Function at 0x409bd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc], 0
mov byte [ebp + 0xf], 0
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x24], 0
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x28], ecx
call fcn.0040b130
mov esi, dword [ebp + 0x10]
mov edx, eax
add esp, 8
mov dword [ebp - 0x10], edx
test edx, edx
je 0x40a18a
movzx ecx, word [edx]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, 0x8000
add eax, 0x45c310
mov dword [ebp - 0x1c], eax
movzx eax, byte [eax]
mov ebx, dword [eax*4 + 0x45c178]
mov ax, word [edx + 2]
and ax, cx
movzx eax, ax
mov dword [ebp - 0x2c], eax
test ax, ax
je 0x409c63
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
shr eax, 0x10
and eax, 0x7fff
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], eax
cmp dword [edi + 0x18], 1
jne 0x409c90
mov eax, dword [edi]
test eax, 0x2000
je 0x409c90
cmp dword [edi + 0x20], 0
jne 0x409c90
test byte [ebp - 0x18], 8
je 0x409c90
and eax, 0xffffdfff
push 3
push edi
mov dword [edi], eax
call fcn.0040d700
add esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 8], edx
cmp edx, 2
jne 0x409cae
test ebx, 0x800000
jne 0x40a18a
cmp edx, edx
je 0x409cba
test ebx, 0x8000000
jne 0x40a18a
test bl, 1
je 0x409d02
mov eax, ebx
not eax
test eax, 0x40000000
je 0x409cd6
inc dword [ecx + 0x10]
dec dword [ecx + 0x14]
js 0x40a18a
mov eax, dword [ecx + 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0xc], eax
test ebx, 0x10000000
je 0x409cef
test al, 0x38
jne 0x40a18a
test ebx, 0x100000
je 0x409d02
cmp eax, 0xc0
jb 0x40a18a
inc dword [ecx + 0x10]
mov edx, dword [edi]
push ebx
push dword [ebp - 0x18]
push edx
push dword [ebp - 8]
call fcn.00409b80
add esp, 0x10
mov dword [ebp - 0x14], eax
test edx, 0x4000
je 0x409d2f
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x45c15c]
mov dword [ebp - 8], eax
push 0x40
push 0
push esi
call fcn.00434f70
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov byte [esi + 0x34], 0xff
mov al, byte [eax + 2]
test al, al
je 0x409e1a
lea ecx, [ebp - 0x24]
movzx eax, al
push ecx
push dword [ebp - 8]
push dword [ebp - 0x14]
push edi
push dword [ebp - 0xc]
push 0
push eax
push ebx
push dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.0040ba70
add esp, 0x2c
test eax, eax
je 0x40a18a
mov eax, dword [ebp - 0x1c]
mov al, byte [eax + 1]
test al, al
je 0x409e1a
push 0
push dword [ebp - 8]
movzx eax, al
push dword [ebp - 0x14]
push edi
push dword [ebp - 0xc]
push 1
push eax
push ebx
push dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.0040ba70
add esp, 0x2c
test eax, eax
je 0x40a18a
test ebx, 0x20000
je 0x409e1a
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 8]
push dword [ebp - 0x14]
movzx eax, byte [ecx + 5]
push edi
push dword [ebp - 0xc]
push 2
push eax
push ebx
push ecx
push esi
push dword [ebp + 8]
call fcn.0040ba70
add esp, 0x2c
test eax, eax
je 0x40a18a
test ebx, 0x40000
je 0x409e1a
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp - 8]
push dword [ebp - 0x14]
movzx eax, byte [ecx + 6]
push edi
push dword [ebp - 0xc]
push 3
push eax
push ebx
push ecx
push esi
push dword [ebp + 8]
call fcn.0040ba70
add esp, 0x2c
test eax, eax
je 0x40a18a
test ebx, 0x200000
je 0x409e58
push dword [ebp + 8]
call fcn.0040b5f0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x40a18a
movzx eax, word [ecx]
lea edx, [eax*8]
sub edx, eax
add edx, 0x45c310
mov dword [ebp - 0x1c], edx
movzx eax, byte [edx]
mov ebx, dword [eax*4 + 0x45c178]
jmp 0x409e5b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, ebx
and eax, 0x400000
mov dword [ebp - 0x10], eax
je 0x409e9a
dec dword [edx + 0x14]
js 0x40a18a
mov eax, dword [edx + 0x10]
mov dl, byte [eax]
inc eax
mov byte [ebp + 0xf], dl
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
test ebx, 0x20000000
je 0x409e90
cmp byte [ebp + 0xf], 0x20
jmp 0x409e94
cmp byte [ebp + 0xf], 8
jae 0x40a18a
mov eax, dword [edx + 0x10]
sub eax, dword [edi + 8]
cmp eax, 0xf
jg 0x40a18a
cmp dword [ebp - 0x24], 1
jne 0x409ebf
test bl, 0x10
je 0x409ebf
or dword [edi + 4], 0x10
or word [esi + 0x18], 1
jmp 0x409ee7
test bl, 0x20
je 0x409ed4
test byte [edi], 0x20
je 0x409ed4
or dword [edi + 4], 0x20
or word [esi + 0x18], 2
jmp 0x409ee7
test bl, 0x40
je 0x409ee7
test byte [edi], 0x40
je 0x409ee7
or dword [edi + 4], 0x40
or word [esi + 0x18], 4
mov eax, ebx
and eax, 0x14000
cmp eax, 0x14000
jne 0x409f14
or dword [edi + 4], 0x4000
mov edx, dword [ebp - 8]
test edx, edx
je 0x409f5b
cmp edx, 1
jne 0x409f0e
mov ax, word [ecx + 8]
jmp 0x409f5f
mov ax, word [ecx + 0xa]
jmp 0x409f5f
mov eax, ebx
and eax, 0xc000
cmp eax, 0xc000
jne 0x409f36
mov ax, word [ecx + 2]
mov edx, dword [ebp - 8]
mov word [esi + 0x20], ax
or dword [edi + 4], 0x4000
jmp 0x409f63
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x409fd4
test ebx, 0x10000
je 0x409f58
test ebx, 0x1000008
jne 0x409f58
or dword [edi + 4], 0x2000
mov edx, dword [ebp - 8]
mov ax, word [ecx + 2]
mov word [esi + 0x20], ax
test ebx, 0x8000
je 0x409f7a
test dword [edi], 0x2000
je 0x409f7a
or dword [edi + 4], 0x2000
mov eax, ebx
and eax, 0x20000000
mov dword [ebp - 0x14], eax
je 0x409fb1
mov dl, byte [ecx + 4]
mov byte [ebp - 1], dl
test dl, 4
mov edx, dword [ebp - 8]
je 0x409f9a
test byte [ebp - 0x18], 8
jne 0x409fa6
test byte [ebp - 1], 8
je 0x409fb1
test byte [ebp - 0x18], 0x10
je 0x409fb1
mov ax, word [ecx + 8]
mov word [esi + 0x20], ax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x40a07d
test eax, eax
movzx eax, byte [ebp + 0xf]
je 0x40a06d
mov ax, word [eax*2 + 0x4621e0]
jmp 0x40a075
cmp eax, 1
jne 0x40a022
mov eax, pe_nt_image_headers32
or word [esi + 0x18], ax
test ebx, 0x10000
je 0x409f58
or dword [edi + 4], 0x2000
test ebx, 0x80000
je 0x40a016
cmp dword [ebp - 0xc], 0xc0
mov edx, dword [ebp - 8]
jae 0x409f5b
mov ax, word [ecx + 8]
jmp 0x409f5f
mov ax, word [ecx + 8]
mov edx, dword [ebp - 8]
jmp 0x409f5f
mov eax, 0x200
or word [esi + 0x18], ax
test ebx, 0x4010000
je 0x409f58
test ebx, 0x80000
je 0x40a04c
cmp dword [ebp - 0xc], 0xc0
jae 0x40a18a
test ebx, 0x4000000
je 0x40a016
test byte [ebp - 0x18], 8
je 0x40a016
or dword [edi + 4], 0x2000000
mov ax, word [ecx + 0xa]
mov edx, dword [ebp - 8]
jmp 0x409f5f
mov ax, word [eax*2 + 0x4621d0]
add ax, word [ecx + 2]
mov word [esi + 0x20], ax
and edx, 3
shl edx, 0xa
or word [esi + 0x18], dx
mov ax, word [esi + 0x18]
test ebx, ebx
jns 0x40a096
or eax, 0x40
mov word [esi + 0x18], ax
push edi
call fcn.0040d8a0
mov ebx, dword [ebp - 0x1c]
add esp, 4
mov word [esi + 0x1a], ax
mov eax, dword [ebp - 0x2c]
or word [esi + 0x18], ax
cmp byte [esi + 0x33], 0
mov al, byte [ebx + 3]
mov byte [esi + 0x37], al
jne 0x40a0bd
mov byte [esi + 0x33], 0xff
mov al, byte [esi + 0x34]
cmp al, 0xff
je 0x40a0d1
movzx eax, al
mov eax, dword [eax*4 + 0x462238]
or dword [esi + 0x1c], eax
mov dl, byte [ebx + 4]
mov al, dl
and al, 2
movzx ecx, al
mov al, dl
and al, 8
add cx, cx
movzx eax, al
or cx, ax
mov al, dl
and al, 0x20
add cx, cx
movzx eax, al
and dl, 0xd5
or cx, ax
movzx eax, dl
shl cx, 6
or cx, ax
mov word [esi + 0x38], cx
mov dl, byte [ebx + 5]
mov al, dl
and al, 2
movzx ecx, al
mov al, dl
and al, 8
add cx, cx
movzx eax, al
or cx, ax
mov al, dl
and al, 0x20
add cx, cx
movzx eax, al
and dl, 0xd5
or cx, ax
movzx eax, dl
shl cx, 6
or cx, ax
mov word [esi + 0x3a], cx
mov dl, byte [ebx + 6]
mov al, dl
and al, 2
movzx ecx, al
mov al, dl
and al, 8
add cx, cx
movzx eax, al
or cx, ax
mov al, dl
and al, 0x20
add cx, cx
movzx eax, al
and dl, 0xd5
or cx, ax
movzx eax, dl
shl cx, 6
or cx, ax
mov eax, dword [ebp + 8]
mov word [esi + 0x3c], cx
mov ecx, dword [ebp - 0x28]
pop edi
mov al, byte [eax + 0x10]
sub al, cl
mov byte [esi + 0x32], al
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x40
push 0
push esi
call fcn.00434f70
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov byte [esi + 0x34], 0xff
mov byte [esi + 0x32], 1
mov dword [edi + 4], 0
cmp byte [ecx], 0x9b
jne 0x40a1c7
or byte [esi + 0x37], 8
mov eax, 0x273a
pop edi
mov word [esi + 0x20], ax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret