Function at 0x302b261
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x310979b
mov eax, dword fs:[0]
push eax
sub esp, 0x1000
mov eax, dword [0x310e008]
xor eax, esp
mov dword [esp + 0xff8], eax
push ebx
push esi
push edi
mov eax, dword [0x310e008]
xor eax, esp
push eax
lea eax, [esp + 0x1010]
mov dword fs:[0], eax
mov dword [esp + 0x28], edx
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1018], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1018], 1
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x302bb89
mov esi, dword [edi + 0x50]
push 0x58
push eax
push edi
mov dword [esp + 0x30], 1
mov dword [esp + 0x20], esi
call sub.msvcrt.dll_memset
mov dword [edi + 0x50], esi
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x34]
add esp, 0xc
mov dword [edi], 0x58
mov eax, dword [esi + 8]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x24], eax
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0xc]
test eax, eax
jne 0x302b326
mov eax, dword [esp + 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [ebx]
lea ecx, [edi + 0x48]
push ecx
push ebx
call dword [eax + 0x10]
test eax, eax
jne 0x302bb5c
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x24]
test eax, eax
jne 0x302b362
cmp dword [esp + 0x14], 3
jne 0x302b354
or dword [edi + 0x28], 0x40
jmp 0x302b362
cmp dword [esp + 0x14], 9
jne 0x302b362
mov dword [edi + 0x28], 0x100
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + pe_nt_image_headers32]
test eax, eax
jne 0x302b37b
mov eax, dword [esp + 0x14]
mov dword [edi + 4], eax
mov eax, dword [edi + 0x48]
sub eax, 5
je 0x302b75d
dec eax
je 0x302b6ef
dec eax
je 0x302b5e2
dec eax
je 0x302b44c
dec eax
dec eax
je 0x302b7c6
sub eax, 0x11
je 0x302b3dd
sub eax, 5
je 0x302b75d
test byte [ebp + 0xc], 1
je 0x302b8a6
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.0302b1f9
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
jmp 0x302b8a6
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x170]
test eax, eax
jne 0x302b407
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.0302b1f9
or dword [edi + 0x28], 0x2000
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], edx
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
mov esi, eax
mov ecx, dword [esp + 0x28]
call fcn.0302b1f9
mov ecx, eax
mov dword [edi + 0x38], eax
or ecx, edx
mov dword [edi + 0x3c], edx
jne 0x302b89e
test dword [0x310fb18], 0x1000000
jne 0x302b89e
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x302b89e
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ebx
call dword [eax + 0x154]
test eax, eax
jne 0x302bb5c
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x302b8a6
mov eax, dword [edi + 0x50]
lea ecx, [edi + 0x54]
add eax, eax
mov dword [esp + 0x34], ecx
push eax
xor eax, eax
push eax
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [esp + 0x14]
xor eax, eax
mov word [esp + 0x44], ax
mov eax, dword [esi]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 1
push esi
call dword [eax + 0x18]
test eax, eax
js 0x302b562
push 8
lea esi, [edi + 0x54]
pop ebx
cmp dword [esp + 0x14], 1
jne 0x302b55a
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x44]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
test eax, eax
jne 0x302b55a
mov ecx, dword [edi + 0x50]
mov eax, esi
sub eax, edi
sub eax, 0x54
sar eax, 1
sub ecx, eax
je 0x302b514
push 0xffffffffffffffff
push dword [esp + 0x50]
push ecx
push esi
call fcn.0307d989
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x30]
jne 0x302b4fd
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esp + 0x44], bx
jne 0x302b531
xor eax, eax
mov word [esp + 0x44], ax
cmp dword [esp + 0x4c], eax
je 0x302b531
push dword [esp + 0x4c]
call fcn.030805d0
xor edx, edx
lea ecx, [esp + 0x18]
call fcn.03031fbe
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x18]
test eax, eax
jns 0x302b4b3
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x14]
sub eax, edi
sub eax, 0x54
sar eax, 1
mov dword [edi + 0x4c], eax
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
call fcn.0302b1f9
mov dword [edi + 0x38], eax
or eax, edx
mov dword [edi + 0x3c], edx
jne 0x302b5a8
mov eax, dword [0x310fb18]
and eax, 0x1000000
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
mov ebx, eax
jmp 0x302b5ac
mov ebx, dword [esp + 0x24]
xor eax, eax
mov byte [esp + 0x1018], al
mov eax, dword [esp + 0x18]
test eax, eax
je 0x302b5c3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [esp + 0x1018], 0xffffffff
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x302b756
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
jmp 0x302b756
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x28]
mov esi, eax
test esi, esi
jne 0x302bb5c
mov eax, dword [esp + 0x14]
xor ecx, ecx
sub eax, ecx
je 0x302b6e3
dec eax
je 0x302b6bf
dec eax
je 0x302b69b
dec eax
je 0x302b668
dec eax
dec eax
je 0x302b653
dec eax
dec eax
jne 0x302b8a6
or dword [edi + 0x28], 0x8000
lea ecx, [esp + 0x14]
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0x48]
test eax, eax
jne 0x302bb5c
mov eax, dword [esp + 0x14]
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
jmp 0x302b8a6
mov ecx, dword [ebx]
lea eax, [edi + 0x40]
push eax
push ebx
call dword [ecx + 0x3c]
or dword [edi + 0x28], 8
mov esi, eax
jmp 0x302b89e
or dword [edi + 0x28], 0x10
lea eax, [edi + 0x40]
mov ecx, dword [ebx]
push eax
push ebx
call dword [ecx + 0x3c]
test eax, eax
jne 0x302bb5c
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x40]
mov esi, eax
mov eax, dword [esp + 0x14]
cdq
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
jmp 0x302b89e
or dword [edi + 0x28], 0x4000
lea ecx, [esp + 0x14]
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0x30]
test eax, eax
jne 0x302bb5c
mov eax, dword [esp + 0x14]
cdq
jmp 0x302b3d2
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
mov esi, eax
mov ecx, dword [esp + 0x28]
call fcn.0302b1f9
mov dword [edi + 0x38], eax
or eax, edx
jmp 0x302b428
or dword [edi + 0x28], 0x80000
jmp 0x302b89e
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.0302b1f9
mov dword [edi + 0x38], eax
or eax, edx
mov dword [edi + 0x3c], edx
jne 0x302b725
mov eax, dword [0x310fb18]
and eax, 0x1000000
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
mov ebx, eax
jmp 0x302b729
mov ebx, dword [esp + 0x24]
xor eax, eax
mov byte [esp + 0x1018], al
mov eax, dword [esp + 0x18]
test eax, eax
je 0x302b740
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [esp + 0x1018], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x302b756
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x302bb8b
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0xb0]
test eax, eax
jne 0x302b782
mov eax, dword [esp + 0x14]
mov dword [edi + 0x30], eax
xor eax, eax
or dword [edi + 0x28], 0x40000
mov dword [edi + 0x34], eax
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x28]
test dword [0x310fb18], 0x1000000
je 0x302b7a2
cmp eax, 1
je 0x302b8a6
test eax, eax
jne 0x302bb5c
mov eax, dword [esp + 0x14]
sub eax, 8
je 0x302b7bf
dec eax
jne 0x302b7c6
or dword [edi + 0x28], 0x20000
jmp 0x302b7c6
or dword [edi + 0x28], 0x10000
xor eax, eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0x198]
test eax, eax
jne 0x302b7eb
cmp dword [esp + 0x2c], eax
je 0x302b7eb
or dword [edi + 0x28], 0x100000
cmp dword [edi + 0x48], 0xa
jne 0x302b810
mov eax, dword [ebx]
lea ecx, [esp + 0x2c]
push ecx
push ebx
call dword [eax + 0x114]
test eax, eax
jne 0x302b810
cmp dword [esp + 0x2c], eax
je 0x302b810
or dword [edi + 0x28], 0x400000
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [eax + 0x34]
mov esi, eax
test esi, esi
jne 0x302b842
test dword [edi + 0x28], 0x20000
je 0x302b842
mov edx, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x14]
add eax, dword [edx + 8]
adc ecx, dword [edx + 0xc]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
jmp 0x302b8a6
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
call fcn.0302b1f9
mov dword [edi + 0x38], eax
or eax, edx
mov dword [edi + 0x3c], edx
jne 0x302b89e
mov ecx, dword [0x310fb18]
test ecx, 0x800
je 0x302b888
mov eax, dword [ebx]
lea ecx, [esp + 0x54]
push ecx
push ebx
call dword [eax + 0x38]
mov esi, eax
mov eax, dword [esp + 0x54]
mov dword [edi + 0x38], eax
mov eax, dword [esp + 0x58]
mov dword [edi + 0x3c], eax
mov ecx, dword [0x310fb18]
mov eax, dword [edi + 0x38]
or eax, dword [edi + 0x3c]
jne 0x302b89e
and ecx, 0x1000000
neg ecx
sbb ecx, ecx
and dword [esp + 0x24], ecx
test esi, esi
jne 0x302bb5c
mov eax, dword [ebx]
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [eax + 0x14]
mov ecx, dword [esp + 0x20]
test eax, eax
jne 0x302ba4d
test ecx, ecx
je 0x302ba4d
xor eax, eax
cmp word [ecx], ax
je 0x302ba4d
cmp dword [edi + 0x48], 0xa
je 0x302b903
test dword [0x310fb18], 0x8000
jne 0x302b903
push 0x40
push ecx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x302b8ff
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x20]
test byte [0x310fb18], 8
je 0x302b943
mov esi, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x3015b88
push ecx
call esi
pop ecx
pop ecx
test eax, eax
je 0x302b93f
push 0x5f
pop ebx
mov word [eax], bx
mov word [eax + 2], bx
push 0x3015b88
push dword [esp + 0x24]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x302b923
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x20]
cmp word [ecx], 0x2e
jne 0x302b950
or dword [edi + 0x28], 0x800
test byte [0x310fb18], 2
je 0x302b9ab
cmp dword [edi + 0x48], 0xa
je 0x302b965
cmp dword [edi + 0x48], 0x1b
jne 0x302b9ab
mov edx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x30]
jne 0x302b96a
push ecx
sub edx, esi
lea esi, [edi + 0x54]
push ecx
sar edx, 1
push edx
mov edx, dword [edi + 0x50]
push ecx
mov ecx, esi
call fcn.0304c06e
xor eax, eax
cmp dword [edi + 0x50], eax
jbe 0x302b9a2
push 0xffffffffffffffff
push esi
push 0x7d1
lea eax, [esp + 0x68]
push eax
jmp 0x302b9b5
xor eax, eax
mov word [esp + 0x5c], ax
jmp 0x302b9bd
push 0xffffffffffffffff
push ecx
push dword [edi + 0x50]
lea esi, [edi + 0x54]
push esi
call fcn.0307d989
add esp, 0x10
mov ecx, dword [esp + 0x20]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x30]
jne 0x302b9c4
sub ecx, edx
sar ecx, 1
cmp ecx, 8
jne 0x302ba34
push 3
push 0x3015b90
push dword [esp + 0x28]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x302ba34
mov eax, dword [esp + 0x20]
movzx eax, word [eax + 0xa]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x302ba34
mov eax, dword [esp + 0x20]
movzx eax, word [eax + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x302ba34
mov eax, dword [esp + 0x20]
movzx eax, word [eax + 0xe]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
neg eax
pop ecx
sbb eax, eax
not eax
and dword [esp + 0x24], eax
lea ecx, [esi + 2]
xor edx, edx
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x302ba39
sub esi, ecx
sar esi, 1
mov dword [edi + 0x4c], esi
jmp 0x302ba8d
cmp dword [edi + 0x48], 0x1b
jne 0x302ba6f
push dword [edi + 0x3c]
lea eax, [edi + 0x54]
push dword [edi + 0x38]
push 0x3015b60
push dword [edi + 0x50]
push eax
call fcn.0307d708
add esp, 0x14
jmp 0x302ba8d
cmp dword [edi + 0x48], 0x19
jne 0x302bb52
push 0x3015b78
push dword [edi + 0x50]
lea eax, [edi + 0x54]
push eax
call fcn.0307d822
add esp, 0xc
cmp dword [esp + 0x20], 0
je 0x302ba9d
push dword [esp + 0x20]
call fcn.030805d0
cmp dword [edi + 0x48], 0xa
jne 0x302bad9
xor eax, eax
mov byte [esp + 0x1018], al
mov eax, dword [esp + 0x18]
test eax, eax
je 0x302baba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [esp + 0x1018], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x302bad0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x24]
jmp 0x302bb8b
mov eax, dword [ebx]
lea ecx, [esp + 0x3c]
push ecx
push ebx
call dword [eax + 0x44]
test eax, eax
jne 0x302baf1
mov eax, dword [esp + 0x3c]
mov dword [edi + 0x1c], eax
jmp 0x302baa3
xor eax, eax
mov dword [esp + 0x28], eax
mov byte [esp + 0x1018], 2
lea ecx, [esp + 0x28]
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0x20]
test eax, eax
jne 0x302bb28
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x3c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jne 0x302bb28
mov eax, dword [esp + 0x3c]
mov dword [edi + 0x1c], eax
xor edx, edx
lea ecx, [esp + 0x28]
call fcn.03031fbe
mov byte [esp + 0x1018], 1
mov eax, dword [esp + 0x28]
test eax, eax
je 0x302baa3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x302baa3
test ecx, ecx
je 0x302bb5c
push ecx
call fcn.030805d0
xor eax, eax
mov byte [esp + 0x1018], al
mov eax, dword [esp + 0x18]
test eax, eax
je 0x302bb73
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [esp + 0x1018], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x302bb89
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xff8]
xor ecx, esp
call fcn.0307c5f7
mov esp, ebp
pop ebp
ret 8