Function at 0x401504
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor edx, edx
push edi
mov dword [ebp - 8], edx
mov byte [ebp + 0xf], dl
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x14], edx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x18], ecx
call fcn.00402446
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov ebx, eax
inc ecx
test ebx, ebx
je 0x40193b
movzx eax, byte [ebx]
mov edx, dword [eax*4 + 0x410018]
mov dword [ebp - 4], edx
cmp dword [edi + 0x18], ecx
jne 0x40157a
mov eax, dword [edi]
test eax, 0x2000
je 0x40157a
cmp dword [edi + 0x20], 0
jne 0x40157a
test byte [ebp - 0x10], 8
je 0x40157a
push 3
and eax, 0xffffdfff
push edi
mov dword [edi], eax
call fcn.00404204
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
mov dword [ebp + 0x10], eax
cmp eax, 2
jne 0x401598
test edx, 0x800000
jne 0x40193b
cmp eax, eax
je 0x4015a4
test edx, 0x8000000
jne 0x40193b
test dl, 1
je 0x4015ef
mov eax, edx
not eax
test eax, 0x40000000
je 0x4015c0
inc dword [ecx + 0x10]
dec dword [ecx + 0x14]
js 0x40193b
mov eax, dword [ecx + 0x10]
movzx eax, byte [eax]
mov dword [ebp - 8], eax
test edx, 0x10000000
je 0x4015d9
test al, 0x38
jne 0x40193b
test edx, 0x100000
je 0x4015ec
cmp eax, 0xc0
jb 0x40193b
mov eax, dword [ebp + 0x10]
inc dword [ecx + 0x10]
mov ecx, dword [edi]
push edx
push dword [ebp - 0x10]
push ecx
push eax
call fcn.004014bc
mov dword [ebp - 0xc], eax
test ecx, 0x4000
je 0x401617
mov eax, dword [ebp + 0x10]
mov eax, dword [eax*4 + section..data]
mov dword [ebp + 0x10], eax
push 0x38
push 0
push esi
call sub.ntoskrnl.exe_memset
mov byte [esi + 0x32], 0xff
add esp, 0xc
mov al, byte [ebx + 2]
test al, al
je 0x4016ea
lea ecx, [ebp - 0x14]
movzx eax, al
push ecx
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push edi
push dword [ebp - 8]
push 0
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.00402ac8
test eax, eax
je 0x40193b
mov al, byte [ebx + 1]
test al, al
je 0x4016ea
push 0
push dword [ebp + 0x10]
xor edx, edx
movzx eax, al
push dword [ebp - 0xc]
inc edx
push edi
push dword [ebp - 8]
push edx
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.00402ac8
test eax, eax
je 0x40193b
mov ecx, dword [ebp - 4]
test ecx, 0x20000
je 0x4016ed
movzx eax, byte [ebx + 7]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push edi
push dword [ebp - 8]
push 2
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.00402ac8
test eax, eax
je 0x40193b
mov ecx, dword [ebp - 4]
test ecx, 0x40000
je 0x4016ed
movzx eax, byte [ebx + 8]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push edi
push dword [ebp - 8]
push 3
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.00402ac8
test eax, eax
je 0x40193b
mov ecx, dword [ebp - 4]
test ecx, 0x200000
je 0x401711
push dword [ebp + 8]
call fcn.004027ec
mov ebx, eax
test ebx, ebx
je 0x40193b
movzx eax, byte [ebx]
mov ecx, dword [eax*4 + 0x410018]
mov edx, dword [ebp + 8]
mov eax, ecx
and eax, 0x400000
mov dword [ebp - 4], eax
je 0x401742
dec dword [edx + 0x14]
js 0x40193b
mov eax, dword [edx + 0x10]
mov dl, byte [eax]
inc eax
mov byte [ebp + 0xf], dl
cmp byte [ebp + 0xf], 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jae 0x40193b
mov eax, dword [edx + 0x10]
sub eax, dword [edi + 8]
cmp eax, 0xf
jg 0x40193b
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jne 0x401764
test cl, 0x10
je 0x401764
or dword [edi + 4], 0x10
jmp 0x401775
test cl, 0x20
je 0x40177b
test byte [edi], 0x20
je 0x40177b
or dword [edi + 4], 0x20
push 2
pop eax
or word [esi + 0x18], ax
jmp 0x40178e
test cl, 0x40
je 0x40178e
test byte [edi], 0x40
je 0x40178e
or dword [edi + 4], 0x40
or word [esi + 0x18], 4
mov edx, 0x14000
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x4017bc
or dword [edi + 4], 0x4000
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401802
xor eax, eax
inc eax
cmp edx, eax
jne 0x4017b6
mov ax, word [ebx + 0xa]
jmp 0x401806
mov ax, word [ebx + 0xc]
jmp 0x401806
mov edx, 0xc000
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x4017dd
mov ax, word [ebx + 4]
mov edx, dword [ebp + 0x10]
mov word [esi + 0x1e], ax
or dword [edi + 4], 0x4000
jmp 0x40180a
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4018a6
test ecx, 0x10000
je 0x4017ff
test ecx, 0x1000008
jne 0x4017ff
or dword [edi + 4], 0x2000
mov edx, dword [ebp + 0x10]
mov ax, word [ebx + 4]
mov word [esi + 0x1e], ax
test ecx, 0x8000
je 0x40181e
mov eax, 0x2000
test dword [edi], eax
je 0x40181e
or dword [edi + 4], eax
test ecx, 0x20000000
je 0x401845
mov al, byte [ebx + 6]
test al, 4
je 0x401833
test byte [ebp - 0x10], 8
jne 0x40183d
test al, 8
je 0x401845
test byte [ebp - 0x10], 0x10
je 0x401845
mov ax, word [ebx + 0xa]
mov word [esi + 0x1e], ax
and edx, 3
shl edx, 0xa
or word [esi + 0x18], dx
mov ax, word [esi + 0x18]
test ecx, ecx
jns 0x40185f
or ax, 0x40
mov word [esi + 0x18], ax
push edi
call fcn.004042b2
cmp byte [esi + 0x31], 0
mov word [esi + 0x1a], ax
mov al, byte [ebx + 3]
mov byte [esi + 0x35], al
jne 0x401879
mov byte [esi + 0x31], 0xff
mov cl, byte [esi + 0x32]
cmp cl, 0xff
je 0x401890
movzx ecx, cl
mov cx, word [ecx*2 + 0x415c68]
or word [esi + 0x1c], cx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov cl, byte [eax + 0x10]
xor eax, eax
sub cl, dl
inc eax
mov byte [esi + 0x30], cl
jmp 0x401972
xor edx, edx
inc edx
cmp eax, edx
jne 0x4018ff
mov eax, 0x100
or word [esi + 0x18], ax
test ecx, 0x10000
je 0x4017ff
or dword [edi + 4], 0x2000
mov edx, dword [ebp + 0x10]
test ecx, 0x80000
je 0x4018e6
cmp dword [ebp - 8], 0xc0
jae 0x401802
jmp 0x4017b0
cmp dword [ebp - 4], 0
je 0x4017b0
mov al, byte [ebp + 0xf]
movzx eax, al
add ax, word [ebx + 4]
jmp 0x401806
mov eax, 0x200
or word [esi + 0x18], ax
test ecx, 0x4010000
je 0x4017ff
test ecx, 0x4000000
je 0x401935
test byte [ebp - 0x10], 8
je 0x401935
or dword [edi + 4], 0x2000000
mov ax, word [ebx + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x401806
mov ax, word [ebx + 0xa]
jmp 0x40192d
push 0x38
push 0
push esi
call sub.ntoskrnl.exe_memset
mov edx, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
mov byte [esi + 0x32], 0xff
mov byte [esi + 0x30], cl
add esp, 0xc
and dword [edi + 4], 0
cmp byte [edx], 0x9b
jne 0x40196f
or byte [esi + 0x35], 8
mov eax, 0x218f
mov word [esi + 0x1e], ax
mov eax, ecx
jmp 0x401972
push 3
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc