Function at 0x36be8
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f8
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov r15, qword [rsp + 0x360]
xor ebp, ebp
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
mov edi, ebp
mov esi, ebp
mov r14, r8
mov qword [rsp + 0x68], rdx
mov r13, rcx
mov ebx, 0xc0000001
cmp rcx, 0xffffffffffffffff
je 0x36f42
lea rdx, [rsp + 0x50]
call fcn.00034ee4
mov ecx, eax
mov ebx, eax
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
je 0x36f42
mov eax, 0x1000
cmp qword [rsp + 0x50], rax
jl 0x36f42
mov r8d, 0x6c616e41
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
cmp rax, rbp
je 0x36f42
mov ebx, 0x1000
xor edx, edx
mov rcx, rax
mov r8, rbx
call fcn.00091d10
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edx, 0xc0000000
mov ebx, eax
and eax, edx
cmp eax, edx
je 0x36f34
cmp ebx, 0x103
je 0x36f34
mov eax, 0x5a4d
mov ebx, 0xc0000001
cmp word [r12], ax
jne 0x36d44
movsxd rax, dword [r12 + 0x3c]
add rax, r12
cmp dword [rax], 0x4550
jne 0x36d44
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x36d2b
mov esi, dword [rax + 0xa8]
mov edi, dword [rax + 0xac]
jmp 0x36d42
mov ecx, 0x10b
cmp word [rax + 0x18], cx
jne 0x36d44
mov esi, dword [rax + 0x98]
mov edi, dword [rax + 0x9c]
mov ebx, ebp
mov eax, ebx
and eax, edx
cmp eax, edx
je 0x36f34
cmp edi, ebp
je 0x36f34
mov eax, esi
mov r8d, 0x6c616e41
mov edx, edi
xor ecx, ecx
mov ebp, edi
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x36f34
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00091d10
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov r13d, 0xc0000000
mov ebx, eax
and eax, r13d
cmp eax, r13d
je 0x36f26
mov ebx, 0x12c
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, rbx
call fcn.00091d10
lea rcx, [rsp + 0x1b0]
mov r8, rbx
xor edx, edx
call fcn.00091d10
xor ebp, ebp
cmp edi, 0xc
jb 0x36ea2
mov eax, 0x200
cmp word [rsi + 4], ax
je 0x36e1b
mov ebx, 0xc0000428
jmp 0x36eba
cmp word [rsi + 6], 2
jne 0x36e11
cmp dword [rsi], 8
jbe 0x36e11
cmp dword [rsi], edi
ja 0x36e11
mov edx, 0x84
xor ecx, ecx
mov r8d, 0x6c616e41
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
jne 0x36e4d
mov ebx, 0xc000009a
jmp 0x36ea7
xor edx, edx
mov r8d, 0x84
mov rcx, rax
call fcn.00091d10
and dword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x1b0]
mov dword [rsp + 0x30], ebx
lea edx, [rdi - 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsi + 8]
lea r9, [rsp + 0x80]
mov r8, rbp
mov dword [rsp + 0x20], ebx
call fcn.0004290c
mov ebx, eax
and eax, r13d
cmp eax, r13d
je 0x36ea7
xor ebx, ebx
jmp 0x36ea7
mov ebx, 0xc0000428
test rbp, rbp
je 0x36eba
mov edx, 0x6c616e41
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
and eax, r13d
cmp eax, r13d
je 0x36f26
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x50], 0x12c
call fcn.00036a94
test rax, rax
je 0x36f26
test r14, r14
je 0x36ef4
mov eax, dword [rsp + 0x50]
mov dword [r14], eax
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x1b0]
mov dword [rsp + 0x50], 0x12c
call fcn.00036a94
test rax, rax
je 0x36f26
test r14, r14
je 0x36f24
mov eax, dword [rsp + 0x50]
mov dword [r15], eax
xor ebx, ebx
mov edx, 0x6c616e41
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, 0x6c616e41
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.000916b0
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret