Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, 0xe0
leave
rcl byte [rdx], 0x13
adc ch, bh
add byte [rax], al
out 0x3e, eax
je 0x1400a0827
ret
xchg edi, eax
and cl, byte [rax + rbx - 0x3c1f7cbb]
and dword [rbx + rdx*4], esp
xor eax, 0xa80e7645
invalid
ret
iretd
add byte [rbp - 0x5b], al
scasd eax, dword [rdi]
push 0xffffffffffeb4aed
sar byte [rbp - 0x62], 1
in eax, dx
jmp 0x1400a0854
call rax
jge 0x1400a07f6
invalid
adc esi, dword [rsi + 0x3c]
jge 0x1400a08a7
jb 0x1400a0896
xor ebp, dword [rcx - 0x2f]
jle 0x1400a085c
imul edx, ecx, 0x54faf57e
cli
push rsp
lea edx, [rcx + rbx*2 - 0x4d]
cmpsd dword [rsi], dword [rdi]
pushfq
nop
mov bh, 0xbc
invalid
std
dec byte [rdx]
invalid
fmul dword [rbp - 0x55]
mov r13b, 0xa2
std
jmp 0x1400a0863
cmp al, 0x59
xor al, 0x2b
push 0x7d
mov ch, 0x28
call 0xc5872f91
jge 0x1400a0828
jge 0x1400a0828
hlt
invalid
invalid
out dx, eax
and al, 8
stc
sub ecx, edx
push rsp
invalid
jae 0x1400a0851
clc
adc al, 0x38
jl 0x1400a08a6
fisttp word [rsi + 0x177b0d98]
sar dword [rdi - 0x4a0e04b4], cl
adc al, 0x34
add ecx, 0xffffffd0
invalid
sub al, byte [rsi + rdi*2]
xchg ecx, eax
in eax, dx
add byte [rdi - 0x34], cl
xlatb
cmp ecx, ecx
invalid
pop rax
adc byte [rax], dh
mov esi, 0x45fe5b26
enter 0x47ee, 0x25
outsd dx, dword [rsi]
retf 0x5694
push rsi
push rsi
sub byte [rcx], cl
invalid
in eax, 0x70
invalid
stosd dword [rdi], eax
int 0xb4
stosb byte [rdi], al
push rsi
xor ch, byte [rbx]
mov edi, 0xf21fa4de
invalid
loope 0x1400a0979
invalid
mov ebp, 0xb8b3849
adc dword [rax + 0x144de101], esp
cld
xor eax, 0xf0e998e6
xchg edi, eax
jnp 0x1400a09de
xor al, 0x93
invalid
invalid
int 0x6b
lahf
punpckldq mm0, mm3
fxch st(1)
hlt
invalid
xor eax, 0x26ec1912
invalid
int3
in al, 0xff
mov edi, 0x9f5890b3
movabs al, byte [0x7177da9ce916f47f]
fidiv dword [rdi + 0x71]
mov edx, 0xe07ed269
test eax, 0xfc05e312
fcomp qword es:[rdi]
fcomp qword [rdi]
fcomp qword [rdi]
int3
not byte [rbx - 0x14]
xchg edi, eax
retf
test byte [rcx], dh
cmp esp, dword [rsi - 0x4403cd94]
xchg esp, eax
mov dl, bh
invalid
xor esi, dword [rsi + 0x3c]
pop rsi
invalid
wait
pop rbx
xchg dword [rdi - 0x5a], ebx
xchg esi, esp
invalid
xchg rsp, rax
cli
adc al, 0xb6
invalid
pop rax
adc dword cs:[rax], 0xffffffe1
pushfq
hlt
push rbx
je 0x1400a0a8b
je 0x1400a0a8b
sbb byte [rbx], bh
invalid
jnp 0x1400a0add
std
in al, dx
movabs byte [0xe743d357af2ae213], al
pop rsi
stc
xchg esi, eax
pop rsi
add eax, 0xa143ce44
movabs eax, dword [0x2568d8503e5b516c]
movabs eax, dword [0x2568d8503e5b516c]
invalid
xchg dword [rdi - 0x1d], ebx
add al, 0xf0
jnp 0x1400a0ab4
jrcxz 0x1400a0b00
invalid
jge 0x1400a0afa
stc
mov ebx, 0xd429f65d
int 0xe6
xchg edi, eax
std
std
mov ss, word [rdi]
invalid
call [rbp - 0x658b5cfa]
invalid
lahf
cmp dl, bl
mov dh, 0x51
shl dword [rdi], cl
invalid
invalid
adc dword [rdi], edx
clc
insd dword [rdi], dx
enter 0xbc6, 0xfffffffffffffffb
enter 0xbc6, 0xfffffffffffffffb
fisub word [r14 - 0x21]
jb 0x1400a0b1d
invalid
fadd st(4)
scasb al, byte [rdi]
test eax, 0x51fcac63
sbb eax, 0x33a4e5a9
fidivr dword [rcx]
movabs al, byte [0x4bfb4b199608634c]
movsxd r9, dword [rax]
xchg esi, eax
sbb dword [rbx - 5], ecx
movabs r15, 0x7d5def8aed8baa16
invalid
invalid
movsxd r9, dword [rax]
xchg esi, eax
sbb dword [rbx - 5], ecx
movabs r15, 0x7d5def8aed8baa16
int 0x25
xchg edx, eax
and eax, 0xe210f292
adc dl, ah
loop 0x1400a0bc9
pop rbp
jb 0x1400a0b6a
add byte [rax - 0x527a9310], dl
jl 0x1400a0b3b
out 0x6c, eax
jl case.0x140002106.40
invalid
mov ebp, dword [rbx - 0x21595276]
invalid
mov ch, byte [rbp - 0x2cc0215a]
movsb byte [rdi], byte [rsi]
sub bl, byte [rax + 0x78]
shr dword [rdx], 1
invalid
jl case.0x140002106.44
mov dh, 0x87
invalid
sti
out dx, eax
mov esi, dword [0x15641ff3a]
pop rsi
cli
jae 0x1400a0b7c
push rdx
movsb byte [rdi], byte [rsi]
cli
mov ah, ch
movabs dword [0x431f1b318695e038], eax
xchg ebp, eax
xchg byte [rcx], dh
sbb ebx, dword [rdi]
lodsb al, byte es:[rsi]
xchg ebp, eax
xchg byte [rcx], dh
sbb ebx, dword [rdi]
lodsb al, byte es:[rsi]
xor eax, 0x9ba4f1e0
mov cl, 0x68
cmp edi, dword [rbx - 0x57]
jbe 0x1400a0c01
stc
in al, 0x3f
invalid
or eax, 0x8ba03e8e
jrcxz case.0x140002106.47
invalid
invalid
invalid
invalid
invalid
call qword [rdi + rbx*4]
scasd eax, dword [rdi]
invalid
invalid
push rcx
xor byte [rbx], dh
and esi, esi
push r13
sbb eax, dword [0x17bb0fd08]
mov ecx, 0x7e0720cb
invalid
jle case.0x140002106.51
sbb dword [rcx + 0x42], edx
add dl, ch
invalid
invalid
mov ah, byte [rdx - 0x25]
mov ebp, 0xd857fe38
push rdi
sti
invalid
invalid
adc esi, dword [rdx + 0x47]
pop rsi
sub al, 0xd9
invalid
out dx, eax
invalid
push rdi
add edi, dword [rbp + 0xbec9c76]
invalid
invalid
adc eax, 0xef886f7f
mov ecx, 0xb56add2a
call 0x12f29e3a6
ror edi, 1
xor ch, al
je 0x1400a0d17
test eax, 0x61a38552
sbb al, 0x53
xchg dword [rdi + 0x642d4780], ecx
pop rsi
push rdx
test dword [rbx - 0x78ace39f], esp
pop qword [rax + 0x5e642d47]
push rsi
fsubr dword [rdi]
add al, 0x1d
mov bl, byte [rdi]
invalid
cmp eax, 0x747bfede
mov cl, 0x6f
invalid
std
pop rdx
adc eax, 0x68189c8c
mov ebx, 0x2f5f5e3d
invalid
movabs byte [0x3ae6b038f0d46d1c], al
adc eax, 0x1bc44fa4
cmp esi, ebx
nop
invalid
sbb dword [rbx + 0x14], esi
and eax, 0xea8bcdfb
sbb byte [rdx + 0x15], bl
add eax, 0x3b6d3da5
invalid
mov cl, 0x9f
out dx, eax
jp 0x1400a0d74
jmp qword [rsi]
fcmove st(0), st(5)
sub eax, 0x6dd29dfd
xchg edi, eax
outsb dx, byte [rsi]
cmp byte [rdi], dh
invalid
mov word [rsi - 4], fs
add al, 0xaa
sbb eax, 0xed6179ca
clc
jmp 0x1400a0de6
invalid
loop 0x1400a0dfa
add esi, dword [rsi - 0x77]
add dword [rax + 0x584d4389], eax
pop rcx
sub eax, 0x7246b8f9
jno 0x1400a0e34
mov edx, 0xf9ef87f0
xchg edi, ebp
stc
mov esi, 0xfdb66e7e
lodsd eax, dword [rsi]
invalid
invalid
fcmove st(0), st(4)
pop rcx
sahf
xchg ecx, eax
cmp eax, 0x393fa064
invalid
mov al, 0x63
and byte [rcx + 0x17fb1945], cl
stosd dword [rdi], eax
hlt
mov ecx, esi
mov word [0x1a84f12fe], gs
sub eax, 0x684504c1
sub eax, 0x684504c1
cmp al, 0x88
in eax, 0x5d
invalid
pop rax
push 0x64
add bl, bh
invalid
mov ecx, 0x4bfe5ff7
jo 0x1400a0eb0
retf
adc dword [0x1a6d55227], 0x4a
xor ecx, ebp
out dx, al
push rbx
imul esp, dword [rsi], 0x5adf6d96
xchg esi, eax
insd dword [rdi], dx
fistp word [rdx - 0x73]
xchg esi, eax
insd dword [rdi], dx
fistp word [rdx - 0x73]
retf
sar dl, 0x75
ret
pushfq
mov ebx, 0x14f2dfb9
in eax, 0x6b
js 0x1400a0f04
cmc
invalid
sub dword [rsi + rbx*8 - 0x72], edi
xlatb
jnp 0x1400a0eff
test qword [rsi], 0xffffffffd954565d
test dword [rsi], 0xd954565d
popfq
invalid
invalid
out dx, al
mov bl, 0x6c
cmp esi, dword [rsi]
xor bh, bh
xor eax, 0xa5ff6ff9
jmp [rdi - 0x5c]
lodsd eax, dword [rsi]
outsb dx, byte [rsi]
or bl, bh
mov edi, 0xbdae8edf
hlt
invalid
jp 0x1400a0efe
mov edi, edx
cli
je 0x1400a0efa
jbe 0x1400a0f03
jmp rsi
out 0x35, al
nop
outsb dx, byte [rsi]
stc
out dx, eax
je 0x1400a0f41
pop rbp
cmp dword [rbp - 0x7359eecf], ebp
jbe 0x1400a0ecf
out 0xef, eax
mov ds, word [rax]
test byte [rcx - 0x78fcc9df], dh
cli
invalid
sub r13b, byte [rcx + 0x7f]
invalid
std
ffreep st(0)
jmp 0x1400a0f29
out dx, eax
jb 0x1400a0efc
xchg dword [rbp + 0x249376d1], edi
retf
xchg esi, eax
xor al, 0xcc
push rsp
pop rax
jrcxz 0x1400a0f90
invalid
cmp eax, 0xe75bcaa1
imul edi, dword [rcx + 0x4e], 0x914ed98b
jl 0x1400a0f4c
movabs eax, dword [0x8b4e796940e75bca]
invalid
xor edi, 0xb65565ef
sti
in al, 0x72
or edi, dword [rsi + 0x72]
jno 0x1400a0fa8
invalid
cmp eax, eax
invalid
rcl ah, 0xaf
jmp 0x105e78a8c
fstp xword [rax]
mov ecx, 0x381c51f3
std
stosd dword [rdi], eax
insb byte [rdi], dx
invalid
fld dword [rdx + rbx*2]
cdq
rcr dword [rcx], 1
jp 0x1400a1003
leave
in eax, dx
invalid
xchg dl, ch
invalid
or eax, 0xff3fd327
mov bl, 0x93
shr dword [rdi], 0xf1
cdq
jbe 0x1400a0fa3
cmc
div byte [rbx + rcx*2 + 0x5a]
out 0xc3, eax
mov ebp, 0xc55c105c
jnp 0x1400a1037
invalid
invalid
push rdx
add byte [rsi + 0x57], dl
mov esi, 0x9b9db640
sbb byte [r10 + 0x5c8680c7], spl
add byte [rsi + 0x5bba205c], 0x27
fisubr word [rax]
add byte [rsi + 0x5bba205c], 0x27
fisubr word [rax]
retf
lea edi, [rdx + rdi*8]
scasb al, byte [rdi]
lea esi, [rax + 0x1a]
adc eax, 0x76530cfc
xchg edi, eax
xor edi, esi
sbb ebp, dword [rdi]
invalid
cli
pop gs
invalid
invalid
outsd dx, dword [rsi]
je 0x1400a0fd5
wait
mov esi, 0x2d61abf7
xchg edx, eax
push rsp
invalid
sub eax, 0xa50e5492
je 0x1400a1039
mov esi, 0xd6fd03f3
imul esp, dword [rsi - 0x2b], 0xffffff84
sbb byte [rdx + rbx*4], ah
and al, 0x9a
stosb byte [rdi], al
scasd eax, dword [rdi]
xchg edi, eax
mov ebx, 0x8d6b8360
xchg esp, eax
div eax
jnp 0x1400a10a9
outsd dx, dword [rsi]
xlatb
mov dl, 0xbd
cmc
invalid
adc byte [rbx - 0x3c], cl
movsd dword [rdi], dword [rsi]
invalid
div dh
movabs al, byte [0x120813d5f371dbe9]
and dword [rdx], ebp
invalid
imul esp, dword [rax + 0x76ff4d7e], 0x3d7f3d59
wait
mov dl, 0x74
or dword [rdx*8 - 0x4db9bff], 0xffffffd4
sti
invalid
sub eax, dword [rsi + rax*4 + 0x498372ed]
push rdx
call qword [rdi + 0x53b93e5c]
pop rsp
invalid
invalid
push rbx
invalid
sti
invalid
pop rsp
mov ecx, 0xa0b78253
in al, dx
or al, 0x7a
loope 0x1400a10cd
invalid
movsb byte [rdi], byte [rsi]
outsd dx, dword [rsi]
xchg edx, eax
add qword [rcx - 0x6d], r13
and byte [rax - 0x188d4669], al
adc dword cs:[rdi - 0x425b29fc], 0xffffff8a
adc dword [rdi - 0x425b29fc], 0xffffff8a
adc dword [rdi - 0x425b29fc], 0xffffff8a
mov ebx, 0x885579bf
and al, 0xb7
xchg edx, eax
adc bh, byte [rbx - 0x3d]
lea ebp, [rax + rdx + 0x5a]
pop rbp
insb byte [rdi], dx
adc byte [rdx + 0x5d], bl
ja 0x1400a114f
mov esi, 0xbf339d1d
out dx, al
jbe 0x1400a114a
xor edi, dword [rdi - 0x22128912]
xchg edi, eax
and eax, 0xd4ca8a88
xor edx, dword [rbx - 0x4adfd6af]
fst qword [rdi - 0x357577db]
invalid
in eax, 0x9f
lahf
imul ebx, dword [rcx - 0x12a5e83a], 0xc7397ce7
or eax, 0x16ffae9a
add al, 0xc1
add dword [rdi], esp
and eax, 0x660a6c8f
pop rax
invalid
scasd eax, dword [rdi]
cld
or eax, edx
invalid
cmp ecx, ebp
add eax, 0xed4df3ce
enter 0x4d0, 0x3c
push rbx
inc byte [rsi]
invalid
lahf
mov ebx, 0x411f2deb
fsub dword [rsi - 0x14]
imul ebp, esi, 0xffffffc1
mov word [rdx + 0x59399c01], ss
pushfq
cmp dword [rcx - 0x5f], ebx
je 0x1400a1225
invalid
ficom word [rbp + rbp + 0x4f]
invalid
invalid
pushfq
cmp dword [rcx - 0x5f], ebx
je 0x1400a1225
invalid
or ebx, esi
invalid
outsd dx, dword [rsi]
cmc
lodsb al, byte [rsi]
push rdi
adc cl, byte [rdi]
jae 0x1400a1191
invalid
invalid
in eax, dx
fucomp st(3)
invalid
int1
add al, dh
jnp 0x1400a1229
sbb al, 0xed
pop rdx
jge 0x1400a11e4
invalid
in al, dx
je 0x1400a127e
invalid
and esi, dword es:[rax]
and esi, dword [rax]
mov ebx, 0xeec43d93
xchg edi, eax
mov esp, 0x643cfd4e
xchg ebx, eax
cmp eax, 0xbc97eec4
std
cmp al, 0x64
je 0x1400a120a
add edx, 0xffffff86
push rbp
cmp esp, dword [rbx - 0x3155727]
and dh, al
fist dword [rsi + 0x3f]
fimul dword [0x117d26597]
invalid
clc
clc
stc
mov sil, 0x8a
sbb eax, 0xfb5a878e
rcr dword [rdi - 9], 1
or eax, 0xb3f0b7fb
out 0x55, eax
in eax, 0xd
or eax, 0x1bf3e57d
push rax
invalid
jge 0x1400a124d
sbb edx, dword [rax + 0x27]
jle 0x1400a1265
adc eax, 0xde7730ce
adc al, al
push rdx
lodsd eax, dword [rsi]
or eax, 0xab24e9a9
and al, 0xab
and al, 0xab
and ecx, edi
jmp 0x1b9733d97
invalid
pop rdi
invalid