Function at 0x1400169e7
Capabilities:
Hash data with crc32
Map section object

Disassembly:
jmp 0x140034aa0
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x11f8
call fcn.14001622b
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x31a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1218]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0x1198], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov dword [rbp + 4], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov rax, qword [rbp + 0x11c0]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xe8], 0
mov byte [rbp + 0x104], 0
mov byte [rbp + 0x105], 0
mov byte [rbp + 0x106], 0
mov byte [rbp + 0x107], 0
mov byte [rbp + 0x108], 0
mov byte [rbp + 0x109], 1
mov dword [rbp + 0x158], 0x30
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov dword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
lea rax, [rbp + 0xa04]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xa30]
call fcn.140016825
lea rdx, [rbp + 0xa30]
mov cx, 0x6566
call fcn.140016073
lea rdx, [rbp + 0xa30]
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edx, 0x834
lea rcx, [rbp + 0x1b0]
call fcn.140016825
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 0x14], 0
je 0x140034c16
mov rax, qword [rbp + 0xa8]
add rax, 0x890
mov r9d, 0x104
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x1bc]
call fcn.1400165af
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0xc]
mov dword [rbp + 0x1b8], eax
call fcn.140016640
mov eax, dword [rax + 0x2c0]
mov dword [rbp + 0x1b4], eax
lea r9, [rbp + 0x24]
mov r8d, 0x208
lea rdx, [rbp + 0x5d0]
xor ecx, ecx
call fcn.140016866
lea r9, [rbp + 0x24]
mov r8d, 0x208
lea rdx, [rbp + 0x3c6]
xor ecx, ecx
call fcn.14001603c
xor edx, edx
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlCreateBoundaryDescriptor]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140034c86
jmp 0x140034ee8
lea r8, [rbp + 0xa04]
mov dl, 1
lea rcx, [rbp + 0x104]
call fcn.1400166db
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140034cb1
jmp 0x140034ee8
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntdll.dll_RtlAddSIDToBoundaryDescriptor]
test eax, eax
jge 0x140034ccb
jmp 0x140034ee8
mov rax, qword [rbp + 0xa8]
add rax, 0x50
mov r9, qword [rbp + 0x48]
lea r8, [rbp + 0x158]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreatePrivateNamespace]
test eax, eax
jge 0x140034cf8
jmp 0x140034ee8
mov dword [rbp + 0x170], 0x40
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb50]
call fcn.140016825
lea rdx, [rbp + 0xb50]
mov cx, 0x6162
call fcn.140016073
lea rdx, [rbp + 0xb50]
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rbp + 0xb50]
lea rcx, [rbp + 0x7da]
call fcn.1400161f9
mov r8d, 0x834
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov dword [rbp + 0x1b0], eax
mov rax, qword [rbp + 0xa8]
add rax, 0x60
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x158]
mov edx, 0x1f0003
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
jge 0x140034db6
jmp 0x140034ee8
mov qword [rbp + 0xc8], 0x1000
mov qword [rbp + 0x88], 0x1000
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb50]
call fcn.140016825
lea rdx, [rbp + 0xb50]
mov cx, 0x6364
call fcn.140016073
lea rdx, [rbp + 0xb50]
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp + 0xa8]
add rax, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x158]
mov edx, 7
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
jl 0x140034ede
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 2
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
lea r8, [rbp + 0x68]
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0x140034ede
mov edx, 0x1000
mov rcx, qword [rbp + 0x68]
call fcn.140016825
mov r8d, 0x834
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp + 0x68]
call fcn.1400165cd
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x140034c67
cmp qword [rbp + 0xe8], 0
je 0x140034efe
mov rcx, qword [rbp + 0xe8]
call fcn.140016c1c
cmp qword [rbp + 0x48], 0
je 0x140034f0f
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_RtlDeleteBoundaryDescriptor]
cmp dword [rbp + 4], 0
jne 0x140034f45
mov rax, qword [rbp + 0xa8]
cmp qword [rax + 0x50], 0
je 0x140034f45
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_NtDeletePrivateNamespace]
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x140060810]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x1198]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x11a8]
pop rdi
pop rbp
ret