Function at 0x140171e10
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.140002db0
nop
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x98]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.14016f910
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 1
jne 0x140172067
mov eax, dword [rsp + 0x60]
and eax, 0xffefffff
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x140171eaa
lea rdx, [0x14023e9f8]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x301bf
cmp eax, 0x301bf
jne 0x140171ed8
lea rdx, [0x14023ea08]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffcfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x200a9
cmp eax, 0x200a9
jne 0x140171f06
lea rdx, str.read_execute
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x116
cmp eax, 0x116
jne 0x140171f34
lea rdx, [0x14023ea38]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffffee9
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20089
cmp eax, 0x20089
jne 0x140171f62
lea rdx, [0x14023ea48]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffdff76
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140171f7e
lea rdx, str.FILE_LIST_DIRECTORY
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140171f9a
lea rdx, str.FILE_ADD_FILE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140171fb6
lea rdx, str.FILE_ADD_SUBDIRECTORY
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140171fd2
lea rdx, str.FILE_READ_EA
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140171fee
lea rdx, [0x14023eaf8]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017200a
lea rdx, str.FILE_TRAVERSE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140172026
lea rdx, str.FILE_DELETE_CHILD
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140172044
lea rdx, str.FILE_READ_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x140172062
lea rdx, str.FILE_WRITE_ATTRIBUTES
lea rcx, [rsp + 0x20]
call fcn.140006000
jmp 0x140172721
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 4
jne 0x1401721dc
mov eax, dword [rsp + 0x60]
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x1401720a7
lea rdx, [0x14023ebc0]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20019
cmp eax, 0x20019
jne 0x1401720d5
lea rdx, [0x14023ebd0]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffdffe6
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x1401720f1
lea rdx, [0x14023ebe0]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14017210d
lea rdx, str.KEY_CREATE_SUB_KEY
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140172129
lea rdx, str.KEY_ENUMERATE_SUB_KEYS
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x140172147
lea rdx, str.KEY_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x140172163
lea rdx, str.KEY_NOTIFY
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017217f
lea rdx, str.KEY_QUERY_VALUE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20019
test eax, eax
je 0x14017219d
lea rdx, str.KEY_READ
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x1401721b9
lea rdx, str.KEY_SET_VALUE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20006
test eax, eax
je 0x1401721d7
lea rdx, str.KEY_WRITE
lea rcx, [rsp + 0x20]
call fcn.140006000
jmp 0x140172721
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 2
jne 0x14017237d
mov eax, dword [rsp + 0x60]
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x14017221c
lea rdx, [0x14023ed10]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x14017224a
lea rdx, str.start_stop
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe02
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x2018d
cmp eax, 0x2018d
jne 0x140172278
lea rdx, [0x14023ed38]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfe72
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140172294
lea rdx, [0x14023ed48]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401722b0
lea rdx, str.SERVICE_ENUMERATE_DEPENDENTS
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x1401722ce
lea rdx, [0x14023edb8]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x1401722ea
lea rdx, str.SERVICE_PAUSE_CONTINUE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x140172306
lea rdx, str.SERVICE_QUERY_CONFIG
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140172322
lea rdx, [0x14023ee48]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017233e
lea rdx, [0x14023ee78]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x14017235a
lea rdx, str.SERVICE_STOP
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x100
test eax, eax
je 0x140172378
lea rdx, str.SERVICE_USER_DEFINED_CONTROL
lea rcx, [rsp + 0x20]
call fcn.140006000
jmp 0x140172721
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 3
jne 0x14017248e
mov eax, dword [rsp + 0x60]
and eax, 0xf000c
cmp eax, 0xf000c
jne 0x1401723bd
lea rdx, str.manage_printer
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfff0fff3
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0xf0030
cmp eax, 0xf0030
jne 0x1401723eb
lea rdx, str.manage_documents
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfff0ffcf
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x20008
cmp eax, 0x20008
jne 0x140172419
lea rdx, [0x14023ef40]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffdfff7
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140172435
lea rdx, str.PRINTER_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x140172451
lea rdx, str.PRINTER_ACCESS_USE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14017246d
lea rdx, str.JOB_ACCESS_ADMINISTER
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x140172489
lea rdx, str.JOB_ACCESS_READ
lea rcx, [rsp + 0x20]
call fcn.140006000
jmp 0x140172721
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 5
jne 0x140172587
mov eax, dword [rsp + 0x60]
and eax, 0x1f01ff
cmp eax, 0x1f01ff
jne 0x1401724ce
lea rdx, [0x14023f008]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xffe0fe00
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x1401724fc
lea rdx, str.change
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xffecfe40
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1200a9
cmp eax, 0x1200a9
jne 0x14017252a
lea rdx, [0x14023f028]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xffedff56
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x1bf
test eax, eax
je 0x140172548
lea rdx, [0x14023f038]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xa9
test eax, eax
je 0x140172566
lea rdx, str.SHARE_CHANGE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140172582
lea rdx, [0x14023f070]
lea rcx, [rsp + 0x20]
call fcn.140006000
jmp 0x140172721
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x98], 0xb
jne 0x140172721
mov eax, dword [rsp + 0x60]
and eax, 0x6003f
cmp eax, 0x6003f
jne 0x1401725c7
lea rdx, str.full
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfff9ffc0
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x13
cmp eax, 0x13
jne 0x1401725ef
lea rdx, [0x14023f0a0]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xffffffec
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 0x21
cmp eax, 0x21
jne 0x140172617
lea rdx, str.remote_access
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xffffffde
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
cmp eax, 1
jne 0x14017263f
lea rdx, str.enable_account
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
and eax, 1
test eax, eax
je 0x14017265b
lea rdx, str.WBEM_ENABLE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 2
test eax, eax
je 0x140172677
lea rdx, str.WBEM_METHOD_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x140172693
lea rdx, str.WBEM_FULL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x1401726af
lea rdx, str.WBEM_PARTIAL_WRITE_REP
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x1401726cb
lea rdx, str.WBEM_WRITE_PROVIDER
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20
test eax, eax
je 0x1401726e7
lea rdx, str.WBEM_REMOTE_ACCESS
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x40
test eax, eax
je 0x140172703
lea rdx, str.WBEM_RIGHT_SUBSCRIBE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x80
test eax, eax
je 0x140172721
lea rdx, [0x14023f230]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20000
test eax, eax
je 0x14017273f
lea rdx, str.READ_CONTROL
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x80000
test eax, eax
je 0x14017275d
lea rdx, [0x14023f278]
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x40000
test eax, eax
je 0x14017277b
lea rdx, str.WRITE_DAC
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10000
test eax, eax
je 0x140172799
lea rdx, str.DELETE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x100000
test eax, eax
je 0x1401727b7
lea rdx, str.SYNCHRONIZE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x1000000
test eax, eax
je 0x1401727d5
lea rdx, str.ACCESS_SYSTEM_SECURITY
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x10000000
test eax, eax
je 0x1401727f3
lea rdx, str.GENERIC_ALL
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x20000000
test eax, eax
je 0x140172811
lea rdx, str.GENERIC_EXECUTE
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x80000000
test eax, eax
je 0x14017282f
lea rdx, str.GENERIC_READ
lea rcx, [rsp + 0x20]
call fcn.140006000
mov eax, dword [rsp + 0x60]
and eax, 0x40000000
test eax, eax
je 0x14017284d
lea rdx, [0x14023f378]
lea rcx, [rsp + 0x20]
call fcn.140006000
lea rdx, [0x14023ea04]
lea rcx, [rsp + 0x20]
call fcn.140008000
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.140001430
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.140001490
mov rax, qword [rsp + 0x58]
add rsp, 0x48
ret