Function at 0x4119a9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x120
jo 0x410e86
jno 0x410e86
call 0xceca1015
mov eax, dword [ecx]
mov esi, ecx
lea ecx, [esp + 0xac]
mov edi, edx
mov dword [ecx], eax
xor eax, eax
cmp byte [edx + 0x40], 2
jg 0x410ea0
jle 0x410ea0
call 0x8e01a3b3
push esp
add byte [eax + ebp*8 + 0x6e], al
mov bh, bh
jmp dword [esi - 0x7b]
setne al
lea edx, [eax + eax + 0x44]
call fcn.0040991a
test ax, ax
jne 0x41182c
jno 0x410eba
jo 0x410eba
call 0x8cce1549
and al, 0xb0
add byte [eax], al
add byte [ecx + 0x7f037e01], cl
add eax, ebp
mov eax, dword [esi]
lea ecx, [esp + 0xb0]
mov dword [ecx], eax
jle 0x410eca
jg 0x410eca
call 0xe89b1838
dec eax
mov bh, bh
jmp dword [esi - 0x7b]
push 9
pop edx
call fcn.0040991a
test ax, ax
jne 0x41182c
mov dword [esp + 0x1c], esi
jo 0x410ee4
jno 0x410ee4
call 0x8b496e73
push edi
or al, 0x7a
add edi, dword [ebx + 1]
mov ebx, dword [edi + 8]
mov edx, dword [edi + 0xc]
jp 0x410eef
jnp 0x410eef
call 0x839f4e5d
sti
mov eax, edx
push 0x3f
pop esi
cmp ebx, 0x64
mov eax, edx
js 0x410efc
jns 0x410efc
call 0x7241e783
das
sbb eax, 0
jb 0x410f30
jnp 0x410f06
jp 0x410f06
call 0x64ab0f74
push 0
push 0x64
push edx
push ebx
call fcn.00401793
add esp, 0x10
imul ecx, eax, 0xffffff9c
add ecx, ebx
mov ebx, eax
movzx ecx, word [ecx + ecx + 0x4037e0]
mov word [esp + esi + 0xd0], cx
add esi, 0xfffffffe
jmp 0x410ef2
jp 0x410f35
jnp 0x410f35
call 0x9abcf6a
xor eax, eax
push 9
pop ecx
cmp ecx, ebx
sbb eax, edx
jb 0x410f52
add bl, 0x30
jae 0x410f48
jb 0x410f48
call 0xd175abd4
add byte [eax], al
add byte [esi - 0x15], al
adc eax, 0x1780379
mov byte [esp + esi + 0xd1], bl
inc esi
jmp 0x410f67
jns 0x410f57
js 0x410f57
call 0x1bc5c66a
loopne 0x410f94
movzx eax, word [ebx + ebx + 0x4037e0]
mov word [esp + esi + 0xd0], ax
inc eax
add byte [esi - 0x77], ah
test byte [eax + edx*8], dh
add byte [eax], al
add byte [ebp + 3], dh
jne 0x410f6c
je 0x410f6c
call 0xd0759bfd
add byte [eax], al
add byte [edx + 0x41], ch
lea ecx, [esp + esi + 0xd0]
push 0x41
pop edx
sub edx, esi
jns 0x410f7d
js 0x410f7d
call 0x1c65840c
mov esi, dword [esp + 0x1c]
push esi
push 0x40329c
call fcn.0041b5c9
pop ecx
pop edx
test ax, ax
jb 0x410f96
jae 0x410f96
add eax, ebp
call 0x8d194a9
add byte [eax], al
jne 0x41182c
jb 0x410fa1
jae 0x410fa1
call 0x8cce1630
and al, 0xb4
add byte [eax], al
add byte [ecx + 0x7c037d01], cl
add eax, ebp
mov eax, dword [esi]
lea ecx, [esp + 0xb4]
mov dword [ecx], eax
jge 0x410fb1
jl 0x410fb1
call 0xe89b191f
popal
mov edi, edi
jmp dword [esi - 0x7b]
push 9
pop edx
call fcn.0040991a
test ax, ax
jne 0x41182c
ja 0x410fc7
jbe 0x410fc7
call 0x8b6d5756
ja 0x410ff1
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
mov ebx, dword [edi + 0x28]
mov edi, eax
mov eax, esi
mov dword [esp + 0x34], ecx
or ecx, ebx
mov dword [esp + 0x30], ebx
or eax, edi
mov dword [esp + 0x20], edi
or ecx, eax
mov eax, esi
sete byte [esp]
bsr ecx, ebx
bsr edx, edi
xor ecx, 0x1f
xor edx, 0x1f
add ecx, 0x20
test edi, edi
cmovne ecx, edx
bsr edx, dword [esp + 0x34]
bsr esi, esi
xor esi, 0x1f
xor edx, 0x1f
add edx, 0x20
test eax, eax
cmovne edx, esi
add edx, 0x40
or ebx, edi
mov ebx, eax
cmovne edx, ecx
push 0x62
pop eax
sub eax, edx
mov edx, 0
mov edi, 0
mov esi, 0
sbb edx, edx
sbb edi, edi
sbb esi, esi
push 0x7f
pop ecx
cmp ecx, eax
mov ecx, 0
mov dword [esp + 0x2c], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, 0
mov dword [esp + 0x10], edi
sbb ecx, edx
mov ecx, 0
sbb ecx, edi
mov ecx, 0
sbb ecx, esi
setb cl
or cl, byte [esp]
mov ecx, ebx
mov ebx, dword [esp + 0x34]
mov edx, ebx
cmovne ecx, eax
cmovne edx, eax
jne 0x411171
retf
mov eax, dword [esp + 8]
mov edi, ecx
mov ecx, dword [esp + 4]
xor eax, 0x7f
or ecx, esi
or eax, dword [esp + 0x10]
or ecx, eax
mov ecx, edi
mov edi, dword [esp + 0x20]
je 0x411358
mov dword [esp + 0x9c], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xa8], edi
and dword [esp + 0x98], 0
and dword [esp + 0x94], 0
and dword [esp + 0x90], 0
and dword [esp + 0x8c], 0
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 8]
xor al, 0x7f
mov ch, al
shr al, 3
and al, 0xf
and ch, 7
neg al
mov cl, ch
movsx eax, al
mov edx, dword [esp + eax + 0xa4]
mov edi, dword [esp + eax + 0xa8]
add byte [eax], al
add byte [edi], cl
movsd dword es:[edi], dword [esi]
xlatb
shl edx, cl
not cl
mov dword [esp + 0x50], edi
mov dword [esp + 0x38], edx
mov edx, dword [esp + eax + 0xa0]
mov edi, dword [esp + eax + 0x9c]
mov dword [esp + 0x28], 0
mov eax, edx
shr eax, 1
shr eax, cl
mov cl, ch
shld edx, edi, cl
shl edi, cl
xor ecx, ecx
add dword [esp + 8], 1
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 4]
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x10]
adc edx, ecx
adc edi, ecx
adc esi, ecx
jae 0x41117a
mov ebx, dword [esp + 0x24]
mov dword [esp], 0
jmp 0x41133b
mov edi, dword [esp + 0x20]
jmp 0x411358
mov ecx, edx
mov edx, ebx
or dword [esp + 0x38], eax
mov ebx, edi
mov dword [esp + 0x6c], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x20]
and dword [esp + 0x88], 0
and dword [esp + 0x84], 0
and dword [esp + 0x80], 0
and dword [esp + 0x7c], 0
mov dword [esp + 0x78], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x4c], esi
mov eax, dword [esp + 8]
mov ch, al
shr al, 3
and al, 0xf
and ch, 7
movzx eax, al
mov cl, ch
mov edx, dword [esp + eax + 0x74]
mov ebx, dword [esp + eax + 0x78]
mov esi, edx
add edx, edx
shrd esi, ebx, cl
mov dword [esp + 0x44], esi
mov esi, dword [esp + eax + 0x70]
mov dword [esp + 0x28], 0
mov edi, esi
shr edi, cl
not cl
shl edx, cl
mov cl, ch
or edx, edi
shr ebx, cl
mov dword [esp + 0x48], edx
mov edx, ebx
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + eax + 0x6c]
mov dword [esp], 0
shrd eax, esi, cl
mov esi, 0x3b9aca00
mov ecx, 0
add esi, 0xffffffff
mov dword [esp + 0x40], eax
mov dword [esp + 0x64], esi
adc ecx, 0xffffffff
mov esi, 0
mov dword [esp + 0x60], ecx
adc esi, 0xffffffff
mov ecx, 0
adc ecx, 0xffffffff
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ecx
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x50]
mov ecx, dword [esp + 0x38]
shld edx, edi, 1
shld edi, eax, 1
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x40]
shld eax, edx, 1
shld edx, esi, 1
shld esi, ecx, 1
or esi, dword [esp]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x3c]
shld ecx, esi, 1
shld esi, ebx, 1
add ebx, ebx
or ecx, dword [esp]
or esi, dword [esp]
or ebx, dword [esp + 0x28]
cmp dword [esp + 0x64], edx
mov dword [esp], 0
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x3c], esi
mov esi, dword [esp + 0xc]
mov dword [esp + 0x24], ebx
sbb ecx, eax
mov ecx, dword [esp + 0x5c]
sbb ecx, edi
mov ecx, dword [esp + 0x58]
sbb ecx, esi
sar ecx, 0x1f
mov ebx, ecx
and ebx, 1
mov dword [esp + 0x28], ebx
mov ebx, 0x3b9aca00
and ecx, ebx
mov ebx, dword [esp + 0x4c]
sub edx, ecx
mov ecx, dword [esp + 4]
sbb eax, 0
mov dword [esp + 0x40], edx
sbb edi, 0
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x10]
sbb esi, 0
mov dword [esp + 0x44], edi
mov dword [esp + 0xc], esi
mov esi, dword [esp + 8]
mov edx, dword [esp + 0xc]
add esi, 0xffffffff
adc ecx, 0xffffffff
mov dword [esp + 8], esi
adc eax, 0xffffffff
mov dword [esp + 4], ecx
adc ebx, 0xffffffff
or esi, eax
mov dword [esp + 0x10], eax
or ecx, ebx
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x24]
or esi, ecx
jne 0x411255
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
shld ecx, ebx, 1
add ebx, ebx
or ebx, dword [esp + 0x28]
or ecx, dword [esp]
mov edx, ebx
mov ebx, eax
neg ebx
mov eax, 0
sbb eax, dword [esp + 0x2c]
mov eax, 0
sbb eax, dword [esp + 0x30]
mov eax, 0
jge 0x411376
jl 0x411376
call 0x1b516ef
jne 0x41137b
je 0x41137b
call 0x1b116f0
jno 0x411380
jo 0x411380
call 0x1be1700
jl 0x411385
jge 0x411385
call 0xfa0ba2
add byte [eax], al
add byte [edi], cl
dec ebp
enter 0x4d0f, 0xffffffffffffffd0
sbb eax, edi
mov eax, 0
cmovge ecx, eax
cmovge edx, eax
push 0
push 0x15180
push ecx
push edx
mov esi, edx
call fcn.00401793
add esp, 0x10
mov dword [esp + 0xd0], eax
mov dword [esp], eax
imul eax, eax, 0xae80
and edx, 0x7fff
mov cx, 0x7b2
xor ebx, ebx
add eax, esi
mov dword [esp + 0xc], edx
mov word [esp + 0xd4], dx
mov word [esp + 0x54], ax
movzx edx, ax
shr eax, 0x10
and eax, 1
mov byte [esp + 0x56], al
shl eax, 0x10
or eax, edx
mov dword [esp + 0x10], eax
mov eax, ecx
xor edx, edx
mov si, 0x190
mov di, 0x64
div si
mov esi, eax
mov eax, ecx
xor edx, edx
div di
test cl, 3
jge 0x41140a
jl 0x41140a
call 0x8656097
mov dword [esp + 8], ecx
je 0x41141c
mov edx, 0x16d
mov byte [esp + 4], 0x1c
jmp 0x41145d
imul esi, esi, 0x190
mov edx, 0x7b2
imul eax, eax, 0x64
mov di, 0x7b2
jo 0x411433
jno 0x411433
call 0xb3000660
pop es
add byte [eax], al
sub edx, esi
mov esi, 0x7b2
sub esi, eax
add esi, ecx
cmp si, di
setne ah
add edx, ecx
cmp dx, di
sete al
or al, ah
movzx edx, al
or al, 0xfc
add edx, 0x16d
mov byte [esp + 4], al
mov eax, dword [esp + 0xc]
mov esi, ebx
mov ecx, 0x7fff
and esi, ecx
mov edi, eax
and edi, ecx
mov ecx, dword [esp]
jge 0x411476
jl 0x411476
call 0xf75ae5b3
cmp ecx, edx
sbb edi, esi
jb 0x411496
sub ecx, edx
ja 0x411483
jbe 0x411483
call 0x8b652110
dec esp
and al, 8
mov dword [esp], ecx
mov ecx, dword [esp + 8]
sbb eax, ebx
mov dword [esp + 0xc], eax
inc ecx
jmp 0x4113ea
js 0x41149b
jns 0x41149b
call 0x4655929
mov al, byte [esp + 4]
and ecx, 0x1ff
mov dl, 1
mov word [esp + 0x68], cx
movzx esi, dl
jne 0x4114b4
je 0x4114b4
call 0x4e50fb3b
and esi, 0xf
dec esi
cmp esi, 0xb
ja case.default.0x4114c3
mov ah, 0x1f
jmp dword [esi*4 + 0x43a3ec]
jnp 0x4114cf
jp 0x4114cf
call 0x1f2cd95b
mov ah, al
jmp case.0x4114c3.1
jns 0x4114d8
js 0x4114d8
call 0x2292ac7
add byte [eax], al
add byte [eax], al
call 0x3bd21d0
jl 0x4114e8
jmp 0x4114ef
call 0x4114e0
add al, ch
jmp 0x4114ef
jl 0x4114e8
jge 0x4114e8
call 0x3b11ad7
jmp 0x4114ef
jo 0x4114ef
jno 0x4114ef
call 0xb65033a7
hlt
mov ah, 0x1e
movzx esi, ah
mov edi, ecx
jno 0x4114fb
jo 0x4114fb
call 0x8160fb82
out 0xff, eax
add dword [eax], eax
add byte [esi + 0x39], ah
div dword [edx + 0xe]
and esi, 0x1f
and edi, 0x1ff
cmp di, si
jb 0x411517
movzx esi, si
jb 0x411511
jae 0x411511
call 0xf16ad813
inc dl
sub ecx, esi
jmp 0x4114ac
ja 0x41151c
jbe 0x41151c
call 0x106591ab
mov edi, dword [esp + 0x10]
inc cl
and dl, 0xf
mov si, 0x3c
and cl, 0x1f
mov byte [esp + 0x14], dl
xor edx, edx
mov byte [esp + 0x1a], cl
mov ecx, 0xe10
mov eax, edi
div ecx
imul ecx, eax, 0xf1f0
and al, 0x1f
xor edx, edx
add ecx, edi
mov byte [esp + 0x16], al
mov eax, ecx
div si
and al, 0x3f
mov byte [esp + 0x1b], al
push 0x3c
pop ecx
mov eax, edi
xor edx, edx
div ecx
and dl, 0x3f
mov byte [esp + 0x18], dl
jns 0x41156f
js 0x41156f
call 0x1bd18f0
jge 0x411574
jl 0x411574
call 0x1b518ed
jne 0x411579
je 0x411579
call 0x2485cb8c
sbb cl, byte [edi]
mov dh, 0x5c
and al, 0x14
movzx eax, byte [esp + 0x1a]
movzx ebx, byte [esp + 0x14]
mov dl, byte [esp + 0x18]
mov ch, byte [esp + 0x1b]
mov dh, byte [esp + 0x16]
call 0x411595
add al, ch
jo 0x41159b
jno 0x41159b
call 0x1bd191c
jge 0x4115a0
jl 0x4115a0
call 0x1b51919
jne 0x4115a5
je 0x4115a5
call 0x1bc1923
jp 0x4115aa
jnp 0x4115aa
call 0x1ba1926
js 0x4115af
jns 0x4115af
call 0xe1c1d73b
pop ds
mov cl, al
and cl, 0x1f
cmp cl, 9
push 5
pop edi
mov byte [esp + 4], dl
mov byte [esp + 0xc], ch
mov byte [esp], dh
ja 0x4115db
and al, 0x1f
jl 0x4115ce
jge 0x4115ce
call 0x3046145b
mov esi, edi
add al, 0x30
mov byte [esp + 0xd5], al
jmp 0x4115f6
push 4
pop esi
and eax, 0x1f
jnp 0x4115e6
jp 0x4115e6
call 0xc5ccf9
loopne 0x411623
movzx eax, word [eax + eax + 0x4037e0]
mov word [esp + 0xd4], ax
inc eax
add byte [esi - 0x77], ah
test byte [esp + edx*8], ah
add byte [eax], al
add byte [ebp + 3], dh
jne 0x4115fb
je 0x4115fb
call 0xd075a28c
add byte [eax], al
add byte [edx + 6], ch
lea ecx, [esp + esi + 0xd0]
push 6
pop edx
sub edx, esi
je 0x41160c
jne 0x41160c
call 0x1c658a9b
mov esi, dword [esp + 0x1c]
push esi
push 0x403274
call fcn.0041b5c9
pop ecx
pop edx
test ax, ax
ja 0x411625
jbe 0x411625
add eax, ebp
call 0x2299b38
add byte [eax], al
jne 0x411813
jp 0x411630
jnp 0x411630
call 0x8cce1cbf
and al, 0xc4
add byte [eax], al
add byte [ecx + 0x71037001], cl
add eax, ebp
mov eax, dword [esi]
lea ecx, [esp + 0xc4]
mov dword [ecx], eax
jo 0x411640
jno 0x411640
call 0xe89b45ae
rol byte [edx - 0x7a990001], cl
ror byte [edi], 0x85
ret 1
push 0x2f
pop edx
call fcn.0040991a
test ax, ax
jne 0x411813
mov eax, ebx
jb 0x411658
jae 0x411658
call 0x97d2580
and al, 0xf
cmp al, 9
ja 0x411674
and bl, 0xf
jb 0x411666
jae 0x411666
call 0x8871e1ea
pushfd
and al, 0xd4
add byte [eax], al
add byte [edx + 4], ch
or bl, 0x30
mov byte [esp + 0xd4], bl
push 4
jmp 0x41168e
and ebx, 0xf
jo 0x41167c
jno 0x41167c
call 0x1bc5cd8f
loopne 0x4116b9
movzx eax, word [ebx + ebx + 0x4037e0]
mov word [esp + 0xd3], ax
push 3
inc eax
add byte [esi - 0x77], ah
test byte [ebx + edx*8], ah
add byte [eax], al
add byte [edx + 3], ch
pop eax
sub edi, eax
jp 0x411696
jnp 0x411696
call 0xd045a327
add byte [eax], al
add byte [ecx + 3], dh
lea ecx, [esp + eax + 0xd0]
jno 0x4116a2
jo 0x4116a2
call 0x6898112f
je 0x4116da
mov edx, edi
push esi
push 0x403274
call fcn.0041b5c9
pop ecx
pop edx
inc eax
add al, ch
sbb bl, byte [edi + 0x5a590000]
test ax, ax
ja 0x4116b9
jbe 0x4116b9
call 0x1959bcc
add byte [eax], al
jne 0x411813
jne 0x4116c4
je 0x4116c4
call 0x8cce1d53
and al, 0xc8
add byte [eax], al
add byte [ecx + 0x78037901], cl
add eax, ebp
mov eax, dword [esi]
lea ecx, [esp + 0xc8]
mov dword [ecx], eax
jns 0x4116d4
js 0x4116d4
call 0xe89b4642
cmp bh, 0xff
push 0x2f
pop edx
call fcn.0040991a
invalid
test ax, ax
jne 0x411813
jp 0x4116ea
jnp 0x4116ea
call 0x8b9f2658
inc esp
and al, 8
push 0xf
pop esi
mov eax, dword [esp + 8]
mov cx, 0x64
cmp ax, 0x64
ja 0x4116fe
jbe 0x4116fe
call 0xd2723974
jb 0x411722
xor edx, edx
jb 0x411707
jae 0x411707
call 0x10330e71
mov bh, 0xd2
div cx
movzx edx, dx
movzx edx, word [edx + edx + 0x4037e0]
mov word [esp + esi + 0xd0], dx
add esi, 0xfffffffe
jmp 0x4116f5
cmp ax, 9
jbe 0x41172b
ja 0x41172b
call 0x1b91aa8
jns 0x411730
js 0x411730
call 0x304523ab
ja 0x41173e
add al, 0x30
mov byte [esp + esi + 0xd1], al
inc esi
jmp 0x411751
movzx eax, ax
movzx eax, word [eax + eax + 0x4037e0]
mov word [esp + esi + 0xd0], ax
jo 0x411756
jno 0x411756
call 0xd075a3e7
add byte [eax], al
add byte [edx + 0x11], ch
lea ecx, [esp + esi + 0xd0]
push 0x11
pop edx
sub edx, esi
ja 0x411767
jbe 0x411767
call 0x1c658bf6
mov esi, dword [esp + 0x1c]
push esi
push 0x403288
call fcn.0041b5c9
pop ecx
pop edx
test ax, ax
js 0x411780
jns 0x411780
call 0xce9c93
add byte [eax], al
jne 0x411813
jne 0x41178b
je 0x41178b
call 0x8cce1e1a
and al, 0xcc
add byte [eax], al
add byte [ecx + 0x79037801], cl
add eax, ebp
mov eax, dword [esi]
lea ecx, [esp + 0xcc]
mov dword [ecx], eax
js 0x41179b
jns 0x41179b
call 0xe89b3809
ja 0x411722
push 0x20
pop edx
call fcn.0040991a
test ax, ax
jne 0x411813
invalid
jle 0x4117ad
jg 0x4117ad
call 0x244dcdc0
movzx ecx, byte [esp]
mov edx, esi
call fcn.0041b771
test ax, ax
jne 0x411813
call 0x4117c3
add al, ch
mov eax, dword [esi]
lea ecx, [esp + 0x68]
mov dword [ecx], eax
jae 0x4117d1
jb 0x4117d1
call 0xe89b523f
inc ecx
cmp edi, 0xc08566ff
push 0x3a
pop edx
call fcn.0040991a
test ax, ax
jne 0x411813
jg 0x4117e3
jle 0x4117e3
call 0x248dcdf6
or al, 0x89
bnd call fcn.0041b771
movzx ecx, byte [esp + 0xc]
mov edx, esi
call fcn.0041b771
test ax, ax
jne 0x411813
jnp 0x4117f9
jp 0x4117f9
call 0x4cce1e88
and al, 0x54
mov eax, dword [esi]
lea ecx, [esp + 0x54]
mov dword [ecx], eax
jp 0x411806
jnp 0x411806
call 0xe89b5274
or al, 0x81
invalid
push 0x3a
pop edx
call fcn.0040991a
test ax, ax
je 0x411839
jno 0x411818
jo 0x411818
call 0x1b91b95
jns 0x41181d
js 0x41181d
call 0x1b71b98
ja 0x411822
jbe 0x411822
call 0x1b31b99
jae 0x411827
jb 0x411827
call 0x1c01ba9
jle 0x41182c
jg 0x41182c
call 0x1ba1ba8
js 0x411831
jns 0x411831
call 0x5f357dc2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jl 0x41183e
jge 0x41183e
call 0x248dce51
add al, 0x89
bnd call fcn.0041b771
movzx ecx, byte [esp + 4]
mov edx, esi
call fcn.0041b771
test ax, ax
jbe 0x411852
ja 0x411852
call 0x1be1bd2
jl 0x411857
jge 0x411857
call 0x1bb1bd6
jnp 0x41185c
jp 0x41185c
call 0x1be1bdc
jl 0x411861
jge 0x411861
call 0x1bc1bdf
jp 0x411866
jnp 0x411866
call 0x3b7dcdf
jne 0x41182c
jbe 0x41186d
ja 0x41186d
call 0x1c655cfc
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xb8]
mov eax, dword [eax]
mov dword [ecx], eax
jnp 0x411881
jp 0x411881
call 0xe89b21ef
xchg ecx, eax
cmp bh, 0xff
push 9
pop edx
call fcn.0040991a
test ax, ax
jne 0x41182c
ja 0x411893
jbe 0x411893
call 0x1c655d22
mov eax, dword [esp + 0x1c]
lea esi, [esp + 0x114]
lea edx, [esp + 0xbc]
mov ecx, esi
mov eax, dword [eax]
mov dword [edx], eax
jae 0x4118b0
jb 0x4118b0
call 0xff4d8eb3
jne 0x4118be
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040988f
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
mov bh, 0x46
add al, 0x66
test eax, eax
jne 0x41182c
js 0x4118cf
jns 0x4118cf
call 0x1c655d5e
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xc0]
mov eax, dword [eax]
mov dword [ecx], eax
jb 0x4118e3
jae 0x4118e3
call 0xe89b2351
das
cmp bh, 0xff
push 0xa
pop edx
call fcn.0040991a
jmp 0x41182c
jp 0x4118f5
jnp 0x4118f5
call 0x56986c4e
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [edx + 0x10]
mov dword [esp], ecx
jbe 0x411907
ja 0x411907
call 0x89457396
xlatb
mov ebx, dword [edx + 4]
mov edi, edx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [edx + 8]
cmp ebx, eax
mov esi, ebx
jl 0x411920
jge 0x411920
call 0x3b87296
jb 0x41197b
ja 0x411927
jbe 0x411927
call 0xb65020b6
invalid
mov eax, dword [edi]
movzx ecx, byte [edi + 0x410]
ja 0x411935
jbe 0x411935
call 0x6a41838a
add byte [edx + 3], ch
push ecx
push 0
push 0
push 3
push 0x400
push dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push eax
call sub.ntdll.dll_NtQueryDirectoryFile
mov byte [edi + 0x410], 0
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x411a0b
jno 0x411970
jo 0x411970
call 0x4580f7
and dword [edi + 4], 0
test esi, esi
mov dword [edi + 8], eax
jne 0x4119e8
lea ebp, [edi + esi + 0x6e]
mov dword [esp + 0xc], eax
jbe 0x411988
ja 0x411988
call 0x89e35f17
jmp 0x8571361e
mov eax, dword [ebp - 0x5e]
mov ecx, ebp
lea ebx, [eax + esi]
test eax, eax
mov eax, 0x400
cmove ebx, eax
mov dword [edi + 4], ebx
mov edi, dword [ebp - 0x22]
jne 0x4119a5
je 0x4119a5
call 0xfacb097a
shr edi, 1
mov edx, edi
push 1
push 0x403d44
call fcn.00410cf9
pop ecx
pop edx
test al, 1
jne 0x4119d6
jge 0x4119c0
jl 0x4119c0
call 0xfacb034d
mov ecx, ebp
mov edx, edi
push 2
push 0x403d46
call fcn.00410cf9
pop ecx
pop edx
test al, 1
je 0x411a28
je 0x4119db
jne 0x4119db
call 0x465966a
mov edi, dword [esp + 4]
mov eax, dword [esp + 0xc]
jmp 0x411917
cmp esi, 0xc0000022
jne 0x411a8f
jns 0x4119f9
js 0x4119f9
call 0x8b9a1f67
cmp al, 0x24
push 5
pop ecx
mov edi, dword [esp]
mov esi, 0x403d30
rep movsd dword es:[edi], dword [esi]
jmp 0x411a9d
jns 0x411a10
js 0x411a10
call 0x83651e9f
pushal
add al, 0
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
and dword [eax + 0xc], 0
and dword [eax + 8], 0
and dword [eax + 0x10], 0
jmp 0x411a9d
mov ebx, dword [esp + 4]
jbe 0x411a31
ja 0x411a31
call 0x1b91dae
jns 0x411a36
js 0x411a36
call 0x186566c7
lea ecx, [esp + 0x18]
lea esi, [ebx + esi + 0x10]
add ebx, 0x411
mov edx, ebx
push edi
push ebp
push 0x2fd
call fcn.004095f9
add esp, 0xc
jp 0x411a5a
jnp 0x411a5a
call 0x8d7968e9
inc esp
and al, 0x18
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x18]
mov eax, dword [eax]
bt ecx, 0xa
setae dl
or dl, 4
test cl, 0x10
movzx edx, dl
push 2
pop ecx
mov esi, dword [esp]
cmove ecx, edx
and word [esi + 0x10], 0
mov byte [esi + 0xc], 1
mov dword [esi], ebx
mov dword [esi + 4], eax
mov byte [esi + 8], cl
jmp 0x411a9d
jle 0x411a94
jg 0x411a94
call 0x66651f23
mov dword [eax + 0x10], 0x374000e
mov eax, dword [esp]
mov word [eax + 0x10], 0xe
je 0x411aa2
jne 0x411aa2
call 0x5e61df29
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret