Function at 0x140006be0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x140010100]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov r12, r8
mov rsi, rdx
mov r14, rcx
movups xmm0, xmmword [0x14000dac0]
movups xmmword [r11 - 0x60], xmm0
movups xmm1, xmmword [0x14000dad0]
movups xmmword [r11 - 0x50], xmm1
movsd xmm0, qword [0x14000dae0]
movsd qword [r11 - 0x40], xmm0
mov eax, dword [0x14000dae8]
mov dword [r11 - 0x38], eax
movzx eax, word [0x14000daec]
mov word [r11 - 0x34], ax
mov dword [rsp + 0x50], 0xc0000001
mov rdx, qword [0x1400101c0]
test rdx, rdx
jne 0x140006c84
mov eax, 0x80000008
xor ecx, ecx
cpuid
movzx ecx, al
mov rdx, 0xffffffffffffffff
shr rdx, cl
shl rdx, cl
not rdx
mov qword [0x1400101c0], rdx
cmp r14, rdx
ja 0x140006e7b
test rdx, rdx
jne 0x140006cb5
mov eax, 0x80000008
xor ecx, ecx
cpuid
movzx ecx, al
mov rdx, 0xffffffffffffffff
shr rdx, cl
shl rdx, cl
not rdx
mov qword [0x1400101c0], rdx
lea rax, [rsi + r14]
cmp rax, rdx
ja 0x140006e7b
xor r15d, r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rdi, rax
mov qword [rsp + 0x60], rax
xor edx, edx
lea r8d, [r15 + 1]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], r15
mov dword [rsp + 0xd0], 0x40
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
lea r8, [rsp + 0xb8]
mov edx, 0xf001f
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov ebx, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140006e48
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], 0x2000
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2000
xor r9d, r9d
lea r8, [rsp + 0x58]
lea rdx, [r9 - 1]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140006e3d
mov r15, qword [rsp + 0x58]
test r15, r15
je 0x140006e3d
mov rdx, qword [rsp + 0x68]
cmp rsi, rdx
cmova rsi, rdx
test rsi, rsi
je 0x140006e3d
sub r14, qword [rsp + 0x70]
mov qword [rsp + 0x80], r14
lea rax, [r14 + rsi]
cmp rax, rdx
ja 0x140006e22
lfence
mov r15, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
add rdx, r15
mov r8, rsi
mov rcx, r12
call fcn.14000d700
mov ebx, dword [rsp + 0x50]
mov rdx, r15
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
jmp 0x140006e3d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140006e53
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, ebx
jmp 0x140006e80
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.14000d510
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret