Function at 0x180026040
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x4d0
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
lea rcx, [rsp + 0x2b2]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x2b0], bx
call fcn.18007ead0
call fcn.1800d08e0
test eax, eax
je 0x18002609f
lea rdx, [rsp + 0x2b0]
mov r8d, 0x103
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1800260ef
lea rcx, [rsp + 0x1a1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x1a0], bl
call fcn.18007ead0
lea rdx, [rsp + 0x1a0]
mov r8d, 0x103
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x2b0]
lea rcx, [rsp + 0x1a0]
mov r9d, 0x104
or edx, 0xffffffff
call fcn.18000fa70
lea rcx, [rsp + 0x2b0]
mov edx, VarDateFromDisp
call fcn.18007e844
mov rdi, rax
test rax, rax
je 0x1800268b3
mov qword [rsp + 0x4e0], rbp
mov qword [rsp + 0x4e8], rsi
mov qword [rsp + 0x4f0], r12
lea r12, [0x1801aa280]
xor edx, edx
mov r8d, 0x104
mov rcx, r12
call fcn.18007ead0
lea rdx, [rdi + 2]
mov r8d, 0x103
mov rcx, r12
call fcn.18007ea70
lea rax, str.smss.exe
lea rdx, str.explorer.exe
mov qword [rsp + 0x1a8], rax
lea rax, str.csrss.exe
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0x1b0], rax
lea rax, str.winlogon.exe
mov qword [rsp + 0x250], rdx
mov qword [rsp + 0x1b8], rax
lea rax, str.services.exe
mov esi, ebx
mov qword [rsp + 0x1c0], rax
lea rax, str.lsass.exe
lea rbp, [rsp + 0x1a0]
mov qword [rsp + 0x1c8], rax
lea rax, str.svchost.exe
mov qword [rsp + 0x1d0], rax
lea rax, [0x18012e9d0]
mov qword [rsp + 0x1d8], rax
lea rax, str.kp.exe
mov qword [rsp + 0x1e0], rax
lea rax, str.java.exe
mov qword [rsp + 0x1e8], rax
lea rax, str.javaw.exe
mov qword [rsp + 0x1f0], rax
lea rax, str.eclipse.exe
mov qword [rsp + 0x1f8], rax
lea rax, str.dbgview.exe
mov qword [rsp + 0x200], rax
lea rax, str.msdev.exe
mov qword [rsp + 0x208], rax
lea rax, str.procexp.exe
mov qword [rsp + 0x210], rax
lea rax, str.editplus.exe
mov qword [rsp + 0x218], rax
lea rax, str.rundll32.exe
mov qword [rsp + 0x220], rax
lea rax, str.winrdlv3.exe
mov qword [rsp + 0x228], rax
lea rax, str.baiduplayer.exe
mov qword [rsp + 0x230], rax
lea rax, str.baidubrowser.exe
mov qword [rsp + 0x238], rax
lea rax, str.zwcad.exe
mov qword [rsp + 0x240], rax
lea rax, str.windbg.exe
mov qword [rsp + 0x248], rax
lea rax, str.rtxmsgmanager.exe
mov qword [rsp + 0x258], rax
lea rax, str.rtxmsg1.exe
mov qword [rsp + 0x260], rax
nop dword [rax + rax]
mov rdx, qword [rbp]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call fcn.18007f540
test eax, eax
je 0x180026866
inc esi
add rbp, 8
cmp esi, 0x19
jb 0x1800262d0
cmp dword [0x1801aa488], ebx
jne 0x18002689b
mov rcx, r12
call fcn.18001f520
test eax, eax
jne 0x180026890
cmp dword [0x1801aa488], ebx
jne 0x18002689b
lea rax, str.qqeim
mov qword [rsp + 0x30], rax
lea rax, [0x18012ba88]
mov qword [rsp + 0x38], rax
lea rax, [0x180132f88]
mov qword [rsp + 0x40], rax
lea rax, [0x18012ba28]
mov qword [rsp + 0x48], rax
lea rax, str.popo
mov qword [rsp + 0x50], rax
lea rax, str.skype
mov qword [rsp + 0x58], rax
lea rax, [0x180132f70]
mov qword [rsp + 0x60], rax
lea rax, str.rtxc
mov qword [rsp + 0x68], rax
lea rax, str.sametime
mov qword [rsp + 0x70], rax
lea rax, str.connect
mov qword [rsp + 0x78], rax
lea rax, str.alitalk
mov qword [rsp + 0x80], rax
lea rax, str.aliim
mov qword [rsp + 0x88], rax
lea rax, str.fetion
mov qword [rsp + 0x90], rax
lea rax, str.googletalk
mov qword [rsp + 0x98], rax
lea rax, str.baiduhi
mov qword [rsp + 0xa0], rax
lea rax, str.263EM
mov qword [rsp + 0xa8], rax
lea rax, str.feiq
mov qword [rsp + 0xb0], rax
lea rax, str.officeim
mov qword [rsp + 0xb8], rax
lea rax, [0x180132eb0]
mov qword [rsp + 0xc0], rax
lea rax, str.nlnotes
mov qword [rsp + 0xc8], rax
lea rax, str.notes2w
mov qword [rsp + 0xd0], rax
lea rax, str.notes2
mov qword [rsp + 0xd8], rax
lea rax, str.qqcrm
mov qword [rsp + 0xe0], rax
lea rax, str.amsger
mov qword [rsp + 0xe8], rax
lea rax, str.line
mov qword [rsp + 0xf0], rax
lea rax, str.aliworkbench
mov qword [rsp + 0xf8], rax
lea rax, [0x180132e58]
mov qword [rsp + 0x100], rax
lea rax, str.lync
mov qword [rsp + 0x108], rax
lea rax, str.wechat
mov qword [rsp + 0x110], rax
lea rax, [0x180132954]
mov qword [rsp + 0x118], rax
lea rax, str.imoclient
mov qword [rsp + 0x120], rax
lea rax, str.wxwork
mov qword [rsp + 0x128], rax
lea rax, str.dingtalk
mov qword [rsp + 0x130], rax
lea rax, [0x180132e00]
mov qword [rsp + 0x138], rax
lea rax, str.lxmain
mov qword [rsp + 0x140], rax
lea rax, str.qipmsg
mov qword [rsp + 0x148], rax
lea rax, str.MideaConnectHanyu
mov qword [rsp + 0x150], rax
lea rax, str.qidian
mov qword [rsp + 0x158], rax
lea rax, str.communicator
mov qword [rsp + 0x160], rax
lea rax, str.cloudhub
mov qword [rsp + 0x168], rax
lea rax, str.zalo
mov qword [rsp + 0x170], rax
lea rax, str.feishu
mov ebp, 1
mov qword [rsp + 0x178], rax
lea rax, str.lark
mov dword [rsp + 0x1a0], 0x800000
mov qword [rsp + 0x180], rax
lea rax, str.whatsapp
mov dword [rsp + 0x1a4], ebp
mov qword [rsp + 0x188], rax
lea rax, [0x180132d30]
mov dword [rsp + 0x1a8], 2
mov dword [rsp + 0x1ac], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rsp + 0x1b0], 0x40
mov dword [rsp + 0x1b4], 0x80
mov qword [rsp + 0x190], rax
mov dword [rsp + 0x1b8], 0x100
mov dword [rsp + 0x1bc], 0x100
mov dword [rsp + 0x1c0], 0x200
mov dword [rsp + 0x1c4], 0x200
mov dword [rsp + 0x1c8], 0x400
mov dword [rsp + 0x1cc], 0x400
mov dword [rsp + 0x1d0], 0x800
mov dword [rsp + 0x1d4], 0x1000
mov dword [rsp + 0x1d8], 0x2000
mov dword [rsp + 0x1dc], 0x4000
mov dword [rsp + 0x1e0], 0x8000
mov dword [rsp + 0x1e4], 0x10000
mov dword [rsp + 0x1e8], 0x40000
mov dword [rsp + 0x1ec], 0x80000
mov dword [rsp + 0x1f0], 0x200
mov dword [rsp + 0x1f4], 0x200
mov dword [rsp + 0x1f8], 0x100000
mov dword [rsp + 0x1fc], 0x400000
mov dword [rsp + 0x200], 0x1000000
mov dword [rsp + 0x204], reloc.OLEAUT32.dll_SafeArrayGetUBound
mov dword [rsp + 0x208], 0x2000000
mov dword [rsp + 0x20c], 0x4000000
mov dword [rsp + 0x210], 0x8000000
mov dword [rsp + 0x214], 0x10000000
mov dword [rsp + 0x218], 0x20000000
mov dword [rsp + 0x21c], 0x80000000
mov dword [rsp + 0x220], 0x40000000
mov dword [rsp + 0x224], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [rsp + 0x228], reloc.OLEAUT32.dll_SafeArrayLock
mov dword [rsp + 0x22c], 0x8000
mov dword [rsp + 0x230], 4
mov dword [rsp + 0x234], 0x800000
mov dword [rsp + 0x238], 0x4000000
mov dword [rsp + 0x23c], 0x20000
mov dword [rsp + 0x240], 8
mov dword [rsp + 0x244], reloc.OLEAUT32.dll_SafeArrayUnlock
mov dword [rsp + 0x248], reloc.OLEAUT32.dll_SafeArrayUnlock
mov dword [rsp + 0x24c], SafeArrayDestroyData
mov dword [rsp + 0x250], 0x10000000
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov rdx, qword [rsi]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call fcn.18007f540
test eax, eax
je 0x1800267e5
inc ebx
add rsi, 8
cmp ebx, 0x2d
jb 0x1800267b0
mov eax, dword [0x1801aa48c]
jmp 0x18002682d
cmp dword [0x1801b0450], 0
je 0x18002681d
movsxd rax, ebx
lea r9, str._s_maybe_im___s_
lea r8, [0x18012b1a8]
mov rcx, qword [rsp + rax*8 + 0x30]
or edx, 0xffffffff
mov qword [rsp + 0x28], rcx
lea rcx, [0x1801afb58]
mov qword [rsp + 0x20], r12
call fcn.1800b3b40
movsxd rax, ebx
mov eax, dword [rsp + rax*4 + 0x1a0]
mov dword [0x1801aa48c], eax
cmp eax, 0x1000000
jne 0x18002684a
call fcn.180015f50
call fcn.180016380
mov dword [0x1801aa4c8], eax
mov eax, dword [0x1801aa48c]
test eax, eax
jne 0x18002689b
call fcn.180025f60
mov ecx, dword [0x1801aa488]
test eax, eax
cmove ecx, ebp
mov dword [0x1801aa488], ecx
jmp 0x18002689b
cmp dword [0x1801b0450], ebx
je 0x180026890
lea r9, str._s_is_not_im
lea r8, [0x18012b1a8]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
mov qword [rsp + 0x20], r12
call fcn.1800b3b40
mov ebp, 1
mov dword [0x1801aa488], ebp
mov rsi, qword [rsp + 0x4e8]
mov rbp, qword [rsp + 0x4e0]
mov r12, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.18007e1e0
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4d0
pop rdi
ret