Function at 0x11cd44a0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x11fa1e9b
push eax
mov eax, 0x1620
mov dword fs:[0], esp
call fcn.11e689f0
mov eax, dword [esp + 0x1634]
push ebx
mov ebx, dword [esp + 0x1640]
push ebp
push esi
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x38], ecx
je 0x11cda82c
cmp ebx, esi
je 0x11cda82c
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x11cda82c
cmp word [eax], si
je 0x11cda82c
mov eax, dword [eax + 4]
cmp eax, esi
je 0x11cda82c
cmp word [eax], si
je 0x11cda82c
push 0xffffffffffffffdd
lea ecx, [esp + 0x54]
call fcn.11e15fa0
mov edx, dword [esp + 0x166c]
mov edi, dword [esp + 0x1660]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x120]
push eax
mov eax, dword [esp + 0x166c]
push ecx
mov ecx, dword [esp + 0x166c]
push edx
mov edx, dword [esp + 0x1668]
push eax
mov eax, dword [esp + 0x1668]
mov ebp, dword [esp + 0x1650]
push ecx
mov ecx, dword [esp + 0x1668]
push edi
push edx
mov edx, dword [esp + 0x166c]
push eax
mov eax, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
push ebx
push eax
push ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x166c], esi
push ebp
mov dword [esp + 0x158], esi
call fcn.11d19fc0
test eax, eax
je 0x11cd45a7
mov esi, dword [esp + 0x120]
jmp 0x11cd9cc6
push esi
push esi
push esi
mov ecx, 0x1212b5c0
mov dword [esp + 0x80], esi
call fcn.11d60760
test eax, eax
jne 0x11cd46a8
lea edx, [esp + 0x74]
push edx
push 0x12118e98
call fcn.11c92320
add esp, 8
test eax, eax
jne 0x11cd46a8
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
je 0x11cd4647
mov eax, dword [esp + 0x1664]
mov ecx, dword [esp + 0x38]
push eax
push ebx
call fcn.11d1aeb0
test eax, eax
je 0x11cd4647
cmp dword [0x12133f80], esi
je 0x11cd462a
mov ecx, dword [esp + 0x1664]
push ecx
push 0x245
push str.CSafeDoc::OnNtCreateFile_line__lu___0x_x__forbid_oplock
push str.Oplock
push 4
call fcn.11ca5810
add esp, 0x14
mov edx, dword [esp + 0x1644]
mov dword [edx], 0xffffffff
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8bfc
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
lea eax, [esp + 0x50]
push eax
mov eax, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push edi
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push ebx
push edx
push eax
push ebp
mov ecx, 0x1212ae38
call fcn.11d20fd0
mov esi, eax
jmp 0x11cd9cc6
push esi
mov ecx, 0x1212b5c0
call fcn.11d88cd0
test eax, eax
je 0x11cd4832
push esi
push esi
push esi
mov ecx, 0x1212b5c0
call fcn.11d60760
test eax, eax
jne 0x11cd46de
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd4832
lea ecx, [esp + 0x50]
call fcn.11e16060
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x1c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push esi
call fcn.11e15b00
mov eax, dword [esp + 0x34]
add esp, 0x10
test eax, eax
je 0x11cd47ae
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebp + 0x1c], ecx
mov ecx, dword [esp + 0x166c]
mov dword [ebp + 0x24], edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
mov edi, dword [ebp + 0xc]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push ebx
push ecx
push edx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0xc], edi
mov ebp, dword [ebp + 0x14]
jmp 0x11cd6b9f
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x11cd482a
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1660]
push eax
mov eax, dword [esp + 0x1660]
push ecx
mov ecx, dword [esp + 0x1660]
push edi
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1660]
push ecx
mov ecx, dword [esp + 0x1660]
push edx
push ebx
push eax
push ecx
call esi
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd482a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov ebp, dword [ebp + 0x14]
jmp 0x11cd6b9f
push esi
push esi
push esi
mov ecx, 0x1212b5c0
call fcn.11d60760
test eax, eax
je 0x11cd4863
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
je 0x11cd4863
lea edx, [esp + 0x74]
push edx
push 0x12118e98
call fcn.11c92320
add esp, 8
push 2
lea ecx, [esp + 0x68]
call fcn.11e15fa0
xor esi, esi
mov byte [esp + 0x1638], 1
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a6]
mov word [esp + 0x1a4], si
rep stosd dword es:[edi], eax
mov ecx, 0x1212b5c0
stosw word es:[edi], ax
call fcn.11d86270
push 0xffffffffffffffff
lea ecx, [esp + 0x80]
mov dword [esp + 0x24], eax
call fcn.11e15fa0
mov ecx, 0x1212b5c0
mov byte [esp + 0x1638], 2
call fcn.11d943c0
test eax, eax
jne 0x11cd48d6
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd4c33
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x18]
push 1
push eax
push ebx
mov dword [esp + 0x24], esi
call fcn.11d1ade0
cmp eax, esi
jne 0x11cd4c33
mov eax, dword [ebx + 8]
xor ecx, ecx
mov cx, word [eax]
mov edx, dword [eax + 4]
shr ecx, 1
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.11e7ee90
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x1a4]
mov byte [esp + 0x1638], 3
mov edx, dword [ebx + 4]
push 0x104
push eax
push ecx
push edx
call fcn.11dba850
add esp, 0x10
cmp word [esp + 0x1a4], si
je 0x11cd4d07
lea eax, [esp + 0x1a4]
mov ecx, 0x1212b5c0
push eax
call fcn.11d9bb70
test eax, eax
je 0x11cd4d31
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x78], esi
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], esi
call fcn.11e7eae0
mov ecx, 0x1212b5c0
mov byte [esp + 0x1638], 4
call fcn.11d94670
lea ecx, [esp + 0x4c]
mov edi, eax
call fcn.11e923e0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1638], 5
call fcn.11e923e0
cmp edi, esi
mov byte [esp + 0x1638], 6
je 0x11cd49b9
call fcn.11e5b370
test eax, eax
jne 0x11cd4bef
push esi
mov ecx, 0x1212b5c0
xor edi, edi
call fcn.11d87b70
test eax, eax
je 0x11cd4a00
call fcn.11de3e90
test eax, eax
jne 0x11cd4a00
mov eax, dword [0x12133f80]
mov edi, 1
cmp eax, esi
je 0x11cd4a00
mov edx, dword [esp + 0x1c]
mov eax, dword [0x12126854]
push edx
push eax
push str.__s__CSafeDoc::OnNtCreateFile:_smart_pro_had_not_visited_ProctectIP__can_not_transform_File__s_
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x1c]
push eax
call fcn.11e5b800
add esp, 4
cmp edi, esi
jne 0x11cd4bef
cmp eax, esi
jne 0x11cd4bef
call fcn.11e5b490
test eax, eax
jne 0x11cd4bef
mov ecx, dword [esp + 0x1c]
push 1
push esi
push ecx
call fcn.11e5bb20
add esp, 0xc
test eax, eax
je 0x11cd4bef
mov edx, dword [esp + 0x1c]
push edx
call fcn.11e5d180
add esp, 4
cmp eax, esi
je 0x11cd4a90
mov eax, dword [0x12133f80]
xor edi, edi
cmp eax, esi
mov dword [esp + 0x78], 0x33
mov dword [esp + 0x30], 5
je 0x11cd4b7a
mov eax, dword [esp + 0x1c]
push eax
push str.CSafeDoc::OnNtCreateFile_Path__s__will_not_transform_GSDES_backup_file_
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x10
jmp 0x11cd4b7a
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x4c]
push ecx
push edx
push eax
mov ecx, 0x1212b5c0
call fcn.11d70140
test eax, eax
jne 0x11cd4abf
lea ecx, [esp + 0x4c]
call fcn.11e928f0
lea ecx, [esp + 0x5c]
call fcn.11e928f0
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ecx
mov ecx, 0x1212b5c0
call fcn.11d6a700
test eax, eax
jne 0x11cd4b1c
mov edx, dword [esp + 0x1c]
push esi
push esi
push esi
push edx
mov ecx, 0x1212b5c0
call fcn.11d70510
test eax, eax
jne 0x11cd4b1c
mov eax, dword [esp + 0x1c]
mov ecx, 0x1212b5c0
push eax
call fcn.11d9b7f0
test eax, eax
jne 0x11cd4b15
mov ecx, dword [esp + 0x1c]
push esi
push 1
push esi
push esi
push ecx
mov ecx, 0x1212b5c0
call fcn.11d6cfd0
test eax, eax
je 0x11cd4b1c
mov edi, 1
jmp 0x11cd4b1e
xor edi, edi
lea ecx, [esp + 0x5c]
call fcn.11e925e0
push eax
lea ecx, [esp + 0x60]
call fcn.11e92d00
push eax
push edi
push esi
lea ecx, [esp + 0x5c]
call fcn.11e925e0
push eax
lea ecx, [esp + 0x60]
call fcn.11e92d00
push eax
lea edx, [esp + 0x48]
lea eax, [esp + 0x90]
push edx
push eax
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x6c], esp
push edx
call fcn.11e7e880
mov ecx, 0x12132fc4
mov byte [esp + 0x165c], 6
call fcn.11e5f390
mov edi, eax
push str._File_Transform_
lea ecx, [esp + 0x48]
call fcn.11e7eae0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x44]
push eax
mov byte [esp + 0x163c], 8
call fcn.11e7ff30
cmp edi, esi
je 0x11cd4d5b
lea ecx, [esp + 0x4c]
call fcn.11e925e0
lea ecx, [esp + 0x4c]
call fcn.11e92ce0
lea ecx, [esp + 0x5c]
mov edi, eax
call fcn.11e925e0
lea ecx, [esp + 0x5c]
call fcn.11e92ce0
mov ecx, dword [esp + 0x44]
push eax
push edi
push esi
push ecx
mov ecx, 0x1212b560
call fcn.11dee5b0
lea ecx, [esp + 0x44]
mov byte [esp + 0x1638], 6
call fcn.11e7f280
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1638], 5
call fcn.11e92540
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1638], 4
call fcn.11e92540
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1638], 3
call fcn.11e7f280
lea ecx, [esp + 0x28]
mov byte [esp + 0x1638], 2
call fcn.11e7f280
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 1
call fcn.11e15fd0
cmp dword [esp + 0x20], esi
je 0x11cd4f17
lea ecx, [esp + 0x18]
push esi
push ecx
mov ecx, dword [esp + 0x40]
push ebx
mov dword [esp + 0x24], esi
call fcn.11d1ade0
cmp eax, esi
jne 0x11cd4f17
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [esp + 0x44]
mov dx, word [eax]
mov eax, dword [eax + 4]
shr edx, 1
push edx
push eax
call fcn.11e7ee90
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x1638], 0xb
mov eax, dword [ebx + 4]
push 0x104
push ecx
push edx
push eax
call fcn.11dba850
add esp, 0x10
cmp word [esp + 0x1a4], si
je 0x11cd4ee5
lea ecx, [esp + 0x1a4]
push ecx
mov ecx, 0x1212ade0
call fcn.11cd2c70
mov edi, eax
cmp edi, esi
jne 0x11cd504f
lea edx, [esp + 0x1a4]
push edx
call fcn.11df9a50
add esp, 4
test eax, eax
jne 0x11cd5099
lea eax, [esp + 0x1a4]
push eax
call fcn.11cbba30
add esp, 4
test eax, eax
jne 0x11cd5101
jmp 0x11cd4f06
cmp dword [0x12133f80], esi
je 0x11cd4c22
push 0x27e
push str._CSafeDoc::OnNtCreateFile__Line:_d__File_name_is_empty.
push str.SDTransform
push 4
call fcn.11ca5810
add esp, 0x10
jmp 0x11cd4c22
cmp dword [0x12133f80], esi
je 0x11cd4c22
push 0x285
push str._CSafeDoc::SDFileTransform__Line:_d__The_file_path_is_not_a_local_or_network_path.
push str.SDTransform
push 4
call fcn.11ca5810
add esp, 0x10
jmp 0x11cd4c22
cmp dword [0x12133f80], esi
je 0x11cd4d77
push str.SDTransform_fail_AddFailLog____10
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0xc
push str._File_Transform:failed_
lea ecx, [esp + 0x24]
call fcn.11e7eae0
lea edx, [esp + 0x1c]
mov bl, 9
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x163c], bl
call fcn.11e7ff30
mov eax, dword [esp + 0x20]
mov ecx, 0x1212b560
push eax
call fcn.11dee590
lea ecx, [esp + 0x124]
call fcn.11e8af10
mov ecx, 0x1212b458
mov byte [esp + 0x1638], 0xa
call fcn.11ec4670
mov ecx, dword [esp + 0x128]
push eax
push ecx
lea ecx, [esp + 0x12c]
call fcn.11e8b150
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x78]
lea edx, [esp + 0x124]
push edx
push eax
push ecx
push esi
lea ecx, [esp + 0x30]
call fcn.11e7ff50
push eax
call fcn.11e5f840
mov eax, dword [0x12133f80]
add esp, 0x10
cmp eax, esi
je 0x11cd4e2d
lea edx, [esp + 0x1a4]
push edx
push 0x2ee
push str._CSafeDoc::OnNtCreateFile__Line:_d____s__SDTransform_Fail_
push str.SDTransform
push 4
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x1644]
lea ecx, [esp + 0x124]
mov dword [eax], 0xffffffff
mov byte [esp + 0x1638], bl
call fcn.11e8af20
lea ecx, [esp + 0x20]
mov byte [esp + 0x1638], 8
call fcn.11e7f280
lea ecx, [esp + 0x44]
mov byte [esp + 0x1638], 6
call fcn.11e7f280
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1638], 5
call fcn.11e92540
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1638], 4
call fcn.11e92540
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1638], 3
call fcn.11e7f280
lea ecx, [esp + 0x28]
mov byte [esp + 0x1638], 2
call fcn.11e7f280
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 1
call fcn.11e15fd0
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8ccb
cmp dword [0x12133f80], esi
je 0x11cd4f06
push 0x30b
push str._CSafeDoc::OnNtCreateFile__Line:_d__File_name_is_empty.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x44]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
mov ecx, 0x1212b5c0
call fcn.11d713d0
test eax, eax
je 0x11cda6a4
test byte [esp + 0x1664], 1
jne 0x11cda6a4
mov eax, dword [ebx + 8]
xor ecx, ecx
mov cx, word [eax]
mov edx, dword [eax + 4]
shr ecx, 1
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.11e7ee90
mov ecx, 0x1212b5c0
mov byte [esp + 0x1638], 0xc
call fcn.11d915c0
test eax, eax
je 0x11cd522c
mov eax, dword [esp + 0x10]
mov ecx, 0x1212b5c0
mov esi, dword [eax - 8]
call fcn.11d916d0
cmp esi, eax
jb 0x11cd522c
lea ecx, [esp + 0x50]
call fcn.11e16060
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
xor edi, edi
push edx
push esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
call fcn.11e15b00
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, edi
je 0x11cd5169
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebp + 0x1c], ecx
mov ecx, dword [esp + 0x166c]
mov dword [ebp + 0x24], edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
mov edi, dword [ebp + 0xc]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push ebx
push ecx
push edx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0xc], edi
jmp 0x11cd51ec
mov ecx, dword [esp + 0x1644]
mov dword [ecx], 0xffffffff
lea ecx, [esp + 0x44]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, edi
jmp 0x11cda986
cmp dword [0x12133f80], esi
je 0x11cd50c2
lea edx, [esp + 0x1a4]
push edx
push 0x31e
push str._CSafeDoc::OnNtCreateFile__Line:_d__Forbid_to_access__s_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x1644]
lea ecx, [esp + 0x44]
mov dword [eax], 0xffffffff
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8ccb
cmp dword [0x12133f80], esi
je 0x11cd512a
lea ecx, [esp + 0x1a4]
push ecx
push 0x328
push str._CSafeDoc::OnNtCreateFile__Line:_d__Forbid_to_access_ShareFolder__s_
push str.NetWorkShareFolder
push 4
call fcn.11ca5810
add esp, 0x14
mov edx, dword [esp + 0x1644]
lea ecx, [esp + 0x44]
mov dword [edx], 0xffffffff
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8ccb
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x11cd51ec
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1660]
push edx
mov edx, dword [esp + 0x1660]
push eax
push ebx
push ecx
push edx
call esi
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd51ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov ebp, dword [ebp + 0x14]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, ebp
jmp 0x11cda986
mov edi, dword [esp + 0x38]
xor esi, esi
lea eax, [esp + 0x11c]
push esi
push eax
push ebx
mov ecx, edi
mov dword [esp + 0x128], esi
call fcn.11d1ade0
test eax, eax
mov dword [esp + 0x44], eax
jne 0x11cd53cf
mov ecx, 0x1212b5c0
call fcn.11d811f0
test eax, eax
je 0x11cd53cf
mov ecx, edi
call fcn.11cdacf0
mov ecx, dword [esp + 0x1660]
mov esi, 1
test ecx, ecx
je 0x11cd5292
cmp ecx, 2
je 0x11cd5292
cmp ecx, 4
je 0x11cd5292
cmp ecx, 5
je 0x11cd5292
xor eax, eax
jmp 0x11cd5297
mov eax, 1
cmp ecx, 3
jne 0x11cd52b0
mov ecx, dword [esp + 0x10]
push 0
push ecx
call fcn.11dbb630
add esp, 8
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x1648]
mov edx, ecx
and edx, 0x10000000
jne 0x11cd52d2
test ecx, 0x80000000
jne 0x11cd52d2
test cl, 1
jne 0x11cd52d2
xor edi, edi
jmp 0x11cd52d7
mov edi, 1
test edx, edx
jne 0x11cd52ec
test ecx, 0x40010000
jne 0x11cd52ec
test cl, 2
jne 0x11cd52ec
xor ecx, ecx
jmp 0x11cd52f1
mov ecx, 1
test eax, eax
mov dword [esp + 0x24], ecx
jne 0x11cd53cf
test edi, edi
mov esi, 2
jne 0x11cd530e
test ecx, ecx
je 0x11cd53cf
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e2]
mov word [esp + 0x3e0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x3e0]
push 0x104
push edx
push eax
push ecx
mov esi, 3
call fcn.11dba850
add esp, 0x10
cmp word [esp + 0x3e0], 0
jne 0x11cd538e
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x11cd53cf
mov eax, dword [0x12133f80]
test eax, eax
je 0x11cd53f8
mov edx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push edx
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile:_NtFileNameFormatEx_0x_08X___s__...__failed__n
push str.OutlineProtect
push 4
call fcn.11ca5810
add esp, 0x18
jmp 0x11cd53cf
mov eax, dword [esp + 0x24]
mov esi, 4
test eax, eax
je 0x11cd53b1
lea eax, [esp + 0x3e0]
mov ecx, 0x1212b5c0
push eax
call fcn.11d81ee0
test eax, eax
jne 0x11cd53cf
lea ecx, [esp + 0x3e0]
mov esi, 5
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.11cd4330
test eax, eax
jne 0x11cda63d
mov eax, dword [0x12133f80]
test eax, eax
je 0x11cd53f8
mov edx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push esi
push edx
push eax
push str.__s__CSafeDoc::OnNtCreateFile___Path__s___Debug__d__n
push str.OutlineProtect
push 4
call fcn.11ca5810
add esp, 0x18
mov esi, dword [esp + 0x44]
test esi, esi
jne 0x11cd547c
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
je 0x11cd547c
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
push eax
push 0x12118e98
call fcn.11c92320
add esp, 8
test eax, eax
je 0x11cd547c
test byte [esp + 0x24], 1
jne 0x11cd547c
cmp dword [esp + 0x1660], 5
jne 0x11cd547c
mov ecx, dword [esp + 0x10]
push 0x1203a7c4
push ecx
call fcn.11e9bad0
add esp, 8
test eax, eax
jne 0x11cd547c
mov edx, dword [esp + 0x10]
push str..lnk
push edx
call fcn.11e9bad0
add esp, 8
test eax, eax
jne 0x11cd547c
mov eax, dword [esp + 0x10]
mov ecx, 0x1212b5c0
push eax
call fcn.11d88310
test eax, eax
je 0x11cda5d6
push 0
push 0
push 0
mov ecx, 0x1212b5c0
call fcn.11d60760
test eax, eax
jne 0x11cd555c
push eax
push 0x12118e98
call fcn.11c92320
add esp, 8
test eax, eax
je 0x11cd555c
call fcn.11dd8540
test eax, eax
je 0x11cd54bc
cmp eax, 1
jne 0x11cd555c
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push eax
mov eax, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push eax
mov eax, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ebx
push ecx
push edx
push ebp
mov ecx, 0x1212ae38
call fcn.11d20fd0
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, edi
jmp 0x11cda986
test esi, esi
jne 0x11cd556f
mov eax, dword [esp + 0x10]
mov ecx, 0x1212b5c0
push eax
call fcn.11d7d0d0
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1232]
mov word [esp + 0x1230], 0
rep stosd dword es:[edi], eax
cmp word [esp + 0x1a4], 0
mov ecx, 6
stosw word es:[edi], ax
mov esi, ebx
lea edi, [esp + 0x104]
rep movsd dword es:[edi], dword [esi]
jne 0x11cd55c4
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x1a4]
push 0x104
push ecx
push edx
push eax
call fcn.11dba850
add esp, 0x10
mov eax, dword [0x12133f80]
test eax, eax
je 0x11cd55f9
mov ecx, dword [esp + 0x44]
mov eax, dword [0x12126854]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1a8]
push edx
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s__Convert_Before_Orgin:_s__bFilter__d__n
push str.test
push 4
call fcn.11ca5810
add esp, 0x1c
lea edx, [esp + 0x1a4]
push 0xffffffffffffffff
push edx
mov ecx, 0x1212b5c0
call fcn.11d6a6d0
test eax, eax
je 0x11cd57a5
lea ecx, [esp + 0x50]
call fcn.11e16060
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x3c], ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
push eax
xor esi, esi
push ecx
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
call fcn.11e15b00
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, esi
je 0x11cd56e2
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x1c], edx
mov edx, dword [esp + 0x166c]
mov dword [ebp + 0x24], ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
mov esi, dword [ebp + 0xc]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push ebx
push edx
push ecx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0xc], esi
jmp 0x11cd5765
mov edi, dword [ebp + 0x18]
cmp edi, esi
je 0x11cd5765
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1660]
push ecx
mov ecx, dword [esp + 0x1660]
push edx
push ebx
push eax
push ecx
call edi
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd5765
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov ebp, dword [ebp + 0x14]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, ebp
jmp 0x11cda986
mov ecx, 0x1212b5c0
call fcn.11d8c8b0
test eax, eax
jne 0x11cd593f
xor esi, esi
cmp word [esp + 0x1a4], si
je 0x11cd5941
mov ecx, 0x1212b5c0
call fcn.11d71190
test eax, eax
je 0x11cd5941
push esi
push esi
lea edx, [esp + 0x1ac]
push esi
push edx
mov ecx, 0x1212b5c0
call fcn.11d70510
test eax, eax
je 0x11cd5941
push 0xffffffffffffffdd
lea ecx, [esp + 0x90]
call fcn.11e15fa0
lea eax, [esp + 0x1a4]
mov byte [esp + 0x1638], 0xd
push eax
call fcn.11dbb4d0
add esp, 4
cmp eax, 0xffffffff
jne 0x11cd5929
lea ecx, [esp + 0x1a4]
push esi
push ecx
mov ecx, dword [esp + 0x40]
call fcn.11d0c7d0
test eax, eax
je 0x11cd5929
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
push edx
call fcn.11e7e880
lea ecx, [esp + 0x28]
mov byte [esp + 0x1638], 0xe
call fcn.11e82c90
lea ecx, [esp + 0x28]
call fcn.11e82fb0
push 0x1204c22c
lea ecx, [esp + 0x2c]
call fcn.11e7fed0
mov eax, dword [esp + 0x28]
push 0x1ff
lea ecx, [esp + 0x1234]
push eax
push ecx
call fcn.11e674bf
lea edx, [esp + 0x123c]
push edx
call fcn.11e67d05
shl eax, 1
add esp, 0x10
lea ecx, [esp + 0x134]
mov word [esp + 0x134], ax
lea edx, [esp + 0x1230]
lea eax, [esp + 0x1230]
mov dword [esp + 0x10c], ecx
push edx
lea ecx, [esp + 0x14]
mov word [esp + 0x13a], 0x400
mov dword [esp + 0x13c], eax
call fcn.11e7f500
push 0x1204c22c
call fcn.11e67d05
mov edi, eax
lea eax, [esp + 0x1a8]
push eax
call fcn.11e67d05
add edi, eax
add esp, 8
cmp edi, 0x104
jae 0x11cd5918
lea ecx, [esp + 0x1a4]
push 0x1204c22c
push ecx
call fcn.11e67470
add esp, 8
lea ecx, [esp + 0x28]
mov byte [esp + 0x1638], 0xd
call fcn.11e7f280
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1638], 0xc
call fcn.11e15fd0
jmp 0x11cd5941
xor esi, esi
mov eax, dword [esp + 0x1660]
cmp eax, esi
mov dword [esp + 0x4c], eax
je 0x11cd5964
cmp eax, 4
jne 0x11cd595f
mov dword [esp + 0x4c], 1
jmp 0x11cd596c
cmp eax, 5
jne 0x11cd596c
mov dword [esp + 0x4c], 3
mov ecx, 0x1212b458
call fcn.11df58e0
test eax, eax
je 0x11cd59b6
mov edx, dword [esp + 0x10]
push str._recovery.xcu
push edx
call fcn.11e9bad0
add esp, 8
test eax, eax
jne 0x11cd59a6
mov eax, dword [esp + 0x10]
push str._recovery.xcu_tmp
push eax
call fcn.11e9bad0
add esp, 8
test eax, eax
je 0x11cd59b6
mov eax, 5
mov dword [esp + 0x1660], eax
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x50]
call fcn.11e16060
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.11e15b00
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, esi
je 0x11cd5a93
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x88], ecx
mov ecx, dword [esp + 0x28]
mov dword [ebp + 0x1c], edx
mov edx, dword [esp + 0x166c]
mov dword [ebp + 0x24], ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
mov esi, dword [esp + 0x1654]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
push ecx
mov ecx, dword [esp + 0x1668]
lea edx, [esp + 0x124]
mov dword [ebp + 0x20], eax
push edx
push ecx
push esi
push ebp
call eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x88]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0xc], ecx
jmp 0x11cd5b27
mov edi, dword [ebp + 0x18]
cmp edi, esi
je 0x11cd5b20
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x1648]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
mov edx, dword [esp + 0x1664]
lea ecx, [esp + 0x120]
push eax
push ecx
push edx
push esi
call edi
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd5b27
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
jmp 0x11cd5b27
mov esi, dword [esp + 0x1644]
mov edi, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x44]
test eax, eax
mov dword [esp + 0x28], edi
je 0x11cd5b7a
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, edi
jmp 0x11cda986
lea ecx, [esp + 0x50]
call fcn.11e16040
mov ecx, 0x1212b458
call fcn.11df49d0
test eax, eax
je 0x11cd5c37
cmp dword [esp + 0x1660], 2
jne 0x11cd5c37
mov eax, dword [esp + 0x165c]
test eax, eax
jne 0x11cd5c37
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e2]
mov word [esp + 0x3e0], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
push 0x104
stosw word es:[edi], ax
mov edx, dword [ebx + 4]
lea eax, [esp + 0x3e4]
push eax
push ecx
push edx
call fcn.11dba850
lea eax, [esp + 0x3f0]
push eax
call fcn.11e67d05
add esp, 0x14
test eax, eax
jbe 0x11cd5c37
lea ecx, [esp + 0x3e0]
push str..pptx
push ecx
call fcn.11e9bad0
add esp, 8
test eax, eax
je 0x11cd5c37
push 0
push 0
push 0
mov ecx, 0x1212b5c0
call fcn.11d60760
lea edx, [esp + 0x3e0]
push eax
push edx
call fcn.11e0fd50
add esp, 8
mov ebx, dword [esp + 0x28]
xor edi, edi
cmp ebx, edi
je 0x11cd5c9f
cmp dword [0x12133f80], edi
je 0x11cd5c62
mov eax, dword [esp + 0x10]
push eax
push str.CSafeDoc::OnNtCreateFile_13___s_
push str.TestNtCreateFile11
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, ebx
jmp 0x11cda986
lea ecx, [esp + 0x1a4]
push ecx
mov ecx, 0x1212b5c0
call fcn.11d6c800
cmp dword [esp + 0x1650], edi
je 0x11cd5d4c
cmp eax, edi
jne 0x11cd5d0e
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x1a4]
push edx
push eax
mov ecx, 0x1212b5c0
call fcn.11d86f70
test eax, eax
je 0x11cd5d0e
cmp dword [0x12133f80], edi
je 0x11cd5d4c
mov ecx, dword [esp + 0x74]
mov eax, dword [0x12126854]
lea edx, [esp + 0x1a4]
push ecx
push edx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__:_File__s__Type__d__Forbid_ThumbOrPreview__n
push str.testpreview
push 4
call fcn.11ca5810
add esp, 0x18
jmp 0x11cd5d4c
push esi
push edi
mov ecx, 0x1212b5c0
call fcn.11d6a6d0
test eax, eax
je 0x11cd5f3e
cmp dword [0x12133f80], edi
je 0x11cd5d4c
mov eax, dword [0x12126854]
lea ecx, [esp + 0x1a4]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__:_File__s__n
push str.RealFilterFile
push 4
call fcn.11ca5810
add esp, 0x14
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x1660]
cmp edx, eax
je 0x11cda599
mov eax, dword [esp + 0x1664]
test ah, 0x10
je 0x11cd5da8
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov eax, dword [esi]
push eax
call dword [0x1213494c]
cmp eax, edi
je 0x11cd5df2
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
call fcn.11e15b00
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, edi
je 0x11cd5eb4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebp + 0x1c], ecx
mov ecx, dword [esp + 0x166c]
mov dword [ebp + 0x24], edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
mov edi, dword [ebp + 0xc]
push ecx
push edx
mov edx, dword [esp + 0x1668]
lea ecx, [esp + 0x124]
mov dword [ebp + 0x20], eax
push ecx
push edx
push esi
push ebp
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0xc], edi
jmp 0x11cd6e45
mov ebx, dword [ebp + 0x18]
cmp ebx, edi
je 0x11cd6e45
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
mov edx, dword [esp + 0x1664]
lea ecx, [esp + 0x120]
push eax
push ecx
push edx
push esi
call ebx
mov ecx, dword [esp + 0x78]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd6e45
jmp 0x11cd6e3c
mov eax, dword [esp + 0x108]
mov esi, dword [esi]
cmp eax, edi
mov dword [esp + 0x1c], esi
jne 0x11cd5f5d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [esp + 0x11c], eax
cmp dword [esp + 0x11c], 1
je 0x11cd5fa4
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
xor ebx, ebx
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x140]
mov dword [esp + 0x13c], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x13c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp eax, ebx
mov dword [esp + 0x2c], eax
jne 0x11cd6086
cmp dword [0x12133f80], ebx
je 0x11cd6008
mov edi, dword [0x12126854]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push eax
push esi
push ecx
push edi
push str.__s__CSafeDoc::OnNtCreateFile____GetFileInformationByHandle__:_File__s__Hanle__08x__failed____Error:__d__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x1c
cmp word [esp + 0x1a4], bx
jne 0x11cd60d1
mov ecx, dword [esp + 0x108]
cmp ecx, ebx
je 0x11cd6049
cmp dword [0x12133f80], ebx
je 0x11cd6049
mov edx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push edx
push ecx
push eax
push str.__s__CSafeDoc::OnNTCreateFile:_NtFileNameFormatEx_0x_08X___s__...__failed__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
test byte [esp + 0x13c], 0x10
je 0x11cd6008
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
lea eax, [esp + 0x1a4]
push ebx
push eax
call fcn.11dbac60
add esp, 8
test eax, eax
je 0x11cd6123
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
cmp dword [esp + 0x20], ebx
je 0x11cd61a6
mov ecx, 0x1212b5c0
call fcn.11d68400
cmp eax, 2
jne 0x11cd61a6
lea ecx, [esp + 0x1a4]
push 1
push ecx
call fcn.11df9800
add esp, 8
test eax, eax
jne 0x11cd6162
lea edx, [esp + 0x1a4]
push edx
call fcn.11cbc4e0
add esp, 4
test eax, eax
je 0x11cd61a6
mov ecx, 0x1212b5c0
call fcn.11d71180
test eax, eax
jne 0x11cd61a6
push ebx
push ebx
push ebx
mov ecx, 0x1212b5c0
call fcn.11d70d90
cmp dword [0x12133f80], ebx
je 0x11cd61a6
lea eax, [esp + 0x1a4]
push eax
push 0x516
push str._CSafeDoc::OnNtCreateFile__Line:_d_SDWM_ENC_WHILE_DEC_visit_safedisk__need_to_authorize._Path__s_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov ecx, dword [esp + 0x1650]
mov eax, dword [ecx + 4]
cmp eax, ebx
je 0x11cd61c9
cmp eax, 2
je 0x11cd61c9
cmp eax, 3
je 0x11cd61c9
mov dword [esp + 0x44], ebx
mov edx, 1
jmp 0x11cd61d2
mov edx, 1
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x1648]
mov eax, ecx
and eax, 0x10000000
jne 0x11cd61f3
test ecx, 0x80000000
jne 0x11cd61f3
test cl, 1
mov dword [esp + 0x14], ebx
je 0x11cd61f7
mov dword [esp + 0x14], edx
cmp eax, ebx
jne 0x11cd6221
test ecx, 0x40010000
jne 0x11cd6221
test cl, 6
jne 0x11cd6221
mov eax, dword [esp + 0x1660]
cmp eax, ebx
je 0x11cd6221
cmp eax, 4
je 0x11cd6221
cmp eax, 5
mov dword [esp + 0x5c], ebx
jne 0x11cd6225
mov dword [esp + 0x5c], edx
mov eax, dword [ebp + 0x18]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x88], eax
push edx
lea eax, [esi + 4]
lea ecx, [esp + 0x80]
push eax
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x20], eax
call fcn.11e8c590
mov byte [esp + 0x1638], 0xf
mov dword [esp + 0x30], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
jle 0x11cd62a4
mov ecx, esi
xor edi, edi
lea esi, [ecx + 0x14]
mov edx, dword [esi]
lea ecx, [esp + 0x1a4]
push ecx
mov eax, dword [edx + edi + 0x40]
push eax
call fcn.11e67d22
add esp, 8
test eax, eax
jne 0x11cd6293
mov edx, dword [esi]
mov eax, dword [edx + edi + 0x20]
test eax, eax
je 0x11cd6321
mov eax, dword [esp + 0x38]
inc ebx
add edi, 0x6c
cmp ebx, dword [eax + 0x18]
jl 0x11cd626a
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0xc
call fcn.11e8c5f0
xor ebx, ebx
cmp dword [esp + 0x2c], ebx
jne 0x11cd6e88
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x1660]
cmp edx, eax
je 0x11cda599
mov eax, dword [esp + 0x1664]
test ah, 0x10
je 0x11cd6c9a
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
cmp ebx, 0xffffffff
mov dword [esp + 0x30], ebx
je 0x11cd62a4
mov ecx, 0x1212b458
call fcn.11df4810
test eax, eax
je 0x11cd63b2
mov edx, dword [esi]
lea eax, [ebx + ebx*2]
lea ecx, [eax + eax*8]
mov eax, dword [edx + ecx*4 + 0x1c]
test eax, eax
je 0x11cd63b2
lea eax, [esp + 0x1a4]
mov ecx, 0x1212b5c0
push eax
call fcn.11da9ea0
test eax, eax
je 0x11cd63b2
mov ecx, dword [esp + 0x1644]
mov dword [ecx], 0xffffffff
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0xc
call fcn.11e8c5f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8bfc
xor edx, edx
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x174]
mov dword [esp + 0x170], edx
mov dword [esp + 0x28], edx
rep stosd dword es:[edi], eax
cmp dword [esp + 0x2c], edx
je 0x11cd6873
mov eax, dword [esp + 0x30]
mov edx, dword [esi]
lea edi, [eax + eax*2]
lea edi, [edi + edi*8]
shl edi, 2
mov dword [edx + edi + 0x34], 0
mov eax, dword [esi]
mov eax, dword [eax + edi + 0x40]
push eax
call fcn.11dbb4d0
mov ecx, dword [esi]
mov ebx, eax
mov eax, dword [ecx + edi + 0x44]
push eax
call fcn.11dbb4d0
and ebx, 1
add esp, 8
and eax, 1
test ebx, ebx
je 0x11cd6459
xor ebx, ebx
cmp eax, ebx
jne 0x11cd6498
mov edx, dword [esi]
push ebx
push 1
mov eax, dword [edx + edi + 0x44]
push eax
call fcn.11dbb440
mov eax, dword [0x12133f80]
add esp, 0xc
cmp eax, ebx
je 0x11cd6498
mov ecx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__:_File__s__Add_ReadOnly__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x14
jmp 0x11cd649a
test eax, eax
je 0x11cd6498
mov edx, dword [esi]
push 1
push 0
mov eax, dword [edx + edi + 0x44]
push eax
call fcn.11dbb440
mov eax, dword [0x12133f80]
add esp, 0xc
test eax, eax
je 0x11cd6498
mov ecx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__:_File__s__Remove_ReadOnly__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x14
xor ebx, ebx
mov ecx, 0x1212b5c0
call fcn.11d92f20
test eax, eax
jne 0x11cd6875
mov ecx, 0x1212b5c0
call fcn.11d68760
test eax, eax
je 0x11cd6875
mov edx, dword [esi]
mov ecx, dword [edx + edi + 0x60]
lea eax, [edx + edi]
cmp ecx, ebx
jne 0x11cd6875
cmp dword [eax + 0x50], ebx
jne 0x11cd6875
mov ecx, dword [esp + 0x154]
cmp ecx, ebx
jne 0x11cd64f0
cmp dword [esp + 0x150], ebx
je 0x11cd6875
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + 0x38]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x15c]
push ecx
call fcn.11dbc8b0
add esp, 0x10
test eax, eax
je 0x11cd6875
cmp dword [0x12133f80], ebx
je 0x11cd653b
mov eax, dword [0x12126854]
lea edx, [esp + 0x1a4]
push edx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_File_modified_by_other_process.__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x14
mov dword [esp + 0x24], ebx
mov eax, dword [esi]
mov ecx, dword [eax + edi + 0x44]
cmp dword [ecx - 8], ebx
je 0x11cd6875
push 0xffffffffffffffdd
lea ecx, [esp + 0x90]
call fcn.11e15fa0
mov byte [esp + 0x1638], 0x10
mov edx, dword [esi]
push ebx
push 0x204020
mov eax, dword [edx + edi + 0x44]
push 7
push 0x100080
push eax
call fcn.11dbb1d0
add esp, 0x14
cmp eax, 0xffffffff
mov dword [esp + 0x60], eax
je 0x11cd65af
lea ecx, [esp + 0x170]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x24], eax
push edx
call dword [0x1213494c]
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1638], 0xf
call fcn.11e15fd0
cmp dword [esp + 0x24], ebx
je 0x11cd6875
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x184]
cmp eax, ebx
jne 0x11cd65e7
cmp ecx, ebx
je 0x11cd6875
push eax
mov eax, dword [esp + 0x158]
push ecx
mov ecx, dword [esp + 0x158]
push eax
push ecx
call fcn.11dbc8b0
add esp, 0x10
test eax, eax
jge 0x11cd66ce
mov eax, dword [esp + 0x1664]
test ah, 0x10
jne 0x11cd6875
push 0xffffffffffffffdd
lea ecx, [esp + 0x90]
call fcn.11e15fa0
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x1638], 0x11
cmp eax, 0xffffffff
je 0x11cd6647
push eax
call dword [0x1213494c]
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x24]
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call fcn.11d18e40
mov ecx, dword [0x12133f80]
mov dword [esp + 0x28], eax
cmp ecx, ebx
je 0x11cd6691
mov ecx, dword [0x12126854]
lea edx, [esp + 0x1a4]
push eax
push edx
push ecx
push str.__s__CSafeDoc::OnNtCreateFile__s_:_File_modified_by_other_process.The_DecryptFile_is_new__MergeDecryptToEncrypt_returns:_d_n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x18
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1638], 0xf
cmp eax, 1
lea ecx, [esp + 0x8c]
jne 0x11cd66c4
call fcn.11e15fd0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0xc
call fcn.11e8c5f0
jmp 0x11cd62b7
call fcn.11e15fd0
jmp 0x11cd6875
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x184]
mov edx, dword [esp + 0x154]
push eax
mov eax, dword [esp + 0x154]
push ecx
push edx
push eax
call fcn.11dbc8b0
add esp, 0x10
test eax, eax
jle 0x11cd6875
cmp dword [0x12133f80], ebx
je 0x11cd6728
mov eax, dword [0x12126854]
lea ecx, [esp + 0x1a4]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_File_modified_by_other_process.The_EncryptFile_is_new_n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x14
push 0xffffffffffffffdd
lea ecx, [esp + 0x90]
call fcn.11e15fa0
mov byte [esp + 0x1638], 0x12
mov edx, dword [esi]
mov ecx, dword [edx + edi + 0x2c]
lea eax, [edx + edi]
cmp ecx, 0xffffffff
je 0x11cd6760
test cl, 1
je 0x11cd6760
mov eax, dword [eax + 0x44]
push 1
push ebx
push eax
call fcn.11dbb440
add esp, 0xc
mov eax, dword [esi]
push 1
mov eax, dword [eax + edi + 0x44]
push eax
call fcn.11dbb670
add esp, 8
cmp eax, ebx
jne 0x11cd67da
mov ecx, dword [esi]
push 0x1204baec
mov eax, dword [ecx + edi + 0x44]
mov ecx, dword [esp + 0x3c]
push eax
call fcn.11ce50b0
mov edx, dword [esi]
mov ecx, dword [esp + 0x38]
push 0x1204baec
mov eax, dword [edx + edi + 0x48]
push eax
call fcn.11ce50b0
cmp dword [0x12133f80], ebx
je 0x11cd67f0
mov ebx, dword [esi]
mov eax, dword [0x12126854]
add ebx, edi
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 0x44]
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
push str.__s__CSafeDoc::OnNtCreateFile_Delete_DecryptFile__s__failed__error_ld
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x18
jmp 0x11cd67f0
mov eax, dword [esi]
mov eax, dword [eax + edi + 0x48]
cmp dword [eax - 8], ebx
je 0x11cd67f0
push 1
push eax
call fcn.11dbb670
add esp, 8
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1638], 0xf
call fcn.11e15fd0
mov ebx, dword [esi + 4]
mov eax, dword [esp + 0x30]
sub ebx, eax
mov eax, dword [esi]
dec ebx
add eax, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x28]
call fcn.11cdac20
mov eax, dword [esp + 0x28]
add eax, 0x6c
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x24], eax
jne 0x11cd681e
test ebx, ebx
je 0x11cd686b
mov ecx, dword [esp + 0x30]
mov eax, dword [esi]
lea ebx, [ebx + ebx*2]
lea ecx, [ecx + ecx*2 + 3]
lea edx, [ebx + ebx*8]
shl edx, 2
lea ecx, [ecx + ecx*8]
push edx
lea edx, [eax + ecx*4]
add eax, edi
push edx
push eax
call fcn.11e679d0
add esp, 0xc
dec dword [esi + 4]
jmp 0x11cd62a4
xor ebx, ebx
cmp dword [esp + 0x1c], 0xffffffff
jne 0x11cd6a41
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], edx
push ecx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x18]
push edx
push ecx
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebx
je 0x11cd694e
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x1c], edx
mov edx, dword [esp + 0x166c]
mov dword [ebp + 0x24], ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
push edx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x24], edx
mov dword [ebp + 0xc], edi
jmp 0x11cd69dc
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x11cd69dc
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x166c]
mov ecx, dword [esp + 0x1668]
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
push eax
mov eax, dword [esp + 0x1664]
lea edx, [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
push eax
push ecx
call edi
mov edx, dword [esp + 0x78]
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd69dc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov eax, dword [esp + 0x78]
mov edi, dword [eax]
cmp edi, ebx
je 0x11cd6a34
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0xc
call fcn.11e8c5f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, edi
jmp 0x11cda986
mov ecx, dword [esp + 0x1644]
mov edx, dword [ecx]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x30]
lea edi, [eax + eax*2]
mov eax, dword [esi]
lea edi, [edi + edi*8]
shl edi, 2
mov ecx, dword [eax + edi + 0x44]
cmp dword [ecx - 8], ebx
je 0x11cd6bc9
push 0xffffffffffffffdd
lea ecx, [esp + 0x90]
call fcn.11e15fa0
mov eax, dword [esp + 0x44]
mov byte [esp + 0x1638], 0x13
cmp eax, ebx
je 0x11cd6a8c
mov edx, dword [esi]
push 1
mov eax, dword [edx + edi + 0x44]
push eax
call fcn.11dbb670
add esp, 8
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
mov eax, dword [eax + edi + 0x44]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
lea ecx, [esp + 0x120]
push edx
mov edx, dword [esp + 0x1668]
push ecx
lea ecx, [esp + 0x84]
push edx
mov edx, dword [esp + 0xb0]
push ecx
push eax
push edx
call fcn.11cdab30
add esp, 0x34
lea ecx, [esp + 0x8c]
mov ebp, eax
mov byte [esp + 0x1638], 0xf
call fcn.11e15fd0
cmp ebp, ebx
je 0x11cd6bba
cmp dword [0x12133f80], ebx
je 0x11cd6b54
mov esi, dword [esi]
add esi, edi
mov edi, dword [0x12126854]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi + 0x44]
push ebp
lea ecx, [esp + 0x1ac]
push eax
push ecx
push edi
push str.__s__CSafeDoc::OnNtCreateFile__s_:_open_decrypt_file__s__failed__2____status0x_08X__Error:__d__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x20
mov edx, dword [esp + 0x1c]
push edx
call dword [0x1213494c]
mov eax, dword [esp + 0x1644]
lea ecx, [esp + 0x7c]
mov dword [eax], 0xffffffff
mov byte [esp + 0x1638], 0xc
call fcn.11e8c5f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, ebp
jmp 0x11cda986
mov ecx, dword [esp + 0x1644]
mov edx, dword [esp + 0x60]
mov dword [ecx], edx
jmp 0x11cd6bd1
mov dword [esp + 0x60], 0xffffffff
cmp dword [esp + 0x28], ebx
je 0x11cd6c19
mov eax, dword [esi]
mov ecx, dword [esp + 0x44]
mov dword [eax + edi + 0x18], ecx
mov edx, dword [esi]
mov dword [edx + edi + 0xc], ebx
mov eax, dword [esi]
mov ecx, dword [esp + 0x170]
mov dword [eax + edi + 0x2c], ecx
mov edx, dword [esi]
mov eax, dword [esp + 0x194]
mov dword [edx + edi + 0x30], eax
mov ecx, dword [esi]
mov edx, dword [esp + 0x184]
mov dword [ecx + edi + 0x38], edx
mov eax, dword [esp + 0x188]
mov dword [ecx + edi + 0x3c], eax
mov ecx, dword [esi]
mov esi, dword [ecx + edi + 0x60]
mov ebx, dword [esp + 0x60]
push 0xffffffffffffffff
lea edi, [ecx + edi + 0x5c]
lea edx, [esi + 1]
push edx
mov ecx, edi
call fcn.11d1c240
mov ecx, dword [edi]
lea eax, [esi + esi*2]
lea edx, [ecx + eax*4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov dword [edx], eax
mov dword [edx + 4], ebx
mov dword [edx + 8], ecx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0xc
call fcn.11e8c5f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov eax, dword [esp + 0x1644]
mov ecx, dword [eax]
push ecx
call dword [0x1213494c]
cmp eax, ebx
je 0x11cd6ceb
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], eax
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebx
je 0x11cd6db4
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov dword [ebp + 0x1c], ecx
mov ecx, dword [esp + 0x166c]
mov dword [ebp + 0x24], edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
mov esi, dword [ebp + 0xc]
push ecx
lea ecx, [esp + 0x120]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
push ecx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0xc], esi
jmp 0x11cd6e45
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x11cd6e45
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
mov ecx, dword [esp + 0x1664]
lea eax, [esp + 0x120]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
push edx
call edi
mov ecx, dword [esp + 0x78]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd6e45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
mov esi, dword [edx]
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, esi
jmp 0x11cda986
cmp dword [esp + 0x14], ebx
jne 0x11cd6e94
cmp dword [esp + 0x5c], ebx
je 0x11cd6ef6
cmp dword [esp + 0x20], ebx
je 0x11cd6ef6
lea eax, [esp + 0x1a4]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d7c540
test eax, eax
je 0x11cd6ef6
mov ecx, 0x1212b5c0
call fcn.11d71180
test eax, eax
jne 0x11cd6ef6
push ebx
push ebx
push ebx
mov ecx, 0x1212b5c0
call fcn.11d70d90
cmp dword [0x12133f80], ebx
je 0x11cd6ef6
mov eax, dword [0x12126854]
lea ecx, [esp + 0x1a4]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_Readonly_File_Opened__n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x14
mov eax, dword [0x11fd6250]
mov dword [esp + 0xd8], eax
mov byte [esp + 0x1638], 0x14
mov dword [esp + 0xdc], eax
mov byte [esp + 0x1638], 0x15
mov dword [esp + 0xe0], eax
mov byte [esp + 0x1638], 0x16
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], ebx
mov byte [esp + 0x1638], 0x17
mov dword [esp + 0xf4], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0xf8], ebx
mov byte [esp + 0x1638], 0x18
push 0x12119948
lea ecx, [esp + 0xdc]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xd4], ebx
call fcn.11e7f500
push 0x12119948
lea ecx, [esp + 0xe0]
call fcn.11e7f500
push 0x12119948
lea ecx, [esp + 0xe4]
call fcn.11e7f500
mov edx, dword [esp + 0x13c]
mov ecx, dword [esp + 0x150]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x160]
mov byte [esp + 0x1638], 0x19
mov dword [esp + 0xc4], edx
mov edx, dword [esp + 0x154]
mov dword [esp + 0xd0], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb0], esi
mov dword [esp + 0xc8], eax
mov dword [esp + 0xd4], edx
call fcn.11e923e0
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x1a
call fcn.11e928f0
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x3bc]
mov dword [esp + 0x3b8], ebx
cmp esi, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x3c], ebx
rep stosd dword es:[edi], eax
je 0x11cd70d2
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x3b8]
push 0x28
push eax
push ecx
call fcn.11dbb3c0
add esp, 0xc
mov dword [esp + 0x3c], eax
cmp dword [0x12133f80], ebx
je 0x11cd7110
mov edx, dword [esp + 0x1664]
mov eax, dword [0x12126854]
and edx, 0x1000
lea ecx, [esp + 0x1a4]
push edx
push esi
push 0x67c
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s__line__lu__bSrcCreateNew__lu__del__lu__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x20
lea ecx, [esp + 0x40]
call fcn.11e923e0
cmp esi, ebx
mov byte [esp + 0x1638], 0x1b
jne 0x11cd9901
mov eax, dword [esp + 0x1664]
test ah, 0x10
je 0x11cd81dc
cmp dword [esp + 0x14], ebx
jne 0x11cd724e
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x1f
cmp eax, ebx
je 0x11cd7181
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x1e
cmp esi, ebx
je 0x11cd71d5
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd71cc
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x1e
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd71a5
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x1d
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x1c
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
push 0xffffffffffffffdd
lea ecx, [esp + 0x80]
call fcn.11e15fa0
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov byte [esp + 0x165c], 0x22
xor esi, esi
call fcn.11edea90
mov edi, eax
mov eax, dword [esp + 0x180]
add esp, 0x24
cmp eax, ebx
jbe 0x11cd7468
cmp edi, ebx
jne 0x11cd72a3
push ebx
push ebx
call fcn.11ee1ad0
add esp, 8
cmp eax, 0xf
jne 0x11cd746c
push ebx
push ebx
call fcn.11ee1ad0
add esp, 8
cmp eax, 0xf
jne 0x11cd72ff
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c0]
push ebx
push eax
call fcn.11ede9a0
mov ebp, eax
mov eax, dword [0x12133f80]
add esp, 0x24
cmp eax, ebx
je 0x11cd72f7
lea ecx, [esp + 0x1a4]
push ebp
push ecx
push 0x6a0
push str._CSafeDoc::OnNtCreateFile__Line:_d__File__s__Type__08x_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x18
cmp ebp, ebx
je 0x11cd7468
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x1a4]
push edx
call fcn.11d13fa0
test eax, eax
je 0x11cd7468
cmp dword [0x12133f80], ebx
je 0x11cd7341
lea eax, [esp + 0x1a4]
push eax
push 0x6a9
push str._CSafeDoc::OnNtCreateFile__Line:_d__Decrypt_Large_File__s__Forbidden.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov esi, dword [esp + 0x1644]
mov ecx, dword [esi]
push ecx
call dword [0x1213494c]
mov dword [esi], 0xffffffff
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x26
cmp eax, ebx
je 0x11cd73a6
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x25
cmp esi, ebx
je 0x11cd73fa
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd73f1
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x25
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd73ca
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x24
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x23
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8ccb
cmp edi, ebx
jne 0x11cd7487
mov esi, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push esi
call fcn.11ee3690
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x11cd74b6
mov esi, 1
cmp esi, ebx
mov dword [esp + 0x30], ebx
je 0x11cd794b
cmp edi, 3
jne 0x11cd7922
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
call fcn.11d0be80
mov edi, eax
jmp 0x11cd7a03
mov edx, dword [esp + 0x74]
mov ecx, 0x1212b5c0
push edx
call fcn.11d8dd30
test eax, eax
je 0x11cd760a
cmp dword [0x12133f80], ebx
je 0x11cd74ee
mov eax, dword [esp + 0x74]
push eax
push str._CSafeDoc::OnNtCreateFile__open_and_delete:THUMB_or_PREVIEW___x_
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x2c
cmp eax, ebx
je 0x11cd753d
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x2b
cmp esi, ebx
je 0x11cd7591
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd7588
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x2b
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd7561
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x2a
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x29
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
test byte [esp + 0x13c], 1
je 0x11cd7734
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x32
cmp eax, ebx
je 0x11cd7667
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x31
cmp esi, ebx
je 0x11cd76bb
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd76b2
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x31
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd768b
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x30
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x2f
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov eax, dword [esp + 0x20]
mov edi, 1
cmp eax, ebx
mov dword [esp + 0x2c], ebx
je 0x11cd77be
call fcn.11dd84e0
test eax, eax
jne 0x11cd7768
lea ecx, [esp + 0x2c]
push ebx
push ecx
mov ecx, 0x1212b5c0
call fcn.11d744b0
test eax, eax
je 0x11cd77be
cmp dword [esp + 0x2c], ebx
je 0x11cd77be
lea edx, [esp + 0x1a4]
push 1
push edx
call fcn.11df9800
add esp, 8
test eax, eax
jne 0x11cd7792
lea eax, [esp + 0x1a4]
push eax
call fcn.11cbc4e0
add esp, 4
test eax, eax
je 0x11cd77be
mov eax, dword [0x12133f80]
xor edi, edi
cmp eax, ebx
je 0x11cd77be
lea ecx, [esp + 0x1a4]
push ecx
push 0x6d6
push str._CSafeDoc::OnNtCreateFile__Line:_d__Only_Read_Mode__File__s__in_safe_disk.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
cmp edi, ebx
mov dword [esp + 0x14], ebx
je 0x11cd790e
push ebx
lea edx, [esp + 0x18]
push ebx
push edx
lea eax, [esp + 0x1b0]
push esi
push eax
mov ecx, 0x1212b5c0
call fcn.11d6cfd0
test eax, eax
je 0x11cd77f2
cmp dword [esp + 0x14], ebx
je 0x11cd790e
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x38
cmp eax, ebx
je 0x11cd7841
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x37
cmp esi, ebx
je 0x11cd7895
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd788c
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x37
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd7865
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x36
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x35
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0xb4], ebx
jmp 0x11cd81c2
cmp edi, 4
jne 0x11cd7ce5
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x34]
push ebx
push ecx
mov ecx, dword [esp + 0x44]
push edx
call fcn.11d0bfd0
mov edi, eax
jmp 0x11cd7a03
cmp edi, 3
jne 0x11cd7ce5
lea ecx, [esp + 0x14]
call fcn.11e923e0
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push 1
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x40]
push ebx
lea ecx, [esp + 0x1b8]
push eax
push ecx
mov ecx, dword [esp + 0x54]
push ebp
mov byte [esp + 0x1658], 0x3b
call fcn.11d0bc10
mov edi, eax
cmp edi, ebx
jne 0x11cd79f2
cmp dword [esp + 0x30], 0x2b
jne 0x11cd79f2
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd79e1
lea edx, [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebx
call fcn.11ee1ad0
mov ecx, dword [esp + 0x34]
add esp, 8
lea edx, [esp + 0x1a4]
push ecx
push 3
push eax
push edx
mov ecx, 0x1212b158
call fcn.11dbfe50
cmp dword [esp + 0x5c], ebx
je 0x11cd79f2
push ebp
mov ecx, 0x1212ae38
call fcn.11d2b2c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1638], 0x22
call fcn.11e92540
cmp edi, ebx
jne 0x11cd7b51
cmp dword [0x12133f80], ebx
je 0x11cd7a35
mov eax, dword [0x12126854]
lea ecx, [esp + 0x1a4]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_CheckAccessRight_failed__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x3f
cmp eax, ebx
je 0x11cd7a84
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x3e
cmp esi, ebx
je 0x11cd7ad8
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd7acf
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x3e
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd7aa8
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x3d
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x3c
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov ecx, dword [esp + 0x30]
cmp ecx, ebx
je 0x11cd7ce5
cmp dword [0x12133f80], ebx
je 0x11cd7b88
mov eax, dword [0x12126854]
lea edx, [esp + 0x1a4]
push ecx
push edx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_No_Access_right__Result:_lu_n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x18
lea eax, [esp + 0x1a4]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d69000
test eax, eax
jne 0x11cd7bc7
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd7bc7
mov ecx, dword [esp + 0x30]
push ebx
push 2
lea edx, [esp + 0x1ac]
push ecx
push edx
mov ecx, 0x1212b158
call fcn.11dbfe50
mov eax, dword [esp + 0x1644]
lea ecx, [esp + 0x7c]
mov dword [eax], 0xffffffff
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x45
cmp eax, ebx
je 0x11cd7c23
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x44
cmp esi, ebx
je 0x11cd7c77
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd7c6e
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x44
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd7c47
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x43
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x42
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8bfc
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e2]
mov word [esp + 0x3e0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x5ea]
mov word [esp + 0x5e8], bx
rep stosd dword es:[edi], eax
push ebx
lea ecx, [esp + 0x5ec]
push 0x104
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x3ec]
push 0x104
lea eax, [esp + 0x1b4]
push edx
push eax
call fcn.11deefd0
add esp, 0x18
test eax, eax
jne 0x11cd7e9a
cmp dword [0x12133f80], ebx
je 0x11cd7d7e
mov edi, dword [0x12126854]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1a4]
push eax
push ecx
push edi
push str.__s__CSafeDoc::OnNtCreateFile__s_:_get_new_decrypt_path_failed____Error:__d__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x18
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x4b
cmp eax, ebx
je 0x11cd7dcd
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x4a
cmp esi, ebx
je 0x11cd7e21
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd7e18
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x4a
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd7df1
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x49
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x48
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
cmp esi, ebx
je 0x11cd7eba
lea edx, [esp + 0x3e0]
push 0xffffffffffffffff
lea eax, [esp + 0x1a8]
push edx
push eax
call fcn.11ee0440
add esp, 0xc
jmp 0x11cd7eda
push 2
lea ecx, [esp + 0x3e4]
push ebx
lea edx, [esp + 0x1ac]
push ecx
push edx
call fcn.11edfab0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
cmp eax, ebx
jne 0x11cd818f
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x34], ebx
call fcn.11ee1ad0
add esp, 8
lea edx, [esp + 0x1a4]
lea ecx, [esp + 0x18]
mov edi, eax
push edx
xor esi, esi
call fcn.11e7eae0
push 0x1204c22c
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x1640], 0x4e
push eax
call fcn.11e7f9f0
lea ecx, [esp + 0x18]
mov byte [esp + 0x1638], 0x50
call fcn.11e7f280
push ebx
push ebx
lea ecx, [esp + 0x1ac]
push ebx
push ecx
mov ecx, 0x1212b5c0
call fcn.11d70510
test eax, eax
je 0x11cd7fb0
mov ecx, 0x1212b5c0
call fcn.11d71190
test eax, eax
je 0x11cd7fb0
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x1a4]
push ebx
push edx
call fcn.11d0c690
test eax, eax
je 0x11cd7fb0
cmp dword [0x12133f80], ebx
je 0x11cd7fab
mov ecx, dword [esp + 0x28]
mov eax, dword [0x12126854]
push 0x751
lea edx, [esp + 0x1a8]
push ecx
push edx
push eax
push str.__s__CSafeDoc::OnNtCreateFileW__s_:_IPGSDFile__s__is_Broken__line__d_
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
mov esi, 1
mov eax, dword [0x11fd6250]
mov dword [esp + 0x20], eax
cmp esi, ebx
mov byte [esp + 0x1638], 0x51
je 0x11cd7fd5
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
call fcn.11e7f410
jmp 0x11cd7fe6
lea edx, [esp + 0x1a4]
lea ecx, [esp + 0x20]
push edx
call fcn.11e7f500
mov eax, dword [esp + 0x20]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d69000
test eax, eax
jne 0x11cd801f
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd801f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ecx
push 2
push edi
push edx
mov ecx, 0x1212b158
call fcn.11dbfe50
cmp dword [0x12133f80], ebx
je 0x11cd8051
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov eax, dword [0x12126854]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push edi
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_Decrypt_file_failed___ESError:_d_LastError:__d_Line:_d__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x20
lea ecx, [esp + 0x20]
mov byte [esp + 0x1638], 0x50
call fcn.11e7f280
lea ecx, [esp + 0x28]
mov byte [esp + 0x1638], 0x22
call fcn.11e7f280
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x55
cmp eax, ebx
je 0x11cd80c2
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x54
cmp esi, ebx
je 0x11cd8116
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd810d
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x54
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd80e6
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x53
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x52
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
lea edx, [esp + 0x3e0]
lea ecx, [esp + 0xdc]
push edx
mov dword [esp + 0xb8], 1
call fcn.11e7f500
lea eax, [esp + 0x5e8]
lea ecx, [esp + 0xe0]
push eax
call fcn.11e7f500
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
mov esi, dword [esp + 0x44]
jmp 0x11cd9f21
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
cmp eax, ebx
je 0x11cd82fa
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x1638], 0x5b
cmp eax, ebx
je 0x11cd822d
push eax
call fcn.11e679b1
add esp, 4
mov esi, dword [esp + 0xe4]
mov byte [esp + 0x1638], 0x5a
cmp esi, ebx
je 0x11cd8281
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x11cd8278
lea edi, [eax]
lea ecx, [esi + 0x210]
mov byte [esp + 0x1638], 0x5a
call fcn.11d1b5d0
add esi, 0x220
dec edi
mov dword [esp + 0x18], esi
jne 0x11cd8251
mov esi, dword [esp + 0xe4]
push esi
call fcn.11e679b1
add esp, 4
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x59
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x58
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
push 0xffffffffffffffdd
lea ecx, [esp + 0x80]
mov dword [esp + 0x34], ebx
call fcn.11e15fa0
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x70], edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], eax
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x18]
push edx
or esi, 0xffffffff
push eax
mov byte [esp + 0x1644], 0x5e
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebx
je 0x11cd83ce
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
mov dword [ebp + 0x1c], ecx
mov ecx, dword [esp + 0x166c]
mov dword [ebp + 0x24], edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1658]
push edx
mov edx, dword [esp + 0x1658]
push 0x60
push 1
push 7
push 0x80
push ecx
mov esi, dword [ebp + 0xc]
push edx
mov edx, dword [esp + 0x1668]
lea ecx, [esp + 0x124]
or edx, 0x120089
push ecx
lea ecx, [esp + 0x40]
push edx
push ecx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x48]
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], eax
or esi, 0xffffffff
jmp 0x11cd8448
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x11cd8448
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1654]
push ecx
mov ecx, dword [esp + 0x1654]
push edx
push 0x60
push 1
push 7
push 0x80
push eax
mov eax, dword [esp + 0x1664]
lea edx, [esp + 0x120]
push ecx
or eax, 0x120089
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call edi
mov edx, dword [esp + 0x78]
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cd8448
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov eax, dword [esp + 0x78]
cmp dword [eax], ebx
jne 0x11cd8d05
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x38], ebx
call fcn.11edea90
add esp, 0x24
mov ecx, 0x1212b458
mov edi, eax
call fcn.11df4810
test eax, eax
je 0x11cd849b
cmp edi, ebx
je 0x11cd849b
lea edx, [esp + 0x1a4]
mov ecx, 0x1212b5c0
push edx
call fcn.11da9ea0
test eax, eax
jne 0x11cd8b1f
cmp dword [esp + 0x15c], ebx
jbe 0x11cd84c1
cmp edi, ebx
je 0x11cd84c5
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x1a4]
push eax
call fcn.11d13fa0
test eax, eax
jne 0x11cd8c0f
cmp edi, ebx
jne 0x11cd84e3
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push ecx
call fcn.11ee3690
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x11cd8541
mov dword [esp + 0x14], 1
lea edx, [esp + 0x1a4]
push ebx
push edx
mov ecx, 0x1212b5c0
mov dword [esp + 0xbc], 1
call fcn.11d6cd50
test eax, eax
je 0x11cd8e38
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], ebx
cmp eax, ebx
mov esi, 1
je 0x11cd87c4
cmp edi, 3
jne 0x11cd879b
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x40]
call fcn.11d0be80
mov esi, eax
jmp 0x11cd887f
mov al, byte [esp + 0x13c]
mov dword [esp + 0x60], esi
test al, 1
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x2c], ebx
jne 0x11cd8583
push ebx
lea edx, [esp + 0x30]
push ebx
push edx
lea eax, [esp + 0x1b0]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d6cfd0
test eax, eax
je 0x11cd8583
cmp dword [esp + 0x2c], ebx
jne 0x11cd8583
xor esi, esi
jmp 0x11cd8588
mov esi, 1
mov ecx, dword [esp + 0x1c]
push ebx
push 1
lea edx, [esp + 0x1ac]
push ecx
push edx
mov ecx, 0x1212b5c0
call fcn.11d6aae0
mov ecx, 0x121336e8
mov dword [esp + 0x9c], eax
call fcn.11cdab20
test eax, eax
je 0x11cd85e5
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x9c]
push eax
lea edx, [esp + 0x1a8]
push ecx
push edx
push 0x7e6
push str._CSafeDoc::OnNtCreateFile__Line:_d__File__s____lu___0x_lx_
push str.IPG_5089
push 4
call fcn.11ca5810
add esp, 0x1c
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1a4]
push eax
push ebx
push ebx
push ecx
mov ecx, 0x1212b5c0
call fcn.11d70510
mov edi, eax
mov ecx, 0x121336e8
mov dword [esp + 0x24], edi
call fcn.11cdab20
test eax, eax
je 0x11cd863f
push edi
lea edx, [esp + 0x1a8]
push 0x7ed
push edx
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s__line__lu__bConfigFile__lu__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
mov ecx, 0x1212b5c0
call fcn.11d8c8b0
test eax, eax
jne 0x11cd86b2
mov ecx, 0x1212b5c0
call fcn.11d71190
test eax, eax
je 0x11cd878f
cmp edi, ebx
je 0x11cd878f
lea eax, [esp + 0x150]
lea ecx, [esp + 0x1a4]
push eax
push ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xa0], 1
call fcn.11d0c690
mov ecx, dword [esp + 0x98]
mov dword [esp + 0xb4], eax
cmp ecx, ebx
je 0x11cd86b2
cmp eax, ebx
je 0x11cd86b2
mov ecx, 0x1212b5c0
call fcn.11d68400
cmp eax, 3
je 0x11cd86b2
xor esi, esi
mov edx, dword [esp + 0x1c]
push edx
call dword [0x1213494c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], ebx
cmp eax, ebx
je 0x11cd8747
call fcn.11dd84e0
test eax, eax
jne 0x11cd86ec
lea eax, [esp + 0x28]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d744b0
test eax, eax
je 0x11cd8747
cmp dword [esp + 0x28], ebx
je 0x11cd8747
lea ecx, [esp + 0x1a4]
push 1
push ecx
call fcn.11df9800
add esp, 8
test eax, eax
jne 0x11cd8716
lea edx, [esp + 0x1a4]
push edx
call fcn.11cbc4e0
add esp, 4
test eax, eax
je 0x11cd8747
mov ecx, 0x121336e8
xor esi, esi
call fcn.11cdab20
test eax, eax
je 0x11cd8747
lea eax, [esp + 0x1a4]
push eax
push 0x80a
push str._CSafeDoc::OnNtCreateFile__Line:_d__Only_Read_Mode__File__s__in_safe_disk.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov ecx, dword [esp + 0x74]
push ecx
mov ecx, 0x1212b5c0
call fcn.11d8dd30
test eax, eax
jne 0x11cd8cde
cmp esi, ebx
jne 0x11cd8d05
cmp dword [esp + 0x5c], ebx
jne 0x11cd889c
cmp dword [esp + 0x98], ebx
je 0x11cd8e2b
cmp dword [esp + 0xb4], ebx
je 0x11cd8e2b
jmp 0x11cd889c
mov dword [esp + 0x98], ebx
jmp 0x11cd86b2
cmp edi, 4
jne 0x11cd887f
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push ebx
push eax
push ecx
mov ecx, dword [esp + 0x48]
call fcn.11d0bfd0
mov esi, eax
jmp 0x11cd887f
cmp edi, 3
jne 0x11cd887f
lea ecx, [esp + 0x20]
call fcn.11e923e0
lea edx, [esp + 0x20]
push 1
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x40]
push ebx
lea eax, [esp + 0x1b8]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x1658], 0x65
call fcn.11d0bc10
mov esi, eax
cmp esi, ebx
jne 0x11cd886e
cmp dword [esp + 0x30], 0x2b
jne 0x11cd886e
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd8859
lea edx, [esp + 0x48]
lea eax, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x50], ebx
call fcn.11ee1ad0
mov ecx, dword [esp + 0x34]
add esp, 8
lea edx, [esp + 0x1a4]
push ecx
push edi
push eax
push edx
mov ecx, 0x1212b158
call fcn.11dbfe50
cmp dword [esp + 0x5c], ebx
je 0x11cd886e
mov eax, dword [esp + 0x1c]
mov ecx, 0x1212ae38
push eax
call fcn.11d2b2c0
lea ecx, [esp + 0x20]
mov byte [esp + 0x1638], 0x5e
call fcn.11e92540
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
cmp esi, ebx
je 0x11cd92b4
cmp dword [esp + 0x30], ebx
jne 0x11cd92f2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e2]
mov word [esp + 0x3e0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc02]
mov word [esp + 0xc00], bx
rep stosd dword es:[edi], eax
push ebx
lea edx, [esp + 0xc04]
stosw word es:[edi], ax
push 0x104
push edx
lea eax, [esp + 0x3ec]
push 0x104
lea ecx, [esp + 0x1b4]
push eax
push ecx
call fcn.11deefd0
add esp, 0x18
test eax, eax
je 0x11cd939e
cmp dword [esp + 0xb4], ebx
je 0x11cd89b5
cmp dword [esp + 0x98], ebx
je 0x11cd896f
lea edx, [esp + 0x1a4]
lea eax, [esp + 0x48]
push edx
push eax
call fcn.11d70b60
add esp, 8
push 2
lea ecx, [esp + 0x3e4]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x1644], 0x66
call fcn.11cdab00
push eax
call fcn.11edfab0
mov edi, eax
add esp, 0x10
neg edi
sbb edi, edi
lea ecx, [esp + 0x48]
inc edi
mov byte [esp + 0x1638], 0x5e
mov dword [esp + 0x30], edi
call fcn.11e7f280
jmp 0x11cd89d7
cmp dword [esp + 0x14], ebx
je 0x11cd8991
lea edx, [esp + 0x3e0]
push 0xffffffffffffffff
lea eax, [esp + 0x1a8]
push edx
push eax
call fcn.11ee0440
add esp, 0xc
jmp 0x11cd89d1
push 2
lea ecx, [esp + 0x3e4]
push ebx
lea edx, [esp + 0x1ac]
push ecx
push edx
call fcn.11edfab0
mov edi, eax
add esp, 0x10
neg edi
sbb edi, edi
inc edi
jmp 0x11cd89d3
push ebx
push 0xffffffffffffffff
lea eax, [esp + 0x3e8]
push ebx
lea ecx, [esp + 0x1b0]
push eax
push ecx
call fcn.11edfe80
add esp, 0x14
mov edi, eax
mov dword [esp + 0x30], edi
cmp edi, ebx
je 0x11cd946e
lea edx, [esp + 0x3e0]
lea ecx, [esp + 0xdc]
push edx
call fcn.11e7f500
lea eax, [esp + 0xc00]
lea ecx, [esp + 0xe0]
push eax
call fcn.11e7f500
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
mov ecx, ebp
call fcn.11cdaa60
mov ecx, ebp
mov esi, eax
call fcn.11cdaa80
mov ecx, ebp
mov dword [esp + 0x70], eax
call fcn.11cdaaa0
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x48], eax
mov ecx, ebp
je 0x11cd9776
call fcn.11cda9c0
mov ecx, dword [esp + 0x2c]
mov edi, eax
push ecx
mov ecx, ebp
call fcn.11cdaa70
mov edx, dword [esp + 0x14]
mov ecx, ebp
push edx
call fcn.11cdaa90
mov eax, dword [esp + 0x20]
mov ecx, ebp
push eax
call fcn.11cdaab0
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
mov ecx, dword [esp + 0x1664]
lea eax, [esp + 0x120]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
push edx
push ebp
call dword [esp + 0x78]
push esi
mov ecx, ebp
call fcn.11cdaa70
mov eax, dword [esp + 0x70]
mov ecx, ebp
push eax
call fcn.11cdaa90
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebp
call fcn.11cdaab0
push edi
mov ecx, ebp
call fcn.11cda9d0
jmp 0x11cd981c
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
mov edi, dword [esp + 0x1644]
mov edx, dword [edi]
push edx
call dword [0x1213494c]
mov dword [edi], esi
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1638], 0x62
call fcn.11d1b790
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1638], 0x61
call fcn.11d1b5f0
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1638], 0x60
call fcn.11e7f280
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1638], 0x5f
call fcn.11e7f280
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1638], 0xc
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], esi
lea ecx, [esp + 0x50]
call fcn.11e15fd0
mov eax, 0xc0000022
jmp 0x11cda986
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd8c3e
lea eax, [esp + 0x1a4]
push eax
push 0x7c0
push str._CSafeDoc::OnNtCreateFile__Line:_d__Decrypt_Large_File__s__Forbidden.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
mov edi, dword [esp + 0x1644]
mov edx, dword [edi]
push edx
call dword [0x1213494c]
mov dword [edi], esi
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], esi
lea ecx, [esp + 0x50]
call fcn.11e15fd0
mov eax, 0xc0000034
jmp 0x11cda986
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd8d05
mov eax, dword [esp + 0x74]
push eax
push str._CSafeDoc::OnNtCreateFile__open:THUMB_or_PREVIEW___x_
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
mov ecx, ebp
call fcn.11cdaa60
mov ecx, ebp
mov esi, eax
call fcn.11cdaa80
mov ecx, ebp
mov dword [esp + 0x70], eax
call fcn.11cdaaa0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x48], eax
mov ecx, ebp
je 0x11cd96bd
call fcn.11cda9c0
mov edi, eax
mov eax, dword [esp + 0x2c]
push eax
mov ecx, ebp
call fcn.11cdaa70
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.11cdaa90
mov edx, dword [esp + 0x24]
mov ecx, ebp
push edx
call fcn.11cdaab0
mov eax, dword [esp + 0x166c]
mov ecx, dword [esp + 0x1668]
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
push eax
mov eax, dword [esp + 0x1664]
lea edx, [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
push eax
push ecx
push ebp
call dword [esp + 0x78]
push esi
mov ecx, ebp
call fcn.11cdaa70
mov edx, dword [esp + 0x70]
mov ecx, ebp
push edx
call fcn.11cdaa90
mov eax, dword [esp + 0x18]
mov ecx, ebp
push eax
call fcn.11cdaab0
push edi
mov ecx, ebp
call fcn.11cda9d0
mov ecx, ebp
call fcn.11cdaa30
mov dword [esp + 0x28], eax
jmp 0x11cd9876
mov dword [esp + 0x60], 0xffffffff
jmp 0x11cd8a07
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd8e78
lea edx, [esp + 0x1a4]
mov ecx, 0x12126430
push edx
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_Not_In_Decrypt_file_list__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x14
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd8ead
lea eax, [esp + 0x1a4]
mov ecx, 0x12126430
push eax
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_Not_In_Decrypt_file_list__n
push str.OutlineProtect
push 8
call fcn.11ca5810
add esp, 0x14
mov ecx, ebp
call fcn.11cdaa60
mov ecx, ebp
mov esi, eax
call fcn.11cdaa80
mov ecx, ebp
mov dword [esp + 0x70], eax
call fcn.11cdaaa0
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x48], eax
mov ecx, ebp
je 0x11cd8fb7
call fcn.11cda9c0
mov ecx, dword [esp + 0x2c]
mov edi, eax
push ecx
mov ecx, ebp
call fcn.11cdaa70
mov edx, dword [esp + 0x14]
mov ecx, ebp
push edx
call fcn.11cdaa90
mov eax, dword [esp + 0x24]
mov ecx, ebp
push eax
call fcn.11cdaab0
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
mov ecx, dword [esp + 0x1664]
lea eax, [esp + 0x120]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
push edx
push ebp
call dword [esp + 0x78]
push esi
mov ecx, ebp
call fcn.11cdaa70
mov eax, dword [esp + 0x70]
mov ecx, ebp
push eax
call fcn.11cdaa90
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, ebp
call fcn.11cdaab0
push edi
mov ecx, ebp
call fcn.11cda9d0
jmp 0x11cd9060
call fcn.11cdaa50
mov esi, eax
cmp esi, ebx
je 0x11cd9060
mov ecx, ebp
call fcn.11cda9e0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
mov edx, dword [esp + 0x1664]
lea ecx, [esp + 0x120]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
push eax
call esi
push eax
mov ecx, ebp
call fcn.11cdaa40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebp
call fcn.11cda9f0
mov ecx, ebp
call fcn.11cda9b0
test eax, 0x800000
je 0x11cd9060
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, ebp
call fcn.11cdaa20
mov ecx, ebp
call fcn.11cdaa30
mov ecx, 0x1212b5c0
mov dword [esp + 0x28], eax
call fcn.11d811f0
test eax, eax
je 0x11cd92a3
cmp dword [esp + 0x5c], ebx
je 0x11cd92a3
mov ecx, dword [esp + 0x1644]
xor eax, eax
lea edi, [esp + 0x5ea]
lea edx, [esp + 0x5e8]
mov ebp, dword [ecx]
mov ecx, 0x81
mov word [esp + 0x5e8], bx
push 0x104
rep stosd dword es:[edi], eax
push edx
push ebp
stosw word es:[edi], ax
call fcn.11dba2c0
add esp, 0xc
test eax, eax
je 0x11cd91cb
lea eax, [esp + 0x5e8]
push 0x7e
push eax
call fcn.11cdaa00
add esp, 8
cmp eax, ebx
je 0x11cd9144
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x7f2]
mov word [esp + 0x7f0], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x7f0]
push 0x104
lea edx, [esp + 0x5ec]
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, ebx
jbe 0x11cd9144
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x5e8]
push 0x103
rep stosd dword es:[edi], eax
lea eax, [esp + 0x7f4]
lea ecx, [esp + 0x5ec]
push eax
push ecx
call fcn.11e674bf
add esp, 0xc
lea edx, [esp + 0x5e8]
lea eax, [esp + 0x1a4]
push edx
push eax
call fcn.11e67e01
add esp, 8
test eax, eax
je 0x11cd91cb
lea ecx, [esp + 0x5e8]
lea edx, [esp + 0x1a4]
push ecx
push edx
call fcn.11e67d22
add esp, 8
test eax, eax
jne 0x11cd91cb
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd91ae
lea eax, [esp + 0x5e8]
lea ecx, [esp + 0x1a4]
push eax
push ecx
push str.CSafeDoc::OnNtCreateFile__s_:_RealFileName__s__n
push str.OutlineProtect
push 4
call fcn.11ca5810
add esp, 0x14
lea edx, [esp + 0x5e8]
push 0x104
lea eax, [esp + 0x1a8]
push edx
push eax
call fcn.11e674bf
add esp, 0xc
lea ecx, [esp + 0x1a4]
push ecx
lea ecx, [esp + 0xdc]
call fcn.11e7f500
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd9214
lea edx, [esp + 0x1a4]
mov ecx, 0x12126430
push edx
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_Not_Decrypt__n
push str.OutlineProtect
push 4
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x18]
push 1
push eax
lea ecx, [esp + 0x12c]
call fcn.11e8c590
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x98]
push edx
mov byte [esp + 0x163c], 0x64
lea esi, [ecx + 0x14]
mov ecx, esi
call fcn.11d1b7a0
mov edi, eax
cmp edi, 0xffffffff
je 0x11cd928f
lea ecx, [esp + 0x8c]
call fcn.11cdaac0
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x8c]
mov dword [esp + 0x90], ecx
push edx
push edi
mov ecx, esi
mov dword [esp + 0x9c], eax
mov dword [esp + 0x94], ebp
call fcn.11d1bdd0
mov ecx, eax
add ecx, 0x5c
call fcn.11d1b640
lea ecx, [esp + 0x124]
mov byte [esp + 0x1638], 0x5e
call fcn.11e8c5f0
mov byte [esp + 0x1638], 0x1b
lea ecx, [esp + 0x7c]
jmp 0x11cd9871
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd8d05
lea eax, [esp + 0x1a4]
mov ecx, 0x12126430
push eax
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_CheckAccessRight_failed__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x14
jmp 0x11cd8d05
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd932c
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x1a4]
push ecx
push edx
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_No_Access_right__Error:_lu_n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x18
lea eax, [esp + 0x1a4]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d69000
test eax, eax
jne 0x11cd936b
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd936b
mov ecx, dword [esp + 0x30]
push ebx
push 2
lea edx, [esp + 0x1ac]
push ecx
push edx
mov ecx, 0x1212b158
call fcn.11dbfe50
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
mov eax, dword [esp + 0x1644]
mov dword [eax], 0xffffffff
mov dword [esp + 0x28], 0xc0000022
jmp 0x11cd9876
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd93da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1a8]
push eax
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_get_new_decrypt_path_failed____Error:__d__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x18
mov ecx, dword [esp + 0x1644]
mov dword [ecx], 0xffffffff
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, 0xc000000d
jmp 0x11cda986
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd94b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push ebx
call fcn.11ee1ad0
add esp, 8
lea edx, [esp + 0x1a8]
mov ecx, 0x12126430
push eax
push edx
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_Decrypt_file_failed___ESError:_d_LastError:__d__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
lea eax, [esp + 0x48]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x50], ebx
call fcn.11ee1ad0
add esp, 8
lea edx, [esp + 0x1a4]
lea ecx, [esp + 0x70]
mov edi, eax
push edx
xor esi, esi
call fcn.11e7eae0
push 0x1204c22c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x1640], 0x67
push eax
call fcn.11e7f9f0
lea ecx, [esp + 0x70]
mov byte [esp + 0x1638], 0x69
call fcn.11e7f280
push ebx
push ebx
lea ecx, [esp + 0x1ac]
push ebx
push ecx
mov ecx, 0x1212b5c0
call fcn.11d70510
test eax, eax
je 0x11cd958e
mov ecx, 0x1212b5c0
call fcn.11d71190
test eax, eax
je 0x11cd958e
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x1a4]
push ebx
push edx
call fcn.11d0c690
test eax, eax
je 0x11cd958e
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd9589
mov eax, dword [esp + 0x14]
push 0x901
lea ecx, [esp + 0x1a8]
push eax
push ecx
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFileW__s_:_IPGSDFile__s__is_Broken__line__d_
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
mov esi, 1
lea ecx, [esp + 0x20]
call fcn.11cdaae0
cmp esi, ebx
mov byte [esp + 0x1638], 0x6a
je 0x11cd95b3
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
push edx
call fcn.11e7f410
jmp 0x11cd95c4
lea eax, [esp + 0x1a4]
lea ecx, [esp + 0x20]
push eax
call fcn.11e7f500
push ebx
lea ecx, [esp + 0x24]
call fcn.11cdab00
push eax
mov ecx, 0x1212b5c0
call fcn.11d69000
test eax, eax
jne 0x11cd9607
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cd9607
mov ecx, dword [esp + 0x2c]
push ecx
push 2
push edi
lea ecx, [esp + 0x2c]
call fcn.11cdab00
push eax
mov ecx, 0x1212b158
call fcn.11dbfe50
mov edx, dword [esp + 0x1644]
lea ecx, [esp + 0x20]
mov dword [edx], 0xffffffff
mov byte [esp + 0x1638], 0x69
call fcn.11e7f280
lea ecx, [esp + 0x14]
mov byte [esp + 0x1638], 0x5e
call fcn.11e7f280
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, 0xc000000d
jmp 0x11cda986
call fcn.11cdaa50
mov esi, eax
cmp esi, ebx
je 0x11cd9766
mov ecx, ebp
call fcn.11cda9e0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
mov ecx, dword [esp + 0x1664]
lea eax, [esp + 0x120]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
push edx
call esi
push eax
mov ecx, ebp
call fcn.11cdaa40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebp
call fcn.11cda9f0
mov ecx, ebp
call fcn.11cda9b0
test eax, 0x800000
je 0x11cd9766
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, ebp
call fcn.11cdaa20
mov ecx, ebp
call fcn.11cdaa30
mov dword [esp + 0x28], eax
jmp 0x11cd9876
call fcn.11cdaa50
mov esi, eax
cmp esi, ebx
je 0x11cd981c
mov ecx, ebp
call fcn.11cda9e0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
mov edx, dword [esp + 0x1664]
lea ecx, [esp + 0x120]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
push eax
call esi
push eax
mov ecx, ebp
call fcn.11cdaa40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebp
call fcn.11cda9f0
mov ecx, ebp
call fcn.11cda9b0
test eax, 0x800000
je 0x11cd981c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, ebp
call fcn.11cdaa20
mov ecx, ebp
call fcn.11cdaa30
cmp eax, ebx
mov dword [esp + 0x28], eax
je 0x11cd98eb
cmp dword [esp + 0x30], ebx
je 0x11cd9876
push 0xffffffffffffffdd
lea ecx, [esp + 0x128]
call fcn.11e15fa0
push 1
lea ecx, [esp + 0xe0]
mov byte [esp + 0x163c], 0x6b
call fcn.11cdab00
push eax
call fcn.11dbb670
add esp, 8
mov byte [esp + 0x1638], 0x1b
lea ecx, [esp + 0x124]
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, dword [esp + 0x28]
jmp 0x11cda986
mov ecx, dword [esp + 0x1644]
mov esi, dword [esp + 0x44]
mov edx, dword [ecx]
mov dword [esp + 0x1c], edx
jmp 0x11cd9f21
mov eax, dword [esp + 0x20]
mov edi, 1
cmp eax, ebx
mov dword [esp + 0x2c], ebx
je 0x11cd9990
call fcn.11dd84e0
test eax, eax
jne 0x11cd9935
lea eax, [esp + 0x2c]
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d744b0
test eax, eax
je 0x11cd9990
cmp dword [esp + 0x2c], ebx
je 0x11cd9990
lea ecx, [esp + 0x1a4]
push 1
push ecx
call fcn.11df9800
add esp, 8
test eax, eax
jne 0x11cd995f
lea edx, [esp + 0x1a4]
push edx
call fcn.11cbc4e0
add esp, 4
test eax, eax
je 0x11cd9990
mov ecx, 0x121336e8
xor edi, edi
call fcn.11cdab20
test eax, eax
je 0x11cd9990
lea eax, [esp + 0x1a4]
push eax
push 0x95b
push str._CSafeDoc::OnNtCreateFile__Line:_d__Only_Read_Mode__File__s__in_safe_disk.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov ecx, dword [esp + 0x74]
push ecx
mov ecx, 0x1212b5c0
call fcn.11d8dd30
test eax, eax
je 0x11cd99cc
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd99ca
mov edx, dword [esp + 0x74]
push edx
push str._CSafeDoc::OnNtCreateFile__create:THUMB_or_PREVIEW___x_
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x10
xor edi, edi
cmp edi, ebx
mov dword [esp + 0x20], ebx
je 0x11cd9ce1
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
lea ecx, [esp + 0x1b0]
push ebx
push ecx
mov ecx, 0x1212b5c0
call fcn.11d6cfd0
test eax, eax
je 0x11cd9a00
cmp dword [esp + 0x20], ebx
je 0x11cd9ce1
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x1660]
cmp edx, eax
je 0x11cda563
mov eax, dword [esp + 0x1c]
push eax
call dword [0x1213494c]
cmp eax, ebx
je 0x11cd9a95
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
test byte [esp + 0x1658], 1
je 0x11cd9ab2
push 1
lea ecx, [esp + 0x1a8]
push ebx
push ecx
call fcn.11dbb440
add esp, 0xc
mov ecx, ebp
call fcn.11cdaa60
mov ecx, ebp
mov esi, eax
call fcn.11cdaa80
mov ecx, ebp
mov dword [esp + 0x70], eax
call fcn.11cdaaa0
mov dword [esp + 0x18], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
push esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x38], ebx
call fcn.11e15b00
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x48], eax
mov ecx, ebp
je 0x11cd9bbc
call fcn.11cda9c0
mov edx, dword [esp + 0x24]
mov ecx, ebp
push edx
mov edi, eax
call fcn.11cdaa70
mov eax, dword [esp + 0x14]
mov ecx, ebp
push eax
call fcn.11cdaa90
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebp
call fcn.11cdaab0
mov edx, dword [esp + 0x166c]
mov eax, dword [esp + 0x1668]
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
mov edx, dword [esp + 0x1664]
lea ecx, [esp + 0x120]
push eax
mov eax, dword [esp + 0x1664]
push ecx
push edx
push eax
push ebp
call dword [esp + 0x78]
push esi
mov ecx, ebp
call fcn.11cdaa70
mov ecx, dword [esp + 0x70]
push ecx
mov ecx, ebp
call fcn.11cdaa90
mov edx, dword [esp + 0x18]
mov ecx, ebp
push edx
call fcn.11cdaab0
push edi
mov ecx, ebp
call fcn.11cda9d0
jmp 0x11cd9c65
call fcn.11cdaa50
mov esi, eax
cmp esi, ebx
je 0x11cd9c65
mov ecx, ebp
call fcn.11cda9e0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x166c]
mov ecx, dword [esp + 0x1668]
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
push eax
mov eax, dword [esp + 0x1664]
lea edx, [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
push eax
push ecx
call esi
push eax
mov ecx, ebp
call fcn.11cdaa40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebp
call fcn.11cda9f0
mov ecx, ebp
call fcn.11cda9b0
test eax, 0x800000
je 0x11cd9c65
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, ebp
call fcn.11cdaa20
mov ecx, ebp
call fcn.11cdaa30
lea ecx, [esp + 0x40]
mov esi, eax
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, esi
jmp 0x11cda986
push ebx
push ebx
lea edx, [esp + 0x1ac]
push ebx
push edx
mov ecx, 0x1212b5c0
call fcn.11d70510
mov edi, eax
mov ecx, 0x121336e8
mov dword [esp + 0x24], edi
call fcn.11cdab20
test eax, eax
je 0x11cd9d37
push edi
lea eax, [esp + 0x1a8]
push 0x985
push eax
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s__line__lu__bConfigFile__lu__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
mov ecx, 0x1212b5c0
call fcn.11d8c8b0
test eax, eax
jne 0x11cd9daa
mov ecx, 0x1212b5c0
call fcn.11d71190
test eax, eax
je 0x11cd9eed
cmp edi, ebx
je 0x11cd9eed
lea ecx, [esp + 0x1a4]
lea edx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0xa0], 1
call fcn.11d70b60
add esp, 8
push 1
mov ecx, eax
mov byte [esp + 0x163c], 0x6c
call fcn.11cdab00
push eax
call fcn.11dbb670
add esp, 8
lea ecx, [esp + 0x48]
mov byte [esp + 0x1638], 0x1b
call fcn.11e7f280
mov ecx, 0x1212b5c0
call fcn.11d71320
test eax, eax
je 0x11cd9f21
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x7f2]
mov word [esp + 0x7f0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc02]
mov word [esp + 0xc00], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [esp + 0xc04]
push 0x104
push eax
lea ecx, [esp + 0x7fc]
push 0x104
lea edx, [esp + 0x1b4]
push ecx
push edx
call fcn.11deefd0
add esp, 0x18
test eax, eax
jne 0x11cd9ef9
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cd9e5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1a8]
push eax
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s_:_get_new_decrypt_path_failed____Error:__d__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x18
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
mov edx, dword [esp + 0x1644]
lea ecx, [esp + 0x40]
mov dword [edx], 0xffffffff
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, 0xc000000d
jmp 0x11cda986
mov dword [esp + 0x98], ebx
jmp 0x11cd9daa
lea eax, [esp + 0x7f0]
lea ecx, [esp + 0xdc]
push eax
call fcn.11e7f500
lea ecx, [esp + 0xc00]
push ecx
lea ecx, [esp + 0xe4]
call fcn.11e7f500
lea ecx, [esp + 0xdc]
call fcn.11cdaaf0
test eax, eax
jne 0x11cda351
push 0xffffffffffffffdd
lea ecx, [esp + 0x90]
call fcn.11e15fa0
cmp esi, ebx
mov byte [esp + 0x1638], 0x6d
jne 0x11cd9fc0
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x174]
mov dword [esp + 0x170], ebx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x170]
lea ecx, [esp + 0xdc]
push edx
call fcn.11cdab00
mov ecx, dword [esp + 0x3c]
push eax
call fcn.11d19950
test eax, eax
je 0x11cd9fc0
mov eax, dword [esp + 0x170]
mov ecx, dword [esp + 0x194]
mov edx, dword [esp + 0x184]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x188]
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xd0], edx
mov dword [esp + 0xd4], eax
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
push ecx
mov ecx, dword [esp + 0x1664]
lea eax, [esp + 0x120]
push edx
push eax
lea edx, [esp + 0x84]
push ecx
push edx
lea ecx, [esp + 0x108]
call fcn.11cdab00
push eax
mov eax, dword [esp + 0xb8]
push eax
call fcn.11cdab30
mov edi, eax
add esp, 0x34
cmp edi, ebx
je 0x11cda0f5
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x1213494c]
push 1
lea ecx, [esp + 0xe0]
call fcn.11cdab00
push eax
call fcn.11dbb670
mov edx, dword [esp + 0x164c]
add esp, 8
lea ecx, [esp + 0x8c]
mov dword [edx], 0xffffffff
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, edi
jmp 0x11cda986
mov ecx, dword [esp + 0x1644]
mov eax, dword [esp + 0x60]
xor esi, esi
mov dword [ecx], eax
lea ecx, [esp + 0x34]
call fcn.11e925e0
test eax, eax
jbe 0x11cda11c
lea ecx, [esp + 0x34]
call fcn.11e92ce0
mov esi, eax
lea ecx, [esp + 0x40]
xor ebp, ebp
call fcn.11e925e0
cmp eax, 0x14
jb 0x11cda137
lea ecx, [esp + 0x40]
call fcn.11e92ce0
mov ebp, eax
cmp dword [esp + 0x24], ebx
jne 0x11cda241
cmp dword [esp + 0xb4], ebx
je 0x11cda1b3
mov ecx, 0x1212b5c0
call fcn.11d68400
cmp eax, 2
jne 0x11cda1b3
push ebx
push ebx
lea edx, [esp + 0x1ac]
push ebx
push edx
mov ecx, 0x1212b5c0
call fcn.11d70510
mov ecx, 0x121336e8
mov edi, eax
call fcn.11cdab20
test eax, eax
je 0x11cda1ab
push edi
lea eax, [esp + 0x1a8]
push 0x9ef
push eax
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s__line__lu__bConfigFile__lu__check_again_n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
cmp edi, ebx
jne 0x11cda241
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cda1ee
push ebx
lea ecx, [esp + 0x1a8]
push 0x9f7
push ecx
mov ecx, 0x12126430
call fcn.11cdab10
push eax
push str.__s__CSafeDoc::OnNtCreateFile__s__line__lu__bConfigFile__lu__SetSafeDocOpened_n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x1c
mov ecx, 0x1212b5c0
call fcn.11d71180
push ebx
push ebp
push esi
mov ecx, 0x1212b5c0
mov edi, eax
call fcn.11d70d90
cmp edi, ebx
jne 0x11cda241
mov ecx, 0x1212b5c0
call fcn.11d68400
cmp eax, 2
jne 0x11cda241
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11cda241
push 1
lea edx, [esp + 0x1a8]
push 0x20001
push edx
mov ecx, 0x1212b158
call fcn.11dbff40
test byte [esp + 0x110], 2
je 0x11cda259
mov eax, dword [esp + 0x1c]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea ecx, [esp + 0xe0]
call fcn.11cdaaf0
test eax, eax
jne 0x11cda31a
mov ecx, 0x109
lea edi, [esp + 0xe0c]
mov edx, dword [esp + 0xc4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xb4]
mov eax, dword [esp + 0xc8]
mov dword [esp + 0xe08], ecx
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0xe14], eax
mov dword [esp + 0xe18], ecx
lea eax, [esp + 0x1a4]
mov dword [esp + 0xe0c], edx
mov edx, dword [esp + 0xd4]
lea ecx, [esp + 0x1028]
push eax
push ecx
mov dword [esp + 0xe18], ebx
mov dword [esp + 0xe24], edx
call fcn.11e6749a
add esp, 8
lea ecx, [esp + 0xdc]
call fcn.11cdab00
lea edx, [esp + 0xe20]
push eax
push edx
call fcn.11e6749a
add esp, 8
lea eax, [esp + 0xe08]
lea ecx, [esp + 0xe0]
push eax
call fcn.11cdab00
push eax
call fcn.11def260
add esp, 8
cmp dword [esp + 0x44], ebx
je 0x11cda33d
cmp dword [esp + 0x3c], ebx
je 0x11cda33d
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x3b8]
push 0x28
push ecx
push edx
call fcn.11dbb400
add esp, 0xc
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1638], 0x1b
call fcn.11e15fd0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x9fa]
mov word [esp + 0x9f8], bx
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x1c]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x9fc]
push eax
push esi
call fcn.11dba2c0
add esp, 0xc
test eax, eax
je 0x11cda492
lea ecx, [esp + 0x9f8]
push 0x7e
push ecx
call fcn.11cdaa00
add esp, 8
cmp eax, ebx
je 0x11cda40b
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x7f2]
mov word [esp + 0x7f0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x7f0]
push 0x104
lea eax, [esp + 0x9fc]
push edx
push eax
call fcn.11caf570
add esp, 0xc
test eax, eax
je 0x11cda40b
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x9f8]
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x7f4]
lea edx, [esp + 0x9fc]
push ecx
push edx
call fcn.11e674bf
add esp, 0xc
lea eax, [esp + 0x9f8]
lea ecx, [esp + 0x1a4]
push eax
push ecx
call fcn.11e67e01
add esp, 8
test eax, eax
je 0x11cda492
lea edx, [esp + 0x9f8]
lea eax, [esp + 0x1a4]
push edx
push eax
call fcn.11e67d22
add esp, 8
test eax, eax
jne 0x11cda492
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cda475
lea ecx, [esp + 0x9f8]
lea edx, [esp + 0x1a4]
push ecx
push edx
push str.CSafeDoc::OnNtCreateFile__s_:_RealFileName__s__n
push str.SafeDoc
push 8
call fcn.11ca5810
add esp, 0x14
lea eax, [esp + 0x9f8]
push 0x104
lea ecx, [esp + 0x1a8]
push eax
push ecx
call fcn.11e674bf
add esp, 0xc
lea edx, [esp + 0x1a4]
lea ecx, [esp + 0xd8]
push edx
call fcn.11e7f500
mov eax, dword [esp + 0x18]
push 1
push eax
lea ecx, [esp + 0x3b4]
call fcn.11e8c590
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x98]
push edx
mov byte [esp + 0x163c], 0x6e
lea edi, [ecx + 0x14]
mov ecx, edi
call fcn.11d1b7a0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x11cda521
lea ecx, [esp + 0x8c]
call fcn.11cdaac0
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x8c]
mov dword [esp + 0x90], ecx
push edx
push ebx
mov ecx, edi
mov dword [esp + 0x9c], eax
mov dword [esp + 0x94], esi
call fcn.11d1bdd0
mov ecx, eax
add ecx, 0x5c
call fcn.11d1b640
test byte [esp + 0x74], 6
je 0x11cda54f
mov ecx, 0x121336e8
call fcn.11cdab20
test eax, eax
je 0x11cda54f
mov eax, dword [esp + 0x74]
push eax
push str._CSafeDoc::OnNtCreateFile__Mapping_add:THUMB_or_PREVIEW___x_
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x3ac]
mov byte [esp + 0x1638], 0x1b
call fcn.11e8c5f0
lea ecx, [esp + 0x40]
mov byte [esp + 0x1638], 0x1a
call fcn.11e92540
lea ecx, [esp + 0x34]
mov byte [esp + 0x1638], 0x19
call fcn.11e92540
lea ecx, [esp + 0x98]
mov byte [esp + 0x1638], 0xc
call fcn.11cdac20
lea ecx, [esp + 0x10]
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
xor eax, eax
jmp 0x11cda986
mov eax, dword [0x12133f80]
test eax, eax
je 0x11cda5fe
mov ecx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile__:_File__s__Access_Denied__n
push str.ImageViewer
push 4
call fcn.11ca5810
add esp, 0x14
mov edx, dword [esp + 0x1644]
lea ecx, [esp + 0x10]
mov dword [edx], 0xffffffff
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8bfc
mov eax, dword [0x12133f80]
test eax, eax
je 0x11cda665
mov ecx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeDoc::OnNtCreateFile___Path__s__Access_Denied_n
push str.OutlineProtect
push 4
call fcn.11ca5810
add esp, 0x14
mov edx, dword [esp + 0x1644]
lea ecx, [esp + 0x10]
mov dword [edx], 0xffffffff
mov byte [esp + 0x1638], 1
call fcn.11e7f280
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
mov dword [esp + 0x1638], 0xffffffff
jmp 0x11cd8bfc
lea ecx, [esp + 0x50]
call fcn.11e16060
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x48], eax
lea edx, [esp + 0x88]
mov dword [esp + 0x70], ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
push eax
xor edi, edi
push ecx
push esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x98], edi
call fcn.11e15b00
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, edi
je 0x11cda77a
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x88]
mov dword [ebp + 0x1c], edx
mov edx, dword [esp + 0x166c]
mov dword [ebp + 0x24], ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
mov edi, dword [ebp + 0xc]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push ebx
push edx
push ecx
push ebp
mov dword [ebp + 0x20], eax
call eax
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x70]
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0xc], edi
jmp 0x11cda7fd
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x11cda7fd
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x166c]
mov edx, dword [esp + 0x1668]
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1660]
push ecx
mov ecx, dword [esp + 0x1660]
push edx
push ebx
push eax
push ecx
call esi
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
test eax, 0x800000
je 0x11cda7fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x28], eax
mov ebp, dword [ebp + 0x14]
lea ecx, [esp + 0x64]
mov byte [esp + 0x1638], 0
call fcn.11e15fd0
lea ecx, [esp + 0x50]
mov dword [esp + 0x1638], 0xffffffff
call fcn.11e15fd0
mov eax, ebp
jmp 0x11cda986
mov esi, dword [esp + 0x1640]
lea ecx, [esp + 0x88]
push ecx
xor ebp, ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x74], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x40]
push edx
push eax
push edi
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x98], ebp
call fcn.11e15b00
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebp
je 0x11cda900
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x88]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x166c]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1668]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x1668]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push ebx
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x70]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], ebp
jmp 0x11cda983
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11cda983
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x166c]
mov ecx, dword [esp + 0x1668]
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1664]
push eax
mov eax, dword [esp + 0x1664]
push ecx
mov ecx, dword [esp + 0x1664]
push edx
mov edx, dword [esp + 0x1660]
push eax
mov eax, dword [esp + 0x1660]
push ecx
push ebx
push edx
push eax
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11cda983
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x1630]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x162c
ret 0x30