Function at 0x16992
Capabilities:
Map section object
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x34
push 0x1bc58
call fcn.00019e7c
xor ebx, ebx
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x16c25
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x16c25
push 1
push 8
push edi
call fcn.00013e02
test al, al
je 0x16c25
push 1
movzx eax, word [edi]
push eax
push dword [edi + 4]
call fcn.00013e02
test al, al
je 0x16c25
push 1
push 4
push esi
call fcn.00013e02
test al, al
je 0x16c25
push 0x35343332
push 0x30
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esi], eax
cmp eax, ebx
jne 0x16a0e
mov eax, 0xc000009a
jmp 0x16c2a
push 0x30
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov esi, dword [esi]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], ebx
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
mov dword [ebp - 0x44], ebx
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov dword [ebp - 0x24], eax
push 0x18
pop edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
lea eax, [esi + 8]
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 8
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jl 0x16c15
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x240
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push ebx
push ebx
push 0x20
push 1
push 3
push 0x80
push ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x80000000
push esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jl 0x16c15
mov dword [ebp - 0x3c], ebx
lea edi, [esi + 4]
push dword [esi]
push 0x4000000
push 2
push ebx
lea eax, [ebp - 0x44]
push eax
push 4
push edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jl 0x16c15
lea eax, [esi + 0x1c]
lea ecx, [esi + 0x10]
push 2
push ebx
push 2
push eax
push ebx
push ebx
push ebx
push ecx
push dword [esi + 8]
push dword [edi]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jl 0x16c15
push ebx
push ebx
push ebx
push dword [esi + 0x1c]
push dword [esi + 0x10]
call dword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x16b33
mov dword [ebp + 0xc], 0xc000009a
jmp 0x16c1a
mov dword [ebp - 4], ebx
push ebx
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov dword [ebp - 4], 0xfffffffe
jmp 0x16b62
cmp dword [ebp + 0xc], ebx
jl 0x16c1a
mov eax, dword [esi + 0xc]
test byte [eax + 6], 5
je 0x16b79
mov eax, dword [eax + 0xc]
jmp 0x16b87
push 0x10
push ebx
push ebx
push 1
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x16b27
mov dword [esi + 0x20], eax
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x16c0e
mov ecx, dword [eax + 0x3c]
mov edx, dword [esi + 0x1c]
cmp ecx, edx
jae 0x16c0e
add ecx, eax
mov dword [esi + 0x24], ecx
cmp dword [ecx], 0x4550
jne 0x16bf2
mov edi, dword [ecx + 0x54]
add edi, dword [eax + 0x3c]
cmp edi, edx
jae 0x16bf2
movzx eax, word [ecx + 0x18]
mov ecx, 0x20b
cmp cx, ax
jne 0x16be8
mov byte [esi + 0x18], 1
mov eax, dword [esi + 0x24]
cmp byte [esi + 0x18], bl
je 0x16bfb
add eax, 0x88
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x24]
add eax, 0x108
jmp 0x16c09
mov ecx, 0x10b
cmp ax, cx
je 0x16bce
mov dword [ebp + 0xc], 0xc0000001
jmp 0x16c1a
add eax, 0x78
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x24]
add eax, 0xf8
mov dword [esi + 0x2c], eax
jmp 0x16c15
mov dword [ebp + 0xc], 0xc0000001
cmp dword [ebp + 0xc], ebx
jge 0x16c20
push esi
call fcn.00016722
mov eax, dword [ebp + 0xc]
jmp 0x16c2a
mov eax, 0xc0000005
call fcn.00019ec1
ret 8