Function at 0x180001d58
Capabilities:
Get windows directory from kuser_shared_data
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x728]
sub rsp, 0x828
xor r15d, r15d
mov rsi, rcx
mov ecx, r15d
mov ebx, r15d
mov r13d, r15d
mov qword [rbp + 0x788], rcx
mov rax, qword [rsi + 0x38]
lea r12d, [r15 + 1]
mov qword [rsp + 0x60], rax
test rcx, rcx
je 0x180001dab
call qword [sym.imp.ntdll.dll_NtClose]
call fcn.180007c9c
mov rdi, qword [rsi + 0x10]
mov dword [rbp + 0x770], r15d
mov qword [rsp + 0x50], r15
mov qword [rbp + 0x788], r15
call fcn.180007bd0
mov r14, rax
test rax, rax
je 0x180001f07
lea rdx, str.PROCEXP152
call fcn.180007634
test al, al
je 0x180001df7
lea rcx, str.PROCEXP152
call fcn.180006cf4
test eax, eax
js 0x180001eeb
lea r8, [rbp + 0x770]
mov byte [rsp + 0x20], 1
mov rdx, rdi
mov ecx, 0x64
call fcn.180001410
mov r15, rax
test rax, rax
jne 0x180001e29
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r15d, r15d
jmp 0x180001eeb
mov r8d, dword [rbp + 0x770]
lea rax, [rbp + 0x780]
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r14
call fcn.180007094
mov rdi, rax
mov r8, r15
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [rbp + 0x770], edi
je 0x180001e7e
mov ecx, dword [rbp + 0x780]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
jmp 0x180001e1b
mov r8b, 1
lea rcx, str.PROCEXP152
mov rdx, r14
call fcn.180006bfc
xor r15d, r15d
mov dword [rbp + 0x780], eax
mov ecx, eax
test eax, eax
js 0x180001edd
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x50]
mov edx, 0xc0000000
lea rcx, str.PROCEXP152
call fcn.180006dc0
mov dword [rbp + 0x780], eax
test eax, eax
js 0x180001edb
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x788], rax
jmp 0x180001eeb
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x788]
lea rdx, [rsp + 0x58]
call fcn.18000767c
test eax, eax
je 0x180002035
mov edx, 0xd8
lea rdi, [rbp - 0x70]
mov ecx, edx
lea r8, [rbp - 0x70]
xor eax, eax
mov r9d, edx
mov rdx, qword [rsp + 0x58]
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.1800052ac
test eax, eax
je 0x180002035
mov rdx, qword [rbp - 0x68]
lea rdi, [rbp + 0x70]
mov r14d, 0x150
lea r8, [rbp + 0x70]
xor eax, eax
mov ecx, r14d
rep stosb byte [rdi], al
mov rcx, rsi
mov r9d, r14d
call fcn.1800052ac
test eax, eax
je 0x180002035
mov rdx, qword [rbp + 0x78]
lea rdi, [rbp + 0x1c0]
xor eax, eax
lea r8, [rbp + 0x1c0]
mov ecx, r14d
mov r9d, r14d
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.1800052ac
test eax, eax
je 0x180002035
mov rcx, qword [rbp + 0x788]
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rsi + 0x38]
lea rcx, [0x1800052e8]
mov r13, qword [rbp + 0x2a0]
mov qword [rbp + 0x788], r15
mov rax, qword [rdi + 0x78]
cmp rax, rcx
je 0x180002030
mov rcx, qword [rsi + 0x20]
lea r8, [rsp + 0x70]
mov rdx, r13
and rdx, 0xfffffffffffff000
call rax
test eax, eax
je 0x18000201b
mov rcx, qword [rsi + 0x20]
lea rdx, [r13 + 0x800]
and rdx, 0xfffffffffffff000
lea r8, [rsp + 0x68]
call qword [rdi + 0x78]
test eax, eax
je 0x18000201b
mov rax, qword [rsp + 0x68]
sub rax, qword [rsp + 0x70]
cmp rax, 0x1000
jbe 0x180002030
inc r12d
cmp r12d, 3
ja 0x180002035
mov rcx, qword [rbp + 0x788]
jmp 0x180001d9b
mov ebx, 1
mov rcx, qword [rbp + 0x788]
test rcx, rcx
je 0x18000204e
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbp + 0x788], r15
test ebx, ebx
je 0x18000218f
mov rdi, qword [rsi + 0x18]
mov dword [rbp + 0x770], r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rbp + 0x780], r15
test rdi, rdi
je 0x18000218f
mov eax, 0x7ffe0030
lea rcx, [rbp + 0x310]
cmp rcx, rax
je 0x1800020b9
movzx edx, word [rax]
lea rcx, [rbp + 0x310]
test dx, dx
je 0x1800020b5
lea r8, [rbp + 0x310]
sub rax, r8
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x1800020a5
mov word [rcx], r15w
lea rdx, str._system32_ntoskrnl.exe
lea rcx, [rbp + 0x310]
call section..text
lea rdx, [rbp + 0x310]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rbp + 0x780]
xor edx, edx
lea r8, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x18000218f
mov rax, qword [rbp + 0x780]
test rax, rax
je 0x18000218f
mov r9, qword [rbp + 0x778]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x58]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180001764
test eax, eax
je 0x18000218f
mov r9, qword [rbp + 0x780]
lea rax, [rbp + 0x770]
mov r8, qword [rsp + 0x50]
mov ecx, dword [rsi + 8]
mov qword [rsp + 0x30], rax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
call fcn.180006674
xor r12d, r12d
mov r15, rax
test rax, rax
je 0x18000218c
cmp dword [rbp + 0x770], r12d
jne 0x1800021bf
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r15d, r15d
mov ebx, r15d
mov rcx, qword [rbp + 0x788]
test rcx, rcx
je 0x1800021a4
call qword [sym.imp.ntdll.dll_NtClose]
call fcn.180007c9c
mov eax, ebx
add rsp, 0x828
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r15 + 0x7b8], rax
mov r14, rax
test rax, rax
je 0x1800022a5
mov rax, qword [rsp + 0x60]
mov r9d, 0x800
mov rcx, qword [rsi + 0x20]
mov r8, r15
mov rdx, r13
call qword [rax + 0x70]
xor r15d, r15d
test eax, eax
je 0x18000222d
lea r8, [rbp + 0x788]
mov edx, 0xc0000000
lea rcx, str.PROCEXP152
call fcn.180006dc0
mov edx, 0x7d0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180002232
mov ebx, r15d
jmp 0x18000229a
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], r15d
lea r8, [rbp + 0x770]
mov dword [rsp + 0x38], 2
mov ecx, 0x1000
mov qword [rsp + 0x30], rax
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x60], rcx
xor r9d, r9d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov qword [rbp + 0x770], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x18000229a
mov rdx, qword [rbp + 0x770]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800022ab
xor r15d, r15d
mov ebx, r15d
test rdi, rdi
je 0x180002192
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x180002192