Function at 0x140105600
Capabilities:
Map section object
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc8
mov rcx, qword [rcx + 8]
lea rdx, [rbp - 0x39]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, eax
mov r15d, 0x5a4d
test eax, eax
js 0x140105746
xor r14d, r14d
mov dword [rbp - 0x19], 0x30
mov dword [rsp + 0x50], r14d
lea rax, [rbp - 0x39]
mov qword [rsp + 0x48], r14
lea r9, [rbp - 0x29]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x19]
mov dword [rsp + 0x38], 1
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x30], 5
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x100021
mov qword [rsp + 0x20], r14
mov qword [rbp - 0x11], r14
mov dword [rbp - 1], 0x40
mov qword [rbp - 9], rax
movdqu xmmword [rbp + 7], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
lea rcx, [rbp - 0x39]
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test edi, edi
js 0x140105746
mov rbx, qword [rbp + 0x77]
lea edx, [r14 + 9]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x140105746
mov rcx, qword [rbp + 0x6f]
lea r9d, [r14 + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], r14
lea r8, [rbp - 0x19]
lea edx, [r14 + 1]
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov edi, eax
test eax, eax
js 0x140105737
cmp dword [rbp + 7], 2
je 0x1401057a8
mov edi, 0xc000036f
mov rcx, qword ds:[rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rbp + 0x6f]
cmp word [rbx], r15w
jne 0x140105796
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x140105796
cmp dword [rcx + rbx], 0x4550
jne 0x140105796
mov edx, dword [rcx + rbx + 0x28]
test edx, edx
je 0x140105796
lea rax, ds:[rbx + rdx]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [case.0x140101f48.0]
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, edi
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x7f]
mov dword [rsp + 0x48], 0x10
lea r8, [rbp + 0x67]
mov dword [rsp + 0x40], r14d
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rdx, [r9 - 1]
mov qword [rbp + 0x67], r14
mov qword [rbp + 0x7f], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword [rbp + 0x6f]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rbp + 0x6f]
test edi, edi
cmovns rbx, qword [rbp + 0x67]
js 0x14010574a
cmp word [rbx], r15w
je 0x14010581a
mov edi, 0xc00001a3
jmp 0x14010574a
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x140105810
cmp dword [rbx + rcx], 0x4550
lea rsi, [rbx + rcx]
je 0x14010583e
mov edi, 0xc00001a3
jmp 0x14010574a
mov rdx, rsi
mov rcx, rbx
call fcn.140104eb0
mov edi, eax
test eax, eax
js 0x14010574a
mov rdx, rsi
mov rcx, rbx
call fcn.140105240
mov edi, eax
test eax, eax
js 0x14010574a
mov eax, dword [rsi + 0x28]
test eax, eax
jne 0x140105879
mov edi, 0xc0000139
jmp 0x14010574a
xor r8d, r8d
add rax, rbx
mov rcx, rbx
lea edx, [r8 + 1]
call qword [case.0x140101f48.0]
test al, al
jne 0x14010589a
mov edi, 0xc0000142
jmp 0x14010574a
mov eax, r14d
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret