Function at 0x67912590
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x248
mov eax, dword [0x67ad7034]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x250]
mov ecx, 0x498
push ebx
mov ebx, dword [esp + 0x250]
push ebp
mov ebp, eax
mov dword [esp + 0x20], eax
shl ebp, 4
push esi
add ebp, ebx
mov dword [esp + 0x28], 0xffffffff
cmp dword [ebx + 0x358], 2
mov esi, 0x488
push edi
mov edi, dword [ebx]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], ecx
jne 0x67912610
cmp dword [ebx + 0x424], 0xffffffff
mov eax, esi
cmovne eax, ecx
cmp dword [eax + ebx], 2
je 0x67912610
mov eax, dword [ebx + 0x34c]
jmp 0x67912616
mov eax, dword [ebx + 0x304]
push 1
push 2
push 1
push 5
mov dword [esp + 0x34], eax
call fcn.679013d0
add esp, 0x10
test al, al
je 0x6791263c
push 0x67949a68
push edi
call fcn.678fe8f0
add esp, 8
cmp byte [ebx + 0x525], 0
je 0x67912678
push 0x67949ae0
push 0x67abc9d8
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x67912678
push 3
push 2
push 3
push 6
call fcn.679013d0
add esp, 0x10
test al, al
je 0x67912678
mov cl, 1
jmp 0x6791267a
xor cl, cl
mov eax, dword [ebp + 0x470]
mov byte [eax + 0x46], cl
cmp dword [ebx + 0x358], 2
jne 0x679126ab
cmp dword [ebx + 0x424], 0xffffffff
mov eax, esi
mov ecx, 0x498
cmovne eax, ecx
cmp dword [eax + ebx], 2
je 0x679126ab
mov eax, dword [ebx + 0x4e4]
jmp 0x679126b1
mov eax, dword [ebx + 0x4b8]
test eax, eax
je 0x679126ed
push 3
push 2
push 1
push 6
call fcn.679013d0
add esp, 0x10
test al, al
je 0x679126d5
mov eax, dword [ebp + 0x470]
mov byte [eax + 0x47], 1
jmp 0x679126f7
push 0x67949af8
push edi
call fcn.678fe810
add esp, 8
mov eax, 0x4d
jmp 0x67913250
mov eax, dword [ebp + 0x470]
mov byte [eax + 0x47], 0
mov eax, dword [ebp + 0x470]
mov dword [eax], 0
cmp dword [ebx + 0x358], 2
jne 0x6791272b
cmp dword [ebx + 0x424], 0xffffffff
mov eax, esi
mov ecx, 0x498
cmovne eax, ecx
cmp dword [eax + ebx], 2
je 0x6791272b
mov al, byte [edi + 0x8cf]
jmp 0x67912731
mov al, byte [edi + 0x873]
test al, al
je 0x67912773
push ebx
call fcn.678f9680
push dword [esp + 0x2c]
lea eax, [esp + 0x24]
push 0
push eax
push ebx
call fcn.678f9180
add esp, 0x14
test al, al
jne 0x6791276a
mov ecx, dword [ebp + 0x470]
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp + 0x470]
mov eax, dword [eax]
inc dword [eax + 0x10]
push ebx
call fcn.678f96b0
add esp, 4
mov esi, dword [ebp + 0x470]
cmp dword [esi], 0
jne 0x67912f61
push 0x38
lea eax, [esp + 0x6c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x68], 4
cmp byte [ebx + 0x4d4], 0
je 0x679127e3
cmp byte [esi + 0x47], 0
mov eax, 0x20
mov ecx, 8
cmovne eax, ecx
mov dword [esp + 0x98], eax
cmp byte [edi + 0x89f], 0
je 0x679127cc
or eax, 0x1800
jmp 0x679127e8
cmp byte [edi + 0x8a1], 0
je 0x679127dc
or eax, 0x1a00
jmp 0x679127e8
or eax, 0x200
jmp 0x679127e8
mov eax, 0x1808
cmp byte [ebx + 0x4d5], 0
mov dword [esp + 0x98], eax
jne 0x67912802
or eax, 4
mov dword [esp + 0x98], eax
mov edx, dword [ebx + 0x4ac]
cmp edx, 7
ja case.default.0x67912811
jmp dword [edx*4 + 0x6791326c]
mov ecx, dword [ebx + 0x358]
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
cmp ecx, 2
jne 0x67912873
cmp dword [ebx + 0x424], 0xffffffff
mov esi, 0x488
mov eax, esi
cmovne eax, dword [esp + 0x10]
cmp dword [eax + ebx], ecx
je 0x6791284f
mov edx, dword [ebx + 0x4d8]
mov esi, dword [ebx + 0x4dc]
jmp 0x67912879
cmp ecx, 2
jne 0x67912873
cmp dword [ebx + 0x424], 0xffffffff
mov eax, esi
mov ecx, 0x498
cmovne eax, ecx
cmp dword [eax + ebx], 2
je 0x67912873
mov esi, dword [ebx + 0x4dc]
jmp 0x67912879
mov esi, dword [ebx + 0x4b0]
test esi, esi
je 0x67912885
cmp esi, 0x10000
jne 0x6791288a
mov esi, 0x60000
sar esi, 0x10
cmp edx, esi
jg 0x67912901
mov ecx, dword [esp + 0x88]
add edx, 0xfffffffc
nop dword [eax + eax]
cmp edx, 3
ja case.default.0x679128a5
jmp dword [edx*4 + 0x6791328c]
or ecx, 0x80
jmp 0x679128c2
or ecx, 0x200
jmp 0x679128c2
or ecx, 0x800
mov dword [esp + 0x88], ecx
inc edx
lea eax, [edx + 4]
cmp eax, esi
jle 0x679128a0
jmp 0x67912901
push 0x679496dc
push dword [esp + 0x18]
call fcn.678fe810
add esp, 8
jmp case.0x67912f47.2146893055
mov dword [esp + 0x88], 0x20
jmp 0x67912901
mov dword [esp + 0x88], 8
mov ecx, dword [ebx + 0x358]
mov edx, 0x488
lea esi, [edx + 0x10]
cmp ecx, 2
jne 0x6791292d
cmp dword [ebx + 0x424], 0xffffffff
mov eax, edx
cmovne eax, esi
cmp dword [eax + ebx], ecx
je 0x6791292d
mov eax, dword [ebx + 0x4f4]
jmp 0x67912933
mov eax, dword [ebx + 0x4c8]
test eax, eax
je 0x679129c0
cmp ecx, 2
jne 0x67912957
cmp dword [ebx + 0x424], 0xffffffff
cmovne edx, esi
cmp dword [edx + ebx], ecx
je 0x67912957
mov esi, dword [ebx + 0x4f4]
jmp 0x6791295d
mov esi, dword [ebx + 0x4c8]
xor ebp, ebp
test esi, esi
je 0x679129aa
cmp byte [esi], 0
je 0x679129aa
cmp ebp, 0x2d
jge 0x679129aa
push 0
push 0
push esi
call dword [sym.imp.ucrtbase.dll_strtol]
add esp, 0xc
test eax, eax
jne 0x6791298c
push esi
call fcn.67911560
add esp, 4
test eax, eax
je 0x67912a07
push 0x3a
mov dword [ebp*4 + 0x67b386c8], eax
inc ebp
push esi
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
je 0x679129aa
add esi, 1
jne 0x67912963
mov dword [esp + 0x80], ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x84], 0x67b386c8
mov esi, dword [edi + 0x888]
test esi, esi
je 0x67912e18
push 0x5c
push esi
call sub.VCRUNTIME140.dll_strchr
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x67912c04
mov ebp, eax
sub ebp, esi
push ebp
push 0x679499e0
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912a1f
mov ebp, 0x10000
jmp 0x67912ae4
push 0x67949b98
push edi
call fcn.678fe810
add esp, 8
mov eax, 0x3b
jmp 0x67913250
push ebp
push 0x679499ec
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912a3d
mov ebp, 0x20000
jmp 0x67912ae4
push ebp
push 0x679499fc
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912a5b
mov ebp, 0x40000
jmp 0x67912ae4
push ebp
push 0x67949a0c
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912a76
mov ebp, 0x50000
jmp 0x67912ae4
push ebp
push 0x67949a18
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912a91
mov ebp, 0x60000
jmp 0x67912ae4
push ebp
push 0x67949a20
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912aac
mov ebp, 0x70000
jmp 0x67912ae4
push ebp
push 0x67949a38
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912ac7
mov ebp, 0x80000
jmp 0x67912ae4
push ebp
push 0x67949a50
push esi
call dword [sym.imp.ucrtbase.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x67912c04
mov ebp, 0x90000
mov eax, dword [esp + 0x10]
inc eax
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
je 0x67912c04
mov eax, dword [esp + 0x10]
inc eax
mov byte [esi], 0
push eax
call dword [0x67ad700c]
mov edx, eax
mov byte [esi], 0x5c
add esp, 4
mov dword [esp + 0x10], edx
test edx, edx
jne 0x67912b25
lea esi, [eax + 0x1b]
jmp 0x67912c09
lea eax, [esi + 1]
mov ecx, eax
mov dword [esp + 0x14], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x67912b31
sub ecx, esi
cmp ecx, 0x28
jne 0x67912c04
push edx
mov eax, ebp
or eax, 0x4000
push eax
push 0
push 0
push 9
call dword [sym.imp.crypt32.dll_CertOpenStore]
mov esi, eax
test esi, esi
jne 0x67912b88
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
push eax
push ebx
push ebp
push 0x67949cf0
push edi
call fcn.678fe810
push ebx
call dword [0x67ad7004]
add esp, 0x18
lea eax, [esi + 0x3a]
jmp 0x67913250
push dword [esp + 0x10]
call dword [0x67ad7004]
add esp, 4
mov dword [esp + 0x58], 0x14
lea eax, [esp + 0xc0]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x58]
push 0
push 0
push eax
lea eax, [esp + 0xcc]
push eax
push 4
push 0x28
push dword [esp + 0x2c]
call dword [sym.imp.crypt32.dll_CryptStringToBinaryA]
test eax, eax
je 0x67912bf1
push 0
lea eax, [esp + 0x5c]
push eax
push 0x10000
push 0
push 0x10001
push esi
call dword [sym.imp.crypt32.dll_CertFindCertificateInStore]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x67912dfb
push 0
push esi
call dword [sym.imp.crypt32.dll_CertCloseStore]
mov eax, 0x3a
jmp 0x67913250
mov esi, 0x3a
mov eax, dword [edi + 0x888]
cmp byte [eax], 0
je 0x67912e93
push 0x679509b4
push eax
call dword [sym.imp.ucrtbase.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x67912e93
push 2
xor esi, esi
mov dword [esp + 0x14], 0
push esi
push ebp
mov dword [esp + 0x20], 0
call dword [sym.imp.ucrtbase.dll_fseek]
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [esp + 0x54], ecx
test eax, eax
jne 0x67912c79
push ebp
call dword [sym.imp.ucrtbase.dll_ftell]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
js 0x67912e64
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x67912e64
push 0
push 0
push ebp
call dword [sym.imp.ucrtbase.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x67912e64
mov eax, dword [esp + 0x14]
inc eax
push eax
call dword [section._________1]
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x67912e64
push ebp
push 1
push dword [esp + 0x1c]
push eax
call dword [sym.imp.ucrtbase.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x67912e64
push ebp
call dword [sym.imp.ucrtbase.dll_fclose]
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x60], eax
mov eax, dword [edi + 0x898]
test eax, eax
je 0x67912cfe
mov esi, eax
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x67912cf5
sub esi, ecx
lea eax, [esi*2 + 2]
push eax
call dword [section._________1]
add esp, 4
mov ebp, eax
test esi, esi
je 0x67912d88
lea ecx, [esi + 1]
push ecx
push ebp
push esi
push dword [edi + 0x898]
push 8
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jns 0x67912d8a
xor eax, eax
mov word [ebp], ax
push 0
push ebp
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.crypt32.dll_PFXImportCertStore]
push ebp
mov esi, eax
call dword [0x67ad7004]
push dword [esp + 0x14]
call dword [0x67ad7004]
add esp, 8
test esi, esi
jne 0x67912db1
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [edi + 0x888]
cmp eax, 0x56
jne 0x67912d97
push ecx
push 0x67949c30
push edi
call fcn.678fe810
add esp, 0xc
lea eax, [esi + 0x3a]
jmp 0x67913250
xor eax, eax
cmp eax, esi
jg 0x67912d32
xor ecx, ecx
mov word [ebp + eax*2], cx
jmp 0x67912d38
push eax
push ecx
push 0x67949c6c
push edi
call fcn.678fe810
add esp, 0x10
mov eax, 0x3a
jmp 0x67913250
push 0
push 0
push 0
push 0
push 0x10001
push esi
call dword [sym.imp.crypt32.dll_CertFindCertificateInStore]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x67912dfb
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push dword [edi + 0x888]
push 0x67949ca8
push edi
call fcn.678fe810
add esp, 0x10
push 0
push esi
call dword [sym.imp.crypt32.dll_CertCloseStore]
mov eax, 0x3a
jmp 0x67913250
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], 1
push esi
mov dword [esp + 0x78], eax
call dword [sym.imp.crypt32.dll_CertCloseStore]
mov ebp, dword [esp + 0x20]
push 0x18
push 1
call dword [0x67ad7010]
mov ecx, dword [ebp + 0x470]
add esp, 8
mov dword [ecx], eax
mov eax, dword [ebp + 0x470]
mov eax, dword [eax]
test eax, eax
jne 0x67912eae
push 0x67949d30
push edi
call fcn.678fe810
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je case.0x67912f47.2146893056
push eax
call dword [sym.imp.crypt32.dll_CertFreeCRLContext]
mov eax, 0x1b
jmp 0x67913250
push ebp
call dword [sym.imp.ucrtbase.dll_fclose]
push dword [edi + 0x888]
push 0x67949c08
push edi
call fcn.678fe810
push dword [esp + 0x20]
call dword [0x67ad7004]
add esp, 0x14
mov eax, 0x3a
jmp 0x67913250
push dword [edi + 0x888]
push 0x67949bcc
push edi
call fcn.678fe810
add esp, 0xc
mov eax, esi
jmp 0x67913250
mov dword [eax + 0x10], 1
mov eax, dword [ebp + 0x470]
mov ecx, dword [eax]
lea eax, [ecx + 8]
push eax
push ecx
push 0
push 0
lea eax, [esp + 0x78]
push eax
mov eax, dword [0x67b38780]
push 0
push 2
push 0x67949d54
mov eax, dword [eax + 0xc]
push 0
call eax
mov ecx, dword [esp + 0x18]
mov esi, eax
test ecx, ecx
je 0x67912ef1
push ecx
call dword [sym.imp.crypt32.dll_CertFreeCRLContext]
test esi, esi
je 0x67912f61
push 0x100
lea eax, [esp + 0x158]
push eax
push esi
call fcn.678eb600
push eax
push 0x67949d84
push edi
call fcn.678fe810
mov eax, dword [ebp + 0x470]
push dword [eax]
call dword [0x67ad7004]
mov eax, dword [ebp + 0x470]
add esi, 0x7ff6fd00
add esp, 0x1c
mov dword [eax], 0
cmp esi, 0xe
ja case.0x67912f47.2146893055
movzx eax, byte [esi + 0x679132a8]
jmp dword [eax*4 + 0x6791329c]
push 0x67949b60
push edi
call fcn.678fe810
add esp, 8
jmp case.0x67912f47.2146893055
mov esi, dword [esp + 0x24]
lea eax, [esp + 0xac]
push eax
push esi
push 2
call fcn.6790fdf0
add esp, 0xc
test eax, eax
jne 0x67912f93
lea eax, [esp + 0xb0]
push eax
push esi
push 0x17
call fcn.6790fdf0
add esp, 0xc
test eax, eax
je 0x67912fa1
push 0x67949db4
push edi
call fcn.678fe8f0
add esp, 8
mov eax, dword [ebp + 0x470]
cmp byte [eax + 0x46], 0
je 0x67913034
push 0x67949df0
push 0x67949dfc
push edi
mov dword [esp + 0xe4], 2
mov byte [esp + 0xea], 8
mov dword [esp + 0xeb], 0x70747468
mov dword [esp + 0xef], 0x312e312f
call fcn.678fe8f0
push 9
call fcn.67901020
mov word [esp + 0xec], ax
add esp, 0x10
movzx eax, ax
add eax, 6
mov dword [esp + 0x30], 0x13
mov dword [esp + 0xd4], eax
lea eax, [esp + 0xd4]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x470]
mov dword [esp + 0x34], 0x12
jmp 0x67913054
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], 1
push 0x10
mov dword [esp + 0x4c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xac], ecx
mov dword [esp + 0xa8], 1
push 1
mov dword [eax + 0x38], 0x811c
call dword [0x67ad7010]
mov ecx, dword [ebp + 0x470]
add esp, 8
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x470]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x679130df
push 0x67949d30
push edi
call fcn.678fe810
add esp, 8
mov eax, 0x1b
jmp 0x67913250
test esi, esi
je case.0x67912f47.2146893056
lea eax, [edx + 8]
push eax
lea eax, [ecx + 0x3c]
push eax
lea eax, [esp + 0xa8]
push eax
push edx
xor edx, edx
lea eax, [esp + 0x58]
cmp byte [ecx + 0x46], dl
push 0
cmove eax, edx
push eax
mov eax, dword [0x67b38780]
push edx
push edx
push dword [ecx + 0x38]
mov eax, dword [eax + 0x18]
push esi
push edx
push dword [ecx]
call eax
mov esi, eax
cmp esi, 0x90312
je 0x679131c0
mov ecx, dword [ebp + 0x470]
push dword [ecx + 4]
call dword [0x67ad7004]
mov ecx, dword [ebp + 0x470]
lea eax, [esp + 0x158]
add esp, 4
mov dword [ecx + 4], 0
push 0x100
push eax
cmp esi, 0x80090300
je 0x6791319d
cmp esi, 0x80090322
je 0x6791317a
push esi
call fcn.678eb600
push eax
push 0x67949e1c
push edi
call fcn.678fe810
add esp, 0x18
jmp case.0x67912f47.2146893055
push 0x80090322
call fcn.678eb600
push eax
push 0x67949e54
push edi
call fcn.678fe810
add esp, 0x18
mov eax, 0x3c
jmp 0x67913250
push 0x80090300
call fcn.678eb600
push eax
push 0x67949e1c
push edi
call fcn.678fe810
add esp, 0x18
mov eax, 0x1b
jmp 0x67913250
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x40]
mov eax, dword [esp + 0x30]
push dword [esp + 0x4c]
push dword [ebx + eax*4 + 0x420]
push ebx
call fcn.678fef10
mov ecx, dword [0x67b38780]
add esp, 0x14
mov esi, eax
push dword [esp + 0x44]
mov ecx, dword [ecx + 0x40]
call ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
test esi, esi
jne 0x6791323b
cmp ecx, eax
jne 0x6791323b
mov eax, dword [ebp + 0x470]
mov dword [eax + 0x40], 0
mov eax, dword [ebp + 0x470]
mov byte [eax + 0x44], 0
mov eax, dword [ebp + 0x470]
mov byte [eax + 0x45], 0
mov eax, dword [ebp + 0x470]
mov byte [eax + 0x34], 0
xor eax, eax
mov dword [ebp + 0x46c], 1
jmp 0x67913250
push ecx
push eax
push 0x67949e88
push edi
call fcn.678fe810
add esp, 0x10
mov eax, 0x23
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.679343f5
add esp, 0x248
ret