Function at 0x403ffe
Capabilities:
Inspect section memory permissions

Disassembly:
push 0x24
mov eax, 0x42e2d7
call fcn.00419920
mov ebx, ecx
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00401e90
mov eax, dword [ebx + 0x50]
and dword [ebp - 4], 0
cmp eax, 1
mov ecx, 0x1f01ff
mov edi, 0xf003f
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], 0x120089
mov dword [ebp - 0x1c], 0x120116
mov dword [ebp - 0x18], 0x1200a0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x30], 0x120019
mov dword [ebp - 0x2c], 0x20006
mov dword [ebp - 0x28], 0x20019
mov dword [ebp - 0x24], edi
jne 0x4041cb
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
and dword [ebp + 0xc], 0xffefffff
mov ecx, dword [ebp + 0xc]
mov eax, 0xf01ff
and ecx, eax
cmp ecx, eax
jne 0x4040a1
push str.full
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfff0fe00
mov ecx, dword [ebp + 0xc]
mov eax, 0x301bf
and ecx, eax
cmp ecx, eax
jne 0x4040c2
push 0x431f9c
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffcfe40
mov ecx, dword [ebp + 0xc]
mov eax, 0x200a9
and ecx, eax
cmp ecx, eax
jne 0x4040e3
push str.read_execute
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffdff56
mov ecx, dword [ebp + 0xc]
mov eax, 0x116
and ecx, eax
cmp ecx, eax
jne 0x404104
push 0x431f70
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffffee9
mov ecx, dword [ebp + 0xc]
mov eax, 0x20089
and ecx, eax
cmp ecx, eax
jne 0x404125
push 0x431f64
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffdff76
test byte [ebp + 0xc], 1
je 0x404137
push str.FILE_LIST_DIRECTORY
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 2
je 0x404149
push str.FILE_ADD_FILE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 4
je 0x40415b
push str.FILE_ADD_SUBDIRECTORY
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 8
je 0x40416d
push str.FILE_READ_EA
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x10
je 0x40417f
push str.FILE_WRITE_EA
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x20
je 0x404191
push str.FILE_TRAVERSE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x40
je 0x4041a3
push str.FILE_DELETE_CHILD
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x80
je 0x4041b5
push str.FILE_READ_ATTRIBUTES
mov ecx, esi
call fcn.00402d67
test word [ebp + 0xc], 0x100
je 0x40452a
push str.FILE_WRITE_ATTRIBUTES
jmp 0x404523
push 4
pop ebx
cmp eax, ebx
jne 0x4042c5
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov eax, dword [ebp + 0xc]
and eax, edi
cmp eax, edi
jne 0x404200
push str.full
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfff0ffc0
mov eax, dword [ebp + 0xc]
mov edi, 0x20019
and eax, edi
cmp eax, edi
jne 0x404221
push 0x431f64
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffdffe6
test byte [ebp + 0xc], 0x20
je 0x404233
push str.KEY_CREATE_LINK
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], bl
je 0x404244
push str.KEY_CREATE_SUB_KEY
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 8
je 0x404256
push str.KEY_ENUMERATE_SUB_KEYS
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], edi
je 0x404267
push str.KEY_EXECUTE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x10
je 0x404279
push str.KEY_NOTIFY
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 1
je 0x40428b
push str.KEY_QUERY_VALUE
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], edi
je 0x40429c
push str.KEY_READ
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 2
je 0x4042ae
push str.KEY_SET_VALUE
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x20006
je 0x40452a
push str.KEY_WRITE
jmp 0x404523
cmp eax, 2
jne 0x4043d6
mov ecx, dword [ebp + 0xc]
mov eax, 0xf01ff
and ecx, eax
cmp ecx, eax
jne 0x4042ef
push str.full
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfff0fe00
mov ecx, dword [ebp + 0xc]
mov eax, 0x201fd
and ecx, eax
cmp ecx, eax
jne 0x404310
push 0x431cd0
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffdfe02
mov ecx, dword [ebp + 0xc]
mov eax, 0x2018d
and ecx, eax
cmp ecx, eax
jne 0x404331
push 0x431f64
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffdfe72
test byte [ebp + 0xc], 2
je 0x404343
push str.SERVICE_CHANGE_CONFIG
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 8
je 0x404355
push str.SERVICE_ENUMERATE_DEPENDENTS
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x80
je 0x404367
push str.SERVICE_INTERROGATE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x40
je 0x404379
push str.SERVICE_PAUSE_CONTINUE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 1
je 0x40438b
push str.SERVICE_QUERY_CONFIG
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], bl
je 0x40439c
push str.SERVICE_QUERY_STATUS
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x10
je 0x4043ae
push str.SERVICE_START
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x20
je 0x4043c0
push str.SERVICE_STOP
mov ecx, esi
call fcn.00402d67
test word [ebp + 0xc], 0x100
je 0x40452a
push str.SERVICE_USER_DEFINED_CONTROL
jmp 0x404523
cmp eax, 3
jne 0x40448b
mov ecx, dword [ebp + 0xc]
mov eax, 0xf000c
and ecx, eax
cmp ecx, eax
jne 0x404400
push str.manage_printer
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfff0fff3
mov ecx, dword [ebp + 0xc]
mov eax, 0xf0030
and ecx, eax
cmp ecx, eax
jne 0x404421
push str.manage_documents
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfff0ffcf
mov ecx, dword [ebp + 0xc]
mov eax, 0x20008
and ecx, eax
cmp ecx, eax
jne 0x404442
push 0x431ae4
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xfffdfff7
test byte [ebp + 0xc], bl
je 0x404453
push str.PRINTER_ACCESS_ADMINISTER
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 8
je 0x404465
push str.PRINTER_ACCESS_USE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x10
je 0x404477
push str.JOB_ACCESS_ADMINISTER
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x20
je 0x40452a
push str.JOB_ACCESS_READ
jmp 0x404523
cmp eax, 5
jne 0x404608
mov eax, dword [ebp + 0xc]
and eax, ecx
cmp eax, ecx
jne 0x4044b0
push str.full
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xffe0fe00
mov ecx, dword [ebp + 0xc]
mov eax, 0x1301bf
and ecx, eax
cmp ecx, eax
jne 0x4044d1
push 0x431f9c
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xffecfe40
mov ecx, dword [ebp + 0xc]
mov eax, 0x1200a9
and ecx, eax
cmp ecx, eax
jne 0x4044f2
push 0x431f64
mov ecx, esi
call fcn.00402d8c
and dword [ebp + 0xc], 0xffedff56
test word [ebp + 0xc], 0x1bf
je 0x404506
push str.SHARE_READ
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0xa9
je 0x404518
push str.SHARE_CHANGE
mov ecx, esi
call fcn.00402d67
test byte [ebp + 0xc], 0x40
je 0x40452a
push str.SHARE_WRITE
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x20000
je 0x40453f
push str.READ_CONTROL
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x80000
je 0x404554
push str.WRITE_OWNER
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x40000
je 0x404569
push str.WRITE_DAC
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x10000
je 0x40457e
push str.DELETE
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x100000
je 0x404593
push str.SYNCHRONIZE
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x1000000
je 0x4045a8
push str.ACCESS_SYSTEM_SECURITY
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x10000000
je 0x4045bd
push str.GENERIC_ALL
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x20000000
je 0x4045d2
push str.GENERIC_EXECUTE
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x80000000
je 0x4045e7
push str.GENERIC_READ
mov ecx, esi
call fcn.00402d67
test dword [ebp + 0xc], 0x40000000
je 0x4045fc
push 0x4318b8
mov ecx, esi
call fcn.00402d67
push 0x4318b4
mov ecx, esi
call fcn.00402aef
mov eax, esi
call fcn.00419989
ret 8