Function at 0x150cc
Capabilities:
Map section object

Disassembly:
push 0x184
push 0x1eb78
call fcn.000195f0
mov eax, dword [0x1f3a4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x170], edi
push eax
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
push 0x18
pop ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], edi
push 0x40
pop esi
mov dword [ebp - 0x160], esi
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], edi
push 0x100
push edi
push edi
push edi
push edi
push edi
push 1
push 1
push 0x80
push edi
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0x80000000
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov dword [ebp - 0x14c], eax
cmp eax, edi
lea eax, [ebp - 0x17c]
push eax
jge 0x15198
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x15503
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], edi
push dword [ebp - 0x150]
push 0x8000000
push 2
push edi
push edi
push 5
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov esi, eax
cmp esi, edi
jge 0x151f9
push dword [ebp - 0x150]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
jmp 0x15509
push 2
push 0x100000
push 1
lea eax, [ebp - 0x170]
push eax
push edi
push 0x1000
push edi
lea eax, [ebp - 0x148]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x154]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [ebp - 0x14c], eax
cmp eax, edi
jl 0x154ed
mov ecx, dword [ebp - 0x148]
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov edx, dword [eax + 0x58]
cmp edx, dword [0x1f418]
je 0x15258
mov dword [ebp - 0x14c], 0xc0000001
jmp 0x154df
mov ebx, dword [eax + 0x34]
push 0x15012
push ecx
call fcn.00014f40
mov esi, eax
push 0x1502e
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x1f500], eax
cmp eax, edi
je 0x152a3
mov dword [ebp - 0x138], 0x11c
lea ecx, [ebp - 0x138]
push ecx
call eax
mov dword [ebp - 4], edi
push esi
push dword [ebp - 0x148]
call fcn.00014abe
mov dword [ebp - 0x174], eax
push eax
push dword [ebp - 0x148]
call fcn.00014a50
mov esi, eax
add esi, dword [ebp - 0x148]
mov dword [ebp - 0x174], esi
push 0x1504a
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x152eb
mov eax, dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f428], eax
push 0x15056
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x1532b
mov eax, dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f42c], eax
push 0x15062
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x1536b
mov eax, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f430], eax
push 0x15072
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x153ab
mov eax, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f434], eax
push 0x15082
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x153eb
mov eax, dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f440], eax
push 0x1508e
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x1542b
mov eax, dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f444], eax
push 0x150a2
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x1546b
mov eax, dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0x1f41c]
sub ecx, ebx
add eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [0x1f438], eax
push 0x150b2
call fcn.00014f1c
mov dword [ebp - 0x144], eax
cmp eax, edi
jne 0x154ab
mov eax, dword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov eax, dword [eax + 1]
mov dword [ebp - 0x140], eax
mov esi, dword [esi + eax*4]
mov dword [ebp - 0x13c], esi
mov eax, dword [0x1f41c]
sub eax, ebx
add esi, eax
mov dword [ebp - 0x13c], esi
mov dword [0x1f43c], esi
jmp 0x154db
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x148]
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0x154]
call esi
push dword [ebp - 0x150]
call esi
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x1c]
call fcn.000195d3
call fcn.0001962b
ret 4