Function at 0x418550
Capabilities:
Hash data with crc32
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
mov eax, dword [0x425024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x100
push esi
push edi
mov edi, dword [0x429044]
lea eax, [ebp - 0x860]
mov dword [ebp - 0x890], ebx
mov ecx, 0x834
mov dword [ebp - 0x868], ebx
mov dword [ebp - 0x864], ebx
mov dword [ebp - 0x88c], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x870], 0x1e001c
mov dword [ebp - 0x86c], str.ArisuTsuberuku
mov dword [ebp - 0x888], 0x18
mov dword [ebp - 0x884], ebx
mov dword [ebp - 0x880], ebx
mov dword [ebp - 0x87c], ebx
mov dword [ebp - 0x878], ebx
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x24], ebx
nop dword [eax]
mov byte [eax], bl
lea eax, [eax + 1]
sub ecx, 1
jne 0x4185e0
cmp dword [edi + 0x40], ebx
je 0x418639
mov edx, 0x104
add edi, 0x662
je 0x418633
movzx esi, word [edi]
lea ecx, [ebp - 0x854]
test si, si
je 0x41862e
mov eax, ecx
sub edi, eax
nop
lea eax, [edx - 1]
test eax, eax
je 0x41862e
test edx, edx
je 0x41862e
movzx eax, word [edi + ecx + 2]
dec edx
mov word [ecx], si
add ecx, 2
mov esi, eax
test ax, ax
jne 0x418610
xor eax, eax
mov word [ecx], ax
mov edi, dword [ebp - 0x88c]
lea ecx, [ebp - 0x236]
mov esi, str.AkagiCompletionEvent
mov eax, ecx
mov edx, 0x41
sub esi, eax
nop dword [eax]
movzx eax, word [esi + ecx + 2]
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
mov edx, eax
test ax, ax
jne 0x418650
xor eax, eax
mov word [ecx], ax
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x858], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x1d4]
mov dword [ebp - 0x85c], eax
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov esi, dword [sym.imp.USER32.dll_GetUserObjectInformationW]
lea ecx, [ebp - 0x10]
push ecx
push 0x208
lea ecx, [ebp - 0x440]
push ecx
push 2
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
lea ecx, [ebp - 0x10]
push ecx
push 0x208
lea ecx, [ebp - 0x64a]
push ecx
push 2
push eax
call esi
push 0x834
lea eax, [ebp - 0x860]
push eax
push 0
call dword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov dword [ebp - 0x860], eax
lea eax, [ebp - 0x870]
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlCreateBoundaryDescriptor]
mov dword [ebp - 0x868], eax
test eax, eax
je 0x4188c9
push 1
call dword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
push eax
mov eax, dword [0x429044]
push 8
push dword [eax + 0xc]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x418752
push 1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlInitializeSid]
test eax, eax
js 0x418741
push 0
push ebx
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov dword [eax], 0
jmp 0x418754
mov eax, dword [0x429044]
push ebx
push 0
push dword [eax + 0xc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
test ebx, ebx
je 0x4188ae
push ebx
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.ntdll.dll_RtlAddSIDToBoundaryDescriptor]
test eax, eax
js 0x41889d
push dword [ebp - 0x868]
lea eax, [ebp - 0x888]
push eax
push 0x2000000
lea esi, [edi + 0x24]
push esi
call dword [sym.imp.ntdll.dll_NtCreatePrivateNamespace]
test eax, eax
js 0x41889d
mov eax, dword [esi]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x884], eax
lea eax, [ebp - 0x870]
push str.AkagiCompletionEvent
push eax
mov dword [ebp - 0x87c], 0x40
mov dword [ebp - 0x880], eax
call esi
push 0
push 0
lea eax, [ebp - 0x888]
push eax
push 0x1f0003
lea eax, [edi + 0x2c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x41889d
push str.AkagiSharedSection
lea eax, [ebp - 0x870]
mov dword [ebp - 0x20], 0x1000
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0x1000
call esi
push 0
push 0x8000000
push 4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x888]
push eax
push 7
lea esi, [edi + 0x28]
push esi
call dword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
js 0x41889d
push 4
push 0x100000
push 2
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1000
push 0
lea eax, [ebp - 0x864]
push eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x41889d
mov eax, dword [ebp - 0x864]
mov ecx, 0x1000
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x418861
mov edi, dword [ebp - 0x864]
lea esi, [ebp - 0x860]
mov ecx, 0x20d
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x864]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov edi, dword [ebp - 0x88c]
mov dword [ebp - 0x890], 1
mov eax, dword [0x429044]
push ebx
push 0
push dword [eax + 0xc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x868]
test eax, eax
je 0x4188bf
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteBoundaryDescriptor]
mov ebx, dword [ebp - 0x890]
test ebx, ebx
jne 0x4188e0
mov eax, dword [edi + 0x24]
test eax, eax
je 0x4188e0
push eax
call dword [sym.imp.ntdll.dll_NtDeletePrivateNamespace]
push dword [edi + 0x24]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a772
mov esp, ebp
pop ebp
ret