Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
invalid
cmp al, 0xc7
push rbp
sub al, 0x49
jge 0x1400a0813
jbe 0x1400a0844
test al, 0x17
invalid
invalid
hlt
mul dword [rax]
push 0xffffffffffffffb9
cmp dword [rdi - 0x33], esi
invalid
invalid
jo 0x1400a082c
out 0xd7, eax
push 0x16e99649
in al, 0xdd
sbb byte [rdi + 0x79], 0x21
pop rdi
jns 0x1400a089c
pop rdi
jns 0x1400a089c
invalid
imul edi, dword [0x166f4a943], 0x5e
mov ebp, 0x701335f5
xor al, 0xb5
xor eax, 0xba71e02b
jmp 0x139640712
pop rcx
stc
invalid
jle 0x1400a08b8
invalid
mov byte [rdx - 0x39], al
ror byte [rsi], cl
insb byte [rdi], dx
invalid
invalid
sti
and byte [rdx], bh
in al, dx
or al, 1
or byte [rdx + 0x36], dh
sbb eax, 0xc3d9944b
cmp esp, esp
jmp 0x1b2900372
invalid
jb 0x1400a086b
in al, dx
add dword [rsi + rdx + 0x6d7a18b1], ecx
sbb byte [rsp + rbp], al
cmp al, 0xa7
cmpsd dword [rsi], dword [rdi]
scasb al, byte [rdi]
sbb ecx, dword [rdi + 0xacedd7d]
invalid
jge 0x1400a08ca
invalid
or bh, byte [rax + 0xcae7eea]
sbb al, byte [rsi]
invalid
invalid
mov esi, 0xd47bffc2
pop rdx
invalid
wait
invalid
xchg edi, eax
invalid
shr dword [rcx], 1
loop 0x1400a0924
invalid
xchg ecx, eax
invalid
insd dword [rdi], dx
invalid
js 0x1400a0985
adc al, 0x57
imul esi, dword [rdx + 0x3a], 0xffffff85
jbe case.0x140002106.18
pop rax
idiv byte [rbx + 0x3acffff]
adc ch, dl
invalid
jb 0x1400a09fa
add eax, 0x97240e6f
and al, 0x97
jnp 0x1400a09fc
invalid
idiv byte [rdi - 0x35549b45]
sbb byte [rax], ch
add ah, bh
invalid
movabs al, byte [0x7630584497b83333]
invalid
stosd dword [rdi], eax
push rdx
scasd eax, dword [rdi]
invalid
or al, cl
cmp r13d, ebx
push rdi
mov ebp, 0x36b2dcbb
invalid
invalid
invalid
mov edx, ebx
mov dl, ch
mov edi, 0xf2be6de0
invalid
invalid
invalid
and cl, ah
xor dl, byte [rsi]
pop rbp
sahf
out dx, al
pushfq
ficom dword [rdi + 0x497b2eff]
invalid
int3
xor esi, dword [rsi + 0x3c]
pop rsi
mov ebp, 0x989af3c4
invalid
pop rbx
setge al
invalid
sub edi, ebx
invalid
js 0x1400a0aae
push rsi
invalid
pop rax
jns 0x1400a0a94
in eax, 0x15
sbb ecx, dword [rbp - 0x2b95b8dc]
invalid
add ebp, dword [rdi]
sar byte [rsi + 0x9c93efe], 1
sahf
std
invalid
invalid
jg 0x1400a0a1d
enter 0x387a, 0xffffffffffffffec
test eax, 0xd13a8439
loop 0x1400a0a8d
shl edx, 1
std
lodsd eax, dword [rsi]
adc dh, byte [rdx + 0x43]
invalid
mov edx, 0xe139b472
pushfq
hlt
xchg esp, eax
sti
test eax, 0x6a2d530e
push rbx
invalid
push 0x76
invalid
push rbx
sub eax, 0x2d80766a
invalid
sub eax, 0x99e2d7d5
movabs byte [0xef40ec35bdb0fbde], al
jbe 0x1400a0b05
add byte [rbx + 0x7bd290ab], ch
jnp 0x1400a0add
std
in al, dx
jo 0x1400a0a64
wait
invalid
ret
invalid
xchg byte [rcx - 0x76], bh
cmp dword [rcx - 0x32a2290f], 0xffffffe0
sti
invalid
mov qword [r8 - 0x39b5b80d], r14
or edi, ebx
sub byte [rbp + r8*2 - 0x6358c52d], sil
sar dword [rdx], cl
cmpsd dword [rsi], dword [rdi]
pushfq
sar dword [rdx], cl
cmpsd dword [rsi], dword [rdi]
pushfq
invalid
neg dword [rcx - 0x76]
test edi, esp
jge 0x1400a0aee
mov edi, 0xee8baa16
mov ebx, 0xbbfbcdae
pop rbp
or byte [rax + 0x18], 0x57
sbb byte [rdi + 0x67], dl
sub ch, byte [rdx + 0x351401be]
sbb byte [rdi + 0x67], dl
sub ch, byte [rdx + 0x351401be]
stosb byte [rdi], al
mov esi, 0x85351401
lodsd eax, dword [rsi]
cmpsb byte [rsi], byte [rdi]
xlatb
mov ch, 0x5a
test dword [rbp + 0x5ab5d7a6], ebp
or byte [rdi + 0x3b], bh
movsb byte [rdi], byte [rsi]
cld
invalid
or byte [rsi - 0x72], ah
xchg ecx, eax
pop rcx
in eax, 0xb4
invalid
mov edi, 0x7d0e42ee
cmp al, 0x33
lahf
movabs al, byte [0x917d17824654e137]
and dword [rdx], ecx
and esi, dword [0xda150e4c]
add cl, byte [rbx]
invalid
jae case.0x140002106.36
add cl, byte [rbx]
invalid
push r14
out dx, al
jp 0x1400a0c11
mov edx, dword [rbx - 0x75]
invalid
cli
invalid
push rcx
cld
cld
sub cl, byte [0x1b2ab3924]
or eax, 0x72a12d53
xchg esi, eax
fild word [rsi + rcx*4 + 0x3e]
movabs al, byte [0x3e75b1942dc54a8b]
je 0x1400a0bdc
invalid
mov cl, 0x75
je 0x1400a0bdc
jne 0x1400a0b6d
jg 0x1400a0bfb
invalid
jno 0x1400a0c3b
invalid
ja 0x1400a0bd8
leave
cmp eax, 0xc13dd12f
invalid
cli
push rdx
shl byte [0xc995e7d2], 0xff
mov eax, dword [rdx + 4]
xor esi, dword [rbx]
add byte [0x13fef0b26], ch
invalid
adc al, 0xcd
call qword [rcx*8 - 0x66484681]
jg 0x1400a0bcc
mov bh, 0x99
test dword [rax - 0x1ac15f71], 0xac6c6e40
lodsb al, byte [rsi]
pop rsi
bnd jnp 0x1400a0c9a
xchg esp, eax
invalid
jmp 0x1400a0bc8
jmp 0x1400a0bc8
popfq
pop rsp
cli
jl 0x1400a0bed
push rsp
sal dword [rbx - 0x1f], 1
notrack jmp rdx
or byte [0xca510beb], dl
invalid
movsd dword [rdi], dword [rsi]
invalid
not byte [rdi + rdi*4]
cmp dword [rsi - 0x7d61ef22], 0xffffffce
push rcx
add ebp, dword [rsi + 0x76]
mov bh, 0xd1
xchg esi, eax
sahf
movabs eax, dword [0x3c6ff3fe15e47607]
rep outsd dx, dword [rsi]
cmp al, 0x81
shr dword [rsi + 0x43cc0016], 0x7a
sbb r13, qword [rsp + rbx*8 + 0x6d666576]
fdiv qword [rsi + 0x65]
insw word [rdi], dx
add ecx, 0xcc0016ae
jp 0x1400a0cf2
sbb ebp, dword [rsp + rbx*8 + 0x6d666576]
fdiv qword [rsi + 0x65]
insw word [rdi], dx
adc eax, 0x818221ae
mov bh, 0x2a
mov esp, 0xb86224c4
sahf
inc byte [rax - 0x80]
jmp 0x15bb072dd
sbb dword [rsi - 0x5a], esp
invalid
sbb dword [rsi - 0x5a], esp
cmpsb byte [rsi], byte [rdi]
sbb ecx, dword [rcx - 0x66]
mov ebx, 0x4e3b2a0a
in eax, dx
adc al, 0xc9
in al, 0x6e
invalid
sub dword ds:[rax], edi
mov esi, 0x5c988992
push 0x2996af18
mov edx, 0x3332323b
xor dh, byte [rbx]
xor dh, byte [rbx]
in al, dx
invalid
mov bl, byte [0x1a5028f5f]
movsb byte [rdi], byte [rsi]
movabs byte [0x7bf0126d5cd9f171], al
popfq
push rcx
leave
push rdi
mov ecx, 0xa65d4f8a
hlt
movabs eax, dword [0xc478c5bb88daa245]
jp 0x1400a0cc2
and al, 0xe7
invalid
invalid
push rbp
pushfq
or esi, dword [r8 + 0x752f8aeb]
invalid
xchg esp, eax
jle 0x1400a0da5
push rcx
jo 0x1400a0d5b
add al, ch
in al, 0x2b
insb byte [rdi], dx
shl byte [rax + 0x17], 1
invalid
call 0x110763944
invalid
sbb byte [rcx - 0x29], al
xlatb
rcr byte [rax + 0x2dcd4579], 0xfd
popfq
invalid
movabs dword [0x5b79ca1daaff3d0e], eax
pop rbp
in eax, dx
adc eax, 0xb73a025b
scasb al, byte [rdi]
add bh, byte [rdx]
mov bh, 0xae
xchg edx, eax
push rbx
lahf
invalid
xor eax, 0xedc76307
push rcx
sbb al, 0x50
out dx, eax
sti
movsb byte [rdi], byte [rsi]
fdivr dword [rdx - 0x51]
jns 0x1400a0d73
or eax, 0xf80e5240
rcr ch, 0xef
xor esi, dword [rsi + 0x584bd59e]
xchg r15d, eax
fist dword [r10]
loop 0x1400a0e2e
popfq
cmp ch, byte [rcx - 0x696aca3e]
invalid
wait
lahf
sbb eax, 0x8e1e1152
adc dword [rsi], ebx
invalid
cdq
xchg edx, eax
invalid
adc dword [rsi], ebx
mov ds, word [rcx + 0x4262f92]
pop rbp
mov edx, 0x7f4d8b4d
mov ecx, esi
mov dl, al
in eax, dx
invalid
fisubr word [rdi + 0x6e]
jb 0x1400a0dec
adc al, 0x2b
jns case.0x140002106.69
xlatb
invalid
movabs eax, dword [0x7f60f8782597ea9f]
invalid
invalid
mov edx, 0xdf083036
jbe 0x1400a0e2b
cmp ch, byte [rsi - 0x53c57ff8]
cmp byte [rdx], 0xac
cli
out dx, eax
movabs dword [0xdeaa8afedd8af98b], eax
imul esp, dword [rcx + 0x2bd3a225], 0xeba8efd3
shr dword [rbx], cl
shr edi, cl
test al, 0xeb
shr dword [rbx], cl
shr edi, cl
test al, 0xeb
mov ah, 0xb1
sub al, 0x3e
invalid
pop rcx
and byte [rbp + 0x29], bl
sal ebx, 0xd9
add al, 0x78
invalid
push 0x7f38c5b4
in eax, 0xc5
add al, 0xd2
pop rbp
invalid
invalid
adc edx, dword [rdi - 0x61]
stc
pop rsp
movabs al, byte [0x99772a77a208e5ed]
or eax, 0xab2475ef
stosd dword [rdi], eax
stosd dword [rdi], eax
xchg edx, eax
mov ecx, 0x1a14f2df
push rsp
adc esp, dword [rsi]
invalid
pop r12
fimul word [rsi - 0x6948429]
adc eax, 0x8556733c
or byte [rbx - 0x29], dh
in eax, 0xbb
or al, 0x9f
push qword [rsi - 0x76]
mov ah, ch
stc
mov ah, ch
stc
stc
invalid
out dx, al
mov bl, 0xc
or dword [rsi + 0x3b], esp
fcmovnb st(0), st(5)
iretd
out dx, al
invalid
invalid
jbe 0x1400a0f03
invalid
mov ecx, 0x20bc5ee7
invalid
out 0x5e, eax
mov esp, 0x2a0ec720
jb 0x1400a0ec4
invalid
enter 8, 0xffffffffffffffb7
xchg ebp, eax
mov edi, dword [rdi]
jle 0x1400a0f84
xchg ah, dl
mov es, word [rdi + rbp + 0x61]
cwde
push rdx
pop rcx
scasd eax, dword [rdi]
std
invalid
mov esp, dword [rcx + 0x22]
insd dword [rdi], dx
in al, dx
cli
jbe 0x1400a0ef9
sub dword [rdi + 0x33820020], ebx
retf 0x6769
jnp case.0x140002106.85
jno 0x1400a0fb7
push rbx
ja 0x1400a0f05
fdivp st(6)
invalid
div dword [rcx]
xor dh, dh
jmp 0xd3f9b48c
int1
outsd dx, dword [rsi]
xlatb
add al, 0x41
sub byte [rdx + 0x5c955894], al
sub byte [r10 + 0x5c955894], al
invalid
invalid
xchg esp, eax
xchg ebp, eax
mov dword [rsi + 0x38], 0xcefd87bb
pop r9
push rdi
sub sp, si
xchg edi, eax
xchg esp, eax
jg 0x1400a0faa
invalid
or dword [rdi + 0x391de896], ecx
fld qword [rbx]
jns 0x1400a0fcf
invalid
jns 0x1400a0fcf
jns 0x1400a0fcf
lahf
invalid
movabs dword [0xeb742414461e6b1b], eax
je 0x1400a0fab
invalid
movabs dword [0xddfffffaf62ed6f6], eax
mov ecx, 0x68cfae90
scasd eax, dword [rdi]
invalid
xor ah, cl
mov al, 0x13
cmp esi, dword [rcx + 0x7cd45f9]
mov esp, fs
add eax, 0x89fd9658
mov dword [rbx - 0x218bfe64], ebx
ja 0x1400a1073
invalid
mov dword [rbx - 0x218bfe64], ebx
ja 0x1400a1073
xchg ebp, ecx
jb 0x1400a1001
int 0x72
invalid
sti
insd dword [rdi], dx
movabs dword [0xffa16b2867a69ad2], eax
cli
mov edi, 0x3725e1f8
mov word [rbx + rbx], es
mov ebx, 0xe5041ccf
sbb al, 4
in eax, 0xd3
invalid
invalid
invalid
sbb al, 4
in eax, 0xd3
invalid
invalid
xor bh, byte [rbx + 0x5f011bb5]
invalid
jp 0x1400a10af
sub ch, byte [rdi + 0x228176ff]
jmp 0x11e11bc77
stosd dword [rdi], eax
invalid
invalid
scasd eax, dword [rdi]
push qword [rsi - 0x7f]
and ch, cl
call 0x1b4e8183b
stosd dword [rdi], eax
invalid
fidiv word [rdx + rbx*2 + 0x7c]
invalid
xchg ebx, eax
xor al, 0xc5
mov r11b, 0xfc
scasd eax, dword [rdi]
dec esi
invalid
or dword [r8], esp
xlatb
invalid
movabs dword [0xbfbc4aa603a52ade], eax
test al, 0xc
sbb eax, 0x18688654
or al, 0x1d
push rsp
xchg byte [rax + 0x18], ch
adc dword [rcx + 0x3bfe42b7], edi
sbb byte [rax - 0x409dc998], cl
mov bh, 0xa0
movabs al, byte [0x84829883d19300d]
movabs al, byte [0x84829883d19300d]
mov byte [rcx], ch
or byte [rdi - 0x3a], bpl
pop rdi
invalid
outsd dx, dword [rsi]
invalid
outsb dx, byte [rsi]
test al, 0x2d
out 0x7f, al
cmp esi, esi
jrcxz 0x1400a1149
invalid
push 0xdb83c93
js 0x1400a1083
xchg ebx, eax
cmp al, 0xb8
or eax, 0x22af9c78
push rax
call 0x1ab7c1a4d
scasd eax, dword [rdi]
and dl, byte [rax - 0x18]
pop rsi
or dword [rdx + 0x6b], esi
push r8
invalid
jg 0x1400a1148
cld
je 0x1400a115c
push r9
xlatb
pop rbx
jge 0x1400a10fe
jge 0x1400a10b5
jno 0x1400a1131
invalid
xor al, 0xce
movsb byte [rdi], byte [rsi]
adc al, 0xbc
fdiv dword [rdi - 0x5228ba42]
push rsi
and dword [rbx + 0x44], ecx
xor dh, byte [rbp*4 - 0xd0f9600]
invalid
mov al, 0x67
jbe 0x1400a11a1
outsd dx, dword [rsi]
std
invalid
xor al, 0xf2
mov bh, 0x55
mov dl, byte [rdx]
retf 0x7b68
je 0x1400a1174
sub dl, byte [rax - 0x53]
push rax
lodsd eax, dword [rsi]
invalid
cmp byte [rax], dl
popfq
pop rbx
cmp dword [rax + 0x6443f0e2], ebp
cmpsb byte [rsi], byte [rdi]
movabs al, byte [0x95a9d0b7acebf493]
push rcx
test eax, 0xff7c5195
jl 0x1400a116e
dec edi
in al, 0xdd
invalid
iretd
invalid
fstp dword [rdx - 0x59]
mov ebp, 0x5d498daa
rcl dword fs:[rbx], cl
jmp 0x1400a1192
invalid
js 0x1400a1163
add eax, 0xcf4df3ce
add ebp, eax
or al, 0x56
invalid
invalid
je 0x1400a11c7
push rdi
mov edx, 0xaf970ae7
mov edx, 0xaf970ae7
mov eax, 0x4f6465e6
movsb byte [rdi], byte fs:[rsi]
movsb byte [rdi], byte fs:[rsi]
leave
retf 0x694d
imul esp, dword [rdx - 0x22], 0xf5ea4677
mov eax, 0x3ab8b186
cmp bl, byte [0x15532b137]
cmp bl, byte [0x15532b137]
add eax, dword [rsi - 0x780e73d0]
lodsb al, byte [rsi]
test bl, dl
invalid
invalid
ror dword [rcx - 0x72], cl
int1
xor al, 0xac
cld
xor edx, dword [rcx]
leave
jle 0x1400a116d
push rbx
xor rdi, r13
cdq
or eax, 0xb53eb429
xchg byte [rsi], cl
push rbp
js 0x1400a11b8
in eax, 0x57
lea ecx, [rcx + 0x5d]
sbb eax, 0xefdded4a
in eax, dx
fucomp st(7)
in eax, dx
fucomp st(7)
jne 0x1400a11b4
int 0x33
cwde
sbb dword [rax], edi
xchg ebp, eax
adc esi, edx
mov ah, 5
sub eax, 0xaf00fe8f
scasd eax, dword [rdi]
scasd eax, dword [rdi]
invalid
and byte [rdi + 0x6f], al
test dword [rsi - 0x4368114e], 0x51bee54e
add dword [rbp - 0x7fd5dcd], esp
clc
clc
ror byte [rbx], 0x66
invalid
invalid
and edi, dword [rsi - 0x6f]
lodsb al, byte [rsi]
and eax, ebp
xchg edx, eax
invalid
xor dh, byte [rcx + 0x6dcdcc5c]
and bl, byte [rbx + rsi*2]
call 0x1657c92e3
jb 0x1400a12af
jb 0x1400a12af
lodsb al, byte [rsi]
sbb eax, edi
cwde
add dword [rcx + rdx*2 + 0x1f37e970], ebx
cld
invalid
pop rdi
invalid
jle 0x1400a1303
cmpsd dword [rsi], dword [rdi]
test dword [rcx], ebp
sti
sti
mov esi, 0xbee15c25
jp 0x1400a133d
invalid
xchg edi, eax
fidivr word [rdi - 0x56dc05f9]
sbb ah, byte [rax]
imul esi, dword [rsi - 0x25e4b954], 0x60
lodsb al, byte [rsi]
sbb r11d, edx
invalid
sbb edx, dword [rsi]
xor byte [rdi - 0x80], ch
pop rdx
sub ah, byte [rdi - 0x4ba2ef98]
invalid
invalid