Function at 0x140178f60
Capabilities:
Map section object
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rbp + 0x7f]
mov r9d, 0x80
mov dword [rsp + 0x20], 1
mov r8d, 0x100021
call sym.SystemInformer.exe_QiCreateFile
mov edi, eax
test eax, eax
js 0x140179311
mov rbx, qword [rbp + 0x7f]
lea rcx, [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x1000000
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0xd]
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x140179311
mov rcx, qword ds:[rbp + 0x6f]
lea r8, [rbp - 0x19]
xorps xmm0, xmm0
xor r12d, r12d
movups xmmword [rbp - 0x19], xmm0
mov qword [rsp + 0x20], r12
movups xmmword [rbp - 9], xmm0
lea r9d, [r12 + 0x40]
lea edx, [r12 + 1]
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov edi, eax
test eax, eax
js 0x140179042
cmp dword [rbp + 7], 2
jne 0x14017903d
mov eax, 0x2002
test word [rbp + 0x13], ax
jne 0x140179051
mov edi, 0xc000036f
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1401790d4
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp - 0x29]
mov dword [rsp + 0x48], 0x10
lea r8, [rbp + 0x77]
mov dword [rsp + 0x40], r12d
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rdx, [r9 - 1]
mov qword [rbp + 0x77], r12
mov qword [rbp - 0x29], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rbp + 0x6f]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp edi, 0x40000003
jne 0x1401790b9
mov rcx, qword [rbp + 0x77]
call fcn.140178c80
mov edi, eax
test edi, edi
js 0x1401790c3
mov rsi, qword [rbp + 0x77]
jmp 0x1401790d8
mov rdx, qword [rbp + 0x77]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rsi, qword [rbp + 0x6f]
nop dword [rax + rax]
test edi, edi
js 0x140179311
mov qword [rsp + 0xe0], r13
lea rax, [rsi + 0x3c]
mov r13d, 0x5a4d
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xa0], r15
cmp word [rsi], r13w
je 0x14017911a
mov edi, 0xc000012f
jmp 0x1401792a4
mov ecx, dword [rax]
mov r14, rax
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14017929c
cmp dword [rsi + rcx], 0x4550
lea r15, [rsi + rcx]
jne 0x14017929c
mov eax, dword [r15 + 0x90]
test eax, eax
je 0x140179295
cmp dword [r15 + 0x94], r12d
je 0x140179295
movzx r11d, word [r15 + 0x14]
lea rbx, [rsi + rax]
movzx r10d, word [r15 + 6]
add r11, r15
mov edx, r12d
test r10d, r10d
je 0x1401791a9
mov rcx, r12
nop word [rax + rax]
mov r8d, dword [rcx + r11 + 0x24]
lea r9, [r8 + rsi]
cmp rbx, r9
jb 0x14017919e
mov eax, dword [rcx + r11 + 0x28]
add rax, r8
add rax, rsi
cmp rbx, rax
jb 0x1401791b3
inc edx
add rcx, 0x28
cmp edx, r10d
jb 0x140179180
mov edi, 0xc0000049
jmp 0x1401792a1
mov eax, dword [r11 + rcx + 0x20]
test r9, r9
je 0x1401791a9
nop dword [rax]
test rax, rax
je 0x1401791a9
mov qword [rbp + 0x77], rax
lea r8, [rbp + 0x77]
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x7f], r9
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edi, eax
test eax, eax
js 0x14017924a
cmp dword [rbx + 0xc], r12d
je 0x140179226
nop dword [rax]
cmp dword [rbx], r12d
je 0x140179226
mov rdx, rbx
mov rcx, rsi
call fcn.140178660
mov edi, eax
test eax, eax
js 0x1401792a1
add rbx, 0x14
cmp dword [rbx + 0xc], r12d
jne 0x140179200
mov r9d, dword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
lea r8, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov edi, eax
mov rax, r14
test edi, edi
js 0x1401792a4
mov rdx, r15
mov rcx, rsi
call fcn.140178860
mov edi, eax
mov rax, r14
test edi, edi
js 0x1401792a4
mov eax, dword [r15 + 0x28]
test eax, eax
jne 0x140179274
mov edi, 0xc0000139
jmp 0x1401792a1
xor r8d, r8d
add rax, rsi
mov rcx, rsi
mov edi, r12d
lea edx, [r8 + 1]
call qword [case.0x14013b5a0.0]
test al, al
jne 0x1401792e9
mov edi, 0xc0000142
jmp 0x1401792a1
mov edi, 0xc0000020
jmp 0x1401792a1
mov edi, 0xc000007b
mov rax, r14
cmp word [rsi], r13w
jne 0x1401792e9
mov ecx, dword [rax]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401792e9
cmp dword [rcx + rsi], 0x4550
jne 0x1401792e9
mov edx, dword [rcx + rsi + 0x28]
test edx, edx
je 0x1401792e9
lea rax, [rsi + rdx]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [case.0x14013b5a0.0]
mov rdx, rsi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov r15, qword [rsp + 0xa0]
mov eax, edi
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe0]
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lfence
mov eax, edi
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret