Function at 0x12e008
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebp, ebp
mov r12, rcx
mov r13d, ebp
mov dword [rax - 0x78], ebp
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
lea r8d, [rbp + 1]
lea r9, [rsp + 0x20]
mov rcx, r12
mov dl, r8b
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rsi, rax
cmp rax, rbp
jne 0x12e05c
xor eax, eax
jmp 0x12e237
cmp dword [rax + 0xc], ebp
je 0x12e234
cmp r13d, ebp
jl 0x12e234
mov eax, dword [rsi]
cmp eax, ebp
jne 0x12e077
mov eax, dword [rsi + 0x10]
mov edx, dword [rsi + 0xc]
mov edi, eax
xor eax, eax
lea rcx, [rsp + 0x48]
add rdx, r12
mov word [rsp + 0x28], bp
add rdi, r12
mov qword [rsp + 0x2a], rax
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
mov word [rsp + 0x38], bp
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
mov word [rsp + 0x58], bp
mov qword [rsp + 0x5a], rax
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov word [rsp + 0x48], bp
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
mov r14d, ebp
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
cmp qword [rsp + 0x30], rbp
je 0x12e152
cmp word [rsp + 0x28], bp
jne 0x12e110
mov word [rsp + 0x3a], bp
mov word [rsp + 0x38], bp
mov qword [rsp + 0x40], rbp
jmp 0x12e152
movzx edx, word [rsp + 0x2a]
mov ecx, 1
mov r8d, 0x656e6f42
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
movzx ecx, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r11, rax
mov qword [rsp + 0x40], rax
movzx eax, word [rsp + 0x2a]
mov word [rsp + 0x38], cx
mov r8, rcx
mov rcx, r11
mov word [rsp + 0x3a], ax
call fcn.000135b0
lea rcx, [rsp + 0x28]
xor edx, edx
call fcn.000121c0
mov rbx, rax
cmp rax, rbp
je 0x12e2c4
mov r10d, 0x20b
movzx ecx, word [r15 + 0x18]
cmp cx, r10w
jne 0x12e180
mov rax, qword [rdi]
jmp 0x12e182
mov eax, dword [rdi]
cmp rax, rbp
je 0x12e211
cmp cx, r10w
jne 0x12e196
mov r8, qword [rdi]
jmp 0x12e199
mov r8d, dword [rdi]
cmp cx, r10w
jne 0x12e1a4
mov rdx, qword [rdi]
jmp 0x12e1a6
mov edx, dword [rdi]
cmp cx, r10w
mov eax, 0x80000000
movabs r9, 0x8000000000000000
cmove rax, r9
cmp rdx, rax
jae 0x12e1cd
lea rbp, [r8 + r12 + 2]
cmp byte [rbp], 0
jne 0x12e1dd
cmp cx, r10w
jne 0x12e1d8
mov rax, qword [rdi]
jmp 0x12e1da
mov eax, dword [rdi]
movzx ebp, ax
mov rcx, qword [rbx + 0x30]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
call fcn.00012434
mov r11, rax
test rax, rax
jne 0x12e255
mov rcx, rbp
call fcn.00012a04
xor ebp, ebp
mov r11, rax
cmp rax, rbp
jne 0x12e257
mov r13d, 0xc0000225
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
add rsi, 0x14
cmp dword [rsi + 0xc], ebp
jne 0x12e065
mov eax, r13d
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
mov r10d, 0x20b
cmp word [r15 + 0x18], r10w
jne 0x12e281
cmp dword [rsi + 0x10], ebp
je 0x12e278
mov eax, dword [rsi + 0x10]
mov ecx, r14d
add rax, r12
mov qword [rcx + rax], r11
jmp 0x12e29b
mov rax, qword [rdi]
mov qword [rax + r12], r11
jmp 0x12e29b
cmp dword [rsi + 0x10], ebp
je 0x12e295
mov eax, dword [rsi + 0x10]
mov ecx, r14d
add rax, r12
mov dword [rcx + rax], r11d
jmp 0x12e29b
mov eax, dword [rdi]
mov dword [rax + r12], r11d
cmp word [r15 + 0x18], r10w
mov ecx, 4
lea edx, [rcx + 4]
mov rax, rcx
cmove rax, rdx
add rdi, rax
cmp word [r15 + 0x18], r10w
mov eax, ecx
cmove eax, edx
add r14d, eax
jmp 0x12e170
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000225
jmp 0x12e237