Function at 0x66203f00
Capabilities:
Map section object

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6621622b
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
push edi
xor edi, edi
cmp ebp, edi
je 0x66203f3b
cmp dword [esp + 0x1c0], 0xffffffff
mov byte [esp + 0x13], 1
je 0x66203f40
mov byte [esp + 0x13], 0
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.66207df0
mov dword [esp + 0x1b0], edi
cmp byte [esp + 0x13], 0
mov ebx, dword [esp + 0x1bc]
je 0x66203fb6
push edi
push ebx
lea eax, [esp + 0x90]
push eax
mov eax, ebp
cdq
push edi
push edx
push eax
lea ecx, [esp + 0x40]
call fcn.66207f60
mov esi, eax
cmp esi, edi
jge 0x66203f9c
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662082f0
mov eax, esi
jmp 0x66204155
lea ecx, [esp + 0x88]
call fcn.66207910
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x1c0], ecx
movzx esi, byte [esp + 0x1d0]
mov edx, dword [esp + 0x1c0]
neg esi
push edi
sbb esi, esi
push 0x8000000
and esi, 0xffffffc4
add esi, 0x40
push esi
lea eax, [esp + 0x2c]
push eax
push edi
push 0xf
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x66204014
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662082f0
mov eax, edi
jmp 0x66204155
mov ecx, dword [esp + 0x18]
push esi
push 0x100000
push 2
lea edx, [esp + 0x28]
push edx
push eax
push eax
push 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
or edi, 0xffffffff
push edi
push ecx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
test esi, esi
jge 0x66204069
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662082f0
mov eax, esi
jmp 0x66204155
cmp byte [esp + 0x13], 0
je 0x662040bb
mov eax, dword [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x90]
push ebp
push ecx
call fcn.66208190
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x662040f2
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662082f0
mov eax, esi
jmp 0x66204155
test ebp, ebp
je 0x662040f2
test ebx, ebx
je 0x662040dc
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x14]
push ecx
push edx
push ebx
push ebp
call fcn.662091b0
add esp, 0x10
jmp 0x662040f2
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call fcn.6620b9c0
add esp, 0xc
mov eax, dword [esp + 0x1c4]
test eax, eax
jne 0x6620410a
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204110
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x1c8]
test eax, eax
jne 0x66204129
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x6620412f
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x1cc]
test eax, eax
je 0x66204143
mov edx, dword [esp + 0x1c0]
mov dword [eax], edx
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662082f0
xor eax, eax
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a4
ret