Function at 0x40f250
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x330
mov rax, qword [0x004408f0]
mov qword [rsp + 0x320], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 0
cmp qword [rsp + 0x340], 0
jne 0x40f2ce
xor eax, eax
jmp 0x40f813
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x40f2e4
xor eax, eax
jmp 0x40f813
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x40f330
xor eax, eax
jmp 0x40f813
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x40f369
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x88]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x8c]
mov dword [rsp + 0x70], eax
jmp 0x40f38a
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x78]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x24]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x20]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x1c]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0
jmp 0x40f3dd
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x14]
cmp dword [rsp + 0x30], eax
jae 0x40f80e
mov word [rsp + 0x88], 0xffff
mov qword [rsp + 0x80], 0
cmp qword [rsp + 0x348], 0xffff
ja 0x40f422
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x88], ax
jmp 0x40f478
cmp qword [rsp + 0x348], 0xffff
jbe 0x40f471
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x30], eax
jae 0x40f471
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x88], ax
jmp 0x40f478
xor eax, eax
jmp 0x40f813
cmp qword [rsp + 0x348], 0xffff
ja 0x40f4a2
movzx eax, word [rsp + 0x348]
movzx ecx, word [rsp + 0x88]
mov rdx, qword [rsp + 0x38]
add ecx, dword [rdx + 0x10]
cmp eax, ecx
je 0x40f4d1
cmp qword [rsp + 0x348], 0xffff
jbe 0x40f809
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x80]
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x40f809
movzx eax, word [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax*4]
add rax, qword [rsp + 0x340]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x60], rax
jb 0x40f807
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x60], rax
ja 0x40f807
mov dword [rsp + 0x308], 0
mov word [rsp + 0xf0], 0
lea rax, [rsp + 0xf2]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
mov word [rsp + 0xc0], 0
lea rax, [rsp + 0xc2]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov word [rsp + 0xd0], 0
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov word [rsp + 0x2f8], 0
lea rax, [rsp + 0x2fa]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov word [rsp + 0xa0], 0
lea rax, [rsp + 0xa2]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov word [rsp + 0x90], 0
lea rax, [rsp + 0x92]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x2f0], 0
cmp qword [rsp + 0x350], 0
jne 0x40f60c
xor eax, eax
jmp 0x40f813
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xc0]
call sub.ntoskrnl.exe_RtlInitAnsiString
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x98], rax
mov word [rsp + 0x90], 0
mov word [rsp + 0x92], 0x200
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call sub.ntoskrnl.exe_RtlAnsiStringToUnicodeString
mov dword [rsp + 0x308], 0
jmp 0x40f677
mov eax, dword [rsp + 0x308]
inc eax
mov dword [rsp + 0x308], eax
mov eax, dword [rsp + 0x308]
mov qword [rsp + 0x310], rax
movzx ecx, word [rsp + 0x90]
xor edx, edx
mov rax, rcx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x310]
cmp rcx, rax
jae 0x40f6fc
mov eax, dword [rsp + 0x308]
mov rcx, qword [rsp + 0x98]
movzx eax, word [rcx + rax*2]
cmp eax, 0x2e
jne 0x40f6f7
mov eax, dword [rsp + 0x308]
shl rax, 1
mov word [rsp + 0x90], ax
mov eax, dword [rsp + 0x308]
mov rcx, qword [rsp + 0x98]
mov word [rcx + rax*2], 0
mov eax, dword [rsp + 0x308]
mov dword [rsp + 0xb8], eax
jmp 0x40f6fc
jmp 0x40f667
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc8]
lea rax, [rcx + rax + 1]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call sub.ntoskrnl.exe_RtlInitAnsiString
lea rdx, [0x00434080]
lea rcx, [rsp + 0x90]
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
mov r8d, 1
mov rdx, qword [rsp + 0x350]
xor ecx, ecx
call fcn.00411740
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x2f8]
call fcn.00415550
mov rcx, qword [rsp + 0x350]
call sub.ntoskrnl.exe_PsGetProcessWow64Process
test rax, rax
je 0x40f79f
mov dword [rsp + 0x318], 1
jmp 0x40f7aa
mov dword [rsp + 0x318], 0
movzx r8d, byte [rsp + 0x318]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x350]
call fcn.0040edb0
mov qword [rsp + 0xb0], rax
lea r9, [rsp + 0xa0]
mov r8, qword [rsp + 0x350]
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xb0]
call fcn.0040f250
mov qword [rsp + 0x2f0], rax
mov rax, qword [rsp + 0x2f0]
jmp 0x40f813
jmp 0x40f80e
jmp 0x40f3d3
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x320]
call fcn.00432250
add rsp, 0x330
pop rdi
ret