Function at 0x101aecd
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1049010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x22c], edi
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
push esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call ebx
cmp edi, esi
je 0x101b67f
cmp word [edi], si
je 0x101b67f
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x101b67f
cmp word [ebp - 0x20c], si
je 0x101b67f
mov eax, dword [ebp - 0x228]
cmp eax, esi
je 0x101b67f
cmp word [eax], si
je 0x101b67f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 0x1f8
push ebx
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x101b689
push ebx
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
test dword [ebp + 0xc], 0x80000000
mov dword [esi], 0xfeedf001
je 0x101afdf
or dword [esi + 0x194], 0x80000000
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
mov dword [ebp - 0x234], eax
je 0x101b003
or dword [esi + 0x194], 0xc0000000
mov dword [ebp - 0x220], 1
mov eax, 0x20000000
test dword [ebp + 0xc], eax
je 0x101b017
or dword [esi + 0x194], eax
or dword [ebp + 0x14], 0x40
mov eax, dword [ebp + 0x10]
dec eax
push 2
pop ecx
je 0x101b062
dec eax
je 0x101b05a
dec eax
je 0x101b04e
dec eax
je 0x101b042
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101b689
mov dword [esi + 0x198], 4
jmp 0x101b06c
mov dword [esi + 0x198], 3
jmp 0x101b06c
mov dword [esi + 0x198], ecx
jmp 0x101b06c
mov dword [esi + 0x198], 1
mov eax, dword [ebp + 0x18]
cmp eax, ecx
ja 0x101b029
test dword [ebp + 0x14], 0xffffffbd
mov dword [esi + 0x1a0], eax
jne 0x101b029
test byte [ebp + 0x14], 2
je 0x101b08e
or dword [esi + 0x19c], ecx
test byte [ebp + 0x14], 0x40
je 0x101b09b
or dword [esi + 0x19c], 0x40
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0101509b
mov dword [esi + 0x1cc], eax
test eax, eax
jne 0x101b0cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0
mov ebx, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
jmp 0x101b037
or ebx, 0xffffffff
mov dword [esi + 4], ebx
push dword [0x1049a84]
push dword [0x1049a80]
push esi
call fcn.0101d8de
test eax, eax
je 0x101b62d
cmp dword [esi + 4], ebx
je 0x101b62d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
pop eax
cmp dword [ebp + 0x10], eax
jne 0x101b116
mov dword [esi + 0x198], eax
mov dword [ebp - 0x224], 1
jmp 0x101b15b
cmp dword [ebp + 0x10], 4
jne 0x101b143
call ebx
cmp eax, 0xb7
jne 0x101b143
push 0
mov dword [esi + 0x198], 3
mov dword [ebp - 0x224], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101b15b
and dword [ebp - 0x224], 0
and dword [ebp - 0x218], 0
mov dword [esi + 0x198], 1
push esi
call fcn.0101b6d7
call fcn.010200dc
cmp dword [ebp - 0x218], 0
mov dword [esi + 0x1b0], eax
mov eax, dword [0x1049a80]
mov dword [esi + 0x1e0], eax
mov eax, dword [0x1049a84]
mov dword [esi + 0x1e4], eax
je 0x101b514
and dword [ebp - 0x21c], 0
xor eax, eax
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x220]
test edi, edi
jne 0x101b1b0
or dword [esi + 0x190], 1
lea eax, [ebp - 0x21c]
push eax
push dword [esi + 4]
call fcn.01019fd0
test eax, eax
jne 0x101b1d0
push 0xd
call fcn.01019f52
mov dword [ebp - 0x210], eax
test edi, edi
je 0x101b1f8
cmp dword [ebp - 0x210], 0
jne 0x101b27f
test byte [esi + 0x19c], 0x40
je 0x101b201
push dword [esi + 4]
call fcn.0101c6f0
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x210], 0
jne 0x101b27f
push dword [ebp - 0x214]
push esi
call fcn.0101d32e
test eax, eax
jne 0x101b266
test edi, edi
je 0x101b22f
mov eax, dword [0x1049a80]
cmp eax, dword [ebp - 0x21c]
jne 0x101b22f
mov eax, dword [0x1049a84]
cmp eax, dword [ebp - 0x218]
je 0x101b27f
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jle 0x101b245
and eax, 0xffff
or eax, 0x80070000
push 0x187
push 0x1003098
push eax
push 0x1002f90
push dword [esi + 0x1cc]
push 0
push 1
call fcn.01015538
jmp 0x101b27f
test byte [esi + 0x28], 8
je 0x101b27f
cmp dword [ebp - 0x234], 0
je 0x101b27f
mov dword [ebp - 0x210], 5
test edi, edi
je 0x101b2f4
cmp dword [ebp - 0x210], 0
jne 0x101b399
test byte [esi + 0x19c], 0x40
je 0x101b307
test byte [esi + 0x28], 0x40
je 0x101b307
cmp dword [ebp - 0x214], 0
je 0x101b2b0
push dword [esi + 4]
call fcn.0101c770
or dword [esi + 0x190], 1
push esi
call fcn.0101abff
push dword [ebp - 0x22c]
call fcn.0101ad6d
test eax, eax
jne 0x101b2ee
push dword [ebp - 0x230]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x22c]
call fcn.0101aecd
jmp 0x101b68b
push eax
jmp 0x101b037
cmp dword [ebp - 0x210], 0
jne 0x101b4fa
mov edi, dword [ebp - 0x220]
push esi
call fcn.0101c8b2
test eax, eax
je 0x101b31b
push esi
call fcn.0101ccdc
test eax, eax
jne 0x101b333
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x101b399
mov dword [ebp - 0x210], 0x570
jmp 0x101b399
test dword [esi + 0x194], 0x80000000
je 0x101b367
push esi
call fcn.0101d9b4
test eax, eax
jne 0x101b367
test edi, edi
je 0x101b38f
mov eax, dword [0x1049a80]
cmp eax, dword [ebp - 0x21c]
jne 0x101b38f
mov eax, dword [0x1049a84]
cmp eax, dword [ebp - 0x218]
jne 0x101b38f
push esi
call fcn.0101c7b0
test eax, eax
jne 0x101b399
test edi, edi
je 0x101b38f
mov eax, dword [0x1049a80]
cmp eax, dword [ebp - 0x21c]
jne 0x101b38f
mov eax, dword [0x1049a84]
cmp eax, dword [ebp - 0x218]
je 0x101b399
mov dword [ebp - 0x210], 0xd
test edi, edi
je 0x101b3e1
cmp dword [ebp - 0x210], 0
jne 0x101b4fa
test byte [esi + 0x19c], 0x40
je 0x101b3ee
push dword [ebp - 0x214]
or dword [esi + 0x28], 0x40
push esi
call fcn.0101d69c
test eax, eax
je 0x101b3d0
or dword [esi + 0x190], 8
jmp 0x101b3dd
push 0xe
call fcn.01019f52
mov dword [ebp - 0x210], eax
and dword [esi + 0x28], 0xffffffbf
cmp dword [ebp - 0x210], 0
jne 0x101b4fa
mov eax, dword [esi + 0x60]
add eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x64]
adc ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x9c]
cmp edx, ecx
mov edi, dword [esi + 0x98]
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], ecx
jl 0x101b43e
jg 0x101b41c
cmp edi, eax
jb 0x101b43e
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0xa4]
mov ebx, eax
or ebx, ecx
je 0x101b43e
add eax, edi
adc ecx, edx
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], ecx
mov edx, dword [esi + 0x124]
cmp edx, dword [esi + 0x1dc]
mov edi, dword [esi + 0x120]
jl 0x101b47e
jg 0x101b45c
cmp edi, dword [esi + 0x1d8]
jb 0x101b47e
mov eax, dword [esi + 0x128]
mov ecx, dword [esi + 0x12c]
mov ebx, eax
or ebx, ecx
je 0x101b47e
add eax, edi
adc ecx, edx
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], ecx
mov eax, dword [esi + 0x1d8]
mov dword [esi + 0x1e0], eax
mov eax, dword [esi + 0x1dc]
push esi
mov dword [esi + 0x1e4], eax
call fcn.01019755
test eax, 0x100
je 0x101b4b5
mov eax, dword [esi + 0x58]
mov dword [esi + 0x1d8], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x1dc], eax
xor edi, edi
cmp dword [ebp - 0x220], edi
je 0x101b4fa
push edi
push edi
push dword [esi + 0x1e4]
push dword [esi + 0x1e0]
push dword [esi + 4]
call fcn.0101a018
push dword [esi + 4]
call fcn.0101a0d0
push edi
push edi
push dword [esi + 0x1dc]
push dword [esi + 0x1d8]
push dword [esi + 4]
call fcn.0101a018
or dword [esi + 0x190], 0x10
cmp dword [ebp - 0x214], 0
je 0x101b5b3
push dword [esi + 4]
call fcn.0101c770
jmp 0x101b5b3
mov eax, dword [0x1003090]
mov ecx, dword [0x1003094]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x18]
dec eax
mov edi, 0xd0
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0x10d00
je 0x101b550
dec eax
jne 0x101b568
or dword [esi + 0x28], 0x40002
mov dword [esi + 0x1a0], 2
jmp 0x101b561
or dword [esi + 0x28], 0x20002
mov dword [esi + 0x1a0], 1
mov dword [esi + 0x2c], 0x8000
xor eax, eax
inc eax
mov word [esi + 0x40], ax
mov word [esi + 0x42], ax
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x101b59f
push eax
push esi
call fcn.0101d69c
test eax, eax
jne 0x101b59f
push 0xe
call fcn.01019f52
mov dword [ebp - 0x210], eax
and dword [esi + 0x1dc], 0
or dword [esi + 0x190], 0x10
mov dword [esi + 0x1d8], edi
cmp dword [ebp - 0x210], 0
jne 0x101b61c
mov eax, dword [esi + 0x28]
test eax, 0x40000
je 0x101b5d2
mov dword [esi + 0x1a0], 2
jmp 0x101b5de
shr eax, 0x11
and eax, 1
mov dword [esi + 0x1a0], eax
mov ax, word [esi + 0x40]
mov word [esi + 0x1ac], ax
mov ax, word [esi + 0x42]
mov word [esi + 0x1ae], ax
mov eax, dword [ebp - 0x230]
mov dword [esi + 0x1ec], esi
test eax, eax
je 0x101b60c
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x101b68b
or dword [esi + 0x190], 1
push esi
call fcn.0101abff
xor esi, esi
jmp 0x101b60c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x101b649
push eax
call fcn.0101a072
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x1cc]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x101b66c
push eax
push 0
call edi
push eax
call ebx
test eax, eax
je 0x101b66c
and dword [esi + 0x1cc], 0
push esi
push 0
call edi
push eax
call ebx
push dword [ebp - 0x210]
jmp 0x101b037
push 0x57
call fcn.01019f52
push eax
call ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010796
leave
ret 0x18