Function at 0x1400a85e0
Capabilities:
Map section object
Parse pe header

Disassembly:
sub rsp, 0x28
cmp byte [0x1402b5a67], 0
je 0x1400a8669
mov qword [rsp + 0x30], rbx
call sym.SystemInformer.exe_PhResolveDevicePrefix
mov rbx, rax
test rax, rax
je 0x1400a865a
mov rcx, qword [rax + 8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
mov rdi, rax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400a862e
call fcn.14013d2a0
test rdi, rdi
mov rdi, qword [rsp + 0x20]
je 0x1400a8644
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rbx, qword [rsp + 0x30]
mov eax, 0xc0000001
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x140175d20
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rbp + 0x7f]
mov r9d, 0x80
mov dword [rsp + 0x20], 1
mov r8d, 0x100021
call sym.SystemInformer.exe_PhCreateFile
mov edi, eax
test eax, eax
js 0x1401760d1
mov rbx, qword [rbp + 0x7f]
lea rcx, [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x1000000
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0xd]
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x1401760d1
mov rcx, qword ds:[rbp + 0x6f]
lea r8, [rbp - 0x19]
xorps xmm0, xmm0
xor r12d, r12d
movups xmmword [rbp - 0x19], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp - 9], xmm0
lea r9d, [r12 + 0x40]
lea edx, [r12 + 1]
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov edi, eax
test eax, eax
js 0x140175e02
cmp dword [rbp + 7], 2
jne 0x140175dfd
mov eax, 0x2002
test word [rbp + 0x13], ax
jne 0x140175e11
mov edi, 0xc000036f
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140175e94
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 0x29]
mov dword [rsp + 0x48], 0x10
lea r8, [rbp + 0x77]
mov dword [rsp + 0x40], r12d
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rdx, [r9 - 1]
mov qword [rbp + 0x77], r12
mov qword [rbp - 0x29], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rbp + 0x6f]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp edi, 0x40000003
jne 0x140175e79
mov rcx, qword [rbp + 0x77]
call fcn.140175a40
mov edi, eax
test edi, edi
js 0x140175e83
mov rsi, qword [rbp + 0x77]
jmp 0x140175e98
mov rdx, qword [rbp + 0x77]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rsi, qword [rbp + 0x6f]
nop dword [rax + rax]
test edi, edi
js 0x1401760d1
mov qword [rsp + 0xe0], r13
lea rax, [rsi + 0x3c]
mov r13d, 0x5a4d
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xa0], r15
cmp word [rsi], r13w
je 0x140175eda
mov edi, 0xc000012f
jmp 0x140176064
mov ecx, dword [rax]
mov r14, rax
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14017605c
cmp dword [rsi + rcx], 0x4550
lea r15, [rsi + rcx]
jne 0x14017605c
mov eax, dword [r15 + 0x90]
test eax, eax
je 0x140176055
cmp dword [r15 + 0x94], r12d
je 0x140176055
movzx r11d, word [r15 + 0x14]
lea rbx, [rsi + rax]
movzx r10d, word [r15 + 6]
add r11, r15
mov edx, r12d
test r10d, r10d
je 0x140175f69
mov rcx, r12
nop word [rax + rax]
mov r8d, dword [rcx + r11 + 0x24]
lea r9, [r8 + rsi]
cmp rbx, r9
jb 0x140175f5e
mov eax, dword [rcx + r11 + 0x28]
add rax, r8
add rax, rsi
cmp rbx, rax
jb 0x140175f73
inc edx
add rcx, 0x28
cmp edx, r10d
jb 0x140175f40
mov edi, 0xc0000049
jmp 0x140176061
mov eax, dword [r11 + rcx + 0x20]
test r9, r9
je 0x140175f69
nop dword [rax]
test rax, rax
je 0x140175f69
mov qword [rbp + 0x77], rax
lea r8, [rbp + 0x77]
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x7f], r9
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edi, eax
test eax, eax
js 0x14017600a
cmp dword [rbx + 0xc], r12d
je 0x140175fe6
nop dword [rax]
cmp dword [rbx], r12d
je 0x140175fe6
mov rdx, rbx
mov rcx, rsi
call fcn.140175420
mov edi, eax
test eax, eax
js 0x140176061
add rbx, 0x14
cmp dword [rbx + 0xc], r12d
jne 0x140175fc0
mov r9d, dword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
lea r8, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edi, eax
mov rax, r14
test edi, edi
js 0x140176064
mov rdx, r15
mov rcx, rsi
call fcn.140175620
mov edi, eax
mov rax, r14
test edi, edi
js 0x140176064
mov eax, dword [r15 + 0x28]
test eax, eax
jne 0x140176034
mov edi, 0xc0000139
jmp 0x140176061
xor r8d, r8d
add rax, rsi
mov rcx, rsi
mov edi, r12d
lea edx, [r8 + 1]
call qword [str.PB__]
test al, al
jne 0x1401760a9
mov edi, 0xc0000142
jmp 0x140176061
mov edi, 0xc0000020
jmp 0x140176061
mov edi, 0xc000007b
mov rax, r14
cmp word [rsi], r13w
jne 0x1401760a9
mov ecx, dword [rax]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401760a9
cmp dword [rcx + rsi], 0x4550
jne 0x1401760a9
mov edx, dword [rcx + rsi + 0x28]
test edx, edx
je 0x1401760a9
lea rax, [rsi + rdx]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [str.PB__]
mov rdx, rsi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov r15, qword [rsp + 0xa0]
mov eax, edi
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe0]
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lfence
mov eax, edi
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret