Function at 0x180001020
Capabilities:
Inspect section memory permissions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180022010]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov r12d, r9d
mov qword [rsp + 0x28], rcx
mov rsi, rcx
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x44], ebx
lea ecx, [r12 + 0x38]
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0x70], r12d
cmp edx, 0x40
jb 0x18000161c
movsxd r13, dword [rsi + 0x3c]
mov edi, edx
mov qword [rsp + 0x38], rdi
lea rax, [r13 + 0x108]
cmp rdi, rax
jl 0x18000161c
cmp dword [rsi + r13], 0x4550
jne 0x18000161c
cmp edx, dword [rsi + r13 + 0x54]
jb 0x18000161c
mov eax, dword [rsi + r13 + 0x50]
lea rdx, str.VirtualAlloc
mov dword [rsp + 0x24], eax
add eax, ecx
lea ecx, [rbx + 3]
mov dword [rsp + 0x20], eax
mov edi, eax
call fcn.180002c30
lea r9d, [rbx + 4]
mov r8d, 0x3000
mov edx, edi
xor ecx, ecx
call rax
mov rbp, rax
test rax, rax
je 0x18000161c
movsxd rcx, dword [rsi + 0x3c]
mov edx, ebx
add rcx, 0x10a
cmp bx, word [rsi + r13 + 6]
jae 0x18000112a
add rcx, rsi
nop word [rax + rax]
mov word [rcx - 1], 0x5949
inc edx
mov byte [rcx + 1], 0x57
lea rcx, [rcx + 0x28]
movzx eax, word [rsi + r13 + 6]
cmp edx, eax
jb 0x180001110
mov edi, dword [rsi + r13 + 0x54]
lea rdx, str.memcpy
mov ecx, 2
call fcn.180002c30
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call rax
movsxd r14, dword [rsi + 0x3c]
mov r15d, ebx
add r14, 0x11c
cmp bx, word [rsi + r13 + 6]
jae 0x1800011d0
add r14, rsi
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rsi + r13 + 0x3c]
mov edx, eax
neg edx
and edx, dword [r14 - 4]
add eax, edx
cmp dword [r14 - 4], edx
cmove eax, edx
test eax, eax
je 0x1800011bc
mov esi, dword [r14]
lea rdx, str.memcpy
mov edi, dword [r14 - 8]
mov ecx, 2
add rsi, qword [rsp + 0x28]
add rdi, rbp
mov ebx, eax
call fcn.180002c30
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call rax
mov rsi, qword [rsp + 0x28]
movzx eax, word [rsi + r13 + 6]
inc r15d
add r14, 0x28
cmp r15d, eax
jb 0x180001170
xor ebx, ebx
mov eax, dword [rsp + 0x20]
lea rdx, str.VirtualProtect
mov ecx, 4
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], ebx
call fcn.180002c30
mov esi, dword [rsp + 0x24]
lea rdx, str.memcpy
mov ecx, 2
mov qword [rsp + 0x68], rax
add rsi, rbp
call fcn.180002c30
mov r8d, 0x38
lea rdx, [rsp + 0x40]
mov rcx, rsi
call rax
lea rdx, str.memcpy
mov ecx, 2
call fcn.180002c30
mov rdx, qword [rsp + 0x30]
lea rcx, [rsi + 0x38]
mov r8, r12
call rax
lea rdx, str.VirtualProtect
mov ecx, 4
lea edi, [r12 + 0x38]
call fcn.180002c30
lea r9, [rsp + 0x78]
mov r8d, 2
mov edx, edi
mov rcx, rsi
call rax
test eax, eax
je 0x18000161c
movsxd rax, dword [rbp + 0x3c]
cmp dword [rax + rbp + 0x94], 0
mov r12d, dword [rax + rbp + 0x50]
jbe 0x180001390
mov r15d, dword [rax + rbp + 0x90]
lea rdx, str.IsBadReadPtr
mov ecx, 5
add r15, rbp
call fcn.180002c30
mov edx, 0x14
mov rcx, r15
call rax
test eax, eax
jne 0x180001390
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x180001390
lea rdx, str.LoadLibraryA
mov ecx, 6
lea rdi, [rax + rbp]
call fcn.180002c30
mov rcx, rdi
call rax
mov r14, rax
test rax, rax
je 0x18000140e
mov eax, dword [r15]
mov ecx, dword [r15 + 0x10]
test eax, eax
je 0x180001307
lea rbx, [rax + rbp]
lea rsi, [rcx + rbp]
jmp 0x18000130e
lea rbx, [rcx + rbp]
mov rsi, rbx
mov rax, qword [rbx]
test rax, rax
je 0x180001369
sub rsi, rbx
nop dword [rax]
lea rdx, str.GetProcAddress
mov ecx, 7
test rax, rax
jns 0x18000133d
movzx edi, ax
call fcn.180002c30
mov edx, edi
jmp 0x18000134a
lea rdi, [rax + 2]
call fcn.180002c30
lea rdx, [rdi + rbp]
mov rcx, r14
call rax
mov qword [rsi + rbx], rax
test rax, rax
je 0x18000140e
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x180001320
lea rdx, str.IsBadReadPtr
mov ecx, 5
add r15, 0x14
call fcn.180002c30
mov edx, 0x14
mov rcx, r15
call rax
test eax, eax
je 0x1800012c0
movsxd r13, dword [rbp + 0x3c]
mov r11, rbp
add r13, rbp
sub r11, qword [r13 + 0x30]
je 0x180001442
xor ebx, ebx
mov qword [r13 + 0x30], rbp
cmp dword [r13 + 0xb4], ebx
jbe 0x180001444
mov r10d, dword [r13 + 0xb0]
add r10, rbp
mov eax, dword [r10]
test eax, eax
je 0x180001444
nop dword [rax + rax]
mov r9d, dword [r10 + 4]
lea rdx, [r10 + 8]
mov r8d, eax
mov edi, ebx
add r8, rbp
lea rax, [r9 - 8]
test rax, 0xfffffffffffffffe
jbe 0x180001433
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x180001417
cmp eax, 0xa
jne 0x18000141b
add qword [rcx + r8], r11
jmp 0x18000141b
xor ebx, ebx
mov eax, ebx
jmp 0x18000161e
add dword [rcx + r8], r11d
mov r9d, dword [r10 + 4]
inc edi
add rdx, 2
mov eax, edi
lea rcx, [r9 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x1800013f0
mov eax, r9d
add r10, rax
mov eax, dword [r10]
test eax, eax
jne 0x1800013d0
jmp 0x180001444
xor ebx, ebx
mov edi, dword [r13 + 0x54]
lea rdx, str.VirtualProtect
mov ecx, 4
call fcn.180002c30
lea r9, [rsp + 0x78]
mov r8d, 2
mov edx, edi
mov rcx, rbp
call rax
test eax, eax
je 0x18000161c
movsxd r14, dword [rbp + 0x3c]
mov r15d, ebx
movzx eax, word [r13 + 6]
add r14, 0x114
cmp bx, ax
jae 0x180001580
add r14, rbp
mov edi, 8
nop word [rax + rax]
mov r8d, dword [r14]
movzx eax, ax
dec eax
cmp r15d, eax
jne 0x1800014b3
mov edx, dword [r13 + 0x50]
jmp 0x1800014b7
mov edx, dword [r14 + 0x28]
mov ecx, dword [r14 + 0x18]
sub edx, r8d
mov eax, ecx
and eax, 0xe0000000
cmp eax, 0xe0000000
jne 0x1800014d3
mov esi, 0x40
jmp 0x180001536
mov eax, ecx
and eax, 0x60000000
cmp eax, 0x60000000
jne 0x1800014e8
mov esi, 0x20
jmp 0x180001536
mov eax, ecx
and eax, 0xa0000000
cmp eax, 0xa0000000
jne 0x1800014fd
mov esi, 0x80
jmp 0x180001536
mov eax, ecx
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x180001512
mov esi, 4
jmp 0x180001536
bt ecx, 0x1d
jae 0x18000151f
mov esi, 0x10
jmp 0x180001536
bt ecx, 0x1e
jae 0x18000152c
mov esi, 2
jmp 0x180001536
test ecx, ecx
mov esi, 1
cmovs esi, edi
mov edi, edx
mov ecx, 4
mov ebx, r8d
lea rdx, str.VirtualProtect
add rbx, rbp
call fcn.180002c30
lea r9, [rsp + 0x78]
mov r8d, esi
mov edx, edi
mov rcx, rbx
call rax
test eax, eax
je 0x18000161c
movzx eax, word [r13 + 6]
inc r15d
add r14, 0x28
mov edi, 8
cmp r15d, eax
jb 0x1800014a0
mov rdi, qword [rsp + 0x28]
lea r8, [r12 + rbp]
mov rcx, qword [rsp + 0x38]
xor eax, eax
rep stosb byte [rdi], al
mov eax, dword [r13 + 0x28]
mov edx, 1
add rax, rbp
mov rcx, rbp
call rax
sub r13d, ebp
lea rdx, str.VirtualProtect
add r13d, 0x108
mov ecx, 4
movsxd rdi, r13d
call fcn.180002c30
lea r9, [rsp + 0x78]
mov r8d, 4
mov rdx, rdi
mov rcx, rbp
call rax
test eax, eax
je 0x18000161c
test r13d, r13d
jle 0x1800015ea
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.180004610
lea rdx, str.VirtualProtect
mov ecx, 4
call fcn.180002c30
lea r9, [rsp + 0x78]
mov r8d, 2
mov rdx, rdi
mov rcx, rbp
call rax
test eax, eax
mov ebx, 0
setne bl
mov eax, ebx
jmp 0x18000161e
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180002d30
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret