Function at 0x140171d40
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.140002d50
nop
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x98]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.14016f840
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 1
jne 0x140171f97
mov eax, dword [rsp + 0x60]
and eax, 0xffefffff
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x140171dda
lea rdx, [0x14023f9f8]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x301bf
cmp eax, 0x301bf
jne 0x140171e08
lea rdx, [0x14023fa08]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffcfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x200a9
cmp eax, 0x200a9
jne 0x140171e36
lea rdx, str.read_execute
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x116
cmp eax, 0x116
jne 0x140171e64
lea rdx, [0x14023fa38]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffffee9
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20089
cmp eax, 0x20089
jne 0x140171e92
lea rdx, [0x14023fa48]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff76
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140171eae
lea rdx, str.FILE_LIST_DIRECTORY
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140171eca
lea rdx, str.FILE_ADD_FILE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140171ee6
lea rdx, str.FILE_ADD_SUBDIRECTORY
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140171f02
lea rdx, str.FILE_READ_EA
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140171f1e
lea rdx, [0x14023faf8]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140171f3a
lea rdx, str.FILE_TRAVERSE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140171f56
lea rdx, str.FILE_DELETE_CHILD
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140171f74
lea rdx, str.FILE_READ_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x140171f92
lea rdx, str.FILE_WRITE_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.140005fa0
jmp 0x140172651
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 4
jne 0x14017210c
mov eax, dword [rsp + 0x60]
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x140171fd7
lea rdx, [0x14023fbc0]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20019
cmp eax, 0x20019
jne 0x140172005
lea rdx, [0x14023fbd0]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdffe6
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140172021
lea rdx, [0x14023fbe0]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017203d
lea rdx, str.KEY_CREATE_SUB_KEY
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140172059
lea rdx, str.KEY_ENUMERATE_SUB_KEYS
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x140172077
lea rdx, str.KEY_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140172093
lea rdx, str.KEY_NOTIFY
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x1401720af
lea rdx, str.KEY_QUERY_VALUE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x1401720cd
lea rdx, str.KEY_READ
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x1401720e9
lea rdx, str.KEY_SET_VALUE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20006
test eax, eax
je 0x140172107
lea rdx, str.KEY_WRITE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
jmp 0x140172651
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 2
jne 0x1401722ad
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x14017214c
lea rdx, [0x14023fd10]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x14017217a
lea rdx, str.start_stop
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe02
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x2018d
cmp eax, 0x2018d
jne 0x1401721a8
lea rdx, [0x14023fd38]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe72
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x1401721c4
lea rdx, [0x14023fd48]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401721e0
lea rdx, str.SERVICE_ENUMERATE_DEPENDENTS
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x1401721fe
lea rdx, [0x14023fdb8]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x14017221a
lea rdx, str.SERVICE_PAUSE_CONTINUE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140172236
lea rdx, str.SERVICE_QUERY_CONFIG
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140172252
lea rdx, [0x14023fe48]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017226e
lea rdx, [0x14023fe78]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017228a
lea rdx, str.SERVICE_STOP
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x1401722a8
lea rdx, str.SERVICE_USER_DEFINED_CONTROL
lea rcx, [rsp + 0x20]
call fcn.140005fa0
jmp 0x140172651
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 3
jne 0x1401723be
mov eax, dword [rsp + 0x60]
and eax, 0xf000c
cmp eax, 0xf000c
jne 0x1401722ed
lea rdx, str.manage_printer
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fff3
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf0030
cmp eax, 0xf0030
jne 0x14017231b
lea rdx, str.manage_documents
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffcf
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20008
cmp eax, 0x20008
jne 0x140172349
lea rdx, [0x14023ff40]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfff7
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140172365
lea rdx, str.PRINTER_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140172381
lea rdx, str.PRINTER_ACCESS_USE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017239d
lea rdx, str.JOB_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x1401723b9
lea rdx, str.JOB_ACCESS_READ
lea rcx, [rsp + 0x20]
call fcn.140005fa0
jmp 0x140172651
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 5
jne 0x1401724b7
mov eax, dword [rsp + 0x60]
and eax, 0x1f01ff
cmp eax, 0x1f01ff
jne 0x1401723fe
lea rdx, [0x140240008]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xffe0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x14017242c
lea rdx, str.change
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xffecfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1200a9
cmp eax, 0x1200a9
jne 0x14017245a
lea rdx, [0x140240028]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xffedff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1bf
test eax, eax
je 0x140172478
lea rdx, [0x140240038]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xa9
test eax, eax
je 0x140172496
lea rdx, str.SHARE_CHANGE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x1401724b2
lea rdx, [0x140240070]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
jmp 0x140172651
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 0xb
jne 0x140172651
mov eax, dword [rsp + 0x60]
and eax, 0x6003f
cmp eax, 0x6003f
jne 0x1401724f7
lea rdx, str.full
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfff9ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x13
cmp eax, 0x13
jne 0x14017251f
lea rdx, [0x1402400a0]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xffffffec
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x21
cmp eax, 0x21
jne 0x140172547
lea rdx, str.remote_access
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xffffffde
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
cmp eax, 1
jne 0x14017256f
lea rdx, str.enable_account
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017258b
lea rdx, str.WBEM_ENABLE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x1401725a7
lea rdx, str.WBEM_METHOD_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x1401725c3
lea rdx, str.WBEM_FULL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401725df
lea rdx, str.WBEM_PARTIAL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x1401725fb
lea rdx, str.WBEM_WRITE_PROVIDER
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140172617
lea rdx, str.WBEM_REMOTE_ACCESS
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140172633
lea rdx, str.WBEM_RIGHT_SUBSCRIBE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140172651
lea rdx, [0x140240230]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20000
test eax, eax
je 0x14017266f
lea rdx, str.READ_CONTROL
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x80000
test eax, eax
je 0x14017268d
lea rdx, [0x140240278]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x40000
test eax, eax
je 0x1401726ab
lea rdx, str.WRITE_DAC
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10000
test eax, eax
je 0x1401726c9
lea rdx, str.DELETE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x100000
test eax, eax
je 0x1401726e7
lea rdx, str.SYNCHRONIZE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x1000000
test eax, eax
je 0x140172705
lea rdx, str.ACCESS_SYSTEM_SECURITY
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x10000000
test eax, eax
je 0x140172723
lea rdx, str.GENERIC_ALL
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x20000000
test eax, eax
je 0x140172741
lea rdx, str.GENERIC_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x80000000
test eax, eax
je 0x14017275f
lea rdx, str.GENERIC_READ
lea rcx, [rsp + 0x20]
call fcn.140005fa0
mov eax, dword [rsp + 0x60]
and eax, 0x40000000
test eax, eax
je 0x14017277d
lea rdx, [0x140240378]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
lea rdx, [0x14023fa04]
lea rcx, [rsp + 0x20]
call fcn.140008040
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.140001440
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.140001470
mov rax, qword [rsp + 0x58]
add rsp, 0x48
ret