Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
push rcx
sbb ebp, dword [rbp + 0xe764c56]
test al, 0x17
mov gs, esp
test byte [rbx + 0x78], r13b
imul edi, dword [rax - 0x62], 0x3e
xor dword [rdi - 0x1b5b0c9d], ebp
imul edi, dword [rax - 0x62], 0x3e
xor dword [rdi - 0x1b5b0c9d], ebp
imul ebx, eax, 0x6f92413f
stc
scasb al, byte [rdi]
movabs byte [0x9e7dd0ff42c2b48e], al
mov bl, 0x46
xchg dl, ch
mov eax, 0xd554b449
mov bl, 0x4f
fidiv dword [r15 - 0x1f1ca0d]
fidiv dword [r15 - 0x1f1ca0d]
scasd eax, dword [rdi]
invalid
pop rsp
invalid
std
dec byte [rdx]
invalid
invalid
mov bh, bh
invalid
std
sbb esp, dword [rcx]
jbe 0x1400a088b
mov esi, 0x3a36a54d
invalid
mov cl, byte [rsi + 0x338cfbf0]
insd dword [rdi], dx
cmc
cmpsb byte [rsi], byte [rdi]
cmp al, byte [rdx + 0x39]
mov dword [rcx + 0x6b], ecx
and byte [rax - 0x54], bh
js 0x1400a0872
js 0x1400a0872
retf 0xca07
pop rcx
invalid
lahf
xchg edx, eax
call 0x182aa4925
pop rax
sbb eax, dword [rdi + riz*4]
mov ebx, 0x53301c60
sub al, 0x14
mov al, 0x89
ret
ret
ret
jg 0x1400a0933
mov byte [rax - 0x745d405c], cl
scasb al, byte [rdi]
mov dh, byte [rax - 0x4acf24ea]
fild word [ebx + edi*8 + 0x69bf17aa]
movabs eax, dword [0x7a4d4510b73d9a7f]
adc byte [rbp + 0x4d], al
jp 0x1400a093e
insd dword [rdi], dx
stosd dword [rdi], eax
add eax, 0xf67ee8bc
sahf
invalid
adc byte [rbp + 0x4d], al
jp 0x1400a093e
jp 0x1400a093e
insd dword [rdi], dx
stosd dword [rdi], eax
add eax, 0xf67ee8bc
sahf
and edi, dword [rcx + 0xed173a2]
mov ecx, 0xed173a2
mov ecx, 0xed173a2
invalid
jo 0x1400a092d
nop
mov ebp, 0x114813cd
or al, 0xf0
xchg dword [rdi], ebp
sbb bl, byte [rsi - 0x7e]
pop rdi
stosd dword [rdi], eax
add dword [rdx - 0x4e], esi
mov dl, 0xd4
mov dl, 0xd4
push 0xffffffff8523bfb2
call [rdx + 0x74e2b3e5]
mov esp, 0x3afe7fe2
loop 0x1400a09e1
invalid
cmp ah, byte [0x17e6a79ff]
invalid
loop 0x1400a09e1
invalid
ror ecx, 0xc1
mov ch, 0xbf
out 0x14, eax
invalid
or eax, 0x9db63520
jg 0x1400a0a0c
sbb ebx, 0x46
and al, 0x80
ror byte [rbx + 0x23d98ad7], 1
mov bl, cl
and edi, dword [rsi + 0x5c792ee1]
mov bl, cl
and edi, dword [rsi + 0x5c792ee1]
jmp 0xfd1eac13
mov ebx, 0xfa341a0d
stosb byte [rdi], al
fistp word [rbp + 0x1e]
cmp eax, 0x51bef293
xchg ebp, eax
invalid
xchg ebp, eax
movabs r8, 0x36ffc05ebd108046
and dword ss:[rbp - 0x4840bf64], 0xae61b720
and byte [rdi + 0x7831ae61], dh
sbb byte [rdi - 0x47759d35], bh
invalid
mov eax, 0x6361f2d5
pop rbx
ror byte [0x13b992d0e], 0xe6
jg 0x1400a09f9
scasd eax, dword [rdi]
mov edx, ebx
mov dl, ch
push 0x66
test qword [r9], r13
test dword [rcx], ebp
test dword [rcx], ebp
xchg byte [esi - 0x7148a74e], bl
jmp 0x1400a0a7a
mov gs, ebx
imul eax, dword [rbp + 0x1b5ccf15], 0xffffff92
fucompi st(2)
invalid
mov byte [rsi - 0x2c], ch
sbb dword [rbp + 0x49], 0x96b58695
mov ebp, 0x337b546f
xor esi, dword [rsi + 0x3c]
xor esi, dword [rsi + 0x3c]
pop rsi
pop rbp
xor ah, byte [rbx + 0x3d097b16]
invalid
stosd dword [rdi], eax
jns 0x1400a0a59
ret
pop rsi
call 0xd8a668bc
mov al, 0x3f
push rdx
hlt
mov ecx, 0x9f020fe6
outsb dx, byte [rsi]
and byte es:[0x146f8447a], ch
std
invalid
add bl, byte [rdi + 0x2d20266e]
add bh, byte [rdx]
out dx, al
invalid
mov dl, byte [rax - 0x32]
lahf
popfq
std
add esp, dword [rsi]
invalid
invalid
invalid
retf 0xa552
leave
call 0x17f9e62fd
sub ecx, esp
push rdi
cdq
movabs byte [0xef74fc9ffeb0fbde], al
jbe 0x1400a0b05
add byte [rbp + 0x3f0d7e7], ch
mov edx, 0xfd159f79
add edi, dword [rdx - 0x2ea6087]
in al, dx
movabs eax, dword [0x3ef95ee78ae5a78b]
test al, 0xb5
or dword [rcx - 0x6d00a0ca], ebp
pop rdi
call qword [rdx - 0x625fab4e]
cmp dh, byte [esi + edi*2 - 4]
push rbp
invalid
movsb byte [rdi], byte [rsi]
invalid
pop rdi
call qword [rdx - 0x625fab4e]
cmp dh, byte [esi + edi*2 - 4]
push rbp
lea esp, [rdx + rcx*2 + 0x43c7d4]
mov edi, 0x746d8bef
mov ebp, dword [rbp + 0x74]
mov ebp, dword [rbp + 0x74]
invalid
invalid
jbe 0x1400a0b0c
invalid
stosb byte [rdi], al
invalid
popfq
std
std
iretd
call [rbp - 0x16161b3c]
std
jmp 0x127e28de0
pop rax
adc cl, byte [rcx + 0x13]
mov dh, 7
lahf
mov edx, 0x892dd96c
add dword [rdi], edx
and dl, ah
invalid
in eax, dx
and al, 0x8c
invalid
mov ecx, 0x8df4a2c0
or esi, dword [rbx - 0x7a]
stc
cmpsq qword [esi], qword [edi]
jne 0x1400a0b04
movsb byte [rdi], byte [rsi]
xchg edx, eax
pop rax
mov ebp, 0xbb03d1fa
jl 0x1400a0b03
out 0xbb, al
sub dword [rdi], 0xffffffd7
insd dword [edi], dx
jae 0x1400a0b0d
out dx, al
invalid
outsb dx, byte [rsi]
mov dl, 0x8b
fcmovnu st(0), st(3)
xchg edi, eax
cmp ah, dl
push rdx
pop rax
jp 0x1400a0bdd
mov edi, 0xc1566749
invalid
pop rsp
mov cl, 0x10
mov bh, 0x8a
invalid
adc byte [rdi + 0x1637f38a], dh
mov dl, 0x65
stosb byte [rdi], al
ja 0x1400a0b37
fucomp st(1)
invalid
ret 0x3874
pop rsp
mov bl, 0x21
invalid
call qword [rdi + 0x7fec9bde]
std
cdq
push 0x7bf01012
cdq
fisttp qword [rdi]
cmp bh, byte [rax + 0x4568686a]
invalid
test al, 0x75
xlatb
pop rbx
rcl dword [rcx - 0x16]
invalid
lodsd eax, dword [rsi]
add byte [rbp + 0x6bf811c8], dh
sar byte [rbp - 0x7543747b], 1
mov esi, 0x58fa6911
cli
pop rax
mov edi, dword [rdx + rcx*4 - 0x596ee42]
cli
pop rax
xchg esp, eax
xchg esi, eax
jge 0x1400a0baa
sbb dword [rcx - 0x7fdf4b5f], esi
mov bh, byte [rax + 0x54]
mov bl, 0x38
mov ebp, 0x30666c56
dec dword [rax]
invalid
mov esp, 0x9f1fcf53
cmp bh, byte [rdx]
pop r9
retf
lahf
sal byte [rbx], 1
push rbp
mov ebx, 0xdeb3e6f5
mov cl, 0xff
loop 0x1400a0c7d
nop
mov bh, 0x6e
jnp 0x1400a0c18
cmovp esi, edi
mov cl, 0x7d
movabs dword [0x8a347f7f9b53cfc6], eax
adc al, 0xb3
mov bl, 0xa8
invalid
invalid
invalid
add ebx, dword [rdx]
fnsave dword [rbx + 0x5f]
not byte [rsi + rax*8]
adc dil, byte [r8]
fdiv qword [rsi - 0x590dddc5]
invalid
or dh, byte es:[rsi + 0x15c22f56]
invalid
invalid
enter 0xe48, 0xffffffffffffffc6
and eax, 0x7128264c
movsb byte [rdi], byte [rsi]
movabs dword [0x1ce9126c52e1427f], eax
sub dword [rbp + rdi - 0x13], esi
shr dword [rax - 0x41], cl
xchg esp, eax
out 0x66, eax
pop rdx
invalid
fistp dword [rdx]
adc al, 0xc9
push 0x7fd3548e
jg 0x1400a0d10
add ebx, 0x14f71144
cmp dh, byte [rdi]
jg 0x1400a0d10
add ebx, 0x14f71144
cmp dh, byte [rdi]
and byte [rax + 0x7cb42ad9], 0x43
pop rbx
sar dword [rbp - 0x6f], 1
movabs al, byte [0x7dd15b437cb42ad9]
xchg ecx, eax
xchg ebx, eax
sbb ah, dl
dec byte [r8 - 9]
fnstcw word [rbp + 0x3f]
test al, 0x33
scasb al, byte [rdi]
push rsi
jg 0x1400a0ce3
scasb al, byte [rdi]
sub bl, byte [0x13c202ca3]
mov gs, word [rcx + 0x586edb7e]
test eax, 0x586edb7e
test eax, 0x586edb7e
jrcxz 0x1400a0cf7
insb byte [rdi], dx
je 0x1400a0d4a
sbb eax, 0xfddd7bf9
std
mov al, byte [rdx + 0x79]
test eax, 0xdbbe08bf
movabs byte [0x5fe1bff62ef8df00], al
invalid
invalid
insd dword [rdi], dx
cmp ah, ch
adc eax, 0x5595fe45
cmp dword [rdx + 0x3f59426e], edx
outsb dx, byte [rsi]
pop rcx
invalid
push rcx
or eax, 0x512e50b8
xchg edx, eax
push rbx
cli
mov ecx, ecx
mov bl, byte [rcx + 0x3f]
invalid
outsb dx, byte [rsi]
pop rcx
invalid
jns 0x1400a0dbd
invalid
hlt
cmp dh, ah
pop rsp
wait
std
invalid
sti
insd dword [rdi], dx
out dx, eax
cmp byte [rsi - 0x5aaeb8e3], bh
in eax, 0x20
movabs al, byte [0xab41198b1ef73b21]
push rsi
adc eax, 0xc1ce973e
lahf
and byte [rcx + 0x311371bf], cl
movsb byte [rdi], byte [rsi]
adc dword [rbp - 0x4557714], ecx
invalid
int3
cdq
stosb byte [rdi], al
invalid
invalid
adc dword [rdx + 0x3b6fd027], ecx
invalid
cld
xchg edx, eax
pop rdi
xor cl, dh
invalid
retf
invalid
invalid
mov edi, 0xf300e565
cmp byte [rdx - 0x2880c3b5], dh
mov dl, 0x4b
cmp al, 0x7f
xlatb
invalid
mov edx, 0xf2dfb9de
adc al, 0xe2
scasd eax, dword [rdi]
xor edx, esi
cmp dword [rax], 0x3d
jle 0x1400a0e8e
sbb byte [rbx - 7], bh
xor esp, ebx
add byte [rdx + 0x384ef78c], dl
cdq
sbb cl, cl
retf
xor eax, esi
out dx, al
mov ebx, 0xf0f5dbff
out dx, al
stosd dword [rdi], eax
invalid
xchg eax, ebx
fcmovnbe st(0), st(5)
cmp byte [rbx - 0x59303a25], bh
jmp qword [rbp - 0x7b179001]
out dx, al
invalid
cdq
pop rdx
mov ecx, 0x46bc5ee7
invalid
stc
add bl, cl
test edi, ebx
sbb al, 0xd6
and al, 0xf3
invalid
retf
test qword [rax], r10
sub esi, dword [rbp + 0x1429e14b]
add byte [rsi - 0x2f], ch
ror esp, 1
xchg byte [rcx - 0x40c00200], al
jnp 0x1400a0fb0
xor ch, byte [rdi - 0x33]
sahf
invalid
stosd dword [rdi], eax
mov dh, 0xdd
movsb byte [rdi], byte [rsi]
and bl, byte [rdi]
je 0x1400a0f1c
invalid
invalid
mov al, 0xe5
not byte [rsi]
xor al, 0x1c
cmpsd dword [rsi], dword [rdi]
movabs dword [0xa894206d7cffa3ff], eax
invalid
jne 0x1400a0fea
invalid
sub esp, dword [rsi - 0x57]
hlt
fld xword ss:[rsp + rbp*2]
xchg esp, eax
jl 0x1400a0fcb
mov esi, dword [r8 - 0x61cd7e09]
push rbx
out dx, al
cmpsb byte [rsi], byte [rdi]
jge 0x1400a0fd4
xor bl, byte [rsi + 0x7da6ee53]
add ch, byte [rbp + 0x165db501]
insd dword [rdi], dx
lodsd eax, dword [rsi]
add dword [rbp + 0x3d6d165d], esi
cmp eax, 0x7f3a69cd
invalid
invalid
mov ch, 0x5d
invalid
cmp eax, 0x7f3a69cd
invalid
mov dh, 0x16
mov al, 0x13
xchg esi, eax
invalid
push rbx
push rbx
nop
insd dword [rdi], dx
xor dl, byte [rdx - 0x34]
adc al, 9
xchg ecx, eax
cld
scasd eax, dword [rdi]
inc dword [0x194527df1]
add eax, 0x54486d50
adc esi, dword [rdi]
cli
mov edi, 0xa5d016fe
call [eax + 0x2d]
popfq
stc
test al, 0x96
sbb byte [r13 + 0x29a3cda4], r13b
jl 0x1400a10b5
and ebp, ecx
cld
pop rbp
add byte [rbp - 0x285c02cf], dl
invalid
pop rsp
std
scasd eax, dword [rdi]
invalid
movsb byte [rdi], byte [rsi]
mov ah, 0xfc
sub al, 0xab
jp 0x1400a10b2
scasd eax, dword [rdi]
call qword [rsi]
or al, 0xfc
out dx, al
in al, dx
add ecx, dword [rdi]
cwde
sub dword [rax + rbp*2 - 0xe018511], esi
invalid
cdq
jg 0x1400a1138
int3
invalid
xchg dword [rdi], edx
push rcx
jl 0x1400a116e
dec edi
fisttp word [rsi - 0x106ba8fc]
adc dword [rdi + 0x9e7bb49], ebx
pop rbx
push rcx
iretd
jge 0x1400a115d
hlt
invalid
sub ebp, 0xe18b8c91
pop rbx
invalid
invalid
invalid
mov ch, 0x6d
xchg esi, eax
mov esp, dword [rdx]
test eax, 0x2a2f14e0
mov bh, byte [rax]
add eax, 0x54f3f4ab
push rsp
push rsp
fimul dword [rdi - 0x17]
sbb dil, r14b
and eax, 0xe5bd7855
push rdi
lea ecx, [rcx + 0x5d]
out 0xc0, al
out 0x2c, al
mov byte [rbp + rdx*4 - 0x5ca3c7cc], ah
xchg edx, eax
outsb dx, byte [rsi]
scasd eax, dword [rdi]
mov edi, dword [rcx + 0x1475e183]
push rbp
retf
hlt
add ch, byte [rsi]
jl 0x1400a120d
xchg esi, edx
out dx, al
xchg edi, eax
mov esp, 0x548754e
insb byte [rdi], dx
outsb dx, byte [rsi]
std
mov edx, 0xc803991d
cdq
add ecx, eax
cdq
add ecx, eax
invalid
invalid
stc
invalid
mov eax, 0x56553864
add ebp, dword [rbx + rbx]
test eax, 0x7bb80ac7
pop rbp
cmc
invalid
cmc
jl 0x1400a12e3
jge 0x1400a126b
xchg r11d, eax
jno 0x1400a12b8
and ah, dh
invalid
pop rdi
invalid
jnp 0x1400a130a
push rsi
mov esi, 0xfb8f7f7a
invalid
add byte [rcx], ch
test eax, 0xd603013
invalid
or eax, 0xb372b1aa
fcmovnu st(0), st(7)
insd dword [rdi], dx
invalid
invalid
mov edi, 0xafb7fe0a
cmc
out 0xb5, eax
ret