Function at 0x140107120
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
mov rdi, qword [r9 + 0x18]
test rdi, rdi
je 0x1401071de
lea rcx, [rdi - 1]
mov rdx, qword [r12 + 8]
add rdx, rcx
xor eax, eax
cmp qword [r12 + 0x10], rcx
cmova rax, rdx
test rax, rax
je 0x1401071de
movzx r15d, byte [rax]
mov edx, dword [r12]
mov r8d, dword [r12 + 4]
mov rax, qword [r14 + 0x290]
or rax, qword [r14 + 0x2a0]
mov rcx, qword [r14 + 0x288]
or rcx, qword [r14 + 0x298]
or rcx, rax
je 0x1401071f6
lea rax, [r14 + 0x288]
mov r9d, r15d
shr r9d, 7
shl r9, 4
mov r10d, 1
xor r11d, r11d
mov ecx, r15d
shld r11, r10, cl
shl r10, cl
xor ecx, ecx
test r15b, 0x40
cmovne r11, r10
cmovne r10, rcx
and r11, qword [rax + r9 + 8]
and r10, qword [rax + r9]
or r10, r11
je 0x1401071f6
mov esi, 4
jmp 0x140107416
mov edx, dword [r12]
mov r8d, dword [r12 + 4]
mov al, 2
movzx r9d, al
mov rax, r9
test edx, edx
jne 0x140107207
jmp 0x140107214
movzx eax, byte [r14 + r15 + 0x78]
movzx r9d, al
mov rax, r9
test edx, edx
je 0x140107214
cmp edx, 1
jne 0x140107403
lea rax, [r9 + 6]
cmp rax, qword [rbx + 0x58]
jae 0x140107a28
mov rcx, qword [rbx + 0x48]
mov r15d, dword [rcx + rax*4]
test r15d, r15d
js 0x140107858
mov qword [rsp + 0x28], r13
mov rbp, qword [r12 + 0x10]
mov r13, qword [r12 + 0x20]
cmp rdi, r13
jae 0x140107321
mov rsi, qword [r12 + 8]
mov rax, qword [r14 + 0x178]
mov qword [rsp + 0x58], rax
cmp byte [r12 + 0x28], 0
je 0x140107524
xor r9d, r9d
lea rcx, [rsp + 0x30]
jmp 0x14010727f
inc rdi
mov r15d, edx
cmp r13, rdi
je 0x140107690
cmp rdi, rbp
jae 0x140107a28
movzx r8d, byte [rsi + rdi]
movzx edx, byte [r14 + r8 + 0x188]
mov eax, r15d
and eax, 0x7ffffff
add rax, rdx
cmp rax, qword [rbx + 0x40]
jae 0x140107a28
mov rdx, qword [rbx + 0x30]
mov edx, dword [rdx + rax*4]
test edx, edx
js 0x1401072e2
cmp edx, 0x7ffffff
jbe 0x140107270
mov eax, edx
test eax, 0x8000000
jne 0x1401077f6
test eax, 0x40000000
jne 0x140107853
test eax, 0x20000000
je 0x140107270
jmp 0x140107781
mov qword [rsp + 0x48], r12
shl r8d, 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
mov r12, rcx
mov edx, r15d
call fcn.1400cc830
test eax, eax
jne 0x1401078f3
xor r9d, r9d
mov rcx, r12
mov r12, qword [rsp + 0x48]
cmp edx, 0x7ffffff
jbe 0x140107270
jmp 0x1401072be
xor r9d, r9d
cmp r13, rbp
jae 0x14010769f
mov rax, qword [r12 + 8]
movzx esi, byte [rax + r13]
movzx ecx, byte [r14 + rsi + 0x188]
mov eax, r15d
and eax, 0x7ffffff
add rax, rcx
cmp rax, qword [rbx + 0x40]
jae 0x140107a28
mov rcx, qword [rbx + 0x30]
mov edx, dword [rcx + rax*4]
test edx, edx
js 0x140107884
mov eax, edx
test eax, 0x8000000
jne 0x140107930
test eax, 0x20000000
je 0x1401079ab
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1401073a7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140107a28
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140107a28
mov byte [rax], 0
mov byte [rax + 1], sil
mov qword [rax + 8], r13
mov rdi, qword [rsp + 0x28]
movzx ecx, byte [rax]
test rcx, rcx
je 0x1401073de
cmp ecx, 1
jne 0x140107a28
mov rsi, qword [rax + 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
mov qword [rdi + 8], rsi
mov qword [rdi], 2
jmp 0x1401079c7
test byte [r14 + 0x71], 1
mov r15d, r8d
mov esi, 2
jne 0x1401074f5
lea ecx, [rsi - 3]
cmp ecx, 2
mov eax, 2
cmovb eax, ecx
test eax, eax
je 0x140107487
cmp eax, 1
jne 0x1401079ef
test rdi, rdi
je 0x140107a28
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140107465
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140107a28
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140107a28
dec rdi
mov byte [rax], 0
mov byte [rax + 1], r15b
jmp 0x1401074cb
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1401074b2
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140107a28
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140107a28
mov byte [rax], 1
mov qword [rax + 8], rdi
mov rsi, qword [rax + 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
mov qword [r13 + 8], rsi
mov qword [r13], 2
jmp 0x1401079c7
mov rax, qword [r14 + 0x178]
cmp qword [rax + 0x160], r15
jbe 0x140107758
lea rax, [r15 + r15*2]
lea rax, [r9 + rax*2]
add rax, 0xc
cmp rax, qword [rbx + 0x58]
jb 0x14010721e
jmp 0x140107a28
mov rax, qword [r14 + 0x180]
and eax, 0x3f
mov qword [rsp + 0x48], rax
xor r9d, r9d
jmp 0x14010754f
mov r11, rdi
inc rdi
cmp r13, rdi
je 0x140107693
cmp rdi, rbp
jae 0x140107a28
movzx r8d, byte [rsi + rdi]
movzx ecx, byte [r14 + r8 + 0x188]
mov eax, r15d
and eax, 0x7ffffff
add rax, rcx
cmp rax, qword [rbx + 0x40]
jae 0x140107a28
mov rcx, qword [rbx + 0x30]
mov edx, dword [rcx + rax*4]
test edx, edx
js 0x14010763b
mov r15d, edx
cmp edx, 0x8000000
jb 0x140107543
mov eax, r15d
test eax, 0x8000000
jne 0x1401075c0
test eax, 0x40000000
jne 0x1401079ab
test eax, 0x20000000
je 0x140107543
jmp 0x140107781
mov r9d, 1
xor r10d, r10d
mov rax, qword [rsp + 0x58]
cmp qword [rax + 0x160], 1
je 0x140107540
mov eax, r15d
and eax, 0x7ffffff
mov rcx, qword [rsp + 0x48]
shr rax, cl
cmp rax, qword [rbx + 0x70]
jae 0x140107a28
mov rdx, qword [rbx + 0x60]
shl rax, 4
mov rcx, qword [rdx + rax + 8]
test rcx, rcx
je 0x140107a28
mov rax, qword [rdx + rax]
test byte [rax + 0x10], 2
je 0x140107540
cmp rcx, 0xd
jb 0x140107a28
add rcx, 0xfffffffffffffff3
cmp rcx, 3
jbe 0x140107a28
mov r10d, dword [rax + 0x1d]
jmp 0x140107540
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x54], r10d
mov qword [rsp + 0x60], r9
shl r8d, 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x30]
mov edx, r15d
call fcn.1400cc830
test eax, eax
jne 0x1401078f3
mov r9, qword [rsp + 0x60]
mov r10d, dword [rsp + 0x54]
mov r11, qword [rsp + 0x40]
mov r15d, edx
cmp edx, 0x8000000
jb 0x140107543
jmp 0x140107595
mov r15d, edx
mov rdi, r13
cmp r13, rbp
jb 0x14010732d
movzx r8d, byte [r14 + 0x287]
shl r8d, 0x10
add r8d, 0x10001
mov ecx, r8d
shr ecx, 0x10
mov eax, r15d
and eax, 0x7ffffff
add rax, rcx
cmp qword [rbx + 0x40], rax
jbe 0x140107a28
mov rcx, qword [rbx + 0x30]
mov edx, dword [rcx + rax*4]
test edx, edx
js 0x1401078be
test edx, 0x8000000
je 0x1401079ab
mov rax, qword [r14 + 0x178]
mov r9d, 1
xor r10d, r10d
cmp qword [rax + 0x160], 1
je 0x1401079a8
and edx, 0x7ffffff
movzx ecx, byte [r14 + 0x180]
shr rdx, cl
cmp rdx, qword [rbx + 0x70]
jae 0x140107a28
mov rax, qword [rbx + 0x60]
shl rdx, 4
mov rcx, qword [rax + rdx + 8]
test rcx, rcx
je 0x140107a28
mov rax, qword [rax + rdx]
test byte [rax + 0x10], 2
je 0x1401079a8
cmp rcx, 0xd
jb 0x140107a28
add rcx, 0xfffffffffffffff3
jmp 0x14010799a
mov rcx, qword [r14 + 0x180]
and ecx, 0x3f
cmp rcx, 0x1b
jae 0x140107a28
mov r15d, 1
shl r15, cl
or r15d, 0x40000000
jmp 0x14010722f
movzx ebx, byte [rsi + rdi]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
mov rsi, qword [rsp + 0x28]
jne 0x1401077b5
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140107a28
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140107a28
mov byte [rax], 0
mov byte [rax + 1], bl
mov qword [rax + 8], rdi
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
mov qword [rsi + 8], rdi
mov qword [rsi], 2
jmp 0x1401079c7
xor eax, eax
mov rcx, qword [rsp + 0x58]
cmp qword [rcx + 0x160], 1
mov rsi, qword [rsp + 0x28]
je 0x140107840
and edx, 0x7ffffff
movzx ecx, byte [r14 + 0x180]
shr rdx, cl
cmp rdx, qword [rbx + 0x70]
jae 0x140107a28
mov rax, qword [rbx + 0x60]
shl rdx, 4
mov rcx, qword [rax + rdx]
mov rdx, qword [rax + rdx + 8]
xor r8d, r8d
call fcn.1400f1ef0
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov dword [rsi + 0x10], eax
jmp 0x1401079c7
jmp 0x1401079ab
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x30]
call fcn.1400cdb30
mov rsi, rax
mov r15, rax
shr r15, 0x20
cmp esi, 5
je 0x14010722f
jmp 0x140107416
mov qword [rsp + 0x40], r11
mov ebp, r10d
mov r12, r9
mov r8d, esi
shl r8d, 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x30]
mov edx, r15d
call fcn.1400cc830
test eax, eax
je 0x140107918
mov rcx, r13
call fcn.1400e52b0
jmp 0x1401073c8
mov r13, r11
mov r12d, r10d
mov rsi, r9
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x30]
mov edx, r15d
call fcn.1400cc830
test eax, eax
je 0x1401079d8
mov rcx, rbp
call fcn.1400e52b0
jmp 0x1401073c8
mov rcx, rdi
call fcn.1400e52b0
mov rcx, rax
call fcn.140100d40
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov qword [rcx], 2
jmp 0x1401079c7
mov r9, r12
mov r10d, ebp
mov r11, qword [rsp + 0x40]
mov eax, edx
test eax, 0x8000000
je 0x140107371
mov rcx, qword [r14 + 0x178]
mov r9d, 1
xor r10d, r10d
cmp qword [rcx + 0x160], 1
je 0x140107984
and eax, 0x7ffffff
movzx ecx, byte [r14 + 0x180]
shr rax, cl
cmp rax, qword [rbx + 0x70]
jae 0x140107a28
mov rdx, qword [rbx + 0x60]
shl rax, 4
mov rcx, qword [rdx + rax + 8]
test rcx, rcx
je 0x140107a28
mov rax, qword [rdx + rax]
test byte [rax + 0x10], 2
jne 0x140107989
mov r11, r13
jmp 0x1401079ab
cmp rcx, 0xd
jb 0x140107a28
add rcx, 0xfffffffffffffff3
mov rbp, r13
cmp rcx, 3
jbe 0x140107a28
mov r10d, dword [rax + 0x1d]
mov r11, rbp
xor eax, eax
test r9, r9
cmove r11, rdi
sete al
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], r11
mov dword [rcx + 0x10], r10d
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r9, rsi
mov r10d, r12d
mov r11, r13
test edx, 0x8000000
jne 0x1401076e8
jmp 0x1401079ab
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140107a16
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140107a28
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
jne 0x140107a2c
ud2
mov byte [rax], 3
mov dword [rax + 4], esi
mov dword [rax + 8], r15d
ud2