Function at 0x405f50
Capabilities:
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0x4351a9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x449fb0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x10], ebx
call fcn.00414de3
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x405f9c
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [esp + 0x44]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, 0x20006
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x120089
mov dword [esp + 0x18], 0x120116
mov dword [esp + 0x1c], 0x1200a0
mov dword [esp + 0x20], 0x1f01ff
mov dword [esp + 0x24], 0x120019
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x20019
mov dword [esp + 0x30], 0xf003f
cmp eax, 1
jne 0x406188
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov eax, dword [esp + 0x48]
and eax, 0xffefffff
mov dword [esp + 0x48], eax
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x406044
push 0x438f14
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfff0fe00
mov eax, dword [esp + 0x48]
and eax, 0x301bf
cmp eax, 0x301bf
jne 0x406068
push 0x438f04
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffcfe40
mov ecx, dword [esp + 0x48]
and ecx, 0x200a9
cmp ecx, 0x200a9
jne 0x40608e
push str.read_execute
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffdff56
mov edx, dword [esp + 0x48]
and edx, 0x116
cmp edx, 0x116
jne 0x4060b4
push 0x438ed8
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffffee9
mov eax, dword [esp + 0x48]
and eax, 0x20089
cmp eax, 0x20089
jne 0x4060d8
push 0x438ecc
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffdff76
test byte [esp + 0x48], 1
je 0x4060eb
push str.FILE_LIST_DIRECTORY
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 2
je 0x4060fe
push str.FILE_ADD_FILE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 4
je 0x406111
push str.FILE_ADD_SUBDIRECTORY
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 8
je 0x406124
push str.FILE_READ_EA
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x10
je 0x406137
push str.FILE_WRITE_EA
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x20
je 0x40614a
push str.FILE_TRAVERSE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x40
je 0x40615d
push str.FILE_DELETE_CHILD
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x80
je 0x406170
push str.FILE_READ_ATTRIBUTES
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x100
je 0x406542
push str.FILE_WRITE_ATTRIBUTES
jmp 0x40653b
cmp eax, 4
jne 0x40629d
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov eax, dword [esp + 0x48]
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x4061c5
push 0x438f14
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfff0ffc0
mov ecx, dword [esp + 0x48]
and ecx, 0x20019
cmp ecx, 0x20019
jne 0x4061eb
push 0x438ecc
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffdffe6
test byte [esp + 0x48], 0x20
je 0x4061fe
push str.KEY_CREATE_LINK
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 4
je 0x406211
push str.KEY_CREATE_SUB_KEY
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 8
je 0x406224
push str.KEY_ENUMERATE_SUB_KEYS
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x20019
je 0x40623a
push str.KEY_EXECUTE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x10
je 0x40624d
push str.KEY_NOTIFY
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 1
je 0x406260
push str.KEY_QUERY_VALUE
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x20019
je 0x406276
push str.KEY_READ
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 2
je 0x406289
push str.KEY_SET_VALUE
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], ebx
je 0x406542
push str.KEY_WRITE
jmp 0x40653b
cmp eax, 2
jne 0x4063c6
mov edx, dword [esp + 0x48]
and edx, 0xf01ff
cmp edx, 0xf01ff
jne 0x4062cc
push 0x438f14
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfff0fe00
mov eax, dword [esp + 0x48]
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x4062f0
push 0x438c38
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffdfe02
mov ecx, dword [esp + 0x48]
and ecx, 0x2018d
cmp ecx, 0x2018d
jne 0x406316
push 0x438ecc
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffdfe72
test byte [esp + 0x48], 2
je 0x406329
push str.SERVICE_CHANGE_CONFIG
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 8
je 0x40633c
push str.SERVICE_ENUMERATE_DEPENDENTS
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x80
je 0x40634f
push str.SERVICE_INTERROGATE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x40
je 0x406362
push str.SERVICE_PAUSE_CONTINUE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 1
je 0x406375
push str.SERVICE_QUERY_CONFIG
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 4
je 0x406388
push str.SERVICE_QUERY_STATUS
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x10
je 0x40639b
push str.SERVICE_START
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x20
je 0x4063ae
push str.SERVICE_STOP
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x100
je 0x406542
push str.SERVICE_USER_DEFINED_CONTROL
jmp 0x40653b
cmp eax, 3
jne 0x40648d
mov edx, dword [esp + 0x48]
and edx, 0xf000c
cmp edx, 0xf000c
jne 0x4063f5
push str.manage_printer
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfff0fff3
mov eax, dword [esp + 0x48]
and eax, 0xf0030
cmp eax, 0xf0030
jne 0x406419
push str.manage_documents
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfff0ffcf
mov ecx, dword [esp + 0x48]
and ecx, 0x20008
cmp ecx, 0x20008
jne 0x40643f
push 0x438a4c
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xfffdfff7
test byte [esp + 0x48], 4
je 0x406452
push str.PRINTER_ACCESS_ADMINISTER
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 8
je 0x406465
push str.PRINTER_ACCESS_USE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x10
je 0x406478
push str.JOB_ACCESS_ADMINISTER
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x20
je 0x406542
push str.JOB_ACCESS_READ
jmp 0x40653b
cmp eax, 5
jne 0x40662a
mov edx, dword [esp + 0x48]
and edx, 0x1f01ff
cmp edx, 0x1f01ff
jne 0x4064bc
push 0x438f14
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xffe0fe00
mov eax, dword [esp + 0x48]
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x4064e0
push 0x438f04
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xffecfe40
mov ecx, dword [esp + 0x48]
and ecx, 0x1200a9
cmp ecx, 0x1200a9
jne 0x406506
push 0x438ecc
mov ecx, esi
call fcn.00404560
and dword [esp + 0x48], 0xffedff56
test dword [esp + 0x48], 0x1bf
je 0x40651c
push str.SHARE_READ
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0xa9
je 0x40652f
push str.SHARE_CHANGE
mov ecx, esi
call fcn.004045c0
test byte [esp + 0x48], 0x40
je 0x406542
push str.SHARE_WRITE
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x20000
je 0x406558
push str.READ_CONTROL
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x80000
je 0x40656e
push str.WRITE_OWNER
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x40000
je 0x406584
push str.WRITE_DAC
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x10000
je 0x40659a
push str.DELETE
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x100000
je 0x4065b0
push str.SYNCHRONIZE
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x1000000
je 0x4065c6
push str.ACCESS_SYSTEM_SECURITY
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x10000000
je 0x4065dc
push str.GENERIC_ALL
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x20000000
je 0x4065f2
push str.GENERIC_EXECUTE
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x80000000
je 0x406608
push str.GENERIC_READ
mov ecx, esi
call fcn.004045c0
test dword [esp + 0x48], 0x40000000
je 0x40661e
push 0x438820
mov ecx, esi
call fcn.004045c0
push 0x43881c
mov ecx, esi
call fcn.00403570
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret 8