Function at 0x18002bc00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14, rdx
mov r12, rcx
mov rax, qword [rdx]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002be6f
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp dword [rsi], 0x4550
jne 0x18002be6f
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x18002bc5b
mov eax, 0x1b5a
jmp 0x18002be74
mov r13d, dword [rsi + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
mov r8d, r13d
mov rcx, r12
call fcn.180029730
mov r15, rax
test rbp, rbp
je 0x18002be68
test rax, rax
je 0x18002be68
mov r8d, dword [rsi + 0x54]
mov rdx, qword [r14]
mov rcx, rbp
call fcn.18010b6e0
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov edi, eax
cmp ax, word [rsi + 6]
jae 0x18002bce2
add rbx, rsi
nop dword [rax]
mov ecx, dword [rbx - 4]
add rcx, rbp
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, qword [r14]
call fcn.18010b6e0
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [rsi + 6]
cmp edi, eax
jl 0x18002bcc0
mov rbx, r15
sub rbx, qword [rsi + 0x30]
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.180030b50
mov r10, qword [rax + 8]
mov r8, qword [rax]
xor edi, edi
cmp r8, r10
je 0x18002bd59
mov r11d, 0xfff
nop word [rax + rax]
mov eax, edi
cmp dword [r8 + 0x10], edi
jbe 0x18002bd50
nop dword [rax + rax]
mov edx, eax
mov rcx, qword [r8 + 8]
movzx r9d, word [rcx + rdx*2]
movzx ecx, r9w
shr cx, 0xc
and r9w, r11w
cmp cx, 0xa
jne 0x18002bd48
movzx edx, r9w
mov rcx, qword [r8]
add qword [rdx + rcx], rbx
inc eax
cmp eax, dword [r8 + 0x10]
jb 0x18002bd20
add r8, 0x18
cmp r8, r10
jne 0x18002bd10
lea rcx, [rsp + 0x40]
call fcn.18002c000
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.180030ca0
nop
mov rdx, rax
mov rcx, r12
call fcn.18002bea0
movzx ebx, al
lea rcx, [rsp + 0x40]
call fcn.18002bf50
test bl, bl
jne 0x18002bda8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1b5c
jmp 0x18002be74
mov r9, r13
mov r8, rbp
mov rdx, r15
mov rcx, r12
call fcn.180029500
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
test al, al
jne 0x18002bdd8
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1b5d
jmp 0x18002be74
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, dword [rsi + 0x28]
add r8, r15
lea rdx, [rsp + 0xa8]
mov rcx, r12
call fcn.18002c0c0
test al, al
jne 0x18002be00
mov eax, 0x1b5e
jmp 0x18002be74
mov eax, dword [rsi + 0x54]
test rax, rax
je 0x18002be64
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0x30
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
jmp 0x18002be74
mov eax, 0x1b5b
jmp 0x18002be74
mov eax, 0x1b59
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret