Function at 0x11070
Capabilities:
Map section object

Disassembly:
mov rax, rsp
sub rsp, 0xe8
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov rdi, rdx
mov r12, rcx
mov qword [rax - 0x10], r13
lea rcx, [rax - 0x28]
lea rdx, [0x000118b0]
xor r13d, r13d
mov rbp, r9
mov rsi, r8
mov qword [r9], r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0xc0]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x60]
mov edx, 0xf001f
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], r13
mov dword [rsp + 0xa8], 0x40
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x60], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
test eax, eax
js 0x1133c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x28], r13
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
mov ebx, eax
js 0x11327
lea rax, [rdi + rsi]
xor edx, edx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x68]
lea ecx, [rdx + 5]
mov r8, rdi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x54], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
mov r8, qword [rsp + 0x58]
xor edx, edx
movzx ebx, al
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x54]
lea ecx, [rdx + 5]
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
test bl, bl
je 0x111aa
test al, al
jne 0x111ee
mov edx, 1
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x50]
lea ecx, [rdx + 4]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
mov r8, qword [rsp + 0x58]
mov edx, 1
mov bl, al
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x54]
lea ecx, [rdx + 4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
test bl, bl
je 0x111f6
test al, al
jne 0x11232
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x50]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x54]
mov bl, al
lea rax, [rsp + 0x58]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
test bl, bl
je 0x11313
test al, al
je 0x11313
cmp dword [rsp + 0x50], r13d
jne 0x11313
cmp dword [rsp + 0x54], r13d
jne 0x11313
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
sub rax, rcx
test eax, eax
jne 0x11273
mov ebx, 0xc0000001
jmp 0x11318
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
lea rdx, [r9 - 1]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
mov ebx, eax
js 0x11318
mov r8, qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov rdx, r8
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x60]
sub rdx, qword [rsp + 0x80]
mov rcx, r12
mov qword [rsp + 0x20], rdi
add rdx, rax
mov qword [rbp], rdx
call fcn.00011010
jmp 0x11332
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
jns 0x11332
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
add rsp, 0xe8
ret
push rbx
sub rsp, 0x20
cmp qword [r8], 0x72626d41
mov rbx, r9
mov rax, r8
je 0x11460
mov eax, 0xc000000d
add rsp, 0x20
pop rbx
ret
cmp edx, 0x81de804f
je 0x114ca
cmp edx, 0x81de8053
je 0x114b0
cmp edx, 0x81de8057
je 0x1149d
cmp edx, 0x81de8063
je 0x1148b
mov eax, 0xc00000bb
add rsp, 0x20
pop rbx
ret
mov eax, dword [r8 + 0x10]
movzx edx, word [r8 + 8]
out dx, eax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movzx edx, word [r8 + 8]
in eax, dx
mov ecx, eax
xor eax, eax
mov qword [r9], rcx
add rsp, 0x20
pop rbx
ret
mov r8, qword [r8 + 0x10]
mov rdx, qword [rax + 8]
call fcn.00011380
mov qword [rbx], 0
add rsp, 0x20
pop rbx
ret
mov r8, qword [r8 + 0x10]
cmp r8, 0x4000000
ja 0x11455
mov rdx, qword [rax + 8]
add rsp, 0x20
pop rbx
jmp 0x11070