Function at 0x140006f40
Capabilities:
Inspect section memory permissions

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
push r13
mov eax, 0x2f60
call fcn.14000f5f0
sub rsp, rax
mov rbx, rcx
mov esi, edx
mov r12d, r8d
mov r14w, r9w
mov r15, qword [rsp + 0x2fc0]
mov r13d, dword [rsp + 0x2fc8]
lea rdi, [rsp + 0x2d50]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2b48]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2940]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2738]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2530]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2328]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2120]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x1f18]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x1d10]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x1b08]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x1900]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x16f8]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x14f0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x12e8]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x10e0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0xed8]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0xcd0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0xac8]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x8c0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x6b8]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x4b0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0xa0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
test r12d, r12d
je 0x14000763a
mov edi, r12d
and edi, 1
cmp r13d, dword [0x1400182d8]
je 0x140007120
cmp r13d, dword [0x1400182d4]
jne 0x1400073ab
test edi, edi
je 0x140007144
mov rcx, qword [0x140022280]
mov edx, 0x278a
lea r8, [rsp + 0x2b48]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 2
je 0x14000716d
mov rcx, qword [0x140022280]
mov edx, 0x278b
lea r8, [rsp + 0x2940]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 4
je 0x140007196
mov rcx, qword [0x140022280]
mov edx, 0x278c
lea r8, [rsp + 0x2738]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 8
je 0x1400071bf
mov rcx, qword [0x140022280]
mov edx, 0x278d
lea r8, [rsp + 0x2530]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x10
je 0x1400071e8
mov rcx, qword [0x140022280]
mov edx, 0x278e
lea r8, [rsp + 0x2328]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x20
je 0x140007211
mov rcx, qword [0x140022280]
mov edx, 0x278f
lea r8, [rsp + 0x2120]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x40
je 0x14000723a
mov rcx, qword [0x140022280]
mov edx, 0x2790
lea r8, [rsp + 0x1f18]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x80
je 0x140007263
mov rcx, qword [0x140022280]
mov edx, 0x2791
lea r8, [rsp + 0x1d10]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x100
je 0x14000728c
mov rcx, qword [0x140022280]
mov edx, 0x2792
lea r8, [rsp + 0x1b08]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x200
je 0x1400072b5
mov rcx, qword [0x140022280]
mov edx, 0x2793
lea r8, [rsp + 0x1900]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x400
je 0x1400072de
mov rcx, qword [0x140022280]
mov edx, 0x2794
lea r8, [rsp + 0x16f8]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x800
je 0x140007307
mov rcx, qword [0x140022280]
mov edx, 0x2795
lea r8, [rsp + 0x14f0]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x1000
je 0x140007330
mov rcx, qword [0x140022280]
mov edx, 0x2796
lea r8, [rsp + 0x12e8]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x2000
je 0x140007359
mov rcx, qword [0x140022280]
mov edx, 0x2797
lea r8, [rsp + 0x10e0]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x4000
je 0x140007382
mov rcx, qword [0x140022280]
mov edx, 0x2798
lea r8, [rsp + 0xed8]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x8000
je 0x1400073ab
mov rcx, qword [0x140022280]
mov edx, 0x2799
lea r8, [rsp + 0xcd0]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
cmp r13d, dword [0x1400182d0]
jne 0x140007524
test edi, edi
je 0x1400073dc
mov rcx, qword [0x140022280]
mov edx, 0x279a
lea r8, [rsp + 0x2b48]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 2
je 0x140007405
mov rcx, qword [0x140022280]
mov edx, 0x279b
lea r8, [rsp + 0x2940]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 4
je 0x14000742e
mov rcx, qword [0x140022280]
mov edx, 0x279c
lea r8, [rsp + 0x2738]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 8
je 0x140007457
mov rcx, qword [0x140022280]
mov edx, 0x279d
lea r8, [rsp + 0x2530]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x10
je 0x140007480
mov rcx, qword [0x140022280]
mov edx, 0x279e
lea r8, [rsp + 0x2328]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x20
je 0x1400074a9
mov rcx, qword [0x140022280]
mov edx, 0x279f
lea r8, [rsp + 0x2120]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x40
je 0x1400074d2
mov rcx, qword [0x140022280]
mov edx, 0x27a0
lea r8, [rsp + 0x1f18]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x80
je 0x1400074fb
mov rcx, qword [0x140022280]
mov edx, 0x27a1
lea r8, [rsp + 0x1d10]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x100
je 0x140007524
mov rcx, qword [0x140022280]
mov edx, 0x27a2
lea r8, [rsp + 0x1b08]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
test r12d, 0x4000000
jne 0x140007531
xor edi, edi
jmp 0x140007556
mov rcx, qword [0x140022280]
mov edx, 0x27a3
lea r8, [rsp + 0xac8]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 1
test r12d, 0x8000000
je 0x140007584
mov rcx, qword [0x140022280]
mov edx, 0x27a4
lea r8, [rsp + 0x8c0]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 1
test r12d, 0x10000000
je 0x1400075b2
mov rcx, qword [0x140022280]
mov edx, 0x27a5
lea r8, [rsp + 0x6b8]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 1
test r12d, 0x20000000
je 0x1400075e0
mov rcx, qword [0x140022280]
mov edx, 0x27a6
lea r8, [rsp + 0x4b0]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 1
test r12d, 0x40000000
je 0x14000760e
mov rcx, qword [0x140022280]
mov edx, 0x27a7
lea r8, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 1
test r12d, r12d
jge 0x140007655
mov rcx, qword [0x140022280]
mov edx, 0x27a8
lea r8, [rsp + 0xa0]
mov r9d, 0x104
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 1
jmp 0x140007655
lea rcx, [rsp + 0x2b48]
mov edx, 0x104
lea r8, str._0
call fcn.14000e950
xor edi, edi
test esi, esi
je 0x14000775b
lea rax, [rsp + 0xcd0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xed8]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x10e0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x12e8]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x14f0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x16f8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x1900]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x1b08]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x1d10]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1f18]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x2120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2328]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2530]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2738]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2940]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b48]
mov qword [rsp + 0x20], rax
movzx r9d, r14w
lea rcx, [rsp + 0x2d50]
mov edx, 0x104
lea r8, str.SACL::ACE__d_.Access:_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls
call fcn.14000e950
jmp 0x140007854
lea rax, [rsp + 0xcd0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xed8]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x10e0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x12e8]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x14f0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x16f8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x1900]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x1b08]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x1d10]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1f18]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x2120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2328]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2530]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2738]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2940]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b48]
mov qword [rsp + 0x20], rax
movzx r9d, r14w
lea rcx, [rsp + 0x2d50]
mov edx, 0x104
lea r8, str.DACL::ACE__d_.Access:_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls_ls
call fcn.14000e950
lea rax, [rsp + 0x2d50]
mov rdx, 0xffffffffffffffff
nop dword [rax]
nop word [rax + rax]
add rdx, 1
cmp word [rax + rdx*2], 0
jne 0x140007870
mov word [rsp + rdx*2 + 0x2d4c], 0
lea rax, [rsp + 0x2d50]
mov qword [r15 + 0x28], rax
mov rcx, rbx
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, r15
mov rcx, rax
mov edx, 0x1132
xor r8, r8
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
je 0x1400079f3
test esi, esi
je 0x14000792c
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xac8]
mov qword [rsp + 0x20], rax
movzx r9d, r14w
lea rcx, [rsp + 0x2d50]
mov edx, 0x104
lea r8, str.SACL::ACE__d_.GeneralAccess:_ls_ls_ls_ls_ls_ls
call fcn.14000e950
jmp 0x140007997
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xac8]
mov qword [rsp + 0x20], rax
movzx r9d, r14w
lea rcx, [rsp + 0x2d50]
mov edx, 0x104
lea r8, str.DACL::ACE__d_.GeneralAccess:_ls_ls_ls_ls_ls_ls
call fcn.14000e950
lea rax, [rsp + 0x2d50]
mov rdx, 0xffffffffffffffff
nop
nop word [rax + rax]
add rdx, 1
cmp word [rax + rdx*2], 0
jne 0x1400079b0
mov word [rsp + rdx*2 + 0x2d4c], 0
lea rax, [rsp + 0x2d50]
mov qword [r15 + 0x28], rax
mov rcx, rbx
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, r15
mov rcx, rax
mov edx, 0x1132
xor r8, r8
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x2f60
pop r13
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret