Function at 0x256c6
Capabilities:
Get file attributes
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.00024c80
test eax, eax
je 0x25877
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
push 0x7070664d
mov esi, 0x418
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, ebx
je 0x25877
push esi
push ebx
push edi
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp byte [ebp + 8], 1
lea edx, [eax + 2]
jne 0x2573e
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x2572b
movzx ecx, word [0x35320]
jmp 0x2574f
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x2573e
movzx ecx, word [0x35340]
sub eax, edx
shr ecx, 1
sar eax, 1
sub eax, ecx
cmp eax, ebx
jle 0x25877
add eax, eax
push eax
push dword [ebp + 0xc]
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp byte [ebp + 8], 1
jne 0x25785
push 0xa
push 0x29ec0
push edi
call dword [sym.imp.ntoskrnl.exe_wcsncat]
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
lea esi, [edi + 0x400]
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x40
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], eax
push 3
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x20081
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jne 0x25877
cmp dword [ebp - 4], ebx
je 0x25877
cmp dword [ebp - 4], 0xffffffff
je 0x25877
push 5
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push 0x18
stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jne 0x25877
push dword [ebp - 4]
mov esi, dword [esi + 8]
push 0x8000000
push 2
push ebx
push ebx
push 5
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
jne 0x25877
push 2
push 0x100000
push 1
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xc]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jne 0x25877
mov edi, dword [ebp - 8]
cmp edi, ebx
je 0x2588a
lea eax, [esi - 4]
push eax
push edi
call fcn.0002533c
cmp eax, dword [edi + esi - 4]
jne 0x25877
push esi
mov edx, edi
call fcn.000253aa
test eax, eax
jne 0x25877
push edi
push dword [ebp - 0x10]
call fcn.00025448
cmp dword [ebp - 8], ebx
je 0x2588a
push dword [ebp - 8]
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov dword [ebp - 8], ebx
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 0xc], ebx
je 0x2589d
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 4], ebx
je 0x258aa
push dword [ebp - 4]
call esi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x10], ebx
je 0x258b9
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8