Function at 0x4352a0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcf8c
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x506070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 0x3c]
mov dword [ebp - 0xa0], ebx
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
lea eax, [ebp + 0x20]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push eax
mov byte [ecx], 0
call fcn.00485ae0
lea ecx, [ebp - 0x40]
call fcn.00408090
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
push edi
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_139]
add esp, 0x24
mov dword [ebp - 0x98], eax
test eax, eax
je 0x435e2d
cmp dword [eax], 0
mov dword [ebp - 0x9c], 0
je 0x435e23
mov edi, eax
nop dword [eax + eax]
cmp byte [ebp + 0x38], 0
jne 0x4353a1
lea eax, [ebp + 0x20]
mov edx, 0x608570
push eax
lea ecx, [ebp - 0x58]
call fcn.00487870
push 0x4d4a44
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00487950
add esp, 8
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.004830f0
lea ecx, [ebp - 0x28]
call fcn.00482890
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00482890
mov edx, dword [edi]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4353a8
sub ecx, esi
push ecx
push edx
mov ecx, ebx
call fcn.00483000
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
mov edx, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
push 0xb
push str.searchflags
push 0
call fcn.004895a0
add esp, 0xc
test eax, eax
jne 0x43582c
push eax
push 0x4d4a42
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.00482f30
mov byte [ebp - 4], 6
push dword [edi]
call fcn.0049db61
add esp, 4
mov ebx, eax
push 8
test bl, 1
je 0x435476
push str.INDEX_1_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
dec ebx
jmp 0x435483
push str.INVALID
lea ecx, [ebp - 0x58]
call fcn.00482f30
test bl, 2
je 0x4354ba
push str.CONTAINER_INDEX_2_
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.004879c0
add esp, 4
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 8
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 2
test bl, 4
je 0x4354f1
push str.ANR_4_
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.004879c0
add esp, 4
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 4
test bl, 8
je 0x435539
push 0x15
push str.PRESERVE_TOMBSTONE_8_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 8
test bl, 0x10
je 0x435581
push 0xe
push str.COPY_VALUE_16_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x10
test bl, 0x20
je 0x4355b8
push str.TUPLE_INDEX_32_
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.004879c0
add esp, 4
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0xc
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x20
test bl, 0x40
je 0x4355ef
push str.SUBTREE_INDEX_64_
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.004879c0
add esp, 4
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0xd
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x40
test bl, bl
jns 0x435636
push 0x11
push str.CONFIDENTIAL_128_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
add ebx, 0xffffff80
test ebx, 0x100
je 0x435684
push 0x10
push str.NEVER_AUDIT_256_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x100
test ebx, 0x200
je 0x4356d2
push 0x12
push str.RODC_FILTERED_512_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x200
test ebx, 0x400
je 0x435720
push 0x15
push str.EXT_LINK_TRKING_1024_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x400
test ebx, 0x800
je 0x43576e
push 0xf
push str.BASE_ONLY_2048_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x800
test ebx, 0x1000
je 0x4357bc
push 0x16
push str.PARTITION_SECRET_4096_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00482890
sub ebx, 0x1000
test ebx, ebx
je 0x435820
mov edx, ebx
lea ecx, [ebp - 0x70]
call fcn.004091b0
push eax
mov edx, str.UNKNOWN_FLAGS_
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x88]
call fcn.00486ce0
push 0x4d5854
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x28]
call fcn.00487950
add esp, 8
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x16
call fcn.00488e10
lea ecx, [ebp - 0x28]
call fcn.00482890
lea ecx, [ebp - 0x88]
call fcn.00482890
lea ecx, [ebp - 0x70]
call fcn.00482890
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00482890
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
push 0xb
push str.systemflags
push 0
call fcn.004895a0
add esp, 0xc
test eax, eax
jne 0x435c93
push dword [edi]
call fcn.0049db61
mov ebx, eax
add esp, 4
test bl, 1
je 0x4358a5
push 0x11
push str.NOT_REPLICATED_1_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
dec ebx
test bl, 2
je 0x4358ed
push 0xb
push str.PAS_ATTR_2_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 2
test bl, 4
je 0x435935
push 0xe
push str.CONSTRUCTED_4_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 4
test bl, 8
je 0x43597d
push 0xe
push str.OPERATIONAL_8_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 8
test bl, 0x10
je 0x4359c5
push 9
push str.CAT_1_16_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x10
test bl, 0x20
je 0x435a0d
push 0xa
push str.IS_RDN_32_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x20
test ebx, 0x2000000
je 0x435a5b
push 0x1b
push str.NO_MOVE_ON_DELETE_33554432_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x2000000
test ebx, 0x4000000
je 0x435aa9
push 0x1f
push str.DOMAIN_DISSALLOW_MOVE_67108864_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x4000000
test ebx, 0x8000000
je 0x435af7
push 0x22
push str.DOMAIN_DISSALLOW_RENAME_134217728_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x8000000
test ebx, 0x10000000
je 0x435b45
push 0x1e
push str.CONFIG_LIMITED_MOVE_268435456_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x10000000
test ebx, 0x20000000
je 0x435b93
push 0x1c
push str.CONFIG_ALLOW_MOVE_536870912_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x20000000
test ebx, 0x40000000
je 0x435be1
push 0x1f
push str.CONFIG_ALLOW_RENAME_1073741824_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x40000000
test ebx, ebx
jns 0x435c2d
push 0x1b
push str.DISALLOW_DELETE_2147483648_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
sub ebx, 0x80000000
test ebx, ebx
je 0x435c93
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.004091b0
push eax
mov edx, str.UNKNOWN_FLAGS_
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x88]
call fcn.00486ce0
push 0x4d5854
mov edx, eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x70]
call fcn.00487950
add esp, 8
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x26
call fcn.00488e10
lea ecx, [ebp - 0x70]
call fcn.00482890
lea ecx, [ebp - 0x88]
call fcn.00482890
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
push 0xd
push str.schemaflagsex
push 0
call fcn.004895a0
add esp, 0xc
test eax, eax
jne 0x435d74
push dword [edi]
call fcn.0049db61
mov ebx, eax
add esp, 4
test bl, 1
je 0x435d0c
push 0x18
push str.FLAG_ATTR_IS_CRITICAL_1_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00482f30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x94]
call fcn.00488e10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
dec ebx
test ebx, ebx
je 0x435d74
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.004091b0
push eax
mov edx, str.UNKNOWN_FLAGS_
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x88]
call fcn.00486ce0
push 0x4d5854
mov edx, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x70]
call fcn.00487950
add esp, 8
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x2a
call fcn.00488e10
lea ecx, [ebp - 0x70]
call fcn.00482890
lea ecx, [ebp - 0x88]
call fcn.00482890
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00482890
mov ebx, dword [ebp - 0xa0]
mov ecx, ebx
push 2
push 0x4eb7d0
call fcn.00483000
mov esi, dword [ebp - 0x94]
cmp esi, dword [ebp - 0x90]
je 0x435de4
cmp esi, dword [ebp - 0x94]
jne 0x435dac
push 0xffffffffffffffff
push 0
push esi
mov ecx, ebx
call fcn.004830f0
jmp 0x435dd9
push esi
mov edx, 0x4d4ef4
lea ecx, [ebp - 0x70]
call fcn.00486d50
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x2b
call fcn.004830f0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.00482890
add esi, 0x18
cmp esi, dword [ebp - 0x90]
jne 0x435d96
push 2
push 0x4d4d68
mov ecx, ebx
call fcn.00483000
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
call fcn.00481f20
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x98]
inc eax
cmp dword [ecx + eax*4], 0
mov dword [ebp - 0x9c], eax
lea edi, [ecx + eax*4]
jne 0x435350
mov eax, ecx
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_223]
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.00482890
lea ecx, [ebp + 8]
call fcn.00482890
lea ecx, [ebp + 0x20]
call fcn.00482890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493041
mov esp, ebp
pop ebp
ret