Function at 0x18002b8d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14, rdx
mov r12, rcx
mov rax, qword [rdx]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002bb3f
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp dword [rsi], 0x4550
jne 0x18002bb3f
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x18002b92b
mov eax, 0x1b5a
jmp 0x18002bb44
mov r13d, dword [rsi + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
mov r8d, r13d
mov rcx, r12
call fcn.1800293d0
mov r15, rax
test rbp, rbp
je 0x18002bb38
test rax, rax
je 0x18002bb38
mov r8d, dword [rsi + 0x54]
mov rdx, qword [r14]
mov rcx, rbp
call fcn.18010b0a0
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov edi, eax
cmp ax, word [rsi + 6]
jae 0x18002b9b2
add rbx, rsi
nop dword [rax]
mov ecx, dword [rbx - 4]
add rcx, rbp
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, qword [r14]
call fcn.18010b0a0
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [rsi + 6]
cmp edi, eax
jl 0x18002b990
mov rbx, r15
sub rbx, qword [rsi + 0x30]
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.180030820
mov r10, qword [rax + 8]
mov r8, qword [rax]
xor edi, edi
cmp r8, r10
je 0x18002ba29
mov r11d, 0xfff
nop word [rax + rax]
mov eax, edi
cmp dword [r8 + 0x10], edi
jbe 0x18002ba20
nop dword [rax + rax]
mov edx, eax
mov rcx, qword [r8 + 8]
movzx r9d, word [rcx + rdx*2]
movzx ecx, r9w
shr cx, 0xc
and r9w, r11w
cmp cx, 0xa
jne 0x18002ba18
movzx edx, r9w
mov rcx, qword [r8]
add qword [rdx + rcx], rbx
inc eax
cmp eax, dword [r8 + 0x10]
jb 0x18002b9f0
add r8, 0x18
cmp r8, r10
jne 0x18002b9e0
lea rcx, [rsp + 0x40]
call fcn.18002bcd0
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.180030970
nop
mov rdx, rax
mov rcx, r12
call fcn.18002bb70
movzx ebx, al
lea rcx, [rsp + 0x40]
call fcn.18002bc20
test bl, bl
jne 0x18002ba78
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1b5c
jmp 0x18002bb44
mov r9, r13
mov r8, rbp
mov rdx, r15
mov rcx, r12
call fcn.1800291a0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
test al, al
jne 0x18002baa8
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1b5d
jmp 0x18002bb44
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, dword [rsi + 0x28]
add r8, r15
lea rdx, [rsp + 0xa8]
mov rcx, r12
call fcn.18002bd90
test al, al
jne 0x18002bad0
mov eax, 0x1b5e
jmp 0x18002bb44
mov eax, dword [rsi + 0x54]
test rax, rax
je 0x18002bb34
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0x30
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
jmp 0x18002bb44
mov eax, 0x1b5b
jmp 0x18002bb44
mov eax, 0x1b59
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret