Function at 0x10066dc
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x100cda4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x25c], eax
mov esi, 0x10066b2
lea edi, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
push 0x7f
pop ecx
lea edi, [ebp - 0x226]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x10066be]
mov dword [ebp - 0x28], eax
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x254], bx
lea edi, [ebp - 0x252]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x27c], ebx
lea edi, [ebp - 0x278]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0xffdf0030
mov dword [ebp - 0x284], ebx
lea edi, [ebp - 0x280]
stosd dword es:[edi], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x231], 1
call fcn.010045dc
push 0x10066c2
push esi
lea eax, [ebp - 0x230]
push eax
call fcn.010045dc
xor eax, eax
mov ecx, dword [ebp + 0x10]
movsx cx, byte [eax + ecx]
mov word [ebp + eax*2 - 0x26], cx
inc eax
cmp eax, 0x10
jb 0x10067b6
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x230]
push eax
call fcn.010045dc
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x20
lea eax, [ebp - 0x254]
mov dword [ebp - 0x274], eax
push 1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x27c]
push eax
push 0x100020
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x27c], 0x18
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x270], 0x40
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov edi, eax
cmp edi, ebx
jl 0x10069a0
push dword [ebp - 0x240]
lea eax, [ebp - 0x27c]
push 0x1000000
push 0x10
push ebx
push eax
push 0xd
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 0x274], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov edi, eax
cmp edi, ebx
jl 0x10069a0
push 4
push 0x100000
push 1
lea eax, [ebp - 0x260]
push eax
push ebx
push 0x1000
push ebx
lea eax, [ebp - 0x238]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x23c]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
cmp edi, ebx
jl 0x10069a0
mov eax, dword [ebp - 0x238]
mov edx, dword [eax + 0x3c]
add edx, eax
mov ecx, dword [edx + 0xa0]
cmp ecx, ebx
je 0x100699b
test byte [edx + 0x16], 1
jne 0x100699b
add ecx, eax
cmp byte [ebp - 0x231], bl
jne 0x10068ed
cmp dword [ecx], ebx
je 0x100699b
mov esi, dword [ecx + 4]
lea eax, [ecx + 8]
mov dword [ebp - 0x244], eax
lea eax, [esi - 8]
shr eax, 1
mov byte [ebp - 0x231], bl
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x264], eax
je 0x1006971
mov eax, dword [ebp - 0x244]
movzx eax, word [eax]
mov edi, eax
and di, 0xf000
cmp di, 0x3000
jne 0x1006956
mov edi, dword [ebp - 0x238]
and eax, 0xfff
add eax, dword [ecx]
mov esi, dword [eax + edi]
sub esi, dword [edx + 0x34]
cmp esi, dword [ebp + 8]
jne 0x1006950
cmp word [eax + edi - 2], 0x5c7
je 0x1006978
mov esi, dword [ebp - 0x24c]
inc dword [ebp - 0x248]
mov eax, dword [ebp - 0x248]
add dword [ebp - 0x244], 2
cmp eax, dword [ebp - 0x264]
jb 0x1006918
add ecx, esi
jmp 0x10068dd
mov esi, dword [eax + edi + 4]
sub esi, dword [edx + 0x34]
mov ecx, dword [ebp + 0xc]
add esi, edi
mov edi, dword [ebp - 0x258]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, dword [ebp - 0x25c]
mov dword [ecx], eax
xor edi, edi
jmp 0x10069a0
mov edi, 0xc0000001
cmp dword [ebp - 0x238], ebx
je 0x10069bc
push dword [ebp - 0x238]
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov dword [ebp - 0x238], ebx
cmp dword [ebp - 0x23c], ebx
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
je 0x10069d8
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x23c], ebx
cmp dword [ebp - 0x240], ebx
je 0x10069e8
push dword [ebp - 0x240]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0100911e
leave
ret 0x14