Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
pop rsi
invalid
jnp 0x1400a07b2
push 0xffffffffffffffcb
sub dword [rbx], edi
sahf
rol dword [rsi], cl
test dword [rax], esp
stosd dword [rdi], eax
iretd
jge 0x1400a080f
loope 0x1400a081b
retf 0x733
sbb eax, 0x4840247d
sub al, 0x5a
adc dl, byte [rdx + 0x1b]
test byte [rdi + 0x49d1b4e0], 0xd
ror dword [rcx + 0xd], 1
ror dword [rcx + 0xd], 1
invalid
div dword [rcx + 0x5f]
in al, dx
add al, 0x69
invalid
std
dec byte [rdx]
invalid
imul edi, dword [0xdebaec04], 0xfffffff1
invalid
adc dh, byte [rdi + 0x7e067bf0]
jne 0x1400a0922
or al, 0xfc
jae 0x1400a0926
push rbx
sub eax, 0x8bf87e45
mov word [rbx], gs
sub edx, dword [rsi]
sub edx, dword [rsi]
and al, byte [rdx]
sub sil, dl
sub byte [rbp - 0x29770f9d], cl
mov ch, 0x7c
add esi, dword [rdi]
int 0x14
cmp byte [rdx + rbx*8 + 0x58], bh
invalid
stosb byte [rdi], al
invalid
sbb byte [0x1473ddca0], ch
sub eax, 0x733d3b9
add eax, 0xdf07b217
ret
invalid
mov esi, 0x4f7bffc2
mov esp, 0xaa87e858
cmp ebp, dword [rsi + 0x4f]
adc edi, dword [rdx - 0x61]
mov dl, byte [rbp + 0x16]
movabs al, byte [0x1afb7b5eabde7cf7]
xchg esi, eax
fstpnce st(2), st(0)
mov ebx, 0x17903eae
mov edi, 0x829da169
push 0x62
nop
invalid
imul esp, dword [rcx + 0x626a829d], 0x617675ac
jl 0x1400a08e1
lodsb al, byte [rsi]
jne 0x1400a09a5
invalid
or ecx, dword [rsi]
sbb al, 0x2d
xor byte [rbp - 0x20], cl
loopne 0x1400a09b2
movsd dword [rdi], dword [rsi]
loopne 0x1400a09b2
movsd dword [rdi], dword [rsi]
jp 0x1400a09b0
mov esi, 0x701a7acd
jg 0x1400a0958
movabs eax, dword [0xac5dd2444e11a708]
cmp al, 0x6f
invalid
jnp 0x1400a0991
cmp esp, dword [rbp - 0x3b]
je 0x1400a0966
or eax, 0x76cfe796
invalid
xchg esi, eax
out 0xcf, eax
jbe 0x1400a0964
invalid
invalid
adc ch, byte [rdi - 0x2c]
invalid
invalid
xlatb
xchg edi, eax
cmp bl, byte [rbx]
sbb ecx, dword [rdx]
test al, 0x22
fimul dword [rsi]
invalid
pop rdi
or dh, dh
add edi, dword [0x12d89e18f]
sbb ecx, dword [rdx]
test al, 0x22
fimul dword [rsi]
invalid
test byte [rbx], 0x3d
call rdi
jg 0x1400a097d
movsb byte [rdi], byte [rsi]
push rcx
cmpsb byte [rsi], byte [rdi]
xor dword [rcx], esi
int1
invalid
invalid
and eax, 0x1620aeab
add al, 0x91
mov ebp, dword [rdi]
invalid
invalid
push 0x73ff668d
invalid
lea esp, [rsi - 1]
jae 0x1400a09cd
mov word [rsi - 0x41], ds
movsb byte [rdi], byte [rsi]
pop rdi
cld
movabs dword [0x3a240efcb9a82661], eax
xchg esp, eax
invalid
std
insd dword [rdi], dx
jmp 0x1400a0989
invalid
in al, dx
sub cl, byte [rbp + 0x13d5df20]
cmp byte [rbp + 0xe], ch
jnp 0x1400a0a4e
cmp dword [rbp + 0x2cfa7f72], esi
push rax
invalid
loop 0x1400a09b1
sub edx, esp
adc bh, byte [rdi]
test byte [rcx], dh
sbb eax, dword [0x1be265836]
invalid
invalid
invalid
cmp bl, byte [r8 - 0x49]
adc dh, byte [rdx + rdi*8]
jle 0x1400a09c8
invalid
xchg edx, eax
out 0xbe, al
ret
jge 0x1400a09e9
mov ebp, 0x5465880f
add dh, byte [rcx + 0x55]
jno 0x1400a0a9b
cmovae eax, dword [rcx - 0x56]
adc dl, byte [rax + 0x64]
clc
invalid
sbb edi, dword [rdi - 0xd]
adc ebp, eax
mov ebp, 0x64db7e8
xchg ebx, eax
cmp edi, edi
stc
invalid
retf 0x8f2f
pop rcx
cmc
pushfq
jbe 0x1400a0ad6
int1
cli
sub eax, 0xa0567dc5
jp 0x1400a0a3c
invalid
invalid
invalid
outsb dx, byte [rsi]
invalid
jnp 0x1400a0add
std
in al, dx
js 0x1400a0af0
add byte [rbp + 0x7b], ch
wait
mov esp, 0xd6de46a6
repne lodsd eax, dword [rsi]
or eax, 0x8fdb88c6
mov dh, 0xca
js 0x1400a0b0c
xor edx, dword [rax]
js 0x1400a0af5
sub esi, dword [rsi + 0x4a]
movabs al, byte [0xdf8fa6730eb382c]
jae 0x1400a0ae4
invalid
jmp 0x1400a0b22
or eax, 0xeaeb733e
jmp 0x1400a0b14
jmp 0x1400a0ae4
invalid
popfq
std
std
iretd
invalid
test eax, 0xe3bbab95
mov esi, 0x2e6d126a
invalid
xchg ebp, eax
stosd dword [rdi], eax
mov ebx, 0x126abee3
insd dword [rdi], dx
invalid
jbe 0x1400a0b2a
invalid
movabs byte [0x9ddf1a8d41742e56], al
in eax, 0xbd
cld
push rsi
je 0x1400a0b6f
lea ebx, [rdx]
fistp word [rbp - 0x3421a0d]
jmp 0x1400a0b55
pop rdi
xlatb
adc al, 0x49
jnp 0x1400a0aea
mov cl, byte [rcx + 9]
jbe 0x1400a0bad
xchg ecx, eax
cmp al, 0xfc
jg 0x1400a0b53
dec dword [rbx + 0x50]
push r8
push rax
ror dword cs:[rbx - 0x3a017504], 7
cmp dword [rbp - 0x326d704b], esi
mov cl, 0xa1
invalid
test al, 0xe0
cmc
cmp dword [rsi + 0x38], esi
adc al, 0xc8
fst dword [edx - 0x1e]
jno 0x1400a0b17
enter 0xffffffffffffd967, 0x52
loop 0x1400a0be6
movabs eax, dword [0xab704f66e2257c31]
xor dword [rbp + riz - 0x1e], edi
jo 0x1400a0b29
jl 0x1400a0b9e
loop 0x1400a0be1
jo 0x1400a0b29
cli
push rsp
movabs byte [0x338d49f34a7dc439], al
jbe 0x1400a0bc7
cmp eax, 0x74f7f7db
je 0x1400a0bad
cmp eax, 0x7b4dc27d
invalid
loopne case.0x140002106.38
mov ecx, 0x6b83fb04
in eax, 0x39
pop rbp
sti
out dx, eax
mov esi, dword [0xfa9fafb7]
adc al, 0xc3
adc byte [rax - 0x481bfb7], bl
movsb byte [rdi], byte [rsi]
xchg ebp, eax
mov edx, 0x10c31448
cwde
jle 0x1400a0bb4
xchg edi, eax
and bl, byte [rsi + 0x3451e8c2]
ret 0x51e8
xor al, 0x3f
ret 0x51e8
invalid
jnp 0x1400a0b77
lea esp, [rdi]
outsb dx, byte [rsi]
jmp 0x13e6a0d02
inc byte [rax]
insb byte [rdi], dx
lodsb al, byte [rsi]
pop rdx
mov ecx, 0x96a712ec
xchg esi, eax
in al, dx
adc ah, byte [rdi - 0x4e0b886a]
xchg esi, eax
ja 0x1400a0bdb
mov cl, 0xf7
mov ebp, 0xc6667715
xchg esi, eax
ja 0x1400a0bdb
hlt
mov cl, 0xf7
mov ebp, 0xc6667715
push rdi
mov esi, 0xeb9e8316
xor edi, dword [rdx - 0x6d]
add bl, bh
invalid
sub al, 0x3f
jbe 0x1400a0bfb
invalid
jbe 0x1400a0bfb
mov ss, word [rsi + 0x4c]
mov dl, 0x8c
sub dword [rdi], eax
xchg ebp, eax
ja 0x1400a0c70
clc
mov ah, byte [rdx]
mov eax, dword [rbp + 0x57]
push r15
push r15
jge 0x1400a0c49
ja 0x1400a0b97
or edx, ebp
sbb dh, byte [rbx + rbp*2 + 0x286b2d44]
pop rbp
push rdx
jne 0x1400a0bfe
adc dl, byte [rax + 0x4a83fde9]
invalid
invalid
in ax, dx
in eax, dx
adc eax, 0x7a19a5de
invalid
enter 0x26e3, 0x5e
mov esp, 0x6e3f3cb6
sti
push rsp
cmp ebx, eax
imul r12d, dword [r9 + 0x7b7705a2], 0x205cf9d5
add eax, 0xf9d57b77
pop rsp
and byte [rsi], cl
stc
pop rsp
and byte [rsi], cl
cmpsb byte [rsi], byte [rdi]
rcr dword [rdx], 1
sbb byte [rax], bh
invalid
not byte [rdi + rdi*4]
cmp dword [rsi - 0x2719ee22], 0x36
inc byte [rax]
lahf
std
fldcw word [rbx - 0x7bf9c09e]
invalid
invalid
invalid
test byte [rdi + 0x2394450], bh
mov ah, 0x3e
invalid
invalid
out dx, eax
invalid
invalid
push r13
xchg ebx, eax
push 0x51
mov al, 0xc9
jmp 0x1400a0cbf
sbb byte [rcx - 0xa7b62e9], ah
lodsd eax, dword [rsi]
invalid
sub al, 0x8a
invalid
popfq
int3
add dh, byte [rbx + 0x46baa696]
ret 0xb196
invalid
adc ebp, edi
invalid
invalid
adc dword [rbx - 0x386806fe], ecx
jns 0x1400a0d38
nop
or eax, 0xcb63ce2c
imul esi, dword [0x1621a5193], 0x69a5c924
sti
xlatb
invalid
cmc
pop rsi
nop
fldenv [rbp + rax*8 + 0x7a]
sti
xchg edi, eax
stc
jle 0x1400a0d33
jge 0x1400a0de1
mov word [rsi], fs
invalid
jg 0x1400a0d2f
retf
fidivr word fs:[rbx + 0x7f]
in eax, 0x38
and eax, 0x994f2ea2
mov dl, 0xc5
hlt
xchg ecx, eax
test al, 0xe6
div dword [rsi - 0x6f]
shr dword [r15 + 0x4d], 1
and dword [rdx], esi
mov bl, 0x5d
invalid
add byte [rbx], dh
invalid
lea ebp, [rdx - 0x2d]
pop rdi
and dword [rcx], ecx
or esp, edi
cld
sub dword [rcx + 0xf], ecx
out 0x2e, eax
jrcxz 0x1400a0e1c
and edi, dword [0x16d437736]
jns 0x1400a0d8b
invalid
invalid
stosb byte [rdi], al
stc
call rcx
mov eax, dword [rbp + 0x4dba5d2f]
mov ecx, dword [rbp + 0x7f]
mov ecx, esi
invalid
fisubr word [rdi + 0x6e]
jb 0x1400a0d9d
xchg byte [rsi + 0x226f32a3], ch
add byte [0x1031f44ca], dl
stosd dword [rdi], eax
fild qword [rdi]
sbb eax, 0xcc0708ec
rcr byte [rdx + 0x5d], 1
int3
int 0x74
invalid
pop rcx
mov edi, 0x1e6969c3
mov esi, dword [rsi + 0xa]
invalid
lea edx, [rax + 0x1c]
push rax
fnstenv [rdi]
pop rsi
out dx, al
jge 0x1400a0ec6
invalid
mov ecx, 0x59fe5ff7
cmp dh, ch
fstpnce st(7), st(0)
xchg esp, eax
retf
cmp al, 0x7b
fcompi st(6)
ror byte [rbx], cl
invalid
ror bh, cl
fild dword [rax + rdx*2 + 0x260f593e]
sbb dword [rcx], ebp
fcom qword [0xfdbc12eb]
mov ebp, 0x9f3a93a8
and eax, 0xa70662ab
mov ebp, 0x9f3a93a8
and eax, 0xa70662ab
invalid
movsb byte [rdi], byte [rsi]
adc al, 0xf7
invalid
sal bl, 1
mov ebx, 0xf0b2537f
add byte [rcx], dh
loopne 0x1400a0e97
je 0x1400a0f11
xchg ebx, eax
fnstsw ax
loope 0x1400a0f23
pop bx
invalid
xor byte [rbx], ah
jmp 0x1becc78f2
jle 0x1400a0ed2
outsb dx, byte [rsi]
je 0x1400a0eee
sbb al, 0xf0
invalid
out dx, al
mov bl, 0xb6
invalid
invalid
sub edi, dword [rbp - 0x2e]
mov ch, byte [rsi]
xchg edi, eax
rol cl, 1
lahf
ror ebp, 1
xchg ebp, eax
invalid
invalid
invalid
jbe 0x1400a0f03
call [rcx]
retf 0xcc7c
sbb edx, ecx
jl 0x1400a0ed4
stc
out dx, eax
je 0x1400a0f04
mov bh, 0xfb
jbe 0x1400a0edf
invalid
xor esi, dword [rcx]
invalid
idiv edi
mov edi, 0x73230a8a
stosd dword [rdi], eax
pop rdi
mov ecx, 0x8c0913ee
invalid
or dword [rbp + rbx*8 - 0x68c78905], ecx
in eax, dx
jmp 0x1400a0f18
invalid
invalid
jnp case.0x140002106.85
int 0x68
rcl dword [rdi], 0xfb
invalid
fist dword [rdi + 0x4a37164b]
jo 0x1400a0f2f
mov rcx, dr0
mov dl, 0x62
pop rcx
invalid
add eax, 0x559d4218
shr byte [rcx], 0x12
invalid
fld dword [rdx + rbx*2]
cdq
in eax, dx
push rbx
jne 0x1400a1002
mov dh, 0x35
pop rdi
mov byte [rcx - 0x7f383c9a], dh
invalid
stosd dword [rdi], eax
invalid
in eax, dx
invalid
xchg ebp, eax
int3
nop
mov edx, 0x7967afb7
jrcxz 0x1400a1042
loop 0x1400a1002
sti
outsd dx, dword [rsi]
lodsb al, byte [rsi]
invalid
enter 0x4923, 0xffffffffffffff8f
or byte [rdx], bl
adc eax, 0xd9e2f7fc
je 0x1400a105f
je 0x1400a105f
fld dword [rbx + 0x74]
pop rcx
je 0x1400a105f
outsb dx, byte [rsi]
sbb ebx, eax
invalid
out 9, eax
sub eax, 0x2724fe
cmpsd dword [rsi], dword [rdi]
rcr byte [rsi - 0x7d], 1
shl dword [rdx + rcx*2], 0x52
add byte [rsi + 0x3b], bh
invalid
cmp byte [rcx], cl
cmpsb byte [rsi], byte [rdi]
lodsd eax, dword [rsi]
movabs eax, dword [0x450417acf35489c6]
jle 0x1400a1077
jle 0x1400a1077
retfq
retf
invalid
invalid
sub ch, byte [rdi + 0x62a076ff]
mov cl, 0xd8
cdq
cdq
invalid
std
stc
pop rbx
invalid
invalid
scasb al, byte [rdi]
invalid
scasb al, byte [rdi]
invalid
pop rbx
invalid
call qword [rbp + 0x28]
clc
outsb dx, byte [rsi]
cli
invalid
and al, 0xf9
orps xmm2, xmmword [rbp - 0x3dce37e6]
lea esi, [rdi + rbx*8]
xor al, 0xdf
xor al, 0xdf
cmp dword [rsi], edx
stosd dword [rdi], eax
jp 0x1400a10b2
scasd eax, dword [rdi]
sbb eax, 0x521d9c06
fdivr qword [rax]
cmp byte [rsi + rax*8], dl
cmp byte [rsi + rax*8], dl
sti
adc byte [rdi + 0x55], spl
popfq
scasb al, byte [rdi]
or ebx, dword ss:[rbp - 7]
out dx, eax
xchg edi, eax
invalid
adc dword [rsi], edx
movabs al, byte [0xdbcab55e771426e6]
and eax, 0xbc65e13a
enter 0xffffffffffffb885, 0xffffffffffffff9d
mov eax, 0xff7c519d
mov eax, 0xff7c519d
dec edi
sbb dword [rbx], eax
invalid
iretd
push rbp
invalid
invalid
invalid
invalid
sub al, 0x10
and al, 0xfc
add dh, byte [rbx + 0x7a68587e]
pop rax
push 0x7228357a
cmp al, ah
pop rax
push 0x7228357a
cmp al, ah
invalid
jns 0x1400a1215
push rbx
sbb eax, 0xe194917f
je case.0x140002106.120
jae 0x1400a1253
mov bh, 0x2c
clc
invalid
and bl, byte [rdx + 0x117d1a94]
out 0x39, al
push rbp
js 0x1400a11b8
in eax, 0x57
lea ecx, [rcx + 0x5d]
cdq
mov edi, 0x75ef4b68
push 0xffffffffad75ef4b
push 0xffffffffad75ef4b
out dx, eax
jne 0x1400a11b4
int 0xe4
mov dh, 0x1b
sub dword [rsi + rbx], 0x8224b891
sbb dword [rbx + rsi + 0x7f], 0x5b
jg 0x1400a1273
xor edi, dword [rdi + 0x5b]
jg 0x1400a1273
cmp bp, word [rdx + 0x57]
ret
fnstcw word [rsi + 0x7c]
push rax
mov ebp, 0xd916e31e
invalid
fcos
scasb al, byte [rdi]
sub ebx, esp
invalid
invalid
invalid
and dword [rbp + 0x64], eax
cmc
test eax, 0xf572ffc8
test al, 0x5b
test byte [rax], dh
add eax, ebp
movsxd r9, r13d
cwde
lahf
int1
invalid
xor bh, byte [rbx + 0x79]
sbb eax, 0xd0bbcbfa
or byte [rdx + 0xdf59c4f], al
sti
mov bh, 0xf0
rcl dword [rsi - 0x80e2575], 0x46
jno 0x1400a1203
cli
retf
jno 0x1400a1203
mov eax, cs
xor esi, dword [rdx + 0x64f69da8]
leave
cmpsb byte [rsi], byte [rdi]
jne 0x1400a123c
sbb qword [r9 + 0x54], 0x5c1ab21f
mov cl, 0x50
sbb bl, byte [rcx + rsi*4 + 0x50]
ja 0x1400a121f
sub esp, ebx
movabs al, byte [0x3b5aa0771ce2980a]
sbb al, 0x77
invalid
pop rdx
cmp ebx, dword [rsi]
sbb al, 0x77
movabs al, byte [0x59569a7dfe1e3b5a]
invalid
jge 0x1400a122b
push rsi
pop rcx
stc
shr dword [rsi + 0x7c], cl
je 0x1400a1293
mov fs, word [rax + 0x48]
invalid
pop rdi
invalid