Function at 0x140015997
Capabilities:
Hash data with crc32
Map section object

Disassembly:
jmp 0x140032000
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x11f8
call fcn.14001521c
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x31a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1218]
mov rax, qword [0x140070328]
xor rax, rbp
mov qword [rbp + 0x1198], rax
lea rcx, [0x140079a23]
call fcn.140015b09
mov dword [rbp + 4], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov rax, qword [rbp + 0x11c0]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xe8], 0
mov byte [rbp + 0x104], 0
mov byte [rbp + 0x105], 0
mov byte [rbp + 0x106], 0
mov byte [rbp + 0x107], 0
mov byte [rbp + 0x108], 0
mov byte [rbp + 0x109], 1
mov dword [rbp + 0x158], 0x30
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov dword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
lea rax, [rbp + 0xa04]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov edx, 0x100
lea rcx, [rbp + 0xa30]
call fcn.1400157e4
lea rdx, [rbp + 0xa30]
mov cx, 0x6566
call fcn.140015073
lea rdx, [rbp + 0xa30]
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edx, 0x834
lea rcx, [rbp + 0x1b0]
call fcn.1400157e4
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 0x14], 0
je 0x140032176
mov rax, qword [rbp + 0xa8]
add rax, 0x890
mov r9d, 0x104
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x1bc]
call fcn.140015578
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0xc]
mov dword [rbp + 0x1b8], eax
call fcn.140015609
mov eax, dword [rax + 0x2c0]
mov dword [rbp + 0x1b4], eax
lea r9, [rbp + 0x24]
mov r8d, 0x208
lea rdx, [rbp + 0x5d0]
xor ecx, ecx
call fcn.140015820
lea r9, [rbp + 0x24]
mov r8d, 0x208
lea rdx, [rbp + 0x3c6]
xor ecx, ecx
call fcn.14001503c
xor edx, edx
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlCreateBoundaryDescriptor]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1400321e6
jmp 0x140032448
lea r8, [rbp + 0xa04]
mov dl, 1
lea rcx, [rbp + 0x104]
call fcn.14001569f
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140032211
jmp 0x140032448
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntdll.dll_RtlAddSIDToBoundaryDescriptor]
test eax, eax
jge 0x14003222b
jmp 0x140032448
mov rax, qword [rbp + 0xa8]
add rax, 0x50
mov r9, qword [rbp + 0x48]
lea r8, [rbp + 0x158]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreatePrivateNamespace]
test eax, eax
jge 0x140032258
jmp 0x140032448
mov dword [rbp + 0x170], 0x40
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov edx, 0x100
lea rcx, [rbp + 0xb50]
call fcn.1400157e4
lea rdx, [rbp + 0xb50]
mov cx, 0x6162
call fcn.140015073
lea rdx, [rbp + 0xb50]
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rbp + 0xb50]
lea rcx, [rbp + 0x7da]
call fcn.1400151ea
mov r8d, 0x834
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov dword [rbp + 0x1b0], eax
mov rax, qword [rbp + 0xa8]
add rax, 0x60
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x158]
mov edx, 0x1f0003
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
jge 0x140032316
jmp 0x140032448
mov qword [rbp + 0xc8], 0x1000
mov qword [rbp + 0x88], 0x1000
mov edx, 0x100
lea rcx, [rbp + 0xb50]
call fcn.1400157e4
lea rdx, [rbp + 0xb50]
mov cx, 0x6364
call fcn.140015073
lea rdx, [rbp + 0xb50]
lea rcx, [rbp + 0x128]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp + 0xa8]
add rax, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x158]
mov edx, 7
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
jl 0x14003243e
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 2
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
lea r8, [rbp + 0x68]
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0x14003243e
mov edx, 0x1000
mov rcx, qword [rbp + 0x68]
call fcn.1400157e4
mov r8d, 0x834
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp + 0x68]
call fcn.140015596
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x1400321c7
cmp qword [rbp + 0xe8], 0
je 0x14003245e
mov rcx, qword [rbp + 0xe8]
call fcn.140015bae
cmp qword [rbp + 0x48], 0
je 0x14003246f
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_RtlDeleteBoundaryDescriptor]
cmp dword [rbp + 4], 0
jne 0x1400324a5
mov rax, qword [rbp + 0xa8]
cmp qword [rax + 0x50], 0
je 0x1400324a5
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_NtDeletePrivateNamespace]
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14005dd08]
call fcn.14001595b
mov eax, edi
mov rcx, qword [rbp + 0x1198]
xor rcx, rbp
call fcn.140015582
lea rsp, [rbp + 0x11a8]
pop rdi
pop rbp
ret