Function at 0x428ccb
Capabilities:
Clear file content
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x67c
mov eax, dword [0x42e0b4]
xor eax, esp
mov dword [esp + 0x678], eax
or dword [esp + 4], 0xffffffff
lea eax, [esp + 0x2c]
push ebx
push esi
push edi
mov ebx, 0x104
mov dword [esp + 0x30], edx
xor esi, esi
mov byte [esp + 0x244], 1
push ebx
push esi
push eax
mov edi, ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x24c], esi
mov dword [esp + 0x254], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x670], esi
lea eax, [esp + 0x468]
mov byte [esp + 0x674], 1
mov dword [esp + 0x678], ebx
push ebx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x458], esi
lea eax, [esp + 0x250]
mov byte [esp + 0x45c], 1
mov dword [esp + 0x460], ebx
push ebx
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x44]
add esp, 0xc
cmp byte [esp + 0x244], al
sete al
dec eax
and eax, 0x7ee3
add eax, ebx
push eax
call fcn.0040e3f0
test eax, eax
js 0x4294a7
xor eax, eax
lea ecx, [esp + 0x468]
cmp byte [esp + 0x674], al
sete al
dec eax
and eax, 0x7ee3
add eax, ebx
push eax
call fcn.0040e3f0
test eax, eax
js 0x4294a7
xor eax, eax
lea ecx, [esp + 0x250]
cmp byte [esp + 0x45c], al
sete al
dec eax
and eax, 0x7ee3
add eax, ebx
push eax
call fcn.0040e3f0
test eax, eax
js 0x4294a7
push esi
lea eax, [esp + 0x18]
mov ecx, 0xfe00
push eax
call fcn.0041522c
mov dword [esp + 0x20], eax
test eax, eax
je 0x4294a7
cmp dword [0x436708], esi
je 0x428e3f
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push 1
push eax
mov ecx, ebx
mov dword [esp + 0x24], ebx
call fcn.0041522c
mov dword [esp + 0x2c], eax
test eax, eax
je 0x4294a7
cmp ebx, dword [esp + 0x28]
jb 0x428e47
mov eax, dword [esp + 0x28]
jmp 0x428e43
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov ebx, dword [edi + 0x20]
mov dword [esp + 0x28], ebx
mov ecx, dword [ebx]
call fcn.00407334
test eax, eax
jne 0x428e69
mov ebx, dword [ebx + 0x20]
mov dword [esp + 0x28], ebx
test ebx, ebx
jne 0x428e4e
jmp 0x429482
mov edx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push dword [ebx + 0x18]
mov ecx, fcn.004159d0
push esi
push 0x21
call fcn.0041589a
mov edi, dword [esp + 0x1c]
and dword [ebx + 0x1c], 0xffff3fff
mov eax, dword [ebx + 0x1c]
test al, 4
je 0x428e9b
and eax, 0xfffffffb
or eax, 2
mov dword [ebx + 0x1c], eax
cmp dword [0x43259c], esi
jne 0x429476
mov edx, dword [esp + 0x670]
test edx, edx
jne 0x428eb9
lea edx, [esp + 0x468]
push dword [esp + 0x678]
mov ecx, ebx
call fcn.00414d28
cmp eax, 1
je 0x429476
push dword [ebx + 4]
push 0x402280
call fcn.00409950
mov eax, dword [esp + 0x248]
pop ecx
pop ecx
test eax, eax
jne 0x428eee
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x30]
mov ecx, ebx
push esi
push dword [esp + 0x24c]
push eax
call fcn.00413cd0
cmp eax, 1
je 0x429476
mov edx, dword [esp + 0x240]
mov eax, edx
test edx, edx
jne 0x428f1c
lea eax, [esp + 0x38]
cmp word [eax], si
je 0x429374
test edx, edx
jne 0x428f2d
lea edx, [esp + 0x38]
mov ecx, dword [ebx + 4]
call fcn.004295f2
mov ecx, dword [ebx + 4]
test eax, eax
je 0x428f55
push edi
push dword [esp + 0x24]
mov edx, ebx
call fcn.004294e0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
jmp 0x42918c
mov edx, dword [ebx + 0x1c]
push ecx
and edx, 0x800
push ecx
shl edx, 0xa
call fcn.0041654b
mov edi, eax
cmp edi, 0xffffffff
je 0x42946b
mov ecx, edi
call fcn.0040dd98
test eax, eax
je 0x428f89
mov ecx, 0x80
mov dword [esp + 0x1c], ecx
jmp 0x428f8d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x240]
test eax, eax
jne 0x428f9c
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x20]
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x2c]
push ebx
push eax
push ecx
mov ecx, edi
call fcn.00414ca0
mov dword [esp + 0x34], eax
cmp dword [0x4367a8], esi
jne 0x429465
mov ecx, dword [esp + 0x240]
test ecx, ecx
jne 0x428fd2
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x240]
test al, 2
jne 0x429017
test ecx, ecx
jne 0x428fec
lea ecx, [esp + 0x38]
call fcn.00415643
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x429458
push eax
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
mov ecx, dword [esp + 0x10]
jmp 0x429033
test ecx, ecx
jne 0x42901f
lea ecx, [esp + 0x38]
push ecx
xor edx, edx
push ecx
inc edx
call fcn.0041654b
mov ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0xffffffff
je 0x429458
cmp dword [0x4367a0], esi
je 0x4290c8
cmp dword [esp + 0x24], esi
jle 0x4290bc
mov eax, dword [esp + 0x240]
test eax, eax
jne 0x42905d
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x20]
push edi
push eax
push dword [esp + 0x2c]
call fcn.00429809
mov ecx, dword [esp + 0x10]
cmp dword [0x436708], esi
je 0x4290bc
call fcn.0040dd98
test eax, eax
jne 0x4290b8
mov edx, dword [esp + 0x240]
test edx, edx
jne 0x429090
lea edx, [esp + 0x38]
push dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push dword [esp + 0x24]
push dword [esp + 0x2c]
call fcn.00428b6c
cmp eax, 1
je 0x4293ed
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
jmp 0x4290bc
mov ecx, dword [esp + 0x10]
cmp dword [0x4367a0], esi
jne 0x42917b
mov eax, dword [esp + 0x34]
jmp 0x4290d2
mov ecx, dword [esp + 0x10]
cmp eax, 1
jne 0x42917b
mov eax, dword [esp + 0x240]
test eax, eax
jne 0x4290ea
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x20]
push edi
push eax
push dword [esp + 0x2c]
call fcn.00429809
mov ecx, dword [esp + 0x10]
cmp dword [0x436708], esi
je 0x429149
call fcn.0040dd98
test eax, eax
jne 0x429145
mov edx, dword [esp + 0x240]
test edx, edx
jne 0x42911d
lea edx, [esp + 0x38]
push dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push dword [esp + 0x24]
push dword [esp + 0x2c]
call fcn.00428b6c
cmp eax, 1
je 0x429410
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
jmp 0x429149
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x240]
test eax, eax
jne 0x429158
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x20]
push eax
push ecx
push ebx
lea eax, [esp + 0x30]
mov ecx, edi
push eax
push dword [esp + 0x2c]
call fcn.00414ca0
cmp dword [0x4367a0], esi
je 0x4290ce
mov ecx, edi
mov dword [0x4367a0], esi
call fcn.0040a16c
mov edi, dword [esp + 0x1c]
mov ebx, dword [ebx + 0x20]
mov dword [0x43670c], esi
test ebx, ebx
je 0x429360
mov eax, dword [ebx + 0x1c]
test al, 4
je 0x4291ad
and eax, 0xfffffffb
or eax, 2
mov dword [ebx + 0x1c], eax
mov ecx, dword [esp + 0x458]
test ecx, ecx
jne 0x4291bf
lea ecx, [esp + 0x250]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x460]
push dword [eax + 4]
push dword [ebx]
call fcn.00413719
test eax, eax
je 0x4291e1
push esi
push eax
call fcn.004063bd
jmp 0x4291fe
mov eax, dword [esp + 0x458]
test eax, eax
jne 0x4291f3
lea eax, [esp + 0x250]
push eax
push 0x402280
call fcn.00409950
pop ecx
pop ecx
mov ecx, dword [esp + 0x458]
test ecx, ecx
jne 0x429212
lea ecx, [esp + 0x250]
call fcn.00407334
test eax, eax
je 0x429351
mov edx, dword [esp + 0x240]
test edx, edx
jne 0x42922e
lea edx, [esp + 0x38]
mov ecx, dword [esp + 0x458]
test ecx, ecx
jne 0x429240
lea ecx, [esp + 0x250]
call fcn.004295f2
test eax, eax
je 0x42925b
push esi
push 0x2340
call fcn.004063bd
pop ecx
pop ecx
jmp 0x429351
mov ecx, dword [esp + 0x458]
test ecx, ecx
jne 0x42926d
lea ecx, [esp + 0x250]
push ecx
push ecx
xor edx, edx
call fcn.0041654b
mov edi, eax
cmp edi, 0xffffffff
je 0x42943c
mov ecx, edi
call fcn.0040dd98
test eax, eax
je 0x429334
mov ecx, 0x80
mov dword [esp + 0x1c], ecx
jmp 0x429338
mov eax, dword [esp + 0x240]
test eax, eax
jne 0x4292ad
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x20]
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x2c]
push ebx
push eax
push ecx
mov ecx, edi
call fcn.00414ca0
test eax, eax
je 0x429344
mov eax, dword [esp + 0x240]
test eax, eax
jne 0x4292d7
lea eax, [esp + 0x38]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push edi
push eax
push dword [esp + 0x2c]
call fcn.00429809
cmp dword [0x436708], esi
je 0x429334
mov ecx, dword [esp + 0x10]
call fcn.0040dd98
test eax, eax
jne 0x429334
mov edx, dword [esp + 0x240]
test edx, edx
jne 0x42930e
lea edx, [esp + 0x38]
push dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push dword [esp + 0x24]
push dword [esp + 0x2c]
call fcn.00428b6c
cmp eax, 1
je 0x429426
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
cmp dword [0x4367a0], esi
je 0x42929e
mov ecx, edi
mov dword [0x4367a0], esi
call fcn.0040a16c
mov ebx, dword [ebx + 0x20]
test ebx, ebx
jne 0x42919d
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
mov ecx, ebx
mov edx, dword [esp + 0x30]
push esi
push dword [esp + 0x14]
call fcn.00414c40
push dword [esp + 0x18]
mov edx, dword [ebx + 0x18]
mov ecx, fcn.004159d0
push 0x21
call fcn.00415851
test al, al
jne 0x428e84
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
mov eax, dword [esp + 0x458]
mov dword [esp + 0x458], esi
test eax, eax
je 0x4293b2
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x670]
mov dword [esp + 0x670], esi
test eax, eax
je 0x4293cc
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x240]
mov dword [esp + 0x240], esi
test eax, eax
je 0x4293e6
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
jmp 0x4294cb
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
mov ecx, edi
call fcn.0040a16c
mov ecx, dword [esp + 0x14]
call fcn.0040a16c
xor edx, edx
xor ecx, ecx
inc edx
call fcn.00428c50
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
mov ecx, edi
call fcn.0040a16c
mov ecx, dword [esp + 0x14]
jmp 0x429401
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
mov ecx, edi
call fcn.0040a16c
mov ecx, dword [esp + 0x14]
jmp 0x429401
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
mov ecx, dword [esp + 0x10]
call fcn.0040a16c
push 0x6e
pop ecx
call fcn.00429edb
jmp 0x429406
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
mov ecx, edi
jmp 0x429449
mov ecx, dword [esp + 0x18]
jmp 0x42945c
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
jmp 0x42944e
mov ecx, dword [esp + 0x18]
call fcn.00408b4d
xor esi, esi
inc esi
lea ecx, [esp + 0x250]
call fcn.004161e6
lea ecx, [esp + 0x468]
call fcn.004161e6
lea ecx, [esp + 0x38]
call fcn.004161e6
mov eax, esi
jmp 0x4294cb
lea ecx, [esp + 0x250]
call fcn.004161e6
lea ecx, [esp + 0x468]
call fcn.004161e6
lea ecx, [esp + 0x38]
call fcn.004161e6
xor eax, eax
inc eax
mov ecx, dword [esp + 0x684]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416b30
mov esp, ebp
pop ebp
ret