Function at 0x909b70
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x386c
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x3864], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x3880]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x3894]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x38a0]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x38a8]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x38b8]
mov dword [esp + 0x6c], edx
mov edx, dword [esp + 0x38bc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x388c]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x38c8]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x389c]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x38d0]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38a4]
mov ebx, dword [esp + 0x38d4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x3888]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x38dc]
mov ebp, dword [esp + 0x3884]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x38ac]
mov esi, dword [esp + 0x3898]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x3890]
mov dword [esp + 0x48], edx
xor edx, edx
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x38b4]
mov edi, dword [esp + 0x38c4]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x5c], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x38], edx
cmp dword [eax], edx
je 0x90aaca
cmp ebx, edx
je 0x909cfc
cmp ecx, edx
je 0x909cfc
cmp byte [ecx], dl
je 0x909cfc
mov eax, 0xadf590
call fcn.0094c3e0
test eax, eax
je 0x909cca
mov ecx, dword [esp + 0x2c]
mov eax, 0xadf598
call fcn.0094c3e0
test eax, eax
jne 0x909cca
mov ecx, dword [esp + 0x2c]
mov eax, 0xadf5a0
call fcn.0094c3e0
test eax, eax
jne 0x909cca
mov ecx, dword [esp + 0x2c]
mov eax, str..xlt
call fcn.0094c3e0
test eax, eax
jne 0x909cfc
push 0
push 0xaba8a4
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x909cf4
push 0
push str.Psalm
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x909cfc
mov dword [esp + 0x38], 1
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
cmp eax, 0x100
jbe 0x909daa
mov ecx, dword [esp + 0x4c]
mov ecx, dword [ecx]
cmp ecx, 1
je 0x909daa
cmp ecx, 2
je 0x909daa
mov edx, dword [esp + 0x30]
cmp dword [edx], 0
jne 0x909daa
mov edx, dword [esp + 0x28]
call fcn.00904f10
cmp eax, 1
jne 0x909d95
test esi, esi
je 0x909d42
mov dword [esi], eax
cmp byte [edx], 0x47
jne 0x909d65
cmp byte [edx + 1], 0x49
jne 0x909d65
cmp byte [edx + 2], 0x46
jne 0x909d65
mov ecx, dword [esp + 0x34]
mov eax, 0xadf5b0
mov edx, ebp
call fcn.00907060
jmp 0x909d95
mov eax, dword [str.Mangled_EXE]
mov dword [ebp], eax
mov ecx, dword [0xadf5b8]
mov eax, dword [esp + 0x34]
mov dword [ebp + 4], ecx
mov edx, dword [0xadf5bc]
mov dword [ebp + 8], edx
mov dword [esp + 0x14], 1
test eax, eax
je 0x909d95
mov dword [eax], 2
cmp dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov dword [eax], 1
jne 0x90aa6b
mov eax, str.cpio
mov ecx, ebp
call fcn.0094c330
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
test eax, eax
jne 0x909e13
mov eax, dword [ebx]
push 0
push 0
cmp eax, 0x400
jbe 0x909dd6
push 0x400
jmp 0x909dd7
push eax
push str._MacDefend
push esi
call fcn.0095ce40
add esp, 0x14
cmp eax, 0xffffffff
je 0x909e13
mov ecx, dword [str.MacBinary]
mov dword [ebp], ecx
mov edx, dword [0xadefec]
mov dword [ebp + 4], edx
mov ax, word [0xadeff0]
mov word [ebp + 8], ax
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov eax, str.Virus_Signature
mov ecx, ebp
call fcn.0094c330
test eax, eax
jne 0x909e53
cmp dword [ebx], 0x190
jbe 0x909e53
cmp byte [esi + 0x180], 0x2a
jne 0x909e53
cmp byte [esi + 0x181], 0x2b
jne 0x909e53
cmp byte [esi + 0x182], 0xff
jne 0x909e53
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov eax, 0xadf5b0
mov ecx, ebp
call fcn.0094c330
test eax, eax
jne 0x909eb1
push 6
mov eax, str.GIF87a
mov ecx, esi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x909eb1
mov edi, dword [esp + 0x30]
cmp dword [edi], eax
jne 0x909ea4
mov eax, dword [ebx]
mov edx, esi
call fcn.00904f10
cmp eax, 1
jne 0x909e9e
mov ecx, dword [esp + 0x34]
mov eax, 0xadf5b0
mov edx, ebp
call fcn.00907060
mov dword [edi], 1
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov eax, 0xadf5d0
mov ecx, ebp
call fcn.0094c330
test eax, eax
jne 0x909ece
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov eax, 0xadf5d4
mov ecx, ebp
call fcn.0094c330
test eax, eax
jne 0x909eeb
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov eax, 0xad6c3c
mov ecx, ebp
call fcn.0094c330
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x909ff0
mov ecx, dword [esp + 0x20]
cmp dword [ecx], 0
jne 0x909fc5
mov ecx, dword [0xb52628]
push esi
call fcn.009051f0
add esp, 4
cmp eax, 0xffffffff
jne 0x909fc5
mov eax, dword [esp + 0x38c0]
sub eax, dword [ebx]
mov esi, 0x800
cmp eax, 0x800
ja 0x909f41
mov esi, eax
cmp eax, 0x400
jbe 0x909ff0
mov edx, dword [esp + 0x40]
push 1
push 0
push 0
push edi
mov dword [esp + 0x40], 0
mov dword [edx], 1
call ebp
mov ebx, eax
push 2
push 0
mov eax, esi
neg eax
push eax
push edi
call ebp
push 0
lea ecx, [esp + 0x34]
push ecx
push esi
lea edx, [esp + 0x7c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov eax, dword [esp + 0x30]
add eax, 0xffffffff
js 0x909fbc
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x70]
cmp cl, 0x7d
je 0x909fbc
test cl, cl
je 0x909fb7
cmp cl, 0xa
je 0x909fb7
cmp cl, 0xd
jne 0x909fe4
sub eax, 1
jns 0x909fa0
mov ecx, dword [esp + 0x20]
cmp dword [ecx], 0
je 0x909ff0
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov eax, 0xad6c3c
mov dword [esp + 0x14], 1
call fcn.00907060
jmp 0x90aa6b
mov eax, dword [esp + 0x20]
mov dword [eax], 1
jmp 0x909fc5
mov edx, dword [esp + 0x4c]
cmp dword [edx], 1
jne 0x90a4d8
mov esi, dword [esp + 0x18]
mov eax, 0xac5f5c
mov ecx, esi
call fcn.0094c330
mov ebx, dword [esp + 0x1c]
test eax, eax
jne 0x90a1a1
mov eax, dword [ebx]
lea ecx, [eax - 1]
cmp ecx, 0x800
ja 0x90a029
dec eax
jmp 0x90a02e
mov eax, 0x800
mov edx, dword [esp + 0x28]
mov ecx, dword [0xb52624]
push 0
push 0
push eax
push edx
call fcn.00906990
add esp, 0x10
cmp eax, 0xffffffff
je 0x90a1a1
mov ecx, dword [str.DOCX]
mov eax, esi
mov esi, dword [esp + 0x38c0]
mov dword [eax], ecx
mov dl, byte [0xadf5dc]
mov byte [eax + 4], dl
mov eax, esi
mov dword [esp + 0x58], eax
fild dword [esp + 0x58]
mov dword [esp + 0x14], 1
test eax, eax
jge 0x90a085
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jnp 0x90a0aa
mov esi, dword [esp + 0x24]
call fcn.00905840
test eax, eax
je 0x90aa6b
mov esi, dword [esp + 0x38c0]
mov edx, dword [ebx]
mov eax, dword [esp + 0x28]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x60]
push ecx
dec edx
push edx
push 0
push str.media_image1.eps
push eax
mov edx, str.embeddings_oleobject
mov ecx, str.vbaProject.bin
mov dword [esp + 0x74], 0
call 0x932740
add esp, 0x24
cmp eax, 0xffffffff
je 0x90a100
mov ecx, dword [str.UCLDOCX]
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [0xadf620]
mov dword [eax + 4], edx
jmp 0x90aa6b
sub esi, dword [ebx]
mov eax, esi
mov esi, 0x800
cmp eax, 0x800
ja 0x90a112
mov esi, eax
cmp eax, 0x400
jbe 0x90aa6b
mov eax, dword [esp + 0x40]
push 1
push 0
push 0
push edi
mov dword [esp + 0x58], 0
mov dword [eax], 1
call ebp
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x4c]
push edx
push esi
lea eax, [esp + 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov eax, dword [esp + 0x48]
push 0
push 0
dec eax
push eax
lea ecx, [esp + 0x7c]
push str.vbaproject.bin
push ecx
call fcn.0095ce40
add esp, 0x14
cmp eax, 0xffffffff
je 0x90aa6b
mov edx, dword [str.UCLDOCX]
mov eax, dword [esp + 0x18]
mov dword [eax], edx
mov ecx, dword [0xadf620]
mov dword [eax + 4], ecx
jmp 0x90aa6b
mov edx, dword [esp + 0x4c]
cmp dword [edx], 1
jne 0x90a4d8
mov eax, 0xac5f5c
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x90a37a
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x90a1e7
lea ecx, [eax + 1]
mov eax, 0xadf634
call fcn.0094c330
test eax, eax
jne 0x90a1e7
mov dword [esp + 0x30], 1
mov eax, dword [ebx]
mov ecx, dword [esp + 0x28]
push 0
push 0
dec eax
push eax
push ecx
mov ecx, dword [0xb526a4]
call fcn.00906990
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x90a2be
mov eax, dword [esp + 0x38c0]
mov edx, dword [esp + 0x1c]
sub eax, dword [edx]
mov esi, 0x800
cmp eax, 0x800
ja 0x90a228
mov esi, eax
cmp eax, 0x400
jbe 0x90a298
mov eax, dword [esp + 0x40]
push 1
push 0
push 0
push edi
mov dword [esp + 0x30], 0
mov dword [eax], 1
call ebp
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x24]
push edx
push esi
lea eax, [esp + 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov ecx, dword [esp + 0x20]
push 0
dec ecx
push 0
push ecx
mov ecx, dword [0xb52640]
lea edx, [esp + 0x7c]
push edx
call fcn.00906990
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x90a2be
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esp + 0x28]
push 0
dec ecx
push 0
push ecx
mov ecx, dword [0xb52664]
push edx
call fcn.00906990
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
je 0x90a2cc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x90a2cc
mov dword [eax], 1
mov ebx, dword [esp + 0x68]
push 0
push str.lib_
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x90a349
push 0
push str.jboss
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x90a349
push 0
push str.Libre
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x90a349
push 0
push str.Mozilla
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x90a349
push 0
push str.BrowserExtension
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x90a349
mov eax, dword [esp + 0x24]
cmp byte [eax], 0x7b
je 0x90a349
cmp dword [esp + 0x30], 1
jne 0x90a359
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x90a35e
mov dword [eax], 0
jmp 0x90a35e
cmp esi, 0xffffffff
jne 0x90a368
cmp dword [esp + 0x38b0], 0
je 0x90a37a
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov eax, 0xac5f5c
call fcn.00907060
mov ecx, dword [esp + 0x4c]
cmp dword [ecx], 1
jne 0x90a4d8
mov ecx, dword [esp + 0x18]
mov eax, 0xadf670
call fcn.0094c330
test eax, eax
jne 0x90a4d8
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx]
mov esi, dword [esp + 0x28]
push 0
push 0
push eax
push str.WWKeywordLinks_Property
push esi
call fcn.0095ce40
add esp, 0x14
cmp eax, 0xffffffff
je 0x90a3e9
mov ecx, str.WWKeywordLinks_Property
inc ecx
cmp byte [ecx], 0
jne 0x90a3c4
sub ecx, str.WWKeywordLinks_Property
lea ecx, [eax + ecx + 5]
cmp byte [esi + ecx], 0x2f
je 0x90a4c6
cmp byte [esi + ecx + 1], 0x2f
je 0x90a4c6
mov eax, dword [ebx]
push 0
push 0
cmp eax, 0x400
jbe 0x90a3fd
push 0x400
jmp 0x90a3fe
push eax
push 0xace5d4
push esi
call fcn.0095ce40
mov ecx, dword [esp + 0x38d4]
sub ecx, dword [ebx]
add esp, 0x14
mov esi, 0x2800
cmp ecx, 0x2800
ja 0x90a424
mov esi, ecx
cmp eax, 0xffffffff
jne 0x90a4c6
cmp ecx, 0x400
jbe 0x90a4d8
mov edx, dword [esp + 0x40]
push 1
push 0
push 0
push edi
mov dword [esp + 0x30], 0
mov dword [edx], 1
call ebp
mov ebx, eax
push 2
push 0
mov eax, esi
neg eax
push eax
push edi
call ebp
push 0
lea ecx, [esp + 0x24]
push ecx
push esi
lea edx, [esp + 0x107c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov eax, dword [esp + 0x20]
push 0
dec eax
push 0
push eax
lea eax, [esp + 0x107c]
push 0xace5d4
push eax
call fcn.0095ce40
add esp, 0x14
cmp eax, 0xffffffff
jne 0x90a4c6
mov eax, dword [esp + 0x20]
cmp byte [esp + eax + 0x1005], 7
lea eax, [esp + eax + 0x1005]
jne 0x90a4d8
cmp byte [eax + 1], 0xa0
jne 0x90a4d8
cmp byte [eax + 2], 0xfb
jne 0x90a4d8
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov eax, 0xadf670
call fcn.00907060
mov esi, dword [esp + 0x18]
mov eax, 0xab748c
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x90a514
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [0xb52624]
call fcn.009051f0
add esp, 4
cmp eax, 0xffffffff
je 0x90a514
mov ecx, dword [esp + 0x34]
mov eax, 0xab748c
mov edx, esi
call fcn.00907060
mov eax, 0xadf1c4
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x90a5f2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push eax
push eax
mov eax, dword [edx]
dec eax
push eax
push ecx
mov ecx, dword [0xb52638]
call fcn.00906990
add esp, 0x10
cmp eax, 0xffffffff
je 0x90a557
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov eax, dword [esp + 0x40]
mov edx, 0x2800
cmp edx, dword [esp + 0x38c0]
push 1
push 0
sbb esi, esi
push 0
and esi, 0x2600
push edi
mov dword [esp + 0x4c], 0
add esi, 0x200
mov dword [eax], 1
call ebp
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x40]
push edx
push esi
lea eax, [esp + 0x107c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov eax, dword [esp + 0x3c]
cmp eax, 0x200
jb 0x90a5f2
push 0
push 0
dec eax
push eax
lea ecx, [esp + 0x107c]
push ecx
mov ecx, dword [0xb52638]
call fcn.00906990
add esp, 0x10
cmp eax, 0xffffffff
je 0x90a5f2
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov ecx, dword [esp + 0x18]
mov eax, 0xadf5b0
call fcn.0094c330
test eax, eax
jne 0x90a65c
mov edx, dword [esp + 0x40]
push 1
push eax
push eax
push edi
mov dword [esp + 0x4c], eax
mov dword [edx], 1
call ebp
push 2
push 0
push 0xffffffffffffffff
push edi
mov esi, eax
call ebp
push 0
lea eax, [esp + 0x40]
push eax
push 1
lea ecx, [esp + 0x53]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push esi
push edi
call ebp
cmp dword [esp + 0x3c], 1
jne 0x90a65c
cmp byte [esp + 0x47], 0x3b
je 0x90a65c
mov dword [esp + 0x14], 1
jmp 0x90aa6b
mov ebx, dword [esp + 0x1c]
cmp dword [ebx], 0
jbe 0x90a95a
mov esi, dword [esp + 0x4c]
cmp dword [esi], 1
je 0x90a8dd
mov ecx, dword [esp + 0x18]
mov eax, 0xaaabac
call fcn.0094c330
test eax, eax
jne 0x90a6a5
cmp dword [esp + 0x2c], eax
je 0x90a6a5
mov ecx, dword [esp + 0x2c]
inc ecx
mov eax, 0xad30a4
call fcn.0094c330
test eax, eax
je 0x90a8dd
mov ecx, dword [esp + 0x18]
mov eax, 0xaaabac
call fcn.0094c330
test eax, eax
jne 0x90a702
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x90a6c5
mov dword [eax], 1
cmp dword [esp + 0x38], 0
je 0x90a6f5
mov eax, dword [esp + 0x34]
test eax, eax
je 0x90a6da
mov dword [eax], 0
mov edx, dword [esp + 0x5c]
mov dword [esi], 0
mov dword [edx], 0
mov dword [ebx], 0
jmp 0x90a943
mov dword [esp + 0x14], 1
jmp 0x90a943
mov ecx, dword [esp + 0x18]
mov eax, 0xadf1c0
call fcn.0094c330
test eax, eax
je 0x90a8d1
mov eax, dword [ebx]
mov ebx, dword [esp + 0x38c0]
sub ebx, eax
mov dword [esp + 0x20], 0xffffffff
mov esi, 0x1000
cmp ebx, 0x1000
ja 0x90a73a
mov esi, ebx
cmp ebx, 0x400
jbe 0x90a7d3
mov eax, dword [esp + 0x40]
push 1
push 0
push 0
push edi
mov dword [esp + 0x48], 0
mov dword [eax], 1
call ebp
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x38d8]
mov eax, dword [esp + 0x38cc]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push 0
push 0
push eax
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x88]
push edx
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x90a8c3
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x1c]
jmp 0x90a93d
mov ecx, dword [esp + 0x54]
cmp dword [ecx], 0
jne 0x90a813
mov edx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x38dc]
push edx
mov edx, dword [esp + 0x30]
push 0
push ecx
mov ecx, dword [esp + 0x38dc]
push ecx
mov ecx, dword [esp + 0x38]
push eax
push edx
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x90a813
mov dword [esp + 0x20], 1
cmp ebx, 0x30
jbe 0x90a8b8
cmp dword [esp + 0x20], 0xffffffff
jne 0x90a8b8
mov eax, dword [esp + 0x40]
push 1
push 0
push 0
push edi
mov dword [esp + 0x48], 0
mov dword [eax], 1
call ebp
push 2
push 0
mov ecx, esi
neg ecx
push ecx
push edi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push edi
call ebp
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x38d8]
mov eax, dword [esp + 0x38cc]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push 0
push 0
push eax
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x88]
push edx
call fcn.00906770
add esp, 0x1c
cmp eax, 0xffffffff
je 0x90a7c6
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
jmp 0x90a943
cmp dword [esp + 0x20], 1
jne 0x90a7c6
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
jmp 0x90a943
mov ecx, dword [esp + 0x50]
mov dword [ecx], 1
jmp 0x90a943
mov ecx, dword [esp + 0x18]
mov eax, 0xaaabac
call fcn.0094c330
test eax, eax
jne 0x90a935
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x90a935
lea ecx, [eax + 1]
mov eax, 0xad30a4
call fcn.0094c330
test eax, eax
jne 0x90a935
mov edx, dword [esp + 0x38c0]
fild dword [esp + 0x38c0]
test edx, edx
jge 0x90a920
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x90a935
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x58]
test eax, eax
je 0x90a943
mov dword [eax], 1
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x24]
mov dword [ebx], 0
jne 0x90aa6b
jmp 0x90a95e
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov eax, 0xad330c
call fcn.0094c330
test eax, eax
jne 0x90aaca
test esi, esi
je 0x90aaca
cmp byte [esi], al
je 0x90aaca
cmp dword [esp + 0x38c0], 0x800000
jae 0x90aaca
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x90a9a2
cmp byte [eax], 0
jne 0x90a9b8
call fcn.00905840
test eax, eax
je 0x90a9b8
mov dword [esp + 0x14], 2
jmp 0x90aa6b
push 0x5f
push esi
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x90a9d4
mov dword [esp + 0x14], 2
jmp 0x90aa6b
cmp byte [esi], 0
mov eax, esi
je 0x90a9e6
jmp 0x90a9e0
inc eax
cmp byte [eax], 0
jne 0x90a9e0
sub eax, esi
cmp eax, 0x20
je 0x90aa08
cmp eax, 0x28
je 0x90aa08
cmp eax, 0x38
je 0x90aa08
cmp eax, 0x40
je 0x90aa08
cmp eax, 0x60
je 0x90aa08
cmp eax, 0x80
jne 0x90aa12
mov dword [esp + 0x14], 2
jmp 0x90aa6b
push 0x2e
push esi
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x90aaca
mov byte [eax], 0
cmp byte [esi], 0
mov ecx, esi
je 0x90aa36
nop
inc ecx
cmp byte [ecx], 0
jne 0x90aa30
sub ecx, esi
cmp ecx, 0x20
je 0x90aa59
cmp ecx, 0x28
je 0x90aa59
cmp ecx, 0x38
je 0x90aa59
cmp ecx, 0x40
je 0x90aa59
cmp ecx, 0x60
je 0x90aa59
cmp ecx, 0x80
jne 0x90aa61
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], 0
mov byte [eax], 0x2e
je 0x90aaca
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x1c]
mov dword [eax], 0
mov eax, dword [esp + 0x34]
mov dword [ecx], 0
mov dword [edx], 0
test eax, eax
je 0x90aa9c
cmp dword [eax], 0
jne 0x90aa9c
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x60]
test eax, eax
je 0x90aaaa
mov dword [eax], 1
mov esi, dword [esp + 0x64]
test esi, esi
je 0x90aaca
mov ecx, dword [esp + 0x18]
mov eax, 0xaaabac
call fcn.0094c330
test eax, eax
je 0x90aaca
mov dword [esi], 1
mov ecx, dword [esp + 0x3874]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x386c
ret