Function at 0x180001dfc
Capabilities:
Get windows directory from kuser_shared_data
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x728]
sub rsp, 0x828
xor r15d, r15d
mov rsi, rcx
mov ecx, r15d
mov ebx, r15d
mov r13d, r15d
mov qword [rbp + 0x788], rcx
mov rax, qword [rsi + 0x38]
lea r12d, [r15 + 1]
mov qword [rsp + 0x60], rax
test rcx, rcx
je 0x180001e4f
call qword [sym.imp.ntdll.dll_NtClose]
call fcn.180007e78
mov rdi, qword [rsi + 0x10]
mov dword [rbp + 0x770], r15d
mov qword [rsp + 0x50], r15
mov qword [rbp + 0x788], r15
call fcn.180007dac
mov r14, rax
test rax, rax
je 0x180001fab
lea rdx, str.PROCEXP152
call fcn.180007758
test al, al
je 0x180001e9b
lea rcx, str.PROCEXP152
call fcn.180006e18
test eax, eax
js 0x180001f8f
lea r8, [rbp + 0x770]
mov byte [rsp + 0x20], 1
mov rdx, rdi
mov ecx, 0x64
call fcn.18000146c
mov r15, rax
test rax, rax
jne 0x180001ecd
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r15d, r15d
jmp 0x180001f8f
mov r8d, dword [rbp + 0x770]
lea rax, [rbp + 0x780]
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r14
call fcn.1800071b8
mov rdi, rax
mov r8, r15
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [rbp + 0x770], edi
je 0x180001f22
mov ecx, dword [rbp + 0x780]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
jmp 0x180001ebf
mov r8b, 1
lea rcx, str.PROCEXP152
mov rdx, r14
call fcn.180006d20
xor r15d, r15d
mov dword [rbp + 0x780], eax
mov ecx, eax
test eax, eax
js 0x180001f81
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x50]
mov edx, 0xc0000000
lea rcx, str.PROCEXP152
call fcn.180006ee4
mov dword [rbp + 0x780], eax
test eax, eax
js 0x180001f7f
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x788], rax
jmp 0x180001f8f
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x788]
lea rdx, [rsp + 0x58]
call fcn.1800077a0
test eax, eax
je 0x1800020d9
mov edx, 0xd8
lea rdi, [rbp - 0x70]
mov ecx, edx
lea r8, [rbp - 0x70]
xor eax, eax
mov r9d, edx
mov rdx, qword [rsp + 0x58]
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.180005350
test eax, eax
je 0x1800020d9
mov rdx, qword [rbp - 0x68]
lea rdi, [rbp + 0x70]
mov r14d, 0x150
lea r8, [rbp + 0x70]
xor eax, eax
mov ecx, r14d
rep stosb byte [rdi], al
mov rcx, rsi
mov r9d, r14d
call fcn.180005350
test eax, eax
je 0x1800020d9
mov rdx, qword [rbp + 0x78]
lea rdi, [rbp + 0x1c0]
xor eax, eax
lea r8, [rbp + 0x1c0]
mov ecx, r14d
mov r9d, r14d
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.180005350
test eax, eax
je 0x1800020d9
mov rcx, qword [rbp + 0x788]
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rsi + 0x38]
lea rcx, [0x18000538c]
mov r13, qword [rbp + 0x2a0]
mov qword [rbp + 0x788], r15
mov rax, qword [rdi + 0x78]
cmp rax, rcx
je 0x1800020d4
mov rcx, qword [rsi + 0x20]
lea r8, [rsp + 0x70]
mov rdx, r13
and rdx, 0xfffffffffffff000
call rax
test eax, eax
je 0x1800020bf
mov rcx, qword [rsi + 0x20]
lea rdx, [r13 + 0x800]
and rdx, 0xfffffffffffff000
lea r8, [rsp + 0x68]
call qword [rdi + 0x78]
test eax, eax
je 0x1800020bf
mov rax, qword [rsp + 0x68]
sub rax, qword [rsp + 0x70]
cmp rax, 0x1000
jbe 0x1800020d4
inc r12d
cmp r12d, 3
ja 0x1800020d9
mov rcx, qword [rbp + 0x788]
jmp 0x180001e3f
mov ebx, 1
mov rcx, qword [rbp + 0x788]
test rcx, rcx
je 0x1800020f2
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbp + 0x788], r15
test ebx, ebx
je 0x180002233
mov rdi, qword [rsi + 0x18]
mov dword [rbp + 0x770], r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rbp + 0x780], r15
test rdi, rdi
je 0x180002233
mov eax, 0x7ffe0030
lea rcx, [rbp + 0x310]
cmp rcx, rax
je 0x18000215d
movzx edx, word [rax]
lea rcx, [rbp + 0x310]
test dx, dx
je 0x180002159
lea r8, [rbp + 0x310]
sub rax, r8
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x180002149
mov word [rcx], r15w
lea rdx, str._system32_ntoskrnl.exe
lea rcx, [rbp + 0x310]
call section..text
lea rdx, [rbp + 0x310]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rbp + 0x780]
xor edx, edx
lea r8, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x180002233
mov rax, qword [rbp + 0x780]
test rax, rax
je 0x180002233
mov r9, qword [rbp + 0x778]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x58]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180001808
test eax, eax
je 0x180002233
mov r9, qword [rbp + 0x780]
lea rax, [rbp + 0x770]
mov r8, qword [rsp + 0x50]
mov ecx, dword [rsi + 8]
mov qword [rsp + 0x30], rax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
call fcn.180006768
xor r12d, r12d
mov r15, rax
test rax, rax
je 0x180002230
cmp dword [rbp + 0x770], r12d
jne 0x180002263
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r15d, r15d
mov ebx, r15d
mov rcx, qword [rbp + 0x788]
test rcx, rcx
je 0x180002248
call qword [sym.imp.ntdll.dll_NtClose]
call fcn.180007e78
mov eax, ebx
add rsp, 0x828
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r15 + 0x7b8], rax
mov r14, rax
test rax, rax
je 0x180002349
mov rax, qword [rsp + 0x60]
mov r9d, 0x800
mov rcx, qword [rsi + 0x20]
mov r8, r15
mov rdx, r13
call qword [rax + 0x70]
xor r15d, r15d
test eax, eax
je 0x1800022d1
lea r8, [rbp + 0x788]
mov edx, 0xc0000000
lea rcx, str.PROCEXP152
call fcn.180006ee4
mov edx, 0x7d0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1800022d6
mov ebx, r15d
jmp 0x18000233e
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], r15d
lea r8, [rbp + 0x770]
mov dword [rsp + 0x38], 2
mov ecx, 0x1000
mov qword [rsp + 0x30], rax
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x60], rcx
xor r9d, r9d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov qword [rbp + 0x770], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x18000233e
mov rdx, qword [rbp + 0x770]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000234f
xor r15d, r15d
mov ebx, r15d
test rdi, rdi
je 0x180002236
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x180002236