0xd38253ec]
js 0x1400a0a78
jae 0x1400a0b0f
mov al, byte [rcx + rdx*4 + 0x432f558c]
movabs eax, dword [0xe9c992952becaa44]
out dx, al
mov ecx, 0xfbe93e23
lodsd eax, dword [rsi]
add eax, ebx
jae 0x1400a0b4a
push rax
sub r8, r9
mov ebp, 0x50e28e96
pop rdi
cdq
call rdi
invalid
hlt
xor ecx, dword [rbx - 0xf]
invalid
and eax, 0xdff6e8d9
push rdi
xchg ebp, eax
fstp xword [rax - 0x3f73621d]
sbb eax, 0x746886b2
in eax, 0xe7
cmp bh, byte [rbx + 0x21]
out 0x3a, eax
jnp 0x1400a0b6f
invalid
mov bl, 0x3d
out dx, eax
invalid
invalid
jrcxz 0x1400a0bbf
and ebp, dword [rax + 0x2cf298da]
fild qword [rax + rbp*4 - 0x601086ec]
sub al, 0xdf
lodsb al, byte [rsi]
test al, 0x14
jns 0x1400a0b65
lahf
cld
lodsb al, byte [rsi]
invalid
scasb al, byte [rdi]
and al, 0xc
rcr dword [rdx], 0xed
cli
fiadd word [rcx + 0x3f4e2c7a]
pop rsi
sahf
jnp 0x1400a0b19
and dword [rdx + 0x65], esi
enter 0x242a, 0xffffffffffffffdc
fsubr qword [rdx + 0x6f]
fsubr qword [rdx + 0x6f]
push rdx
invalid
pop rbx
sub eax, 0x37f38ae8
invalid
js 0x1400a0b7b
cmc
push rbx
add al, 0xe9
adc eax, 0x7fbf60ed
or eax, 0xfff0778a
jnp 0x1400a0b77
jbe 0x1400a0c01
xchg ebx, eax
xchg ebx, eax
invalid
idiv dword [rsi]
cli
xchg ebp, eax
xor byte [rsi], ch
or byte [r13 - 0x5b], r10b
or byte [rbp - 0x5b], dl
or byte [rbp - 0x5b], dl
mov edx, 0x332f8f80
pop rdi
wait
invalid
xlatb
jle 0x1400a0bdd
invalid
loopne 0x1400a0c7d
jg 0x1400a0c1f
and byte [rsi + 0x54], ah
push sp
movabs dword [0xc8aed278780b76d7], eax
jmp rsp
call qword [rsp + rdi]
mov edx, dword [rcx]
sbb byte [rdi - 0x763dd4f9], dh
movabs al, byte [0xf25ee2ac1ce46398]
lodsb al, byte [rsi]
loop 0x1400a0c7f
bnd jnp 0x1400a0c9a
lodsb al, byte [rsi]
loop 0x1400a0c7f
bnd jnp 0x1400a0c9a
invalid
jb 0x1400a0bfa
pop rdi
invalid
shl byte [0x1361ff01a], cl
wait
or cl, dh
jmp rdx
push 0x56721db2
mov dil, 0x55
clc
pop rax
in al, 0xce
jg 0x1400a0cde
invalid
pop rcx
invalid
push rdx
in al, dx
in al, dx
xchg esp, eax
cmp dword [0x14161967d], 0x47
cmp eax, 0x15789f5
pop r13
cmp eax, 0x15789f5
pop r13
adc byte [rbx], 0x76
fild qword [rsi]
or dword [rsi + 0x6b], ecx
scasb al, byte [rdi]
push 0x1c
movabs byte [0xd1ca4832633c6d53], al
pop rcx
in eax, dx
retfq 0x59d1
idiv byte [rsi + 0x43]
cmp byte [rsp + rdi], cl
invalid
cmpsb byte [rsi], byte [rdi]
jp 0x1400a0c9f
invalid
out dx, eax
and al, 0xb5
mov cl, 0xd1
xlatb
stc
add al, 0xa2
stosb byte [rdi], al
cmp al, 0xe8
insb byte [rdi], dx
repz ret 0xbe8e
invalid
invalid
hlt
sub al, 0x8a
fst qword cs:[rdi - 0x49774291]
mov bh, 0x84
sbb al, 0x9a
xchg esi, eax
ret
popfq
mov ecx, 0x92eb5edc
cmp al, 0xdd
adc dl, dl
invalid
test eax, 0x6cce087e
not qword [rdi - 0x14960582]
push rdi
invalid
jrcxz 0x1400a0cd3
mov ebp, 0x64cbc581
push rax
mov bl, 0xd4
iretd
rcl byte [rsi + 0x738be7b1], cl
imul esp, ebx, 0xc6ab3607
invalid
push rax
mov r8d, 0xf374684b
imul edx, esp, 0x18
add byte [rax - 6], dh
mov ecx, ecx
mov bl, byte [rbx]
mov cl, 0xfc
imul cx, word [rdx - 0x3dd32095], 0x3c8b
jb 0x1400a0de5
sti
mov edx, 0x2f2d8b36
int 0x2d
std
popfq
mov es, word [rdx + rsi*4 + 0x5e]
div byte [rbp + 0x48]
invalid
hlt
invalid
or ch, ah
invalid
mov bh, 0xc0
invalid
fistp qword [rdi]
cmp eax, dword [rsi - 0x2e698770]
sub ecx, dword [rbp + 0x1f]
invalid
sub byte [rax], 0x3e
adc al, 0x5b
wait
fistp word [rsi + 0x1d]
js 0x1400a0dd6
invalid
fisubr word [rdi + 0x6e]
jb 0x1400a0e36
in al, 0xeb
jp 0x1400a0def
stc
sub eax, 0x9aa4e545
invalid
push rdi
test eax, 0xdc43df04
invalid
cli
invalid
mov dh, 0x1e
and eax, 0xf07b8bbd
adc al, 0x1d
imul byte [rsi - 0x10044be9]
mov ah, 0xfb
out dx, eax
scasb al, byte [rdi]
invalid
mov ah, 0xfb
out dx, eax
jg 0x1400a0e2c
movabs dword [0x16ad45f8a6aef98b], eax
and edx, dword [rdi]
add eax, 0xc3dd77b3
ja 0x1400a0e29
ret
or ah, cl
xor eax, 0xca8f2081
cmp al, 0xc7
sbb eax, 0xb18ece74
xor al, 0x98
cwde
stc
scasb al, byte [rdi]
cmpsb byte [rsi], byte [rdi]
clc
lodsd eax, dword [rsi]
invalid
ja 0x1400a0e29
ret
cwde
push rsi
stosb byte [rdi], al
add dword [rbx], ebx
pop rbp
cmc
xchg esp, eax
pop rax
nop
je 0x1400a0e3f
mov edi, 0xadd424d9
lodsd eax, dword [rsi]
hlt
cmp al, 0xf1
cmp ecx, edx
fcom dword [rdi - 0x27b45731]
ja 0x1400a0ef0
adc dl, 0xc1
imul esp, dword [0xcbbf82f1], 0x159752a7
and eax, 0x8bb57460
cmpsd dword [rsi], dword [rdi]
push rdx
xchg edi, eax
invalid
jbe 0x1400a0f07
and eax, 0x8bb57460
cmpsd dword [rsi], dword [rdi]
push rdx
xchg edi, eax
adc eax, 0x2c637476
and byte [rsi], dl
add ch, ah
or dl, bl
sal dword [rsi + 0x2a366b1a], cl
invalid
sal dword [rsi + 0x2a366b1a], cl
cmp dword [rax], edx
sti
jae 0x1400a0f24
invalid
outsb dx, byte [rsi]
sbb al, byte [rsi + 0x16192c45]
cmc
mov ebx, 0x2a1be416
jo 0x1400a0e43
invalid
mov edx, 0x39c35665
outsb dx, byte [rsi]
cmp esi, dword [rcx]
out dx, al
stosd dword [rdi], eax
invalid
out dx, al
mov bl, 0xd0
sbb eax, 0xe2197442
mov al, 5
jmp qword [rbp + 0x3ab56fff]
out dx, eax
xchg dl, dh
xor al, 0x6b
or dh, dh
sahf
movsd dword [rdi], dword [rsi]
lock or byte [rdx - 0x2642bf73], 0x46
cmp ch, byte [rax - 0x6d5f8149]
lea eax, [rax - 0x43]
fld dword [rsi + 0x3a]
test al, 0xb7
jle case.0x140002106.77
xchg edx, eax
invalid
invalid
xor eax, 0xe85e8082
invalid
cmp byte [rdi], ch
mov bh, 0xbf
mul dword [rsi + 0x79392b5f]
scasb al, byte [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
sbb eax, 0x81020a77
mov bl, 0x50
in eax, dx
invalid
invalid
shl dword [rdx + rdi*4 + 0x43], cl
jge 0x1400a0fa2
push rsi
retfq 0x2114
jnp case.0x140002106.85
sub eax, 0xef181246
mov dl, 0x14
lea esi, [rsi - 0x14482c45]
xor edi, 0xa9da0fef
mov eax, 0xc84cb7d5
fisub dword [rbx + 0x3d]
jae 0x1400a0f6c
cmp eax, 0xc46ffb73
lodsb al, byte [rsi]
js 0x1400a0f7d
outsd dx, dword [rsi]
invalid
jle 0x1400a0f0f
and byte [rbp + 0xb], bl
mov eax, 0x4e0fb003
mov al, 0xf
nop
nop
sbb al, 0x58
movabs eax, dword [0xa4bce8a3c42df985]
and esp, dword [rbp + 3]
movsb byte [rdi], byte [rsi]
movabs dword [0x4abd0389fb79e46c], eax
stosb byte [rdi], al
jg 0x1400a0f7f
scasb al, byte [rdi]
push rax
scasd eax, dword [rdi]
xchg dx, ax
xchg dx, ax
xchg edx, eax
call 0x154015899
int1
int1
cdq
jbe 0x1400a0fa3
cmp ebp, dword [rdx]
add dl, byte [rdi - 0x3a7b82e0]
mov ebp, dword [rbx]
invalid
sbb al, 0x27
js 0x1400a0faa
pop rdx
ror ecx, 0xf7
loope case.0x140002106.97
mov ecx, 0x41465bfb
invalid
outsd dx, dword [rsi]
mov edi, 0xac068abe
scasd eax, dword [rdi]
push rcx
cmpsd dword [rsi], dword [rdi]
mov edx, 0xc109edcd
sal dword [rcx + 0x5f8de7c0], 0xcb
sal dword [rcx + 0x5f8de7c0], 0xcb
imul ecx, esi, 0x6cbd366d
sbb eax, 0x41441fe2
invalid
invalid
invalid
invalid
and ecx, dword [rax]
cmovbe edi, edx
invalid
add eax, 0xd8f69866
invalid
cmp r12b, bpl
jmp 0x1bf15eb3a
call 0x10c11b9a3
imul esi, dword [rbx + rsi*8 - 0x42], 0xfffffff3
loope 0x1400a104d
cmp byte [rbx], ah
sbb bl, ch
sub edi, dword [rdi - 0x4bf22c5e]
mov edi, 0xb40dd3a2
sbb al, 0x7b
out dx, eax
xor dword [rcx - 0x1583f57c], edx
invalid
sub edi, dword [rdi + 0x5553302b]
clc
adc dword [rsp + rbp - 0x12], ebx
test byte [rdi - 0x68b6aead], al
wait
cwde
sub eax, 0x16539ef9
push rbx
invalid
cdq
invalid
push rbx
invalid
in al, dx
invalid
add ebp, dword [rax]
push 0x2ba153b3
cmp byte [rcx - 0x4e820383], dl
cdq
xchg dword [rdi], edx
invalid
push rbx
movsb byte [rdi], byte [rsi]
fdiv st(6), st(0)
jno 0x1400a1178
ret
jp 0x1400a1141
std
scasd eax, dword [rdi]
invalid
test dword [rdi - 0xa], ecx
invalid
fcom dword [rdi - 0x76]
in eax, 0x72
sub edi, dword [rbx + 0x68b6ce31]
insd dword [rdi], dx
mov edi, 0x3452c671
invalid
push rdx
xor al, 0x50
invalid
jp 0x1400a1140
invalid
int1
invalid
movabs al, byte [0x1790829ca9f79606]
invalid
xchg dword [rdi], edx
movsd dword [rdi], dword [rsi]
xor eax, 0xb6d4e180
stc
invalid
invalid
pop rax
invalid
invalid
mov ah, 0x2a
cli
add byte [rax + 0x40b300d1], bl
wait
adc ebp, edx
iretd
invalid
jle 0x1400a1222
insb byte [rdi], dx
invalid
pop rdi
invalid
or ecx, edi
mov edx, 0x9938f878
clc
invalid
cdq
invalid
clc
cmp byte [rcx + 0x4021070e], bl
imul edx, dword [0x197733dbb], 0x585d498d
adc edx, dword [rax + 0x65]
push rax
out dx, eax
push rax
out dx, eax
jne 0x1400a11b4
int 0xdd
mov bl, 0x7e
fidiv dword [rcx]
mov bh, 0x29
invalid
mov cl, 0xa5
bnd jo 0x1400a11ec
fidiv dword [rcx + 0x8bdffe1]
mov cl, 0x8e
adc dword [rsi], ebx
jrcxz 0x1400a123d
invalid
mov ss, word [rcx]
invalid
invalid
fstpnce st(7), st(0)
invalid
cmp al, 0x75
nop
adc al, 0x2f
jne 0x1400a123e
invalid
std
cdq
sub byte [rax + 0x1f], ah
not byte ds:[rdi]
mov dh, 0xbd
mov eax, dword [rdx - 0x14b711d4]
jmp 0x1400a127e
movsb byte [rdi], byte [rsi]
mov bh, 0xef
fcomp dword ss:[rcx - 0x7b]
movabs dword [0xff830f5253442cf8], eax
ficom dword [rbp - 0x2f180ec2]
out 0xd0, eax
jmp 0x1400a127e
out 0xd0, eax
sbb al, 0x78
mov word [rax + 0x50], fs
invalid
invalid
test al, 0x6b
cli
push rbx
js 0x1400a12f0
or edi, dword [rdx + 0x55]
pop rcx
invalid
retf 0xa4a4
int1
invalid