Function at 0x1000b420
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 5
test edi, edi
jne 0x1000b456
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [edi + 2]
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.1000d4c0
lea eax, [ebp + 0x10]
push eax
call fcn.1000d510
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call fcn.1000d560
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1000b4a1
push esi
call fcn.1000d4e0
add esp, 4
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi], 0xffffffff
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, eax
shl ecx, 0x1f
mov dword [ebp - 8], ecx
test al, 2
je 0x1000b4c8
test eax, 0x20000
je 0x1000b4bf
or ecx, 0x120114
jmp 0x1000b4c5
or ecx, 0x40000000
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x80
test al, 8
je 0x1000b4da
mov dword [ebp - 4], 0x4000082
test al, 4
je 0x1000b4e5
or dword [ebp - 4], 0x80000000
test al, 0x10
je 0x1000b4f0
or dword [ebp - 4], 0x20000000
test al, 0x40
je 0x1000b4fb
or dword [ebp - 4], 0x60000000
test eax, 0x800
je 0x1000b509
or dword [ebp - 4], 0x8000000
mov ebx, eax
shr ebx, 0x11
and ebx, 4
mov dword [esi + 4], eax
test eax, 0x200
jne 0x1000b51e
or ebx, 1
test eax, 0x400
jne 0x1000b528
or ebx, 2
push 1
push edi
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edx, dword [ebp + 0xc]
mov edi, eax
push 0x10061738
push edx
mov dword [ebp - 0x10], edi
call sym.vmtools.dll_StrUtil_StartsWith
add esp, 0x10
test al, al
jne 0x1000b590
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000b550
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x1000b590
push edi
call dword [sym.imp.MSVCR90.dll_free]
push esi
call fcn.1000d6b0
push esi
call fcn.1000d4e0
add esp, 0xc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
mov eax, 8
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx*4 + 0x10061694]
push 0
push eax
mov eax, dword [ebp - 8]
push edx
push 0
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000b5c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1000b5c2
xor edi, edi
mov ecx, dword [ebp + 0x1c]
cmp dword [ebp - 0xc], ecx
jae 0x1000b5f1
lea edx, [ebp - 0x18]
push edx
push 2
push edi
call fcn.1000be90
add esp, 0xc
test al, al
je 0x1000b5f1
push 0x64
push 0xa
call fcn.1000a600
mov edi, dword [ebp - 0x10]
add esp, 8
add dword [ebp - 0xc], eax
jmp 0x1000b590
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test edi, edi
je 0x1000b698
mov esi, dword [ebp + 8]
push esi
call fcn.1000d6b0
push esi
call fcn.1000d4e0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [edi - 2]
cmp eax, 0xb5
ja case.0x1000b630.4
movzx ecx, byte [eax + 0x1000b6bc]
jmp dword [ecx*4 + 0x1000b6a8]
pop esi
pop ebx
mov eax, 3
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, 6
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, 7
pop edi
mov esp, ebp
pop ebp
ret
push str.FileIOCreateRetry
push str._s:_CreateFileW___returned_ERROR_SHARING_VIOLATION__failing_with_FILEIO_CANCELLED._n
call fcn.10003450
add esp, 8
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
push edi
push str.FileIOCreateRetry
push str._s:_Unrecognized_error_code:__u_n
call sym.vmtools.dll_Warning
add esp, 0xc
pop esi
pop ebx
mov eax, 2
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [edx], esi
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret