Function at 0x140050d40
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x310
mov rax, qword [0x140083040]
xor rax, rsp
mov qword [rsp + 0x300], rax
xor eax, eax
lea rdi, [r11 - 0x228]
xor esi, esi
mov rbx, rdx
mov qword [rsp + 0x78], rsi
mov rdx, rcx
mov qword [rsp + 0x70], rsi
mov ecx, 0x104
rep stosb byte [rdi], al
mov qword [r11 - 0x258], rsi
movabs rax, 0x24c64dd348830179
mov dword [rsp + 0x84], esi
movabs rcx, 0xec03e2aad353fe48
mov dword [rsp + 0x9c], esi
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rax
movabs rax, 0xb94bfa00c1cd7ae1
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
movabs rax, 0x9232791716eea123
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x68], rax
movabs rax, 0x24a94dbd48c80125
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x248], rax
movabs rax, 0xb927fa44c1a37a96
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x240], rax
movabs rax, 0x9232794b169da14f
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x238], rax
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
cmp word [rsp + 0xf0], si
mov qword [r11 - 0x230], rax
lea rax, [r11 - 0x228]
vmovdqu ymm0, ymmword [rsp + 0xd0]
vpxor ymm0, ymm0, ymmword [rsp + 0x50]
vmovdqu ymmword [rsp + 0x50], ymm0
vzeroupper
je 0x140050ec9
nop dword [rax + rax]
add rax, 2
cmp word [rax], si
jne 0x140050ec0
mov rcx, qword [rsp + 0x50]
test cx, cx
je 0x140050ef0
lea rdi, [rsp + 0x50]
sub rdi, rax
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdi + rax]
test cx, cx
jne 0x140050ee0
mov word [rax], si
lea rax, [rsp + 0xf0]
test rdx, rdx
je 0x140050f43
cmp word [rsp + 0xf0], si
je 0x140050f19
nop word [rax + rax]
add rax, 2
cmp word [rax], si
jne 0x140050f10
movzx ecx, word [rdx]
test cx, cx
je 0x140050f40
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140050f30
mov word [rax], si
mov ecx, esi
lea rax, [rsp + 0xf0]
cmp word [rsp + 0xf0], cx
je 0x140050f6b
nop word [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], si
jne 0x140050f60
add cx, cx
mov dword [rsp + 0x80], 0x30
mov word [rsp + 0xb0], cx
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xb8], rax
lea r8, [rsp + 0x80]
add cx, 2
mov qword [rsp + 0x88], rsi
mov word [rsp + 0xb2], cx
lea rax, [rsp + 0xb0]
movaps xmm0, xmmword [rsp + 0xb0]
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0xb0], xmm0
mov edx, 4
xorps xmm0, xmm0
mov dword [rsp + 0x98], 0x40
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x90], rax
call qword [sym.imp.ntdll.dll_ZwOpenSection]
test eax, eax
js 0x140051052
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x78]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_ZwMapViewOfSection]
test eax, eax
js 0x140051052
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140051052
call qword [sym.imp.ntdll.dll_NtClose]
mov rdx, rbx
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140050c30
mov rdx, rbx
mov rcx, 0xffffffffffffffff
test rax, rax
jne 0x14005107c
call qword [sym.imp.ntdll.dll_ZwUnmapViewOfSection]
movzx eax, si
jmp 0x140051089
movzx edi, word [rax + 4]
call qword [sym.imp.ntdll.dll_ZwUnmapViewOfSection]
movzx eax, di
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400677c0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret