Function at 0x85ca70
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebp, 0x16
cmp qword [rcx], 0xffffffffffffffff
mov dword [rsp + 0x64], 0xffffffff
mov r12, rcx
mov r15, rdx
mov ebx, r8d
jne 0x85cd80
test r8d, 0xfc00bffe
jne 0x85cd80
mov rcx, rdx
call sym.strlen
movsxd r13, eax
test bh, 0x40
je 0x85cd98
lea ecx, [r13 + r13 + 7]
movsxd rcx, ecx
call sym.malloc
mov r14, rax
test rax, rax
je 0x85cf4c
lea r13, [rax + r13 + 6]
mov r8, r15
lea rdx, str._s_lock
mov rcx, rax
call sym.sprintf
mov rdx, r15
mov rcx, r13
call sym.strcpy
or ebx, dword [r12 + 0x18]
test ebx, 0x20000
je 0x85cded
and ebx, 0xfff7ffff
mov esi, ebx
or esi, 0x20000000
mov dword [r12 + 0x18], esi
mov rcx, r15
call sym.strdup
mov r15d, dword [r12 + 0x30]
mov edx, 0x30
mov qword [r12 + 0x38], rax
mov rcx, r15
mov qword [rsp + 0x48], rax
call sym.calloc
mov edx, 2
mov rcx, r15
mov qword [r12 + 0x90], rax
mov rdi, rax
call sym.calloc
mov edx, 4
mov rcx, r15
mov qword [r12 + 0x98], rax
mov rbp, rax
call sym.calloc
mov r8, qword [rsp + 0x48]
test rdi, rdi
sete dl
mov qword [r12 + 0xa0], rax
test r8, r8
sete cl
or edx, ecx
test rbp, rbp
sete cl
or dl, cl
jne 0x85ce38
test rax, rax
je 0x85ce38
lea rax, [sym.mdb_cmp_long]
mov qword [rdi + 0x10], rax
mov eax, ebx
and eax, 0x420000
mov dword [rsp + 0x54], eax
je 0x85ce50
mov edi, ebx
lea rax, [rsp + 0x68]
mov rcx, r13
and edi, 0x20000
mov rdx, rax
mov qword [rsp + 0x58], rax
cmp edi, 1
sbb r8d, r8d
not r8d
add r8d, 4
cmp edi, 1
sbb r15d, r15d
mov dword [rsp + 0x48], r8d
call sym.utf8_to_utf16.constprop.0
and r15d, 0x40000000
mov r8d, dword [rsp + 0x48]
add r15d, 0x80000000
test eax, eax
mov ebp, eax
jne 0x85ce70
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov rcx, qword [rsp + 0x68]
mov edx, r15d
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, 3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x48], rax
call rax
mov rcx, qword [rsp + 0x68]
mov qword [r12], rax
call sym.free
cmp qword [r12], 0xffffffffffffffff
je 0x85cf39
cmp dword [rsp + 0x54], 0x20000
je 0x85ce98
and esi, 0x2000000
mov rcx, r12
mov edx, esi
call fcn.0085b3d0
test eax, eax
jne 0x85cd60
test ebx, 0xa0000
je 0x85ced8
mov rax, qword [r12]
mov qword [r12 + 0x10], rax
mov eax, dword [rsp + 0x64]
test eax, eax
jle 0x85ccb1
and ebx, 0x2000000
je 0x85cd46
test edi, edi
jne 0x85cd78
mov ebx, dword [r12 + 0x30]
mov edx, dword [r12 + 0x1c]
mov ecx, 1
call sym.calloc
imul esi, ebx, 0x3d
mov qword [r12 + 0x60], rax
add esi, 0x88
test rax, rax
je 0x85ce38
movsxd rdx, esi
mov ecx, 1
call sym.calloc
test rax, rax
je 0x85ce38
mov edx, ebx
lea r8, [rax + 0x88]
mov qword [rax + 0x20], r12
xor ebp, ebp
lea rcx, [rdx + rdx*2]
mov qword [rax + 0x58], r8
shl rcx, 4
mov dword [rax + 0x7c], 1
add rcx, r8
mov qword [r12 + 0x70], rax
mov qword [rax + 0x68], rcx
lea rcx, [rcx + rdx*8]
lea rdx, [rcx + rdx*4]
mov qword [rax + 0x60], rcx
mov qword [rax + 0x70], rdx
mov rdx, qword [r12 + 0x90]
mov qword [rax + 0x50], rdx
jmp 0x85cd78
lea rdx, [rsp + 0x64]
mov rcx, r12
call fcn.0085b1d0
test eax, eax
je 0x85ccb1
nop dword [rax + rax]
mov edx, dword [rsp + 0x64]
mov ebp, eax
nop word cs:[rax + rax]
mov rcx, r12
call fcn.0085b8d0
mov rcx, r14
call sym.free
mov eax, ebp
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r13, 0xa
lea ecx, [r13 + r13]
movsxd rcx, ecx
call sym.malloc
mov r14, rax
test rax, rax
je 0x85cf4c
add r13, rax
mov r8, r15
lea rdx, str._s_lock.mdb
mov rcx, rax
call sym.sprintf
mov r8, r15
lea rdx, str._s_data.mdb
mov rcx, r13
call sym.sprintf
or ebx, dword [r12 + 0x18]
test ebx, 0x20000
jne 0x85cb0d
mov ecx, 0x1ffff
mov esi, ebx
call sym.mdb_midl_alloc
or esi, 0x20000000
mov qword [r12 + 0xd0], rax
test rax, rax
je 0x85ce80
mov edx, 0x10
mov ecx, 0x20000
call sym.calloc
mov dword [r12 + 0x18], esi
mov qword [r12 + 0xd8], rax
test rax, rax
jne 0x85cb20
nop dword [rax]
mov edx, dword [rsp + 0x64]
mov ebp, 0xc
jmp 0x85cd70
lea r8, [rsp + 0x64]
mov rdx, r14
mov rcx, r12
call fcn.0085bd20
mov ebp, eax
test eax, eax
je 0x85cbc2
nop word [rax + rax]
mov edx, dword [rsp + 0x64]
jmp 0x85cd70
mov dword [r12 + 0x18], esi
mov edx, dword [rsp + 0x64]
mov ebp, 0xc
jmp 0x85cd70
lea r8, [rsp + 0x64]
mov rdx, r14
mov rcx, r12
call fcn.0085bd20
test eax, eax
jne 0x85cd60
test ebx, 0x2000000
je 0x85cc70
mov edx, dword [rsp + 0x64]
test edx, edx
jne 0x85cc70
mov ebp, 0xb
jmp 0x85cd70
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call sym.utf8_to_utf16.constprop.0
test eax, eax
jne 0x85cd60
xor r9d, r9d
mov rcx, qword [rsp + 0x68]
mov edx, r15d
mov rax, qword [rsp + 0x48]
mov r8d, 3
mov dword [rsp + 0x28], 0x80000080
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call rax
mov rcx, qword [rsp + 0x68]
mov qword [r12 + 0x10], rax
call sym.free
cmp qword [r12 + 0x10], 0xffffffffffffffff
jne 0x85cc9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x85cd78
jmp 0x85cd60
mov ebp, 0xc
jmp 0x85cd80