Function at 0x2a220
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor ebp, ebp
mov r13, r8
mov rbx, rcx
mov rdi, rdx
lea rcx, [rax - 0x68]
lea r8d, [rbp + 0x38]
xor edx, edx
mov r15d, ebp
mov r14, rbp
call fcn.000407c0
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x40], rbx
call fcn.0002a078
cmp eax, ebp
je 0x2a62f
mov edx, 0x4000
lea ebx, [rbp + 1]
mov r8d, 0x33363053
mov ecx, ebx
mov dword [rsp + 0x70], edx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x68], rax
cmp rax, rbp
je 0x2a651
lea r9, [rsp + 0x40]
lea r8d, [rbp + 0x40]
mov rdx, rdi
xor ecx, ecx
call fcn.0002a0c0
cmp eax, ebp
je 0x2a62f
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x2a62f
movsxd rcx, dword [rdi + 0x3c]
lea r9, [rsp + 0x40]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
call fcn.0002a0c0
cmp eax, ebp
je 0x2a62f
cmp dword [rsp + 0x30], 0x4550
jne 0x2a62f
movsxd rsi, dword [rdi + 0x3c]
lea r9, [rsp + 0x40]
lea r8d, [rbp + 0x14]
lea rcx, [rsi + 4]
mov rdx, rdi
call fcn.0002a0c0
cmp eax, ebp
je 0x2a62f
add rsi, 0x18
lea r9, [rsp + 0x40]
lea r8d, [rbp + 2]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.0002a0c0
cmp eax, ebp
je 0x2a62f
mov eax, 0x10b
cmp word [rsp + 0xb0], ax
jne 0x2a361
movzx eax, word [rdi + 0x10]
cmp ax, 0x78
jb 0x2a62f
mov ebp, 0xe0
jmp 0x2a38b
mov eax, 0x20b
cmp word [rsp + 0xb0], ax
jne 0x2a62f
mov ax, word [rdi + 0x10]
mov ecx, 0x88
cmp ax, cx
jb 0x2a62f
mov ebx, ebp
lea ebp, [rcx + 0x68]
mov r12w, word [rdi + 2]
movzx eax, ax
cmp eax, ebp
cmovb ebp, eax
test ebp, ebp
je 0x2a3b7
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call fcn.0002a0c0
test eax, eax
je 0x2a62d
lea eax, [rsi + 0x40]
mov dword [r13], eax
test ebx, ebx
je 0x2a3ed
lea eax, [rsi + 0x80]
mov dword [r13 + 4], eax
mov eax, dword [rdi + 0x80]
mov dword [r13 + 0xc], eax
mov eax, dword [rdi + 0x84]
mov dword [r13 + 0x14], eax
mov eax, dword [rdi + 0x40]
mov dword [r13 + 0x10], eax
mov rbx, qword [rdi + 0x70]
jmp 0x2a419
lea eax, [rsi + 0x90]
mov dword [r13 + 4], eax
mov eax, dword [rdi + 0x90]
mov dword [r13 + 0xc], eax
mov eax, dword [rdi + 0x94]
mov dword [r13 + 0x14], eax
mov eax, dword [rdi + 0x40]
mov dword [r13 + 0x10], eax
mov rbx, qword [rdi + 0x80]
mov eax, dword [r13 + 4]
mov qword [rsp + 0x38], rbx
add eax, 4
mov dword [r13 + 8], eax
mov eax, ebp
xor ebp, ebp
add rsi, rax
mov dword [r13 + 0x18], ebp
cmp ebx, ebp
je 0x2a625
mov eax, 0x333
mov word [rsp + 0xb0], ax
cmp r12w, ax
jbe 0x2a452
mov r12d, eax
mov eax, 0xffff
cmp r12w, ax
jne 0x2a461
lea r12d, [rax - 1]
movzx eax, r12w
mov ecx, 1
mov r8d, 0x33363053
lea ebp, [rax + rax*4]
shl ebp, 3
mov edx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
je 0x2a62d
test ebp, ebp
je 0x2a4ad
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
call fcn.0002a0c0
xor ebp, ebp
cmp eax, ebp
je 0x2a62f
jmp 0x2a4af
xor ebp, ebp
mov rcx, r14
movzx eax, bp
cmp bp, r12w
jae 0x2a4f0
mov edx, 1
cmp ebx, dword [rcx + 0xc]
jb 0x2a4d2
add ax, dx
add rcx, 0x28
cmp ax, r12w
jb 0x2a4c0
cmp ax, bp
je 0x2a4f0
sub ebx, dword [rcx - 0x1c]
mov eax, dword [rsp + 0x3c]
lea edx, [rbx + rax]
cmp edx, dword [rcx - 0x20]
ja 0x2a4f0
cmp edx, dword [rcx - 0x18]
ja 0x2a4f0
add ebx, dword [rcx - 0x14]
jmp 0x2a4f2
mov ebx, ebp
cmp ebx, ebp
je 0x2a625
lea rax, [rsp + 0x40]
mov esi, 0x8000
mov r8, rdi
mov edx, 0xa
mov ecx, ebx
mov r9d, esi
mov qword [rsp + 0x20], rax
call fcn.0002a67c
cmp rax, rbp
je 0x2a625
mov ecx, dword [rax + 4]
bt ecx, 0x1f
jae 0x2a625
btr ecx, 0x1f
lea rax, [rsp + 0x40]
mov r9d, esi
mov r8, rdi
mov edx, 0x360
add ecx, ebx
mov qword [rsp + 0x20], rax
call fcn.0002a67c
cmp rax, rbp
je 0x2a625
mov ecx, dword [rax + 4]
bt ecx, 0x1f
jae 0x2a625
btr ecx, 0x1f
lea rax, [rsp + 0x40]
mov r9d, esi
mov r8, rdi
xor edx, edx
add ecx, ebx
mov qword [rsp + 0x20], rax
call fcn.0002a67c
cmp rax, rbp
je 0x2a625
mov eax, dword [rax + 4]
bt eax, 0x1f
jb 0x2a625
lea ecx, [rbx + rax]
lea r9, [rsp + 0x40]
mov r8d, 0x10
mov rdx, rdi
call fcn.0002a0c0
cmp eax, ebp
je 0x2a62f
mov r10d, 0x80
cmp dword [rdi + 4], r10d
jne 0x2a625
mov ecx, dword [rdi]
mov rax, r14
movzx edx, bp
cmp bp, r12w
jae 0x2a606
lea r8d, [r10 - 0x7f]
cmp ecx, dword [rax + 0xc]
jb 0x2a5e5
add dx, r8w
add rax, 0x28
cmp dx, r12w
jb 0x2a5d2
cmp dx, bp
je 0x2a606
sub ecx, dword [rax - 0x1c]
lea edx, [rcx + 0x80]
cmp edx, dword [rax - 0x20]
ja 0x2a606
cmp edx, dword [rax - 0x18]
ja 0x2a606
mov eax, dword [rax - 0x14]
lea r8d, [rcx + rax]
jmp 0x2a609
mov r8d, ebp
mov ecx, r8d
lea rdx, [r13 + 0x1c]
lea r9, [rsp + 0x40]
mov r8d, r10d
call fcn.0002a0c0
cmp eax, ebp
je 0x2a62f
mov dword [r13 + 0x18], ebx
mov r15d, 1
jmp 0x2a62f
xor ebp, ebp
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x2a641
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r14, rbp
je 0x2a651
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x80]
mov eax, r15d
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret