Function at 0x1400ab330
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, rcx
mov r15, qword [r9 + 0x10]
mov r12, qword [r9 + 0x20]
cmp r12, r15
jae 0x1400ab3cc
mov rax, qword [r9 + 8]
movzx ebx, byte [rax + r12]
mov eax, dword [r9]
mov r10d, dword [r9 + 4]
mov rcx, qword [rdx + 0x298]
or rcx, qword [rdx + 0x2a8]
mov r11, qword [rdx + 0x290]
or r11, qword [rdx + 0x2a0]
or r11, rcx
je 0x1400ab3e2
lea r11, [rdx + 0x290]
mov esi, ebx
shr esi, 3
and esi, 0xfffffff0
mov edi, 1
mov r13, r14
xor r14d, r14d
mov ecx, ebx
shld r14, rdi, cl
shl rdi, cl
xor ecx, ecx
test bl, 0x40
cmovne r14, rdi
cmovne rdi, rcx
and r14, qword [r11 + rsi + 8]
and rdi, qword [r11 + rsi]
or rdi, r14
mov r14, r13
je 0x1400ab3e2
mov eax, 4
jmp 0x1400ab891
mov eax, dword [r9]
mov r10d, dword [r9 + 4]
mov cl, 2
movzx r11d, cl
mov rcx, r11
test eax, eax
jne 0x1400ab3f5
jmp 0x1400ab402
movzx ecx, byte [rdx + rbx + 0x90]
movzx r11d, cl
mov rcx, r11
test eax, eax
je 0x1400ab402
cmp eax, 1
jne 0x1400ab630
lea rcx, [r11 + 6]
cmp rcx, qword [r8 + 0x40]
jae 0x1400abd1c
mov rsi, qword [r8 + 0x38]
mov ebx, dword [rsi + rcx*4]
test ebx, ebx
js 0x1400ab853
mov r13, qword [r9 + 0x18]
cmp r13, r12
jne 0x1400ab492
test r12, r12
je 0x1400ab706
lea rsi, [r12 - 1]
cmp rsi, r15
jae 0x1400abd1c
mov rax, qword [r9 + 8]
movzx edi, byte [rax + rsi]
movzx ecx, byte [rdx + rdi + 0x190]
mov eax, ebx
and eax, 0x7ffffff
add rax, rcx
cmp rax, qword [r8 + 0x28]
jae 0x1400abd1c
mov rcx, qword [r8 + 0x20]
mov ecx, dword [rcx + rax*4]
test ecx, ecx
js 0x1400ab945
mov r10d, ecx
test r10d, 0x8000000
jne 0x1400abac5
test r10d, 0x20000000
jne 0x1400ab79a
xor eax, eax
jmp 0x1400abc30
dec r12
mov rsi, qword [r9 + 8]
mov r11, qword [rdx + 0x2b0]
mov rcx, qword [rdx + 0x2b8]
and ecx, 0x3f
xor eax, eax
mov qword [rsp + 0x38], rax
nop word cs:[rax + rax]
cmp r12, r15
jae 0x1400abd1c
movzx eax, byte [rsi + r12]
movzx r9d, byte [rdx + rax + 0x190]
mov r10d, ebx
and r10d, 0x7ffffff
add r10, r9
cmp r10, qword [r8 + 0x28]
jae 0x1400abd1c
mov r9, qword [r8 + 0x20]
mov ebp, dword [r9 + r10*4]
test ebp, ebp
js 0x1400ab5bf
cmp ebp, 0x7ffffff
jbe 0x1400ab59e
mov eax, ebp
test eax, 0x8000000
jne 0x1400ab530
test eax, 0x40000000
jne 0x1400ab83d
test eax, 0x20000000
je 0x1400ab59e
jmp 0x1400ab91c
xor edi, edi
cmp qword [r11 + 0x168], 1
je 0x1400ab58a
mov eax, ebp
and eax, 0x7ffffff
shr rax, cl
cmp rax, qword [r8 + 0x58]
jae 0x1400abd1c
mov r9, qword [r8 + 0x50]
shl eax, 4
mov r10, qword [r9 + rax + 8]
test r10, r10
je 0x1400abd1c
mov rax, qword [r9 + rax]
test byte [rax + 0x10], 2
je 0x1400ab58a
cmp r10, 0xd
jb 0x1400abd1c
add r10, 0xfffffffffffffff3
cmp r10, 3
jbe 0x1400abd1c
mov edi, dword [rax + 0x1d]
lea rax, [r12 + 1]
mov qword [rsp + 0x40], rax
mov eax, 1
mov qword [rsp + 0x38], rax
cmp r13, r12
je 0x1400ab659
dec r12
mov ebx, ebp
cmp r12, qword [rsp + 0xd0]
jae 0x1400ab4c0
jmp 0x1400ab829
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], r15
mov r15d, edi
mov qword [rsp + 0x48], r14
shl eax, 8
mov rdi, rdx
mov qword [rsp + 0x28], rdx
mov r14, r8
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x28]
mov edx, ebx
mov r8d, eax
call fcn.1400a2c70
test eax, eax
jne 0x1400ab9aa
mov ebp, edx
mov r8, r14
mov rdx, rdi
mov r14, qword [rsp + 0x48]
mov edi, r15d
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
cmp ebp, 0x7ffffff
ja 0x1400ab50a
jmp 0x1400ab59e
test byte [rdx + 0x81], 1
mov ebx, r10d
jne 0x1400ab74d
mov rax, rbx
shl rax, 0x20
or rax, 2
cmp eax, 5
je 0x1400ab41b
jmp 0x1400ab891
test r13, r13
je 0x1400ab7c5
movzx esi, byte [rsi + r13 - 1]
movzx r9d, byte [rdx + rsi + 0x190]
mov eax, ebp
and eax, 0x7ffffff
add rax, r9
cmp rax, qword [r8 + 0x28]
jae 0x1400abd1c
mov r9, qword [r8 + 0x20]
mov r9d, dword [r9 + rax*4]
test r9d, r9d
js 0x1400aba55
mov r10d, r9d
test r10d, 0x8000000
jne 0x1400abc5e
test r10d, 0x20000000
je 0x1400ab801
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
dec r13
mov byte [rax], 0
mov byte [rax + 1], sil
mov qword [rax + 8], r13
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rax
call sub.KERNEL32.dll_HeapFree
mov qword [r14 + 8], 1
mov qword [r14 + 0x10], r13
mov qword [r14], 2
jmp 0x1400abcf0
movzx r9d, byte [rdx + 0x28f]
mov eax, ebx
and eax, 0x7ffffff
add rax, r9
inc rax
cmp qword [r8 + 0x28], rax
jbe 0x1400abd1c
mov rcx, qword [r8 + 0x20]
mov r10d, dword [rcx + rax*4]
test r10d, r10d
js 0x1400ab9fc
xor r9d, r9d
test r10d, 0x8000000
jne 0x1400abbb3
xor eax, eax
jmp 0x1400abc30
mov rcx, qword [rdx + 0x2b0]
cmp qword [rcx + 0x168], rbx
jbe 0x1400ab778
lea rcx, [rbx + rbx*2]
lea rcx, [r11 + rcx*2]
add rcx, 0xc
cmp rcx, qword [r8 + 0x40]
jb 0x1400ab40c
jmp 0x1400abd1c
mov rax, qword [rdx + 0x2b8]
and eax, 0x3f
cmp rax, 0x1b
jae 0x1400abd1c
mov ebx, 0x40000000
bts rbx, rax
jmp 0x1400ab41b
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 0
mov byte [rax + 1], dil
mov r12, rsi
jmp 0x1400ab8ef
movzx r9d, byte [rdx + 0x28f]
mov eax, ebp
and eax, 0x7ffffff
add eax, r9d
inc eax
cmp qword [r8 + 0x28], rax
jbe 0x1400abd1c
mov r10, qword [r8 + 0x20]
mov r10d, dword [r10 + rax*4]
test r10d, r10d
js 0x1400abb3e
test r10d, 0x8000000
jne 0x1400abc9a
test ebp, 0x40000000
jne 0x1400ab99b
mov rax, qword [rsp + 0x38]
test rax, rax
mov rcx, qword [rsp + 0x40]
je 0x1400abce5
cmp rcx, r13
jbe 0x1400abce5
mov qword [r14 + 8], 0
mov qword [r14], 2
jmp 0x1400abcf0
mov rax, qword [rsp + 0x38]
mov qword [r14], rax
mov rax, qword [rsp + 0x40]
mov qword [r14 + 8], rax
jmp 0x1400abcec
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x28]
mov rsi, rdx
mov edx, eax
mov rdi, r8
mov r8d, r10d
mov rbx, r9
mov r9d, r11d
call fcn.1400a3fa0
mov r9, rbx
mov rdx, rsi
mov r8, rdi
mov rbx, rax
shr rbx, 0x20
cmp eax, 5
je 0x1400ab41b
lea edx, [rax - 3]
cmp edx, 2
mov ecx, 2
cmovb ecx, edx
test ecx, ecx
je 0x1400ab8d0
cmp ecx, 1
jne 0x1400abd01
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 0
mov byte [rax + 1], bl
jmp 0x1400ab8ef
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 1
mov qword [rax + 8], r12
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rax
call sub.KERNEL32.dll_HeapFree
mov qword [r14 + 8], 1
mov qword [r14 + 0x10], r12
mov qword [r14], 2
jmp 0x1400abcf0
movzx ebx, byte [rsi + r12]
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 0
mov byte [rax + 1], bl
jmp 0x1400ab8ef
mov r13, r14
mov eax, edi
shl eax, 8
mov r14, rdx
mov qword [rsp + 0x28], rdx
mov r15, r8
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x28]
mov edx, ebx
mov r8d, eax
call fcn.1400a2c70
test eax, eax
je 0x1400abaaa
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 1
mov r14, r13
jmp 0x1400ab8ef
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
jmp 0x1400abce5
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 1
mov qword [rax + 8], r12
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rax
call sub.KERNEL32.dll_HeapFree
mov r13, qword [rsp + 0x48]
mov qword [r13 + 8], 1
mov qword [r13 + 0x10], r12
mov qword [r13], 2
jmp 0x1400abcf0
inc r9
shl r9d, 0x10
or r9d, 1
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov rdi, r8
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x28]
mov edx, ebx
mov r8d, r9d
call fcn.1400a2c70
test eax, eax
je 0x1400abb9a
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 1
xor r12d, r12d
jmp 0x1400ab8ef
mov r12, r11
mov r15, rcx
mov ebx, edi
mov eax, esi
shl eax, 8
mov qword [rsp + 0x28], rdx
mov rdi, r8
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x28]
mov edx, ebp
mov r8d, eax
call fcn.1400a2c70
test eax, eax
je 0x1400abc40
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 1
jmp 0x1400ab6d9
mov ecx, edx
mov r8, r15
mov rdx, r14
mov r14, r13
mov r10d, ecx
test r10d, 0x8000000
je 0x1400ab47e
mov rcx, qword [rdx + 0x2b0]
mov eax, 1
xor r9d, r9d
cmp qword [rcx + 0x168], 1
je 0x1400abc30
and r10d, 0x7ffffff
movzx ecx, byte [rdx + 0x2b8]
shr r10, cl
cmp r10, qword [r8 + 0x58]
jae 0x1400abd1c
mov rcx, qword [r8 + 0x50]
shl r10d, 4
mov rdx, qword [rcx + r10 + 8]
test rdx, rdx
je 0x1400abd1c
mov rcx, qword [rcx + r10]
test byte [rcx + 0x10], 2
je 0x1400abc30
cmp rdx, 0xd
jb 0x1400abd1c
add rdx, 0xfffffffffffffff3
cmp rdx, 3
ja 0x1400abc2c
jmp 0x1400abd1c
mov r15, r11
mov rbx, rcx
inc r9d
shl r9d, 0x10
or r9d, 1
mov qword [rsp + 0x28], rdx
mov rsi, r8
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x28]
mov edx, ebp
mov r8d, r9d
call fcn.1400a2c70
test eax, eax
je 0x1400abc81
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x1400abd1c
mov byte [rax], 1
xor r13d, r13d
jmp 0x1400ab6d9
mov r10d, edx
mov r8, rdi
mov rdx, rsi
xor r9d, r9d
test r10d, 0x8000000
je 0x1400ab746
mov rcx, qword [rdx + 0x2b0]
mov eax, 1
cmp qword [rcx + 0x168], 1
jne 0x1400abbce
xor r12d, r12d
jmp 0x1400abc30
and r10d, 0x7ffffff
movzx ecx, byte [rdx + 0x2b8]
shr r10, cl
cmp r10, qword [r8 + 0x58]
jae 0x1400abd1c
mov rcx, qword [r8 + 0x50]
shl r10d, 4
mov rdx, qword [rcx + r10 + 8]
test rdx, rdx
je 0x1400abd1c
mov rcx, qword [rcx + r10]
test byte [rcx + 0x10], 2
jne 0x1400abc11
xor r9d, r9d
xor r12d, r12d
jmp 0x1400abc30
cmp rdx, 0xd
jb 0x1400abd1c
add rdx, 0xfffffffffffffff3
cmp rdx, 3
jbe 0x1400abd1c
xor r12d, r12d
mov r9d, dword [rcx + 0x1d]
mov qword [r14], rax
mov qword [r14 + 8], r12
mov dword [r14 + 0x10], r9d
jmp 0x1400abcf0
mov r9d, edx
mov r8, rdi
mov edi, ebx
mov rcx, r15
mov r11, r12
mov r10d, r9d
test r10d, 0x8000000
je 0x1400ab6a6
cmp qword [r11 + 0x168], 1
jne 0x1400abc6c
xor edi, edi
jmp 0x1400abcdd
and r10d, 0x7ffffff
shr r10, cl
cmp r10, qword [r8 + 0x58]
jb 0x1400abcc2
jmp 0x1400abd1c
mov r10d, edx
mov r8, rsi
mov rcx, rbx
mov r11, r15
test r10d, 0x8000000
je 0x1400ab801
cmp qword [r11 + 0x168], 1
jne 0x1400abcaf
xor ecx, ecx
mov eax, 1
xor edi, edi
jmp 0x1400abce5
and r10d, 0x7ffffff
shr r10, cl
cmp r10, qword [r8 + 0x58]
jae 0x1400abd1c
xor r13d, r13d
mov rax, qword [r8 + 0x50]
shl r10d, 4
mov rcx, qword [rax + r10]
mov rdx, qword [rax + r10 + 8]
xor r8d, r8d
call fcn.1400c5b80
mov edi, eax
mov eax, 1
mov rcx, r13
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov dword [r14 + 0x10], edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rax
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
jne 0x1400abd1e
ud2
mov byte [rax], 3
mov dword [rax + 4], esi
mov dword [rax + 8], ebx
ud2