Function at 0x140177910
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.140002de0
nop
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x98]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.140175190
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 1
jne 0x140177b67
mov eax, dword [rsp + 0x60]
and eax, 0xffefffff
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x1401779aa
lea rdx, [0x140244568]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x301bf
cmp eax, 0x301bf
jne 0x1401779d8
lea rdx, [0x140244578]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffcfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x200a9
cmp eax, 0x200a9
jne 0x140177a06
lea rdx, str.read_execute
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x116
cmp eax, 0x116
jne 0x140177a34
lea rdx, [0x1402445a8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffffee9
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20089
cmp eax, 0x20089
jne 0x140177a62
lea rdx, [0x1402445b8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff76
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140177a7e
lea rdx, str.FILE_LIST_DIRECTORY
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140177a9a
lea rdx, str.FILE_ADD_FILE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140177ab6
lea rdx, str.FILE_ADD_SUBDIRECTORY
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140177ad2
lea rdx, str.FILE_READ_EA
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140177aee
lea rdx, [0x140244668]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140177b0a
lea rdx, str.FILE_TRAVERSE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140177b26
lea rdx, str.FILE_DELETE_CHILD
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140177b44
lea rdx, str.FILE_READ_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x140177b62
lea rdx, str.FILE_WRITE_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.1400060d0
jmp 0x140178221
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 4
jne 0x140177cdc
mov eax, dword [rsp + 0x60]
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x140177ba7
lea rdx, [0x140244730]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20019
cmp eax, 0x20019
jne 0x140177bd5
lea rdx, [0x140244740]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdffe6
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140177bf1
lea rdx, [0x140244750]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140177c0d
lea rdx, str.KEY_CREATE_SUB_KEY
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140177c29
lea rdx, str.KEY_ENUMERATE_SUB_KEYS
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x140177c47
lea rdx, str.KEY_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140177c63
lea rdx, str.KEY_NOTIFY
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140177c7f
lea rdx, str.KEY_QUERY_VALUE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x140177c9d
lea rdx, str.KEY_READ
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140177cb9
lea rdx, str.KEY_SET_VALUE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20006
test eax, eax
je 0x140177cd7
lea rdx, str.KEY_WRITE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
jmp 0x140178221
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 2
jne 0x140177e7d
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x140177d1c
lea rdx, [0x140244880]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x140177d4a
lea rdx, str.start_stop
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe02
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x2018d
cmp eax, 0x2018d
jne 0x140177d78
lea rdx, [0x1402448a8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe72
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140177d94
lea rdx, [0x1402448b8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140177db0
lea rdx, str.SERVICE_ENUMERATE_DEPENDENTS
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140177dce
lea rdx, [0x140244928]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140177dea
lea rdx, str.SERVICE_PAUSE_CONTINUE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140177e06
lea rdx, str.SERVICE_QUERY_CONFIG
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140177e22
lea rdx, [0x1402449b8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140177e3e
lea rdx, [0x1402449e8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140177e5a
lea rdx, str.SERVICE_STOP
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x140177e78
lea rdx, str.SERVICE_USER_DEFINED_CONTROL
lea rcx, [rsp + 0x20]
call fcn.1400060d0
jmp 0x140178221
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 3
jne 0x140177f8e
mov eax, dword [rsp + 0x60]
and eax, 0xf000c
cmp eax, 0xf000c
jne 0x140177ebd
lea rdx, str.manage_printer
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fff3
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf0030
cmp eax, 0xf0030
jne 0x140177eeb
lea rdx, str.manage_documents
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffcf
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20008
cmp eax, 0x20008
jne 0x140177f19
lea rdx, [0x140244ab0]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfff7
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140177f35
lea rdx, str.PRINTER_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140177f51
lea rdx, str.PRINTER_ACCESS_USE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140177f6d
lea rdx, str.JOB_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140177f89
lea rdx, str.JOB_ACCESS_READ
lea rcx, [rsp + 0x20]
call fcn.1400060d0
jmp 0x140178221
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 5
jne 0x140178087
mov eax, dword [rsp + 0x60]
and eax, 0x1f01ff
cmp eax, 0x1f01ff
jne 0x140177fce
lea rdx, [0x140244b78]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xffe0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x140177ffc
lea rdx, str.change
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xffecfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1200a9
cmp eax, 0x1200a9
jne 0x14017802a
lea rdx, [0x140244b98]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xffedff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1bf
test eax, eax
je 0x140178048
lea rdx, [0x140244ba8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xa9
test eax, eax
je 0x140178066
lea rdx, str.SHARE_CHANGE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140178082
lea rdx, [0x140244be0]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
jmp 0x140178221
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 0xb
jne 0x140178221
mov eax, dword [rsp + 0x60]
and eax, 0x6003f
cmp eax, 0x6003f
jne 0x1401780c7
lea rdx, [0x140244c00]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfff9ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x13
cmp eax, 0x13
jne 0x1401780ef
lea rdx, [0x140244c10]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xffffffec
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x21
cmp eax, 0x21
jne 0x140178117
lea rdx, str.remote_access
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xffffffde
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
cmp eax, 1
jne 0x14017813f
lea rdx, str.enable_account
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017815b
lea rdx, str.WBEM_ENABLE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140178177
lea rdx, str.WBEM_METHOD_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140178193
lea rdx, str.WBEM_FULL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401781af
lea rdx, str.WBEM_PARTIAL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x1401781cb
lea rdx, str.WBEM_WRITE_PROVIDER
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x1401781e7
lea rdx, str.WBEM_REMOTE_ACCESS
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140178203
lea rdx, str.WBEM_RIGHT_SUBSCRIBE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140178221
lea rdx, [0x140244da0]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20000
test eax, eax
je 0x14017823f
lea rdx, str.READ_CONTROL
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x80000
test eax, eax
je 0x14017825d
lea rdx, [0x140244de8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x40000
test eax, eax
je 0x14017827b
lea rdx, str.WRITE_DAC
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10000
test eax, eax
je 0x140178299
lea rdx, str.DELETE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x100000
test eax, eax
je 0x1401782b7
lea rdx, str.SYNCHRONIZE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x1000000
test eax, eax
je 0x1401782d5
lea rdx, str.ACCESS_SYSTEM_SECURITY
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x10000000
test eax, eax
je 0x1401782f3
lea rdx, str.GENERIC_ALL
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x20000000
test eax, eax
je 0x140178311
lea rdx, str.GENERIC_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x80000000
test eax, eax
je 0x14017832f
lea rdx, str.GENERIC_READ
lea rcx, [rsp + 0x20]
call fcn.1400060d0
mov eax, dword [rsp + 0x60]
and eax, 0x40000000
test eax, eax
je 0x14017834d
lea rdx, [0x140244ee8]
lea rcx, [rsp + 0x20]
call fcn.1400060d0
lea rdx, [0x140244574]
lea rcx, [rsp + 0x20]
call fcn.140007370
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.140001430
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.140001490
mov rax, qword [rsp + 0x58]
add rsp, 0x48
ret