Function at 0x17c9fed2
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x17d2b108]
push ebx
xor ebx, ebx
push esi
push edi
cmp eax, ebx
je 0x17c9ff01
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x17d2b108]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x17d2b108], ebx
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
mov esi, 0x17c91700
mov edi, 0x17d26008
jge 0x17c9ff36
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17c9ff36
test byte [ecx + 0x1c], 1
je 0x17c9ff36
push eax
push esi
push 0x50
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov ecx, dword [0x17d2b110]
mov eax, ecx
and eax, 0x80000
xor edx, edx
or eax, edx
je 0x17c9ff54
call fcn.17cc3b50
mov ecx, dword [0x17d2b110]
and ecx, 0x2000
xor eax, eax
or ecx, eax
je 0x17c9ffa0
cmp dword [0x17d2b120], ebx
je 0x17c9ff74
call fcn.17c9f708
neg eax
sbb eax, eax
inc eax
jmp 0x17c9ff77
xor eax, eax
inc eax
push eax
call fcn.17ced668
cmp eax, ebx
jge 0x17c9ffa0
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17c9ffa0
test byte [ecx + 0x1c], 1
je 0x17c9ffa0
push eax
push esi
push 0x51
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
jge 0x17c9ffcb
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17c9ffcb
test byte [ecx + 0x1c], 1
je 0x17c9ffcb
push eax
push esi
push 0x52
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov ecx, dword [0x17d2b114]
and ecx, 2
xor eax, eax
or eax, ecx
je 0x17ca0002
call fcn.17cdd658
cmp eax, ebx
jge 0x17ca0002
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca0002
test byte [ecx + 0x1c], 1
je 0x17ca0002
push eax
push esi
push 0x53
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x80000000
xor ecx, ecx
or eax, ecx
je 0x17ca003a
call fcn.17cdbead
cmp eax, ebx
jge 0x17ca003a
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca003a
test byte [ecx + 0x1c], 1
je 0x17ca003a
push eax
push esi
push 0x54
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
jge 0x17ca0065
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca0065
test byte [ecx + 0x1c], 1
je 0x17ca0065
push eax
push esi
push 0x55
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x20000000
xor ecx, ecx
or eax, ecx
je 0x17ca00a3
call fcn.17c9f708
push eax
call fcn.17cdaf72
cmp eax, ebx
jge 0x17ca00a3
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca00a3
test byte [ecx + 0x1c], 1
je 0x17ca00a3
push eax
push esi
push 0x56
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x4000
xor ecx, ecx
or eax, ecx
je 0x17ca00db
call fcn.17ca9cc4
cmp eax, ebx
jge 0x17ca00db
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca00db
test byte [ecx + 0x1c], 1
je 0x17ca00db
push eax
push esi
push 0x57
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x10000
xor ecx, ecx
or eax, ecx
je 0x17ca0113
call fcn.17caacb1
cmp eax, ebx
jge 0x17ca0113
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca0113
test byte [ecx + 0x1c], 1
je 0x17ca0113
push eax
push esi
push 0x58
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
jge 0x17ca013e
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca013e
test byte [ecx + 0x1c], 1
je 0x17ca013e
push eax
push esi
push 0x59
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x1000000
xor ecx, ecx
or eax, ecx
je 0x17ca0176
call fcn.17cf2436
cmp eax, ebx
jge 0x17ca0176
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca0176
test byte [ecx + 0x1c], 1
je 0x17ca0176
push eax
push esi
push 0x5a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
jge 0x17ca01a1
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca01a1
test byte [ecx + 0x1c], 1
je 0x17ca01a1
push eax
push esi
push 0x5b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov ecx, dword [0x17d2b114]
and ecx, 1
xor eax, eax
or eax, ecx
je 0x17ca01b5
call fcn.17cdcddf
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
jge 0x17ca01e0
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca01e0
test byte [ecx + 0x1c], 1
je 0x17ca01e0
push eax
push esi
push 0x5c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 2
xor ecx, ecx
or eax, ecx
je 0x17ca0216
call fcn.17cad272
cmp eax, ebx
jge 0x17ca0216
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca0216
test byte [ecx + 0x1c], 1
je 0x17ca0216
push eax
push esi
push 0x5d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x400
xor ecx, ecx
or eax, ecx
je 0x17ca022b
call fcn.17cba817
mov eax, dword [0x17d2b110]
and eax, 0x4000000
xor ecx, ecx
or eax, ecx
je 0x17ca0240
call fcn.17cd2b98
mov eax, dword [0x17d2b110]
and eax, 0x8000000
xor ecx, ecx
or eax, ecx
je 0x17ca0255
call fcn.17cd4fa2
push ebx
push 3
call fcn.17c9f4bb
cmp eax, ebx
jge 0x17ca0280
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca0280
test byte [ecx + 0x1c], 1
je 0x17ca0280
push eax
push esi
push 0x5e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
mov ebx, 0x800000
and eax, ebx
xor ecx, ecx
or eax, ecx
je 0x17ca0297
call fcn.17ccbd7b
mov eax, dword [0x17d2b110]
and eax, 0x2000000
xor ecx, ecx
or eax, ecx
je 0x17ca02ac
call fcn.17cd00ad
mov eax, dword [0x17d2b110]
and eax, 4
xor ecx, ecx
or eax, ecx
je 0x17ca02bf
call fcn.17cd8bf4
push 0
push 3
call fcn.17c9f4bb
test eax, eax
jge 0x17ca02eb
mov ecx, dword [0x17d26008]
cmp ecx, edi
je 0x17ca02eb
test byte [ecx + 0x1c], 1
je 0x17ca02eb
push eax
push esi
push 0x5f
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
mov edi, 0x100
and eax, edi
xor ecx, ecx
or eax, ecx
je 0x17ca0303
call dword [0x17d2b2ec]
mov ecx, dword [0x17d2b114]
and ecx, 8
xor eax, eax
or eax, ecx
je 0x17ca0317
call fcn.17cfb690
mov eax, dword [0x17d2b110]
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x17ca0351
call fcn.17ca8775
test eax, eax
jge 0x17ca0351
mov ecx, dword [0x17d26008]
cmp ecx, 0x17d26008
je 0x17ca0351
test byte [ecx + 0x1c], 1
je 0x17ca0351
push eax
push esi
push 0x60
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push 0
push 3
call fcn.17c9f4bb
test eax, eax
jge 0x17ca0381
mov ecx, dword [0x17d26008]
cmp ecx, 0x17d26008
je 0x17ca0381
test byte [ecx + 0x1c], 1
je 0x17ca0381
push eax
push esi
push 0x61
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
cmp dword [0x17d2b11c], 0
je 0x17ca0401
call fcn.17ca2a56
test eax, eax
je 0x17ca0401
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.17cbff43
test eax, eax
jge 0x17ca03cb
mov ecx, dword [0x17d26008]
cmp ecx, 0x17d26008
je 0x17ca03c7
test byte [ecx + 0x1c], 1
je 0x17ca03c7
push eax
push esi
push 0x62
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x17ca0401
push 2
push 3
call fcn.17c9f804
test eax, eax
jge 0x17ca0401
mov ecx, dword [0x17d26008]
cmp ecx, 0x17d26008
je 0x17ca0401
test byte [ecx + 0x1c], 1
je 0x17ca0401
push eax
push esi
push 0x63
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x8000
xor ecx, ecx
or eax, ecx
je 0x17ca043d
call fcn.17cc03d0
test eax, eax
jge 0x17ca043d
mov ecx, dword [0x17d26008]
cmp ecx, 0x17d26008
je 0x17ca043d
test byte [ecx + 0x1c], 1
je 0x17ca043d
push eax
push esi
push 0x64
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push 0
push 3
call fcn.17c9f4bb
test eax, eax
jge 0x17ca046d
mov ecx, dword [0x17d26008]
cmp ecx, 0x17d26008
je 0x17ca046d
test byte [ecx + 0x1c], 1
je 0x17ca046d
push eax
push esi
push 0x65
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
mov ecx, eax
and ecx, 0x80
xor edx, edx
or ecx, edx
je 0x17ca048a
call fcn.17cceced
mov eax, dword [0x17d2b110]
and eax, ebx
xor ecx, ecx
or eax, ecx
je 0x17ca0497
call fcn.17cca79a
push 0
push 3
call fcn.17c9f4bb
test eax, eax
jge 0x17ca04ca
mov ecx, dword [0x17d26008]
mov ebx, 0x17d26008
cmp ecx, ebx
je 0x17ca04cf
test byte [ecx + 0x1c], 1
je 0x17ca04cf
push eax
push esi
push 0x66
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
jmp 0x17ca04cf
mov ebx, 0x17d26008
mov eax, dword [0x17d2b110]
and eax, edi
xor ecx, ecx
or eax, ecx
je 0x17ca0508
call fcn.17ca8ea5
xor edi, edi
cmp eax, edi
jge 0x17ca050a
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca050a
test byte [ecx + 0x1c], 1
je 0x17ca050a
push eax
push esi
push 0x67
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
jmp 0x17ca050a
xor edi, edi
push edi
push 3
call fcn.17c9f4bb
cmp eax, edi
jge 0x17ca0535
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0535
test byte [ecx + 0x1c], 1
je 0x17ca0535
push eax
push esi
push 0x68
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov ecx, dword [0x17d2b114]
and ecx, 8
xor eax, eax
or eax, ecx
je 0x17ca0549
call fcn.17cfb658
mov ecx, dword [0x17d2b110]
mov eax, ecx
and eax, 0x4000000
xor edx, edx
or eax, edx
je 0x17ca0567
call fcn.17cd2972
mov ecx, dword [0x17d2b110]
and ecx, 0x8000000
xor eax, eax
or ecx, eax
je 0x17ca0578
call fcn.17cd3f06
push edi
push 3
call fcn.17c9f4bb
cmp eax, edi
jge 0x17ca05a3
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca05a3
test byte [ecx + 0x1c], 1
je 0x17ca05a3
push eax
push esi
push 0x69
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 4
xor ecx, ecx
or eax, ecx
je 0x17ca05b6
call fcn.17cd8c09
mov eax, dword [0x17d2b110]
and eax, 0x400
xor ecx, ecx
or eax, ecx
je 0x17ca05cb
call fcn.17cb8ec1
mov eax, dword [0x17d2b110]
and eax, 0x200
xor ecx, ecx
or eax, ecx
je 0x17ca0603
call fcn.17cb0ccd
cmp eax, edi
jge 0x17ca0603
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0603
test byte [ecx + 0x1c], 1
je 0x17ca0603
push eax
push esi
push 0x6a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push edi
push 3
call fcn.17c9f4bb
cmp eax, edi
jge 0x17ca062e
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca062e
test byte [ecx + 0x1c], 1
je 0x17ca062e
push eax
push esi
push 0x6b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 2
xor ecx, ecx
or eax, ecx
je 0x17ca0664
call fcn.17cac385
cmp eax, edi
jge 0x17ca0664
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0664
test byte [ecx + 0x1c], 1
je 0x17ca0664
push eax
push esi
push 0x6c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov ecx, dword [0x17d2b114]
and ecx, 1
xor eax, eax
or eax, ecx
je 0x17ca0678
call fcn.17cdcdef
push edi
push 3
call fcn.17c9f4bb
cmp eax, edi
jge 0x17ca06a3
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca06a3
test byte [ecx + 0x1c], 1
je 0x17ca06a3
push eax
push esi
push 0x6d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x200000
xor ecx, ecx
or eax, ecx
je 0x17ca06db
call fcn.17cb49f6
cmp eax, edi
jge 0x17ca06db
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca06db
test byte [ecx + 0x1c], 1
je 0x17ca06db
push eax
push esi
push 0x6e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x2000000
xor ecx, ecx
or eax, ecx
je 0x17ca06f0
call fcn.17cd00c2
push edi
push 3
call fcn.17c9f4bb
cmp eax, edi
jge 0x17ca071b
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca071b
test byte [ecx + 0x1c], 1
je 0x17ca071b
push eax
push esi
push 0x6f
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x20
xor ecx, ecx
or eax, ecx
je 0x17ca0751
call fcn.17cafa31
cmp eax, edi
jge 0x17ca0751
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0751
test byte [ecx + 0x1c], 1
je 0x17ca0751
push eax
push esi
push 0x70
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov ecx, dword [0x17d2b114]
and ecx, 0x10
xor eax, eax
or eax, ecx
je 0x17ca0765
call fcn.17ce22a1
mov eax, dword [0x17d2b110]
and eax, 0x10000
xor ecx, ecx
or eax, ecx
je 0x17ca079d
call fcn.17cab593
cmp eax, edi
jge 0x17ca079d
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca079d
test byte [ecx + 0x1c], 1
je 0x17ca079d
push eax
push esi
push 0x71
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x40000000
xor ecx, ecx
or eax, ecx
je 0x17ca07d5
call fcn.17ca20ec
cmp eax, edi
jge 0x17ca07d5
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca07d5
test byte [ecx + 0x1c], 1
je 0x17ca07d5
push eax
push esi
push 0x72
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push edi
push 3
call fcn.17c9f4bb
cmp eax, edi
jge 0x17ca0800
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0800
test byte [ecx + 0x1c], 1
je 0x17ca0800
push eax
push esi
push 0x73
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x4000
xor ecx, ecx
or eax, ecx
je 0x17ca0838
call fcn.17ca98ff
cmp eax, edi
jge 0x17ca0838
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0838
test byte [ecx + 0x1c], 1
je 0x17ca0838
push eax
push esi
push 0x74
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x20000
xor ecx, ecx
or eax, ecx
je 0x17ca0870
call fcn.17ca77eb
cmp eax, edi
jge 0x17ca0870
mov ecx, dword [0x17d26008]
cmp ecx, ebx
je 0x17ca0870
test byte [ecx + 0x1c], 1
je 0x17ca0870
push eax
push esi
push 0x75
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.17ca2c24
push 0
push 3
call fcn.17c9f4bb
mov edi, eax
test edi, edi
jge 0x17ca089d
mov eax, dword [0x17d26008]
cmp eax, ebx
je 0x17ca089d
test byte [eax + 0x1c], 1
je 0x17ca089d
push edi
push esi
push 0x76
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x10
xor ecx, ecx
or eax, ecx
je 0x17ca08d4
call fcn.17ca51d8
mov edi, eax
test edi, edi
jge 0x17ca08d4
mov eax, dword [0x17d26008]
cmp eax, ebx
je 0x17ca08d4
test byte [eax + 0x1c], 1
je 0x17ca08d4
push edi
push esi
push 0x77
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
push 0
push 3
call fcn.17c9f4bb
mov ecx, dword [0x17d2b110]
mov eax, ecx
and eax, 0x40000
xor edx, edx
or eax, edx
je 0x17ca08fb
call fcn.17cb7a4a
mov ecx, dword [0x17d2b110]
and ecx, 0x1000000
xor eax, eax
or ecx, eax
je 0x17ca0930
call fcn.17cf2498
mov edi, eax
test edi, edi
jge 0x17ca0930
mov eax, dword [0x17d26008]
cmp eax, ebx
je 0x17ca0930
test byte [eax + 0x1c], 1
je 0x17ca0930
push edi
push esi
push 0x78
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
push 0
push 3
call fcn.17c9f4bb
mov eax, dword [0x17d2b110]
and eax, 0x10000000
xor ecx, ecx
or eax, ecx
je 0x17ca094e
call fcn.17cd65fa
mov ecx, dword [0x17d2b114]
and ecx, 4
xor eax, eax
or eax, ecx
je 0x17ca0962
call fcn.17cdef1c
push 0
push 3
call fcn.17c9f4bb
mov ecx, dword [0x17d2b110]
mov eax, ecx
and eax, 0x100000
xor edx, edx
or eax, edx
je 0x17ca0989
call fcn.17cc8249
mov ecx, dword [0x17d2b110]
and ecx, 0x400000
xor eax, eax
or ecx, eax
je 0x17ca099a
call fcn.17cc98a8
push 0
push 3
call fcn.17c9f4bb
mov eax, dword [0x17d2b110]
and eax, 0x800
xor ecx, ecx
or eax, ecx
je 0x17ca09df
call fcn.17c9f194
call dword [eax + 4]
mov edi, eax
test edi, edi
jge 0x17ca09df
mov eax, dword [0x17d26008]
cmp eax, ebx
je 0x17ca09df
test byte [eax + 0x1c], 1
je 0x17ca09df
push edi
push esi
push 0x79
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x1000
xor ecx, ecx
or eax, ecx
je 0x17ca0a18
call fcn.17cb5c61
mov edi, eax
test edi, edi
jge 0x17ca0a18
mov eax, dword [0x17d26008]
cmp eax, ebx
je 0x17ca0a18
test byte [eax + 0x1c], 1
je 0x17ca0a18
push edi
push esi
push 0x7a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov eax, dword [0x17d2b110]
and eax, 0x80000
xor ecx, ecx
or eax, ecx
je 0x17ca0a2f
push 1
call fcn.17cc3a46
mov eax, dword [0x17d2b110]
and eax, 0x40
xor ecx, ecx
or eax, ecx
je 0x17ca0a66
call sub.MpClient.dll_MpConfigUninitialize
mov edi, eax
test edi, edi
jge 0x17ca0a66
mov eax, dword [0x17d26008]
cmp eax, ebx
je 0x17ca0a66
test byte [eax + 0x1c], 1
je 0x17ca0a66
push edi
push esi
push 0x7b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
and dword [0x17d2b110], 0
and dword [0x17d2b114], 0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret