Function at 0x4303f0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x40], 0
jmp 0x430418
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x418
jae 0x430460
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x43045e
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
movzx eax, byte [rcx + rax]
xor eax, 0x23
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [rsp + 0xa0]
mov byte [rdx + rcx], al
jmp 0x43040e
call fcn.0042fff0
cmp qword [0x004c5f70], 0
jne 0x4304fd
lea rdx, [0x00435100]
lea rcx, [rsp + 0x50]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x50]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5f70], rax
lea rdx, [0x004350e0]
lea rcx, [rsp + 0x60]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x60]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5f78], rax
cmp qword [0x004c5f78], 0
jne 0x4304d4
lea rcx, [0x004350d0]
call fcn.00424700
mov qword [0x004c5f78], rax
mov rax, qword [sym.imp.ntoskrnl.exe_MmSectionObjectType]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
cmp qword [0x004c5ec8], 0
jne 0x4304fd
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x78]
mov qword [0x004c5ec8], rax
cmp qword [0x004c5f70], 0
jne 0x430511
mov eax, 0xc0000001
jmp 0x4307ff
xor edx, edx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 8]
call fcn.00430f80
movzx eax, al
test eax, eax
jne 0x430535
mov eax, 0xc0000001
jmp 0x4307ff
mov r8d, 0x486e7367
mov edx, 0x50
xor ecx, ecx
call sub.ntoskrnl.exe_ExAllocatePoolWithTag
mov qword [0x004c5ec0], rax
mov r8d, 0x50
xor edx, edx
mov rcx, qword [0x004c5ec0]
call fcn.00431d40
nop
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 0x10], 0
je 0x4305cc
xor eax, eax
test rax, rax
je 0x43057d
call sub.ntoskrnl.exe_ExRaiseDatatypeMisalignment
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
add rax, qword [rcx + 8]
cmp rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
ja 0x4305c2
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
add rax, qword [rcx + 8]
mov rcx, qword [rsp + 0xa0]
cmp rax, qword [rcx + 8]
jae 0x4305cc
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov byte [rax], 0
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
mov r8d, 0x486e7367
mov rdx, rax
xor ecx, ecx
call sub.ntoskrnl.exe_ExAllocatePoolWithTag
mov rcx, qword [0x004c5ec0]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
mov r8, rax
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [0x004c5ec0]
mov rcx, qword [rax + 0x20]
call fcn.004319d0
movzx eax, byte [sym.imp.ntoskrnl.exe_KdDebuggerNotPresent]
test eax, eax
je 0x430735
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
mov r8d, 0x486e7367
mov rdx, rax
mov ecx, 1
call sub.ntoskrnl.exe_ExAllocatePoolWithTag
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x70], 0
jmp 0x43066d
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x14]
test eax, eax
je 0x4306c1
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x70], eax
jae 0x4306c1
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0xa0]
movzx ecx, byte [rcx + 0x14]
xor eax, ecx
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
mov byte [rdx + rcx], al
jmp 0x430663
mov rcx, qword [rsp + 0x80]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x4306e5
mov eax, 0xc000007b
jmp 0x4307ff
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x430706
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x88], eax
jmp 0x430715
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x88], eax
mov rax, qword [0x004c5ec0]
mov ecx, dword [rsp + 0x88]
mov dword [rax + 0x40], ecx
xor edx, edx
mov rcx, qword [rsp + 0x80]
call sub.ntoskrnl.exe_ExFreePoolWithTag
jmp 0x430746
mov rax, qword [rsp + 0xa0]
add rax, 0x16
mov rdx, rax
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_RtlInitUnicodeString
mov rax, qword [rsp + 0xa0]
add rax, 0x214
mov rdx, rax
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
movzx eax, word [rsp + 0x30]
test eax, eax
je 0x43078c
movzx eax, word [rsp + 0x20]
test eax, eax
jne 0x430798
call fcn.0042fff0
mov eax, 0xc00000e8
jmp 0x4307ff
mov r8b, 1
lea rdx, [rsp + 0x30]
mov rcx, qword [0x004c5ec0]
call sub.ntoskrnl.exe_RtlUpcaseUnicodeString
mov rax, qword [0x004c5ec0]
add rax, 0x10
mov r8b, 1
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.ntoskrnl.exe_RtlUpcaseUnicodeString
mov rax, qword [0x004c5ec0]
mov byte [rax + 0x39], 1
mov rax, qword [0x004c5ec0]
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx + 0x10]
mov dword [rax + 0x28], ecx
mov rax, qword [0x004c5ec0]
mov rcx, qword [rsp + 0xa0]
movzx ecx, byte [rcx + 0x14]
mov byte [rax + 0x38], cl
xor eax, eax
add rsp, 0x98
ret