Function at 0x4a6a6c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x7c
je 0x4a6b03
mov dword [esp], 0x506d2c
call sym._strdup
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4a6afb
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x506d30
mov dword [esp + 8], str.decode_win_permissions
mov dword [esp + 4], 0x673
mov dword [esp], str.shared_syscheck_op.c
call dbg._merror_exit
mov eax, dword [ebp - 0x28]
jmp 0x4a72ec
mov dword [esp + 4], 1
mov dword [esp], 0x5000
call sym._calloc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4a6b68
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x506d30
mov dword [esp + 8], str.decode_win_permissions
mov dword [esp + 4], 0x677
mov dword [esp], str.shared_syscheck_op.c
call dbg._merror_exit
mov dword [ebp - 0x30], 0x5000
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
jmp 0x4a71ff
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4a72a2
mov eax, dword [ebp - 0x38]
mov byte [eax], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4a6c0c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x506d30
mov dword [esp + 8], str.decode_win_permissions
mov dword [esp + 4], 0x684
mov dword [esp], str.shared_syscheck_op.c
call dbg._merror_exit
mov eax, dword [ebp - 0x38]
mov byte [eax], 0x2c
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4a72a5
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
mov byte [ebp - 0x3d], al
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x7c
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4a6c97
mov eax, dword [ebp - 0x38]
mov byte [eax], 0
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._strtol
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov byte [eax], 0x7c
jmp 0x4a6cb5
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._strtol
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
and eax, 0x100
test eax, eax
je 0x4a6cca
mov dword [ebp - 0x4c], 0x507270
jmp 0x4a6cd1
mov dword [ebp - 0x4c], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x80
test eax, eax
je 0x4a6ce6
mov dword [ebp - 0x50], 0x507282
jmp 0x4a6ced
mov dword [ebp - 0x50], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x20
test eax, eax
je 0x4a6d00
mov dword [ebp - 0x54], 0x507293
jmp 0x4a6d07
mov dword [ebp - 0x54], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x10
test eax, eax
je 0x4a6d1a
mov dword [ebp - 0x58], 0x50729c
jmp 0x4a6d21
mov dword [ebp - 0x58], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 8
test eax, eax
je 0x4a6d34
mov dword [ebp - 0x5c], 0x5072a6
jmp 0x4a6d3b
mov dword [ebp - 0x5c], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 4
test eax, eax
je 0x4a6d4e
mov dword [ebp - 0x60], 0x5072af
jmp 0x4a6d55
mov dword [ebp - 0x60], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 2
test eax, eax
je 0x4a6d68
mov dword [ebp - 0x64], 0x5072bc
jmp 0x4a6d6f
mov dword [ebp - 0x64], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 1
test eax, eax
je 0x4a6d82
mov dword [ebp - 0x68], 0x5072c8
jmp 0x4a6d89
mov dword [ebp - 0x68], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x100000
test eax, eax
je 0x4a6d9e
mov dword [ebp - 0x6c], 0x5072d3
jmp 0x4a6da5
mov dword [ebp - 0x6c], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x80000
test eax, eax
je 0x4a6dba
mov dword [ebp - 0x70], 0x5072e0
jmp 0x4a6dc1
mov dword [ebp - 0x70], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x40000
test eax, eax
je 0x4a6dd6
mov dword [ebp - 0x74], 0x5072ed
jmp 0x4a6ddd
mov dword [ebp - 0x74], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x20000
test eax, eax
je 0x4a6df2
mov dword [ebp - 0x78], 0x5072f8
jmp 0x4a6df9
mov dword [ebp - 0x78], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x10000
test eax, eax
je 0x4a6e0c
mov edi, 0x507306
jmp 0x4a6e11
mov edi, 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x10000000
test eax, eax
je 0x4a6e24
mov esi, 0x50730e
jmp 0x4a6e29
mov esi, 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x20000000
test eax, eax
je 0x4a6e3c
mov ebx, 0x50731b
jmp 0x4a6e41
mov ebx, 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x40000000
test eax, eax
je 0x4a6e54
mov ecx, 0x50732c
jmp 0x4a6e59
mov ecx, 0x506d2c
cmp dword [ebp - 0x2c], 0
jns 0x4a6e66
mov edx, 0x50733b
jmp 0x4a6e6b
mov edx, 0x506d2c
cmp byte [ebp - 0x3d], 0x30
jne 0x4a6e7a
mov dword [ebp - 0x7c], str.allowed
jmp 0x4a6e81
mov dword [ebp - 0x7c], str.denied
mov eax, dword [ebp - 0x4c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 0x50], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x48], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 0x38], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s___s_:__s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._snprintf_63
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30]
jle 0x4a6f45
cmp dword [ebp - 0x24], 0
je 0x4a6f36
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x38], 0
je 0x4a7221
jmp 0x4a71ff
mov eax, dword [ebp - 0x2c]
and eax, 0x100
test eax, eax
je 0x4a6f58
mov edx, 0x507270
jmp 0x4a6f5d
mov edx, 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x80
test eax, eax
je 0x4a6f72
mov dword [ebp - 0x4c], 0x507282
jmp 0x4a6f79
mov dword [ebp - 0x4c], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x20
test eax, eax
je 0x4a6f8c
mov dword [ebp - 0x50], 0x507293
jmp 0x4a6f93
mov dword [ebp - 0x50], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x10
test eax, eax
je 0x4a6fa6
mov dword [ebp - 0x54], 0x50729c
jmp 0x4a6fad
mov dword [ebp - 0x54], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 8
test eax, eax
je 0x4a6fc0
mov dword [ebp - 0x58], 0x5072a6
jmp 0x4a6fc7
mov dword [ebp - 0x58], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 4
test eax, eax
je 0x4a6fda
mov dword [ebp - 0x5c], 0x5072af
jmp 0x4a6fe1
mov dword [ebp - 0x5c], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 2
test eax, eax
je 0x4a6ff4
mov dword [ebp - 0x60], 0x5072bc
jmp 0x4a6ffb
mov dword [ebp - 0x60], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 1
test eax, eax
je 0x4a700e
mov dword [ebp - 0x64], 0x5072c8
jmp 0x4a7015
mov dword [ebp - 0x64], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x100000
test eax, eax
je 0x4a702a
mov dword [ebp - 0x68], 0x5072d3
jmp 0x4a7031
mov dword [ebp - 0x68], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x80000
test eax, eax
je 0x4a7046
mov dword [ebp - 0x6c], 0x5072e0
jmp 0x4a704d
mov dword [ebp - 0x6c], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x40000
test eax, eax
je 0x4a7062
mov dword [ebp - 0x70], 0x5072ed
jmp 0x4a7069
mov dword [ebp - 0x70], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x20000
test eax, eax
je 0x4a707e
mov dword [ebp - 0x74], 0x5072f8
jmp 0x4a7085
mov dword [ebp - 0x74], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x10000
test eax, eax
je 0x4a709a
mov dword [ebp - 0x78], 0x507306
jmp 0x4a70a1
mov dword [ebp - 0x78], 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x10000000
test eax, eax
je 0x4a70b4
mov edi, 0x50730e
jmp 0x4a70b9
mov edi, 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x20000000
test eax, eax
je 0x4a70cc
mov esi, 0x50731b
jmp 0x4a70d1
mov esi, 0x506d2c
mov eax, dword [ebp - 0x2c]
and eax, 0x40000000
test eax, eax
je 0x4a70e4
mov ebx, 0x50732c
jmp 0x4a70e9
mov ebx, 0x506d2c
cmp dword [ebp - 0x2c], 0
jns 0x4a70f6
mov ecx, 0x50733b
jmp 0x4a70fb
mov ecx, 0x506d2c
cmp byte [ebp - 0x3d], 0x30
jne 0x4a710a
mov dword [ebp - 0x7c], str.allowed
jmp 0x4a7111
mov dword [ebp - 0x7c], str.denied
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x80], eax
mov dword [esp + 0x54], edx
mov edx, dword [ebp - 0x4c]
mov dword [esp + 0x50], edx
mov edx, dword [ebp - 0x50]
mov dword [esp + 0x4c], edx
mov edx, dword [ebp - 0x54]
mov dword [esp + 0x48], edx
mov edx, dword [ebp - 0x58]
mov dword [esp + 0x44], edx
mov edx, dword [ebp - 0x5c]
mov dword [esp + 0x40], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 0x3c], edx
mov edx, dword [ebp - 0x64]
mov dword [esp + 0x38], edx
mov edx, dword [ebp - 0x68]
mov dword [esp + 0x34], edx
mov edx, dword [ebp - 0x6c]
mov dword [esp + 0x30], edx
mov edx, dword [ebp - 0x70]
mov dword [esp + 0x2c], edx
mov edx, dword [ebp - 0x74]
mov dword [esp + 0x28], edx
mov edx, dword [ebp - 0x78]
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s___s_:__s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._snprintf_63
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 1
cmp dword [ebp - 0x30], eax
jle 0x4a71cf
mov eax, dword [ebp - 0x20]
lea edx, [eax + 1]
mov dword [ebp - 0x20], edx
lea edx, [eax - 1]
mov eax, dword [ebp - 0x34]
add eax, edx
mov word [eax], 0x202c
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x30], eax
cmp dword [ebp - 0x24], 0
je 0x4a71f9
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x38], 0
je 0x4a7224
mov dword [esp + 4], 0x7c
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4a6b80
jmp 0x4a7225
nop
jmp 0x4a7225
nop
cmp dword [ebp - 0x34], 0
je 0x4a729d
cmp dword [ebp - 0x20], 1
jle 0x4a729d
mov eax, dword [ebp - 0x34]
sub eax, 2
mov byte [eax], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._realloc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4a729d
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x506d30
mov dword [esp + 8], str.decode_win_permissions
mov dword [esp + 4], 0x6d5
mov dword [esp], str.shared_syscheck_op.c
call dbg._merror_exit
mov eax, dword [ebp - 0x28]
jmp 0x4a72ec
nop
jmp 0x4a72a6
nop
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.The_file_permissions_could_not_be_decoded:__s.
mov dword [esp + 8], str.decode_win_permissions
mov dword [esp + 4], 0x6dc
mov dword [esp], str.shared_syscheck_op.c
call dbg._mdebug1
mov eax, 0
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret