Function at 0x140001f80
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test rcx, rcx
je 0x140002094
mov rsi, rcx
call fcn.140002130
test al, al
je 0x14000209d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 2
jb 0x140002094
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
add rax, 1
cmp rax, 2
jb 0x140002083
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000207a
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne case.default.0x14000208d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne case.default.0x14000208d
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x20b
jne case.default.0x14000208d
mov edx, dword [rbx + rax + 0x50]
cmp rdx, 0x148
jb case.default.0x14000208d
mov rcx, rbx
call fcn.140002180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp 0x1400020b0
push rsi
sub rsp, 0x40
test rcx, rcx
je case.default.0x140002106
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400020f3
add rsp, 0x40
pop rsi
ret
mov rsi, rax
mov rcx, rax
call fcn.140001e70
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
ret
jp 0x1400a082a
invalid
cmpsb byte [rsi], byte [rdi]
mov ch, 0x52
push rdx
int1
invalid
movabs byte [0x23af6d3695e0036], al
sal esi, cl
cmp al, byte [rdx]
add dh, bl
mov dword [rax + 0x19], edx
mov dword [rax + 0x19], edx
psraw mm4, mm6
loope 0x1400a0824
jg 0x1400a0833
cmc
or dword [rsi + 0xaeab9c7], esi
mov eax, 0x71b086b4
jno 0x1400a0828
jno 0x1400a0828
invalid
mov ecx, dword [rcx + 0x480a04b3]
invalid
mov bl, 4
or cl, byte [rax - 0x10]
jp 0x1400a080d
stosb byte [rdi], al
stosb byte [rdi], al
jg 0x1400a0836
jle 0x1400a085c
cli
sbb dl, byte [rax - 0x3c]
imul esi, dword [rbx - 0x55], 0xffffffcf
movabs eax, dword [0x7d9005dc46717c01]
nop
jge 0x1400a0876
std
std
dec byte [rdx]
invalid
test al, 0x35
mov esp, 0xab982db4
cmc
jo 0x1400a0876
jo 0x1400a08f0
pop rbp
test eax, 0xfe89d9bf
mov edx, 0xeefe74e9
adc edi, dword [0x1b67562a3]
pop rdx
invalid
invalid
pop rdx
imul esi, dword [rsi - 0x36], 0xffffffe5
retf
retf 0xcbe5
jne 0x1400a08a3
mov dword [rbx - 0x6067e95], edi
loopne 0x1400a092a
fst qword [rcx*8 + 0x4c7352ed]
push rdx
jae 0x1400a0903
imul edi, dword [rbx - 0x72], 0x7d
int1
mov cl, 0xa
add byte [rax], al
jo case.0x140002106.13
sbb al, byte [rdx]
push rdx
push rdx
js 0x1400a085a
adc al, 0x38
jl 0x1400a08a6
fld qword [rcx - 2]
fstp xword [rbx + 0x17]
sar dword [rdi - 0x655f71be], cl
adc dword [rdi], esp
mov ah, 0xed
cli
idiv esi
jmp 0x113e58c85
rcl dword [rdi + 0x7d466b66], cl
cdq
jge case.0x140002106.13
cdq
std
sbb eax, 0x8feeedd3
invalid
in eax, dx
out dx, al
invalid
imul edx, dword [rdi + 0x78], 0xffffffb8
push rdx
sbb eax, 0x67fd6972
or cl, ah
mov eax, 0x69721d52
std
or cl, ah
add bl, ah
push rcx
invalid
invalid
invalid
in al, dx
lea ebx, [rcx + 0x8febf97]
std
je 0x1400a08e5
cdq
xchg edi, eax
mov edi, 0x74fd08fe
mov cl, 0xb8
test al, 0x63
rcl byte [rdi - 0xb81e353], cl
sbb al, 0x7e
hlt
stosd dword [rdi], eax
pop rbp
mov esp, 0x7c3f7b02
lahf
test al, 0x98
and dword [rdi], edx
cmp eax, 0xce12d43f
jl 0x1400a092b
mov eax, 0x97d263a8
lodsd eax, dword [rsi]
sbb al, 0x7e
hlt
adc eax, 0x97abc9aa
leave
stosd dword [rdi], eax
xchg edi, eax
rol eax, 0xad
invalid
scasb al, byte [rdi]
sbb ebx, dword [rdx + 0x1817a293]
or al, 0x66
adc dword [rdx + rbx*8 + 0x26e7f33c], edi
movabs dword [0x6d70c83efdd1d7d8], eax
pushfq
cmp byte [rdi - 0x6c], dl
invalid
invalid
cwde
add eax, 0x7fdf3a2e
jb 0x1400a091e
invalid
js 0x1400a09ce
stosb byte [rdi], al
cld
invalid
push 0xffffffffb41ffd7e
invalid
jle 0x1400a09b9
invalid
mov esp, 0x1067e3aa
pop rsi
xor dword [rdi + 0x22], esp
adc al, 0xd9
jrcxz 0x1400a0a39
adc byte [rsi + 0x31], bl
and dl, byte [ecx + ebx*8]
mov ebx, edx
adc dword [rdi], 0x61
mov edi, 0x675f6cfc
rdpmc
pop rdi
rdpmc
popfq
invalid
mov edi, 0x648a62cb
adc al, 0x74
adc al, 0x74
jg 0x1400a09e1
jle 0x1400a09e1
jg 0x1400a09d5
or dword [rax], ebx
jmp 0x1400a09e8
invalid
invalid
test dword [rdx - 0x2f50e949], ecx
lea edi, [rsp + rdi*2 + 0x140f8599]
xchg esp, eax
add al, 0xef
or cl, al
enter 0xffffffffffff9c64, 0x59
invalid
enter 0xffffffffffff9c64, 0x59
js 0x1400a0a9b
xor dword [rax + 0x7b], esp
or dword [0x1b5868f00], edi
invalid
jl 0x1400a0ab0
or eax, 0x345ed0ac
or byte [rdx], 0xff
pop rsi
call 0x166c468bc
jns 0x1400a0a99
outsb dx, byte [rsi]
js 0x1400a0a1b
invalid
cmp byte [rdx - 0x61471e03], ch
sahf
add al, byte [rbp + rbx - 0xb]
jl 0x1400a0ab8
invalid
adc al, 0xe1
test dword [rsp + rdx], edx
loope 0x1400a0a09
adc al, 0x14
invalid
invalid
movabs eax, dword [0xdc21c979fa0edf01]
fisttp word [rsi]
cli
jns 0x1400a0a69
and esp, ebx
mov cl, byte [rdx - 0x26]
invalid
mov bh, 0x87
ror ch, 0x9e
hlt
cmp edi, edi
invalid
jmp case.0x140002106.37
cmp dh, byte [rdi + 0x2fe6607c]
movabs al, byte [0x5c8d55fc7eb95ba4]
jns 0x1400a0b17
movabs byte [0x3596dc31b59e55ee], al
je 0x1400a0a81
xor esp, ebx
xchg esi, eax
xor eax, 0x77c88374
cmp bh, byte [rbx + 0x7ea51a63]
mov fs, rsi
xchg edi, eax
std
std
cmp eax, 0x8251df36
push rbp
or dword [rcx], esp
and dh, byte [rdi + 0x7ecfc220]
and dl, al
iretd
jle 0x1400a0b08
jbe 0x1400a0b52
enter 0x3a77, 0xffffffffffffffbb
invalid
and dl, al
iretd
ret 0x7ecf
out dx, eax
invalid
jmp 0x1400a0b55
adc al, 0x43
movsd dword [rdi], dword [rsi]
and al, 0xf9
xchg ebp, eax
xor eax, 0x9d495e45
invalid
add byte [rdi + rdx*2], bl
push rdi
cmp bl, byte [rsi + 0x1d]
xchg edi, eax
push rcx
rcr byte [rax + rdx - 0x21], 0xf
pop rsp
in eax, dx
mov ch, bh
pop rbp
or eax, 0x3d95ff0e
xchg ebp, eax
invalid
jmp 0x1400a0b6b
xchg ebp, eax
cmp eax, 0x79cbffeb
cmpsd dword [rsi], dword [rdi]
dec ebx
jns case.0x140002106.35
add al, 0xdf
lodsb al, byte [rsi]
test al, 0x14
xchg esp, eax
invalid
and dh, dh
rol dword [rdi + 0x19], 0x79
jo 0x1400a0b58
invalid
invalid
and al, 0x68
and eax, esi
loopne 0x1400a0bea
invalid
sti
out dx, eax
mov esi, dword [0x12bef324e]
mov dl, 0x2f
enter 0x5d76, 0xffffffffffffffa9
pop rdi
jno 0x1400a0bb4
pop rbp
test eax, 0x97fb715f
xchg edi, eax
and bl, byte [rsi + 0x7479b5be]
in eax, dx
mov esi, 0xed7479b5
sub dword [rsi - 0x577a0f01], eax
adc al, 0x65
mov ebp, 0xf00a63ad
fsubr qword [rax]
invalid
invalid
mov bh, byte [rdi]
invalid
push 0xffffffffffffffaa
lahf
invalid
cdq
fst st(3)
and ah, byte [rdi + 0x48]
mov esi, 0x899e8316
clc
cmp eax, 0x40432a1b
add esi, esp
hlt
sbb ebp, dword [rdx]
add esi, esp
hlt
hlt
cmp byte [rcx + 0xa], bh
fisttp dword [rbx - 0x74750077]
invalid
sub eax, 0x17af9f04
jns 0x1400a0bd9
jle 0x1400a0bdb
jge 0x1400a0c99
jg 0x1400a0b9e
cmp dword [rbp + 0x6c], 0xffffffd8
jge 0x1400a0c89
fdiv st(3)
mov ah, 0xe2
mov ah, 0xe2
movsb byte [rdi], byte [rsi]
jmp 0x1400a0c3b
jg 0x1400a0c00
invalid
nop
fidivr word [rbp + 0x3f]
jg 0x1400a0c37
and eax, 0x568e331f
adc dh, al
add byte [rbx + rdx*4], al
xchg ebx, eax
adc dword [rsi + 0x36], edi
test edi, 0x92c2ec7b
xchg dword [rdi + rbp*4 + 0x45], eax
and cl, byte [rsi]
sbb dword [rbx - 0x26], 0x4825c504
mov esi, dword [rbx]
mov dh, byte [0x12495cb7f]
jne 0x1400a0bf7
push rdi
cli
push rax
loope 0x1400a0c19
pushfq
add al, 0x13
xchg edx, eax
and byte [rsi], 0xe8
cmp dh, bh
push rdi
fcom dword [rdi - 5]
push rdi
sti
invalid
out dx, eax
cmp dword [rsi + rbx*8], 0x55
xchg esp, eax
fidiv dword [rcx + 0x3b9e3045]
jmp 0xffca20b9
invalid
mov cl, 0x45
xor byte [rsi + 0x1426e93b], bl
sar byte [rdi - 0xc02ac6e], 0x8b
mov edi, 0xf3fd5392
mov edx, dword [0x1117a009b]
mov edi, 0xf3fd5392
mov edx, dword [0x1117a009b]
invalid
wait
sub esi, ebx
add byte [rdi], 0x4c
ja 0x1400a0c3e
invalid
cmpsb byte [rsi], byte [rdi]
sub bh, 0x7f
shr byte [rax], 0xe6
xlatb
adc ebx, dword [rbp - 0x16cf65a6]
cmp qword [r15], r10
pop rdx
add dword es:[rdi], eax
xchg edi, eax
mov eax, 0xeff7e929
sub ecx, ebp
imul edi
sub ecx, ebp
imul edi
movabs al, byte [0xff5f35fdf6b0f9cb]
xchg ebp, eax
dec byte [rbx + 0x6e3e97e6]
sbb byte [rsi + rdx*2], al
xchg edi, eax
mov esp, dword [rax - 0x12]
mov ch, 0x9f
lahf
lahf
pop rbp
sbb dword [rbp - 0x24e0f2ea], 0x778ff79f
in al, dx
out 0xc9, eax
pcmpeqd mm0, qword [rax]
jbe 0x1400a0cee
jbe 0x1400a0cee
pop rsp
invalid
invalid
invalid
invalid
push rbp
invalid
jno case.0x140002106.60
stosd dword [rdi], eax
outsd dx, dword [rsi]
loope 0x1400a0d46
jnp case.0x140002106.63
jge 0x1400a0d42
movabs al, byte [0x996d54c2898e6659]
cdq
push rcx
pop rsi
imul ecx, dword [r15], 0x21
hlt
loop 0x1400a0d42
invalid
hlt
invalid
int3
jg 0x1400a0e50
pop rbp
int 0xd5
mov ebx, 0x8aea631e
in al, dx
outsb dx, byte [rsi]
iretd
xchg edi, ebp
stc
mov esi, 0xae19965
js 0x1400a0de0
pop rax
xor al, 0x75
test dword [rax - 0x75], 0xde7ff243
fisubr word [rdi + 0x6e]
jb 0x1400a0dec
mov ecx, 0x393f810c
invalid
enter 0x5005, 0x28
loop 0x1400a0e9e
invalid
test byte [0x15321bd2f], bl
fbstp tbyte [rcx + 0x6865b83e]
jno 0x1400a0e71
scasb al, byte [rdi]
invalid
adc ebx, edi
mov cl, 0x3e
mov eax, 0x714d6865
invalid
xor ecx, dword [rsi - 0x70]
idiv byte [rsi - 0x59]
xchg ebp, eax
mov edi, 0x1ec63efe
invalid
invalid
invalid
invalid
shl dword [0x1ba0eb3a4], cl
invalid
push rax
movsd dword [rdi], dword [rsi]
add al, 0x7a
jne 0x1400a0eb3
iretd
jmp 0x1bafd104d
add al, byte [rbx]
nop
invalid
sub byte [rsi + 0x75d690b0], cl
or qword [rax], r15
or dword [rax], edi
or dword [rax], edi
push rax
mov ecx, 0xc916f01d
scasd eax, dword [rdi]
or dword [rax], 0xfffffff4
shr byte [rdx + 0x4d], cl
and eax, 0x9eccf7fe
or byte [rbx], 0xa6
invalid
invalid
jnp 0x1400a0e33
invalid
push 0xffffffffd78ede9f
jnp 0x1400a0f2a
jb 0x1400a0e36
fsub qword [rdi - 0x629506db]
push 0xffffffffffffff9d
invalid
lahf
jno 0x1400a0eb7
invalid
xor al, 0xf7
invalid
push rbp
ror byte [rbp - 0x54], 1
hlt
cmp dword [0x1a5c47581], ebp
pop rsp
dec byte [rcx + rbx*2]
stc
invalid
adc qword [rdx - 0x63], rsp
xchg ebp, eax
int1
stc
out dx, eax
je 0x1400a0ef0
jnp 0x1400a0ef0
stosb byte [rdi], al
jo 0x1400a0f7d
mov dword [rdx], esp
imul edx, dword [rsi + 0x9477038], 0xffffffde
ficomp word [rdi + 3]
cmc
ficomp word [rdi + 3]
cmc
sar bl, 1
invalid
and ch, byte [rdx]
invalid
rcr sil, cl
mov r9d, 0x93436c6a
cmp byte [rdi + 0x3be4ebed], dl
in al, 0x3b
in al, 0x3b
adc cl, byte [rsi + 0x35]
invalid
add al, 0x1d
rol dword [rdx - 0x7f], 1
shl dword [rdi], cl
jg 0x1400a0f66
sbb eax, 0xab348776
jmp 0x1400a0ee3
sahf
push 0xffffffffdfc1dba3
retf
fbstp tbyte [rbx + rdi*8]
outsd dx, dword [rsi]
invalid
mov dh, 0x66
stosb byte [rdi], al
and al, 0x26
xchg edi, eax
cwde
jnp 0x1400a0f25
pop r11
invalid
fld dword [rdx + rbx*2]
cdq
sbb esp, dword [rbp + 0xf]
or bl, bh
xchg edi, eax
fisttp word [rsi + 0x138204ff]
adc al, 0xf7
jb 0x1400a1005
adc eax, 0xe80de5d8
invalid
jg 0x1400a0ffb
enter 0x545a, 0x40
invalid
outsd dx, dword [rsi]
mov edi, 0x4e4c8abe
xchg byte [rsi - 0x10200c1], bl
invalid
sti
mov al, 0x13
cmp esi, dword [rcx + 0xd431047]
sti
outsd dx, dword [rsi]
lodsb al, byte [rsi]
invalid
mov ebp, dword [rdx + 0x2737aee1]
sal ebp, 1
sbb cl, byte [0x1ae060f76]
invalid
invalid
jb 0x1400a1001
sti
jg 0x1400a1006
or eax, 0x4fcbae83
push rbx
insd dword [rdi], dx
and byte [rbx - 0x1b89660b], dh
out 0xb8, al
add edi, ecx
stc
stc
adc dword [rax], 0x60
invalid
push rsi
int 0x95
fst dword [rax]
wait
xor dword [rbx + riz + 0x47ff0517], 0x930a24a9
test eax, 0xe930a24
test eax, 0xe930a24
rol bl, cl
invalid
std
xor al, 0x94
stosd dword [rdi], eax
and byte [rcx], cl
retf
sar byte [rdi], 0x1a
mov ebp, 0xffaf45fc
out dx, al
invalid
movsb byte [rdi], byte [rsi]
jns 0x1400a10e6
movq mm3, qword [rdi + 0x4b]
and al, byte [rdx + 0x42]
invalid
or eax, 0xe098673e
outsd dx, dword [rsi]
invalid
in al, dx
invalid
movabs byte [0x7c414d631a0de75e], al
sub al, 0x77
scasd eax, dword [rdi]
adc al, byte [rsi + 0x12733a0c]
jae case.0x140002106.107
or esp, dword [r14 + 0x2f2ace91]
jp 0x1400a10ad
sbb eax, 0x6cf782fa
and rax, 0x5d174c16
invalid
pop rbp
or cl, dh
or eax, 0xed640e6f
cmp ebp, dword [rcx + 0x7e]
invalid
invalid
test dword [rdi - 0xa], ecx
invalid
int1
mov edx, dword [rax + 0x11b60f7c]
mov dl, 0xe4
push rbx
xchg ecx, eax
out dx, eax
lahf
sti
stosb byte [rdi], al
invalid
jp 0x1400a10f2
push rdi
stc
xor ebx, dword [rsi]
mov esi, 0x61e9c867
sar dword [rcx + 0x5c], 0x2c
invalid
movabs r9, 0x5466167c03e876a6
mov ch, 0x94
invalid
bnd je 0x1400a1154
jp 0x1400a11cb
clc
sahf
out 0x57, eax
hlt
invalid
and byte [rbx + 0x1d], dl
adc eax, 0x72de63cd
adc dh, byte [rbx]
jge 0x1400a11fc
sbb eax, 0xde63cd15
jb 0x1400a11bb
xor edi, dword [rbp + 0x50]
outsd dx, dword [rsi]
cli
mov edi, 0xdf75b417
mov ah, 0x75
invalid
sti
mov ah, 0x75
fbld tbyte [rbx + rdi*8 - 0x4a]
out dx, eax
sti
mov dh, 0xef
sbb byte [rdi + 0x1f38df17], ch
cmp byte [rdi], bl
sbb edx, dword [rdx - 0x5a]
nop
pop rdx
cld
retf
scasb al, byte [rdi]
invalid
in al, 0x3f
mov ebp, 0xca9f2f
pop rax
invalid
outsb dx, byte [rsi]
adc al, byte [rsi - 0x56]
jnp 0x1400a11a0
xor eax, 0x8a2a2f9d
cmp byte [rdi], dl
invalid
invalid
imul ebp, ecx, 0xffffff8a
cld
mov al, pe_nt_image_headers64
adc byte [rdi], 0xef
jne 0x1400a11b4
int 0x33
invalid
jb 0x1400a11a2
invalid
invalid
wait
pop rax
push rdx
sar dword [rax - 0x4d], cl
sbb al, 0x49
test eax, 0x1603755a
invalid
out dx, eax
jmp 0x1400a12ac
hlt
loop 0x1400a124a
movabs al, byte [0x8aed54579fce57cc]
invalid
lahf
push rdi
push rsp
in eax, dx
mov bh, dh
pop rdi
loope 0x1400a1260
mov ecx, 0xcefa17af
mov ecx, 0x8277d472
mov cl, 3
jnp 0x1400a126c
out dx, eax
out dx, eax
call qword [rdi - 0x7bd4872b]
or byte [rdi + 0x7a], bh
invalid
test ah, cl
add al, 0xed
cli
sub eax, 0xfddd12e7
sub eax, 0xfddd12e7
sbb eax, 0x56182931
je 0x1400a1293
mov fs, word [rax - 0x59]
femms
femms
femms
cmp al, 0xe0
xor eax, 0x962f7135
invalid
invalid