Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x507bdbf0
mov ebp, dword [rax]
or byte [rdx + 0x7d], bh
outsb dx, byte [rsi]
invalid
retf
or r8b, byte [rax - 0x5c5f0318]
jp 0x1400a07f0
cld
movabs al, byte [0xe1ffc8ff6cb87aa3]
loope 0x1400a0824
jg 0x1400a0833
wait
insb byte [rdi], dx
dec eax
jmp rcx
invalid
loope 0x1400a0824
jg 0x1400a0833
wait
movabs byte [0xff172b18900e8ec6], al
adc ebx, edi
invalid
insb byte [rdi], dx
mov r14d, dword [0x1226aea47]
dec dword [rcx - 0x3004119]
cld
cld
stc
invalid
or ebp, dword [rdx]
mov esi, 0x163bc43e
xor eax, 0x6e65171e
jae 0x1400a0853
or eax, 0x89f17c46
fsub st(1)
mov dl, 5
push rbx
int1
mov ebx, 0x92d18dff
or dword [rax], edx
add al, 0x7b
push rcx
in eax, dx
xor byte [rdx - 0x546dff84], dl
invalid
xchg edx, eax
stosd dword [rdi], eax
add bh, dh
add byte [rdx + 0x6efe02ab], dl
outsb dx, byte [rsi]
or byte [rax], dh
std
add dword [rbp + 0x13], eax
mov al, byte [rbx + 0x5b6d0308]
movabs eax, dword [0xe7398fbf08e8a1d]
mov cl, byte [rsi + 0x7398fbf0]
invalid
pop rbx
mov cl, 0xa
add byte [rax], al
invalid
mov cl, byte [rsi + 0x7398fbf0]
invalid
int3
xor esi, ebx
ret
invalid
add byte [rbx - 0x17], bl
mov fs, word [rcx + 0x71148676]
cli
or byte [rcx], ch
invalid
pop rbx
jmp 0xc680aa95
ja 0x1400a08a5
mov al, 0x58
push rdx
leave
pop rbx
jmp 0x13ea37c1f
jge 0x1400a0982
mov edx, 0x97eefebe
sbb al, 0xbc
call 0x118beffb8
invalid
mov edx, 0x57d407e5
invalid
in eax, 0xbc
mov fs, word [rsi + 0x581f01e1]
cmpsb byte [rsi], byte [rdi]
loope 0x1400a0964
invalid
pop rax
cmpsb byte [rsi], byte [rdi]
loope 0x1400a0964
invalid
pop rax
je 0x1400a0901
add dword [rdx], ebp
retf 0xf32b
sub byte [rsi], dh
adc eax, 0x672f41c8
enter 0x2f41, 0x67
enter 0x2f41, 0x67
invalid
pop rcx
pop rsp
rcr dword [rdi], cl
mov esi, 0xff7a8eb4
xlatb
jg 0x1400a097d
mov dl, 0x93
popfq
invalid
sbb esp, edx
invalid
xchg esp, eax
xchg byte [rbp + rdx*2 - 0x4b93764a], ch
js 0x1400a095d
movsb byte [rdi], byte [rsi]
mov esp, edi
mov ch, 0x5a
adc eax, dword fs:[rdi]
mov edi, edx
in al, 0xff
mov edi, 0x32bc6e6c
movabs al, byte [0xfdfcbf611716f47f]
invalid
nop
invalid
scasd eax, dword [rdi]
ret 0x6714
pop rbx
or al, byte [rsi]
jbe 0x1400a0a80
pop rbp
leave
mov ch, 0x8b
jle 0x1400a09c6
invalid
invalid
sub ecx, dword [rbp + 0x54dd95b4]
invalid
jg 0x1400a09e6
fnstsw word [rdx + 0x3f7a09ff]
fcomp qword ds:[rsi - 0x3a53d5df]
invalid
sub ah, byte [rsi + 0x35684798]
test eax, 0xd297f73c
sahf
jmp 0x1400a0a69
xlatb
or al, 0x4a
test byte [rdi], ch
cli
lahf
sbb eax, 0x66d94af5
stosd dword [rdi], eax
invalid
push rbx
cmp ah, byte [rbx + 0x27d227f3]
invalid
invalid
invalid
shl byte [rdi], cl
invalid
movabs dword [0xe80d456227d227f3], eax
fimul dword [rdi + 0x77d7e9e9]
xor edi, ebx
scasb al, byte [rdi]
invalid
invalid
in al, dx
cmp al, 0xb2
test edi, r12d
jmp 0x1aa4ca3c3
jnp 0x1400a0add
std
in al, dx
invalid
iretd
add edx, dword [rdi - 0x451c4110]
invalid
clc
or eax, 0xaeab733e
stosd dword [rdi], eax
scasb al, byte [rdi]
stosd dword [rdi], eax
scasb al, byte [rdi]
xor al, 0x7f
invalid
in eax, 0xac
shr dword [r9 + rcx*4], cl
scasd eax, dword [rdi]
ja 0x1400a0b8a
xor dword [rcx - 0x3798df8e], ebx
push rbp
invalid
call [rbp + 0x7e7116ef]
cmp dword [rdi], edx
add ah, byte [rsi]
push rsp
stc
xor eax, 0x3756e791
insd dword [rdi], dx
cmpsd dword [rsi], dword [rdi]
jmp 0x1400a0b02
add dword [rcx - 0x2cc7c9f0], eax
invalid
test al, 0x8a
ror dword [rdx + 0x16], 1
xor byte [rax - 0x36], bh
jnp 0x1400a0b6f
invalid
invalid
stosb byte [rdi], al
stosd dword [rdi], eax
sar bh, 0xf4
stc
enter 0xffffffffffffa4e7, 0xffffffffffffffd1
invalid
jl 0x1400a0af4
invalid
cmp byte [rdi + rdx*4], dh
adc al, 0x24
movabs dword [0x81f9ff047c5b428d], eax
mov dword cs:[rcx + rdi*8 + 0x5a], edx
mov dword [rcx + rdi*8 + 0x5a], edx
mov dword [rcx + rdi*8 + 0x5a], edx
out dx, al
invalid
ficom dword [rdx - 0x25]
div edi
je 0x1400a0b82
mov dh, 0x5e
pop rsi
jrcxz 0x1400a0b20
fcmovnu st(0), st(3)
xchg edi, eax
insd dword [rdi], dx
cld
cld
jp 0x1400a0bdd
mov edi, 0x3fd8ef49
push rbx
jge 0x1400a0b48
idiv ebx
sti
out dx, eax
mov esi, dword [0x15641ff3a]
xor al, 0xa5
scasd eax, dword [rdi]
lahf
mov edx, esi
mov bl, al
push 0x75
add al, 0x3b
cli
invalid
xchg esp, eax
push rax
invalid
idiv dword [rsi]
cli
lahf
cld
sbb edi, edi
push 0xffffffffffffffaa
lahf
adc rax, 0xfffffffff53c13d7
add al, 0xb7
add byte [rsi - 0x39617cea], bh
imul esi, dword [rdi - 0x1504ff2d], 0x45d8d92c
fstpnce st(0), st(0)
stosb byte [rdi], al
fstpnce st(0), st(0)
stosb byte [rdi], al
and eax, 0x499938fd
add dword [rax + 0x48cde239], edi
jmp rsp
call qword [rdx + rbx*2]
sbb dword [rcx - 0x4a], esi
mov ch, byte [0x1482f1739]
xchg dword [rax - 0x77], ebp
add eax, 0xa58b2a04
add al, 0x2a
invalid
movsd dword [rdi], dword [rsi]
and edi, dword [rsi + 0x2f]
add al, 0x2a
mov esp, dword [rbp + 0x3e2f7e23]
add eax, 0x173effee
jle 0x1400a0c54
add eax, 0x173effee
loopne 0x1400a0c54
bnd call 0x12102cb68
sub dword [rbp - 0x75d1db0b], esp
and al, 0x2e
mov dl, byte [rcx + 0x30]
push rcx
xor byte [rbp + 0x3f], bh
push rcx
xor byte [rbp + 0x3f], bh
jg 0x1400a0c37
not dword [rdx - 0x62a90448]
out 0xf3, al
and bl, cl
xchg edx, eax
mov eax, 0xe69d56fb
and bl, cl
and byte [rdi], al
jle 0x1400a0c3f
invalid
movabs dword [0x346cb5c4b5e8cd7f], eax
popfq
mov ch, 0x6c
insb byte [rdi], dx
xor al, 0x9d
cdq
cmp dword [rdx], edx
xlatb
xor cl, byte [rbx + 0x668a46ff]
out dx, eax
jae 0x1400a0c53
xor byte [rbx - 0x2c1eb7af], bl
xchg esi, eax
invalid
adc eax, ebx
jno 0x1400a0cbe
invalid
invalid
not byte [rdx + rsi*2]
sub dword [rbx + 0x21eed6a4], edi
adc ah, 0xf8
jge 0x1400a0c23
pop r10
popfq
movsb byte [rdi], byte [rsi]
cmp eax, 0xab829f6f
insb byte [rdi], dx
iretd
sbb al, bh
enter 0x4111, 0x5d
invalid
xchg edi, eax
mov eax, 0xd1fffe5e
pop rsi
invalid
call rcx
jle 0x1400a0cc1
pop rsi
invalid
invalid
push rbx
in eax, dx
and dl, byte [rax + riz]
movabs dword [0xb8fcbaaa0e5e2435], eax
xchg ebx, eax
and dl, byte [rcx]
adc dword [rsi - 0x5b], edi
adc dword [rsi - 0x5b], edi
hlt
retfq 0x6c24
push 0xfffffffffffffff1
invalid
std
mov al, byte [rdx + 0x26]
jo 0x1400a0d5b
xor dword [rbp - 0x80], ecx
movabs al, byte [0xe91695f62ef8df21]
cmpsd dword [rsi], dword [rdi]
xor dword [r9 + 0x1664682b], r8d
sub dword [rbx], 0xe8166468
mov ch, byte [rdi]
jne 0x1400a0d38
xchg ebp, eax
invalid
sub dword [rbx], 0xe8166468
mov ch, byte [rdi]
jne 0x1400a0d38
mov bl, 0xe8
sbb eax, 0x5dc2b31f
movsb byte [rdi], byte [rsi]
int3
or dword [rcx + rcx*8 + 0x12], eax
call 0x15dbb2975
mov cl, 0x1d
je 0x1400a0db1
out 0x8e, al
invalid
push rsp
movabs dword [0xa62bd12d0ed8d906], eax
shr ebx, 1
pop rcx
xor dword [rsi], ecx
add byte [rdi + rbp - 0x4b], 0x42
mov ch, dl
invalid
or al, 0x23
fidivr word [rbx + 0x7f]
in eax, 0x46
jmp 0x17c3053a0
pop rsp
pop rbx
ret 0x1daa
adc dword [rcx], eax
test byte [rax], 0xff
add byte [rbx], dh
jp 0x1400a0dd7
fisttp dword [rbp + rdx*8 - 0x3f]
jnp 0x1400a0dd0
cmpsb byte [rsi], byte [rdi]
scasb al, byte [rdi]
int3
xchg edi, eax
invalid
movabs byte [0x8aec8bfd1ee21fa1], al
out dx, al
loop 0x1400a0dfa
std
mov ebp, esp
mov ch, dh
div eax
jnp 0x1400a0de2
invalid
adc byte [rdi*4 - 0x2e798d31], dl
jmp 0x1b74e69f4
invalid
invalid
ja 0x1400a0e3b
popfq
scasd eax, dword [rdi]
test al, 0xc9
or dh, byte [rdx + 0x4d6d6cf6]
jg 0x1400a0d8a
insb byte [rdi], dx
insd dword [rdi], dx
jg 0x1400a0d8a
invalid
outsd dx, dword [rsi]
mov esi, dword [rbx + 0x7f]
sub eax, 0x5c7aebe4
jp 0x1400a0e69
test byte [rbx - 0x6e675f27], bl
invalid
movabs eax, dword [0x5efecedc4397ea9f]
rcr dword [rbx + 0x3226210d], 1
std
push rax
cwde
test dword [0xdf593e7c], eax
and al, 0xde
sbb eax, 0x6d947a49
xchg esi, eax
mov ss, word [rax + rsi*4 - 0x53]
invalid
invalid
cli
xor byte [rdi - 0x1c09ce05], dl
xchg edi, eax
sti
xor esi, esi
jrcxz 0x1400a0e0b
scasd eax, dword [rdi]
jle 0x1400a0e30
outsb dx, byte [rsi]
xchg edi, eax
sti
xor esi, esi
jrcxz 0x1400a0e0b
scasd eax, dword [rdi]
jle 0x1400a0e30
outsb dx, byte [rsi]
invalid
push rsp
cmp eax, 0xd4eb79a5
movsd dword [rdi], dword [rsi]
jns 0x1400a0e5a
invalid
adc al, 0x28
invalid
movsd dword [rdi], dword [rsi]
jns 0x1400a0e5a
invalid
invalid
adc dword [rbx - 0x474eafb3], edi
hlt
invalid
jl 0x1400a0f28
fimul word [rsi - 0x40b78429]
mov cl, 0x2d
mov ebx, 0x87c28a26
invalid
xor eax, esi
out dx, al
mov ebx, 0x648df3c
out dx, al
stosd dword [rdi], eax
invalid
out dx, al
mov bl, 0xf1
and al, 0xb6
sub ebx, dword [rdi + rbp]
sal ah, 1
or dword [rsi], ecx
lgs edi, [rbp - 0x6d]
invalid
cmp ebx, ebp
hlt
sub ecx, dword [rcx + 0x5ec67471]
invalid
retf
mov eax, 0x6b3ac022
invalid
adc byte [rbp + 0x7b39be0f], 0x98
out 0x6d, eax
movabs al, byte [0x7a7c3cac8e805607]
outsd dx, dword [rsi]
lodsb al, byte [rsi]
cmp al, 0x7c
jp 0x1400a0f9c
invalid
adc eax, 0xecf692a8
cli
jbe 0x1400a0ef9
invalid
jnp case.0x140002106.85
and al, 0xb4
jrcxz 0x1400a0f0d
test byte [rdi], ah
adc al, 0xa8
ret 0xc489
or esp, dword [rdi + 0x18]
invalid
pop rsp
cmp dword [rdx + rax*4 + 0x78], ebp
cmpsb byte [rsi], byte [rdi]
movabs al, byte [0x5a04d97b1b806c49]
fld dword [rdx + rbx*2]
fld dword [rdx + rbx*2]
cdq
push 0xffffffffffffffef
xchg esi, eax
invalid
invalid
std
invalid
invalid
je 0x1400a0fab
add eax, 0x7c1c702b
add eax, 0x39f68b41
pushfq
invalid
invalid
sti
push rbp
mov edi, 0x366150b1
xchg ebx, eax
sti
outsd dx, dword [rsi]
lodsb al, byte [rsi]
invalid
add eax, 0xf38f4964
or dh, bh
lea esp, [rdi - 0x74931557]
retf 0x3961
invalid
invalid
invalid
movabs eax, dword [0x7ef8567f85fd8743]
int1
invalid
test eax, 0xd65ba391
sbb dword [rdx - 0x2fc1990], ebx
sti
xchg edx, eax
mov bh, 0xb6
retf
invalid
xchg ecx, eax
invalid
stc
invalid
xor eax, 0x94580537
jmp rax
cdqe
cdq
mov edi, 0xd3976e03
not dword [rdx + 0x40]
cmp eax, 0x3f581ec5
invalid
pop rbx
invalid
adc eax, 0x1c6453ba
loopne case.0x140002106.102
cmp al, 0x73
push rdi
or dword [rdi + 0x37], esp
invalid
out dx, al
mov edx, 0xa098d527
in al, dx
or al, 0x7a
invalid
loope 0x1400a10ae
mov esi, ecx
int1
push rdx
retf 0x4544
mov byte [rcx], dh
jbe 0x1400a11a1
std
invalid
cmp eax, 0x9fecef61
mov r8b, 0x6a
jnp 0x1400a10e2
pop rdx
jge 0x1400a117c
invalid
mov al, 0x27
mov ecx, 0xdcf7c024
invalid
sbb dl, byte [rax + 0x56]
sbb al, byte [rdx + 0xe]
out dx, al
call 0x151657d7e
lea eax, [rsi]
pop rsi
and eax, 0x848b72cf
mov eax, dword [rax + rdi*2 - 0x7f7be2a1]
test dword [rax], esp
js 0x1400a11df
sbb eax, 0x20858084
movsd dword [rdi], dword [rsi]
add bh, al
pop rsi
jo 0x1400a1123
int 0x5d
scasb al, byte [rdi]
jmp qword [0x18940d7bd]
mov dword [rdx + 0x4df3ce05], ecx
xchg ecx, eax
invalid
pop rsi
or ebp, dword [rbx]
and dword [rsi], edx
push 0x3d41f7df
xor al, 0x12
sub word [rdx - 0x72], si
cmp dl, ch
fidiv dword [rdi + rbx*2 - 2]
fidivr word [rax + 0x14]
invalid
or ebx, esi
loopne 0x1400a11fc
add esp, ebp
jns 0x1400a1186
cli
je 0x1400a123a
movabs eax, dword [0xf971ceb8bffaf7a]
scasd eax, dword [rdi]
dec dword [rbx + 0xf971ceb]
stc
ror byte [rdx], cl
shl al, cl
xchg esp, edi
xchg edi, eax
invalid
int3
push rdi
lea ecx, [rcx + 0x5d]
sbb eax, 0x5edded4a
in eax, dx
fstp qword [rsi - 0x7b]
xor al, 0x24
in eax, dx
fstp qword [rsi - 0x7b]
xor al, 0x24
fnsave dword [rbx + 0x41abda7e]
xchg edi, eax
push 0x35
sub byte [0x1b49f1dcf], ah
je case.0x140002106.126
cmc
mov eax, 0x4e74950b
je case.0x140002106.126
cmc
scasd eax, dword [rdi]
jbe 0x1400a1256
mov ebx, 0xf00f8a17
xchg edi, eax
invalid
invalid
retf
jle 0x1400a11ee
or dword [rcx + 0x10816920], ebp
mov esp, 0x17f63e89
mov dh, 0xdd
out 0xf3, al
out dx, eax
out dx, eax
xor al, 0x86
xor al, 0x86
xchg byte [rax + 0x24], cl
stc
and al, 0xf9
out 0x5a, eax
invalid
test bl, dh
xchg ecx, eax
xchg ecx, eax
jbe 0x1400a129c
sub dword [rbx - 8], eax
fld dword [rbx]
jnp 0x1400a1269
retf 0xe57d
jge 0x1400a124d
insd dword [rdi], dx
add ch, byte [rcx + rcx*2]
add bl, byte [rax + 0x4d]
push rdi
scasd eax, dword [rdi]
invalid
or eax, 0xd3c60ffd
push rax
jbe 0x1400a1257
invalid
jo 0x1400a1213
pop rdx
jo 0x1400a12da
mov cl, 0x47
invalid
invalid
pop rdi
invalid
sti
jp 0x1400a124a
call rdi
invalid
wait
and al, 0x6a
jae 0x1400a1340
ja case.0x14001b157.3
mov dh, 0x7b
add al, byte [rax]
cli
call qword [rbx + 0x7d]
jge case.0x14001b157.0
mov ds, word [rsi + 0x72]
mov bl, 0xdb
fbld tbyte [rdx]
push rdi
push rdx
dec ebp
invalid
pop rbx
sar byte [rsi + rsi*2 + 0x699c6bea], cl
sub byte [rsi - 0x100c0046], al
invalid