Function at 0x18002baf0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14, rdx
mov r12, rcx
mov rax, qword [rdx]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002bd5f
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp dword [rsi], 0x4550
jne 0x18002bd5f
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x18002bb4b
mov eax, 0x1b5a
jmp 0x18002bd64
mov r13d, dword [rsi + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
mov r8d, r13d
mov rcx, r12
call fcn.180029620
mov r15, rax
test rbp, rbp
je 0x18002bd58
test rax, rax
je 0x18002bd58
mov r8d, dword [rsi + 0x54]
mov rdx, qword [r14]
mov rcx, rbp
call fcn.18010b710
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov edi, eax
cmp ax, word [rsi + 6]
jae 0x18002bbd2
add rbx, rsi
nop dword [rax]
mov ecx, dword [rbx - 4]
add rcx, rbp
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, qword [r14]
call fcn.18010b710
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [rsi + 6]
cmp edi, eax
jl 0x18002bbb0
mov rbx, r15
sub rbx, qword [rsi + 0x30]
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.180030a40
mov r10, qword [rax + 8]
mov r8, qword [rax]
xor edi, edi
cmp r8, r10
je 0x18002bc49
mov r11d, 0xfff
nop word [rax + rax]
mov eax, edi
cmp dword [r8 + 0x10], edi
jbe 0x18002bc40
nop dword [rax + rax]
mov edx, eax
mov rcx, qword [r8 + 8]
movzx r9d, word [rcx + rdx*2]
movzx ecx, r9w
shr cx, 0xc
and r9w, r11w
cmp cx, 0xa
jne 0x18002bc38
movzx edx, r9w
mov rcx, qword [r8]
add qword [rdx + rcx], rbx
inc eax
cmp eax, dword [r8 + 0x10]
jb 0x18002bc10
add r8, 0x18
cmp r8, r10
jne 0x18002bc00
lea rcx, [rsp + 0x40]
call fcn.18002bef0
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.180030b90
nop
mov rdx, rax
mov rcx, r12
call fcn.18002bd90
movzx ebx, al
lea rcx, [rsp + 0x40]
call fcn.18002be40
test bl, bl
jne 0x18002bc98
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1b5c
jmp 0x18002bd64
mov r9, r13
mov r8, rbp
mov rdx, r15
mov rcx, r12
call fcn.1800293f0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
test al, al
jne 0x18002bcc8
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1b5d
jmp 0x18002bd64
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, dword [rsi + 0x28]
add r8, r15
lea rdx, [rsp + 0xa8]
mov rcx, r12
call fcn.18002bfb0
test al, al
jne 0x18002bcf0
mov eax, 0x1b5e
jmp 0x18002bd64
mov eax, dword [rsi + 0x54]
test rax, rax
je 0x18002bd54
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0x30
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
jmp 0x18002bd64
mov eax, 0x1b5b
jmp 0x18002bd64
mov eax, 0x1b59
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret