Function at 0x662040c0
Capabilities:
Map section object

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x662164db
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
push edi
xor edi, edi
cmp ebp, edi
je 0x662040fb
cmp dword [esp + 0x1c0], 0xffffffff
mov byte [esp + 0x13], 1
je 0x66204100
mov byte [esp + 0x13], 0
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.66207ee0
mov dword [esp + 0x1b0], edi
cmp byte [esp + 0x13], 0
mov ebx, dword [esp + 0x1bc]
je 0x66204176
push edi
push ebx
lea eax, [esp + 0x90]
push eax
mov eax, ebp
cdq
push edi
push edx
push eax
lea ecx, [esp + 0x40]
call fcn.66208050
mov esi, eax
cmp esi, edi
jge 0x6620415c
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662083e0
mov eax, esi
jmp 0x66204315
lea ecx, [esp + 0x88]
call fcn.66207a40
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x1c0], ecx
movzx esi, byte [esp + 0x1d0]
mov edx, dword [esp + 0x1c0]
neg esi
push edi
sbb esi, esi
push 0x8000000
and esi, 0xffffffc4
add esi, 0x40
push esi
lea eax, [esp + 0x2c]
push eax
push edi
push 0xf
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x662041d4
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.662083e0
mov eax, edi
jmp 0x66204315
mov ecx, dword [esp + 0x18]
push esi
push 0x100000
push 2
lea edx, [esp + 0x28]
push edx
push eax
push eax
push 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
or edi, 0xffffffff
push edi
push ecx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
test esi, esi
jge 0x66204229
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662083e0
mov eax, esi
jmp 0x66204315
cmp byte [esp + 0x13], 0
je 0x6620427b
mov eax, dword [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x90]
push ebp
push ecx
call fcn.66208280
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x662042b2
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662083e0
mov eax, esi
jmp 0x66204315
test ebp, ebp
je 0x662042b2
test ebx, ebx
je 0x6620429c
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x14]
push ecx
push edx
push ebx
push ebp
call fcn.662092a0
add esp, 0x10
jmp 0x662042b2
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call fcn.6620bc70
add esp, 0xc
mov eax, dword [esp + 0x1c4]
test eax, eax
jne 0x662042ca
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x662042d0
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x1c8]
test eax, eax
jne 0x662042e9
mov edx, dword [esp + 0x14]
push edx
push edi
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x662042ef
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x1cc]
test eax, eax
je 0x66204303
mov edx, dword [esp + 0x1c0]
mov dword [eax], edx
mov dword [esp + 0x1b0], edi
lea ecx, [esp + 0x28]
call fcn.662083e0
xor eax, eax
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a4
ret