Function at 0x140006c84
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov eax, 0x5c
mov word [rsp + 0x68], ax
mov eax, 0x42
mov word [rsp + 0x6a], ax
mov eax, 0x61
mov word [rsp + 0x6c], ax
mov eax, 0x73
mov word [rsp + 0x6e], ax
mov eax, 0x65
mov word [rsp + 0x70], ax
mov eax, 0x4e
mov word [rsp + 0x72], ax
mov eax, 0x61
mov word [rsp + 0x74], ax
mov eax, 0x6d
mov word [rsp + 0x76], ax
mov eax, 0x65
mov word [rsp + 0x78], ax
mov eax, 0x64
mov word [rsp + 0x7a], ax
mov eax, 0x4f
mov word [rsp + 0x7c], ax
mov eax, 0x62
mov word [rsp + 0x7e], ax
mov eax, 0x6a
mov word [rsp + 0x80], ax
mov eax, 0x65
mov word [rsp + 0x82], ax
mov eax, 0x63
mov word [rsp + 0x84], ax
mov eax, 0x74
mov word [rsp + 0x86], ax
mov eax, 0x73
mov word [rsp + 0x88], ax
mov eax, 0x5c
mov word [rsp + 0x8a], ax
mov eax, 0x6d
mov word [rsp + 0x8c], ax
mov eax, 0x79
mov word [rsp + 0x8e], ax
mov eax, 0x44
mov word [rsp + 0x90], ax
mov eax, 0x72
mov word [rsp + 0x92], ax
mov eax, 0x69
mov word [rsp + 0x94], ax
mov eax, 0x76
mov word [rsp + 0x96], ax
mov eax, 0x65
mov word [rsp + 0x98], ax
mov eax, 0x72
mov word [rsp + 0x9a], ax
mov eax, 0x44
mov word [rsp + 0x9c], ax
mov eax, 0x61
mov word [rsp + 0x9e], ax
mov eax, 0x74
mov word [rsp + 0xa0], ax
mov eax, 0x61
mov word [rsp + 0xa2], ax
xor eax, eax
mov word [rsp + 0xa4], ax
mov dword [rsp + 0x5c], 0xc0000001
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0x50], 0xa
mov dword [rsp + 0x54], 0
jmp 0x140006e31
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x54], eax
jge 0x140006eb1
mov eax, dword [rsp + 0x54]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x140006e8b
mov eax, dword [rsp + 0x50]
shl eax, 1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
jne 0x140006e79
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
jmp 0x140006e89
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
jmp 0x140006eac
cmp dword [rsp + 0x50], 0
jle 0x140006eac
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 5
idiv ecx
mov eax, edx
jmp 0x140006e8b
jmp 0x140006e27
cmp dword [rsp + 0x50], 0x14
jle 0x140006ece
mov eax, dword [rsp + 0x50]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xa
jg 0x140006eb8
jmp 0x140006f22
mov dword [rsp + 0x58], 0
jmp 0x140006ee2
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x58], eax
jge 0x140006f22
mov eax, dword [rsp + 0x58]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
jne 0x140006f10
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
jmp 0x140006f20
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
jmp 0x140006ed8
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xd0], 0x40
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
lea r8, [rsp + 0xb8]
mov edx, 6
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jl 0x1400070a2
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jl 0x140007094
mov r8d, dword [0x140003020]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, qword [rsp + 0x110]
mov qword [rcx], rax
mov rax, qword [rsp + 0x110]
cmp qword [rax], 0
je 0x140007077
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x110]
mov rcx, qword [rax]
call fcn.140001680
mov rax, qword [rsp + 0x118]
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
jmp 0x14000707f
mov dword [rsp + 0x5c], 0xc0000001
mov rdx, qword [rsp + 0xa8]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x5c]
add rsp, 0x108
ret