Function at 0x421c70
Capabilities:
Check if file exists
Get disk information
Get disk size
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d46b
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10150
call fcn.0043c8d0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4574c0]
mov dword [ebp - 0x10054], eax
mov eax, dword [0x4574c8]
push 0x30
mov dword [ebp - 0x10084], eax
lea eax, [ebp - 0x100b8]
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0x10080], 0
lea eax, [ebp - 0x10020]
mov dword [ebp - 0x1005c], 0
mov dword [ebp - 0x10068], 0
mov dword [ebp - 0x1007c], 0
push 0x10000
push 0
push eax
call fcn.0042a4e0
mov ax, word [0x4574e0]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
xorps xmm0, xmm0
mov word [ebp - 0x1c], ax
xor edi, edi
xor eax, eax
movq qword [ebp - 0x10148], xmm0
push 0x40848
push eax
push dword [0x45764c]
mov dword [ebp - 0x10060], edi
mov dword [ebp - 0x1a], 0x5c003a
mov word [ebp - 0x16], ax
movq qword [ebp - 0x10150], xmm0
movups xmmword [ebp - 0x10048], xmm0
mov dword [ebp - 0x10064], eax
movups xmmword [ebp - 0x10038], xmm0
movq qword [ebp - 0x10028], xmm0
movq qword [ebp - 0x100cc], xmm0
movq qword [ebp - 0x10160], xmm0
movq qword [ebp - 0x10158], xmm0
call esi
mov dword [ebp - 0x10070], eax
test eax, eax
je 0x421ddc
push 0x300
push edi
push dword [0x45764c]
mov dword [ebp - 0x10098], 0x20
call esi
mov dword [ebp - 0x100a0], eax
test eax, eax
mov dword [ebp - 0x10090], eax
mov eax, dword [ebp - 0x10070]
jne 0x421ded
push eax
push edi
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x45771c], 8
xor al, al
jmp 0x423355
mov dword [ebp - 0x10058], eax
lea eax, [ebp - 0x100c4]
push eax
push 0x104
push 0x457720
push 0x400
push 0
push dword [0x45631c]
mov dword [ebp - 0x100c4], str.7_Zip_SFX_Tool
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
sub esp, 8
lea ecx, [ebp - 0x10140]
push 0x457720
push dword [0x45633c]
sub esp, 8
push 0x457720
call fcn.00402d80
lea ecx, [ebp - 0x10140]
mov dword [ebp - 4], 0
call fcn.00402fd0
push 0x4037c0
push 0xfa
push 0x65
push dword [ebp - 0x10138]
lea eax, [ebp - 0x10140]
mov dword [0x45754c], eax
call dword [sym.imp.USER32.dll_SetTimer]
movzx ecx, byte [ebp - 0x10102]
test eax, eax
lea eax, [ebp - 0x100bc]
mov dword [ebp - 0x100bc], 0
mov edx, 1
mov dword [ebp - 0x100c0], 0
push eax
cmovne ecx, edx
push 0x2000e
mov byte [ebp - 0x10102], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x421ece
xor eax, eax
jmp 0x421ef1
lea eax, [ebp - 0x100c0]
push eax
push 2
push dword [ebp - 0x100bc]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0x100bc]
call esi
mov eax, dword [ebp - 0x100c0]
mov dword [ebp - 0x1009c], eax
mov eax, 1
mov dword [ebp - 0x100a8], 0xffffffff
mov dword [ebp - 0x100a4], 0xffffffff
mov dword [0x45771c], 0
mov dword [ebp - 0x1006c], eax
cmp dword [ebp - 0x10054], eax
jbe 0x42261a
nop dword [eax]
mov ecx, dword [ebp - 0x10084]
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x1013c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x4225d9
mov eax, dword [ebp - 0x10098]
cmp dword [ebp - 0x10094], eax
jne 0x421fa4
add eax, eax
mov dword [ebp - 0x10098], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push dword [ebp - 0x100a0]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x10090], eax
test eax, eax
je 0x42261a
mov ecx, dword [ebp - 0x10094]
mov dword [ebp - 0x100a0], eax
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*8]
mov dword [ebp - 0x10090], eax
cmp word [esi], 0x2f
jne 0x42227e
movzx eax, word [esi + 2]
cmp eax, 0x37
jne 0x422033
movzx eax, word [esi + 4]
cmp eax, 0x5a
je 0x421fc9
cmp eax, 0x7a
jne 0x42227e
movzx eax, word [esi + 6]
cmp eax, 0x53
je 0x421fdb
cmp eax, 0x73
jne 0x42227e
movzx eax, word [esi + 8]
cmp eax, 0x50
je 0x421fed
cmp eax, 0x70
jne 0x42227e
movzx eax, word [esi + 0xa]
cmp eax, 0x4c
je 0x421fff
cmp eax, 0x6c
jne 0x42227e
movzx eax, word [esi + 0xc]
cmp eax, 0x49
je 0x422011
cmp eax, 0x69
jne 0x42227e
movzx eax, word [esi + 0xe]
cmp eax, 0x54
je 0x422023
cmp eax, 0x74
jne 0x42227e
cmp word [esi + 0x10], 0
je 0x42252c
jmp 0x42227e
cmp eax, 0x41
je 0x42203d
cmp eax, 0x61
jne 0x422064
movzx ecx, word [esi + 4]
cmp ecx, 0x52
je 0x42204b
cmp ecx, 0x72
jne 0x422064
cmp word [esi + 6], 0
jne 0x422064
cmp dword [0x4574d4], 0
je 0x423373
jmp 0x42227e
cmp eax, 0x41
je 0x422072
cmp eax, 0x61
jne 0x422207
cmp word [esi + 4], 0x3d
jne 0x422207
lea edi, [esi + 6]
mov byte [ebp - 0x1004d], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10078], xmm0
test edi, edi
je 0x4221f2
movzx eax, word [edi]
test ax, ax
je 0x4221f2
cmp ax, 9
je 0x422156
cmp ax, 0x20
je 0x422156
cmp ax, 0xd
je 0x422156
cmp ax, 0xa
je 0x422156
mov ecx, 0xa0
cmp ax, cx
je 0x422156
cmp ax, 0xc
je 0x422156
cmp ax, 0xb
je 0x422156
mov ecx, 0x85
cmp ax, cx
je 0x422156
mov ecx, 0x2028
cmp ax, cx
je 0x422156
mov ecx, 0x2029
cmp ax, cx
je 0x422156
mov ecx, 0x202f
cmp ax, cx
je 0x422156
mov ecx, 0x1680
cmp ax, cx
je 0x422156
mov ecx, 0x180e
cmp ax, cx
je 0x422156
mov ecx, 0x1fff
cmp ax, cx
jbe 0x422138
mov ecx, 0x200c
cmp ax, cx
jb 0x422156
mov ecx, 0x3000
cmp ax, cx
je 0x422156
mov ecx, 0xfeff
cmp ax, cx
je 0x422156
mov ecx, 0x205f
cmp ax, cx
jne 0x422162
movzx eax, word [edi + 2]
add edi, 2
jmp 0x4220a6
cmp ax, 0x2b
je 0x422178
movzx ecx, ax
cmp ax, 0x2d
jne 0x42217f
mov byte [ebp - 0x1004d], 1
movzx ecx, word [edi + 2]
add edi, 2
mov esi, dword [ebp - 0x10078]
cmp cx, 0x30
jb 0x4221d9
movzx edx, cx
mov ecx, dword [ebp - 0x10074]
cmp dx, 0x39
ja 0x4221d9
mov eax, esi
mov dword [ebp - 0x10074], ecx
shld ecx, eax, 2
shl eax, 2
add esi, eax
movzx eax, dx
cdq
adc dword [ebp - 0x10074], ecx
mov ecx, dword [ebp - 0x10074]
shld ecx, esi, 1
add esi, esi
add esi, eax
movzx eax, word [edi + 2]
adc ecx, edx
sub esi, 0x30
mov edx, eax
sbb ecx, 0
add edi, 2
cmp eax, 0x30
jae 0x422194
mov eax, esi
neg eax
cmp byte [ebp - 0x1004d], 0
cmove eax, esi
or dword [ebp - 0x10080], eax
jmp 0x42252c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
or dword [ebp - 0x10080], eax
jmp 0x42252c
cmp eax, 0x46
je 0x422211
cmp eax, 0x66
jne 0x42227e
cmp word [esi + 4], 0x3d
jne 0x42227e
test di, di
jne 0x42227e
lea edi, [esi + 6]
mov ecx, edi
movzx eax, word [ecx]
cmp eax, 0x20
je 0x42222f
cmp eax, 9
jne 0x422234
add ecx, 2
jmp 0x422222
test ax, ax
je 0x42227e
test edi, edi
je 0x42225b
push 0x457630
mov edx, 0x7fff
mov ecx, edi
call fcn.00402470
test eax, eax
js 0x42225b
movzx eax, word [0x457630]
jmp 0x422278
mov dword [0x457630], 0
test edi, edi
je 0x422276
cmp word [edi], 0
je 0x422276
mov eax, 0x7fff
jmp 0x422278
xor eax, eax
mov dword [ebp - 0x10060], eax
push ecx
lea eax, [ebp - 0x1007c]
mov ecx, esi
push eax
lea edx, [ebp - 0x10070]
call fcn.00404830
add esp, 8
test al, al
je 0x42252c
mov ecx, dword [ebp - 0x10090]
mov ax, word [0x457638]
mov edi, dword [ebp - 0x10070]
push 0
push 0x2000080
push 3
mov word [ecx + 4], ax
mov ecx, dword [ebp - 0x1007c]
mov eax, dword [ebp - 0x10090]
sub ecx, edi
push 0
push 7
push 0x120089
sar ecx, 1
push edi
mov word [eax + 6], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x422309
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42252c
cmp dword [0x4574d4], 0
je 0x423379
jmp 0x42252c
mov eax, dword [ebp - 0x10090]
push 0x23
mov dword [ebp - 0x100cc], 0
push 8
and dword [eax], 0x7fffffff
lea eax, [ebp - 0x100cc]
push eax
lea eax, [ebp - 0x10150]
push eax
push esi
call dword [0x4576d0]
test eax, eax
jns 0x422393
push 4
push 0x28
lea eax, [ebp - 0x10048]
push eax
lea eax, [ebp - 0x10150]
push eax
push esi
call dword [0x4576d0]
test eax, eax
js 0x422523
mov eax, dword [ebp - 0x10028]
mov dword [ebp - 0x100cc], eax
mov ax, word [edi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4223a3
cmp eax, 2
je 0x4223a3
mov eax, dword [ebp - 0x10090]
or dword [eax], 0x80000000
jmp 0x4223a3
test dword [ebp - 0x100cc], 0x410
jne 0x422523
cmp dword [ebp - 0x10064], 0
jne 0x42240b
mov eax, dword [ebp - 0x10090]
cmp dword [eax], 0
movzx eax, word [0x4574e0]
jl 0x4223c2
movzx eax, word [edi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x10158]
push eax
lea eax, [ebp - 0x10160]
push eax
lea eax, [ebp - 0x100a8]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x422403
mov eax, dword [ebp - 0x100a8]
or eax, dword [ebp - 0x100a4]
je 0x422403
mov dword [ebp - 0x10064], 1
jmp 0x42240b
xor eax, eax
mov dword [ebp - 0x10064], eax
mov eax, dword [ebp - 0x10090]
cmp dword [eax], 0
jl 0x422441
cmp dword [0x4574d4], 0
jne 0x422441
movzx eax, word [eax + 6]
mov edx, edi
mov ecx, dword [ebp - 0x1009c]
push 0x120156
push eax
call fcn.00403fc0
add esp, 8
test al, al
je 0x422550
mov edx, dword [ebp - 0x10080]
mov ecx, esi
shr edx, 3
push 2
and dl, 1
call fcn.00414f20
add esp, 4
test eax, eax
jne 0x422469
cmp dword [0x457638], eax
je 0x422523
mov eax, dword [ebp - 0x10090]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [ebp - 0x10090]
mov ecx, dword [ebp - 0x100f0]
mov eax, dword [ebp - 0x100ec]
add ecx, dword [edx + 8]
mov dword [ebp - 0x100f0], ecx
adc eax, dword [edx + 0xc]
mov dword [ebp - 0x100ec], eax
cmp eax, dword [ebp - 0x100a4]
ja 0x42257d
jb 0x4224b8
cmp ecx, dword [ebp - 0x100a8]
ja 0x42257d
movzx eax, word [edx + 4]
lea eax, [eax*2 + 0xa]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x10090]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x10090]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x422571
movzx eax, word [eax + 4]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.0043c9e0
add esp, 0xc
add dword [ebp - 0x100e0], 1
adc dword [ebp - 0x100dc], 0
inc dword [ebp - 0x100b4]
add dword [ebp - 0x10090], 0x18
inc dword [ebp - 0x10094]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0x1006c]
inc eax
mov dword [ebp - 0x1006c], eax
cmp eax, dword [ebp - 0x10054]
jae 0x42261a
mov edi, dword [ebp - 0x10060]
jmp 0x421f30
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
cmp dword [0x4574d4], 0
je 0x423379
mov dword [0x45771c], 5
jmp 0x42258f
mov dword [0x45771c], 8
jmp 0x42258f
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov dword [0x45771c], 1
cmp byte [ebp - 0x10102], 0
je 0x4225a3
lea ecx, [ebp - 0x10140]
call fcn.004036e0
sub esp, 8
lea ecx, [ebp - 0x10140]
call fcn.00403080
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x45771c]
lea ecx, [ebp - 0x10140]
push 0x5dc
call fcn.00403330
jmp 0x42330b
push 0x65
push dword [ebp - 0x10138]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x1013c]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x10102], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x1013c]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x423305
cmp dword [ebp - 0x100e0], 0
je 0x423305
mov ecx, dword [ebp - 0x100ec]
mov eax, dword [ebp - 0x100f0]
test ecx, ecx
jne 0x422648
cmp eax, 0x63
ja 0x422648
mov dword [ebp - 0x100d8], 1
jmp 0x422659
push 0
push 0x64
push ecx
push eax
call fcn.0043d1d0
mov dword [ebp - 0x100d8], eax
push 0x65
push dword [ebp - 0x10138]
mov dword [ebp - 0x10100], 1
mov dword [ebp - 0x100fc], 0
mov byte [ebp - 0x10101], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x1013c]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x10102], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x1013c]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
cmp byte [ebp - 0x10107], 0
je 0x4226ed
mov eax, dword [ebp - 0x10134]
mov byte [ebp - 0x10107], 0
test eax, eax
je 0x4226ed
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000000
push 0xfffffffffffffff0
push dword [ebp - 0x10134]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x45754c]
mov ecx, dword [esi + 0x60]
call fcn.00428880
push 0x14
push 0x457550
mov dword [ebp - 0x10088], eax
push dword [esi + 0x54]
push dword [esi + 0x50]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
push 0x20
push str.7_Zip_SFX_Tool:
push 0x457720
mov dword [ebp - 0x10084], eax
call fcn.0043c9e0
add esp, 0xc
lea eax, [ebp - 0x10088]
push eax
push 0xf4
push 0x457740
push 0x400
push 0
push dword [0x4563bc]
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x1013c]
push 0
push 0
push 0x457720
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x10140], eax
mov eax, dword [ebp - 0x1013c]
push 0
mov byte [ebp - 0x10101], 1
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x100e0]
mov dword [ebp - 0x10140], eax
mov eax, dword [ebp - 0x100a0]
mov dword [ebp - 0x1007c], ecx
mov dword [ebp - 0x10090], eax
test ecx, ecx
je 0x4232e8
mov eax, dword [ebp - 0x1013c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x4232e8
mov edx, dword [ebp - 0x10090]
push 0
push 1
mov byte [ebp - 0x1004d], 1
movzx esi, word [edx + 4]
movzx ecx, word [edx + 6]
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x10084], ecx
movzx edi, ax
mov eax, dword [edx + 0x10]
movzx ecx, cx
mov dword [ebp - 0x10060], esi
mov dword [ebp - 0x10064], edi
lea edx, [eax + ecx*2]
mov eax, dword [ebp - 0x1013c]
push edx
push 2
push eax
mov ecx, dword [eax]
mov dword [ebp - 0x1006c], edx
call dword [ecx + 0x28]
movzx ecx, di
mov edi, 1
mov dword [ebp - 0x10140], eax
lea edx, [ecx + ecx]
mov dword [ebp - 0x10074], edx
add edx, dword [ebp - 0x1006c]
test ecx, ecx
je 0x422852
movzx eax, word [edx - 2]
sub edx, 2
cmp eax, 0x2e
je 0x422852
cmp eax, 0x5c
je 0x422852
cmp eax, 0x2f
je 0x422852
inc edi
sub ecx, 1
jne 0x422836
xor ecx, ecx
movzx eax, di
cmp word [edx], 0x2e
cmove ecx, eax
movzx eax, cx
mov ecx, dword [ebp - 0x10090]
mov dword [ebp - 0x10054], eax
cmp dword [ecx], 0
jge 0x4228cf
mov edi, dword [0x4576b4]
movzx esi, di
add esi, esi
push esi
push dword [0x4574d0]
push dword [ebp - 0x10058]
call fcn.0043c9e0
mov eax, dword [ebp - 0x10074]
add esp, 0xc
add eax, 2
push eax
mov eax, dword [ebp - 0x10058]
push dword [ebp - 0x1006c]
add eax, esi
push eax
call fcn.0043c9e0
mov eax, dword [ebp - 0x10064]
add esp, 0xc
add eax, edi
movzx esi, ax
movzx eax, di
mov dword [ebp - 0x10060], esi
mov dword [ebp - 0x10084], eax
jmp 0x4228eb
movzx eax, si
lea eax, [eax*2 + 2]
push eax
push dword [ecx + 0x10]
push dword [ebp - 0x10058]
call fcn.0043c9e0
add esp, 0xc
mov eax, dword [ebp - 0x10054]
movzx ecx, ax
push 0
push 0x2000080
movzx eax, si
sub eax, ecx
mov dword [ebp - 0x1006c], ecx
push 3
add eax, eax
push 0
mov dword [ebp - 0x10074], eax
mov eax, dword [ebp - 0x10090]
push 7
push 0x120089
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1004c], edi
cmp edi, 0xffffffff
je 0x422a5c
push 2
mov dl, 1
mov ecx, edi
call fcn.00414f20
add esp, 4
mov dword [ebp - 0x10064], eax
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp word [ebp - 0x10054], 4
mov ecx, dword [ebp - 0x10074]
jne 0x4229a7
mov eax, dword [ebp - 0x10058]
movzx edx, word [ecx + eax + 2]
cmp edx, 0x53
je 0x42297f
cmp edx, 0x73
jne 0x4229a7
movzx eax, word [ecx + eax + 4]
cmp eax, 0x46
je 0x42298e
cmp eax, 0x66
jne 0x4229a7
mov eax, dword [ebp - 0x10058]
movzx eax, word [ecx + eax + 6]
cmp eax, 0x58
je 0x4229a3
cmp eax, 0x78
jne 0x4229a7
mov al, 1
jmp 0x4229a9
xor al, al
mov edx, dword [ebp - 0x10064]
test edx, edx
jne 0x422a7a
cmp dword [0x457638], edx
je 0x422a5c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10074]
mov edi, dword [ebp - 0x10058]
movq xmm0, qword [str..sfx]
push edi
movq qword [ecx + edi], xmm0
mov ax, word [0x44d0ac]
mov word [ecx + edi + 8], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42321d
cmp eax, 0x10
je 0x42321d
push 0
push 0x2000080
push 3
push 0
push 7
push 0x120089
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1004c], edi
cmp edi, 0xffffffff
je 0x422a5c
lea eax, [ebp - 0x10148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x422a5c
cmp dword [ebp - 0x10144], 0
jne 0x422a5c
mov eax, dword [ebp - 0x10148]
mov dword [ebp - 0x10064], eax
test eax, eax
jne 0x422f2a
xor edi, edi
mov esi, dword [ebp - 0x1004c]
test esi, esi
je 0x423210
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x423216
test al, al
jne 0x422f2a
mov eax, dword [ebp - 0x10090]
cmp edx, dword [eax + 8]
jne 0x422a97
cmp dword [eax + 0xc], 0
je 0x422f2a
mov edx, dword [ebp - 0x10058]
mov eax, dword [0x44d0b0]
mov edi, dword [ebp - 0x10080]
mov dword [ecx + edx], eax
mov eax, dword [0x44d0b4]
mov dword [ecx + edx + 4], eax
and edi, 2
jne 0x422af7
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422af1
mov ecx, dword [ebp - 0x10058]
mov edx, esi
push 0x80e8
call fcn.00404280
movzx esi, word [0x457638]
mov edx, eax
add esp, 4
mov dword [ebp - 0x10058], edx
mov dword [ebp - 0x10060], esi
jmp 0x422af7
mov edx, dword [ebp - 0x10058]
movq xmm0, qword [str..txt]
movzx eax, si
sub eax, dword [ebp - 0x1006c]
movq qword [edx + eax*2], xmm0
lea ecx, [edx + eax*2]
mov ax, word [0x44d0c0]
mov word [ecx + 8], ax
test edi, edi
jne 0x422b5c
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422b56
mov ecx, dword [ebp - 0x10058]
mov edx, esi
push 0x80e8
call fcn.00404280
movzx esi, word [0x457638]
mov edx, eax
add esp, 4
mov dword [ebp - 0x10058], edx
mov dword [ebp - 0x10060], esi
jmp 0x422b5c
mov edx, dword [ebp - 0x10058]
movq xmm0, qword [str..sfx]
movzx eax, si
sub eax, dword [ebp - 0x1006c]
movq qword [edx + eax*2], xmm0
lea ecx, [edx + eax*2]
mov ax, word [0x44d0ac]
mov word [ecx + 8], ax
test edi, edi
jne 0x422bc1
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422bbb
mov ecx, dword [ebp - 0x10058]
mov edx, esi
push 0x80e8
call fcn.00404280
mov edx, eax
add esp, 4
movzx eax, word [0x457638]
mov dword [ebp - 0x10058], edx
mov dword [ebp - 0x10060], eax
jmp 0x422bc1
mov edx, dword [ebp - 0x10058]
push 0
push 0xa000080
push 2
push 0
push 7
push 0x120116
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x10054], edi
cmp edi, 0xffffffff
je 0x422a5e
mov esi, dword [ebp - 0x10064]
mov edi, 0xffff
nop word [eax + eax]
push 0
cmp esi, 0xffff
lea eax, [ebp - 0x1005c]
mov ecx, esi
push eax
cmovae ecx, edi
lea eax, [ebp - 0x10020]
mov edi, ecx
push edi
push eax
push dword [ebp - 0x1004c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423205
mov eax, dword [ebp - 0x1005c]
cmp edi, eax
jne 0x423205
push 0
lea ecx, [ebp - 0x10068]
push ecx
push eax
lea eax, [ebp - 0x10020]
push eax
push dword [ebp - 0x10054]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423205
mov eax, dword [ebp - 0x10068]
cmp dword [ebp - 0x1005c], eax
jne 0x423205
sub esi, eax
jne 0x422c00
push dword [ebp - 0x10054]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10060]
mov edx, dword [ebp - 0x10058]
movq xmm0, qword [str..txt]
push esi
push 0xa000080
movzx eax, cx
sub eax, dword [ebp - 0x1006c]
push 2
push esi
lea ecx, [edx + eax*2]
movq qword [ecx], xmm0
mov ax, word [0x44d0c0]
push 7
push 0x120116
push edx
mov dword [ebp - 0x10084], ecx
mov word [ecx + 8], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x10054], edi
cmp edi, 0xffffffff
je 0x422a5e
mov edi, dword [ebp - 0x1004c]
push esi
push esi
push dword [ebp - 0x10064]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10060], esi
nop
push 0
lea eax, [ebp - 0x1005c]
push eax
push 0xffff
lea eax, [ebp - 0x10020]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422dbf
mov edx, dword [ebp - 0x1005c]
test edx, edx
je 0x422dbf
mov ecx, edx
lea eax, [ebp - 0x10020]
nop word [eax + eax]
test ecx, ecx
je 0x422d4f
cmp byte [eax], 0x37
je 0x422d4f
inc eax
sub ecx, 1
jne 0x422d44
cmp ecx, 6
jb 0x422d8d
cmp byte [eax], 0x37
jne 0x422d77
cmp byte [eax + 1], 0x7a
jne 0x422d77
cmp byte [eax + 2], 0xbc
jne 0x422d77
cmp byte [eax + 3], 0xaf
jne 0x422d77
cmp byte [eax + 4], 0x27
jne 0x422d77
cmp byte [eax + 5], 0x1c
je 0x422d7f
inc eax
sub ecx, 1
jne 0x422d40
jmp 0x422da9
mov eax, dword [ebp - 0x10060]
mov esi, edx
sub esi, ecx
add esi, eax
jmp 0x422daf
push 1
push 0
push 0xfffffffffffffff9
sub edx, 7
push edi
mov dword [ebp - 0x1005c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x1005c]
mov eax, dword [ebp - 0x10060]
add eax, edx
mov dword [ebp - 0x10060], eax
test esi, esi
je 0x422d00
push 0
push 0
push dword [ebp - 0x10064]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, 0xffff
test esi, esi
je 0x422e5b
nop dword [eax]
cmp esi, 0xffff
mov eax, esi
push 0
cmovae eax, edi
mov edi, eax
lea eax, [ebp - 0x1005c]
push eax
push edi
lea eax, [ebp - 0x10020]
push eax
push dword [ebp - 0x1004c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423205
mov eax, dword [ebp - 0x1005c]
cmp edi, eax
jne 0x423205
push 0
lea ecx, [ebp - 0x10068]
push ecx
push eax
lea eax, [ebp - 0x10020]
push eax
push dword [ebp - 0x10054]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423205
mov eax, dword [ebp - 0x10068]
cmp dword [ebp - 0x1005c], eax
jne 0x423205
sub esi, eax
jne 0x422de0
push dword [ebp - 0x10054]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x10084]
mov eax, dword [0x44d0b0]
push 0
push 0xa000080
push 2
push 0
push 7
push 0x120116
push dword [ebp - 0x10058]
mov dword [ecx], eax
mov eax, dword [0x44d0b4]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x422a5e
push 0
lea eax, [ebp - 0x1005c]
push eax
push 0xffff
lea eax, [ebp - 0x10020]
push eax
push dword [ebp - 0x1004c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422a5e
mov eax, dword [ebp - 0x1005c]
test eax, eax
je 0x422f0c
push 0
lea ecx, [ebp - 0x10068]
push ecx
push eax
lea eax, [ebp - 0x10020]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x422a5e
mov eax, dword [ebp - 0x1005c]
cmp eax, dword [ebp - 0x10068]
jne 0x422a5e
cmp eax, 0xffff
je 0x422ea7
push dword [ebp - 0x1004c]
call esi
push edi
call esi
mov byte [ebp - 0x1004d], 0
jmp 0x42321d
mov edx, dword [ebp - 0x10058]
mov ecx, dword [ebp - 0x10074]
mov eax, dword [0x44d0b0]
push edx
mov dword [ecx + edx], eax
mov eax, dword [0x44d0b4]
mov dword [ecx + edx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422a5c
cmp eax, 0x10
je 0x422a5c
mov edx, dword [ebp - 0x10058]
mov ecx, dword [ebp - 0x10074]
movq xmm0, qword [str..txt]
push edx
movq qword [ecx + edx], xmm0
mov ax, word [0x44d0c0]
mov word [ecx + edx + 8], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422a5c
cmp eax, 0x10
je 0x422a5c
test byte [ebp - 0x10080], 2
mov ecx, dword [ebp - 0x10074]
mov edx, dword [ebp - 0x10058]
movq xmm0, qword [str..exe]
movq qword [ecx + edx], xmm0
mov ax, word [0x44d0cc]
mov word [ecx + edx + 8], ax
jne 0x422ff8
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422ff8
sub esi, dword [ebp - 0x10054]
mov ecx, dword [ebp - 0x10058]
push 0x80e8
lea edx, [esi + 4]
call fcn.00404280
add esp, 4
mov dword [ebp - 0x10058], eax
mov eax, dword [ebp - 0x10084]
mov esi, dword [ebp - 0x10058]
mov ecx, dword [ebp - 0x1013c]
push 0
movzx eax, ax
push 1
mov edx, dword [ecx]
lea eax, [esi + eax*2]
push eax
push 2
push ecx
call dword [edx + 0x28]
push 0
push 0xa000080
push 2
push 0
push 7
push 0x120116
push esi
mov dword [ebp - 0x10140], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10054], eax
cmp eax, 0xffffffff
je 0x423205
mov ecx, dword [ebp - 0x10064]
mov esi, 0xffff
test ecx, ecx
je 0x4230e6
nop
cmp ecx, 0xffff
mov eax, ecx
push 0
cmovae eax, esi
mov esi, eax
lea eax, [ebp - 0x1005c]
push eax
push esi
lea eax, [ebp - 0x10020]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423205
mov eax, dword [ebp - 0x1005c]
cmp esi, eax
jne 0x423205
push 0
lea ecx, [ebp - 0x10068]
push ecx
push eax
lea eax, [ebp - 0x10020]
push eax
push dword [ebp - 0x10054]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423205
mov eax, dword [ebp - 0x10068]
cmp dword [ebp - 0x1005c], eax
jne 0x423205
mov ecx, dword [ebp - 0x10064]
sub ecx, eax
mov dword [ebp - 0x10064], ecx
jne 0x423060
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10090]
sub esp, 8
mov esi, dword [ebp - 0x10074]
movq xmm0, qword [str..txt]
mov edi, dword [ebp - 0x10054]
mov ecx, dword [eax + 0x10]
movq qword [ecx + esi], xmm0
mov ax, word [0x44d0c0]
mov word [ecx + esi + 8], ax
mov ecx, edi
mov edx, dword [ebp - 0x10090]
mov edx, dword [edx + 0x10]
call fcn.00421670
add esp, 8
test eax, eax
je 0x423210
mov eax, dword [ebp - 0x10090]
push 0
push 0xa000080
push 3
mov ecx, dword [eax + 0x10]
mov eax, dword [0x44d0b0]
push 0
push 7
mov dword [ecx + esi], eax
mov eax, dword [0x44d0b4]
mov dword [ecx + esi + 4], eax
mov eax, dword [ebp - 0x10090]
push 0x120089
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1004c], esi
cmp esi, 0xffffffff
je 0x422a64
push 0
lea eax, [ebp - 0x1005c]
push eax
push 0xffff
lea eax, [ebp - 0x10020]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422a64
mov eax, dword [ebp - 0x1005c]
test eax, eax
je 0x4231e4
push 0
lea ecx, [ebp - 0x10068]
push ecx
push eax
lea eax, [ebp - 0x10020]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x422a64
mov eax, dword [ebp - 0x1005c]
cmp eax, dword [ebp - 0x10068]
jne 0x422a64
cmp eax, 0xffff
je 0x423184
push dword [ebp - 0x1004c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov byte [ebp - 0x1004d], 0
jmp 0x42321d
mov edi, dword [ebp - 0x10054]
jmp 0x422a5e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x42321d
push edi
call esi
mov esi, dword [ebp - 0x10090]
mov ecx, dword [ebp - 0x100e8]
mov eax, dword [ebp - 0x100e4]
push 0
add ecx, dword [esi + 8]
push dword [ebp - 0x100d8]
mov dword [ebp - 0x100e8], ecx
adc eax, dword [esi + 0xc]
push eax
push ecx
mov dword [ebp - 0x100e4], eax
call fcn.0043d1d0
mov dword [ebp - 0x100f8], eax
mov dword [ebp - 0x100f4], edx
cmp edx, dword [ebp - 0x100fc]
jb 0x42327f
ja 0x42326e
cmp eax, dword [ebp - 0x10100]
jbe 0x42327f
lea ecx, [ebp - 0x10140]
call fcn.004031a0
mov esi, dword [ebp - 0x10090]
add dword [ebp - 0x100e0], 0xffffffff
adc dword [ebp - 0x100dc], 0xffffffff
cmp byte [ebp - 0x1004d], 0
je 0x4232ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x1007c]
cmp edi, 1
mov dword [0x45771c], eax
sete cl
movzx ecx, cl
push ecx
push eax
push 0x3e8
lea ecx, [ebp - 0x10140]
call fcn.00403330
mov esi, dword [ebp - 0x10090]
jmp 0x4232d0
mov edi, dword [ebp - 0x1007c]
dec edi
add esi, 0x18
mov dword [ebp - 0x1007c], edi
mov dword [ebp - 0x10090], esi
test edi, edi
jne 0x4227b1
lea ecx, [ebp - 0x10140]
mov byte [ebp - 0x100f8], 0x64
call fcn.004031a0
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x10070]
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 8
lea ecx, [ebp - 0x100b8]
call fcn.00403870
add esp, 8
lea ecx, [ebp - 0x10140]
call fcn.00403270
cmp dword [0x45771c], 0
lea ecx, [ebp - 0x10140]
sete byte [ebp - 0x1004d]
call fcn.00402f30
mov al, byte [ebp - 0x1004d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov edi, dword [ebp - 0x10070]
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
lea edx, [ebp - 0x100b8]
lea ecx, [ebp - 0x10140]
call fcn.00403910
int3