Function at 0x66204100
Capabilities:
Map section object

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x662166fb
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
push edi
xor edi, edi
cmp ebp, edi
je 0x6620413b
cmp dword [esp + 0x1c0], 0xffffffff
mov byte [esp + 0x13], 1
je 0x66204140
mov byte [esp + 0x13], 0
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.66207fa0
mov dword [esp + 0x1b0], edi
cmp byte [esp + 0x13], 0
mov ebx, dword [esp + 0x1bc]
je 0x662041b6
push edi
push ebx
lea eax, [esp + 0x90]
push eax
mov eax, ebp
cdq
push edi
push edx
push eax
lea ecx, [esp + 0x40]
call fcn.66208110
mov esi, eax
cmp esi, edi
jge 0x6620419c
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662084a0
mov eax, esi
jmp 0x66204355
lea ecx, [esp + 0x88]
call fcn.66207b00
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x1c0], ecx
movzx esi, byte [esp + 0x1d0]
mov edx, dword [esp + 0x1c0]
neg esi
push edi
sbb esi, esi
push 0x8000000
and esi, 0xffffffc4
add esi, 0x40
push esi
lea eax, [esp + 0x2c]
push eax
push edi
push 0xf
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x66204214
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662084a0
mov eax, edi
jmp 0x66204355
mov ecx, dword [esp + 0x18]
push esi
push 0x100000
push 2
lea edx, [esp + 0x28]
push edx
push eax
push eax
push 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
or edi, 0xffffffff
push edi
push ecx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
test esi, esi
jge 0x66204269
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662084a0
mov eax, esi
jmp 0x66204355
cmp byte [esp + 0x13], 0
je 0x662042bb
mov eax, dword [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x90]
push ebp
push ecx
call fcn.66208340
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x662042f2
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662084a0
mov eax, esi
jmp 0x66204355
test ebp, ebp
je 0x662042f2
test ebx, ebx
je 0x662042dc
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x14]
push ecx
push edx
push ebx
push ebp
call fcn.66209360
add esp, 0x10
jmp 0x662042f2
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call fcn.6620be90
add esp, 0xc
mov eax, dword [esp + 0x1c4]
test eax, eax
jne 0x6620430a
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204310
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x1c8]
test eax, eax
jne 0x66204329
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x6620432f
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x1cc]
test eax, eax
je 0x66204343
mov edx, dword [esp + 0x1c0]
mov dword [eax], edx
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662084a0
xor eax, eax
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a4
ret