Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edx
sub r11, rdx
invalid
invalid
inc dword [rsi]
lodsb al, byte [rsi]
scasd eax, dword [rdi]
xchg edi, eax
add ebx, 0xffffffa5
push 0xffffffffd3dc360c
add eax, 0xf9ebc4f6
jrcxz 0x1400a07cc
invalid
invalid
xchg ecx, eax
sldt word [rax]
invalid
jge 0x1400a0798
pop rcx
adc byte [rsi + rdi*8 - 0x28], dh
jp 0x1400a0779
fistp qword [rsi]
or al, 5
and bl, cl
xor al, 0x28
cmpsb byte [rsi], byte [rdi]
jmp 0x1400a0819
mov fs, esi
ror byte [rdx - 0x4f], 1
and ebx, dword [rcx + 0x17]
pshufw mm7, qword [rdi - 0x2d], 0xbf
push qword [rbp + 0x4e]
cwde
loopne 0x1400a084e
sbb ebp, dword [rdi - 0x295081bf]
lodsd eax, dword [rsi]
cmp esi, dword [rsi + 0xe]
test al, 0x17
js 0x1400a07cb
jle 0x1400a07e0
invalid
sbb esi, dword [rdi + 0x183a3157]
invalid
push rdi
xor dword [rdx], edi
sbb ah, dl
and al, 0xec
invalid
invalid
je 0x1400a08c5
mov bl, 0xee
add byte [rbp - 0x7c], cl
mov al, 0x9e
invalid
test byte [rax + 0x51c7479e], dh
clc
fcomp dword [rbp + rdx*4 + 0x7af0eedb]
stosb byte [rdi], al
jg 0x1400a07f0
mov dword [rax], eax
imul edi, esi, 0xaffffeaf
invalid
std
dec byte [rdx]
invalid
sbb dword [rax + 0x502d8af0], eax
cmp dh, byte [rdi + rsi + 0x2b74ff56]
jle 0x1400a0854
invalid
adc dh, byte [rdi + 0x44797bf0]
cmp byte [rsi], ah
or al, 0xfc
jae 0x1400a0926
int 0x11
int1
adc ecx, esi
jne 0x1400a092f
clc
mov ecx, dword [rsp + rdi*2 - 0x1f90fa3e]
jl case.0x140002106.4
add eax, 0xc513e06f
jl case.0x140002106.4
add eax, 0xc513e06f
invalid
cdq
mov cl, 0xa
add byte [rax], al
retf
call 0xd7850e67
mov cl, 0xc
sahf
add eax, 0xcb1977b
push rbp
shl dword [rdi + 0x23], 1
sti
mov esp, esi
invalid
invalid
fmul st(3), st(0)
invalid
pop r12
jle 0x1400a08ad
xor esp, ebp
jrcxz 0x1400a08ba
scasd eax, dword [rdi]
and ecx, dword [rsi - 0x747f003a]
push rbx
cmp al, 0x9c
xor al, 0x39
invalid
imul esp, dword [rcx + 0x1fb318ff], 0xfebf9799
adc ebx, dword [rbx + 4]
cdq
xchg edi, eax
mov edi, 0x45b13fe
invalid
invalid
invalid
invalid
invalid
xor al, 0xab
movabs byte [0xf537622d682721ea], al
hlt
invalid
cwde
xchg byte [rdx + 0x6354a7e2], dh
mov eax, 0xb5e09155
push rbp
xchg ecx, eax
loopne 0x1400a0953
jmp 0x151e35bfe
adc edx, edi
pushfq
xchg ebp, eax
sbb esp, ecx
mov qword [r15 - 0x3d], rsi
movsd dword [rdi], dword [rsi]
push rcx
mov esi, 0x72859931
jmp 0x1400a099a
sbb byte [rcx + 0x46395a3f], ch
int3
movsb byte [rdi], byte [rsi]
cmp eax, dword [rbx - 0x2dd8eecf]
cmp eax, 0xb9ac60ae
mov al, 0xaa
sbb eax, 0xf623a35
leave
invalid
hlt
invalid
loop 0x1400a0a4d
xchg esi, eax
cmp cl, byte [rdi]
out 0xd3, eax
push rdi
xor byte [rdx], 0x9e
adc eax, 0x693f348d
invalid
invalid
mov ch, 0x63
invalid
invalid
insb byte [rdi], dx
in eax, dx
adc dword [rsi], esp
scasb al, byte [rdi]
invalid
push qword [rcx + 0x36640191]
add dword [rcx - 0x7ba9828b], edi
invalid
add dword [rsi + rsi + 1], esp
mov ecx, 0x84567d75
invalid
test byte [rsi], ah
xor ecx, dword [rbp + 0x6b27a2c2]
xor ecx, dword es:[rbp + 0x6b27a2c2]
outsb dx, byte [rsi]
in al, dx
invalid
xchg ebx, eax
jl 0x1400a0a50
lea esi, [rcx]
ret
mov ecx, 0xe9f4ae54
invalid
hlt
sbb dl, byte [rdx]
js case.0x140002106.27
imul ebp, dword [rdi], 0xffffffd0
xchg rbx, rax
loopne 0x1400a0b19
cmc
loop 0x1400a0a85
invalid
xor bh, ah
push rbx
stosb byte [rdi], al
ficomp dword [rax + 5]
mov ecx, 0x2bb7c116
fidiv word [rbx - 2]
lahf
cld
je 0x1400a0ab4
jbe 0x1400a0b05
add byte [rsi], cl
invalid
pop rsi
cli
cdq
xchg dword [rbp + 0x47], ebp
invalid
shr dword [rdi + rdx*4], cl
invalid
sub ecx, dword [rax - 0x5cf09ba0]
xor byte [rbx + 0x59497b12], al
jbe 0x1400a0b0c
invalid
stosb byte [rdi], al
invalid
popfq
std
std
iretd
lodsd eax, dword [rsi]
scasd eax, dword [rdi]
xchg ecx, eax
iretd
jmp 0x1400a0b55
and dword [rbp + 0x34], ebx
and eax, 0x5043986c
push rsp
cmovle esp, dword [rcx]
or bh, byte [rax]
ret 0x335f
invalid
xor esp, dword [rax]
push 0x62
and dl, dh
push 0x62
movabs eax, dword [0x7f494fa6b773b5ca]
xchg esi, eax
retf
invalid
adc al, 0x72
invalid
mov edi, 0xdbdb8bee
xchg edi, eax
insd dword [rdi], dx
cld
cld
in al, dx
xchg dword [rsi], edx
stosb byte [rdi], al
out dx, eax
fdivr dword [rdi]
push rbx
sahf
movsb byte [rdi], byte cs:[rsi]
sti
out dx, eax
mov esi, dword [0x1973c5124]
retf 0x367e
cli
invalid
invalid
xlatb
sbb al, 0xfa
adc eax, 0xb80eb85f
jae 0x1400a0c12
and dh, byte [rdi - 0x80]
mov dl, 0xed
invalid
fcomp dword [rbx]
push rbp
cmp esp, esp
sub eax, 0xd8d0f860
and byte [rsi + 0x15bf56ff], dl
in eax, 0x39
test al, 0xda
rcr byte [rdi], 0x49
stosd dword [rdi], eax
stosq qword [rdi], rax
invalid
and al, 0x73
pop rsi
bnd jnp 0x1400a0c9a
invalid
xchg ebx, eax
xchg bl, cl
call 0x17ad5287c
and dword [rbx - 0x5b3482e5], esi
pushfq
xchg esi, eax
add eax, 0x80f74405
enter 0xffffffffffffe9db, 0x1c
mov esi, 0x55f59e84
test dword [rax + 0x1ce9dbc8], 0xf59e84be
push rbp
retf
in eax, dx
stosb byte [rdi], al
xchg ebp, eax
invalid
lahf
mov esi, 0xd857fe38
push rdi
sti
invalid
sbb bh, byte [rcx - 0x21398d60]
mov bpl, al
imul dword [0xe3a0bc8b]
invalid
jb 0x1400a0c4d
fimul word [rdx - 0x78]
invalid
lea esp, [rdi + 0x53]
std
mov edx, dword [rdi - 0x3fbd5e4e]
sahf
push rbx
xor edi, dword [rdx - 0x5f]
pop rdi
mov dl, 0xa1
rcr byte [rsi - 0x5e85ccad], 0x5f
movabs eax, dword [0x5fa17a33539ec042]
cli
or edx, dword [rcx]
ret 0xef25
out dx, eax
out dx, eax
invalid
invalid
shr byte [rdi + 0x204b2313], 1
fdivr dword [rbx]
jp 0x1400a0c99
je 0x1400a0d29
invalid
invalid
ja 0x1400a0ccb
loop 0x1400a0c85
wait
xchg ecx, eax
or al, 0xb6
mov dh, 0x3f
mov dh, 0x3f
xlatb
invalid
ror dword [rsi - 0x1e], cl
bt eax, esp
loopne 0x1400a0ce8
mov al, 0xeb
invalid
loopne 0x1400a0ce8
mov al, 0xeb
add eax, eax
imul esp, dword [rbx + 0x24], 0xffffffc6
test dword [rbx + 0x6c3ca3f7], 0x626464cd
cmpsd dword [rsi], dword [rdi]
mov ebp, dword [rax - 0x35]
jl 0x1400a0cfd
insd dword [rdi], dx
jl 0x1400a0ce7
invalid
xor dword [rdx + 0x66], 0x4d7bf094
mov esp, es
leave
sti
sbb dword [rdx + 0x4b6cf81f], ebx
mul dword [rcx]
pop rdx
int 0x3c
cmp al, 0xeb
invalid
jb 0x1400a0d91
xchg esp, eax
invalid
cmp al, 0xeb
invalid
invalid
and al, cl
movabs dword [0x2c7ef997fb5bbb97], eax
pop rdi
sub al, 0x5f
xchg ebp, eax
pop rdx
push rbp
rcl byte [rcx - 0x17cdcabb]
pop rdi
adc al, 0xba
invalid
jl 0x1400a0d55
xchg byte [rsi], dh
mov ebp, dword [0x13d37daaa]
popfq
scasb al, byte [rdi]
invalid
vmread qword [rdx], rax
jnp 0x1400a0dd2
fsubp st(3)
cmp ebp, esi
invalid
out dx, al
sahf
lahf
lea ebx, [0x103586d38]
invalid
cmc
xchg esi, eax
pop rsi
pop rsi
test al, 0xd2
and dword [rdx + 0x20ebbc08], eax
div ah
ret 0xe317
or eax, 0xf8098421
lodsd eax, dword [rsi]
lodsd eax, dword [rsi]
sar byte [rsi - 0xf80354f], 0xa6
mov esi, 0xf07fcab1
cmpsb byte [rsi], byte [rdi]
mov esi, 0xf07fcab1
cmpsb byte [rsi], byte [rdi]
xor r9, rbp
mov esi, 0xb479713
enter 0xffffffffffffb696, 0xffffffffffffffde
mov dword [rbx + rdx*8 - 0x3f83c7a7], ebp
cmp byte [rax + rax*8 - 0x54], bh
cmp byte [rax + rax*8 - 0x54], bh
sahf
invalid
mov esp, 0xbd709d43
jg 0x1400a0d8a
invalid
fisubr word [rdi + 0x6e]
jb 0x1400a0e36
in al, 0xeb
jp 0x1400a0df7
enter 0x3099, 0x5c
invalid
or edi, eax
ret 0x8a3d
sub dword [rdx], esp
push 0xffffffffe1aeb077
cmp cl, byte [0x13ee79846]
loope case.0x140002106.75
or eax, 0xfedd8a03
mov bh, byte [rsi]
invalid
sbb dil, r12b
stc
out 0xf9, eax
movsb byte [rdi], byte [rsi]
push rdi
movabs al, byte [0xc5dfc278f7a2183f]
nop
je 0x1400a0e3c
nop
cmpsd dword [rsi], dword [rdi]
int1
push 0xffffffffda8224b0
clc
ja 0x1400a0e48
add dword [rdx - 0xd744e7c], eax
mov dl, byte [rdi + 0x7a]
push rdi
jp 0x1400a0ed4
sub byte [rdi - 0x2dc6b548], cl
push rdi
jp 0x1400a0ed4
sub byte [rdi - 0x2dc6b548], cl
pop rbp
invalid
jge 0x1400a0ee3
pop rax
stosd dword [rdi], eax
mov edi, 0x7de990ec
fcmovbe st(0), st(1)
invalid
int3
pop rdx
invalid
invalid
outsd dx, dword [rsi]
in eax, dx
pop rsp
mov bl, bh
xor esp, dword [rbx + 0x19e319b8]
push 0xffffffffffffffda
mov ch, 0x31
xor eax, esi
xor eax, esi
out dx, al
mov ebx, 0xf0f5dbff
int 9
push rax
add ecx, ebp
or dword [rax - 0x14905c40], ebp
test al, 0xc0
invalid
outsd dx, dword [rsi]
jmp 0x1400a0f20
fcmovnb st(0), st(5)
test al, 0xc0
movabs dword [0xffa6cfc5db4ceb6f], eax
movsd dword [rdi], dword [rsi]
jmp [rdi - 0x14]
fcmovnb st(0), st(5)
iretd
mov dl, 0x3b
invalid
cmp ebx, ebp
hlt
xor byte [rax - 0x47], dl
out 0x5e, eax
mov esp, 0x74eff9f2
div dword [rdi + 0x632c76fb]
push rbx
cmp byte [rsi + 0x195dc5b6], ch
mov eax, 0x3c32d98e
mov ds, ecx
xor bh, byte [rcx + rcx]
sub byte [rcx - 0x79], cl
loopne 0x1400a0eb2
rol dl, 1
invalid
invalid
mov ds, ecx
xor bh, byte [rcx + rcx]
sub byte [rcx - 0x79], cl
loopne 0x1400a0eb2
rol dl, 1
mov esi, dword [rdi + 0x6213696f]
invalid
invalid
invalid
fist dword [rdi + 0x63a6c135]
invalid
lea ebx, [rbp - 0x1d74e004]
stosd dword [rdi], eax
mov byte [rbp - 0x6a], ch
stosd dword [rdi], eax
invalid
fld dword [rdx + rbx*2]
cdq
cmp byte [rbx - 0x5c000279], bh
invalid
std
invalid
invalid
je 0x1400a0fab
jmp 0xcda1e081
mov esp, 0xcb8d97d0
pop rsp
pop rsi
invalid
adc eax, 0x71218121
xor eax, 0xff3f62be
std
invalid
and dword [rcx - 0x41ca8edf], eax
invalid
js 0x1400a0fd9
push rbp
invalid
cld
invalid
add dil, bl
test dword [rcx], ecx
pop rcx
jbe 0x1400a0fc1
imul esp, dword [rsi + 0x56ee9e88], 0x59
invalid
pop rdx
call 0x1170b6f46
pop rdi
add edi, edx
pop rdi
add edi, edx
outsd dx, dword [rsi]
cdq
outsd dx, dword [rsi]
jo 0x1400a102f
and eax, 0x228b3bf
retf 0x8125
add al, byte [rdx - 0x36]
and eax, 0x30973281
push 0x64
mov edx, 0x2b9d1735
push rsi
invalid
and ebx, dword [rcx + 0x192420cf]
jae case.0x140045520.2
jp 0x1400a10a2
sbb bl, byte [rdx - 0x3070096a]
xchg edi, eax
pop rbp
mov byte [rax], dil
xor eax, 0xbb468547
or al, 0x2c
adc al, byte [rdi + 0x46951ffe]
xchg esi, edi
invalid
xchg ebp, eax
sub dword [rbx], 0x1a3fc05c
sar byte [rdi], 0x1a
sar byte [rdi], 0x1a
mov ebp, 0xb2e66ab0
std
invalid
adc al, 0x1f
mov bl, 0x96
sbb bl, bh
je 0x1400a1143
or edx, dword [rdx + 0x61]
mov al, 0x3d
stosd dword [rdi], eax
adc dword [0xd2aa3f81], ecx
insb byte [rdi], dx
sub eax, 0x95b74e47
mov dil, 0x95
mov dil, 0x95
invalid
sbb dword es:[rax], 0xffffff8a
cli
xchg edi, eax
movabs byte [0xf6fecbe8c435e95e], al
enter 0xffffffffffffae0d, 0x79
invalid
int1
cdq
ror byte [rdx - 0x21e301d2], 1
hlt
wait
push rdi
stc
imul ecx, edi, 0xfffffffa
fdiv dword [rbx]
div dword [rsi]
invalid
push 0x63
stosb byte [edi], al
cmovns ecx, ebx
or esi, dword [rax]
pop rsi
rcl dword [rcx + 0x7a], cl
or ch, byte [rbx + 0x7faf8b7a]
pushfq
in al, 0xda
int1
int1
int1
mov ebx, dword [rbx + 0x16239eda]
cmp dword [rcx], ebp
out dx, al
insb byte [rdi], dx
ja 0x1400a117f
add bh, ch
add bh, ch
sahf
movsb byte [rdi], byte [rsi]
push rsi
jl 0x1400a116d
js 0x1400a115a
sub byte [rdi - 0x515d044c], bh
dec dword [rdi - 0x1f13287d]
push rcx
push rsp
movsb byte [rdi], byte [rsi]
rcr dword [rdx], 0x79
imul esp, dword [rsi + 0x1426cf58], 0x77
pop rsi
shr ebx, 0x30
and dword [rcx - 0x57], ecx
sbb dword [rbp - 0x5d], edx
iretd
pop rax
iretd
add al, 0x97
lea ebp, [0x101f1c401]
sub eax, 0xc1e7b28f
in al, 0x19
mov ch, 0x94
invalid
push rbp
invalid
ficom dword [rbp - 0x3e]
out 0x35, al
jp case.0x140002106.120
invalid
movabs byte [0x2af09b8ed80beba4], al
push rdx
and eax, 0x3f6db785
jmp 0x1400a11bd
mov ecx, 0x757c9e8a
jl 0x1400a1237
std
pushfq
xlatb
sti
push 0x20c77147
and al, 0xe3
mov edi, dword [rbx + 0x33]
ja 0x1400a1224
popfq
outsd dx, dword [rsi]
outsd dx, dword [rsi]
jrcxz 0x1400a11ae
xor esp, dword [rsi + 0x626a6a5b]
invalid
cmp byte [rbp - 0x6942e212], bl
insb byte [rdi], dx
cmc
xor edi, 0x18
adc eax, 0xf6e75b41
shr byte [rbx + 0x5b], 0xc7
popfq
pop rax
invalid
stc
mov edx, 0xcdad75ef
fnsave dword [rbx - 0x79c62582]
xchg ebp, eax
sal ecx, 0xf2
mov word [rsi], es
mov eax, fs
int 0xdd
mov bl, 0x7e
fidivr dword [rcx]
xchg byte [rbp - 0x730d0e3f], dl
invalid
invalid
scasd eax, dword [rdi]
or bh, byte [rbx - 0x6fbd6621]
or bh, byte [rbx - 0x6fbd6621]
or bh, byte [rbx - 0x6fbd6621]
test byte [rdi + 0x35], al
jae 0x1400a1207
xor eax, 0x7dc4d673
mov dl, byte [rsi]
cmp eax, 0xf0f01c1d
invalid
invalid
push rax
and r12d, ebp
jns 0x1400a1247
invalid
sbb al, 0xf0
invalid
invalid
lahf
pop rbx
xchg edi, eax
mov cl, 0xad
div byte [rdx - 0x15befbea]
sub byte [rcx - 0x69], bh
invalid
mov ecx, 0x5816fb3a
int1
mov eax, 0x2d648a64
fstpnce st(3), st(0)
scasd eax, dword [rdi]
popfq
pop rax
xor ch, dl
jl 0x1400a1241
js 0x1400a122e
invalid
cmc
jge 0x1400a12bd
in eax, dx
mov bh, dh
stosb byte [rdi], al
cwde
invalid
jmp 0x16c35098f
sub eax, 0xef168f40
scasb al, byte [rdi]
invalid
jnp 0x1400a12ae
scasb al, byte [rdi]
in al, 0x21
loopne 0x1400a122e
invalid
test eax, 0xff7f137e
dec dword [rbp + 0x62]
push rbp
invalid
mov ch, byte [rdx - 0xf0000c8]
jnp 0x1400a133f
invalid
invalid