Function at 0x42a350
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44dda9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4643c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], eax
mov word [esi], cx
mov dword [ebp - 4], eax
mov edx, dword [edi + 0x80]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov dword [ebp - 0x10], 1
call fcn.00435200
mov ebx, eax
mov eax, dword [edi + 0x80]
add esp, 8
cmp eax, 1
jne 0x42a52b
and ebx, 0xffefffff
mov ecx, ebx
and ecx, 0xf01ff
cmp ecx, 0xf01ff
jne 0x42a3e7
push 5
mov eax, 0x45a4fc
mov ecx, esi
call fcn.00408740
and ebx, 0xfff0fe00
mov edx, ebx
and edx, 0x301bf
cmp edx, 0x301bf
jne 0x42a40b
push 7
mov eax, str.change
mov ecx, esi
call fcn.00408740
and ebx, 0xfffcfe40
mov eax, ebx
and eax, 0x200a9
cmp eax, 0x200a9
jne 0x42a42d
push 0xd
mov eax, str.read_execute
mov ecx, esi
call fcn.00408740
and ebx, 0xfffdff56
mov ecx, ebx
and ecx, 0x116
cmp ecx, 0x116
jne 0x42a451
push 6
mov eax, str.write
mov ecx, esi
call fcn.00408740
and ebx, 0xfffffee9
mov edx, ebx
and edx, 0x20089
cmp edx, 0x20089
jne 0x42a475
push 5
mov eax, str.read
mov ecx, esi
call fcn.00408740
and ebx, 0xfffdff76
test bl, 1
je 0x42a488
push 0x14
mov eax, str.FILE_LIST_DIRECTORY
mov ecx, esi
call fcn.00408740
test bl, 2
je 0x42a49b
push 0xe
mov eax, str.FILE_ADD_FILE
mov ecx, esi
call fcn.00408740
test bl, 4
je 0x42a4ae
push 0x16
mov eax, str.FILE_ADD_SUBDIRECTORY
mov ecx, esi
call fcn.00408740
test bl, 8
je 0x42a4c1
push 0xd
mov eax, str.FILE_READ_EA
mov ecx, esi
call fcn.00408740
test bl, 0x10
je 0x42a4d4
push 0xe
mov eax, str.FILE_WRITE_EA
mov ecx, esi
call fcn.00408740
test bl, 0x20
je 0x42a4e7
push 0xe
mov eax, str.FILE_TRAVERSE
mov ecx, esi
call fcn.00408740
test bl, 0x40
je 0x42a4fa
push 0x12
mov eax, str.FILE_DELETE_CHILD
mov ecx, esi
call fcn.00408740
test bl, bl
jns 0x42a50c
push 0x15
mov eax, str.FILE_READ_ATTRIBUTES
mov ecx, esi
call fcn.00408740
test ebx, 0x100
je 0x42a996
push 0x16
mov eax, str.FILE_WRITE_ATTRIBUTES
mov ecx, esi
call fcn.00408740
jmp 0x42a996
cmp eax, 4
jne 0x42a635
mov eax, ebx
and eax, 0xf003f
cmp eax, 0xf003f
jne 0x42a556
push 5
mov eax, 0x45a4fc
mov ecx, esi
call fcn.00408740
and ebx, 0xfff0ffc0
mov ecx, ebx
and ecx, 0x20019
cmp ecx, 0x20019
jne 0x42a57a
push 5
mov eax, str.read
mov ecx, esi
call fcn.00408740
and ebx, 0xfffdffe6
test bl, 0x20
je 0x42a58d
push 0x10
mov eax, str.KEY_CREATE_LINK
mov ecx, esi
call fcn.00408740
test bl, 4
je 0x42a5a0
push 0x13
mov eax, str.KEY_CREATE_SUB_KEY
mov ecx, esi
call fcn.00408740
test bl, 8
je 0x42a5b3
push 0x17
mov eax, str.KEY_ENUMERATE_SUB_KEYS
mov ecx, esi
call fcn.00408740
mov edi, ebx
and edi, 0x20019
je 0x42a5cb
push 0xc
mov eax, str.KEY_EXECUTE
mov ecx, esi
call fcn.00408740
test bl, 0x10
je 0x42a5de
push 0xb
mov eax, str.KEY_NOTIFY
mov ecx, esi
call fcn.00408740
test bl, 1
je 0x42a5f1
push 0x10
mov eax, str.KEY_QUERY_VALUE
mov ecx, esi
call fcn.00408740
test edi, edi
je 0x42a603
push 9
mov eax, str.KEY_READ
mov ecx, esi
call fcn.00408740
test bl, 2
je 0x42a616
push 0xe
mov eax, str.KEY_SET_VALUE
mov ecx, esi
call fcn.00408740
test ebx, 0x20006
je 0x42a996
push 0xa
mov eax, str.KEY_WRITE
mov ecx, esi
call fcn.00408740
jmp 0x42a996
cmp eax, 2
jne 0x42a75e
mov edx, ebx
and edx, 0xf01ff
cmp edx, 0xf01ff
jne 0x42a662
push 5
mov eax, 0x45a4fc
mov ecx, esi
call fcn.00408740
and ebx, 0xfff0fe00
mov eax, ebx
and eax, 0x201fd
cmp eax, 0x201fd
jne 0x42a684
push 0xb
mov eax, str.start_stop
mov ecx, esi
call fcn.00408740
and ebx, 0xfffdfe02
mov ecx, ebx
and ecx, 0x2018d
cmp ecx, 0x2018d
jne 0x42a6a8
push 5
mov eax, str.read
mov ecx, esi
call fcn.00408740
and ebx, 0xfffdfe72
test bl, 2
je 0x42a6bb
push 0x16
mov eax, str.SERVICE_CHANGE_CONFIG
mov ecx, esi
call fcn.00408740
test bl, 8
je 0x42a6ce
push 0x1d
mov eax, str.SERVICE_ENUMERATE_DEPENDENTS
mov ecx, esi
call fcn.00408740
test bl, bl
jns 0x42a6e0
push 0x14
mov eax, str.SERVICE_INTERROGATE
mov ecx, esi
call fcn.00408740
test bl, 0x40
je 0x42a6f3
push 0x17
mov eax, str.SERVICE_PAUSE_CONTINUE
mov ecx, esi
call fcn.00408740
test bl, 1
je 0x42a706
push 0x15
mov eax, str.SERVICE_QUERY_CONFIG
mov ecx, esi
call fcn.00408740
test bl, 4
je 0x42a719
push 0x15
mov eax, str.SERVICE_QUERY_STATUS
mov ecx, esi
call fcn.00408740
test bl, 0x10
je 0x42a72c
push 0xe
mov eax, str.SERVICE_START
mov ecx, esi
call fcn.00408740
test bl, 0x20
je 0x42a73f
push 0xd
mov eax, str.SERVICE_STOP
mov ecx, esi
call fcn.00408740
test ebx, 0x100
je 0x42a996
push 0x1d
mov eax, str.SERVICE_USER_DEFINED_CONTROL
mov ecx, esi
call fcn.00408740
jmp 0x42a996
cmp eax, 3
jne 0x42a80b
mov edx, ebx
and edx, 0xf000c
cmp edx, 0xf000c
jne 0x42a788
push esi
mov eax, str.manage_printer
call fcn.004084e0
and ebx, 0xfff0fff3
mov eax, ebx
and eax, 0xf0030
cmp eax, 0xf0030
jne 0x42a7a7
push esi
mov eax, str.manage_documents
call fcn.004084e0
and ebx, 0xfff0ffcf
mov ecx, ebx
and ecx, 0x20008
cmp ecx, 0x20008
jne 0x42a7c8
push esi
mov eax, str.print
call fcn.004084e0
and ebx, 0xfffdfff7
test bl, 4
je 0x42a7d8
push esi
mov eax, str.PRINTER_ACCESS_ADMINISTER
call fcn.004084e0
test bl, 8
je 0x42a7e8
push esi
mov eax, str.PRINTER_ACCESS_USE
call fcn.004084e0
test bl, 0x10
je 0x42a7f8
push esi
mov eax, str.JOB_ACCESS_ADMINISTER
call fcn.004084e0
test bl, 0x20
je 0x42a996
mov eax, str.JOB_ACCESS_READ
jmp 0x42a990
cmp eax, 5
jne 0x42a8ab
mov edx, ebx
and edx, 0x1f01ff
cmp edx, 0x1f01ff
jne 0x42a835
push esi
mov eax, 0x45a4fc
call fcn.004084e0
and ebx, 0xffe0fe00
mov eax, ebx
and eax, 0x1301bf
cmp eax, 0x1301bf
jne 0x42a854
push esi
mov eax, str.change
call fcn.004084e0
and ebx, 0xffecfe40
mov ecx, ebx
and ecx, 0x1200a9
cmp ecx, 0x1200a9
jne 0x42a875
push esi
mov eax, str.read
call fcn.004084e0
and ebx, 0xffedff56
test ebx, 0x1bf
je 0x42a888
push esi
mov eax, str.SHARE_READ
call fcn.004084e0
test bl, 0xa9
je 0x42a898
push esi
mov eax, str.SHARE_CHANGE
call fcn.004084e0
test bl, 0x40
je 0x42a996
mov eax, str.SHARE_WRITE
jmp 0x42a990
cmp eax, 0xb
jne 0x42a996
mov edx, ebx
and edx, 0x6003f
cmp edx, 0x6003f
jne 0x42a8d5
push esi
mov eax, 0x45a4fc
call fcn.004084e0
and ebx, 0xfff9ffc0
mov eax, ebx
and eax, 0x13
cmp al, 0x13
jne 0x42a8ec
push esi
mov eax, str.execute
call fcn.004084e0
and ebx, 0xffffffec
mov ecx, ebx
and ecx, 0x21
cmp cl, 0x21
jne 0x42a904
push esi
mov eax, str.remote_access
call fcn.004084e0
and ebx, 0xffffffde
test bl, 1
je 0x42a927
push esi
mov eax, str.enable_account
call fcn.004084e0
and ebx, 0xfffffffe
test bl, 1
je 0x42a927
push esi
mov eax, str.WBEM_ENABLE
call fcn.004084e0
test bl, 2
je 0x42a937
push esi
mov eax, str.WBEM_METHOD_EXECUTE
call fcn.004084e0
test bl, 4
je 0x42a947
push esi
mov eax, str.WBEM_FULL_WRITE_REP
call fcn.004084e0
test bl, 8
je 0x42a957
push esi
mov eax, str.WBEM_PARTIAL_WRITE_REP
call fcn.004084e0
test bl, 0x10
je 0x42a967
push esi
mov eax, str.WBEM_WRITE_PROVIDER
call fcn.004084e0
test bl, 0x20
je 0x42a977
push esi
mov eax, str.WBEM_REMOTE_ACCESS
call fcn.004084e0
test bl, 0x40
je 0x42a987
push esi
mov eax, str.WBEM_RIGHT_SUBSCRIBE
call fcn.004084e0
test bl, bl
jns 0x42a996
mov eax, str.WBEM_RIGHT_PUBLISH
push esi
call fcn.004084e0
test ebx, 0x20000
je 0x42a9ac
push 0xd
mov eax, str.READ_CONTROL
mov ecx, esi
call fcn.00408740
test ebx, 0x80000
je 0x42a9c2
push 0xc
mov eax, str.WRITE_OWNER
mov ecx, esi
call fcn.00408740
test ebx, 0x40000
je 0x42a9d8
push 0xa
mov eax, str.WRITE_DAC
mov ecx, esi
call fcn.00408740
test ebx, 0x10000
je 0x42a9ee
push 7
mov eax, str.DELETE
mov ecx, esi
call fcn.00408740
test ebx, 0x100000
je 0x42aa04
push 0xc
mov eax, str.SYNCHRONIZE
mov ecx, esi
call fcn.00408740
test ebx, 0x1000000
je 0x42aa1a
push 0x17
mov eax, str.ACCESS_SYSTEM_SECURITY
mov ecx, esi
call fcn.00408740
test ebx, 0x10000000
je 0x42aa30
push 0xc
mov eax, str.GENERIC_ALL
mov ecx, esi
call fcn.00408740
test ebx, 0x20000000
je 0x42aa46
push 0x10
mov eax, str.GENERIC_EXECUTE
mov ecx, esi
call fcn.00408740
test ebx, ebx
jns 0x42aa58
push 0xd
mov eax, str.GENERIC_READ
mov ecx, esi
call fcn.00408740
test ebx, 0x40000000
je 0x42aa6e
push 0xe
mov eax, str.GENERIC_WRITE
mov ecx, esi
call fcn.00408740
sub esp, 0x14
mov edi, esp
mov dword [ebp + 0xc], esp
push 0x457938
call fcn.00408050
add esp, 4
mov ecx, esi
call fcn.00419570
add esp, 0x14
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8