Function at 0x14002b7c0
Capabilities:
Map section object
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x60], 0xffffffff
lea rdx, [0x140072940]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd8], 0x240
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x100]
lea r8, [rsp + 0xc0]
mov edx, 0x120089
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x14002bac4
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov edx, 0xf001f
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x14002bab6
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x14002baa8
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x54], 0
jmp 0x14002ba14
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x14]
cmp dword [rsp + 0x54], eax
jae 0x14002ba96
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xa8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xb0]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x70]
call sub.ntoskrnl.exe__stricmp
test eax, eax
jne 0x14002ba91
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
mov dword [rsp + 0x60], eax
jmp 0x14002ba96
jmp 0x14002ba0a
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14002bac6
mov eax, dword [rsp + 0x60]
add rsp, 0x118
ret