Function at 0x409900
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e7b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov edi, ecx
mov dword [ebp - 0x10], 0
call fcn.00415f44
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x409948
push 0x80004005
call fcn.0040f420
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x34]
mov dword [ebp - 0x10], 1
call fcn.0040ca80
mov ebx, eax
mov eax, dword [edi + 0x34]
cmp eax, 1
jne 0x409ae4
and ebx, 0xffefffff
mov ecx, ebx
and ecx, 0xf01ff
cmp ecx, 0xf01ff
jne 0x4099a6
push 5
push 0x46d948
mov ecx, esi
call fcn.0040da80
and ebx, 0xfff0fe00
mov eax, ebx
and eax, 0x301bf
cmp eax, 0x301bf
jne 0x4099c8
push 7
push str.change
mov ecx, esi
call fcn.0040da80
and ebx, 0xfffcfe40
mov eax, ebx
and eax, 0x200a9
cmp eax, 0x200a9
jne 0x4099ea
push 0xd
push str.read_execute
mov ecx, esi
call fcn.0040da80
and ebx, 0xfffdff56
mov eax, ebx
and eax, 0x116
cmp eax, 0x116
jne 0x409a0c
push 6
push str.write
mov ecx, esi
call fcn.0040da80
and ebx, 0xfffffee9
mov eax, ebx
and eax, 0x20089
cmp eax, 0x20089
jne 0x409a2e
push 5
push str.read
mov ecx, esi
call fcn.0040da80
and ebx, 0xfffdff76
test bl, 1
je 0x409a41
push 0x14
push str.FILE_LIST_DIRECTORY
mov ecx, esi
call fcn.0040da80
test bl, 2
je 0x409a54
push 0xe
push str.FILE_ADD_FILE
mov ecx, esi
call fcn.0040da80
test bl, 4
je 0x409a67
push 0x16
push str.FILE_ADD_SUBDIRECTORY
mov ecx, esi
call fcn.0040da80
test bl, 8
je 0x409a7a
push 0xd
push str.FILE_READ_EA
mov ecx, esi
call fcn.0040da80
test bl, 0x10
je 0x409a8d
push 0xe
push str.FILE_WRITE_EA
mov ecx, esi
call fcn.0040da80
test bl, 0x20
je 0x409aa0
push 0xe
push str.FILE_TRAVERSE
mov ecx, esi
call fcn.0040da80
test bl, 0x40
je 0x409ab3
push 0x12
push str.FILE_DELETE_CHILD
mov ecx, esi
call fcn.0040da80
test bl, bl
jns 0x409ac5
push 0x15
push str.FILE_READ_ATTRIBUTES
mov ecx, esi
call fcn.0040da80
test ebx, 0x100
je 0x409d91
push 0x16
push str.FILE_WRITE_ATTRIBUTES
mov ecx, esi
call fcn.0040da80
jmp 0x409d91
cmp eax, 4
jne 0x409bec
mov eax, ebx
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x409b0f
push 5
push 0x46d948
mov ecx, esi
call fcn.0040da80
and ebx, 0xfff0ffc0
mov eax, ebx
and eax, 0x20019
cmp eax, 0x20019
jne 0x409b31
push 5
push str.read
mov ecx, esi
call fcn.0040da80
and ebx, 0xfffdffe6
test bl, 0x20
je 0x409b44
push 0x10
push str.KEY_CREATE_LINK
mov ecx, esi
call fcn.0040da80
test bl, 4
je 0x409b57
push 0x13
push str.KEY_CREATE_SUB_KEY
mov ecx, esi
call fcn.0040da80
test bl, 8
je 0x409b6a
push 0x17
push str.KEY_ENUMERATE_SUB_KEYS
mov ecx, esi
call fcn.0040da80
mov edi, ebx
and edi, 0x20019
je 0x409b82
push 0xc
push str.KEY_EXECUTE
mov ecx, esi
call fcn.0040da80
test bl, 0x10
je 0x409b95
push 0xb
push str.KEY_NOTIFY
mov ecx, esi
call fcn.0040da80
test bl, 1
je 0x409ba8
push 0x10
push str.KEY_QUERY_VALUE
mov ecx, esi
call fcn.0040da80
test edi, edi
je 0x409bba
push 9
push str.KEY_READ
mov ecx, esi
call fcn.0040da80
test bl, 2
je 0x409bcd
push 0xe
push str.KEY_SET_VALUE
mov ecx, esi
call fcn.0040da80
test ebx, 0x20006
je 0x409d91
push 0xa
push str.KEY_WRITE
mov ecx, esi
call fcn.0040da80
jmp 0x409d91
cmp eax, 2
jne 0x409cf2
mov eax, ebx
and eax, 0xf01ff
cmp eax, 0xf01ff
jne 0x409c15
push 0x46d948
mov ecx, esi
call fcn.0040d810
and ebx, 0xfff0fe00
mov eax, ebx
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x409c35
push str.start_stop
mov ecx, esi
call fcn.0040d810
and ebx, 0xfffdfe02
mov eax, ebx
and eax, 0x2018d
cmp eax, 0x2018d
jne 0x409c55
push str.read
mov ecx, esi
call fcn.0040d810
and ebx, 0xfffdfe72
test bl, 2
je 0x409c66
push str.SERVICE_CHANGE_CONFIG
mov ecx, esi
call fcn.0040d810
test bl, 8
je 0x409c77
push str.SERVICE_ENUMERATE_DEPENDENTS
mov ecx, esi
call fcn.0040d810
test bl, bl
jns 0x409c87
push str.SERVICE_INTERROGATE
mov ecx, esi
call fcn.0040d810
test bl, 0x40
je 0x409c98
push str.SERVICE_PAUSE_CONTINUE
mov ecx, esi
call fcn.0040d810
test bl, 1
je 0x409ca9
push str.SERVICE_QUERY_CONFIG
mov ecx, esi
call fcn.0040d810
test bl, 4
je 0x409cba
push str.SERVICE_QUERY_STATUS
mov ecx, esi
call fcn.0040d810
test bl, 0x10
je 0x409ccb
push str.SERVICE_START
mov ecx, esi
call fcn.0040d810
test bl, 0x20
je 0x409cdc
push str.SERVICE_STOP
mov ecx, esi
call fcn.0040d810
test ebx, 0x100
je 0x409d91
push str.SERVICE_USER_DEFINED_CONTROL
jmp 0x409d8a
cmp eax, 5
jne 0x409d91
mov eax, ebx
and eax, 0x1f01ff
cmp eax, 0x1f01ff
jne 0x409d1b
push 0x46d948
mov ecx, esi
call fcn.0040d810
and ebx, 0xffe0fe00
mov eax, ebx
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x409d3b
push str.change
mov ecx, esi
call fcn.0040d810
and ebx, 0xffecfe40
mov eax, ebx
and eax, 0x1200a9
cmp eax, 0x1200a9
jne 0x409d5b
push str.read
mov ecx, esi
call fcn.0040d810
and ebx, 0xffedff56
test ebx, 0x1bf
je 0x409d6f
push str.SHARE_READ
mov ecx, esi
call fcn.0040d810
test bl, 0xa9
je 0x409d80
push str.SHARE_CHANGE
mov ecx, esi
call fcn.0040d810
test bl, 0x40
je 0x409d91
push str.SHARE_WRITE
mov ecx, esi
call fcn.0040d810
test ebx, 0x20000
je 0x409da7
push 0xd
push str.READ_CONTROL
mov ecx, esi
call fcn.0040da80
test ebx, 0x80000
je 0x409dbd
push 0xc
push str.WRITE_OWNER
mov ecx, esi
call fcn.0040da80
test ebx, 0x40000
je 0x409dd3
push 0xa
push str.WRITE_DAC
mov ecx, esi
call fcn.0040da80
test ebx, 0x10000
je 0x409de9
push 7
push str.DELETE
mov ecx, esi
call fcn.0040da80
test ebx, 0x100000
je 0x409dff
push 0xc
push str.SYNCHRONIZE
mov ecx, esi
call fcn.0040da80
test ebx, 0x1000000
je 0x409e15
push 0x17
push str.ACCESS_SYSTEM_SECURITY
mov ecx, esi
call fcn.0040da80
test ebx, 0x10000000
je 0x409e2b
push 0xc
push str.GENERIC_ALL
mov ecx, esi
call fcn.0040da80
test ebx, 0x20000000
je 0x409e41
push 0x10
push str.GENERIC_EXECUTE
mov ecx, esi
call fcn.0040da80
test ebx, ebx
jns 0x409e53
push 0xd
push str.GENERIC_READ
mov ecx, esi
call fcn.0040da80
test ebx, 0x40000000
je 0x409e69
push 0xe
push str.GENERIC_WRITE
mov ecx, esi
call fcn.0040da80
push 0x46df40
mov ecx, esi
call fcn.0040d150
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8