Function at 0x1000ddd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100e8018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x30], 0
push edi
mov edi, edx
test esi, esi
je 0x1000e764
test edi, edi
je 0x1000e764
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000e764
mov ebx, dword [eax]
mov edx, dword [eax + 4]
mov eax, ebx
and eax, 0xf
cmp eax, 2
ja 0x1000e764
mov ecx, ebx
mov eax, edx
shrd ecx, eax, 4
mov dword [ebp - 0x2c], ecx
and ecx, 0xf
shr eax, 4
mov dword [ebp - 0x34], eax
cmp ecx, 2
ja 0x1000e764
mov ecx, ebx
mov eax, edx
shrd ecx, eax, 0xc
mov dword [ebp - 0x34], ecx
and ecx, 0xf
shr eax, 0xc
mov dword [ebp - 0x3c], eax
cmp ecx, 4
ja 0x1000e764
push 0x358
push 0
push esi
call fcn.100346a0
mov ecx, dword [ebp - 0x2c]
mov al, bl
and al, 0xf
shl cl, 4
or al, cl
add esp, 0xc
mov byte [esi], al
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, edx
shrd ecx, eax, 8
mov eax, dword [ebp - 0x34]
and cl, 0xf
shl al, 4
or cl, al
shrd ebx, edx, 0x10
mov byte [esi + 1], cl
xor ecx, ecx
mov byte [esi + 2], bl
nop dword [eax]
mov al, byte [ecx + edi]
mov byte [esi + ecx + 0x343], al
inc ecx
cmp ecx, 0xf
jb 0x1000dea0
movzx eax, byte [esi + 0x343]
cmp byte [eax + 0x100673f0], 0
je 0x1000dede
sub esp, 8
lea edx, [esi + 0x343]
mov ecx, esi
call fcn.1000adc0
add esp, 8
cmp eax, 0x80000000
jae 0x1000e769
movzx eax, byte [esi]
and eax, 0xf
sub eax, 0
je 0x1000df46
sub eax, 1
je 0x1000df30
sub eax, 1
jne 0x1000e154
mov cl, byte [esi + 7]
mov al, byte [esi + 4]
mov dl, cl
and dl, 4
neg dl
sbb dl, dl
and al, 0xf0
add dl, 2
or dl, al
test byte [esi + 0x24], 1
je 0x1000df1f
mov cl, 2
and dl, 0xf
shl cl, 4
or cl, dl
jmp 0x1000df58
shr cl, 1
and dl, 0xf
not cl
and cl, 1
shl cl, 4
or cl, dl
jmp 0x1000df58
mov al, byte [esi + 7]
mov cl, al
shr al, 2
shl cl, 3
not al
not cl
and cl, 0x10
and al, 1
jmp 0x1000df56
mov al, byte [esi + 7]
mov cl, al
and al, 2
shr cl, 2
and cl, 1
shl al, 3
or cl, al
lea eax, [ebp - 0x30]
mov byte [esi + 4], cl
push eax
movzx eax, byte [esi + 0xc]
lea edx, [esi + 0x343]
push 0xf
push eax
mov ecx, esi
call fcn.1000d6b0
add esp, 0xc
cmp eax, 0x80000000
jae 0x1000e769
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x14]
mov dword [esi + 0x300], eax
movzx eax, word [edx]
mov dword [esi + 0x304], eax
movzx eax, byte [edx + 2]
mov dword [esi + 0x308], eax
movzx eax, byte [edx + 3]
mov dword [esi + 0x30c], eax
mov ecx, dword [edx + 0x2c]
and ecx, dword [edx + 0x28]
mov dword [esi + 0x2f4], ecx
mov eax, dword [edx + 0x20]
mov dword [esi + 0x2e4], eax
mov eax, dword [edx + 0x24]
mov dword [esi + 0x2e8], eax
mov eax, dword [edx + 0x28]
xor eax, ecx
mov dword [esi + 0x2ec], eax
mov eax, dword [edx + 0x2c]
xor eax, ecx
mov dword [esi + 0x2f0], eax
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0x1c]
mov dword [esi + 0x310], eax
mov dword [esi + 0x314], ecx
mov eax, dword [edx + 8]
mov dword [esi + 0x318], eax
mov ax, word [edx + 6]
mov word [esi + 0x31c], ax
mov al, byte [edx + 0xc]
mov byte [esi + 0x31e], al
mov al, byte [edx + 0x10]
mov byte [esi + 0x2f8], al
mov al, byte [edx + 0xf]
shr al, 5
mov byte [esi + 0x2f9], al
mov al, byte [edx + 0xf]
and al, 0x1f
xor ecx, ecx
mov byte [esi + 0x2fa], al
mov al, byte [edx + 0xe]
mov byte [esi + 0x2fb], al
nop dword [eax + eax]
movzx eax, word [edx + 4]
mov eax, dword [eax*4 + 0x10064f88]
mov al, byte [ecx + eax]
mov byte [esi + ecx + 0x31f], al
test al, al
je 0x1000e0af
movzx eax, word [edx + 4]
mov eax, dword [eax*4 + 0x10064f88]
mov al, byte [eax + ecx + 1]
mov byte [esi + ecx + 0x320], al
test al, al
je 0x1000e0af
movzx eax, word [edx + 4]
mov eax, dword [eax*4 + 0x10064f88]
mov al, byte [eax + ecx + 2]
mov byte [esi + ecx + 0x321], al
test al, al
je 0x1000e0af
movzx eax, word [edx + 4]
mov eax, dword [eax*4 + 0x10064f88]
mov al, byte [eax + ecx + 3]
mov byte [esi + ecx + 0x322], al
test al, al
je 0x1000e0af
add ecx, 4
cmp ecx, 0x20
jb 0x1000e040
mov al, byte [esi]
mov byte [ebp - 0x26], al
and al, 0xf
cmp al, 2
je 0x1000e0ca
test dword [esi + 0x300], 0x40000000
je 0x1000e0ca
and dword [esi + 0x24], 0xfffffffe
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x300]
test edi, 1
je 0x1000e0ec
mov dword [ebp - 0x2c], ecx
test ecx, 0x400
jne 0x1000e0ec
mov byte [ebp - 0x25], 1
jmp 0x1000e0f3
mov byte [ebp - 0x25], 0
mov dword [ebp - 0x2c], ecx
mov ebx, ecx
and ebx, 2
je 0x1000e107
mov al, byte [esi + 1]
and al, 0xf0
cmp al, 0x20
je 0x1000e107
mov ah, 1
jmp 0x1000e109
xor ah, ah
test ecx, 4
jne 0x1000e122
test ebx, ebx
je 0x1000e11e
mov al, byte [esi + 1]
and al, 0xf0
cmp al, 0x20
je 0x1000e122
xor bl, bl
jmp 0x1000e124
mov bl, 1
test byte [esi + 7], 2
je 0x1000e13c
cmp byte [esi + 0xa], 0
jge 0x1000e138
test ecx, 0x80000
je 0x1000e13c
mov al, 1
jmp 0x1000e13e
xor al, al
movzx ecx, byte [ebp - 0x26]
and ecx, 0xf
sub ecx, 0
je 0x1000e1af
sub ecx, 1
je 0x1000e1ad
sub ecx, 1
je 0x1000e16a
mov eax, 0x80000101
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x25], 0
jne 0x1000e180
test ah, ah
jne 0x1000e180
test bl, bl
je 0x1000e17c
test al, al
je 0x1000e180
xor al, 1
jmp 0x1000e182
mov al, 2
mov bl, byte [esi + 5]
mov cl, byte [esi + 4]
and bl, 0xf0
or bl, al
mov dword [ebp - 0x34], 2
test dword [ebp - 0x2c], 0x10000000
movzx eax, cl
cmovne eax, dword [ebp - 0x34]
xor al, cl
and al, 0xf
xor al, cl
mov byte [esi + 4], al
jmp 0x1000e1b7
xor al, 1
mov bl, byte [esi + 5]
and bl, 0xf0
or bl, al
mov cl, byte [esi + 6]
movzx eax, bl
and eax, 0xf
mov byte [esi + 5], bl
mov al, byte [eax + 0x100ce1f0]
xor al, byte [esi + 0xd]
and al, 0xf
xor byte [esi + 0xd], al
test cl, cl
jns 0x1000e263
test edi, 0x80000
je 0x1000e20e
mov al, byte [esi + 0x1d]
mov bl, byte [esi + 0x31e]
and al, 0xc0
cmp al, 0xc0
jne 0x1000e2ef
test bl, 1
je 0x1000e2b6
or byte [esi + 0xa], 0x18
mov eax, edi
shr eax, 0xc
and al, 3
mov byte [esi + 0x2fc], al
test edi, 0x1c00000
je 0x1000e329
test byte [esi + 0x31e], 8
je 0x1000e313
or byte [esi + 0xa], 2
test edi, 0x200000
je 0x1000e250
test byte [esi + 0x31e], 4
je 0x1000e365
mov al, byte [esi + 0xa]
test al, 2
je 0x1000e34f
or al, 4
mov byte [esi + 0xa], al
cmp byte [esi + 8], 0
jge 0x1000e263
mov al, byte [esi + 0xe]
and al, 0xf0
cmp al, 0x10
jne 0x1000e263
or byte [esi + 9], 0x80
mov ebx, dword [esi + 0x300]
test ebx, 0x40000
je 0x1000e40f
test byte [esi + 0xa], 0x38
jne 0x1000e3dd
shr edi, 0xc
and edi, 3
sub edi, 0
je 0x1000e3af
sub edi, 1
je 0x1000e395
sub edi, 1
je 0x1000e37b
mov eax, 0x80000041
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test bl, 2
je 0x1000e2c4
or byte [esi + 0xa], 0x10
jmp 0x1000e20e
test dword [esi + 0x300], 0x20000000
je 0x1000e2d9
or byte [esi + 0xa], 0x20
jmp 0x1000e20e
mov eax, 0x80000035
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test bl, 0x10
je 0x1000e2fd
or byte [esi + 0xa], 1
jmp 0x1000e20e
mov eax, 0x80000039
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov eax, 0x80000033
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test dword [esi + 0x300], 0x2000
je 0x1000e22b
mov eax, 0x80000034
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov eax, 0x80000038
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov eax, 0x80000036
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 5]
and cl, 0xf0
and al, 0xf
or al, 0x20
mov byte [esi + 5], al
mov eax, ebx
shr eax, 8
not al
and al, 2
or al, cl
jmp 0x1000e3b8
mov al, byte [esi + 5]
and cl, 0xf0
and al, 0xf
or al, 0x10
mov byte [esi + 5], al
mov eax, ebx
shr eax, 9
not al
and al, 1
or al, cl
jmp 0x1000e3b8
and byte [esi + 5], 0xf
and cl, 0xf0
mov al, cl
mov byte [esi + 6], al
test al, 0xf
jne 0x1000e40f
test ebx, 0x8000
je 0x1000e40f
mov eax, reloc.OLEAUT32.dll_SysReAllocString
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x2fb]
cmp al, 6
je 0x1000e405
cmp al, 4
je 0x1000e405
cmp al, 5
je 0x1000e405
cmp al, 7
je 0x1000e405
mov al, byte [esi + 5]
and cl, 0xf2
and al, 0xf
or al, 0x20
or cl, 2
mov byte [esi + 5], al
jmp 0x1000e40c
and byte [esi + 5], 0xf
and cl, 0xf0
mov byte [esi + 6], cl
test bl, 0x40
je 0x1000e41c
mov al, byte [esi + 0x40]
and al, 0x1f
mov byte [esi + 0x4b], al
test bl, 0x20
je 0x1000e42f
mov al, byte [esi + 0x342]
and al, 0xf
mov byte [esi + 0x4d], al
mov byte [esi + 0x4c], al
mov cl, byte [edx + 0xd]
mov edi, 0
and cl, 0xf
mov byte [esi + 0x4f], cl
mov al, byte [edx + 0xd]
shr al, 4
add al, cl
mov byte [esi + 0x4e], al
je 0x1000e48b
mov ebx, 0x30
nop
push dword [ebx + edx + 4]
movzx eax, byte [esi + 0xc]
mov ecx, esi
push dword [ebx + edx]
lea edx, [esi + 0x343]
push edi
push 0xf
push eax
call fcn.1000b3d0
add esp, 0x14
cmp eax, 0x80000000
jae 0x1000e769
movzx eax, byte [esi + 0x4e]
inc edi
add ebx, 8
cmp edi, eax
jae 0x1000e48b
mov edx, dword [ebp - 0x30]
jmp 0x1000e450
mov bl, byte [esi + 0x19]
test bl, bl
je 0x1000e4ea
test byte [esi + 7], 8
jne 0x1000e4af
movzx ecx, word [esi + 0x31c]
mov eax, ecx
mov edi, ecx
mov edx, eax
test ecx, 0x100
je 0x1000e4e1
jmp 0x1000e4b6
movzx edi, word [esi + 0x31c]
cmp dword [esi + 0x58], 2
movzx eax, di
mov edx, eax
jne 0x1000e4e1
test al, 0x18
je 0x1000e4d0
cmp bl, 0xf2
jne 0x1000e4d0
or byte [esi + 8], 1
jmp 0x1000e4df
mov edx, eax
test al, 0x28
je 0x1000e4e1
cmp bl, 0xf3
jne 0x1000e4e1
or byte [esi + 8], 2
mov edx, eax
test dl, 3
je 0x1000e4ea
mov al, 0x80
jmp 0x1000e4ec
xor al, al
mov dl, byte [esi + 7]
mov ebx, dword [esi + 0x300]
and dl, 0x7f
or dl, al
mov byte [esi + 7], dl
test ebx, 0x800000
je 0x1000e51d
mov eax, 0x200
test word [esi + 0x31c], ax
je 0x1000e519
cmp byte [esi + 0x1a], 0x3e
je 0x1000e51d
mov cl, 8
jmp 0x1000e51f
xor cl, cl
mov al, byte [esi + 8]
and al, 0xf7
or al, cl
test byte [esi + 0x2d9], 0xa
mov byte [esi + 8], al
je 0x1000e58c
mov edi, dword [esi + 0x308]
cmp edi, 0x19
mov al, byte [esi + 0x2dc]
setne cl
and al, 0xfd
dec cl
and cl, 2
or cl, al
or cl, 1
test byte [esi + 0x69], 1
jne 0x1000e563
mov eax, dword [esi + 0x58]
cmp eax, 1
je 0x1000e56c
cmp eax, 2
je 0x1000e56c
cmp edi, 0x44
je 0x1000e56c
xor al, al
jmp 0x1000e56e
mov al, 4
and cl, 0xfb
or cl, al
mov al, byte [esi + 0x2d8]
and al, 0xa
and cl, 0xf7
neg al
sbb al, al
and al, 8
or cl, al
mov byte [esi + 0x2dc], cl
test dl, 8
je 0x1000e5c6
test ebx, 0x1000
je 0x1000e5a1
mov al, byte [esi]
and al, 0xf
cmp al, 2
jne 0x1000e5c6
test byte [esi + 0x31c], 4
je 0x1000e5b0
cmp dword [esi + 0x58], 2
je 0x1000e5c6
mov eax, 0x8000000a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test dl, 2
je 0x1000e5e9
test ebx, 0x4000000
je 0x1000e5e9
mov eax, 0x8000000c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test byte [esi + 3], 0xf
je 0x1000e751
test byte [esi + 0x50], 8
jne 0x1000e628
mov eax, dword [esi + 0x24]
test eax, 0x3c000
jne 0x1000e6e5
test bl, bl
js 0x1000e62c
test eax, 0x40000
je 0x1000e67f
mov eax, 0x80000040
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test bl, bl
jns 0x1000e67f
cmp dword [esi + 0x308], 0x46
je 0x1000e67f
movzx edi, byte [esi + 0x4e]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test edi, edi
je 0x1000e67f
lea ecx, [esi + 0x70]
nop dword [eax]
mov eax, dword [ecx - 0x18]
cmp eax, 1
jne 0x1000e662
cmp dword [ecx], 5
jne 0x1000e677
mov eax, dword [ecx + 8]
jmp 0x1000e66b
cmp eax, 2
jne 0x1000e677
movzx eax, byte [ecx + 0x14]
inc byte [ebp + eax - 0x24]
mov al, byte [ebp + eax - 0x24]
cmp al, 1
ja 0x1000e6c6
inc edx
add ecx, 0x40
cmp edx, edi
jb 0x1000e650
mov al, byte [esi + 0x2f9]
cmp al, 4
jne 0x1000e6fb
cmp byte [esi + 0x2fa], al
jne 0x1000e6dc
mov eax, dword [esi + 0xb8]
mov ecx, dword [esi + 0x78]
cmp ecx, eax
je 0x1000e6b0
mov edx, dword [esi + 0xf8]
cmp ecx, edx
je 0x1000e6b0
cmp eax, edx
jne 0x1000e751
mov eax, 0x80000043
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov eax, 0x80000031
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test dword [esi + 0x24], 0x3c000
je 0x1000e751
mov eax, 0x80000032
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
cmp al, 2
jne 0x1000e751
mov al, byte [esi + 0x2fa]
cmp al, 7
je 0x1000e70d
cmp al, 0x13
jne 0x1000e751
cmp dword [esi + 0x58], 1
jne 0x1000e751
cmp dword [esi + 0xd8], 1
jne 0x1000e727
mov eax, dword [esi + 0x78]
cmp eax, dword [esi + 0xf8]
je 0x1000e73b
cmp dword [esi + 0x118], 1
jne 0x1000e751
mov eax, dword [esi + 0x78]
cmp eax, dword [esi + 0x138]
jne 0x1000e751
mov eax, 0x80000044
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
mov eax, 0x80000100
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100313c7
mov esp, ebp
pop ebp
ret