Function at 0x66203f00
Capabilities:
Map section object

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6621622b
push eax
mov dword fs:[0], esp
add esp, 0xfffffe68
push ebx
push esi
mov esi, dword [esp + 0x1b0]
push ebp
push edi
xor edi, edi
cmp esi, edi
je 0x66203f3b
cmp dword [esp + 0x1c0], 0xffffffff
mov byte [esp + 0x13], 1
je 0x66203f40
mov byte [esp + 0x13], 0
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.66207df0
mov dword [esp + 0x1b0], edi
cmp byte [esp + 0x13], 0
mov ebx, dword [esp + 0x1bc]
je 0x66203fb6
push edi
push ebx
lea eax, [esp + 0x90]
push eax
mov eax, esi
cdq
push edi
push edx
push eax
lea ecx, [esp + 0x40]
call fcn.66207f60
mov ebp, eax
cmp ebp, edi
jge 0x66203f9c
lea ecx, [esp + 0x28]
mov dword [esp + 0x1b0], 0xffffffff
call fcn.662082f0
mov eax, ebp
jmp 0x66204155
lea ecx, [esp + 0x88]
call fcn.66207910
mov edx, dword [esp + 0xd8]
mov dword [esp + 0x1c0], edx
movzx ebp, byte [esp + 0x1d0]
neg ebp
sbb ebp, ebp
mov edx, dword [esp + 0x1c0]
push edi
push 0x8000000
and ebp, 0xffffffc4
sub ebp, 0xffffffc0
push ebp
lea eax, [esp + 0x2c]
push eax
push edi
push 0xf
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x66204014
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662082f0
mov eax, edi
jmp 0x66204155
or edi, 0xffffffff
mov ecx, dword [esp + 0x18]
push ebp
push 0x100000
push 2
lea edx, [esp + 0x28]
push edx
push eax
push eax
push 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
push edi
push ecx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebp, eax
test ebp, ebp
jge 0x66204069
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esp + 0x28]
mov dword [esp + 0x1b0], edi
call fcn.662082f0
mov eax, ebp
jmp 0x66204155
cmp byte [esp + 0x13], 0
je 0x662040bb
mov eax, dword [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x90]
push esi
push ecx
call fcn.66208190
mov ebx, eax
sub esp, 0xfffffff0
test ebx, ebx
jge 0x662040f2
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esp + 0x28]
mov dword [esp + 0x1b0], edi
call fcn.662082f0
mov eax, ebx
jmp 0x66204155
or esi, esi
je 0x662040f2
or ebx, ebx
je 0x662040dc
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c0]
push ecx
push edx
push ebx
push esi
call fcn.662091b0
sub esp, 0xfffffff0
jmp 0x662040f2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c0]
push eax
push esi
push ecx
call fcn.6620b9c0
add esp, 0xc
mov eax, dword [esp + 0x1c4]
or eax, eax
jne 0x6620410a
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204110
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x1c8]
test eax, eax
jne 0x66204129
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x6620412f
mov esi, dword [esp + 0x14]
mov dword [eax], esi
mov eax, dword [esp + 0x1cc]
or eax, eax
je 0x66204143
mov edx, dword [esp + 0x1c0]
mov dword [eax], edx
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662082f0
xor eax, eax
mov ecx, dword [esp + 0x1a8]
pop edi
pop ebp
pop esi
pop ebx
sub esp, 0xfffffe5c
mov dword fs:[0], ecx
ret