Function at 0x43bcc8
Capabilities:
Check if file exists
Clear file content
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], 0x101
test byte [edx + 0x170], 4
je 0x43bd17
cmp dword [ebx + 0x80], 0
jne 0x43bd17
cmp dword [ebx + 0x2c], 0
je 0x43e4c7
cmp dword [ebx + 0xa4], 0
je 0x43bd29
mov byte [ebp - 0x140], 0
jmp 0x43bd76
add esp, 0xfffffff0
mov esi, dword [ebx + 0x58]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x3c], esi
lea esi, [ebp - 0x28]
mov dword [esp + 0xc], esi
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], edi
call fcn.0043a9bc
add esp, 0x10
test eax, eax
je 0x43bd76
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x140]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x43bd93
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x43bd7e
dec eax
mov edx, dword [ebp - 4]
movsx esi, ax
add esi, 0xa
mov word [edx + 0x15a], ax
lea ecx, [edx + 0x60]
push ecx
push 0
push esi
mov dword [ebp - 0x154], ecx
call fcn.004265d0
add esp, 0xc
test eax, eax
je 0x43bdc9
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x43bdd5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
or edx, dword [eax + 0x9c]
jne 0x43be04
mov dword [eax + 0x98], 1
mov dword [eax + 0x9c], 0
cmp dword [ebx + 0x44], 0
je 0x43be28
or byte [eax + 0x171], 0x40
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0x80000000
or byte [eax + 0x177], 0x10
jmp 0x43be36
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x43f24d
cmp eax, 2
je 0x43bee5
cmp eax, 1
jne 0x43be81
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], 0
or byte [eax + 0x171], 0x40
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43bf0b
cmp eax, 3
jne 0x43bec2
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43c088
mov dword [ebp - 0x158], 0
or byte [eax + 0x176], 1
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43bf0b
mov edx, dword [ebp - 4]
mov eax, 0x2ed
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43bee1
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43c088
xor eax, eax
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov dword [ebp - 0x158], eax
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x43bfe3
cmp eax, 2
je 0x43bfbd
cmp eax, 1
jne 0x43bf59
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], 0
or byte [eax + 0x171], 0x40
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43bfe3
cmp eax, 3
jne 0x43bf9a
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43c088
mov dword [ebp - 0x158], 0
or byte [eax + 0x176], 1
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43bfe3
mov edx, dword [ebp - 4]
mov eax, 0x23b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43bfb9
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43c088
xor eax, eax
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov dword [ebp - 0x158], eax
mov eax, dword [ebx]
cmp eax, 5
ja case.default.0x43bfee
jmp dword [eax*4 + 0x4e59a0]
mov eax, dword [ebp - 4]
or byte [eax + 0x173], 4
and byte [eax + 0x170], 0x7b
jmp case.0x43bfee.0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 0x10
mov byte [edx + 0x173], al
jmp 0x43c065
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43c088
mov edx, eax
movzx eax, byte [edx + 0x173]
or eax, 3
mov byte [edx + 0x173], al
jmp 0x43c065
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 8
mov byte [edx + 0x173], al
jmp 0x43c065
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 2
mov byte [edx + 0x173], al
mov edx, dword [ebx + 0x58]
cmp edx, 5
ja case.default.0x43c071
jmp dword [edx*4 + 0x4e59b8]
test al, 1
je 0x43c09a
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
jne 0x43c09a
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
or dword [ebp - 0x1c], 2
or dword [ebp - 0x18], 0x4000002
or byte [eax + 0x172], 4
jmp 0x43c149
test al, 1
je 0x43c0d6
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
jne 0x43c0d6
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
or dword [ebp - 0x1c], 1
jmp 0x43c149
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 2
or dword [ebp - 0x1c], 3
jmp 0x43c149
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je case.0x43c071.4
push str.USER
lea eax, [ebp - 0x140]
push eax
call fcn.00474990
add esp, 8
test eax, eax
jne case.0x43c071.4
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 8
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
je 0x43c12f
test byte [eax + 0x170], 4
je 0x43c138
test byte [eax + 0x177], 0x10
je case.0x43c071.5
or byte [eax + 0x172], 2
or dword [ebp - 0x1c], 3
jmp 0x43c149
or dword [ebp - 0x1c], 4
mov eax, dword [ebx + 0x28]
cmp eax, 6
ja case.default.0x43c2bb
jmp dword [eax*4 + 0x4e59d0]
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 4
je case.0x43c155.2
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
test al, 4
jne 0x43c088
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x172], al
jmp case.0x43c155.0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
test al, 4
jne 0x43c088
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x172], al
jmp case.0x43c155.0
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43c088
mov edx, eax
movzx eax, byte [edx + 0x172]
or eax, 8
mov byte [edx + 0x172], al
mov edx, dword [ebx + 0x28]
cmp edx, 5
jne 0x43c1f5
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x172], al
jmp case.0x43c155.0
cmp edx, 6
jne case.0x43c155.0
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x172], al
jmp case.0x43c155.0
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 4
je case.0x43c155.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x34]
cmp eax, 4
ja case.default.0x43c232
jmp dword [eax*4 + 0x4e59ec]
mov eax, dword [ebp - 4]
or byte [eax + 0x178], 2
jmp 0x43c2a4
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test edx, 0x80
jne 0x43c260
or byte [eax + 0x172], 0x80
jmp 0x43c2a4
or byte [eax + 0x178], 1
jmp 0x43c2a4
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x43c27f
test al, 0x10
jne 0x43c27f
test al, 4
je case.0x43c232.1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test edx, 0x80
jne 0x43c260
or byte [eax + 0x172], 0x80
jmp 0x43c2a4
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 0x40
mov edx, eax
mov eax, dword [ebx + 0x4c]
mov byte [edx + 0x15c], al
mov edx, dword [ebx + 0x4c]
cmp edx, 8
ja case.default.0x43c2bb
jmp dword [edx*4 + 0x4e5a00]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x43c2e7
test dl, 0x10
jne 0x43c2e7
test dl, 4
jne 0x43c2e7
mov edx, dword [ebp - 4]
test byte [edx + 0x172], 0x40
je case.0x43c2bb.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 4
mov eax, 4
jmp case.0x43c2bb.0
mov edx, dword [ebp - 4]
test byte [edx + 0x173], 4
je case.0x43c2bb.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov byte [ecx + 0x15e], dl
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x43f1d0
cmp edx, 1
je 0x43c39e
cmp edx, 2
jne 0x43c377
mov edx, ecx
test byte [edx + 0x173], 4
jne 0x43c088
test byte [edx + 0x172], 0x40
je 0x43c3ad
movsx edx, al
add edx, 0xfffffffb
cmp edx, 3
ja 0x43c3ad
mov edx, ecx
mov byte [edx + 0x15e], 3
jmp 0x43c3ad
cmp edx, 3
je 0x43c3ad
mov edx, ecx
mov eax, 0x2f2
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43c39a
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, ecx
test byte [edx + 0x173], 4
jne 0x43c088
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x43f1a9
cmp edx, 1
je 0x43c42b
cmp edx, 2
jne 0x43c3de
mov eax, dword [ebp - 4]
test byte [eax + 0x173], 0x10
jne 0x43c088
mov byte [eax + 0x15d], 2
jmp 0x43c479
cmp edx, 3
jne case.default.0x43c2bb
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x43c088
test dl, 1
jne 0x43c088
test dl, 4
jne 0x43c088
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 3
mov ecx, 3
jmp 0x43c470
mov eax, 0x30
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
je 0x43c458
movsx ecx, al
cmp ecx, 1
je 0x43c458
test ecx, ecx
je 0x43c458
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test dl, 0x10
jne 0x43c088
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 1
mov ecx, 1
test dl, 8
je 0x43c59d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x15c], eax
add eax, 0xf
and eax, 0xfffffff0
call fcn.0047bb30
mov eax, esp
mov edi, eax
push dword [ebp - 0x14]
push 0
push edi
call fcn.004c49d0
add esp, 0xc
push str.FOR_DO_NOT_CACHE_DIRECT_FILE
push dword [ebp - 0x14]
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.004727a0
add esp, 0x10
test edi, edi
je 0x43c575
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x100]
movsx eax, byte [edi]
cmp eax, 0x20
mov dword [ebp - 0x168], edx
mov edx, edi
jne 0x43c4de
inc edx
movsx eax, byte [edx]
cmp eax, 0x20
je 0x43c4d5
mov ecx, edx
je 0x43c4f2
movsx eax, byte [edx]
test eax, eax
je 0x43c4f2
inc ecx
movsx eax, byte [ecx]
cmp eax, 0x20
jne 0x43c4e5
push 0x4e5a7c
push edx
mov byte [ecx], 0
call fcn.0047bb60
add esp, 8
mov esi, eax
test esi, esi
je 0x43c575
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], edi
mov ebx, dword [ebp - 0x168]
push 0x2d
push esi
call fcn.004795b0
mov edi, eax
add esp, 8
test edi, edi
je 0x43e4dd
push esi
mov byte [edi], 0
call fcn.0047bd40
add esp, 4
inc edi
push edi
mov esi, eax
call fcn.0047bd40
add esp, 4
cmp ebx, esi
jl 0x43c554
cmp ebx, eax
jle 0x43e4ee
push 0x4e5a7c
push 0
call fcn.0047bb60
add esp, 8
mov esi, eax
test esi, esi
jne 0x43c51b
mov edi, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x160]
or dword [ebp - 0x18], 0x10000000
mov edx, edi
mov eax, dword [ebp - 0x15c]
add eax, 0xf
and eax, 0xfffffff0
add esp, eax
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x15c]
movsx ecx, byte [edx + 0x15d]
and ecx, 0xfffffffe
cmp dword [ebx + 0x4c], 0
jne 0x43c655
cmp ecx, 2
je 0x43c5c6
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x173]
test dl, 8
jne 0x43c5c3
test dl, 0x10
je 0x43c5dd
cmp ecx, 2
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 1
mov eax, 1
je 0x43c66e
jmp 0x43c65a
movzx eax, byte [eax + 0x178]
test al, 1
jne 0x43c607
test al, 2
jne 0x43c607
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
and eax, 0x80
shr eax, 7
test dl, 4
je 0x43c618
test eax, eax
je 0x43c62d
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 5
mov eax, 5
jmp 0x43c664
test eax, eax
je 0x43c62d
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 4
mov eax, 4
jmp 0x43c664
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 3
je 0x43c647
mov byte [eax + 0x15c], 8
mov eax, 8
jmp 0x43c664
mov byte [eax + 0x15c], 5
mov eax, 5
jmp 0x43c664
cmp ecx, 2
je 0x43c66e
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x43c66e
test dl, 0x10
je 0x43c688
movsx edx, al
cmp edx, 1
je 0x43c68b
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
movsx edx, al
mov eax, dword [ebp - 4]
test byte [eax + 0x178], 1
je 0x43c6bd
movzx eax, byte [eax + 0x173]
test al, 1
jne 0x43c6a6
test al, 2
je 0x43c6bd
cmp edx, 5
je 0x43c6c6
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp edx, 4
je 0x43f187
or dword [ebp - 0x20], 1
cmp dword [ebx + 0x54], 0
jne 0x43c6dc
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43c6fd
mov eax, dword [ebp - 4]
mov dword [ebp - 0x164], 0
or byte [eax + 0x172], 1
and byte [eax + 0x178], 0xfb
or dword [ebp - 0x20], 2
jmp 0x43c707
mov dword [ebp - 0x164], 1
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x43c747
cmp eax, 1
je 0x43c73b
cmp eax, 2
je 0x43c751
mov edx, dword [ebp - 4]
mov eax, 0x23d
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43c737
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x43c764
cmp dword [ebp - 0x38], 0
je 0x43f160
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 0x20
mov byte [edx + 0x173], al
and eax, 4
mov esi, dword [ebx + 0x48]
shr eax, 2
test esi, esi
je 0x43c787
test eax, eax
je 0x43c7d7
mov eax, 0x70
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x43c8db
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 0x40
je 0x43c7b4
mov esi, dword [0x509ec4]
cmp esi, 0xfffffffe
je 0x43f2a3
cmp esi, 0xffffffff
jne 0x43c7cc
jmp 0x43c8db
mov esi, dword [0x509ec8]
cmp esi, 0xfffffffe
je 0x43f291
cmp esi, 0xffffffff
je 0x43c8db
mov dword [ebx + 0x48], esi
test esi, esi
je 0x43c8db
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43c80f
test esi, esi
jle 0x43c7fd
mov eax, esi
mov ecx, 0xfffffffa
cdq
mov eax, esi
xor edi, edi
sub eax, ecx
sbb edx, edi
jl 0x43c817
or eax, edx
je 0x43c817
mov eax, 0x245
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x43f2b5
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x172]
and edx, 0x80
shr edx, 7
mov dword [eax + 0xfc], esi
test edx, edx
je 0x43c84c
test byte [eax + 0x174], 0x10
jne 0x43c84c
cmp dword [ebx + 0x7c], 0
lea eax, [esi*4]
jne 0x43c84c
mov esi, eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x15c]
dec eax
cmp eax, 7
ja case.default.0x43c85c
jmp dword [eax*4 + 0x4e5a24]
mov eax, dword [ebp - 4]
lea edx, [esi + 1]
cmp byte [eax + 0x15e], 3
jne case.0x43c85c.1
mov esi, edx
jmp case.0x43c85c.1
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x173]
test byte [ecx + 0x178], 2
jne 0x43c891
test al, 4
je case.0x43c85c.1
test edx, edx
je case.0x43c85c.1
mov edx, ecx
or eax, 0xffffff80
mov esi, 0x400
mov dword [edx + 0xfc], 0x10000
mov byte [edx + 0x173], al
jmp case.0x43c85c.1
add esi, 4
jmp case.0x43c85c.1
add esi, 8
jmp case.0x43c85c.1
push 0x6de
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0041fa10
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [eax + 0xf8], esi
jmp 0x43c9e7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15c], 1
je 0x43c8fa
mov esi, eax
movzx eax, byte [esi + 0x173]
test al, 8
mov dword [ebp - 0x168], eax
je 0x43c91d
mov edx, dword [ebp - 4]
mov eax, 0x241
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43c919
mov eax, 0x25
mov esp, ebp
pop ebp
ret
mov eax, esi
movzx eax, byte [eax + 0x178]
test al, 1
jne 0x43c94f
test al, 2
jne 0x43c94f
mov eax, esi
mov ecx, dword [ebp - 0x168]
and ecx, 4
shr ecx, 2
movzx edx, byte [eax + 0x172]
test ecx, ecx
je 0x43c967
test edx, 0x80
je 0x43c967
mov eax, esi
mov dword [eax + 0xf8], 0x400
mov dword [eax + 0xfc], 0x10000
jmp 0x43c9d6
test byte [eax + 0x170], 4
je 0x43c98a
test dl, 0x40
je 0x43c98a
mov edx, eax
mov eax, 0x400
mov dword [edx + 0xf8], eax
mov dword [edx + 0xfc], eax
jmp 0x43c9d6
test edx, 0x80
je 0x43c9a8
mov dword [eax + 0xf8], 0x800
mov dword [eax + 0xfc], 0x1fe
jmp 0x43c9d6
test ecx, ecx
je 0x43c9c2
mov dword [eax + 0xf8], 0x401
mov dword [eax + 0xfc], 0x400
jmp 0x43c9d6
mov dword [eax + 0xf8], 0x85
mov dword [eax + 0xfc], 0x84
mov edx, esi
mov eax, dword [ebp - 0x168]
or eax, 0xffffff80
mov byte [edx + 0x173], al
mov eax, dword [ebx + 4]
test eax, eax
je 0x43c9fd
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov eax, dword [ebx + 8]
mov byte [edx + 0x15f], al
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3c]
mov dword [edx + 0xd8], eax
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x43ca81
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 0x40
jne 0x43ca3e
mov edx, eax
mov eax, 0x2ee
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43ca3a
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x43ca81
cmp edx, 1
jne 0x43ca51
mov byte [eax + 0x161], 0x27
jmp 0x43ca8b
cmp edx, 3
jne 0x43ca5f
mov byte [eax + 0x161], 0x22
jmp 0x43ca8b
mov edx, eax
mov eax, 0x2ef
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43ca7d
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x161], 0
mov edx, dword [ebx + 0x74]
test edx, edx
je 0x43caf2
test byte [eax + 0x172], 0x40
jne 0x43cabd
mov edx, eax
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43cab9
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x43caf2
cmp edx, 1
jne 0x43cad0
and byte [eax + 0x176], 0xfd
jmp 0x43cb10
mov edx, eax
mov eax, 0x2f1
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43caee
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, eax
movzx eax, byte [edx + 0x176]
movzx esi, byte [edx + 0x170]
and eax, 0xfffffffd
and esi, 2
or eax, esi
mov byte [edx + 0x176], al
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x43cb63
cmp eax, 2
je 0x43cb49
cmp eax, 1
je 0x43cb49
cmp eax, 3
je 0x43cb49
mov edx, dword [ebp - 4]
mov eax, 0x2ec
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43cb45
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x43c088
test al, 0x10
jne 0x43c088
mov eax, dword [ebx + 0x90]
cmp eax, 5
ja case.default.0x43cb72
jmp dword [eax*4 + 0x4e5a44]
mov ecx, dword [ebp - 4]
and dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x172]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43cd30
mov ecx, dword [ebp - 4]
and dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x172]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43cd30
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
or edx, 2
and edx, 0xfffffffe
mov dword [ebp - 0x20], edx
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffcb
movzx edx, byte [ecx + 0x172]
or eax, 8
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
mov dword [ebp - 0x164], 0
jmp 0x43cd30
mov ecx, dword [ebp - 4]
or dword [ebp - 0x20], 2
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
or eax, 4
movzx edx, byte [ecx + 0x172]
and eax, 0xffffffc7
or edx, 1
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43cd30
cmp dword [ebx + 0x54], 0
jne 0x43cc8f
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43ccc4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x164], 0
movzx edx, byte [ecx + 0x172]
movzx eax, byte [ecx + 0x178]
or edx, 1
or eax, 4
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43cd30
cmp dword [ebx + 0x50], 0
je 0x43cd05
mov ecx, eax
and dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x172]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43cd30
mov ecx, eax
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x172]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
mov eax, edx
and eax, 0x40
mov ecx, dword [ebx + 0xb4]
shr eax, 6
test ecx, ecx
je 0x43cd69
test eax, eax
jne 0x43cd69
mov edx, dword [ebp - 4]
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43cd65
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov byte [esi + 0x167], cl
mov ecx, dword [ebx + 0xb8]
test ecx, ecx
je 0x43cda2
test eax, eax
jne 0x43cda2
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43cd9e
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x169], cl
mov ecx, dword [ebx + 0xbc]
test ecx, ecx
je 0x43cdd8
test eax, eax
jne 0x43cdd8
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43cdd4
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x16b], cl
mov ecx, dword [ebx + 0xc0]
test ecx, ecx
je 0x43ce0e
test eax, eax
jne 0x43ce10
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43ce0a
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
test eax, eax
mov eax, esi
mov byte [eax + 0x16d], cl
je 0x43ce68
movzx eax, byte [eax + 0x173]
test al, 2
jne 0x43ce29
test al, 1
je 0x43ce3a
mov eax, esi
mov dword [eax + 0x13c], 3
jmp 0x43cf19
test al, 8
je 0x43ce4f
mov eax, esi
mov dword [eax + 0x13c], 2
jmp 0x43cf19
test al, 0x10
je 0x43cf19
mov eax, esi
mov dword [eax + 0x13c], 8
jmp 0x43cf19
test edx, 0x80
jne 0x43ce79
test byte [ebp - 0x168], 1
je 0x43ced1
movzx eax, byte [eax + 0x173]
test al, 2
jne 0x43ce88
test al, 1
je 0x43cead
test byte [ebp - 0x168], 1
je 0x43ce9f
mov eax, esi
mov dword [eax + 0x13c], 7
jmp 0x43cf19
mov eax, esi
mov dword [eax + 0x13c], 0xb
jmp 0x43cf19
test al, 8
je 0x43cebf
mov eax, esi
mov dword [eax + 0x13c], 6
jmp 0x43cf19
test al, 0x10
je 0x43cf19
mov eax, esi
mov dword [eax + 0x13c], 9
jmp 0x43cf19
test byte [ebp - 0x168], 2
movzx eax, byte [eax + 0x173]
je 0x43cf19
test al, 2
jne 0x43cee9
test al, 1
je 0x43cef7
mov eax, esi
mov dword [eax + 0x13c], 5
jmp 0x43cf19
test al, 8
je 0x43cf09
mov eax, esi
mov dword [eax + 0x13c], 4
jmp 0x43cf19
test al, 0x10
je 0x43cf19
mov eax, esi
mov dword [eax + 0x13c], 0xa
mov eax, dword [0x50bf40]
cmp dword [ebx + 0x84], 0
je 0x43cf3d
test eax, eax
jne 0x43cf3d
mov eax, 0x232
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x94], 0
je 0x43f0f8
test eax, eax
je 0x43e429
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0x168], eax
mov eax, dword [ebx + 0x9c]
cmp eax, 1
je 0x43d061
test eax, eax
jne 0x43cff7
mov eax, dword [ebp - 4]
test byte [eax + 0x179], 0x20
jne 0x43cf96
push str.FORT_BUFFERED
call fcn.004315b0
add esp, 4
test eax, eax
je 0x43d061
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00430670
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
lea eax, [ebp - 0x140]
sete dl
movzx ecx, byte [esi + 0x179]
shl edx, 6
and ecx, 0xffffffbf
push eax
push esi
or ecx, edx
mov byte [esi + 0x179], cl
call fcn.00430670
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x17c]
shl edx, 2
and ecx, 0xfffffffb
or ecx, edx
mov byte [esi + 0x17c], cl
jmp 0x43d072
cmp eax, 2
jne case.default.0x43c2bb
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00430670
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
lea eax, [ebp - 0x140]
sete dl
movzx ecx, byte [esi + 0x179]
shl edx, 6
and ecx, 0xffffffbf
push eax
push esi
or ecx, edx
mov byte [esi + 0x179], cl
call fcn.00430670
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x17c]
shl edx, 2
and ecx, 0xfffffffb
or ecx, edx
mov byte [esi + 0x17c], cl
jmp 0x43d072
mov eax, dword [ebp - 4]
and byte [eax + 0x179], 0xbf
and byte [eax + 0x17c], 0xfb
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00430670
mov dword [ebp - 0x144], eax
add esp, 8
cmp dword [ebp - 0x144], 0xffffffff
je 0x43d0fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x13c]
cmp eax, 3
jne 0x43d0b0
mov eax, dword [ebp - 4]
mov dword [eax + 0x13c], 1
jmp 0x43d0b5
cmp eax, 5
jne 0x43d0d1
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43d0fc
or byte [eax + 0x172], 2
mov dword [ebp - 0x1c], 3
jmp 0x43d0fc
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test dl, 4
je 0x43d0fc
mov eax, 0x229
test dl, 0x20
mov ebx, dword [ebp - 8]
jne 0x43d0f2
mov eax, 0x33
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x50bf40]
test ecx, ecx
jne 0x43d11b
cmp dword [ebp - 0x144], 0xfffffffa
jne 0x43d14b
mov dword [ebp - 0x144], 1
jmp 0x43d165
cmp dword [ebp - 0x144], 0xfffffffa
je 0x43ef37
cmp dword [ebp - 0x144], 1
je 0x43d165
cmp dword [ebp - 0x168], 0
jne 0x43e429
cmp dword [ebx + 0x84], 0
jne 0x43cf2b
cmp dword [ebp - 0x144], 0xfffffffc
je 0x43f069
cmp dword [ebp - 0x144], 0
jl 0x43ef22
mov eax, dword [ebp - 4]
cmp dword [eax + 0x13c], 1
jne 0x43d1a3
cmp dword [ebp - 0x144], 0
je 0x43d18c
cmp dword [ebp - 0x144], 2
je 0x43d18c
cmp dword [ebp - 0x144], 1
jne 0x43d1a3
mov edx, eax
shl ecx, 7
movzx eax, byte [edx + 0x178]
and eax, 0x7f
or eax, ecx
mov byte [edx + 0x178], al
cmp dword [ebp - 0x28], 0
je 0x43d25f
cmp dword [ebx + 0xa4], 0
jne 0x43d234
cmp dword [ebx + 0x68], 0
je 0x43e506
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], 0
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x43d1f6
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x43d1e1
dec eax
push eax
lea edx, [ebp - 0x14c]
push edx
lea edi, [ebp - 0x148]
push edi
lea ecx, [ebp - 0x18]
push ecx
lea esi, [ebp - 0x1c]
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x140]
push ecx
call dword [ebx + 0x68]
mov dword [ebp - 0x168], eax
add esp, 0x24
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
jmp 0x43d26e
push dword [ebx + 0xa8]
call fcn.0047c210
mov dword [ebp - 0x168], eax
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe4], eax
mov edx, dword [ebx + 0xa8]
mov dword [ecx + 0x180], edx
jmp 0x43d26e
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0xffffffff
je 0x43ec56
cmp dword [ebx + 0xa4], 0
jne 0x43d3a5
mov eax, dword [ebp - 4]
cmp dword [0x50aa64], 0
mov dword [eax + 0x180], 0xffffffff
je 0x43d3a5
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x43d3a5
cmp dword [ebp - 0x28], 0
je 0x43d32d
mov edx, dword [ebp - 4]
test byte [edx + 0x178], 2
jne 0x43d2d6
test al, 4
je 0x43d2dd
movzx ecx, byte [edx + 0x172]
test ecx, 0x80
je 0x43d2dd
mov edx, 0x8000
jmp 0x43d2df
xor edx, edx
mov ecx, dword [ebp - 0x24]
test ecx, 0xc0000000
je 0x43d2ef
or edx, 2
jmp 0x43d2fe
mov esi, edx
or esi, 1
test ecx, 0x40000000
je 0x43d2fe
mov edx, esi
cmp dword [ebx + 0x78], 1
je 0x43d308
test al, 1
je 0x43d30b
or edx, 8
push edx
push dword [ebp - 0x168]
call fcn.0047c3a0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x180], eax
mov eax, dword [0x50bf40]
jmp 0x43d3aa
cmp dword [0x50bf40], 0
jne 0x43d3ae
cmp dword [ebp - 0x144], 1
je 0x43d389
cmp dword [ebp - 0x144], 0
jne 0x43d364
call fcn.00472940
push eax
call fcn.0047c6d0
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x43d3e7
cmp dword [ebp - 0x144], 2
jne 0x43d3e7
call fcn.00472940
add eax, 0x40
push eax
call fcn.0047c6d0
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x43d3e7
call fcn.00472940
add eax, 0x20
push eax
call fcn.0047c6d0
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x43d3e7
mov eax, dword [0x50bf40]
test eax, eax
je 0x43d3d8
test dword [ebp - 0x144], 0xfffffffe
je 0x43d3cc
cmp dword [ebp - 0x144], 0xfffffffa
je 0x43d3cc
cmp dword [ebp - 0x144], 2
jne 0x43d3d8
mov dword [ebp - 0x168], 2
jmp 0x43d3f9
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x15e]
test eax, eax
jne 0x43d52a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15c], 1
je 0x43e537
movzx edx, byte [eax + 0x171]
and edx, 6
shr edx, 1
test edx, edx
je 0x43d4c2
mov ecx, dword [eax + 0x100]
add ecx, 2
cmp ecx, 0x20
jae 0x43d4c2
mov eax, 1
shl eax, cl
test eax, 0x103
je 0x43d4c2
cmp edx, 1
je 0x43d4a2
cmp edx, 2
jne 0x43d47c
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 2
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
inc dword [eax + 0xf8]
jmp 0x43d55e
cmp edx, 3
jne case.default.0x43c2bb
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 3
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
jmp 0x43d55e
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 1
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
inc dword [eax + 0xf8]
jmp 0x43d51e
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x170]
test cl, 4
movzx edx, byte [eax + 0x172]
je 0x43d4fe
cmp dword [eax + 0x13c], 1
je 0x43d511
test dl, 0x40
je 0x43d4ef
cmp dword [ebp - 0x168], 2
je 0x43d511
mov byte [eax + 0x15e], 2
inc dword [eax + 0xf8]
jmp 0x43d55e
test dl, 0x40
je 0x43d4ef
cmp dword [ebp - 0x168], 2
jne 0x43d4ef
test cl, 1
je 0x43d4ef
mov byte [eax + 0x15e], 1
inc dword [eax + 0xf8]
mov eax, dword [ebp - 4]
add dword [eax + 0xf8], 5
jmp 0x43d55e
mov edx, dword [ebp - 4]
cmp eax, 3
movzx ecx, byte [edx + 0x170]
movzx edx, byte [edx + 0x172]
je 0x43d55e
mov esi, dword [ebp - 4]
movsx edi, byte [esi + 0x15c]
cmp edi, 1
je 0x43d555
inc dword [esi + 0xf8]
cmp eax, 1
je 0x43ec48
test cl, 1
je 0x43d57e
mov eax, dword [ebp - 4]
test byte [eax + 0x173], 8
je 0x43d57e
cmp byte [eax + 0x15d], 2
jne 0x43d57e
inc dword [eax + 0xf8]
test cl, 4
je 0x43d5a2
mov eax, dword [ebp - 4]
and edx, 0x40
shr edx, 6
test byte [eax + 0x173], 8
je 0x43d5a8
test edx, edx
je 0x43d5a8
add dword [eax + 0xf8], 2
jmp 0x43d5a8
and edx, 0x40
shr edx, 6
cmp dword [ebp - 0x168], 1
jne 0x43d5c0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x174]
or eax, 8
jmp 0x43d5cd
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x174]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
test edx, edx
mov byte [ecx + 0x174], al
je 0x43d6af
push dword [ebp - 4]
call fcn.00425e70
add esp, 4
test eax, eax
jne 0x43bd69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
test eax, eax
je 0x43d6af
cmp byte [eax + 0x1e], 0
je 0x43d6af
mov esi, dword [eax + 0xc]
movzx eax, byte [esi + 0x175]
test al, 0x40
je 0x43d624
cmp byte [esi + 0x15e], 1
je 0x43e570
push esi
call fcn.004277a0
add esp, 4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
test edx, edx
je 0x43d63b
mov byte [edx + 0x1e], 0
test eax, eax
je 0x43d69a
mov edx, dword [esi + 0x18]
test edx, edx
je 0x43e5a7
test byte [edx + 0x44], 2
je 0x43d675
mov dword [edx + 0x38], eax
mov edx, dword [esi + 0x18]
mov dword [edx + 0x3c], eax
mov edx, dword [esi + 0x64]
test edx, edx
je 0x43d668
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x64], ecx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push eax
movzx edx, byte [esi + 0x174]
push eax
and edx, 7
push edx
push 0xffffffffffffffff
push esi
call fcn.0042bac0
add esp, 0x14
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
add dword [esi + 0x98], 1
adc dword [esi + 0x9c], 0
and byte [esi + 0x177], 0xfb
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
je 0x43d6db
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
jne 0x43d6db
mov eax, 0x33
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 0
je 0x43e049
cmp dword [ebx + 0x58], 5
je 0x43eb03
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x43e038
cmp eax, 2
je 0x43e038
cmp eax, 3
jne 0x43d73b
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov byte [edx + 0x173], al
mov dword [edx + 0x98], 1
mov dword [edx + 0x9c], 0
jmp 0x43e049
cmp eax, 1
jne 0x43d91b
cmp dword [ebx + 0x58], 5
je 0x43ead9
mov eax, dword [ebp - 4]
test byte [eax + 0x174], 8
jne 0x43d766
movzx eax, byte [eax + 0x173]
jmp 0x43e049
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, eax
mov eax, dword [esi + 0xe4]
call fcn.0043f310
mov dword [ebp - 0x168], eax
add esp, 0x10
mov eax, 0xffffffff
mov ecx, edx
mov esi, dword [ebp - 0x168]
sub ecx, eax
sub esi, eax
or esi, ecx
je 0x43ea93
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x168]
movzx eax, byte [esi + 0x173]
and byte [esi + 0x177], 0xfb
and eax, 0xfffffffe
mov dword [esi + 0x98], 0x80000000
mov dword [esi + 0x9c], 0xffffffff
mov byte [esi + 0x173], al
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], edx
cmp dword [esi + 0x13c], 5
je 0x43e049
mov eax, esi
movsx edx, byte [eax + 0x15c]
lea eax, [edx - 1]
cmp eax, 7
ja case.default.0x43d809
jmp dword [eax*4 + 0x4e5a5c]
cmp edx, 7
je 0x43e79f
cmp edx, 5
je 0x43e76c
mov dword [ebp - 0x164], 3
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.0043f370
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov esi, dword [ebp - 0x164]
neg esi
mov dword [esp + 4], esi
mov dword [esp + 8], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xe4]
call fcn.0043f310
mov dword [ebp - 0x160], eax
add esp, 0x10
mov eax, 0xffffffff
mov ecx, edx
mov edi, dword [ebp - 0x160]
sub ecx, eax
sub edi, eax
or edi, ecx
je 0x43d990
mov ecx, dword [ebp - 0x15c]
sub ecx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x168]
sbb eax, edx
neg ecx
neg eax
xor edx, edx
add ecx, dword [ebp - 0x164]
add eax, edx
or ecx, eax
jne 0x43d990
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x43d8d2
cmp dword [ebx + 0x68], 0
je 0x43e5c1
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x164]
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x43e74b
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x154]
jne 0x43d92a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x43e049
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x43e049
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.0043f370
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov dword [esp + 4], 0xfffffffc
mov dword [esp + 8], 0xffffffff
mov ecx, esi
mov eax, dword [ecx + 0xe4]
call fcn.0043f310
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x43da64
mov esi, dword [ebp - 0x164]
mov ecx, 4
sub esi, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
sub esi, ecx
or esi, eax
je 0x43daca
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x43e049
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x43dae0
cmp dword [ebx + 0x68], 0
je 0x43e7bd
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push 4
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x43e74b
cmp dword [ebp - 0x154], 4
jne 0x43db3e
movzx eax, byte [ebp - 0x15f]
shl eax, 8
movzx edx, byte [ebp - 0x160]
or edx, eax
cmp edx, 1
je 0x43e862
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x43e049
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x43e049
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.0043f370
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov dword [esp + 4], 0xfffffff7
mov dword [esp + 8], 0xffffffff
mov ecx, esi
mov eax, dword [ecx + 0xe4]
call fcn.0043f310
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x43dd33
mov ecx, dword [ebp - 0x164]
sub ecx, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
mov edx, 9
sub ecx, edx
or ecx, eax
jne 0x43dd33
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x43dc30
cmp dword [ebx + 0x68], 0
je 0x43e8c3
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push 9
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x43e74b
cmp dword [ebp - 0x154], 9
jne 0x43dccd
mov eax, dword [ebp - 4]
movzx esi, byte [ebp - 0x15b]
movzx edx, byte [ebp - 0x15a]
movzx ecx, byte [ebp - 0x159]
movzx edi, byte [ebp - 0x158]
test byte [eax + 0x175], 0x20
je 0x43dc9c
shl ecx, 8
shl edx, 0x10
or edi, ecx
shl esi, 0x18
or edi, edx
or edi, esi
jmp 0x43dcab
shl edx, 8
shl ecx, 0x10
or esi, edx
shl edi, 0x18
or esi, ecx
or edi, esi
cmp edi, 1
jne 0x43d75a
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x43e049
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x43e049
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.0043f370
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
mov edi, esi
xor ecx, ecx
add esp, 0xfffffff4
xor esi, esi
mov edx, 1
sub esi, dword [edi + 0xf8]
mov eax, dword [edi + 0xe4]
mov dword [esp + 4], esi
sbb ecx, 0
mov dword [esp + 8], ecx
call fcn.0043f310
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x43de18
mov ecx, dword [ebp - 0x164]
sub ecx, eax
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x168]
sbb eax, edx
neg ecx
neg eax
xor edx, edx
mov esi, dword [esi + 0xf8]
add ecx, esi
add eax, edx
or ecx, eax
je 0x43de7e
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x43e049
lea eax, [ebp - 0x164]
push eax
push 0
push esi
call fcn.004265d0
add esp, 0xc
test eax, eax
jne 0x43bd69
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x43deae
cmp dword [ebx + 0x68], 0
je 0x43e9a0
mov edx, eax
lea eax, [ebp - 0x154]
push 0
push eax
push dword [edx + 0xf8]
push dword [ebp - 0x164]
push dword [edx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x43e74b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
cmp eax, dword [ebp - 0x154]
jne 0x43df9e
mov edx, dword [ebp - 4]
movzx ecx, byte [edx + 0x172]
test ecx, 0x80
jne 0x43df13
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
push 0xe2c
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0041fa10
add esp, 0x10
mov eax, esi
movzx eax, byte [eax + 0x173]
jmp 0x43e049
mov eax, dword [ebp - 4]
or byte [eax + 0x177], 4
movzx eax, byte [eax + 0x173]
test al, 1
je 0x43e0fc
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
je 0x43e129
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov eax, esi
cmp dword [eax + 0x13c], 7
jne 0x43e0d4
add esp, 0xfffffff0
mov ecx, 0xffffffff
mov edx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov eax, dword [esi + 0xe4]
call fcn.0043f310
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43e6ea
mov eax, esi
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x177], 0xfb
movzx eax, byte [eax + 0x173]
test al, 1
jne 0x43e129
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
je 0x43e129
test byte [edx + 0x170], 4
je 0x43e115
test al, 8
jne 0x43e129
test byte [edx + 0x172], 0x40
jne 0x43e122
test al, 4
jne 0x43e129
or byte [edx + 0x175], 8
test eax, 0x80
jne 0x43e142
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf8]
mov word [edx + 0x158], ax
jmp 0x43e179
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 1
je 0x43ec0f
test byte [eax + 0x170], 4
je 0x43e16b
mov edx, eax
mov eax, 0x4f
mov word [edx + 0x158], ax
jmp 0x43e179
mov edx, eax
mov eax, 0x50
mov word [edx + 0x158], ax
mov edx, dword [ebx + 0x14]
test edx, edx
jle 0x43ebd0
mov ecx, dword [ebp - 4]
mov esi, dword [ebx + 0x10]
movzx ecx, byte [ecx + 0x170]
and ecx, 4
shr ecx, 2
test ecx, ecx
je 0x43e1aa
cmp esi, 0x7ffffe00
jle 0x43e1aa
mov esi, 0x7ffffe00
jmp 0x43e1b2
test esi, esi
jle 0x43eb84
add esi, 0x1ff
and esi, 0xfffffe00
mov dword [ebx + 0x10], esi
mov ecx, dword [ebp - 4]
test byte [ecx + 0x173], 8
je 0x43e22a
mov edx, ecx
test byte [edx + 0x170], 4
je 0x43e1ea
movzx edx, byte [ecx + 0x179]
and edx, 0xffffffbf
mov byte [ecx + 0x179], dl
jmp 0x43e1f1
movzx edx, byte [edx + 0x179]
test dl, 0x40
mov ecx, dword [ecx + 0xf8]
je 0x43e224
cmp esi, ecx
jae 0x43e204
mov eax, ecx
mov esi, ecx
jmp 0x43e23e
imul edx, esi
mov ecx, dword [ecx + 0xf8]
lea eax, [ecx + 4]
cmp eax, edx
ja 0x43e23c
mov eax, edx
mov esi, eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x172]
test edx, 0x80
je 0x43e26a
mov edi, dword [ebp - 4]
cmp byte [edi + 0x15c], 3
je 0x43eb4d
mov eax, dword [ebp - 4]
mov dword [eax + 0xec], esi
mov ecx, dword [ebp - 4]
test dl, 0x40
mov eax, dword [ebx + 0x10]
mov dword [ecx + 0x140], eax
je 0x43e32d
mov eax, 0x234
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23f
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43e45a
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43e47d
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43e4a0
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23c
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43e4c3
mov eax, 0x30
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x58], 0
jne 0x43bd17
mov dword [ebx + 0x58], 3
jmp 0x43bd17
push esi
call fcn.0047bd40
add esp, 4
cmp eax, ebx
jne 0x43c554
mov edi, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x160]
or dword [ebp - 0x18], 0x8000000
jmp 0x43c57c
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
jmp 0x43d26e
movzx ecx, byte [eax + 0x170]
test cl, 4
movzx edx, byte [eax + 0x172]
je 0x43e564
test byte [eax + 0x173], 8
je 0x43e564
test dl, 0x40
je 0x43e564
mov byte [eax + 0x15e], 2
jmp 0x43d55e
mov byte [eax + 0x15e], 3
jmp 0x43d55e
mov ecx, dword [esi + 0x38]
movsx edx, byte [ecx + 5]
cmp edx, 0x20
je 0x43e59a
cmp edx, 0x2b
jne 0x43e58c
mov byte [ecx + 5], 0
movzx eax, byte [esi + 0x175]
and eax, 0xffffffbf
mov byte [esi + 0x175], al
jmp 0x43d624
mov byte [ecx + 5], 0x24
movzx eax, byte [esi + 0x175]
jmp 0x43e58c
push esi
push eax
push eax
push 1
call fcn.0041d960
add esp, 0x10
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x43e662
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x1e
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, esi
movsx eax, byte [eax + 0x15e]
cmp eax, 3
je 0x43e790
xor edx, edx
cmp eax, 2
setne dl
add edx, 2
mov dword [ebp - 0x164], edx
jmp 0x43d82c
mov dword [ebp - 0x164], 1
jmp 0x43d82c
mov eax, esi
cmp byte [eax + 0x15e], 3
jne 0x43d822
mov dword [ebp - 0x164], 2
jmp 0x43d82c
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x43e74b
add esp, 0xfffffff0
mov edx, 1
mov dword [esp + 4], 0xfffffffc
mov dword [esp + 8], 0xffffffff
call fcn.0043f310
add esp, 0x10
push 0
lea eax, [ebp - 0x154]
push eax
push 4
lea edx, [ebp - 0x160]
push edx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.0043f310
add esp, 0x10
jmp 0x43db02
cmp byte [ebp - 0x15e], 0x1a
je 0x43e87a
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43e74b
add esp, 0xfffffff0
mov eax, edi
mov edx, 2
mov dword [esp + 4], 0xfffffff7
mov dword [esp + 8], 0xffffffff
call fcn.0043f310
add esp, 0x10
push 0
lea eax, [ebp - 0x154]
push eax
push 9
lea edx, [ebp - 0x160]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.0043f310
add esp, 0x10
jmp 0x43dc52
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x43e74b
mov ecx, dword [ebp - 4]
xor esi, esi
add esp, 0xfffffff0
xor edi, edi
mov edx, 2
sub edi, dword [ecx + 0xf8]
mov dword [esp + 4], edi
sbb esi, 0
mov dword [esp + 8], esi
call fcn.0043f310
add esp, 0x10
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
push 0
push eax
push dword [edx + 0xf8]
push dword [ebp - 0x164]
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.0043f310
add esp, 0x10
jmp 0x43ded3
mov edx, dword [ebp - 4]
push eax
mov eax, dword [edx + 0xe4]
call fcn.0043f370
add esp, 4
or eax, edx
jne 0x43eab8
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x43e049
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x177], 0xfb
movzx eax, byte [eax + 0x173]
jmp 0x43e049
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x43eb25
mov eax, dword [ebp - 4]
and byte [eax + 0x175], 0xf7
jmp 0x43d6ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x26
mov edi, dword [ebp - 0x10]
and byte [edx + 0x175], 0xf7
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x43eb91
mov dword [ebx + 0x10], 0x400
jmp 0x43ebac
mov esi, dword [0x509ecc]
cmp esi, 0xfffffffe
je 0x43ebbe
test esi, esi
je 0x43eba5
cmp esi, 0xffffffff
jne 0x43ebb6
mov dword [ebx + 0x10], 0x20000
mov esi, 0x2000
jmp 0x43e1c1
mov dword [ebx + 0x10], esi
jmp 0x43e1c1
mov eax, 0x6a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x509ed0]
cmp edx, 0xfffffffe
je 0x43ebfd
test edx, edx
je 0x43ebe4
cmp edx, 0xffffffff
jne 0x43ebf5
mov dword [ebx + 0x14], 1
mov edx, 1
jmp 0x43e184
mov dword [ebx + 0x14], edx
jmp 0x43e184
mov eax, 0x6b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test byte [eax + 0x170], 4
je 0x43ec1f
mov edx, 0x50
jmp 0x43ec24
mov edx, 0x51
cmp byte [eax + 0x15c], 1
je 0x43ec3c
add edx, 4
mov word [eax + 0x158], dx
jmp 0x43e179
mov word [eax + 0x158], dx
jmp 0x43e179
cmp edi, 1
jne 0x43d51e
jmp 0x43d55e
cmp dword [ebx + 0xa4], 0
je 0x43ed43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.0047c7c0
mov dword [eax], ebx
cmp ebx, 2
jge 0x43ed17
cmp ebx, 0x7b
je 0x43f25c
cmp ebx, 0xa1
je 0x43f25c
cmp ebx, 0xce
je 0x43f25c
cmp ebx, 0xb7
je 0x43f2c7
cmp ebx, 0x50
je 0x43f2c7
cmp ebx, 0x13
je 0x43f26e
cmp ebx, 5
je 0x43f26e
cmp ebx, 0x14
je 0x43ed05
cmp ebx, 0xf
je 0x43ed05
cmp ebx, 4
jne 0x43ecea
mov edx, dword [ebp - 4]
mov eax, 0x25b
test byte [edx + 0x170], 0x20
jne 0x43ecf8
mov eax, 0x1e
jmp 0x43ecf8
mov eax, dword [ebp - 4]
mov dword [eax + 0xe8], ebx
mov eax, 0x1e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x2a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp ebx, 3
jg 0x43ec7b
mov edx, dword [ebp - 4]
mov eax, 0x25a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43ed3f
mov eax, 0x1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x43ed5c
test byte [eax + 0x171], 0x40
je 0x43ec63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
cmp eax, 0x13
movzx edx, byte [edx + 0x170]
je 0x43ed7f
cmp eax, 5
je 0x43ed7f
test dl, 4
je 0x43ee00
test dl, 1
jne 0x43ee00
cmp dword [ebp - 0x158], 0
je 0x43ee00
mov edx, dword [ebp - 4]
test byte [edx + 0x171], 0x40
jne 0x43ee00
test byte [edx + 0x176], 1
jne 0x43ee00
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
push dword [ebp - 0x20]
or edx, 0x80000000
push edx
mov dword [ebp - 0x24], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x168]
cmp edx, 0xffffffff
mov dword [eax + 0xe4], edx
je 0x43eed0
or byte [eax + 0x171], 0x40
or byte [eax + 0x177], 0x10
jmp 0x43eebe
cmp eax, 0x20
jne 0x43eeaf
cmp dword [ebp - 0x164], 0
je 0x43eeaf
cmp dword [ebp - 0x158], 0
jne 0x43ee3c
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43ee3c
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
jmp 0x43eebe
xor eax, eax
lea esi, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
and ecx, 0x3fffffff
or edx, 2
or ecx, 0x80000000
push edx
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x168]
cmp edx, 0xffffffff
mov dword [eax + 0xe4], edx
je 0x43ec63
or byte [eax + 0x171], 0x40
or byte [eax + 0x177], 0x10
or byte [eax + 0x172], 1
or byte [eax + 0x178], 4
jmp 0x43d27b
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0xffffffff
je 0x43ec63
jmp 0x43d27b
test byte [eax + 0x170], 4
je 0x43eded
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
push dword [ebp - 0x20]
or edx, 0x40000000
push edx
mov dword [ebp - 0x24], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
or byte [edx + 0x176], 1
jmp 0x43eebe
test ecx, ecx
je 0x43d1a3
cmp dword [ebp - 0x144], 0xfffffffa
jne 0x43d1a3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], 0
or byte [eax + 0x178], 0x80
cmp dword [ebx + 0x84], 0
je 0x43ef63
cmp dword [ebx + 0x88], 0
jne 0x43ef63
and byte [eax + 0x179], 0xfe
jmp 0x43ef6a
or byte [eax + 0x179], 1
mov eax, dword [ebp - 0x168]
test eax, eax
lea edx, [ebp - 0x150]
jne 0x43ef7f
mov eax, 0x100
push edx
push 0
mov dword [ebp - 0x168], eax
lea ecx, [eax + 1]
push ecx
call fcn.004265d0
add esp, 0xc
test eax, eax
jne 0x43bd69
cmp dword [ebx + 0x98], 0
jne 0x43efc3
mov eax, dword [ebp - 4]
push dword [eax + 0x100]
push str.Unit__i
push dword [ebp - 0x150]
call fcn.00471b40
add esp, 0xc
jmp 0x43efed
push dword [ebp - 0x168]
push dword [ebx + 0x94]
push dword [ebp - 0x150]
call fcn.00471850
add esp, 0xc
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x168]
mov byte [eax + edx], 0
push dword [ebp - 0x150]
call fcn.004c8ff0
add esp, 4
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [edx + 0xe4], eax
je 0x43f2ea
test byte [edx + 0x179], 1
je 0x43f046
push eax
call fcn.004c90b0
add esp, 4
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call fcn.004c9030
add esp, 4
test eax, eax
jne 0x43f046
mov eax, 0x28e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x150]
call fcn.00426690
add esp, 4
test eax, eax
je 0x43d1a3
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax + 0x15a]
cmp edx, 4
jge 0x43f0b7
push dword [eax + 0x60]
call fcn.00426690
add esp, 4
test eax, eax
je 0x43f094
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x154]
push 0
push 5
call fcn.004265d0
add esp, 0xc
test eax, eax
je 0x43f0b7
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x13c], 0
mov dword [ebp - 0x140], 0x314d4f43
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x43f0d4
mov edx, dword [ebp - 4]
mov eax, 4
mov ecx, dword [0x50bf40]
mov word [edx + 0x15a], ax
jmp 0x43ef22
test eax, eax
jne 0x43f114
push str.USER
lea eax, [ebp - 0x140]
push eax
call fcn.00474990
add esp, 8
test eax, eax
je 0x43f123
mov dword [ebp - 0x168], 0
jmp 0x43cf5e
mov dword [ebp - 0x140], 0x4e4f43
mov eax, esi
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x43f138
mov edx, dword [ebp - 4]
mov eax, 3
mov dword [ebp - 0x168], 0
mov word [edx + 0x15a], ax
jmp 0x43cf5e
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x43c751
mov edx, eax
movzx eax, byte [edx + 0x173]
and eax, 0xffffffdf
mov byte [edx + 0x173], al
jmp 0x43c764
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 3
je 0x43c6c6
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 0x10
je 0x43c461
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 3
mov ecx, 3
jmp 0x43c470
mov edx, ecx
test byte [edx + 0x170], 4
je 0x43f1f9
test byte [edx + 0x173], 8
je 0x43f1f9
test byte [edx + 0x172], 0x40
je 0x43f1f9
mov byte [edx + 0x15e], 2
jmp 0x43c3ad
movsx edx, al
cmp edx, 4
je 0x43f23e
cmp edx, 1
je 0x43f23e
movzx esi, byte [ecx + 0x172]
test esi, 0x80
jne 0x43f23e
movzx ecx, byte [ecx + 0x178]
test cl, 1
jne 0x43f23e
test cl, 2
jne 0x43f23e
test esi, 0x40
je 0x43c3ad
add edx, 0xfffffffb
cmp edx, 3
ja 0x43c3ad
mov edx, dword [ebp - 4]
mov byte [edx + 0x15e], 3
jmp 0x43c3ad
mov dword [ebp - 0x158], 1
jmp 0x43bf0b
mov eax, 0x2b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x258
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f28d
mov eax, 9
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x63
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x25
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x259
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f2e6
mov eax, 0xa
mov esp, ebp
pop ebp
ret
mov eax, 0x258
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f306
mov eax, 9
mov esp, ebp
pop ebp
ret