Function at 0x101adec
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1049010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x22c], edi
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
push esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call ebx
cmp edi, esi
je 0x101b59e
cmp word [edi], si
je 0x101b59e
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x101b59e
cmp word [ebp - 0x20c], si
je 0x101b59e
mov eax, dword [ebp - 0x228]
cmp eax, esi
je 0x101b59e
cmp word [eax], si
je 0x101b59e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 0x1f8
push ebx
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x101b5a8
push ebx
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
test dword [ebp + 0xc], 0x80000000
mov dword [esi], 0xfeedf001
je 0x101aefe
or dword [esi + 0x194], 0x80000000
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
mov dword [ebp - 0x234], eax
je 0x101af22
or dword [esi + 0x194], 0xc0000000
mov dword [ebp - 0x220], 1
mov eax, 0x20000000
test dword [ebp + 0xc], eax
je 0x101af36
or dword [esi + 0x194], eax
or dword [ebp + 0x14], 0x40
mov eax, dword [ebp + 0x10]
dec eax
push 2
pop ecx
je 0x101af81
dec eax
je 0x101af79
dec eax
je 0x101af6d
dec eax
je 0x101af61
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101b5a8
mov dword [esi + 0x198], 4
jmp 0x101af8b
mov dword [esi + 0x198], 3
jmp 0x101af8b
mov dword [esi + 0x198], ecx
jmp 0x101af8b
mov dword [esi + 0x198], 1
mov eax, dword [ebp + 0x18]
cmp eax, ecx
ja 0x101af48
test dword [ebp + 0x14], 0xffffffbd
mov dword [esi + 0x1a0], eax
jne 0x101af48
test byte [ebp + 0x14], 2
je 0x101afad
or dword [esi + 0x19c], ecx
test byte [ebp + 0x14], 0x40
je 0x101afba
or dword [esi + 0x19c], 0x40
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.01014fba
mov dword [esi + 0x1cc], eax
test eax, eax
jne 0x101afec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0
mov ebx, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
jmp 0x101af56
or ebx, 0xffffffff
mov dword [esi + 4], ebx
push dword [0x1049a84]
push dword [0x1049a80]
push esi
call fcn.0101d7fd
test eax, eax
je 0x101b54c
cmp dword [esi + 4], ebx
je 0x101b54c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
pop eax
cmp dword [ebp + 0x10], eax
jne 0x101b035
mov dword [esi + 0x198], eax
mov dword [ebp - 0x224], 1
jmp 0x101b07a
cmp dword [ebp + 0x10], 4
jne 0x101b062
call ebx
cmp eax, 0xb7
jne 0x101b062
push 0
mov dword [esi + 0x198], 3
mov dword [ebp - 0x224], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x101b07a
and dword [ebp - 0x224], 0
and dword [ebp - 0x218], 0
mov dword [esi + 0x198], 1
push esi
call fcn.0101b5f6
call fcn.0101fffb
cmp dword [ebp - 0x218], 0
mov dword [esi + 0x1b0], eax
mov eax, dword [0x1049a80]
mov dword [esi + 0x1e0], eax
mov eax, dword [0x1049a84]
mov dword [esi + 0x1e4], eax
je 0x101b433
and dword [ebp - 0x21c], 0
xor eax, eax
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x220]
test edi, edi
jne 0x101b0cf
or dword [esi + 0x190], 1
lea eax, [ebp - 0x21c]
push eax
push dword [esi + 4]
call fcn.01019eef
test eax, eax
jne 0x101b0ef
push 0xd
call fcn.01019e71
mov dword [ebp - 0x210], eax
test edi, edi
je 0x101b117
cmp dword [ebp - 0x210], 0
jne 0x101b19e
test byte [esi + 0x19c], 0x40
je 0x101b120
push dword [esi + 4]
call fcn.0101c60f
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x210], 0
jne 0x101b19e
push dword [ebp - 0x214]
push esi
call fcn.0101d24d
test eax, eax
jne 0x101b185
test edi, edi
je 0x101b14e
mov eax, dword [0x1049a80]
cmp eax, dword [ebp - 0x21c]
jne 0x101b14e
mov eax, dword [0x1049a84]
cmp eax, dword [ebp - 0x218]
je 0x101b19e
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jle 0x101b164
and eax, 0xffff
or eax, 0x80070000
push 0x187
push 0x1003098
push eax
push 0x1002f90
push dword [esi + 0x1cc]
push 0
push 1
call fcn.01015457
jmp 0x101b19e
test byte [esi + 0x28], 8
je 0x101b19e
cmp dword [ebp - 0x234], 0
je 0x101b19e
mov dword [ebp - 0x210], 5
test edi, edi
je 0x101b213
cmp dword [ebp - 0x210], 0
jne 0x101b2b8
test byte [esi + 0x19c], 0x40
je 0x101b226
test byte [esi + 0x28], 0x40
je 0x101b226
cmp dword [ebp - 0x214], 0
je 0x101b1cf
push dword [esi + 4]
call fcn.0101c68f
or dword [esi + 0x190], 1
push esi
call fcn.0101ab1e
push dword [ebp - 0x22c]
call fcn.0101ac8c
test eax, eax
jne 0x101b20d
push dword [ebp - 0x230]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x22c]
call fcn.0101adec
jmp 0x101b5aa
push eax
jmp 0x101af56
cmp dword [ebp - 0x210], 0
jne 0x101b419
mov edi, dword [ebp - 0x220]
push esi
call fcn.0101c7d1
test eax, eax
je 0x101b23a
push esi
call fcn.0101cbfb
test eax, eax
jne 0x101b252
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x101b2b8
mov dword [ebp - 0x210], 0x570
jmp 0x101b2b8
test dword [esi + 0x194], 0x80000000
je 0x101b286
push esi
call fcn.0101d8d3
test eax, eax
jne 0x101b286
test edi, edi
je 0x101b2ae
mov eax, dword [0x1049a80]
cmp eax, dword [ebp - 0x21c]
jne 0x101b2ae
mov eax, dword [0x1049a84]
cmp eax, dword [ebp - 0x218]
jne 0x101b2ae
push esi
call fcn.0101c6cf
test eax, eax
jne 0x101b2b8
test edi, edi
je 0x101b2ae
mov eax, dword [0x1049a80]
cmp eax, dword [ebp - 0x21c]
jne 0x101b2ae
mov eax, dword [0x1049a84]
cmp eax, dword [ebp - 0x218]
je 0x101b2b8
mov dword [ebp - 0x210], 0xd
test edi, edi
je 0x101b300
cmp dword [ebp - 0x210], 0
jne 0x101b419
test byte [esi + 0x19c], 0x40
je 0x101b30d
push dword [ebp - 0x214]
or dword [esi + 0x28], 0x40
push esi
call fcn.0101d5bb
test eax, eax
je 0x101b2ef
or dword [esi + 0x190], 8
jmp 0x101b2fc
push 0xe
call fcn.01019e71
mov dword [ebp - 0x210], eax
and dword [esi + 0x28], 0xffffffbf
cmp dword [ebp - 0x210], 0
jne 0x101b419
mov eax, dword [esi + 0x60]
add eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x64]
adc ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x9c]
cmp edx, ecx
mov edi, dword [esi + 0x98]
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], ecx
jl 0x101b35d
jg 0x101b33b
cmp edi, eax
jb 0x101b35d
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0xa4]
mov ebx, eax
or ebx, ecx
je 0x101b35d
add eax, edi
adc ecx, edx
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], ecx
mov edx, dword [esi + 0x124]
cmp edx, dword [esi + 0x1dc]
mov edi, dword [esi + 0x120]
jl 0x101b39d
jg 0x101b37b
cmp edi, dword [esi + 0x1d8]
jb 0x101b39d
mov eax, dword [esi + 0x128]
mov ecx, dword [esi + 0x12c]
mov ebx, eax
or ebx, ecx
je 0x101b39d
add eax, edi
adc ecx, edx
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], ecx
mov eax, dword [esi + 0x1d8]
mov dword [esi + 0x1e0], eax
mov eax, dword [esi + 0x1dc]
push esi
mov dword [esi + 0x1e4], eax
call fcn.01019674
test eax, 0x100
je 0x101b3d4
mov eax, dword [esi + 0x58]
mov dword [esi + 0x1d8], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x1dc], eax
xor edi, edi
cmp dword [ebp - 0x220], edi
je 0x101b419
push edi
push edi
push dword [esi + 0x1e4]
push dword [esi + 0x1e0]
push dword [esi + 4]
call fcn.01019f37
push dword [esi + 4]
call fcn.01019fef
push edi
push edi
push dword [esi + 0x1dc]
push dword [esi + 0x1d8]
push dword [esi + 4]
call fcn.01019f37
or dword [esi + 0x190], 0x10
cmp dword [ebp - 0x214], 0
je 0x101b4d2
push dword [esi + 4]
call fcn.0101c68f
jmp 0x101b4d2
mov eax, dword [0x1003090]
mov ecx, dword [0x1003094]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x18]
dec eax
mov edi, 0xd0
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0x10d00
je 0x101b46f
dec eax
jne 0x101b487
or dword [esi + 0x28], 0x40002
mov dword [esi + 0x1a0], 2
jmp 0x101b480
or dword [esi + 0x28], 0x20002
mov dword [esi + 0x1a0], 1
mov dword [esi + 0x2c], 0x8000
xor eax, eax
inc eax
mov word [esi + 0x40], ax
mov word [esi + 0x42], ax
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x101b4be
push eax
push esi
call fcn.0101d5bb
test eax, eax
jne 0x101b4be
push 0xe
call fcn.01019e71
mov dword [ebp - 0x210], eax
and dword [esi + 0x1dc], 0
or dword [esi + 0x190], 0x10
mov dword [esi + 0x1d8], edi
cmp dword [ebp - 0x210], 0
jne 0x101b53b
mov eax, dword [esi + 0x28]
test eax, 0x40000
je 0x101b4f1
mov dword [esi + 0x1a0], 2
jmp 0x101b4fd
shr eax, 0x11
and eax, 1
mov dword [esi + 0x1a0], eax
mov ax, word [esi + 0x40]
mov word [esi + 0x1ac], ax
mov ax, word [esi + 0x42]
mov word [esi + 0x1ae], ax
mov eax, dword [ebp - 0x230]
mov dword [esi + 0x1ec], esi
test eax, eax
je 0x101b52b
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x101b5aa
or dword [esi + 0x190], 1
push esi
call fcn.0101ab1e
xor esi, esi
jmp 0x101b52b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x101b568
push eax
call fcn.01019f91
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x1cc]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x101b58b
push eax
push 0
call edi
push eax
call ebx
test eax, eax
je 0x101b58b
and dword [esi + 0x1cc], 0
push esi
push 0
call edi
push eax
call ebx
push dword [ebp - 0x210]
jmp 0x101af56
push 0x57
call fcn.01019e71
push eax
call ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010106b6
leave
ret 0x18