Function at 0x16d70
Capabilities:
Map section object
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
cmp eax, edi
je 0x16d8a
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
push 0x20
push 1
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x40], eax
push 0x100020
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x48], 0x18
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], 0x240
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
cmp eax, edi
mov dword [ebp - 0xc], eax
jl 0x16f1a
mov ecx, dword [ebp - 8]
push ecx
push 0x1000000
push 0x10
push edi
lea edx, [ebp - 0x48]
push edx
push 0xf001f
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 0x40], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
cmp eax, edi
mov dword [ebp - 0xc], eax
jl 0x16f10
mov eax, dword [ebp + 0xc]
push 4
push 0x100000
push 1
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x400
push edi
lea edx, [ebp - 4]
push edx
push 0xffffffffffffffff
push eax
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ecx, dword [ebp - 8]
mov esi, eax
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, edi
jl 0x16f1a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov edi, dword [ecx + eax + 0x78]
mov ecx, dword [edi + eax + 0x1c]
mov esi, dword [edi + eax + 0x20]
add edi, eax
add ecx, eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [edi + 0x24]
add esi, eax
add ecx, eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov edx, eax
lea ebx, [ecx + 1]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], ebx
nop
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x16e70
sub ecx, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
cmp dword [edi + 0x14], ebx
ja 0x16eab
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
movzx ecx, word [ecx + ebx*2]
mov eax, dword [esi + ebx*4]
add ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov esi, dword [esi + ecx*4 - 4]
mov ecx, dword [ebp + 8]
add eax, edx
add esi, edx
mov edx, dword [ebp - 0x14]
push edx
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe__strnicmp]
add esp, 0xc
test eax, eax
je 0x16ee4
inc ebx
cmp ebx, dword [edi + 0x14]
jb 0x16ea5
mov eax, dword [ebp - 4]
jmp 0x16e84
movzx edx, word [esi + 1]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], edx
mov edx, dword [ebp + 0xc]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc