Function at 0x43e358
Capabilities:
Check if file exists
Clear file content
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], 0x101
test byte [edx + 0x170], 4
je 0x43e3a7
cmp dword [ebx + 0x80], 0
jne 0x43e3a7
cmp dword [ebx + 0x2c], 0
je 0x440b57
cmp dword [ebx + 0xa4], 0
je 0x43e3b9
mov byte [ebp - 0x140], 0
jmp 0x43e406
add esp, 0xfffffff0
mov esi, dword [ebx + 0x58]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x3c], esi
lea esi, [ebp - 0x28]
mov dword [esp + 0xc], esi
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], edi
call fcn.0043d04c
add esp, 0x10
test eax, eax
je 0x43e406
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x140]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x43e423
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x43e40e
dec eax
mov edx, dword [ebp - 4]
movsx esi, ax
add esi, 0xa
mov word [edx + 0x15a], ax
lea ecx, [edx + 0x60]
push ecx
push 0
push esi
mov dword [ebp - 0x154], ecx
call fcn.00428c60
add esp, 0xc
test eax, eax
je 0x43e459
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x43e465
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
or edx, dword [eax + 0x9c]
jne 0x43e494
mov dword [eax + 0x98], 1
mov dword [eax + 0x9c], 0
cmp dword [ebx + 0x44], 0
je 0x43e4b8
or byte [eax + 0x171], 0x40
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0x80000000
or byte [eax + 0x177], 0x10
jmp 0x43e4c6
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4418dd
cmp eax, 2
je 0x43e575
cmp eax, 1
jne 0x43e511
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], 0
or byte [eax + 0x171], 0x40
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43e59b
cmp eax, 3
jne 0x43e552
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43e718
mov dword [ebp - 0x158], 0
or byte [eax + 0x176], 1
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43e59b
mov edx, dword [ebp - 4]
mov eax, 0x2ed
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43e571
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43e718
xor eax, eax
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov dword [ebp - 0x158], eax
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x43e673
cmp eax, 2
je 0x43e64d
cmp eax, 1
jne 0x43e5e9
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], 0
or byte [eax + 0x171], 0x40
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43e673
cmp eax, 3
jne 0x43e62a
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43e718
mov dword [ebp - 0x158], 0
or byte [eax + 0x176], 1
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x43e673
mov edx, dword [ebp - 4]
mov eax, 0x23b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43e649
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43e718
xor eax, eax
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov dword [ebp - 0x158], eax
mov eax, dword [ebx]
cmp eax, 5
ja case.default.0x43e67e
jmp dword [eax*4 + 0x4e79a0]
mov eax, dword [ebp - 4]
or byte [eax + 0x173], 4
and byte [eax + 0x170], 0x7b
jmp case.0x43e67e.0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 0x10
mov byte [edx + 0x173], al
jmp 0x43e6f5
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43e718
mov edx, eax
movzx eax, byte [edx + 0x173]
or eax, 3
mov byte [edx + 0x173], al
jmp 0x43e6f5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 8
mov byte [edx + 0x173], al
jmp 0x43e6f5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 2
mov byte [edx + 0x173], al
mov edx, dword [ebx + 0x58]
cmp edx, 5
ja case.default.0x43e701
jmp dword [edx*4 + 0x4e79b8]
test al, 1
je 0x43e72a
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
jne 0x43e72a
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
or dword [ebp - 0x1c], 2
or dword [ebp - 0x18], 0x4000002
or byte [eax + 0x172], 4
jmp 0x43e7d9
test al, 1
je 0x43e766
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
jne 0x43e766
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
or dword [ebp - 0x1c], 1
jmp 0x43e7d9
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 2
or dword [ebp - 0x1c], 3
jmp 0x43e7d9
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je case.0x43e701.4
push str.USER
lea eax, [ebp - 0x140]
push eax
call fcn.004764c0
add esp, 8
test eax, eax
jne case.0x43e701.4
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 8
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
je 0x43e7bf
test byte [eax + 0x170], 4
je 0x43e7c8
test byte [eax + 0x177], 0x10
je case.0x43e701.5
or byte [eax + 0x172], 2
or dword [ebp - 0x1c], 3
jmp 0x43e7d9
or dword [ebp - 0x1c], 4
mov eax, dword [ebx + 0x28]
cmp eax, 6
ja case.default.0x43e94b
jmp dword [eax*4 + 0x4e79d0]
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 4
je case.0x43e7e5.2
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
test al, 4
jne 0x43e718
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x172], al
jmp case.0x43e7e5.0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
test al, 4
jne 0x43e718
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x172], al
jmp case.0x43e7e5.0
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x43e718
mov edx, eax
movzx eax, byte [edx + 0x172]
or eax, 8
mov byte [edx + 0x172], al
mov edx, dword [ebx + 0x28]
cmp edx, 5
jne 0x43e885
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x172], al
jmp case.0x43e7e5.0
cmp edx, 6
jne case.0x43e7e5.0
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x172], al
jmp case.0x43e7e5.0
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 4
je case.0x43e7e5.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x34]
cmp eax, 4
ja case.default.0x43e8c2
jmp dword [eax*4 + 0x4e79ec]
mov eax, dword [ebp - 4]
or byte [eax + 0x178], 2
jmp 0x43e934
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test edx, 0x80
jne 0x43e8f0
or byte [eax + 0x172], 0x80
jmp 0x43e934
or byte [eax + 0x178], 1
jmp 0x43e934
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x43e90f
test al, 0x10
jne 0x43e90f
test al, 4
je case.0x43e8c2.1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test edx, 0x80
jne 0x43e8f0
or byte [eax + 0x172], 0x80
jmp 0x43e934
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 0x40
mov edx, eax
mov eax, dword [ebx + 0x4c]
mov byte [edx + 0x15c], al
mov edx, dword [ebx + 0x4c]
cmp edx, 8
ja case.default.0x43e94b
jmp dword [edx*4 + 0x4e7a00]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x43e977
test dl, 0x10
jne 0x43e977
test dl, 4
jne 0x43e977
mov edx, dword [ebp - 4]
test byte [edx + 0x172], 0x40
je case.0x43e94b.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 4
mov eax, 4
jmp case.0x43e94b.0
mov edx, dword [ebp - 4]
test byte [edx + 0x173], 4
je case.0x43e94b.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov byte [ecx + 0x15e], dl
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x441860
cmp edx, 1
je 0x43ea2e
cmp edx, 2
jne 0x43ea07
mov edx, ecx
test byte [edx + 0x173], 4
jne 0x43e718
test byte [edx + 0x172], 0x40
je 0x43ea3d
movsx edx, al
add edx, 0xfffffffb
cmp edx, 3
ja 0x43ea3d
mov edx, ecx
mov byte [edx + 0x15e], 3
jmp 0x43ea3d
cmp edx, 3
je 0x43ea3d
mov edx, ecx
mov eax, 0x2f2
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43ea2a
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, ecx
test byte [edx + 0x173], 4
jne 0x43e718
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x441839
cmp edx, 1
je 0x43eabb
cmp edx, 2
jne 0x43ea6e
mov eax, dword [ebp - 4]
test byte [eax + 0x173], 0x10
jne 0x43e718
mov byte [eax + 0x15d], 2
jmp 0x43eb09
cmp edx, 3
jne case.default.0x43e94b
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x43e718
test dl, 1
jne 0x43e718
test dl, 4
jne 0x43e718
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 3
mov ecx, 3
jmp 0x43eb00
mov eax, 0x30
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
je 0x43eae8
movsx ecx, al
cmp ecx, 1
je 0x43eae8
test ecx, ecx
je 0x43eae8
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test dl, 0x10
jne 0x43e718
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 1
mov ecx, 1
test dl, 8
je 0x43ec2d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x15c], eax
add eax, 0xf
and eax, 0xfffffff0
call fcn.0047d660
mov eax, esp
mov edi, eax
push dword [ebp - 0x14]
push 0
push edi
call fcn.004c60d0
add esp, 0xc
push str.FOR_DO_NOT_CACHE_DIRECT_FILE
push dword [ebp - 0x14]
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.004742d0
add esp, 0x10
test edi, edi
je 0x43ec05
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x100]
movsx eax, byte [edi]
cmp eax, 0x20
mov dword [ebp - 0x168], edx
mov edx, edi
jne 0x43eb6e
inc edx
movsx eax, byte [edx]
cmp eax, 0x20
je 0x43eb65
mov ecx, edx
je 0x43eb82
movsx eax, byte [edx]
test eax, eax
je 0x43eb82
inc ecx
movsx eax, byte [ecx]
cmp eax, 0x20
jne 0x43eb75
push 0x4e7a7c
push edx
mov byte [ecx], 0
call fcn.0047d690
add esp, 8
mov esi, eax
test esi, esi
je 0x43ec05
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], edi
mov ebx, dword [ebp - 0x168]
push 0x2d
push esi
call fcn.0047b0e0
mov edi, eax
add esp, 8
test edi, edi
je 0x440b6d
push esi
mov byte [edi], 0
call fcn.0047d870
add esp, 4
inc edi
push edi
mov esi, eax
call fcn.0047d870
add esp, 4
cmp ebx, esi
jl 0x43ebe4
cmp ebx, eax
jle 0x440b7e
push 0x4e7a7c
push 0
call fcn.0047d690
add esp, 8
mov esi, eax
test esi, esi
jne 0x43ebab
mov edi, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x160]
or dword [ebp - 0x18], 0x10000000
mov edx, edi
mov eax, dword [ebp - 0x15c]
add eax, 0xf
and eax, 0xfffffff0
add esp, eax
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x15c]
movsx ecx, byte [edx + 0x15d]
and ecx, 0xfffffffe
cmp dword [ebx + 0x4c], 0
jne 0x43ece5
cmp ecx, 2
je 0x43ec56
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x173]
test dl, 8
jne 0x43ec53
test dl, 0x10
je 0x43ec6d
cmp ecx, 2
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 1
mov eax, 1
je 0x43ecfe
jmp 0x43ecea
movzx eax, byte [eax + 0x178]
test al, 1
jne 0x43ec97
test al, 2
jne 0x43ec97
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
and eax, 0x80
shr eax, 7
test dl, 4
je 0x43eca8
test eax, eax
je 0x43ecbd
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 5
mov eax, 5
jmp 0x43ecf4
test eax, eax
je 0x43ecbd
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 4
mov eax, 4
jmp 0x43ecf4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 3
je 0x43ecd7
mov byte [eax + 0x15c], 8
mov eax, 8
jmp 0x43ecf4
mov byte [eax + 0x15c], 5
mov eax, 5
jmp 0x43ecf4
cmp ecx, 2
je 0x43ecfe
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x43ecfe
test dl, 0x10
je 0x43ed18
movsx edx, al
cmp edx, 1
je 0x43ed1b
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
movsx edx, al
mov eax, dword [ebp - 4]
test byte [eax + 0x178], 1
je 0x43ed4d
movzx eax, byte [eax + 0x173]
test al, 1
jne 0x43ed36
test al, 2
je 0x43ed4d
cmp edx, 5
je 0x43ed56
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp edx, 4
je 0x441817
or dword [ebp - 0x20], 1
cmp dword [ebx + 0x54], 0
jne 0x43ed6c
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43ed8d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x164], 0
or byte [eax + 0x172], 1
and byte [eax + 0x178], 0xfb
or dword [ebp - 0x20], 2
jmp 0x43ed97
mov dword [ebp - 0x164], 1
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x43edd7
cmp eax, 1
je 0x43edcb
cmp eax, 2
je 0x43ede1
mov edx, dword [ebp - 4]
mov eax, 0x23d
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43edc7
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x43edf4
cmp dword [ebp - 0x38], 0
je 0x4417f0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 0x20
mov byte [edx + 0x173], al
and eax, 4
mov esi, dword [ebx + 0x48]
shr eax, 2
test esi, esi
je 0x43ee17
test eax, eax
je 0x43ee67
mov eax, 0x70
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x43ef6b
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 0x40
je 0x43ee44
mov esi, dword [0x50abc4]
cmp esi, 0xfffffffe
je 0x441933
cmp esi, 0xffffffff
jne 0x43ee5c
jmp 0x43ef6b
mov esi, dword [0x50abc8]
cmp esi, 0xfffffffe
je 0x441921
cmp esi, 0xffffffff
je 0x43ef6b
mov dword [ebx + 0x48], esi
test esi, esi
je 0x43ef6b
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43ee9f
test esi, esi
jle 0x43ee8d
mov eax, esi
mov ecx, 0xfffffffa
cdq
mov eax, esi
xor edi, edi
sub eax, ecx
sbb edx, edi
jl 0x43eea7
or eax, edx
je 0x43eea7
mov eax, 0x245
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x441945
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x172]
and edx, 0x80
shr edx, 7
mov dword [eax + 0xfc], esi
test edx, edx
je 0x43eedc
test byte [eax + 0x174], 0x10
jne 0x43eedc
cmp dword [ebx + 0x7c], 0
lea eax, [esi*4]
jne 0x43eedc
mov esi, eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x15c]
dec eax
cmp eax, 7
ja case.default.0x43eeec
jmp dword [eax*4 + 0x4e7a24]
mov eax, dword [ebp - 4]
lea edx, [esi + 1]
cmp byte [eax + 0x15e], 3
jne case.0x43eeec.1
mov esi, edx
jmp case.0x43eeec.1
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x173]
test byte [ecx + 0x178], 2
jne 0x43ef21
test al, 4
je case.0x43eeec.1
test edx, edx
je case.0x43eeec.1
mov edx, ecx
or eax, 0xffffff80
mov esi, 0x400
mov dword [edx + 0xfc], 0x10000
mov byte [edx + 0x173], al
jmp case.0x43eeec.1
add esi, 4
jmp case.0x43eeec.1
add esi, 8
jmp case.0x43eeec.1
push 0x6de
push str.for_nt_open_proc.c
push 2
push 8
call fcn.004220a0
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [eax + 0xf8], esi
jmp 0x43f077
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15c], 1
je 0x43ef8a
mov esi, eax
movzx eax, byte [esi + 0x173]
test al, 8
mov dword [ebp - 0x168], eax
je 0x43efad
mov edx, dword [ebp - 4]
mov eax, 0x241
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43efa9
mov eax, 0x25
mov esp, ebp
pop ebp
ret
mov eax, esi
movzx eax, byte [eax + 0x178]
test al, 1
jne 0x43efdf
test al, 2
jne 0x43efdf
mov eax, esi
mov ecx, dword [ebp - 0x168]
and ecx, 4
shr ecx, 2
movzx edx, byte [eax + 0x172]
test ecx, ecx
je 0x43eff7
test edx, 0x80
je 0x43eff7
mov eax, esi
mov dword [eax + 0xf8], 0x400
mov dword [eax + 0xfc], 0x10000
jmp 0x43f066
test byte [eax + 0x170], 4
je 0x43f01a
test dl, 0x40
je 0x43f01a
mov edx, eax
mov eax, 0x400
mov dword [edx + 0xf8], eax
mov dword [edx + 0xfc], eax
jmp 0x43f066
test edx, 0x80
je 0x43f038
mov dword [eax + 0xf8], 0x800
mov dword [eax + 0xfc], 0x1fe
jmp 0x43f066
test ecx, ecx
je 0x43f052
mov dword [eax + 0xf8], 0x401
mov dword [eax + 0xfc], 0x400
jmp 0x43f066
mov dword [eax + 0xf8], 0x85
mov dword [eax + 0xfc], 0x84
mov edx, esi
mov eax, dword [ebp - 0x168]
or eax, 0xffffff80
mov byte [edx + 0x173], al
mov eax, dword [ebx + 4]
test eax, eax
je 0x43f08d
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov eax, dword [ebx + 8]
mov byte [edx + 0x15f], al
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3c]
mov dword [edx + 0xd8], eax
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x43f111
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 0x40
jne 0x43f0ce
mov edx, eax
mov eax, 0x2ee
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f0ca
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x43f111
cmp edx, 1
jne 0x43f0e1
mov byte [eax + 0x161], 0x27
jmp 0x43f11b
cmp edx, 3
jne 0x43f0ef
mov byte [eax + 0x161], 0x22
jmp 0x43f11b
mov edx, eax
mov eax, 0x2ef
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f10d
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x161], 0
mov edx, dword [ebx + 0x74]
test edx, edx
je 0x43f182
test byte [eax + 0x172], 0x40
jne 0x43f14d
mov edx, eax
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f149
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x43f182
cmp edx, 1
jne 0x43f160
and byte [eax + 0x176], 0xfd
jmp 0x43f1a0
mov edx, eax
mov eax, 0x2f1
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f17e
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, eax
movzx eax, byte [edx + 0x176]
movzx esi, byte [edx + 0x170]
and eax, 0xfffffffd
and esi, 2
or eax, esi
mov byte [edx + 0x176], al
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x43f1f3
cmp eax, 2
je 0x43f1d9
cmp eax, 1
je 0x43f1d9
cmp eax, 3
je 0x43f1d9
mov edx, dword [ebp - 4]
mov eax, 0x2ec
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f1d5
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x43e718
test al, 0x10
jne 0x43e718
mov eax, dword [ebx + 0x90]
cmp eax, 5
ja case.default.0x43f202
jmp dword [eax*4 + 0x4e7a44]
mov ecx, dword [ebp - 4]
and dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x172]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43f3c0
mov ecx, dword [ebp - 4]
and dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x172]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43f3c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
or edx, 2
and edx, 0xfffffffe
mov dword [ebp - 0x20], edx
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffcb
movzx edx, byte [ecx + 0x172]
or eax, 8
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
mov dword [ebp - 0x164], 0
jmp 0x43f3c0
mov ecx, dword [ebp - 4]
or dword [ebp - 0x20], 2
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
or eax, 4
movzx edx, byte [ecx + 0x172]
and eax, 0xffffffc7
or edx, 1
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43f3c0
cmp dword [ebx + 0x54], 0
jne 0x43f31f
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43f354
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x164], 0
movzx edx, byte [ecx + 0x172]
movzx eax, byte [ecx + 0x178]
or edx, 1
or eax, 4
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43f3c0
cmp dword [ebx + 0x50], 0
je 0x43f395
mov ecx, eax
and dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x172]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x43f3c0
mov ecx, eax
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x172]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
mov eax, edx
and eax, 0x40
mov ecx, dword [ebx + 0xb4]
shr eax, 6
test ecx, ecx
je 0x43f3f9
test eax, eax
jne 0x43f3f9
mov edx, dword [ebp - 4]
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f3f5
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov byte [esi + 0x167], cl
mov ecx, dword [ebx + 0xb8]
test ecx, ecx
je 0x43f432
test eax, eax
jne 0x43f432
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f42e
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x169], cl
mov ecx, dword [ebx + 0xbc]
test ecx, ecx
je 0x43f468
test eax, eax
jne 0x43f468
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f464
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x16b], cl
mov ecx, dword [ebx + 0xc0]
test ecx, ecx
je 0x43f49e
test eax, eax
jne 0x43f4a0
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43f49a
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
test eax, eax
mov eax, esi
mov byte [eax + 0x16d], cl
je 0x43f4f8
movzx eax, byte [eax + 0x173]
test al, 2
jne 0x43f4b9
test al, 1
je 0x43f4ca
mov eax, esi
mov dword [eax + 0x13c], 3
jmp 0x43f5a9
test al, 8
je 0x43f4df
mov eax, esi
mov dword [eax + 0x13c], 2
jmp 0x43f5a9
test al, 0x10
je 0x43f5a9
mov eax, esi
mov dword [eax + 0x13c], 8
jmp 0x43f5a9
test edx, 0x80
jne 0x43f509
test byte [ebp - 0x168], 1
je 0x43f561
movzx eax, byte [eax + 0x173]
test al, 2
jne 0x43f518
test al, 1
je 0x43f53d
test byte [ebp - 0x168], 1
je 0x43f52f
mov eax, esi
mov dword [eax + 0x13c], 7
jmp 0x43f5a9
mov eax, esi
mov dword [eax + 0x13c], 0xb
jmp 0x43f5a9
test al, 8
je 0x43f54f
mov eax, esi
mov dword [eax + 0x13c], 6
jmp 0x43f5a9
test al, 0x10
je 0x43f5a9
mov eax, esi
mov dword [eax + 0x13c], 9
jmp 0x43f5a9
test byte [ebp - 0x168], 2
movzx eax, byte [eax + 0x173]
je 0x43f5a9
test al, 2
jne 0x43f579
test al, 1
je 0x43f587
mov eax, esi
mov dword [eax + 0x13c], 5
jmp 0x43f5a9
test al, 8
je 0x43f599
mov eax, esi
mov dword [eax + 0x13c], 4
jmp 0x43f5a9
test al, 0x10
je 0x43f5a9
mov eax, esi
mov dword [eax + 0x13c], 0xa
mov eax, dword [0x50cc40]
cmp dword [ebx + 0x84], 0
je 0x43f5cd
test eax, eax
jne 0x43f5cd
mov eax, 0x232
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x94], 0
je 0x441788
test eax, eax
je 0x440ab9
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0x168], eax
mov eax, dword [ebx + 0x9c]
cmp eax, 1
je 0x43f6f1
test eax, eax
jne 0x43f687
mov eax, dword [ebp - 4]
test byte [eax + 0x179], 0x20
jne 0x43f626
push str.FORT_BUFFERED
call fcn.00433c40
add esp, 4
test eax, eax
je 0x43f6f1
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00432cf0
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
lea eax, [ebp - 0x140]
sete dl
movzx ecx, byte [esi + 0x179]
shl edx, 6
and ecx, 0xffffffbf
push eax
push esi
or ecx, edx
mov byte [esi + 0x179], cl
call fcn.00432cf0
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x17c]
shl edx, 2
and ecx, 0xfffffffb
or ecx, edx
mov byte [esi + 0x17c], cl
jmp 0x43f702
cmp eax, 2
jne case.default.0x43e94b
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00432cf0
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
lea eax, [ebp - 0x140]
sete dl
movzx ecx, byte [esi + 0x179]
shl edx, 6
and ecx, 0xffffffbf
push eax
push esi
or ecx, edx
mov byte [esi + 0x179], cl
call fcn.00432cf0
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x17c]
shl edx, 2
and ecx, 0xfffffffb
or ecx, edx
mov byte [esi + 0x17c], cl
jmp 0x43f702
mov eax, dword [ebp - 4]
and byte [eax + 0x179], 0xbf
and byte [eax + 0x17c], 0xfb
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00432cf0
mov dword [ebp - 0x144], eax
add esp, 8
cmp dword [ebp - 0x144], 0xffffffff
je 0x43f78c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x13c]
cmp eax, 3
jne 0x43f740
mov eax, dword [ebp - 4]
mov dword [eax + 0x13c], 1
jmp 0x43f745
cmp eax, 5
jne 0x43f761
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43f78c
or byte [eax + 0x172], 2
mov dword [ebp - 0x1c], 3
jmp 0x43f78c
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test dl, 4
je 0x43f78c
mov eax, 0x229
test dl, 0x20
mov ebx, dword [ebp - 8]
jne 0x43f782
mov eax, 0x33
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x50cc40]
test ecx, ecx
jne 0x43f7ab
cmp dword [ebp - 0x144], 0xfffffffa
jne 0x43f7db
mov dword [ebp - 0x144], 1
jmp 0x43f7f5
cmp dword [ebp - 0x144], 0xfffffffa
je 0x4415c7
cmp dword [ebp - 0x144], 1
je 0x43f7f5
cmp dword [ebp - 0x168], 0
jne 0x440ab9
cmp dword [ebx + 0x84], 0
jne 0x43f5bb
cmp dword [ebp - 0x144], 0xfffffffc
je 0x4416f9
cmp dword [ebp - 0x144], 0
jl 0x4415b2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x13c], 1
jne 0x43f833
cmp dword [ebp - 0x144], 0
je 0x43f81c
cmp dword [ebp - 0x144], 2
je 0x43f81c
cmp dword [ebp - 0x144], 1
jne 0x43f833
mov edx, eax
shl ecx, 7
movzx eax, byte [edx + 0x178]
and eax, 0x7f
or eax, ecx
mov byte [edx + 0x178], al
cmp dword [ebp - 0x28], 0
je 0x43f8ef
cmp dword [ebx + 0xa4], 0
jne 0x43f8c4
cmp dword [ebx + 0x68], 0
je 0x440b96
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], 0
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x43f886
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x43f871
dec eax
push eax
lea edx, [ebp - 0x14c]
push edx
lea edi, [ebp - 0x148]
push edi
lea ecx, [ebp - 0x18]
push ecx
lea esi, [ebp - 0x1c]
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x140]
push ecx
call dword [ebx + 0x68]
mov dword [ebp - 0x168], eax
add esp, 0x24
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
jmp 0x43f8fe
push dword [ebx + 0xa8]
call fcn.0047dd40
mov dword [ebp - 0x168], eax
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe4], eax
mov edx, dword [ebx + 0xa8]
mov dword [ecx + 0x180], edx
jmp 0x43f8fe
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0xffffffff
je 0x4412e6
cmp dword [ebx + 0xa4], 0
jne 0x43fa35
mov eax, dword [ebp - 4]
cmp dword [0x50b764], 0
mov dword [eax + 0x180], 0xffffffff
je 0x43fa35
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x43fa35
cmp dword [ebp - 0x28], 0
je 0x43f9bd
mov edx, dword [ebp - 4]
test byte [edx + 0x178], 2
jne 0x43f966
test al, 4
je 0x43f96d
movzx ecx, byte [edx + 0x172]
test ecx, 0x80
je 0x43f96d
mov edx, 0x8000
jmp 0x43f96f
xor edx, edx
mov ecx, dword [ebp - 0x24]
test ecx, 0xc0000000
je 0x43f97f
or edx, 2
jmp 0x43f98e
mov esi, edx
or esi, 1
test ecx, 0x40000000
je 0x43f98e
mov edx, esi
cmp dword [ebx + 0x78], 1
je 0x43f998
test al, 1
je 0x43f99b
or edx, 8
push edx
push dword [ebp - 0x168]
call fcn.0047ded0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x180], eax
mov eax, dword [0x50cc40]
jmp 0x43fa3a
cmp dword [0x50cc40], 0
jne 0x43fa3e
cmp dword [ebp - 0x144], 1
je 0x43fa19
cmp dword [ebp - 0x144], 0
jne 0x43f9f4
call fcn.00474470
push eax
call fcn.0047e200
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x43fa77
cmp dword [ebp - 0x144], 2
jne 0x43fa77
call fcn.00474470
add eax, 0x40
push eax
call fcn.0047e200
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x43fa77
call fcn.00474470
add eax, 0x20
push eax
call fcn.0047e200
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x43fa77
mov eax, dword [0x50cc40]
test eax, eax
je 0x43fa68
test dword [ebp - 0x144], 0xfffffffe
je 0x43fa5c
cmp dword [ebp - 0x144], 0xfffffffa
je 0x43fa5c
cmp dword [ebp - 0x144], 2
jne 0x43fa68
mov dword [ebp - 0x168], 2
jmp 0x43fa89
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x15e]
test eax, eax
jne 0x43fbba
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15c], 1
je 0x440bc7
movzx edx, byte [eax + 0x171]
and edx, 6
shr edx, 1
test edx, edx
je 0x43fb52
mov ecx, dword [eax + 0x100]
add ecx, 2
cmp ecx, 0x20
jae 0x43fb52
mov eax, 1
shl eax, cl
test eax, 0x103
je 0x43fb52
cmp edx, 1
je 0x43fb32
cmp edx, 2
jne 0x43fb0c
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 2
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
inc dword [eax + 0xf8]
jmp 0x43fbee
cmp edx, 3
jne case.default.0x43e94b
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 3
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
jmp 0x43fbee
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 1
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
inc dword [eax + 0xf8]
jmp 0x43fbae
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x170]
test cl, 4
movzx edx, byte [eax + 0x172]
je 0x43fb8e
cmp dword [eax + 0x13c], 1
je 0x43fba1
test dl, 0x40
je 0x43fb7f
cmp dword [ebp - 0x168], 2
je 0x43fba1
mov byte [eax + 0x15e], 2
inc dword [eax + 0xf8]
jmp 0x43fbee
test dl, 0x40
je 0x43fb7f
cmp dword [ebp - 0x168], 2
jne 0x43fb7f
test cl, 1
je 0x43fb7f
mov byte [eax + 0x15e], 1
inc dword [eax + 0xf8]
mov eax, dword [ebp - 4]
add dword [eax + 0xf8], 5
jmp 0x43fbee
mov edx, dword [ebp - 4]
cmp eax, 3
movzx ecx, byte [edx + 0x170]
movzx edx, byte [edx + 0x172]
je 0x43fbee
mov esi, dword [ebp - 4]
movsx edi, byte [esi + 0x15c]
cmp edi, 1
je 0x43fbe5
inc dword [esi + 0xf8]
cmp eax, 1
je 0x4412d8
test cl, 1
je 0x43fc0e
mov eax, dword [ebp - 4]
test byte [eax + 0x173], 8
je 0x43fc0e
cmp byte [eax + 0x15d], 2
jne 0x43fc0e
inc dword [eax + 0xf8]
test cl, 4
je 0x43fc32
mov eax, dword [ebp - 4]
and edx, 0x40
shr edx, 6
test byte [eax + 0x173], 8
je 0x43fc38
test edx, edx
je 0x43fc38
add dword [eax + 0xf8], 2
jmp 0x43fc38
and edx, 0x40
shr edx, 6
cmp dword [ebp - 0x168], 1
jne 0x43fc50
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x174]
or eax, 8
jmp 0x43fc5d
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x174]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
test edx, edx
mov byte [ecx + 0x174], al
je 0x43fd3f
push dword [ebp - 4]
call fcn.00428500
add esp, 4
test eax, eax
jne 0x43e3f9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
test eax, eax
je 0x43fd3f
cmp byte [eax + 0x1e], 0
je 0x43fd3f
mov esi, dword [eax + 0xc]
movzx eax, byte [esi + 0x175]
test al, 0x40
je 0x43fcb4
cmp byte [esi + 0x15e], 1
je 0x440c00
push esi
call fcn.00429e20
add esp, 4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
test edx, edx
je 0x43fccb
mov byte [edx + 0x1e], 0
test eax, eax
je 0x43fd2a
mov edx, dword [esi + 0x18]
test edx, edx
je 0x440c37
test byte [edx + 0x44], 2
je 0x43fd05
mov dword [edx + 0x38], eax
mov edx, dword [esi + 0x18]
mov dword [edx + 0x3c], eax
mov edx, dword [esi + 0x64]
test edx, edx
je 0x43fcf8
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x64], ecx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push eax
movzx edx, byte [esi + 0x174]
push eax
and edx, 7
push edx
push 0xffffffffffffffff
push esi
call fcn.0042e140
add esp, 0x14
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
add dword [esi + 0x98], 1
adc dword [esi + 0x9c], 0
and byte [esi + 0x177], 0xfb
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
je 0x43fd6b
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
jne 0x43fd6b
mov eax, 0x33
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 0
je 0x4406d9
cmp dword [ebx + 0x58], 5
je 0x441193
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x4406c8
cmp eax, 2
je 0x4406c8
cmp eax, 3
jne 0x43fdcb
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov byte [edx + 0x173], al
mov dword [edx + 0x98], 1
mov dword [edx + 0x9c], 0
jmp 0x4406d9
cmp eax, 1
jne 0x43ffab
cmp dword [ebx + 0x58], 5
je 0x441169
mov eax, dword [ebp - 4]
test byte [eax + 0x174], 8
jne 0x43fdf6
movzx eax, byte [eax + 0x173]
jmp 0x4406d9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, eax
mov eax, dword [esi + 0xe4]
call fcn.004419a0
mov dword [ebp - 0x168], eax
add esp, 0x10
mov eax, 0xffffffff
mov ecx, edx
mov esi, dword [ebp - 0x168]
sub ecx, eax
sub esi, eax
or esi, ecx
je 0x441123
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x168]
movzx eax, byte [esi + 0x173]
and byte [esi + 0x177], 0xfb
and eax, 0xfffffffe
mov dword [esi + 0x98], 0x80000000
mov dword [esi + 0x9c], 0xffffffff
mov byte [esi + 0x173], al
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], edx
cmp dword [esi + 0x13c], 5
je 0x4406d9
mov eax, esi
movsx edx, byte [eax + 0x15c]
lea eax, [edx - 1]
cmp eax, 7
ja case.default.0x43fe99
jmp dword [eax*4 + 0x4e7a5c]
cmp edx, 7
je 0x440e2f
cmp edx, 5
je 0x440dfc
mov dword [ebp - 0x164], 3
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.00441a00
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov esi, dword [ebp - 0x164]
neg esi
mov dword [esp + 4], esi
mov dword [esp + 8], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xe4]
call fcn.004419a0
mov dword [ebp - 0x160], eax
add esp, 0x10
mov eax, 0xffffffff
mov ecx, edx
mov edi, dword [ebp - 0x160]
sub ecx, eax
sub edi, eax
or edi, ecx
je 0x440020
mov ecx, dword [ebp - 0x15c]
sub ecx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x168]
sbb eax, edx
neg ecx
neg eax
xor edx, edx
add ecx, dword [ebp - 0x164]
add eax, edx
or ecx, eax
jne 0x440020
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x43ff62
cmp dword [ebx + 0x68], 0
je 0x440c51
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x164]
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x440ddb
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x154]
jne 0x43ffba
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x4406d9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x4406d9
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.00441a00
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov dword [esp + 4], 0xfffffffc
mov dword [esp + 8], 0xffffffff
mov ecx, esi
mov eax, dword [ecx + 0xe4]
call fcn.004419a0
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x4400f4
mov esi, dword [ebp - 0x164]
mov ecx, 4
sub esi, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
sub esi, ecx
or esi, eax
je 0x44015a
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x4406d9
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x440170
cmp dword [ebx + 0x68], 0
je 0x440e4d
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push 4
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x440ddb
cmp dword [ebp - 0x154], 4
jne 0x4401ce
movzx eax, byte [ebp - 0x15f]
shl eax, 8
movzx edx, byte [ebp - 0x160]
or edx, eax
cmp edx, 1
je 0x440ef2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x4406d9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x4406d9
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.00441a00
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov dword [esp + 4], 0xfffffff7
mov dword [esp + 8], 0xffffffff
mov ecx, esi
mov eax, dword [ecx + 0xe4]
call fcn.004419a0
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x4403c3
mov ecx, dword [ebp - 0x164]
sub ecx, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
mov edx, 9
sub ecx, edx
or ecx, eax
jne 0x4403c3
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x4402c0
cmp dword [ebx + 0x68], 0
je 0x440f53
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push 9
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x440ddb
cmp dword [ebp - 0x154], 9
jne 0x44035d
mov eax, dword [ebp - 4]
movzx esi, byte [ebp - 0x15b]
movzx edx, byte [ebp - 0x15a]
movzx ecx, byte [ebp - 0x159]
movzx edi, byte [ebp - 0x158]
test byte [eax + 0x175], 0x20
je 0x44032c
shl ecx, 8
shl edx, 0x10
or edi, ecx
shl esi, 0x18
or edi, edx
or edi, esi
jmp 0x44033b
shl edx, 8
shl ecx, 0x10
or esi, edx
shl edi, 0x18
or esi, ecx
or edi, esi
cmp edi, 1
jne 0x43fdea
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x4406d9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x4406d9
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.00441a00
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
mov edi, esi
xor ecx, ecx
add esp, 0xfffffff4
xor esi, esi
mov edx, 1
sub esi, dword [edi + 0xf8]
mov eax, dword [edi + 0xe4]
mov dword [esp + 4], esi
sbb ecx, 0
mov dword [esp + 8], ecx
call fcn.004419a0
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x4404a8
mov ecx, dword [ebp - 0x164]
sub ecx, eax
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x168]
sbb eax, edx
neg ecx
neg eax
xor edx, edx
mov esi, dword [esi + 0xf8]
add ecx, esi
add eax, edx
or ecx, eax
je 0x44050e
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x4406d9
lea eax, [ebp - 0x164]
push eax
push 0
push esi
call fcn.00428c60
add esp, 0xc
test eax, eax
jne 0x43e3f9
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x44053e
cmp dword [ebx + 0x68], 0
je 0x441030
mov edx, eax
lea eax, [ebp - 0x154]
push 0
push eax
push dword [edx + 0xf8]
push dword [ebp - 0x164]
push dword [edx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x440ddb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
cmp eax, dword [ebp - 0x154]
jne 0x44062e
mov edx, dword [ebp - 4]
movzx ecx, byte [edx + 0x172]
test ecx, 0x80
jne 0x4405a3
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
push 0xe2c
push str.for_nt_open_proc.c
push 2
push 8
call fcn.004220a0
add esp, 0x10
mov eax, esi
movzx eax, byte [eax + 0x173]
jmp 0x4406d9
mov eax, dword [ebp - 4]
or byte [eax + 0x177], 4
movzx eax, byte [eax + 0x173]
test al, 1
je 0x44078c
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
je 0x4407b9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov eax, esi
cmp dword [eax + 0x13c], 7
jne 0x440764
add esp, 0xfffffff0
mov ecx, 0xffffffff
mov edx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov eax, dword [esi + 0xe4]
call fcn.004419a0
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x440d7a
mov eax, esi
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x177], 0xfb
movzx eax, byte [eax + 0x173]
test al, 1
jne 0x4407b9
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
je 0x4407b9
test byte [edx + 0x170], 4
je 0x4407a5
test al, 8
jne 0x4407b9
test byte [edx + 0x172], 0x40
jne 0x4407b2
test al, 4
jne 0x4407b9
or byte [edx + 0x175], 8
test eax, 0x80
jne 0x4407d2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf8]
mov word [edx + 0x158], ax
jmp 0x440809
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 1
je 0x44129f
test byte [eax + 0x170], 4
je 0x4407fb
mov edx, eax
mov eax, 0x4f
mov word [edx + 0x158], ax
jmp 0x440809
mov edx, eax
mov eax, 0x50
mov word [edx + 0x158], ax
mov edx, dword [ebx + 0x14]
test edx, edx
jle 0x441260
mov ecx, dword [ebp - 4]
mov esi, dword [ebx + 0x10]
movzx ecx, byte [ecx + 0x170]
and ecx, 4
shr ecx, 2
test ecx, ecx
je 0x44083a
cmp esi, 0x7ffffe00
jle 0x44083a
mov esi, 0x7ffffe00
jmp 0x440842
test esi, esi
jle 0x441214
add esi, 0x1ff
and esi, 0xfffffe00
mov dword [ebx + 0x10], esi
mov ecx, dword [ebp - 4]
test byte [ecx + 0x173], 8
je 0x4408ba
mov edx, ecx
test byte [edx + 0x170], 4
je 0x44087a
movzx edx, byte [ecx + 0x179]
and edx, 0xffffffbf
mov byte [ecx + 0x179], dl
jmp 0x440881
movzx edx, byte [edx + 0x179]
test dl, 0x40
mov ecx, dword [ecx + 0xf8]
je 0x4408b4
cmp esi, ecx
jae 0x440894
mov eax, ecx
mov esi, ecx
jmp 0x4408ce
imul edx, esi
mov ecx, dword [ecx + 0xf8]
lea eax, [ecx + 4]
cmp eax, edx
ja 0x4408cc
mov eax, edx
mov esi, eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x172]
test edx, 0x80
je 0x4408fa
mov edi, dword [ebp - 4]
cmp byte [edi + 0x15c], 3
je 0x4411dd
mov eax, dword [ebp - 4]
mov dword [eax + 0xec], esi
mov ecx, dword [ebp - 4]
test dl, 0x40
mov eax, dword [ebx + 0x10]
mov dword [ecx + 0x140], eax
je 0x4409bd
mov eax, 0x234
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23f
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x440aea
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x440b0d
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x440b30
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23c
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x440b53
mov eax, 0x30
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x58], 0
jne 0x43e3a7
mov dword [ebx + 0x58], 3
jmp 0x43e3a7
push esi
call fcn.0047d870
add esp, 4
cmp eax, ebx
jne 0x43ebe4
mov edi, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x160]
or dword [ebp - 0x18], 0x8000000
jmp 0x43ec0c
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
jmp 0x43f8fe
movzx ecx, byte [eax + 0x170]
test cl, 4
movzx edx, byte [eax + 0x172]
je 0x440bf4
test byte [eax + 0x173], 8
je 0x440bf4
test dl, 0x40
je 0x440bf4
mov byte [eax + 0x15e], 2
jmp 0x43fbee
mov byte [eax + 0x15e], 3
jmp 0x43fbee
mov ecx, dword [esi + 0x38]
movsx edx, byte [ecx + 5]
cmp edx, 0x20
je 0x440c2a
cmp edx, 0x2b
jne 0x440c1c
mov byte [ecx + 5], 0
movzx eax, byte [esi + 0x175]
and eax, 0xffffffbf
mov byte [esi + 0x175], al
jmp 0x43fcb4
mov byte [ecx + 5], 0x24
movzx eax, byte [esi + 0x175]
jmp 0x440c1c
push esi
push eax
push eax
push 1
call fcn.0041fff0
add esp, 0x10
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x440cf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x1e
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, esi
movsx eax, byte [eax + 0x15e]
cmp eax, 3
je 0x440e20
xor edx, edx
cmp eax, 2
setne dl
add edx, 2
mov dword [ebp - 0x164], edx
jmp 0x43febc
mov dword [ebp - 0x164], 1
jmp 0x43febc
mov eax, esi
cmp byte [eax + 0x15e], 3
jne 0x43feb2
mov dword [ebp - 0x164], 2
jmp 0x43febc
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x440ddb
add esp, 0xfffffff0
mov edx, 1
mov dword [esp + 4], 0xfffffffc
mov dword [esp + 8], 0xffffffff
call fcn.004419a0
add esp, 0x10
push 0
lea eax, [ebp - 0x154]
push eax
push 4
lea edx, [ebp - 0x160]
push edx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.004419a0
add esp, 0x10
jmp 0x440192
cmp byte [ebp - 0x15e], 0x1a
je 0x440f0a
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x440ddb
add esp, 0xfffffff0
mov eax, edi
mov edx, 2
mov dword [esp + 4], 0xfffffff7
mov dword [esp + 8], 0xffffffff
call fcn.004419a0
add esp, 0x10
push 0
lea eax, [ebp - 0x154]
push eax
push 9
lea edx, [ebp - 0x160]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.004419a0
add esp, 0x10
jmp 0x4402e2
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x440ddb
mov ecx, dword [ebp - 4]
xor esi, esi
add esp, 0xfffffff0
xor edi, edi
mov edx, 2
sub edi, dword [ecx + 0xf8]
mov dword [esp + 4], edi
sbb esi, 0
mov dword [esp + 8], esi
call fcn.004419a0
add esp, 0x10
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
push 0
push eax
push dword [edx + 0xf8]
push dword [ebp - 0x164]
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.004419a0
add esp, 0x10
jmp 0x440563
mov edx, dword [ebp - 4]
push eax
mov eax, dword [edx + 0xe4]
call fcn.00441a00
add esp, 4
or eax, edx
jne 0x441148
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x4406d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x177], 0xfb
movzx eax, byte [eax + 0x173]
jmp 0x4406d9
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4411b5
mov eax, dword [ebp - 4]
and byte [eax + 0x175], 0xf7
jmp 0x43fd7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x26
mov edi, dword [ebp - 0x10]
and byte [edx + 0x175], 0xf7
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x441221
mov dword [ebx + 0x10], 0x400
jmp 0x44123c
mov esi, dword [0x50abcc]
cmp esi, 0xfffffffe
je 0x44124e
test esi, esi
je 0x441235
cmp esi, 0xffffffff
jne 0x441246
mov dword [ebx + 0x10], 0x20000
mov esi, 0x2000
jmp 0x440851
mov dword [ebx + 0x10], esi
jmp 0x440851
mov eax, 0x6a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x50abd0]
cmp edx, 0xfffffffe
je 0x44128d
test edx, edx
je 0x441274
cmp edx, 0xffffffff
jne 0x441285
mov dword [ebx + 0x14], 1
mov edx, 1
jmp 0x440814
mov dword [ebx + 0x14], edx
jmp 0x440814
mov eax, 0x6b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test byte [eax + 0x170], 4
je 0x4412af
mov edx, 0x50
jmp 0x4412b4
mov edx, 0x51
cmp byte [eax + 0x15c], 1
je 0x4412cc
add edx, 4
mov word [eax + 0x158], dx
jmp 0x440809
mov word [eax + 0x158], dx
jmp 0x440809
cmp edi, 1
jne 0x43fbae
jmp 0x43fbee
cmp dword [ebx + 0xa4], 0
je 0x4413d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.0047e2f0
mov dword [eax], ebx
cmp ebx, 2
jge 0x4413a7
cmp ebx, 0x7b
je 0x4418ec
cmp ebx, 0xa1
je 0x4418ec
cmp ebx, 0xce
je 0x4418ec
cmp ebx, 0xb7
je 0x441957
cmp ebx, 0x50
je 0x441957
cmp ebx, 0x13
je 0x4418fe
cmp ebx, 5
je 0x4418fe
cmp ebx, 0x14
je 0x441395
cmp ebx, 0xf
je 0x441395
cmp ebx, 4
jne 0x44137a
mov edx, dword [ebp - 4]
mov eax, 0x25b
test byte [edx + 0x170], 0x20
jne 0x441388
mov eax, 0x1e
jmp 0x441388
mov eax, dword [ebp - 4]
mov dword [eax + 0xe8], ebx
mov eax, 0x1e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x2a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp ebx, 3
jg 0x44130b
mov edx, dword [ebp - 4]
mov eax, 0x25a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x4413cf
mov eax, 0x1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x4413ec
test byte [eax + 0x171], 0x40
je 0x4412f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
cmp eax, 0x13
movzx edx, byte [edx + 0x170]
je 0x44140f
cmp eax, 5
je 0x44140f
test dl, 4
je 0x441490
test dl, 1
jne 0x441490
cmp dword [ebp - 0x158], 0
je 0x441490
mov edx, dword [ebp - 4]
test byte [edx + 0x171], 0x40
jne 0x441490
test byte [edx + 0x176], 1
jne 0x441490
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
push dword [ebp - 0x20]
or edx, 0x80000000
push edx
mov dword [ebp - 0x24], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x168]
cmp edx, 0xffffffff
mov dword [eax + 0xe4], edx
je 0x441560
or byte [eax + 0x171], 0x40
or byte [eax + 0x177], 0x10
jmp 0x44154e
cmp eax, 0x20
jne 0x44153f
cmp dword [ebp - 0x164], 0
je 0x44153f
cmp dword [ebp - 0x158], 0
jne 0x4414cc
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x4414cc
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
jmp 0x44154e
xor eax, eax
lea esi, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
and ecx, 0x3fffffff
or edx, 2
or ecx, 0x80000000
push edx
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x168]
cmp edx, 0xffffffff
mov dword [eax + 0xe4], edx
je 0x4412f3
or byte [eax + 0x171], 0x40
or byte [eax + 0x177], 0x10
or byte [eax + 0x172], 1
or byte [eax + 0x178], 4
jmp 0x43f90b
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0xffffffff
je 0x4412f3
jmp 0x43f90b
test byte [eax + 0x170], 4
je 0x44147d
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
push dword [ebp - 0x20]
or edx, 0x40000000
push edx
mov dword [ebp - 0x24], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
or byte [edx + 0x176], 1
jmp 0x44154e
test ecx, ecx
je 0x43f833
cmp dword [ebp - 0x144], 0xfffffffa
jne 0x43f833
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], 0
or byte [eax + 0x178], 0x80
cmp dword [ebx + 0x84], 0
je 0x4415f3
cmp dword [ebx + 0x88], 0
jne 0x4415f3
and byte [eax + 0x179], 0xfe
jmp 0x4415fa
or byte [eax + 0x179], 1
mov eax, dword [ebp - 0x168]
test eax, eax
lea edx, [ebp - 0x150]
jne 0x44160f
mov eax, 0x100
push edx
push 0
mov dword [ebp - 0x168], eax
lea ecx, [eax + 1]
push ecx
call fcn.00428c60
add esp, 0xc
test eax, eax
jne 0x43e3f9
cmp dword [ebx + 0x98], 0
jne 0x441653
mov eax, dword [ebp - 4]
push dword [eax + 0x100]
push str.Unit__i
push dword [ebp - 0x150]
call fcn.00473670
add esp, 0xc
jmp 0x44167d
push dword [ebp - 0x168]
push dword [ebx + 0x94]
push dword [ebp - 0x150]
call fcn.00473380
add esp, 0xc
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x168]
mov byte [eax + edx], 0
push dword [ebp - 0x150]
call fcn.004ca6e0
add esp, 4
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [edx + 0xe4], eax
je 0x44197a
test byte [edx + 0x179], 1
je 0x4416d6
push eax
call fcn.004ca7a0
add esp, 4
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call fcn.004ca720
add esp, 4
test eax, eax
jne 0x4416d6
mov eax, 0x28e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x150]
call fcn.00428d20
add esp, 4
test eax, eax
je 0x43f833
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax + 0x15a]
cmp edx, 4
jge 0x441747
push dword [eax + 0x60]
call fcn.00428d20
add esp, 4
test eax, eax
je 0x441724
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x154]
push 0
push 5
call fcn.00428c60
add esp, 0xc
test eax, eax
je 0x441747
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x13c], 0
mov dword [ebp - 0x140], 0x314d4f43
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x441764
mov edx, dword [ebp - 4]
mov eax, 4
mov ecx, dword [0x50cc40]
mov word [edx + 0x15a], ax
jmp 0x4415b2
test eax, eax
jne 0x4417a4
push str.USER
lea eax, [ebp - 0x140]
push eax
call fcn.004764c0
add esp, 8
test eax, eax
je 0x4417b3
mov dword [ebp - 0x168], 0
jmp 0x43f5ee
mov dword [ebp - 0x140], 0x4e4f43
mov eax, esi
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4417c8
mov edx, dword [ebp - 4]
mov eax, 3
mov dword [ebp - 0x168], 0
mov word [edx + 0x15a], ax
jmp 0x43f5ee
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x43ede1
mov edx, eax
movzx eax, byte [edx + 0x173]
and eax, 0xffffffdf
mov byte [edx + 0x173], al
jmp 0x43edf4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 3
je 0x43ed56
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 0x10
je 0x43eaf1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 3
mov ecx, 3
jmp 0x43eb00
mov edx, ecx
test byte [edx + 0x170], 4
je 0x441889
test byte [edx + 0x173], 8
je 0x441889
test byte [edx + 0x172], 0x40
je 0x441889
mov byte [edx + 0x15e], 2
jmp 0x43ea3d
movsx edx, al
cmp edx, 4
je 0x4418ce
cmp edx, 1
je 0x4418ce
movzx esi, byte [ecx + 0x172]
test esi, 0x80
jne 0x4418ce
movzx ecx, byte [ecx + 0x178]
test cl, 1
jne 0x4418ce
test cl, 2
jne 0x4418ce
test esi, 0x40
je 0x43ea3d
add edx, 0xfffffffb
cmp edx, 3
ja 0x43ea3d
mov edx, dword [ebp - 4]
mov byte [edx + 0x15e], 3
jmp 0x43ea3d
mov dword [ebp - 0x158], 1
jmp 0x43e59b
mov eax, 0x2b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x258
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x44191d
mov eax, 9
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x63
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x25
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x259
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x441976
mov eax, 0xa
mov esp, ebp
pop ebp
ret
mov eax, 0x258
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x441996
mov eax, 9
mov esp, ebp
pop ebp
ret