Function at 0x4088d0
Capabilities:
Map section object
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov word [rsp + 0xc0], 0
lea rax, [rsp + 0xc2]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x6c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x50], 0xffffffff
lea rdx, [0x0040c8f0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x240
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x80]
mov edx, 0x20
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jl 0x408a34
mov dword [rsp + 0xd8], 1
jmp 0x408a6a
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
lea r9, [0x0040c8e0]
mov r8d, 0x470
lea rdx, [0x0040c870]
lea rcx, [0x0040bf10]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0xd8], 0
cmp dword [rsp + 0xd8], 0
je 0x408c63
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0x90], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
lea r8, [rsp + 0x80]
mov edx, 0xc
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jl 0x408b14
mov dword [rsp + 0xdc], 1
jmp 0x408b4a
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
lea r9, [0x0040c8e0]
mov r8d, 0x481
lea rdx, [0x0040c870]
lea rcx, [0x0040bf10]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0xdc], 0
cmp dword [rsp + 0xdc], 0
je 0x408c58
mov dword [rsp + 0x48], 0x10
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jl 0x408bca
mov dword [rsp + 0xe0], 1
jmp 0x408c00
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
lea r9, [0x0040c8e0]
mov r8d, 0x48e
lea rdx, [0x0040c870]
lea rcx, [0x0040bf10]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0xe0], 0
cmp dword [rsp + 0xe0], 0
je 0x408c4a
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x78]
call fcn.00408330
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x408c38
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov dword [rsp + 0x50], eax
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x50]
add rsp, 0xf0
pop rdi
ret