Function at 0x435fa0
Capabilities:
Access peb ldr_data
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4e65e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [esp + 0x4c]
push edi
push 1
lea eax, [esp + 0x38]
push 4
mov esi, ecx
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x30]
push 4
push ecx
mov ecx, esi
call fcn.00435b20
mov ecx, dword [esp + 0x50]
xor ebx, ebx
mov dword [esp + 0x2c], eax
mov dword [ecx], eax
mov dl, byte [edi + 0xc]
test dl, 0x10
jne 0x43679d
jmp 0x436007
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x2c]
cmp ebx, eax
jge 0x43679d
lea eax, [ecx + 4]
push 4
push 0
push eax
mov dword [ecx], 0xffffffff
call dword [sym.imp.MSVCRT.dll__strnset]
mov eax, dword [esp + 0x5c]
add esp, 0xc
mov ecx, dword [eax + 0xc]
mov word [eax + 8], 0xffff
test ecx, ecx
je 0x436044
push ecx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x54]
add esp, 4
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0xffffffff
push edi
push 1
add eax, 4
push 4
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x28]
lea ebx, [ebx + eax*4]
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x20]
lea eax, [edx + 4]
mov dl, byte [edx + ecx + 4]
lea ecx, [esp + 0x28]
push edx
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 4
mov dword [esp + 0x20], eax
jb 0x436076
mov eax, dword [esp + 0x28]
push str.8BIM
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x43677e
push edi
push 1
lea ecx, [esp + 0x1e]
push 2
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x16]
mov ecx, esi
lea ebx, [ebx + eax*2]
push 2
push edx
call fcn.00435b20
mov ecx, dword [esp + 0x50]
push edi
push 1
lea edx, [esp + 0x1a]
push 1
push edx
mov word [ecx + 8], ax
call ebp
add esp, 0x10
add ebx, eax
lea eax, [esp + 0x12]
mov ecx, esi
push 1
push eax
mov dword [esp + 0x24], ebx
call fcn.00435b20
mov ebx, eax
test ebx, ebx
jle 0x43612d
push ebx
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x54]
push edi
push 1
push ebx
push eax
mov dword [ecx + 0xc], eax
call ebp
imul eax, ebx
mov ecx, dword [esp + 0x30]
add esp, 0x14
add ecx, eax
mov dword [esp + 0x1c], ecx
and ebx, 0x80000001
jns 0x43613a
dec ebx
or ebx, 0xfffffffe
inc ebx
jne 0x436155
push edi
push 1
lea edx, [esp + 0x1a]
push 1
push edx
call ebp
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, eax
mov dword [esp + 0x1c], ecx
push edi
push 1
lea eax, [esp + 0x3c]
push 4
push eax
call ebp
mov ecx, dword [esp + 0x2c]
add esp, 0x10
lea edx, [esp + 0x34]
lea ebx, [ecx + eax*4]
push 4
push edx
mov ecx, esi
call fcn.00435b20
mov ecx, dword [esp + 0x50]
mov edx, eax
and edx, 0x80000001
mov dword [ecx + 0x10], eax
jns 0x43618f
dec edx
or edx, 0xfffffffe
inc edx
je 0x436195
inc eax
mov dword [ecx + 0x10], eax
mov edx, dword [ecx + 0x10]
test edx, edx
jle 0x43677e
movsx eax, word [ecx + 8]
add eax, 0xfffffc18
cmp eax, 0x2f
ja case.0x4361ba.1008
xor ecx, ecx
mov cl, byte [eax + 0x4367f0]
jmp dword [ecx*4 + 0x4367cc]
push edi
push 1
lea edx, [esp + 0x1c]
push 2
push edx
mov byte [esi + 0x5c], 1
call ebp
add esp, 0x10
lea ebx, [ebx + eax*2]
lea eax, [esp + 0x14]
mov ecx, esi
push 2
push eax
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
mov word [esi + 0x52], ax
call ebp
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
lea ebx, [ebx + eax*2]
push 2
push edx
call fcn.00435b20
mov word [esi + 0x54], ax
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x14]
lea ebx, [ebx + eax*2]
push 2
push ecx
mov ecx, esi
call fcn.00435b20
push edi
push 1
lea edx, [esp + 0x1c]
push 2
push edx
mov word [esi + 0x56], ax
call ebp
add esp, 0x10
lea ebx, [ebx + eax*2]
lea eax, [esp + 0x14]
mov ecx, esi
push 2
push eax
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
mov word [esi + 0x58], ax
call ebp
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
lea ebx, [ebx + eax*2]
push 2
push edx
call fcn.00435b20
mov word [esi + 0x5a], ax
jmp 0x43677e
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov byte [esi + 0x50], 1
call ebp
add esp, 0x10
lea ecx, [esp + 0x14]
lea ebx, [ebx + eax*2]
push 2
push ecx
mov ecx, esi
call fcn.00435b20
push edi
push 1
lea edx, [esp + 0x20]
push 4
push edx
mov word [esi + 0x3c], ax
call ebp
add esp, 0x10
lea ebx, [ebx + eax*4]
lea eax, [esp + 0x18]
mov ecx, esi
push 4
push eax
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
mov dword [esi + 0x40], eax
call ebp
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
lea ebx, [ebx + eax*2]
push 2
push edx
call fcn.00435b20
mov word [esi + 0x44], ax
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x14]
lea ebx, [ebx + eax*2]
push 2
push ecx
mov ecx, esi
call fcn.00435b20
push edi
push 1
lea edx, [esp + 0x20]
push 4
push edx
mov word [esi + 0x46], ax
call ebp
add esp, 0x10
lea ebx, [ebx + eax*4]
lea eax, [esp + 0x18]
mov ecx, esi
push 4
push eax
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
mov dword [esi + 0x48], eax
call ebp
add esp, 0x10
lea ebx, [ebx + eax*2]
lea edx, [esp + 0x14]
push 2
push edx
mov ecx, esi
call fcn.00435b20
mov word [esi + 0x4c], ax
jmp 0x43677e
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov byte [esi + 0x74], 1
call ebp
add esp, 0x10
lea ecx, [esp + 0x14]
lea ebx, [ebx + eax*2]
push 2
push ecx
mov ecx, esi
call fcn.00435b20
lea edx, [esi + 0x62]
mov word [esi + 0x60], ax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], 4
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x14]
lea ebx, [ebx + eax*2]
push 2
push ecx
mov ecx, esi
call fcn.00435b20
mov ecx, dword [esp + 0x24]
mov word [ecx], ax
mov eax, dword [esp + 0x20]
add ecx, 2
dec eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
jne 0x436394
push edi
push 1
lea edx, [esp + 0x1c]
push 2
push edx
call ebp
add esp, 0x10
lea ebx, [ebx + eax*2]
lea eax, [esp + 0x14]
mov ecx, esi
push 2
push eax
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x19]
push 1
push ecx
mov word [esi + 0x6a], ax
call ebp
add esp, 0x10
lea edx, [esp + 0x11]
mov ecx, esi
add ebx, eax
push 1
push edx
call fcn.00435b20
mov dword [esi + 0x6c], eax
push edi
push 1
lea eax, [esp + 0x19]
push 1
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x11]
add ebx, eax
push 1
push ecx
mov ecx, esi
call fcn.00435b20
mov byte [esi + 0x70], al
jmp 0x43677e
push edi
push 1
lea edx, [esp + 0x1c]
push 2
push edx
call ebp
add esp, 0x10
lea ebx, [ebx + eax*2]
lea eax, [esp + 0x14]
mov ecx, esi
push 2
push eax
call fcn.00435b20
mov dword [esi + 0x9c], eax
jmp 0x43677e
push edi
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [esi + 0x98], 1
call ebp
add esp, 0x10
lea edx, [esp + 0x18]
mov ecx, esi
lea ebx, [ebx + eax*4]
push 4
push edx
call fcn.00435b20
mov dword [esi + 0x78], eax
push edi
push 1
lea eax, [esp + 0x20]
push 4
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x18]
lea ebx, [ebx + eax*4]
push 4
push ecx
mov ecx, esi
call fcn.00435b20
push edi
push 1
lea edx, [esp + 0x20]
push 4
push edx
mov dword [esi + 0x7c], eax
call ebp
add esp, 0x10
lea ebx, [ebx + eax*4]
lea eax, [esp + 0x18]
mov ecx, esi
push 4
push eax
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
mov dword [esi + 0x80], eax
call ebp
add esp, 0x10
lea edx, [esp + 0x18]
mov ecx, esi
lea ebx, [ebx + eax*4]
push 4
push edx
call fcn.00435b20
mov dword [esi + 0x84], eax
push edi
push 1
lea eax, [esp + 0x20]
push 4
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x18]
lea ebx, [ebx + eax*4]
push 4
push ecx
mov ecx, esi
call fcn.00435b20
push edi
push 1
lea edx, [esp + 0x20]
push 4
push edx
mov dword [esi + 0x88], eax
call ebp
add esp, 0x10
lea ebx, [ebx + eax*4]
lea eax, [esp + 0x18]
push 4
push eax
mov ecx, esi
call fcn.00435b20
push edi
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
mov dword [esi + 0x8c], eax
call ebp
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
lea ebx, [ebx + eax*2]
push 2
push edx
call fcn.00435b20
mov word [esi + 0x90], ax
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x14]
lea ebx, [ebx + eax*2]
push 2
push ecx
mov ecx, esi
call fcn.00435b20
mov edx, dword [esp + 0x50]
mov word [esi + 0x92], ax
mov eax, dword [edx + 0x10]
sub eax, 0x1c
push eax
mov dword [esp + 0x24], eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x54]
add esp, 4
mov dword [esp + 0x24], eax
mov cx, word [ecx + 8]
cmp cx, 0x409
jne 0x43667e
mov ecx, dword [esp + 0x20]
test ecx, ecx
jbe 0x4366ce
or ecx, 0xffffffff
lea edx, [eax + 1]
sub ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x38], ecx
push edi
push 1
lea eax, [esp + 0x54]
push 1
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x4c]
add ebx, eax
push 1
push ecx
mov ecx, esi
call fcn.00435b20
mov edx, dword [esp + 0x1c]
push edi
push 1
push 1
mov byte [edx + 1], al
lea eax, [esp + 0x58]
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x4c]
add ebx, eax
push 1
push ecx
mov ecx, esi
call fcn.00435b20
mov edx, dword [esp + 0x1c]
push edi
push 1
push 1
mov byte [edx], al
lea eax, [esp + 0x58]
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x4c]
add ebx, eax
push 1
push ecx
mov ecx, esi
call fcn.00435b20
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x38]
mov byte [ecx - 1], al
mov eax, dword [esp + 0x20]
add ecx, 3
add edx, ecx
mov dword [esp + 0x1c], ecx
cmp edx, eax
jb 0x4365e2
mov eax, dword [esp + 0x24]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x43677e
cmp cx, 0x40c
jne 0x4366ce
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], 0
test ecx, ecx
jbe 0x4366ce
push edi
push 1
lea eax, [esp + 0x54]
push 1
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x4c]
add ebx, eax
push 1
push ecx
mov ecx, esi
call fcn.00435b20
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov byte [ecx + edx], al
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x1c], ecx
jb 0x436695
mov eax, edx
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x43677e
push edi
push 1
lea eax, [esp + 0x20]
push 4
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x18]
lea ebx, [ebx + eax*4]
push 4
push ecx
mov ecx, esi
call fcn.00435b20
mov dword [esi + 0x38], eax
jmp 0x43677e
push edi
push 1
lea edx, [esp + 0x1c]
push 2
push edx
call ebp
add esp, 0x10
lea ebx, [ebx + eax*2]
lea eax, [esp + 0x14]
mov ecx, esi
push 2
push eax
call fcn.00435b20
mov word [esi + 0x20], ax
jmp 0x43677e
push edi
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
lea ebx, [ebx + eax*2]
push 2
push edx
call fcn.00435b20
mov word [esi + 0x22], ax
jmp 0x43677e
test edx, edx
mov dword [esp + 0x24], 0
jbe 0x43677e
push edi
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call ebp
mov ecx, dword [esp + 0x60]
add ebx, eax
mov eax, dword [esp + 0x34]
add esp, 0x10
mov edx, dword [ecx + 0x10]
inc eax
cmp eax, edx
mov dword [esp + 0x24], eax
jb 0x436759
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0xffffffff
call fcn.0047d354
test byte [edi + 0xc], 0x10
je 0x435fff
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
cmp ebx, eax
pop ebx
jne 0x4367b8
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x2c]
xor al, al
mov dword fs:[0], ecx
add esp, 0x38
ret 8