Function at 0x14001b800
Capabilities:
Inspect section memory permissions

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, str.KERNEL32.DLL
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14001b85a
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b85a
movzx r9d, word [rbx + 0x12e]
lea rcx, [rbx + 0x148]
movzx r8d, word [rbx + 0x12c]
mov edx, dword [rbx + 0x9c]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rbx + 0x98]
call rax
mov ecx, dword [rbx + 0x130]
mov eax, dword [rbx + 0x148]
and ecx, 0xfffffffd
mov dword [rbx + 0x130], ecx
cmp eax, 0x62
ja 0x14001bd33
je 0x14001bd20
dec eax
cmp eax, 0x60
ja case.0x14001c1f1.201
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x1c3f8]
add rax, rdx
jmp rax
bts ecx, 0x13
or dword [rbx + 0x134], 0x1000
jmp 0x14001c3a9
bts ecx, 0x1c
or dword [rbx + 0x134], 0x8800
jmp 0x14001c3a9
bts ecx, 0x10
jmp 0x14001c3a9
or ecx, 0x1800000
jmp 0x14001c3a9
bts ecx, 0x18
jmp 0x14001c3a9
or ecx, 0x2800000
or dword [rbx + 0x134], 0x8000
jmp 0x14001c3a9
bts ecx, 0x19
or dword [rbx + 0x134], 0x8000
jmp 0x14001c3a9
or ecx, 0x8800000
jmp 0x14001c3a9
bts ecx, 0x1b
jmp 0x14001c3a9
or ecx, 2
or dword [rbx + 0x134], 0x4000
jmp 0x14001c3a9
or ecx, 0x800002
jmp 0x14001c3a9
or ecx, 0x800002
or dword [rbx + 0x134], 0x4000
jmp 0x14001c3a9
bts ecx, 0x16
jmp 0x14001c3a9
or ecx, 0xc00000
jmp 0x14001c3a9
or ecx, 0x24000020
jmp 0x14001c3a9
or ecx, 0x20000020
jmp 0x14001c3a9
or ecx, 0x20
jmp 0x14001c3a9
or ecx, 0x4000020
jmp 0x14001c3a9
or ecx, 0x4000020
or dword [rbx + 0x134], 0x4000
jmp 0x14001c3a9
or ecx, 0x24000002
jmp 0x14001c3a9
or ecx, 0x20000002
jmp 0x14001c3a9
or ecx, 0x4000002
jmp 0x14001c3a9
mov dword [rbx + 0xa8], 5
or ecx, 2
jmp 0x14001c3a9
or ecx, 0x24000000
or dword [rbx + 0x134], 0x20
jmp 0x14001c3a9
bts ecx, 0x1d
or dword [rbx + 0x134], 0x20
jmp 0x14001c3a9
bts ecx, 0x1a
or dword [rbx + 0x134], 0x20
jmp 0x14001c3a9
bts ecx, 0x1a
or dword [rbx + 0x134], 0x4020
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x20
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x400
jmp case.0x14001c1f1.201
or ecx, 0x20000080
jmp 0x14001c3a9
bts ecx, 7
jmp 0x14001c3a9
bts ecx, 0x1c
jmp 0x14001c3a9
or dword [rbx + 0x13c], 0x80
jmp case.0x14001c1f1.201
or dword [rbx + 0x13c], 0x100
jmp case.0x14001c1f1.201
bts ecx, 0x1d
or dword [rbx + 0x13c], 0x100
jmp 0x14001c3a9
bts ecx, 0x1e
jmp 0x14001c3a9
bts ecx, 0x1f
jmp 0x14001c3a9
or dword [rbx + 0x134], 1
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 2
jmp case.0x14001c1f1.201
bts ecx, 0x1a
or dword [rbx + 0x134], 2
jmp 0x14001c3a9
or ecx, 1
or dword [rbx + 0x134], 0x8004
jmp 0x14001c3a9
or ecx, 0x20000001
or dword [rbx + 0x134], 0x8004
jmp 0x14001c3a9
or ecx, 0x20080002
jmp 0x14001c3a9
or ecx, 0x80002
jmp 0x14001c3a9
or dword [rbx + 0x134], 8
or ecx, 0x20080000
jmp 0x14001c3a9
bts ecx, 0x13
or dword [rbx + 0x134], 8
jmp 0x14001c3a9
or ecx, 0x20080000
or dword [rbx + 0x134], 0x20
jmp 0x14001c3a9
or ecx, 0x20080000
or dword [rbx + 0x134], 0x4020
jmp 0x14001c3a9
bts ecx, 0x13
or dword [rbx + 0x134], 0x20
jmp 0x14001c3a9
or ecx, 0x20080000
or dword [rbx + 0x134], 0x10
jmp 0x14001c3a9
bts ecx, 0x13
or dword [rbx + 0x134], 0x10
jmp 0x14001c3a9
bts ecx, 0x13
or dword [rbx + 0x134], 0x4010
jmp 0x14001c3a9
or ecx, 2
or dword [rbx + 0x134], 0x40
jmp 0x14001c3a9
bts ecx, 0x18
or dword [rbx + 0x134], 0x40
jmp 0x14001c3a9
bts ecx, 0x19
or dword [rbx + 0x134], 0x8040
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x80
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0xc0
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x134], 0x80
jmp 0x14001c3a9
or ecx, 0x4000001
jmp 0x14001c3a9
or ecx, 1
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x100
jmp case.0x14001c1f1.201
bts ecx, 8
or dword [rbx + 0x134], 0x200
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x220
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x18200
jmp case.0x14001c1f1.201
or ecx, 0x20000100
or dword [rbx + 0x134], 0x200
jmp 0x14001c3a9
bts ecx, 0x10
or dword [rbx + 0x134], 0x40
jmp 0x14001c3a9
or ecx, 0x810000
jmp 0x14001c3a9
bts ecx, 0x16
or dword [rbx + 0x134], 0x40
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x2000
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x134], 0x2000
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x2000
mov dword [rbx + 0xa8], 9
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x20000
jmp case.0x14001c1f1.201
bts ecx, 8
or dword [rbx + 0x134], 0x40000
jmp 0x14001c3a9
bts ecx, 8
jmp 0x14001c3a9
bts ecx, 8
or dword [rbx + 0x134], 0x2000000
jmp 0x14001c3a9
mov dword [rbx + 0xa8], 9
or dword [rbx + 0x134], 0x4000000
jmp case.0x14001c1f1.201
bts ecx, 8
or dword [rbx + 0x134], 0x80
jmp 0x14001c3a9
bts ecx, 0x17
or dword [rbx + 0x134], 0x4000000
jmp 0x14001c3a9
cmp eax, 0x95
ja 0x14001c009
je 0x14001bffa
add eax, 0xffffff9d
cmp eax, 0x31
ja case.0x14001c1f1.201
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x1c57c]
add rax, rdx
jmp rax
or dword [rbx + 0x134], 0x4080000
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x4100000
jmp case.0x14001c1f1.201
bts ecx, 0xe
or dword [rbx + 0x134], 0x80
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x14000000
jmp case.0x14001c1f1.201
bts ecx, 8
or dword [rbx + 0x134], 0x2004000
jmp 0x14001c3a9
bts ecx, 8
or dword [rbx + 0x134], 0x2004040
jmp 0x14001c3a9
bts ecx, 8
or dword [rbx + 0x134], 0x4000
jmp 0x14001c3a9
bts ecx, 8
or dword [rbx + 0x134], 0x4040
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x80000000
jmp case.0x14001c1f1.201
bts ecx, 0x13
or dword [rbx + 0x138], 1
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x800000
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x8000080
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x134], 0x800000
jmp 0x14001c3a9
bts ecx, 0x17
or dword [rbx + 0x134], 0x8000080
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x900000
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x880000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 8
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x2000000
or dword [rbx + 0x138], 0x10
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 4
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 2
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x1000000
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x134], 0x1000000
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x20
jmp case.0x14001c1f1.201
or ecx, 2
or dword [rbx + 0x134], 0x40000000
jmp 0x14001c3a9
or ecx, 0x800002
or dword [rbx + 0x134], 0x40000000
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x40000080
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x134], 0x40000080
jmp 0x14001c3a9
or ecx, 2
or dword [rbx + 0x134], 0x40004000
jmp 0x14001c3a9
or ecx, 0x800002
or dword [rbx + 0x134], 0x40004000
jmp 0x14001c3a9
or ecx, 2
or dword [rbx + 0x134], 0x10000000
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x40
jmp case.0x14001c1f1.201
bts ecx, 0x1b
or dword [rbx + 0x138], 0x40
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x100080
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x80080
jmp case.0x14001c1f1.201
or ecx, 2
or dword [rbx + 0x138], 0x80
jmp 0x14001c3a9
or ecx, 0x800002
or dword [rbx + 0x138], 0x80
jmp 0x14001c3a9
or ecx, 0x20
or dword [rbx + 0x134], 0x80000000
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x80000020
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x20000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x800
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x100
jmp case.0x14001c1f1.201
cmp eax, 0xbf
ja 0x14001c1c1
je 0x14001c1a5
add eax, 0xffffff61
cmp eax, 0x1e
ja case.0x14001c1f1.201
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x1c644]
add rax, rdx
jmp rax
or ecx, 0x20000020
or dword [rbx + 0x134], 0x4000
jmp 0x14001c3a9
bts ecx, 0x1d
or dword [rbx + 0x134], 0x4020
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x200
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x138], 0x200
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x1000080
jmp case.0x14001c1f1.201
bts ecx, 0x17
or dword [rbx + 0x134], 0x1000080
jmp 0x14001c3a9
bts ecx, 0x1d
or dword [rbx + 0x138], 0x400
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x80000000
or dword [rbx + 0x138], 0x400
jmp case.0x14001c1f1.201
or ecx, 2
or dword [rbx + 0x138], 0x1000
jmp 0x14001c3a9
or ecx, 0x800002
or dword [rbx + 0x138], 0x1000
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x4000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x8000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x40000
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x40
or dword [rbx + 0x138], 0x2000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x80000
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x40
bts ecx, 0x17
or dword [rbx + 0x138], 0x2000
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x200000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x400000
jmp case.0x14001c1f1.201
or ecx, 2
or dword [rbx + 0x138], 0x800000
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x1000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x40000000
or ecx, 2
or dword [rbx + 0x138], 0x800000
jmp 0x14001c3a9
cmp eax, 0xcc
ja 0x14001c299
je 0x14001c28d
add eax, 0xffffff40
cmp eax, 0xb
ja case.0x14001c1f1.201
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x1c6c0]
add rax, rdx
jmp rax
or dword [rbx + 0x138], 0x100000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x2000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x4000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x8000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x10000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x20000000
jmp case.0x14001c1f1.201
or dword [rbx + 0x13c], 0x10
jmp case.0x14001c1f1.201
or dword [rbx + 0x13c], 2
jmp case.0x14001c1f1.201
or dword [rbx + 0x13c], 4
jmp case.0x14001c1f1.201
or dword [rbx + 0x13c], 8
bts ecx, 0x17
jmp 0x14001c3a9
or dword [rbx + 0x13c], 8
jmp case.0x14001c1f1.201
or dword [rbx + 0x13c], 0x40
jmp case.0x14001c1f1.201
cmp eax, 0xd2
ja 0x14001c34b
je 0x14001c342
sub eax, 0xcd
je 0x14001c329
sub eax, 1
je 0x14001c317
sub eax, 1
je 0x14001c2fb
sub eax, 1
je 0x14001c2e2
cmp eax, 1
jne case.0x14001c1f1.201
or dword [rbx + 0x138], 0x400
or dword [rbx + 0x13c], 0x800
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x400
or dword [rbx + 0x13c], 0x400
jmp case.0x14001c1f1.201
or dword [rbx + 0x134], 0x4000
or ecx, 2
or dword [rbx + 0x138], 0x800000
jmp 0x14001c3a9
or ecx, 2
or dword [rbx + 0x138], 0x800080
jmp 0x14001c3a9
or dword [rbx + 0x134], 0x40000000
or ecx, 2
or dword [rbx + 0x138], 0x800080
jmp 0x14001c3a9
or dword [rbx + 0x13c], 0x20
jmp case.0x14001c1f1.201
cmp eax, 0x196
je 0x14001c39b
cmp eax, 0x197
je 0x14001c38c
cmp eax, 0x198
je 0x14001c373
cmp eax, 0xabcdabcd
jne case.0x14001c1f1.201
or dword [rbx + 0x13c], 0x200
jmp case.0x14001c1f1.201
or dword [rbx + 0x138], 0x400
or ecx, 0x20000020
or dword [rbx + 0x13c], 1
jmp 0x14001c3a9
or ecx, 0x20
or dword [rbx + 0x138], 0x80000400
jmp 0x14001c3a9
or dword [rbx + 0x138], 0x40000400
bts ecx, 0x1d
mov dword [rbx + 0x130], ecx
cmp dword [rbx + 0xa4], 4
jne 0x14001c3ef
cmp dword [rbx + 0x98], 5
jne 0x14001c3ef
cmp dword [rbx + 0x9c], 0
jne 0x14001c3d3
cmp dword [rbx + 0x140], 1
jmp 0x14001c3e3
cmp dword [rbx + 0x140], 1
jne 0x14001c3ef
test byte [rbx + 0x130], 0x40
jne 0x14001c3ef
or dword [rbx + 0x134], 0x80
add rsp, 0x30
pop rbx
ret