Function at 0xf03a06e
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
movzx ecx, word [ebp + 8]
mov edx, dword [ebp + 0xc]
and dword [ebp - 4], 0
sub ecx, 0xfffa
mov eax, dword [edx]
push ebx
push esi
mov esi, dword [0xf0ad1b8]
push edi
je 0xf03a2f5
dec ecx
je 0xf03a2b9
dec ecx
je 0xf03a225
dec ecx
je 0xf03a20d
dec ecx
je 0xf03a14e
dec ecx
je 0xf03a0c0
push 0x1e7
jmp 0xf03a218
test esi, esi
je 0xf03a2ab
mov edi, dword [ebp + 0x10]
mov ecx, 0xfffe
cmp word [esi + 8], cx
jne 0xf03a0e1
cmp dword [esi], eax
jne 0xf03a0e1
mov ecx, dword [esi + 4]
cmp ecx, dword [edi]
je 0xf03a0e8
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03a0cb
test esi, esi
je 0xf03a2ab
push dword [esi]
push 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jl 0xf03a2f0
mov ecx, dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi]
push 0x40
push 0x40000000
sub ecx, 0xc0000
push 2
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 4]
push edi
mov dword [edi], ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push eax
push 0xffffffffffffffff
push dword [0xf0ad1b4]
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jl 0xf03a2ab
mov eax, 0xffff
mov word [esi + 8], ax
jmp 0xf03a2f0
test esi, esi
je 0xf03a2ab
mov ecx, dword [ebp + 0x10]
mov edx, 0xffff
cmp word [esi + 8], dx
jne 0xf03a177
mov edx, dword [ecx]
mov edi, dword [esi]
add edx, eax
cmp edi, edx
ja 0xf03a177
mov ebx, dword [esi + 4]
add ebx, edi
cmp ebx, edx
jae 0xf03a17e
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03a159
test esi, esi
je 0xf03a2ab
push 0xfffe
push dword [ecx]
push eax
push esi
call fcn.0f039c0c
mov esi, eax
test esi, esi
je 0xf03a21e
mov eax, dword [esi]
push 0x40
push 0x40000000
push 2
sub eax, 0xc0000
mov dword [ebp - 8], eax
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 8]
push ecx
push dword [eax]
push 0
push esi
push 0xffffffffffffffff
push dword [0xf0ad1b4]
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jl 0xf03a2ab
mov eax, 0xfffe
jmp 0xf03a145
mov eax, 0xffff
cmp word [esi + 8], ax
jne 0xf03a20a
push 0x40
push 0x1000
lea eax, [esi + 4]
push eax
push 0
push esi
push 0xffffffffffffffff
call sub.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
jl 0xf03a216
mov eax, 0xfffd
mov word [esi + 8], ax
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03a1dd
jmp 0xf03a2f0
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03a301
test esi, esi
je 0xf03a216
mov ebx, dword [ebp + 0x10]
mov ecx, 0xffff
cmp word [esi + 8], cx
jne 0xf03a252
mov edx, dword [esi + 4]
mov edi, dword [ebx]
cmp edx, edi
jb 0xf03a252
test eax, eax
je 0xf03a259
mov ecx, dword [esi]
cmp eax, ecx
jb 0xf03a252
add edx, ecx
add edi, eax
cmp edi, edx
jbe 0xf03a259
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03a22c
xor edi, edi
cmp esi, edi
je 0xf03a216
cmp eax, edi
jne 0xf03a265
mov eax, dword [esi]
push 0xfffc
push dword [ebx]
push eax
push esi
call fcn.0f039c0c
mov esi, eax
cmp esi, edi
je 0xf03a21e
push 0x40
push 0x40000000
mov dword [ebp - 4], edi
mov eax, dword [esi]
push 2
sub eax, 0xc0000
mov dword [ebp - 8], eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push esi
push 0xffffffffffffffff
push dword [0xf0ad1b4]
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jge 0xf03a2b2
push 5
jmp 0xf03a218
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
jmp 0xf03a2ee
test esi, esi
je 0xf03a21e
mov eax, 0xfffd
cmp word [esi + 8], ax
je 0xf03a2d3
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03a2c1
test esi, esi
je 0xf03a21e
mov ecx, dword [ebp + 0x10]
mov eax, 0xfffb
mov word [esi + 8], ax
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0xf03a301
mov ecx, dword [ebp + 0x10]
push esi
push dword [ecx]
push eax
call fcn.0f039e12
pop edi
pop esi
pop ebx
leave
ret 0xc