Function at 0x14018e990
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ebx, r8d
mov rdi, rdx
mov r15, rcx
xor esi, esi
cmp dword [0x14049b200], esi
jle 0x14018ed1b
mov eax, dword [0x14049b204]
cmp eax, 0xfffffffe
jle 0x14018e9dd
call fcn.14018ff40
lea rdx, [rbp - 0x41]
mov rcx, r15
call fcn.140189eb0
nop
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
lea rcx, [rbp - 0x41]
call fcn.1400c02d0
mov rcx, rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x31]
mov edx, 1
mov r8d, 7
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x14018ecfa
mov esi, 0xffffffff
test ebx, 0x700
je 0x14018ebfa
mov eax, dword [rdi]
or eax, 0x700
cmp qword [0x14049b258], 0
mov dword [rdi], eax
je 0x14018ebb6
mov dword [rbp + 7], 0x120089
mov dword [rbp + 0xb], 0x120116
mov dword [rbp + 0xf], 0x1200a0
mov dword [rbp + 0x13], 0x1f01ff
mov dword [rbp - 0x61], 0x80000000
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_MapGenericMask]
mov dword [rbp - 0x49], setsockopt
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x65]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
mov r8d, dword [rbp - 0x61]
mov rdx, qword [0x14049b258]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_AccessCheck]
test eax, eax
je 0x14018eae9
cmp dword [rbp - 0x59], 0
je 0x14018eae9
or dword [rdi + 4], 0x400
mov dword [rbp - 0x49], setsockopt
mov dword [rbp - 0x61], 0x40000000
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_MapGenericMask]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x65]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
mov r8d, dword [rbp - 0x61]
mov rdx, qword [0x14049b258]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_AccessCheck]
test eax, eax
je 0x14018eb53
cmp dword [rbp - 0x59], 0
je 0x14018eb53
or dword [rdi + 4], 0x200
mov dword [rbp - 0x49], setsockopt
mov dword [rbp - 0x61], 0x20000000
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_MapGenericMask]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x65]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
mov r8d, dword [rbp - 0x61]
mov rdx, qword [0x14049b258]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_AccessCheck]
test eax, eax
je 0x14018ebfa
cmp dword [rbp - 0x59], 0
jmp 0x14018ebf1
lea r8, [rbp - 0x69]
lea rdx, [0x14049b208]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_GetEffectiveRightsFromAclW]
test eax, eax
je 0x14018ebd6
mov eax, esi
mov dword [rbp - 0x69], eax
jmp 0x14018ebd9
mov eax, dword [rbp - 0x69]
test al, 1
je 0x14018ebe4
or dword [rdi + 4], 0x400
test al, 2
je 0x14018ebef
or dword [rdi + 4], 0x200
test al, 0x20
je 0x14018ebfa
or dword [rdi + 4], 0x100
test ebx, 0x7000
je 0x14018ec57
or dword [rdi], 0x7000
mov rdx, qword [rbp - 0x31]
lea rcx, [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_GetEffectiveRightsFromAclW]
test eax, eax
je 0x14018ec33
mov eax, esi
mov dword [rbp - 0x69], eax
jmp 0x14018ec36
mov eax, dword [rbp - 0x69]
test al, 1
je 0x14018ec41
or dword [rdi + 4], 0x4000
test al, 2
je 0x14018ec4c
or dword [rdi + 4], 0x2000
test al, 0x20
je 0x14018ec57
or dword [rdi + 4], 0x1000
test bl, 0x70
je 0x14018eca5
or dword [rdi], 0x70
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_GetEffectiveRightsFromAclW]
test eax, eax
je 0x14018ec8a
mov eax, esi
mov dword [rbp - 0x69], eax
jmp 0x14018ec8d
mov eax, dword [rbp - 0x69]
test al, 1
je 0x14018ec95
or dword [rdi + 4], 0x40
test al, 2
je 0x14018ec9d
or dword [rdi + 4], 0x20
test al, 0x20
je 0x14018eca5
or dword [rdi + 4], 0x10
test bl, 7
je 0x14018ecef
or dword [rdi], 7
lea r8, [rbp - 0x69]
lea rdx, [0x14049b228]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_GetEffectiveRightsFromAclW]
test eax, eax
je 0x14018eccb
mov dword [rbp - 0x69], esi
jmp 0x14018ecce
mov esi, dword [rbp - 0x69]
test sil, 1
je 0x14018ecd8
or dword [rdi + 4], 4
test sil, 2
je 0x14018ece2
or dword [rdi + 4], 2
test sil, 0x20
je 0x14018ecef
or dword [rdi + 4], 0x1000
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rax, qword [rbp - 0x41]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018efc0
cmp ecx, 0xffffffff
je 0x14018efd4
mov esi, 0xffffffff
jmp 0x14018efb3
mov eax, dword [rdx + 4]
or eax, 0x4044
mov dword [rdx + 4], eax
test byte [rdx + 0x10], 1
jne 0x14018ed34
or eax, 0x2022
mov dword [rdx + 4], eax
lea rdx, [rbp - 0x41]
call fcn.1401897e0
nop
mov r8d, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x41]
call fcn.1400be130
nop
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.1400bf270
nop
mov rax, qword [rbp - 0x39]
mov ecx, dword [rax]
mov esi, 0xffffffff
test ecx, ecx
je 0x14018ed81
cmp ecx, esi
je 0x14018ed95
mov rax, qword [rbp - 0x39]
mov ecx, esi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14018ed95
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x39]
call fcn.1400affb0
test dword [rdi + 4], 0x40000
jne 0x14018ee86
mov dword [rbp + 7], 4
lea rax, str..exe
mov qword [rbp + 0xf], rax
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1400b6da0
test al, al
jne 0x14018ee86
mov dword [rbp + 7], 4
lea rax, str..com
mov qword [rbp + 0xf], rax
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1400b6da0
test al, al
jne 0x14018ee86
mov dword [rbp + 7], 4
lea rax, str..bat
mov qword [rbp + 0xf], rax
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1400b6da0
test al, al
jne 0x14018ee86
mov dword [rbp + 7], 4
lea rax, str..pif
mov qword [rbp + 0xf], rax
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1400b6da0
test al, al
jne 0x14018ee86
mov dword [rbp + 7], 4
lea rax, str..cmd
mov qword [rbp + 0xf], rax
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1400b6da0
test al, al
je 0x14018ee8d
or dword [rdi + 4], 0x1111
or dword [rdi], 0x7177
bt ebx, 0xa
jae 0x14018ef02
lea rdx, [rbp - 0x51]
mov rcx, r15
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rcx, rax
mov edx, 4
call fcn.14024380c
mov r14d, eax
mov rcx, qword [rbp - 0x51]
mov edx, dword [rcx]
test edx, edx
je 0x14018eedc
cmp edx, 0xffffffff
je 0x14018eef0
mov rcx, qword [rbp - 0x51]
mov edx, esi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14018eef0
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x51]
call fcn.1400affb0
test r14d, r14d
jne 0x14018eefc
or dword [rdi + 4], 0x400
or dword [rdi], 0x400
bt ebx, 9
jae 0x14018ef71
lea rdx, [rbp - 0x51]
mov rcx, r15
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rcx, rax
mov edx, 2
call fcn.14024380c
mov r14d, eax
mov rcx, qword [rbp - 0x51]
mov edx, dword [rcx]
test edx, edx
je 0x14018ef4b
cmp edx, 0xffffffff
je 0x14018ef5f
mov rcx, qword [rbp - 0x51]
mov edx, esi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14018ef5f
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x51]
call fcn.1400affb0
test r14d, r14d
jne 0x14018ef6b
or dword [rdi + 4], 0x200
or dword [rdi], 0x200
mov rax, qword [rbp - 0x59]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018ef8f
cmp ecx, 0xffffffff
je 0x14018efa4
mov rax, qword [rbp - 0x59]
mov ecx, esi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14018efa4
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x59]
call fcn.1400affb0
nop
mov rax, qword [rbp - 0x41]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018efc0
cmp ecx, 0xffffffff
je 0x14018efd4
mov rax, qword [rbp - 0x41]
lock xadd dword [rax], esi
cmp esi, 1
jne 0x14018efd4
mov r8d, 8
mov edx, 2
mov rcx, qword [rbp - 0x41]
call fcn.1400affb0
mov eax, dword [rdi]
and eax, ebx
cmp eax, ebx
sete al
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret