Function at 0x140002ea0
Capabilities:
Map section object
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov r14, rcx
lea rdx, [0x140009a20]
xorps xmm0, xmm0
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor ebx, ebx
mov qword [rbp - 0x29], 0x30
lea rax, [rbp - 0x51]
mov qword [rbp - 0x11], 0x40
xorps xmm0, xmm0
mov qword [rbp - 0x21], rbx
lea r8, [rbp - 0x29]
mov qword [rbp - 0x19], rax
lea edx, [rbx + 4]
mov qword [rbp + 0x77], rbx
lea rcx, [rbp + 0x77]
movdqu xmmword [rbp - 9], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
test eax, eax
js 0x140002f65
mov rcx, qword [rbp + 0x77]
lea rax, [rbp - 0x69]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x7f]
mov dword [rsp + 0x40], ebx
lea rdx, [rbx - 1]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rbp + 0x7f], rbx
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], rbx
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jns 0x140002f73
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
add rsp, 0x100
pop r14
pop rbx
pop rbp
ret
lea rax, [r14 + 0x370]
mov byte [rbp + 0x6f], 1
mov qword [rbp - 0x59], rax
cmp r14, rax
je 0x1400030ad
mov qword [rsp + 0x120], rsi
add r14, 8
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xe8], r13
movups xmm0, xmmword [r14]
lea rcx, [0x140009a50]
mov rax, 0xffffffffffffffff
movaps xmmword [rbp - 0x39], xmm0
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140002fd0
mov r8, qword [rbp - 0x31]
cmp r8, rax
jne 0x1400030f2
mov rdx, rcx
mov rcx, qword [rbp - 0x39]
call fcn.140009130
test eax, eax
jne 0x1400030f2
mov rdi, qword [rbp + 0x7f]
movsxd rax, dword [rdi + 0x3c]
mov rcx, qword [rax + rdi + 0x88]
mov rax, rcx
shr rax, 0x20
test eax, eax
je 0x140003081
test ecx, ecx
je 0x140003081
mov esi, ecx
lea rdx, [0x140009a70]
add rsi, rdi
lea rcx, [rbp + 0x17]
mov r12d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x20]
add r12, rdi
mov r13d, dword [rsi + 0x24]
add r15, rdi
add r13, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
cmp dword [rsi + 0x14], 0
jbe 0x140003081
nop word [rax + rax]
mov edx, dword [r15 + rbx*4]
lea rcx, [rbp + 7]
add rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x17]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x1400030d8
mov eax, dword [rsi + 0x14]
inc rbx
cmp rbx, rax
jb 0x140003050
mov byte [rbp + 0x6f], 0
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x120]
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rdx, qword [rbp + 0x7f]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
movzx eax, byte [rbp + 0x6f]
add rsp, 0x100
pop r14
pop rbx
pop rbp
ret
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140003081
movzx eax, word [rcx + 4]
inc ax
xor ebx, ebx
jmp 0x14000310d
mov r8, qword [r14]
xor ecx, ecx
mov rdx, qword [rbp + 0x7f]
call fcn.140008b40
test rax, rax
je 0x140003081
movzx eax, word [rax + 4]
mov word [r14 - 8], ax
lea r8, [0x140009aa0]
cwde
lea rdx, [0x140009ac0]
mov dword [rsp + 0x28], eax
mov r9d, 0x6d
mov rax, qword [r14]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140003c60
add r14, 0x28
lea rax, [r14 - 8]
cmp rax, qword [rbp - 0x59]
je 0x140003085
jmp 0x140002fb7