Function at 0x14017c0e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.140002d10
nop
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x98]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.140179be0
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 1
jne 0x14017c337
mov eax, dword [rsp + 0x60]
and eax, 0xffefffff
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x14017c17a
lea rdx, [0x1402559d8]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x301bf
cmp eax, 0x301bf
jne 0x14017c1a8
lea rdx, [0x1402559e8]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffcfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x200a9
cmp eax, 0x200a9
jne 0x14017c1d6
lea rdx, str.read_execute
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x116
cmp eax, 0x116
jne 0x14017c204
lea rdx, [0x140255a18]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffffee9
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20089
cmp eax, 0x20089
jne 0x14017c232
lea rdx, [0x140255a28]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff76
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017c24e
lea rdx, str.FILE_LIST_DIRECTORY
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x14017c26a
lea rdx, str.FILE_ADD_FILE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017c286
lea rdx, str.FILE_ADD_SUBDIRECTORY
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x14017c2a2
lea rdx, str.FILE_READ_EA
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017c2be
lea rdx, [0x140255ad8]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017c2da
lea rdx, str.FILE_TRAVERSE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x14017c2f6
lea rdx, str.FILE_DELETE_CHILD
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x14017c314
lea rdx, str.FILE_READ_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x14017c332
lea rdx, str.FILE_WRITE_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.140006080
jmp 0x14017c9f1
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 4
jne 0x14017c4ac
mov eax, dword [rsp + 0x60]
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x14017c377
lea rdx, [0x140255ba0]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20019
cmp eax, 0x20019
jne 0x14017c3a5
lea rdx, [0x140255bb0]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffdffe6
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017c3c1
lea rdx, [0x140255bc0]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017c3dd
lea rdx, str.KEY_CREATE_SUB_KEY
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x14017c3f9
lea rdx, str.KEY_ENUMERATE_SUB_KEYS
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x14017c417
lea rdx, str.KEY_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017c433
lea rdx, str.KEY_NOTIFY
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017c44f
lea rdx, str.KEY_QUERY_VALUE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x14017c46d
lea rdx, str.KEY_READ
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x14017c489
lea rdx, str.KEY_SET_VALUE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20006
test eax, eax
je 0x14017c4a7
lea rdx, str.KEY_WRITE
lea rcx, [rsp + 0x20]
call fcn.140006080
jmp 0x14017c9f1
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 2
jne 0x14017c64d
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x14017c4ec
lea rdx, [0x140255cf0]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x14017c51a
lea rdx, str.start_stop
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe02
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x2018d
cmp eax, 0x2018d
jne 0x14017c548
lea rdx, [0x140255d18]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe72
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x14017c564
lea rdx, [0x140255d28]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x14017c580
lea rdx, str.SERVICE_ENUMERATE_DEPENDENTS
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x14017c59e
lea rdx, [0x140255d98]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x14017c5ba
lea rdx, str.SERVICE_PAUSE_CONTINUE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017c5d6
lea rdx, str.SERVICE_QUERY_CONFIG
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017c5f2
lea rdx, [0x140255e28]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017c60e
lea rdx, [0x140255e58]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017c62a
lea rdx, str.SERVICE_STOP
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x14017c648
lea rdx, str.SERVICE_USER_DEFINED_CONTROL
lea rcx, [rsp + 0x20]
call fcn.140006080
jmp 0x14017c9f1
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 3
jne 0x14017c75e
mov eax, dword [rsp + 0x60]
and eax, 0xf000c
cmp eax, 0xf000c
jne 0x14017c68d
lea rdx, str.manage_printer
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fff3
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf0030
cmp eax, 0xf0030
jne 0x14017c6bb
lea rdx, str.manage_documents
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffcf
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20008
cmp eax, 0x20008
jne 0x14017c6e9
lea rdx, [0x140255f20]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfff7
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017c705
lea rdx, str.PRINTER_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x14017c721
lea rdx, str.PRINTER_ACCESS_USE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017c73d
lea rdx, str.JOB_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017c759
lea rdx, str.JOB_ACCESS_READ
lea rcx, [rsp + 0x20]
call fcn.140006080
jmp 0x14017c9f1
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 5
jne 0x14017c857
mov eax, dword [rsp + 0x60]
and eax, 0x1f01ff
cmp eax, 0x1f01ff
jne 0x14017c79e
lea rdx, [0x140255fe8]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xffe0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x14017c7cc
lea rdx, str.change
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xffecfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1200a9
cmp eax, 0x1200a9
jne 0x14017c7fa
lea rdx, [0x140256008]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xffedff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1bf
test eax, eax
je 0x14017c818
lea rdx, [0x140256018]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xa9
test eax, eax
je 0x14017c836
lea rdx, str.SHARE_CHANGE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x14017c852
lea rdx, [0x140256050]
lea rcx, [rsp + 0x20]
call fcn.140006080
jmp 0x14017c9f1
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 0xb
jne 0x14017c9f1
mov eax, dword [rsp + 0x60]
and eax, 0x6003f
cmp eax, 0x6003f
jne 0x14017c897
lea rdx, [0x140256070]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfff9ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x13
cmp eax, 0x13
jne 0x14017c8bf
lea rdx, [0x140256080]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xffffffec
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x21
cmp eax, 0x21
jne 0x14017c8e7
lea rdx, str.remote_access
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xffffffde
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
cmp eax, 1
jne 0x14017c90f
lea rdx, str.enable_account
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017c92b
lea rdx, str.WBEM_ENABLE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x14017c947
lea rdx, str.WBEM_METHOD_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017c963
lea rdx, str.WBEM_FULL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x14017c97f
lea rdx, str.WBEM_PARTIAL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017c99b
lea rdx, str.WBEM_WRITE_PROVIDER
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017c9b7
lea rdx, str.WBEM_REMOTE_ACCESS
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x14017c9d3
lea rdx, str.WBEM_RIGHT_SUBSCRIBE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x14017c9f1
lea rdx, [0x140256210]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20000
test eax, eax
je 0x14017ca0f
lea rdx, str.READ_CONTROL
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x80000
test eax, eax
je 0x14017ca2d
lea rdx, [0x140256258]
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x40000
test eax, eax
je 0x14017ca4b
lea rdx, str.WRITE_DAC
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10000
test eax, eax
je 0x14017ca69
lea rdx, str.DELETE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x100000
test eax, eax
je 0x14017ca87
lea rdx, str.SYNCHRONIZE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x1000000
test eax, eax
je 0x14017caa5
lea rdx, str.ACCESS_SYSTEM_SECURITY
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x10000000
test eax, eax
je 0x14017cac3
lea rdx, str.GENERIC_ALL
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x20000000
test eax, eax
je 0x14017cae1
lea rdx, str.GENERIC_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x80000000
test eax, eax
je 0x14017caff
lea rdx, str.GENERIC_READ
lea rcx, [rsp + 0x20]
call fcn.140006080
mov eax, dword [rsp + 0x60]
and eax, 0x40000000
test eax, eax
je 0x14017cb1d
lea rdx, [0x140256358]
lea rcx, [rsp + 0x20]
call fcn.140006080
lea rdx, [0x1402559e4]
lea rcx, [rsp + 0x20]
call fcn.1400075e0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.140001430
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.140007060
mov rax, qword [rsp + 0x58]
add rsp, 0x48
ret