Function at 0x7ff2ada868c
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x7ff2adb3100]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
or qword [rsp + 0x60], 0xffffffffffffffff
and qword [rsp + 0x58], 0
mov rbx, rdx
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x70]
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rsp + 0xc0]
lea r8d, [rdx + 0x60]
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rsp + 0x120]
lea r8d, [rdx + 0x40]
call sub.ntdll.dll_memset
and dword [rsp + 0x50], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x40]
mov rdx, rbx
mov ecx, 1
call fcn.7ff2ada8f74
mov ebx, eax
test eax, eax
jne 0x7ff2ada88f2
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
cmp r8d, 4
jb 0x7ff2ada893c
mov ax, word [rdx]
cmp ax, word [0x7ff2ada307c]
jne 0x7ff2ada893c
cmp r8d, 0x40
jb 0x7ff2ada893c
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x7ff2ada893c
movsxd r9, dword [rdx + 0x3c]
lea rcx, [r9 + 0x40]
cmp r8, rcx
jb 0x7ff2ada893c
cmp dword [r9 + rdx], 0x4550
jne 0x7ff2ada893c
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.7ff2ada9294
test eax, eax
je 0x7ff2ada88ed
mov rcx, qword [rsp + 0x58]
mov eax, 0x200
cmp ax, word [rcx + 4]
jne 0x7ff2ada88ed
lea eax, [rbx + 2]
cmp ax, word [rcx + 6]
jne 0x7ff2ada88ed
mov edx, dword [rcx]
cmp edx, 8
jb 0x7ff2ada88ed
lea rax, [rsp + 0x70]
add edx, 0xfffffff8
add rcx, 8
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call fcn.7ff2ada8a74
mov ebx, eax
test eax, eax
jne 0x7ff2ada88f2
cmp dword [rsp + 0x70], 0xa
jne 0x7ff2ada88e6
mov rcx, qword [rsp + 0x78]
lea rax, [0x7ff2ada3070]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x7ff2ada881c
mov dx, word [rax + 8]
cmp dx, word [rcx + 8]
jne 0x7ff2ada881c
xor eax, eax
jmp 0x7ff2ada8821
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x7ff2ada88e6
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea r9, [0x7ff2ada2f10]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x20], 6
mov dword [rsp + 0x58], 8
call fcn.7ff2ada9a54
test eax, eax
jle 0x7ff2ada88e6
cmp dword [rsp + 0xd0], 0
jle 0x7ff2ada88e6
lea rcx, [rsp + 0x100]
call fcn.7ff2ada9348
test eax, eax
jne 0x7ff2ada888c
mov ebx, 0x80091002
jmp 0x7ff2ada88fd
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x120]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov ecx, 3
mov r8d, eax
call fcn.7ff2ada859c
mov ebx, eax
test eax, eax
jne 0x7ff2ada88f2
mov eax, dword [rsp + 0x50]
cmp eax, dword [rsp + 0x110]
jne 0x7ff2ada88df
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x120]
mov r8, rax
call sub.ntdll.dll_memcmp
test eax, eax
je 0x7ff2ada88fd
mov ebx, 0x80091007
jmp 0x7ff2ada88fd
mov ebx, 0x8009200d
jmp 0x7ff2ada88fd
mov ebx, 0x800b0100
mov eax, 0x8000ffff
cmp ebx, 0x7a
cmove ebx, eax
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x7ff2ada8910
mov rcx, rdx
call qword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x7ff2ada8921
call qword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.7ff2adaaa90
add rsp, 0x170
pop rbx
ret
mov ebx, 0x32
jmp 0x7ff2ada8902