Function at 0x18070
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x408
test ecx, ecx
push ebp
mov ebp, dword [esp + 0x410]
je 0x1831d
cmp dword [ecx + 0x18], 0
je 0x1831d
cmp edx, 0xffffffff
jne 0x1809b
mov edx, dword [ecx + 0x244]
push esi
mov esi, dword [ecx + 0xc9c]
and edx, 3
test esi, esi
je 0x180bf
cmp esi, 2
je 0x180bf
push ebp
call fcn.000438f0
pop esi
pop ebp
add esp, 0x408
ret 4
test eax, 0x20000000
push edi
je 0x1810d
test eax, 0x40000000
je 0x180f1
mov esi, dword [ecx + 0xc98]
cmp esi, 0xffffffff
je 0x1810d
mov edi, eax
and edi, 0xffffff
cmp dword [ecx + esi*4 + 0xb6c], edi
jne 0x1810d
or eax, 0x80000000
jmp 0x1810d
mov esi, eax
and esi, 0xffffff
cmp dword [ecx + 0xc98], esi
jne 0x1810d
mov eax, dword [ecx + esi*4 + 0xb6c]
or eax, 0xe0000000
test eax, eax
jns 0x181a6
mov ecx, dword [ecx + 8]
and edx, 3
and eax, 0xffffff
shl edx, 0x1c
or edx, eax
lea eax, [esp + 0xc]
push eax
push 0x400
mov dword [esp + 0x18], edx
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x20]
push eax
push 0x2320bc
push ecx
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
je 0x1815c
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x408
ret 4
xor eax, eax
lea ecx, [ebp + 0x200]
xor edx, edx
mov dh, byte [esp + eax*4 + 0x14]
add eax, 1
add ecx, 2
mov word [ecx + 0x1fe], dx
xor edx, edx
mov dh, byte [esp + eax*4 + 0x11]
mov word [ecx - 2], dx
xor edx, edx
cmp eax, 0x100
mov dh, byte [esp + eax*4 + 0x12]
mov word [ecx - 0x202], dx
jb 0x18164
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x408
ret 4
cmp dword [ecx + 0x23c], 3
je 0x1814e
mov esi, dword [ecx + 0x244]
and esi, 3
cmp esi, edx
jne 0x1814e
test eax, 0x40000000
push ebx
je 0x1820e
mov esi, dword [ecx + 0xafc]
and eax, 0xffffff
xor edx, edx
test esi, esi
mov ebx, eax
jbe 0x181f7
lea edi, [ecx + 0xb50]
lea ecx, [ecx]
mov eax, dword [edi]
cmp ebx, dword [ecx + eax*4 + 0xb6c]
je 0x181fb
add edx, 1
add edi, 4
cmp edx, esi
jb 0x181e0
jmp 0x181fb
mov eax, dword [esp + 0x10]
cmp edx, esi
jb 0x18213
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x408
ret 4
and eax, 0xffffff
shl eax, 8
add eax, eax
add eax, eax
lea esi, [ebp + 0x200]
mov edi, 0x40
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [eax + edx]
add eax, 0x10
add esi, 8
mov word [esi + 0x1f8], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 0xf]
mov word [esi - 8], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 0xe]
mov word [esi - 0x208], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 0xc]
mov word [esi + 0x1fa], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 0xb]
mov word [esi - 6], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 0xa]
mov word [esi - 0x206], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [eax + edx - 8]
mov word [esi + 0x1fc], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 7]
mov word [esi - 4], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 6]
mov word [esi - 0x204], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [eax + edx - 4]
mov word [esi + 0x1fe], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
mov bh, byte [edx + eax - 3]
mov word [esi - 2], bx
mov edx, dword [ecx + 0x340]
xor ebx, ebx
sub edi, 1
mov bh, byte [edx + eax - 2]
mov word [esi - 0x202], bx
jne 0x18225
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x408
ret 4
xor eax, eax
pop ebp
add esp, 0x408
ret 4