Function at 0x14001b850
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea rcx, str.KERNEL32.DLL
mov dword [rsp + 0x40], 0
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14001b8b4
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b8b4
movzx r9d, word [rbx + 0x12e]
lea rcx, [rsp + 0x40]
movzx r8d, word [rbx + 0x12c]
mov edx, dword [rbx + 0x9c]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rbx + 0x98]
call rax
mov eax, dword [rsp + 0x40]
dec eax
cmp eax, 0x81
ja case.0x14001b8d6.51
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1c070]
add rcx, rdx
jmp rcx
or dword [rbx + 0x130], 0x80000
or dword [rbx + 0x134], 0x1000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x10000000
or dword [rbx + 0x134], 0x8800
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x10000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x1800000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x1000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x2800000
or dword [rbx + 0x134], 0x8000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x2000000
or dword [rbx + 0x134], 0x8000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x8800000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x8000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 2
or dword [rbx + 0x134], 0x4000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800002
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800002
or dword [rbx + 0x134], 0x4000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x400000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0xc00000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x24000020
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20000020
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000020
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000020
or dword [rbx + 0x134], 0x4000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x24000002
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20000002
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000002
jmp case.0x14001b8d6.51
mov dword [rbx + 0xa8], 5
or dword [rbx + 0x130], 2
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x24000000
or dword [rbx + 0x134], 0x20
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20000000
or dword [rbx + 0x134], 0x20
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000000
or dword [rbx + 0x134], 0x20
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000000
or dword [rbx + 0x134], 0x4020
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x400
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20000080
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x10000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x40000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 1
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 2
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 2
or dword [rbx + 0x130], 0x4000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 1
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 1
or dword [rbx + 0x134], 0x8004
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20000001
or dword [rbx + 0x134], 0x8004
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20080002
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80002
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 8
or dword [rbx + 0x130], 0x20080000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80000
or dword [rbx + 0x134], 8
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x20
or dword [rbx + 0x130], 0x20080000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20080000
or dword [rbx + 0x134], 0x4020
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80000
or dword [rbx + 0x134], 0x20
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20080000
or dword [rbx + 0x134], 0x10
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80000
or dword [rbx + 0x134], 0x10
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80000
or dword [rbx + 0x134], 0x4010
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 2
or dword [rbx + 0x134], 0x40
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x1000000
or dword [rbx + 0x134], 0x40
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x2000000
or dword [rbx + 0x134], 0x8040
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0xc0
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x80
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000001
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x100
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x200
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x220
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x18200
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x20000100
or dword [rbx + 0x134], 0x200
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x10000
or dword [rbx + 0x134], 0x40
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x810000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x400000
or dword [rbx + 0x134], 0x40
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x2000
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x2000
mov dword [rbx + 0xa8], 9
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x20000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x40000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x2000000
jmp case.0x14001b8d6.51
mov dword [rbx + 0xa8], 9
or dword [rbx + 0x134], 0x4000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x4080000
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x4100000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x4000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x4000
or dword [rbx + 0x134], 0x80
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x80
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x14000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x2004000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x2004040
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x4000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x100
or dword [rbx + 0x134], 0x4040
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x80000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x80000
or dword [rbx + 0x138], 1
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x800000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x8000080
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x900000
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x880000
jmp case.0x14001b8d6.51
or dword [rbx + 0x138], 8
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x2000000
or dword [rbx + 0x138], 0x10
jmp case.0x14001b8d6.51
or dword [rbx + 0x138], 4
jmp case.0x14001b8d6.51
or dword [rbx + 0x138], 2
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x1000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x134], 0x20000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x138], 0x20
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 2
or dword [rbx + 0x134], 0x40000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800002
or dword [rbx + 0x134], 0x40000000
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 0x800000
or dword [rbx + 0x134], 0x40000080
jmp case.0x14001b8d6.51
or dword [rbx + 0x130], 2
jmp 0x14001c020
or dword [rbx + 0x130], 0x800002
or dword [rbx + 0x134], 0x40004000
cmp dword [rbx + 0xa4], 4
jne 0x14001c06a
cmp dword [rbx + 0x98], 5
jne 0x14001c06a
cmp dword [rbx + 0x9c], 0
jne 0x14001c04e
cmp dword [rbx + 0x13c], 1
jmp 0x14001c05e
cmp dword [rbx + 0x13c], 1
jne 0x14001c06a
test byte [rbx + 0x130], 0x40
jne 0x14001c06a
or dword [rbx + 0x134], 0x80
add rsp, 0x30
pop rbx
ret