Function at 0x406e8f
Capabilities:
Inspect section memory permissions

Disassembly:
push 0x24
mov eax, 0x42eed6
call fcn.0041ae41
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
mov ecx, esi
call fcn.00408753
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x50]
cmp eax, 1
mov ecx, 0x1f01ff
mov ebx, 0x20019
mov edi, 0xf003f
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], 0x120089
mov dword [ebp - 0x1c], 0x120116
mov dword [ebp - 0x18], 0x1200a0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x30], 0x120019
mov dword [ebp - 0x2c], 0x20006
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
jne 0x40705e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
and dword [ebp + 0x10], 0xffefffff
mov ecx, dword [ebp + 0x10]
mov eax, 0xf01ff
and ecx, eax
cmp ecx, eax
jne 0x406f34
push str.full
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfff0fe00
mov ecx, dword [ebp + 0x10]
mov eax, 0x301bf
and ecx, eax
cmp ecx, eax
jne 0x406f55
push str.change
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffcfe40
mov ecx, dword [ebp + 0x10]
mov eax, 0x200a9
and ecx, eax
cmp ecx, eax
jne 0x406f76
push str.read_execute
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffdff56
mov ecx, dword [ebp + 0x10]
mov eax, 0x116
and ecx, eax
cmp ecx, eax
jne 0x406f97
push str.write
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffffee9
mov ecx, dword [ebp + 0x10]
mov eax, 0x20089
and ecx, eax
cmp ecx, eax
jne 0x406fb8
push str.read
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffdff76
test byte [ebp + 0x10], 1
je 0x406fca
push str.FILE_LIST_DIRECTORY
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 2
je 0x406fdc
push str.FILE_ADD_FILE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 4
je 0x406fee
push str.FILE_ADD_SUBDIRECTORY
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 8
je 0x407000
push str.FILE_READ_EA
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x10
je 0x407012
push str.FILE_WRITE_EA
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x20
je 0x407024
push str.FILE_TRAVERSE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x40
je 0x407036
push str.FILE_DELETE_CHILD
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x80
je 0x407048
push str.FILE_READ_ATTRIBUTES
mov ecx, esi
call fcn.004090a5
test word [ebp + 0x10], 0x100
je 0x4073b9
push str.FILE_WRITE_ATTRIBUTES
jmp 0x4073b2
cmp eax, 4
jne 0x407152
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov eax, dword [ebp + 0x10]
and eax, edi
cmp eax, edi
jne 0x407091
push str.full
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfff0ffc0
mov eax, dword [ebp + 0x10]
and eax, ebx
cmp eax, ebx
jne 0x4070ad
push str.read
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffdffe6
test byte [ebp + 0x10], 0x20
je 0x4070bf
push 0x4355f8
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 4
je 0x4070d1
push str.KEY_CREATE_SUB_KEY
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 8
je 0x4070e3
push str.KEY_ENUMERATE_SUB_KEYS
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], ebx
je 0x4070f4
push str.KEY_EXECUTE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x10
je 0x407106
push str.KEY_NOTIFY
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 1
je 0x407118
push str.KEY_QUERY_VALUE
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], ebx
je 0x407129
push str.KEY_READ
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 2
je 0x40713b
push str.KEY_SET_VALUE
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x20006
je 0x4073b9
push str.KEY_WRITE
jmp 0x4073b2
cmp eax, 2
jne 0x407264
mov ecx, dword [ebp + 0x10]
mov eax, 0xf01ff
and ecx, eax
cmp ecx, eax
jne 0x40717c
push str.full
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfff0fe00
mov ecx, dword [ebp + 0x10]
mov eax, 0x201fd
and ecx, eax
cmp ecx, eax
jne 0x40719d
push str.start_stop
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffdfe02
mov ecx, dword [ebp + 0x10]
mov eax, 0x2018d
and ecx, eax
cmp ecx, eax
jne 0x4071be
push str.read
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffdfe72
test byte [ebp + 0x10], 2
je 0x4071d0
push str.SERVICE_CHANGE_CONFIG
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 8
je 0x4071e2
push str.SERVICE_ENUMERATE_DEPENDENTS
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x80
je 0x4071f4
push str.SERVICE_INTERROGATE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x40
je 0x407206
push str.SERVICE_PAUSE_CONTINUE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 1
je 0x407218
push str.SERVICE_QUERY_CONFIG
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 4
je 0x40722a
push str.SERVICE_QUERY_STATUS
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x10
je 0x40723c
push str.SERVICE_START
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x20
je 0x40724e
push str.SERVICE_STOP
mov ecx, esi
call fcn.004090a5
test word [ebp + 0x10], 0x100
je 0x4073b9
push str.SERVICE_USER_DEFINED_CONTROL
jmp 0x4073b2
cmp eax, 3
jne 0x40731a
mov ecx, dword [ebp + 0x10]
mov eax, 0xf000c
and ecx, eax
cmp ecx, eax
jne 0x40728e
push str.manage_printer
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfff0fff3
mov ecx, dword [ebp + 0x10]
mov eax, 0xf0030
and ecx, eax
cmp ecx, eax
jne 0x4072af
push str.manage_documents
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfff0ffcf
mov ecx, dword [ebp + 0x10]
mov eax, 0x20008
and ecx, eax
cmp ecx, eax
jne 0x4072d0
push str.print
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xfffdfff7
test byte [ebp + 0x10], 4
je 0x4072e2
push str.PRINTER_ACCESS_ADMINISTER
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 8
je 0x4072f4
push str.PRINTER_ACCESS_USE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x10
je 0x407306
push str.JOB_ACCESS_ADMINISTER
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x20
je 0x4073b9
push str.JOB_ACCESS_READ
jmp 0x4073b2
cmp eax, 5
jne 0x407497
mov eax, dword [ebp + 0x10]
and eax, ecx
cmp eax, ecx
jne 0x40733f
push str.full
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xffe0fe00
mov ecx, dword [ebp + 0x10]
mov eax, 0x1301bf
and ecx, eax
cmp ecx, eax
jne 0x407360
push str.change
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xffecfe40
mov ecx, dword [ebp + 0x10]
mov eax, 0x1200a9
and ecx, eax
cmp ecx, eax
jne 0x407381
push str.read
mov ecx, esi
call fcn.0040910e
and dword [ebp + 0x10], 0xffedff56
test word [ebp + 0x10], 0x1bf
je 0x407395
push str.SHARE_READ
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0xa9
je 0x4073a7
push str.SHARE_CHANGE
mov ecx, esi
call fcn.004090a5
test byte [ebp + 0x10], 0x40
je 0x4073b9
push str.SHARE_WRITE
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x20000
je 0x4073ce
push str.READ_CONTROL
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x80000
je 0x4073e3
push str.WRITE_OWNER
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x40000
je 0x4073f8
push str.WRITE_DAC
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x10000
je 0x40740d
push str.DELETE
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x100000
je 0x407422
push str.SYNCHRONIZE
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x1000000
je 0x407437
push str.ACCESS_SYSTEM_SECURITY
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x10000000
je 0x40744c
push str.GENERIC_ALL
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x20000000
je 0x407461
push str.GENERIC_EXECUTE
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x80000000
je 0x407476
push str.GENERIC_READ
mov ecx, esi
call fcn.004090a5
test dword [ebp + 0x10], 0x40000000
je 0x40748b
push str.GENERIC_WRITE
mov ecx, esi
call fcn.004090a5
push 0x4355f4
mov ebx, esi
call fcn.00408ab0
mov eax, esi
call fcn.0041aee0
ret 0xc