Function at 0x136e6
Capabilities:
Map section object

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x17edc]
push ebx
push esi
push edi
mov dword [ebp + 0x1f0], eax
mov esi, 0x136c2
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
push 0x7f
pop ecx
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x136ce]
mov dword [ebp + 0x1cc], eax
xor eax, eax
push 7
pop ecx
lea edi, [ebp + 0x1d0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x5c], bx
lea edi, [ebp - 0x5a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x78], ebx
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0xffdf0030
mov dword [ebp - 0x80], ebx
lea edi, [ebp - 0x7c]
stosd dword es:[edi], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x3d], 1
call fcn.00013450
push 0x136d2
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00013450
xor eax, eax
mov ecx, dword [ebp + 0x204]
movsx cx, byte [eax + ecx]
mov word [ebp + eax*2 + 0x1ce], cx
inc eax
cmp eax, 0x10
jb 0x1378d
lea eax, [ebp + 0x1cc]
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00013450
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x20
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x70], eax
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x100020
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x78], 0x18
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov edi, eax
cmp edi, ebx
jl 0x13924
push dword [ebp - 0x48]
lea eax, [ebp - 0x78]
push 0x1000000
push 0x10
push ebx
push eax
push 0xd
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov edi, eax
cmp edi, ebx
jl 0x13924
push 4
push 0x100000
push 1
lea eax, [ebp - 0x54]
push eax
push ebx
push 0x1000
push ebx
lea eax, [ebp - 0x4c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x44]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
cmp edi, ebx
jl 0x13924
mov ebx, dword [ebp - 0x4c]
mov edx, dword [ebx + 0x3c]
add edx, ebx
mov eax, dword [edx + 0xa0]
test eax, eax
je 0x1391d
test byte [edx + 0x16], 1
jne 0x1391d
lea ecx, [eax + ebx]
cmp byte [ebp - 0x3d], 0
jne 0x1388e
cmp dword [ecx], 0
je 0x1391d
mov esi, dword [ecx + 4]
and dword [ebp + 0x204], 0
lea eax, [ecx + 8]
mov dword [ebp - 0x50], eax
lea eax, [esi - 8]
shr eax, 1
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x60], eax
je 0x138f3
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
mov edi, eax
and di, 0xf000
cmp di, 0x3000
jne 0x138de
and eax, 0xfff
add eax, dword [ecx]
mov edi, dword [eax + ebx]
sub edi, dword [edx + 0x34]
cmp edi, dword [ebp + 0x1fc]
jne 0x138de
cmp word [eax + ebx - 2], 0x5c7
je 0x138f7
inc dword [ebp + 0x204]
mov eax, dword [ebp + 0x204]
add dword [ebp - 0x50], 2
cmp eax, dword [ebp - 0x60]
jb 0x138ac
add ecx, esi
jmp 0x1387f
mov esi, dword [eax + ebx + 4]
sub esi, dword [edx + 0x34]
mov ecx, dword [ebp + 0x200]
mov edi, dword [ebp + 0x208]
add esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, dword [ebp + 0x20c]
mov dword [ecx], eax
xor edi, edi
jmp 0x13927
mov edi, 0xc0000001
jmp 0x13927
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x13938
push ebx
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
and dword [ebp - 0x4c], 0
cmp dword [ebp - 0x44], 0
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
je 0x1394d
push dword [ebp - 0x44]
call esi
and dword [ebp - 0x44], 0
cmp dword [ebp - 0x48], 0
je 0x13958
push dword [ebp - 0x48]
call esi
mov ecx, dword [ebp + 0x1f0]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.00015e15
add ebp, 0x1f4
leave
ret 0x14