Function at 0x1ae78
Capabilities:
Access pe header
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
xor eax, eax
mov rsi, r8
mov r13d, edx
mov rbx, rcx
mov dword [rsp + 0x54], 0x32
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x50], r15d
mov ebp, r15d
mov dword [r11 + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x1b318
mov edx, 0x1000
mov rcx, rbx
call fcn.0001a7f4
cmp eax, r15d
je 0x1b318
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1b318
lea r14d, [r15 + 4]
lea rcx, [rbx + 0x3c]
mov edx, r14d
call fcn.0001a7f4
cmp eax, r15d
je 0x1b318
movsxd rdi, dword [rbx + 0x3c]
mov edx, r14d
add rdi, rbx
mov rcx, rdi
call fcn.0001a7f4
cmp eax, r15d
je 0x1b318
cmp dword [rdi], 0x4550
jne 0x1b318
lea r12, [rdi + 0x28]
mov edx, r14d
mov rcx, r12
call fcn.0001a7f4
cmp eax, r15d
je 0x1b318
lea r8, [rsp + 0x50]
mov edx, r13d
mov rcx, rbx
call fcn.000182e4
mov edx, r13d
mov rcx, rbx
call fcn.00018498
cmp eax, r15d
je 0x1af97
lea r8, [rsp + 0xf8]
mov r9, rsi
mov edx, r13d
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.0001881c
mov ebp, dword [rsp + 0xf8]
mov r14d, 0x480
mov ecx, 1
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, r15
je 0x1b318
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov rdx, rdi
mov rcx, rbx
call fcn.0001a93c
cmp eax, r15d
je 0x1b018
cmp rsi, r15
je 0x1b2d6
mov rcx, rbx
call sub.ntoskrnl.exe_RtlImageNtHeader
cmp rax, r15
je 0x1b2d6
lea r8, [rsp + 0x54]
mov rdx, rsi
mov rcx, rbx
call fcn.00020238
cmp eax, r15d
je 0x1b2d6
mov rcx, rsi
call fcn.00021710
cmp eax, r15d
jne 0x1b2d6
cmp dword [rsp + 0x50], r15d
jne 0x1b2d6
cmp ebp, r15d
jne 0x1b2d6
mov eax, 0x208
mov qword [rdi], rbx
cmp word [rsi], ax
jae 0x1b04a
movzx r8d, word [rsi]
mov rdx, qword [rsi + 8]
lea rcx, [rdi + 0x38]
call fcn.00040300
lea rbp, [rdi + 0x24]
mov r14d, 0x14
lea r12, [rdi + 0x14]
mov r9, rbp
lea r8d, [r14 - 4]
cmp dword [0x000620c0], r15d
je 0x1b09e
lea rax, [rdi + 0x458]
lea rcx, [rdi + 0x450]
lea rdx, [rdi + 0x448]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.0001efcc
jmp 0x1b0b8
lea rax, [rsp + 0x40]
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call fcn.0001ed94
mov dword [rdi + 0x10], eax
cmp dword [0x000620c0], r15d
jne 0x1b185
cmp eax, r15d
je 0x1b18b
cmp dword [rsp + 0x44], r15d
je 0x1b185
cmp dword [rsp + 0x40], r15d
je 0x1b185
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.0001a874
cmp eax, r15d
je 0x1b185
mov eax, dword [rsp + 0x4c]
cmp eax, r15d
je 0x1b185
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x1b185
cmp eax, dword [rsp + 0x44]
jne 0x1b11b
cmp ecx, dword [rsp + 0x40]
je 0x1b185
mov dword [rdi + 0x10], r15d
cmp word [rsi], r15w
je 0x1b165
lea rdx, [0x000412a0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.0001f6e0
mov ecx, r15d
cmp ax, word [rsi]
setb cl
cmp ecx, 1
jne 0x1b168
cmp r13d, 0x100000
cmovb ecx, r15d
jmp 0x1b168
mov ecx, r15d
cmp ecx, r15d
je 0x1b185
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.0001c09c
lea rcx, [0x00062540]
call fcn.0001c310
cmp dword [rdi + 0x10], r15d
jne 0x1b1db
call fcn.00016038
cmp eax, r15d
je 0x1b1db
cmp word [0x000620a8], r15w
je 0x1b1db
call fcn.0001ad18
cmp eax, r15d
jne 0x1b1db
cmp dword [0x000620c0], r15d
jne 0x1b1db
mov rcx, rsi
call fcn.0001adf8
cmp eax, r15d
jne 0x1b1db
mov r9, rbp
mov r8d, 0x10
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.00025d90
mov dword [rdi + 0x10], eax
cmp rbx, qword [0x000620f8]
jne 0x1b2b7
lea rax, [0x000620ec]
lea r13, [0x00062108]
mov r9, rbp
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [0x00062100]
mov qword [rsp + 0x28], rax
mov r8d, 0x10
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.0001efcc
mov dword [rdi + 0x10], eax
cmp eax, r15d
je 0x1b2b7
cmp dword [0x000620c0], r15d
jne 0x1b2b7
lea rdx, [0x00040e60]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [0x000620ec]
mov rcx, qword [0x00062100]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x58]
mov r8, r13
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x70], 0x240
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r15
call fcn.00012aec
cmp eax, r15d
jge 0x1b2b7
mov edx, dword [0x000620ec]
mov rcx, qword [0x00062100]
lea r9, [rsp + 0x58]
mov r8, r13
call fcn.00025a50
mov r8, qword [0x00062130]
mov rdx, rdi
mov rcx, rbx
call fcn.0001d388
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1b318
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp rbx, qword [0x000620f8]
je 0x1b318
mov edi, dword [r12]
mov edx, 0x10
add rdi, rbx
mov rcx, rdi
call fcn.0001a7f4
cmp eax, r15d
je 0x1b318
lea rdx, [0x00061d10]
mov r8d, 3
mov rcx, rdi
call fcn.0001a728
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret