Function at 0x430830
Capabilities:
Access pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x74]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0x7c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov word [rsp + 0xc0], 0
lea rax, [rsp + 0xc2]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x84], eax
cmp dword [0x004c6320], 0x611
jg 0x430937
mov rax, qword [0x004c5ed0]
mov qword [rsp + 0xe8], rax
jmp 0x430946
mov rax, qword [0x004c5ed8]
mov qword [rsp + 0xe8], rax
cmp qword [rsp + 0xe8], 0
je 0x430a04
movzx eax, byte [sym.imp.ntoskrnl.exe_KdDebuggerNotPresent]
test eax, eax
je 0x430a04
movzx eax, byte [sym.imp.ntoskrnl.exe_KdDebuggerEnabled]
test eax, eax
jne 0x430a04
cmp dword [0x004c6320], 0x611
jg 0x4309a9
mov rax, qword [0x004c5ed0]
mov rax, qword [rax + 0x28]
mov rcx, qword [0x004c5f20]
mov qword [rax + 0x18], rcx
mov rax, qword [0x004c5ed0]
mov rcx, qword [0x004c5f20]
mov qword [rax + 0x30], rcx
jmp 0x4309e0
cmp dword [0x004c6320], 0xa00
jl 0x4309e0
mov rax, qword [0x004c5ed8]
mov rax, qword [rax + 0x28]
mov rax, qword [rax]
mov rcx, qword [0x004c5f20]
mov qword [rax + 0x18], rcx
mov rax, qword [0x004c5ed8]
mov rcx, qword [0x004c5f20]
mov qword [rax + 0x30], rcx
cmp dword [0x004c6320], 0x611
jg 0x4309f9
mov qword [0x004c5ed0], 0
jmp 0x430a04
mov qword [0x004c5ed8], 0
cmp qword [rsp + 0x120], 0
je 0x430a6b
mov rcx, qword [rsp + 0x140]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x430a39
mov dword [rsp + 0xb8], 0xc000007b
jmp 0x430ede
mov rcx, qword [rsp + 0x130]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x430a69
mov dword [rsp + 0xb8], 0xc000007b
jmp 0x430ede
jmp 0x430a7b
mov dword [rsp + 0xb8], 0xc000000d
jmp 0x430ede
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x430a9c
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xf0], eax
jmp 0x430aab
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xf0]
cmp qword [rsp + 0x138], rax
jae 0x430acc
mov dword [rsp + 0xb8], 0xc000000d
jmp 0x430ede
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
mov ecx, dword [rcx + 8]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
mov ecx, dword [rcx + 0x58]
mov dword [rax + 0x58], ecx
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x430b13
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xf4], eax
jmp 0x430b22
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xf4], eax
mov eax, dword [rsp + 0xf4]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
lea r9, [rsp + 0x78]
xor r8d, r8d
mov edx, 0xf001f
lea rcx, [rsp + 0x98]
call sub.ntoskrnl.exe_MmCreateSection
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jge 0x430b80
jmp 0x430ede
lea r9, [rsp + 0xa0]
mov r8d, 1
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
call fcn.0042ed40
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jge 0x430bb9
jmp 0x430ede
mov dword [rsp + 0x50], 0x1000
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x40
mov dword [rsp + 0x30], 2
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xb0]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x98]
call fcn.0042ebc0
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jge 0x430d29
cmp dword [rsp + 0xb8], 0xc0000604
jne 0x430d24
mov dword [rsp + 0x88], 2
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x90], 2
lea rcx, [rsp + 0x80]
call fcn.00431050
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jge 0x430c86
jmp 0x430ede
mov rax, qword [0x004c5ec0]
mov byte [rax + 0x3b], 1
mov dword [rsp + 0x50], 0x1000
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x40
mov dword [rsp + 0x30], 2
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xb0]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x98]
call fcn.0042ebc0
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jge 0x430d22
mov dword [rsp + 0x8c], 1
lea rcx, [rsp + 0x80]
call fcn.00431050
jmp 0x430ede
jmp 0x430d29
jmp 0x430ede
cmp dword [rsp + 0xb8], 0
jl 0x430e8f
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x430d58
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0xf8], eax
jmp 0x430d67
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0xf8]
mov r8, rax
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0xb0]
call fcn.004319d0
mov rax, qword [rsp + 0x68]
add rax, 0x108
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x430dbc
mov rax, qword [rsp + 0x68]
add rax, 0xf8
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
jmp 0x430de2
mov rax, qword [rsp + 0xd8]
add rax, 0x28
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xd0]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0xd8], rax
jae 0x430e8f
mov rax, qword [rsp + 0xd8]
mov eax, dword [rax + 0x24]
and eax, 0xe0000000
test eax, eax
je 0x430e2d
mov rax, qword [rsp + 0xd8]
cmp dword [rax + 0x10], 0
jne 0x430e2f
jmp 0x430dce
mov rax, qword [rsp + 0xd8]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0xd8]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x140]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0xd8]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0xb0]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x100], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x100]
mov rcx, rax
call fcn.004319d0
jmp 0x430dce
cmp dword [0x004c6320], 0xa00
jge 0x430ec3
cmp qword [0x004c5ee0], 0
je 0x430ec3
mov rax, qword [rsp + 0x130]
cmp qword [0x004c5ee0], rax
je 0x430ec3
mov rax, qword [0x004c5ec0]
cmp dword [rax + 0x3c], 2
jb 0x430ede
mov r9d, 0xc000007b
mov r8d, 0xc0000018
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call fcn.00408eb0
cmp qword [rsp + 0xa0], 0
je 0x430f47
mov qword [rsp + 0xe0], 0
lea r8, [rsp + 0xe0]
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
call fcn.0042e960
mov rax, qword [rsp + 0xe0]
mov eax, dword [rax + 0x1c]
shl rax, 0xc
or rax, 0xfff
mov rcx, qword [rsp + 0xa0]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xa0]
mov qword [rax + 0x38], rcx
cmp qword [rsp + 0x98], 0
je 0x430f5f
mov rcx, qword [rsp + 0x98]
call sub.ntoskrnl.exe_ObfDereferenceObject
mov qword [0x004c5ee0], 0
mov eax, dword [rsp + 0xb8]
add rsp, 0x110
pop rdi
ret