Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
hlt
lodsd eax, dword [rsi]
out 0xaf, al
movabs al, byte [0x1397c89bef7f8fe9]
invalid
loopne 0x1400a07ce
or eax, dword [rsi + riz*8]
cmp ebp, dword [rsi - 0x28]
xor esp, dword [rcx]
ret
push rbp
jge 0x1400a087a
jge 0x1400a0813
jbe 0x1400a0844
test al, 0x17
invalid
invalid
hlt
mul dword [rbp + 0x6a]
enter 0x3e39, 0xffffffffffffffcd
pop rdx
call rax
jge 0x1400a07f6
jp 0x1400a08c0
std
out 0xe2, al
dec dword [rcx + 0x17f6f4e7]
invalid
invalid
invalid
js 0x1400a08bb
sub eax, 0xd7d7c2bf
invalid
pop rdi
sub byte [rcx], ah
and byte [rcx + 0x2d], dh
and dword [rax], esp
jno 0x1400a08ab
jge 0x1400a08fe
invalid
imul edi, dword [0x103f4ca43], 0x5e
ret 0x26f5
je 0x1400a089a
pop rcx
invalid
jle 0x1400a08b1
invalid
push 0xffffffffffffffa6
cli
mov cr5, rbx
movabs al, byte [0x7f0ea9c7258815f3]
mov byte [0x1bf18b281], ah
invalid
and edx, esi
loopne 0x1400a089a
loopne 0x1400a0911
push rax
mov dl, 0x84
sbb bh, bl
sti
sti
push rbx
cmp dl, bl
or al, 0xe2
invalid
psubsw mm0, qword [rdx + rdi*8 - 0x133f8d62]
jb 0x1400a089a
shr ah, 0x74
mov word [rbx + 0x327ab9b1], cs
sbb byte [rcx], al
sub al, 0x69
in al, dx
je 0x1400a0869
mov esi, dword [rcx + 0x18327ab9]
add dword [rcx + rbp*2], ebp
cmpsd dword [rsi], dword [rdi]
movabs al, byte [0xa70ae3dd308f5aae]
invalid
xor ch, bl
jrcxz 0x1400a08f9
cmpsd dword [rsi], dword [rdi]
invalid
cmpsd dword [rsi], dword [rdi]
invalid
xor eax, 0xffc2be33
jnp 0x1400a08d9
mov esi, 0xd47bffc2
push rdi
invalid
wait
push 5
push rdx
or dl, dh
fidiv dword [rbx + rdx*4]
invalid
cmp edx, dword [rsp + rdi*2 + 6]
jge 0x1400a08fe
invalid
rol dword [rdx + riz*8 - 0x5d], 1
loop 0x1400a08d3
invalid
xchg ecx, eax
cmc
jle 0x1400a09b8
pop rsi
adc eax, 0x3e86331c
xchg esi, eax
idiv byte [rbp - 0x4050a733]
sti
out dx, eax
mov word [rax + rdx*8], es
add ch, byte [rdx - 0x14658a93]
insd dword [rdi], dx
jne 0x1400a08ef
jmp 0x1400a0927
mov dh, 0x3c
mov edi, 0xc16965e2
invalid
wait
js 0x1400a09dc
pop rax
scasd eax, dword [rdi]
mov edi, 0x48ceffb
rol byte [rdx], 1
stosb byte [rdi], al
insd dword [rdi], dx
jne 0x1400a08ef
jmp 0x1400a0927
js 0x1400a09dc
adc al, 0x52
imul ebx, dword [rdi + 0x69767e3a], 0x58
mov cl, 0xbb
invalid
mov ebx, 0x3acffff
jns 0x1400a0948
xchg edx, eax
stc
rcr esi, 0xec
mov edi, 0x767e7dfe
sbb edx, dword [r11 + 0x12050172]
jb 0x1400a0983
invalid
adc cl, byte [rsi]
jb 0x1400a0983
add eax, 0x97510e12
adc cl, byte [rsi]
push rcx
xchg edi, eax
push rsp
jae 0x1400a09c9
invalid
idiv byte [rdi + 0x13aba1bb]
sbb byte [rdi], dl
mov ch, 0xe7
invalid
movabs al, byte [0x763758fd97a5337c]
sbb al, 0xcd
fstp qword [rsi + 0x742bea82]
mov edi, 0xd71fa28b
push 0xffffffffaf7fab97
stosd dword [rdi], eax
jg 0x1400a096c
invalid
pop rbx
or al, 0x12
lodsd eax, dword [rsi]
retf 0xab68
or cl, byte [rax]
out 0xeb, al
push rsp
mov ebp, 0x3683dcc4
div dword [rdi]
mov ebp, 0x5fd15867
scasd eax, dword [rdi]
invalid
invalid
invalid
invalid
retf
xor esi, dword [rsi + 0x3c]
pop rsi
mov ebp, 0x98a5f3eb
and byte [rdi + rcx - 0x4d41763], r8b
invalid
sub edi, ebx
setge al
sub edi, ebx
invalid
js 0x1400a0aa1
push rsi
sbb eax, 0x5f0803d6
invalid
invalid
jg 0x1400a0a38
enter 0x3807, 0xffffffffffffffc5
retf 0xa139
mov edx, 0xe146b463
pushfq
hlt
cmpsd dword [rsi], dword [rdi]
outsb dx, byte es:[rsi]
invalid
push rbx
and ch, byte [rdx - 0x6d]
adc byte [rsi - 0x2b], 0xe6
loop 0x1400a0b28
invalid
movabs byte [0xef1bebecbdb0fbde], al
jbe 0x1400a0b05
add byte [rbx + 0x7bf590ca], ch
paddw mm5, mm4
jnp 0x1400a0add
std
in al, dx
shr byte [rax - 0x5874004f], cl
in eax, 0x8a
invalid
test dword gs:[rsi], esi
rcr byte [rsi + 0x61429626], 0x89
xchg esi, eax
invalid
invalid
mov dword [rcx - 0x60], edx
movsb byte [rdi], byte [rsi]
pop rbx
mov ecx, 0x7c66cb1
invalid
push 0xffffffffffffff9f
invalid
xchg esi, eax
invalid
movsb byte [rdi], byte [rsi]
pop rbx
mov ecx, 0x7c66cb1
invalid
ret
invalid
xchg dl, al
mov dl, byte [rcx + rdi*4 - 0x32ed2942]
sti
js 0x1400a0b4c
cmp al, 0xb4
jl 0x1400a0ab8
mov dword [rax + rcx*2 - 0x52], ebx
pop rsp
scasb al, byte [rdi]
movsd dword [rdi], dword [rsi]
hlt
loopne 0x1400a0ae9
int3
rol dword [rdi], cl
cmpsd dword [rsi], dword [rdi]
mov ch, 0x37
invalid
sal dl, cl
mov ecx, 0x7ffc3caa
push rdi
mul dword [rsi]
mov cl, byte [rsi + 0x4b934ee7]
mul dword [rsi]
mov cl, byte [rsi + 0x4b934ee7]
mov edi, 0xee8baa16
in al, 0xae
sar bl, cl
push 0xffffffffd948795d
fst dword [rsi + 0x24]
sub al, byte [rbp + 0x2c14f0be]
invalid
nop
cmpsb byte [rsi], byte [rdi]
jp 0x1400a0b2c
fst dword [rsi + 0x24]
sub al, byte [rbp + 0x2c14f0be]
test dword [rax + 0x71b57aa6], edx
or dh, cl
cmp esi, dword [rdi + 0x67085efc]
or byte [rdi - 0x72], ah
invalid
pop rcx
retf 0xdb4
loop 0x1400a0bc2
jno 0x1400a0b81
invalid
or byte [rdi - 0x72], ah
invalid
jle 0x1400a0ba6
invalid
mov edi, 0x7cd142ee
xor ecx, dword [rax + riz*4 + 0x469fe102]
movabs eax, dword [0xee35360ae6916617]
xor eax, 0x9a0a02ee
jbe case.0x140002106.36
add cl, byte [rdx]
invalid
sub dl, byte [rsi + 0x3f]
jp 0x1400a0bea
mov ecx, dword [rax - 0x75]
invalid
cli
invalid
inc dword [rax + 0x76]
invalid
fild word [rsi + rcx*4 + 0x3e]
movabs al, byte [0x3e7ab1a12d964a8b]
invalid
invalid
cdq
invalid
push rdx
jmp 0x1400a0c24
call qword [rcx*8 - 0x66574688]
mov edx, 0x2da0c680
in eax, 0xf3
outsb dx, byte [rsi]
push rcx
lodsb al, byte [rsi]
pop rsi
bnd jnp 0x1400a0c9a
xchg esp, eax
and al, 0xd6
insd dword [rdi], dx
xor esp, ebx
popfq
pop rcx
mov ecx, 0x1f9fbea2
jmp [rbx + rdi*8 - 1]
sahf
mov ecx, dword [rdi]
sti
sub eax, 0x84a179b6
jnp case.0x14002b41b.1
push rax
push rax
adc al, 0xde
sbb dword [rbp - 0x61c60581], 0xe13ad125
popfq
jg 0x1400a0c47
cmp dword [rsi - 0x1ec52edb], ebx
popfq
jg 0x1400a0c47
cmp dword [rsi - 0x1ec52edb], ebx
imul edi, edi, 0x769026e2
or byte ds:[0xca510beb], dl
or byte [0xca510beb], dl
or byte [0xca510beb], dl
invalid
int3
movsd dword [rdi], dword [rsi]
add bl, byte ds:[rdx + 0x592d7c28]
pop rcx
add dword [rdx + rbx*4], esi
jae 0x1400a0ce1
not byte [rdi + rdi*4]
cmp dword [rsi - 0x7d40ef22], 0x6b
push rcx
or byte [rsi + 0x67], ch
mov bh, 0xca
xchg esi, eax
mov bl, 0xa1
jbe 0x1400a0c45
adc eax, 0x3c6ff3fe
int3
rep outsd dx, dword [rsi]
cmp al, 0xcc
ror ebp, 0x16
sbb esp, ecx
invalid
fdiv qword [rbp + 0x65]
imul ebp, dword [rbp + 0x29], 0x29217f15
add edx, 0xfbc49f2a
invalid
sbb dword [rcx], esi
cmpsb byte [rsi], byte [rdi]
je 0x1400a0d0e
int 0xbb
int1
sub bl, byte [rsi + rcx*2]
retf 0x8e14
sahf
sahf
cmp byte [rdi - 0x6e], bl
invalid
xor bl, byte [rsi]
jp 0x1400a0cdd
invalid
popfq
push rcx
leave
invalid
xchg esp, eax
wait
sbb ch, byte [rsp + rsi*8]
invalid
movabs eax, dword [0xc4e1c59c888fa278]
invalid
invalid
cmp dh, dh
ja 0x1400a0dac
mov word [0x1844be898], gs
push rsi
fild dword [rcx + 0x44]
mov al, 0x80
mov ch, byte [rdi]
jne 0x1400a0d38
hlt
xchg esp, eax
jnp 0x1400a0da5
pop rdx
jo 0x1400a0d8a
add bl, bl
in al, 0x50
insb byte [rdi], dx
invalid
jno 0x1400a0db4
invalid
insb byte [rdi], dx
hlt
movabs dword [0x5b79ca1daab23cfd], eax
in eax, dx
pop rdx
pop rbx
out dx, eax
cmp dword [rax - 0x52], esi
xchg ebp, eax
push rbx
lahf
lahf
mov dl, 0xa9
loopne 0x1400a0e27
in al, dx
fcomp qword [rbx + 0x3035178a]
invalid
invalid
invalid
mov dl, byte [rdi]
xor eax, 0xedc86330
jl 0x1400a0dd9
push rax
out dx, eax
sti
movsb byte [rdi], byte [rsi]
scasd eax, dword [rdi]
jp case.0x140002106.63
jns case.0x140002106.66
or eax, 0xf82d5269
jrcxz 0x1400a0daa
stosb byte [rdi], al
add sil, byte [rsi + 0x58f6d5e5]
xchg edi, eax
push rsp
fninit
jrcxz 0x1400a0e23
out dx, eax
out dx, eax
push rcx
xchg edx, eax
cmp cl, dl
ret 0x956e
wait
cli
sbb eax, 0x8e371141
adc dword [rdi], esi
mov cs, word [rsi - 0x6e]
adc dword [rdi], esi
mov cs, word [rsi - 0x6e]
push rdx
wait
pop rbp
mov edx, 0x7f4d8b4d
mov ecx, esi
mov dl, al
in eax, dx
invalid
fisubr word [rdi + 0x6e]
jb 0x1400a0dec
sub bl, byte [rdi + rsi*8 - 0x30]
invalid
movabs eax, dword [0x7f1bf86b2597ea9f]
xchg edi, eax
and eax, 0x7f1bf86b
sbb edi, dword [rdi + 0x4d]
adc rax, 0x36badd39
adc rax, 0x36badd39
xor byte [rdi], ch
fild word [rcx + 0x31ae57f6]
cmp byte [rdx], 0xac
cli
out dx, eax
movabs dword [0xedaa8afedd8af98b], eax
imul ecx, dword [rdx + 0x8d38325], 0xeba8efd3
ror dword [rax], cl
shr edi, cl
test al, 0xeb
ror dword [rax], cl
shr edi, cl
test al, 0xeb
mov ah, 0xf8
sub al, 0x69
invalid
pop rcx
adc eax, 0x4ac1485d
fidivr dword [rdi + 0x78]
mov ebx, 0x89347daf
invalid
push 0x7f27c58f
pushfq
invalid
invalid
adc edi, dword [rax - 0x61]
invalid
stosd dword [rdi], eax
in eax, dx
mov ecx, 0x1a14f2df
adc rsp, qword [r11 + 0x17]
pop rsp
invalid
pop r9
fimul word [rsi + 0x526b7bd7]
invalid
mov bl, byte [rcx + rdi*8 - 0xa24002c]
invalid
out dx, al
mov bl, 0xc
shl byte [rbp - 0x1a], 1
fcmovnb st(0), st(5)
iretd
out dx, al
ret
invalid
jbe 0x1400a0f03
invalid
mov ecx, 0x20bc5ee7
cmpsb byte [rsi], byte [rdi]
invalid
leave
invalid
mov ebx, dword [rsi + 0x22]
push rax
in al, dx
cli
jbe 0x1400a0ef9
sub esi, edx
and bl, bl
invalid
jnp case.0x140002106.85
jno 0x1400a0f74
pop rax
ja 0x1400a0fd6
fimul word [rbx]
invalid
mul byte [rax]
xor bh, ch
jmp 0xd39cb49f
movsd dword [rdi], dword [rsi]
xchg edx, eax
xchg ebx, eax
invalid
int1
js 0x1400a0f5a
jmp 0xff8c4ac9
xchg esp, eax
mov bh, al
ja 0x1400a0fc9
mov ebx, 0x8cefd87
pop rcx
invalid
xchg esp, eax
sahf
or dword [rax - 0x6a], edi
lodsd eax, dword [rsi]
sbb eax, 0x4a4cdd2c
jl 0x1400a0fcf
jl 0x1400a0fcf
test byte [rdi], dl
invalid
je 0x1400a0fab
invalid
mov edi, dword [rdx]
fidiv word [rbp + 0x62712d03]
jb 0x1400a0fc7
invalid
invalid
mov ecx, 0x68dcae61
and dword [rdi - 0x200c053], ebp
invalid
xor bh, dl
mov al, 0x13
cmp esi, dword [rcx + 0x10cd6af9]
invalid
mov dword [rdx - 0x1e8bad64], eax
ja 0x1400a0f9e
xchg esp, ecx
jb 0x1400a1001
invalid
sti
insd dword [rdi], dx
movabs dword [0xffbc6b0b67cd9ac5], eax
cli
mov edi, 0x3722e1f8
xchg ebx, eax
add al, 0xde
mov edx, 0xe4f31c06
sbb al, 0xf3
in al, 0x86
invalid
sub edi, esi
sbb al, 0xf3
in al, 0x86
invalid
invalid
xor bh, byte [rbp + rsi*4 + 0x64]
add dword [rdi + rdi*8], eax
jae 0x1400a101c
invalid
pop rsi
cmpsb byte [rsi], byte [rdi]
movsd dword [rdi], dword [rsi]
int 0x91
xchg ecx, eax
cmc
jg 0x1400a1046
cmc
stosd dword [rdi], eax
xchg byte [rax + riz*2 - 0x68313308], dh
jnp 0x1400a10d5
sti
invalid
sub ch, byte [rdi + 0x438176ff]
jmp 0x11e16bc14
stosd dword [rdi], eax
or al, 0xde
xor al, 2
push rax
jl 0x1400a1095
invalid
movabs al, byte [0x829296f3d4c3062]
invalid
outsb dx, byte [rsi]
xlatb
sub eax, 0xf6b07f59
test byte [rax - 0x34], ch
push 0xdbd3ccc
movsd dword [rdi], dword [rsi]
pushfq
test al, 0x22
push 0xdbd3ccc
movsd dword [rdi], dword [rsi]
xor al, 0xeb
movsb byte [rdi], byte [rsi]
invalid
and dword [rdx - 0x1fcbdebc], eax
add byte [rdi], bl
invalid
invalid
mov al, 0x16
jbe 0x1400a11a1
std
xor al, 0x5d
mov eax, 0xca5d8a94
add edi, dword [rbx - 0x64]
pop rdx
jge 0x1400a11bd
push r8
rcr byte [rdi], 1
invalid
cmp byte [rdi], bh
popfq
cmp rbx, r10
loop 0x1400a1133
mov r11d, 0x21939ba6
in al, dx
xchg ebx, eax
and esp, ebp
movsd dword [rdi], dword [rsi]
mov bh, 0x91
test eax, 0xff7c51d2
iretd
fstp dword [rcx - 0x59]
invalid
invalid
js case.0x140002106.122
add eax, 0xcf4df3ce
sbb ch, al
push r14
or al, 0x6f
invalid
invalid
je 0x1400a1164
push rsi
imul edi, dword [rdx - 0x5045f518], 0xffffffb8
out 0x65, al
mov eax, 0x386465e6
wait
leave
cmp byte fs:[rbx + rbx*4 - 0x37], ah
xchg edi, eax
invalid
cmp cl, al
pop rdi
pushfq
sub byte [rsi], bl
add edx, dword [rdi + 0x30]
cdq
int1
jl 0x1400a118b
movsd dword [rdi], dword [rsi]
rcl dword [rdx], cl
invalid
cdq
sub dword es:[rcx + 0x3e], ebp
fadd dword [rsi - 0x4287aa5b]
in eax, 0x57
lea ecx, [rcx + 0x5d]
sbb eax, 0xefdded4a
in eax, dx
fucomp st(7)
in eax, dx
fucomp st(7)
jne 0x1400a11b4
int 0x33
and al, 0x98
cld
cmp byte [rdx + 0x2b48313], dl
sub eax, 0xaf00fea0
scasd eax, dword [rdi]
scasd eax, dword [rdi]
invalid
and byte [rdi + rbp*2], bh
clc
xchg byte [rcx + 0x4ebc97ee], dh
in eax, 0xe5
push rcx
or al, 0xa5
push rax
movabs byte [0xff752f660bc0f82b], al
clc
ror byte [rbx], 0x66
invalid
jne 0x1400a123e
std
lahf
pop rbx
xchg edi, eax
mov cl, 0x39
or eax, 0x5bdd2b5d
ficom word [rdi - 2]
scasd eax, dword [rdi]
clc
ror byte [rbx], 0x66
invalid
invalid
and esi, dword [rdi - 0x6f]
invalid
xor bl, ah
pop rsp
retf
jb 0x1400a12d0
lodsb al, byte [rsi]
clc
popfq
pushfq
jo 0x1400a1292
jo 0x1400a1292
invalid
pop rdi
invalid
jmp 0x1566ec1fa