Function at 0x423512
Capabilities:
Check if file exists
Clear file content
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
mov ebx, eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 1
test byte [edx + 0x168], 4
je 0x422650
cmp dword [ebx + 0x80], 0
jne 0x422650
cmp dword [ebx + 0x2c], 0
je 0x424c68
cmp dword [ebx + 0xa4], 0
je 0x422662
mov byte [ebp - 0x13c], 0
jmp 0x4226a9
mov esi, dword [ebx + 0x58]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x38], esi
lea esi, [ebp - 0x24]
mov dword [esp + 0xc], esi
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x2c], edx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], edi
call fcn.0042125c
test eax, eax
je 0x4226a9
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x13c]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4226c6
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4226b1
dec eax
mov edx, dword [ebp - 4]
movsx esi, ax
add esi, 0xa
mov word [edx + 0x152], ax
lea ecx, [edx + 0x60]
push ecx
push 0
push esi
mov dword [ebp - 0x158], ecx
call fcn.004085a0
add esp, 0xc
test eax, eax
je 0x4226fc
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x13c]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x422708
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
or edx, dword [eax + 0x9c]
jne 0x422737
mov dword [eax + 0x98], 1
mov dword [eax + 0x9c], 0
cmp dword [ebx + 0x44], 0
je 0x42275b
or byte [eax + 0x169], 0x40
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0x80000000
or byte [eax + 0x16f], 0x10
jmp 0x422769
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0xc0000000
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x425953
cmp eax, 2
je 0x422818
cmp eax, 1
jne 0x4227b4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x15c], 0
or byte [eax + 0x169], 0x40
mov edx, dword [ebp - 0x20]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x42283e
cmp eax, 3
jne 0x4227f5
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x4229bf
mov dword [ebp - 0x15c], 0
or byte [eax + 0x16e], 1
mov edx, dword [ebp - 0x20]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x42283e
mov edx, dword [ebp - 4]
mov eax, 0x2ed
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x422814
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x4229bf
xor eax, eax
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0xc0000000
mov dword [ebp - 0x15c], eax
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x422916
cmp eax, 2
je 0x4228f0
cmp eax, 1
jne 0x42288c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x15c], 0
or byte [eax + 0x169], 0x40
mov edx, dword [ebp - 0x20]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x422916
cmp eax, 3
jne 0x4228cd
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x4229bf
mov dword [ebp - 0x15c], 0
or byte [eax + 0x16e], 1
mov edx, dword [ebp - 0x20]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x422916
mov edx, dword [ebp - 4]
mov eax, 0x23b
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x4228ec
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x4229bf
xor eax, eax
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0xc0000000
mov dword [ebp - 0x15c], eax
mov eax, dword [ebx]
cmp eax, 5
ja case.default.0x422928
mov eax, dword [eax*4 + 0x4ced30]
jmp eax
mov eax, dword [ebp - 4]
or byte [eax + 0x16b], 4
and byte [eax + 0x168], 0x7b
jmp case.0x422928.0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 0x10
mov byte [edx + 0x16b], al
jmp 0x42299a
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x4229bf
mov edx, eax
movzx eax, byte [edx + 0x16b]
or eax, 3
mov byte [edx + 0x16b], al
jmp 0x42299a
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 8
mov byte [edx + 0x16b], al
jmp 0x42299a
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 2
mov byte [edx + 0x16b], al
mov edx, dword [ebx + 0x58]
cmp edx, 5
ja case.default.0x4229ad
mov edx, dword [edx*4 + 0x4ced48]
jmp edx
test al, 1
je 0x4229d1
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
jne 0x4229d1
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
or dword [ebp - 0x18], 2
or dword [ebp - 0x14], 0x4000002
or byte [eax + 0x16a], 4
jmp 0x422a80
test al, 1
je 0x422a0d
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
jne 0x422a0d
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
or dword [ebp - 0x18], 1
jmp 0x422a80
mov eax, dword [ebp - 4]
or byte [eax + 0x16a], 2
or dword [ebp - 0x18], 3
jmp 0x422a80
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je case.0x4229ad.4
push str.USER
lea eax, [ebp - 0x13c]
push eax
call fcn.00466cc0
add esp, 8
test eax, eax
jne case.0x4229ad.4
mov eax, dword [ebp - 4]
or byte [eax + 0x16a], 8
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
je 0x422a66
test byte [eax + 0x168], 4
je 0x422a6f
test byte [eax + 0x16f], 0x10
je case.0x4229ad.5
or byte [eax + 0x16a], 2
or dword [ebp - 0x18], 3
jmp 0x422a80
or dword [ebp - 0x18], 4
mov eax, dword [ebx + 0x28]
cmp eax, 6
ja case.default.0x422bfd
mov eax, dword [eax*4 + 0x4ced60]
jmp eax
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 4
je case.0x422a93.2
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16a]
test al, 4
jne 0x4229bf
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x16a], al
jmp case.0x422a93.0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16a]
test al, 4
jne 0x4229bf
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x16a], al
jmp case.0x422a93.0
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x4229bf
mov edx, eax
movzx eax, byte [edx + 0x16a]
or eax, 8
mov byte [edx + 0x16a], al
mov edx, dword [ebx + 0x28]
cmp edx, 5
jne 0x422b2e
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x16a], al
jmp case.0x422a93.0
cmp edx, 6
jne case.0x422a93.0
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x16a], al
jmp case.0x422a93.0
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 4
je case.0x422a93.0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x34]
cmp eax, 4
ja case.default.0x422b72
mov eax, dword [eax*4 + 0x4ced7c]
jmp eax
mov eax, dword [ebp - 4]
or byte [eax + 0x170], 2
jmp 0x422bdf
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x168]
test edx, 0x80
jne 0x422bcc
or byte [eax + 0x16a], 0x80
jmp 0x422bdf
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
test al, 8
jne 0x422bb1
test al, 0x10
jne 0x422bb1
test al, 4
je case.0x422b72.1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x168]
test edx, 0x80
jne 0x422bcc
or byte [eax + 0x16a], 0x80
jmp 0x422bdf
or byte [eax + 0x170], 1
jmp 0x422bdf
mov eax, dword [ebp - 4]
or byte [eax + 0x16a], 0x40
mov edx, eax
mov eax, dword [ebx + 0x4c]
mov byte [edx + 0x154], al
mov edx, dword [ebx + 0x4c]
cmp edx, 8
ja case.default.0x422bfd
mov edx, dword [edx*4 + 0x4ced90]
jmp edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
jne 0x422c24
test dl, 0x10
jne 0x422c24
test dl, 4
jne 0x422c24
mov edx, dword [ebp - 4]
test byte [edx + 0x16a], 0x40
je case.0x422bfd.0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 4
mov eax, 4
jmp case.0x422bfd.0
mov edx, dword [ebp - 4]
test byte [edx + 0x16b], 4
je case.0x422bfd.0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov byte [ecx + 0x156], dl
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x4258d0
cmp edx, 1
je 0x422cdd
cmp edx, 2
jne 0x422cb6
mov edx, ecx
test byte [edx + 0x16b], 4
jne 0x4229bf
test byte [edx + 0x16a], 0x40
je 0x422cec
movsx edx, al
cmp edx, 5
jl 0x422cec
cmp edx, 8
jg 0x422cec
mov edx, ecx
mov byte [edx + 0x156], 3
jmp 0x422cec
cmp edx, 3
je 0x422cec
mov edx, ecx
mov eax, 0x2f2
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x422cd9
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, ecx
test byte [edx + 0x16b], 4
jne 0x4229bf
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x4258a9
cmp edx, 1
je 0x422d6a
cmp edx, 2
jne 0x422d1d
mov eax, dword [ebp - 4]
test byte [eax + 0x16b], 0x10
jne 0x4229bf
mov byte [eax + 0x155], 2
jmp 0x422db4
cmp edx, 3
jne case.default.0x422bfd
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
jne 0x4229bf
test dl, 1
jne 0x4229bf
test dl, 4
jne 0x4229bf
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x155], 3
mov ecx, 3
jmp 0x422daf
mov eax, 0x30
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
je 0x422d97
movsx ecx, al
cmp ecx, 1
je 0x422d97
test ecx, ecx
je 0x422d97
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
test dl, 0x10
jne 0x4229bf
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x155], 1
mov ecx, 1
test dl, 8
je 0x422e04
push str.FOR_DO_NOT_CASHE_DIRECT_FILE
call fcn.00465960
add esp, 4
mov edx, eax
test edx, edx
je 0x422dec
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x100]
call fcn.00425ac0
test eax, eax
je 0x422dec
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x154]
movsx ecx, byte [edx + 0x155]
jmp 0x422e04
mov edx, dword [ebp - 4]
or dword [ebp - 0x14], 0x10000000
movsx eax, byte [edx + 0x154]
movsx ecx, byte [edx + 0x155]
cmp dword [ebx + 0x4c], 0
jne 0x422eb5
cmp ecx, 3
je 0x422e2c
cmp ecx, 2
je 0x422e2c
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x16b]
test dl, 8
jne 0x422e2c
test dl, 0x10
je 0x422e3d
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 1
mov eax, 1
jmp 0x422eb5
movzx eax, byte [eax + 0x170]
test al, 1
jne 0x422e67
test al, 2
jne 0x422e67
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16a]
and eax, 0x80
shr eax, 7
test dl, 4
je 0x422e78
test eax, eax
je 0x422e8d
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 5
mov eax, 5
jmp 0x422ece
test eax, eax
je 0x422e8d
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 4
mov eax, 4
jmp 0x422ece
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 3
je 0x422ea7
mov byte [eax + 0x154], 8
mov eax, 8
jmp 0x422ece
mov byte [eax + 0x154], 5
mov eax, 5
jmp 0x422ece
cmp ecx, 3
je 0x422ed3
cmp ecx, 2
je 0x422ed3
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
jne 0x422ed3
test dl, 0x10
je 0x422eed
movsx edx, al
cmp edx, 1
je 0x422ef0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movsx edx, al
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x422f22
movzx eax, byte [eax + 0x16b]
test al, 1
jne 0x422f0b
test al, 2
je 0x422f22
cmp edx, 5
je 0x422f2b
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp edx, 4
je 0x425887
or dword [ebp - 0x1c], 1
cmp dword [ebx + 0x54], 0
jne 0x422f41
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x422f62
mov eax, dword [ebp - 4]
mov dword [ebp - 0x160], 0
or byte [eax + 0x16a], 1
and byte [eax + 0x170], 0xfb
or dword [ebp - 0x1c], 2
jmp 0x422f6c
mov dword [ebp - 0x160], 1
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x422fac
cmp eax, 1
je 0x422fa0
cmp eax, 2
je 0x422fb6
mov edx, dword [ebp - 4]
mov eax, 0x23d
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x422f9c
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
jmp 0x422fc9
cmp dword [ebp - 0x34], 0
je 0x425860
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 0x20
mov byte [edx + 0x16b], al
and eax, 4
mov edx, dword [ebx + 0x48]
shr eax, 2
mov dword [ebp - 0x164], edx
test edx, edx
je 0x422ff2
test eax, eax
je 0x423059
mov eax, 0x70
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4231b3
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 0x40
je 0x423028
mov eax, dword [0x50144c]
cmp eax, 0xfffffffe
mov dword [ebp - 0x164], eax
je 0x4259cc
cmp dword [ebp - 0x164], 0xffffffff
jne 0x423049
jmp 0x4231b3
mov eax, dword [0x501450]
cmp eax, 0xfffffffe
mov dword [ebp - 0x164], eax
je 0x4259ba
cmp dword [ebp - 0x164], 0xffffffff
je 0x4231b3
mov dword [ebx + 0x48], eax
cmp dword [ebp - 0x164], 0
je 0x4231b3
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x423098
cmp dword [ebp - 0x164], 0
jle 0x423086
mov ecx, 0xfffffffa
xor esi, esi
mov eax, dword [ebp - 0x164]
cdq
sub eax, ecx
sbb edx, esi
jl 0x4230a5
or eax, edx
je 0x4230a5
mov eax, 0x245
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x164], 0
jle 0x4259de
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x164]
mov dword [edx + 0xfc], eax
movzx edx, byte [edx + 0x16a]
and edx, 0x80
shr edx, 7
test edx, edx
je 0x4230ef
mov eax, dword [ebp - 4]
test byte [eax + 0x16c], 0x10
jne 0x4230ef
mov ecx, dword [ebp - 0x164]
cmp dword [ebx + 0x7c], 0
lea eax, [ecx*4]
jne 0x4230e9
mov ecx, eax
mov dword [ebp - 0x164], ecx
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x154]
dec eax
cmp eax, 7
ja case.default.0x42310a
mov eax, dword [eax*4 + 0x4cedb4]
jmp eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x164]
cmp byte [eax + 0x156], 3
lea edx, [ecx + 1]
jne 0x423123
mov ecx, edx
mov dword [ebp - 0x164], ecx
jmp case.0x42310a.1
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x16b]
test byte [ecx + 0x170], 2
jne 0x423146
test al, 4
je case.0x42310a.1
test edx, edx
je case.0x42310a.1
mov edx, ecx
or eax, 0xffffff80
mov dword [ebp - 0x164], 0x400
mov dword [edx + 0xfc], 0x10000
mov byte [edx + 0x16b], al
jmp case.0x42310a.1
mov eax, dword [ebp - 0x164]
add eax, 4
mov dword [ebp - 0x164], eax
jmp case.0x42310a.1
mov eax, dword [ebp - 0x164]
add eax, 8
mov dword [ebp - 0x164], eax
jmp case.0x42310a.1
push 0x6ba
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0040e820
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x164]
mov dword [edx + 0xf8], eax
jmp 0x4232bf
mov eax, dword [ebp - 4]
cmp byte [eax + 0x154], 1
je 0x4231d2
mov esi, eax
movzx eax, byte [esi + 0x16b]
test al, 8
mov dword [ebp - 0x164], eax
je 0x4231f5
mov edx, dword [ebp - 4]
mov eax, 0x241
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x4231f1
mov eax, 0x25
mov esp, ebp
pop ebp
ret
mov eax, esi
movzx eax, byte [eax + 0x170]
test al, 1
jne 0x423227
test al, 2
jne 0x423227
mov eax, esi
mov ecx, dword [ebp - 0x164]
and ecx, 4
shr ecx, 2
movzx edx, byte [eax + 0x16a]
test ecx, ecx
je 0x42323f
test edx, 0x80
je 0x42323f
mov eax, esi
mov dword [eax + 0xf8], 0x400
mov dword [eax + 0xfc], 0x10000
jmp 0x4232ae
test byte [eax + 0x168], 4
je 0x423262
test dl, 0x40
je 0x423262
mov edx, eax
mov eax, 0x400
mov dword [edx + 0xf8], eax
mov dword [edx + 0xfc], eax
jmp 0x4232ae
test edx, 0x80
je 0x423280
mov dword [eax + 0xf8], 0x800
mov dword [eax + 0xfc], 0x1fe
jmp 0x4232ae
test ecx, ecx
je 0x42329a
mov dword [eax + 0xf8], 0x401
mov dword [eax + 0xfc], 0x400
jmp 0x4232ae
mov dword [eax + 0xf8], 0x85
mov dword [eax + 0xfc], 0x84
mov edx, esi
mov eax, dword [ebp - 0x164]
or eax, 0xffffff80
mov byte [edx + 0x16b], al
mov eax, dword [ebx + 4]
test eax, eax
je 0x4232d2
mov dword [edx + 0x54], eax
mov eax, dword [ebx + 8]
mov byte [edx + 0x157], al
mov eax, dword [ebx + 0x3c]
mov dword [edx + 0xd8], eax
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x423353
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 0x40
jne 0x423310
mov edx, eax
mov eax, 0x2ee
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42330c
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x423353
cmp edx, 1
jne 0x423323
mov byte [eax + 0x159], 0x27
jmp 0x42335d
cmp edx, 3
jne 0x423331
mov byte [eax + 0x159], 0x22
jmp 0x42335d
mov edx, eax
mov eax, 0x2ef
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42334f
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x159], 0
mov edx, dword [ebx + 0x74]
test edx, edx
je 0x4233c4
test byte [eax + 0x16a], 0x40
jne 0x42338f
mov edx, eax
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42338b
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x4233c4
cmp edx, 1
jne 0x4233a2
and byte [eax + 0x16e], 0xfd
jmp 0x4233e2
mov edx, eax
mov eax, 0x2f1
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x4233c0
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, eax
movzx eax, byte [edx + 0x16e]
movzx esi, byte [edx + 0x168]
and eax, 0xfffffffd
and esi, 2
or eax, esi
mov byte [edx + 0x16e], al
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x423435
cmp eax, 2
je 0x42341b
cmp eax, 1
je 0x42341b
cmp eax, 3
je 0x42341b
mov edx, dword [ebp - 4]
mov eax, 0x2ec
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x423417
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
test al, 8
jne 0x4229bf
test al, 0x10
jne 0x4229bf
mov eax, dword [ebx + 0x90]
cmp eax, 5
ja case.default.0x42344b
mov eax, dword [eax*4 + 0x4cedd4]
jmp eax
mov ecx, dword [ebp - 4]
and dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x16a]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x423604
mov ecx, dword [ebp - 4]
and dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x16a]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x423604
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
or edx, 2
and edx, 0xfffffffe
mov dword [ebp - 0x1c], edx
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffcb
movzx edx, byte [ecx + 0x16a]
or eax, 8
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
mov dword [ebp - 0x160], 0
jmp 0x423604
mov ecx, dword [ebp - 4]
or dword [ebp - 0x1c], 2
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
or eax, 4
movzx edx, byte [ecx + 0x16a]
and eax, 0xffffffc7
or edx, 1
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x423604
cmp dword [ebx + 0x54], 0
jne 0x423563
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x423598
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x160], 0
movzx edx, byte [ecx + 0x16a]
movzx eax, byte [ecx + 0x170]
or edx, 1
or eax, 4
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x423604
cmp dword [ebx + 0x50], 0
je 0x4235d9
mov ecx, eax
and dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x16a]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x423604
mov ecx, eax
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x16a]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
mov eax, edx
and eax, 0x40
mov ecx, dword [ebx + 0xb4]
shr eax, 6
test ecx, ecx
je 0x42363d
test eax, eax
jne 0x42363d
mov edx, dword [ebp - 4]
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x423639
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov byte [esi + 0x15f], cl
mov ecx, dword [ebx + 0xb8]
test ecx, ecx
je 0x423676
test eax, eax
jne 0x423676
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x423672
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x161], cl
mov ecx, dword [ebx + 0xbc]
test ecx, ecx
je 0x4236ac
test eax, eax
jne 0x4236ac
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x4236a8
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x163], cl
mov ecx, dword [ebx + 0xc0]
test ecx, ecx
je 0x4236e2
test eax, eax
jne 0x4236e4
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x4236de
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
test eax, eax
mov eax, esi
mov byte [eax + 0x165], cl
je 0x42373c
movzx eax, byte [eax + 0x16b]
test al, 2
jne 0x4236fd
test al, 1
je 0x42370e
mov eax, esi
mov dword [eax + 0x138], 3
jmp 0x4237ed
test al, 8
je 0x423723
mov eax, esi
mov dword [eax + 0x138], 2
jmp 0x4237ed
test al, 0x10
je 0x4237ed
mov eax, esi
mov dword [eax + 0x138], 8
jmp 0x4237ed
test edx, 0x80
jne 0x42374d
test byte [ebp - 0x164], 1
je 0x4237a5
movzx eax, byte [eax + 0x16b]
test al, 2
jne 0x42375c
test al, 1
je 0x423781
test byte [ebp - 0x164], 1
je 0x423773
mov eax, esi
mov dword [eax + 0x138], 7
jmp 0x4237ed
mov eax, esi
mov dword [eax + 0x138], 0xb
jmp 0x4237ed
test al, 8
je 0x423793
mov eax, esi
mov dword [eax + 0x138], 6
jmp 0x4237ed
test al, 0x10
je 0x4237ed
mov eax, esi
mov dword [eax + 0x138], 9
jmp 0x4237ed
test byte [ebp - 0x164], 2
movzx eax, byte [eax + 0x16b]
je 0x4237ed
test al, 2
jne 0x4237bd
test al, 1
je 0x4237cb
mov eax, esi
mov dword [eax + 0x138], 5
jmp 0x4237ed
test al, 8
je 0x4237dd
mov eax, esi
mov dword [eax + 0x138], 4
jmp 0x4237ed
test al, 0x10
je 0x4237ed
mov eax, esi
mov dword [eax + 0x138], 0xa
mov eax, dword [0x5033e0]
cmp dword [ebx + 0x84], 0
je 0x423811
test eax, eax
jne 0x423811
mov eax, 0x232
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x94], 0
je 0x4257f8
test eax, eax
je 0x424bca
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0x164], eax
mov eax, dword [ebx + 0x9c]
cmp eax, 1
je 0x42389b
test eax, eax
jne 0x423860
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x20
jne 0x423869
push str.FORT_BUFFERED
call fcn.0042ab50
add esp, 4
test eax, eax
je 0x42389b
jmp 0x423869
cmp eax, 2
jne case.default.0x422bfd
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 4]
call fcn.0040be80
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x171]
shl edx, 6
and ecx, 0xffffffbf
or ecx, edx
mov byte [esi + 0x171], cl
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 4]
call fcn.0040be80
mov dword [ebp - 0x140], eax
add esp, 8
cmp dword [ebp - 0x140], 0xffffffff
je 0x423925
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
cmp eax, 3
jne 0x4238d9
mov eax, dword [ebp - 4]
mov dword [eax + 0x138], 1
jmp 0x4238de
cmp eax, 5
jne 0x4238fa
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x423925
or byte [eax + 0x16a], 2
mov dword [ebp - 0x18], 3
jmp 0x423925
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x168]
test dl, 4
je 0x423925
mov eax, 0x229
test dl, 0x20
mov ebx, dword [ebp - 0x10]
jne 0x42391b
mov eax, 0x33
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5033e0]
test ecx, ecx
jne 0x423944
cmp dword [ebp - 0x140], 0xfffffffa
jne 0x423974
mov dword [ebp - 0x140], 1
jmp 0x42398e
cmp dword [ebp - 0x140], 0xfffffffa
je 0x42563a
cmp dword [ebp - 0x140], 1
je 0x42398e
cmp dword [ebp - 0x164], 0
jne 0x424bca
cmp dword [ebx + 0x84], 0
jne 0x4237ff
cmp dword [ebp - 0x140], 0xfffffffc
je 0x425769
cmp dword [ebp - 0x140], 0
jl 0x425625
mov eax, dword [ebp - 4]
cmp dword [eax + 0x138], 1
jne 0x4239cc
cmp dword [ebp - 0x140], 0
je 0x4239b5
cmp dword [ebp - 0x140], 2
je 0x4239b5
cmp dword [ebp - 0x140], 1
jne 0x4239cc
mov edx, eax
shl ecx, 7
movzx eax, byte [edx + 0x170]
and eax, 0x7f
or eax, ecx
mov byte [edx + 0x170], al
cmp dword [ebp - 0x24], 0
je 0x423a80
cmp dword [ebx + 0xa4], 0
jne 0x423a59
cmp dword [ebx + 0x68], 0
je 0x424c7e
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x13c]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], 0
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x423a1f
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x423a0a
dec eax
push eax
lea edx, [ebp - 0x148]
push edx
lea edi, [ebp - 0x144]
push edi
lea ecx, [ebp - 0x14]
push ecx
lea esi, [ebp - 0x18]
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x13c]
push ecx
call dword [ebx + 0x68]
add esp, 0x24
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe4], esi
jmp 0x423a89
push dword [ebx + 0xa8]
call fcn.00469770
add esp, 4
mov esi, eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], esi
mov eax, dword [ebx + 0xa8]
mov dword [edx + 0x178], eax
jmp 0x423a89
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xe4]
cmp esi, 0xffffffff
je 0x425388
cmp dword [ebx + 0xa4], 0
jne 0x423bb7
mov eax, dword [ebp - 4]
cmp dword [0x501470], 0
mov dword [eax + 0x178], 0xffffffff
je 0x423bb7
movzx eax, byte [eax + 0x16b]
test al, 8
jne 0x423bb7
cmp dword [ebp - 0x24], 0
je 0x423b3f
mov edx, dword [ebp - 4]
test byte [edx + 0x170], 2
jne 0x423aed
test al, 4
je 0x423af4
movzx ecx, byte [edx + 0x16a]
test ecx, 0x80
je 0x423af4
mov edx, 0x8000
jmp 0x423af6
xor edx, edx
mov ecx, dword [ebp - 0x20]
test ecx, 0xc0000000
je 0x423b06
or edx, 2
jmp 0x423b15
mov edi, edx
or edi, 1
test ecx, 0x40000000
je 0x423b15
mov edx, edi
cmp dword [ebx + 0x78], 1
je 0x423b1f
test al, 1
je 0x423b22
or edx, 8
push edx
push esi
call fcn.004698e0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x178], eax
mov eax, dword [0x5033e0]
jmp 0x423bbc
cmp dword [0x5033e0], 0
jne 0x423bc0
cmp dword [ebp - 0x140], 1
je 0x423b9b
cmp dword [ebp - 0x140], 0
jne 0x423b76
call fcn.004670f0
push eax
call fcn.00469c40
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x178], eax
jmp 0x423bf1
cmp dword [ebp - 0x140], 2
jne 0x423bf1
call fcn.004670f0
add eax, 0x40
push eax
call fcn.00469c40
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x178], eax
jmp 0x423bf1
call fcn.004670f0
add eax, 0x20
push eax
call fcn.00469c40
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x178], eax
jmp 0x423bf1
mov eax, dword [0x5033e0]
test eax, eax
je 0x423be8
mov eax, dword [ebp - 0x140]
lea ecx, [eax + 6]
cmp ecx, 0x20
jae 0x423be8
mov eax, 1
shl eax, cl
test eax, 0x1c1
je 0x423be8
mov dword [ebp - 0x164], 2
jmp 0x423bfe
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xe4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x156]
test eax, eax
jne 0x423d2f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x154], 1
je 0x424cab
movzx edx, byte [eax + 0x169]
and edx, 6
shr edx, 1
test edx, edx
je 0x423cc7
mov ecx, dword [eax + 0x100]
add ecx, 2
cmp ecx, 0x20
jae 0x423cc7
mov eax, 1
shl eax, cl
test eax, 0x103
je 0x423cc7
cmp edx, 1
je 0x423ca7
cmp edx, 2
jne 0x423c81
mov eax, dword [ebp - 4]
mov byte [eax + 0x156], 2
movzx ecx, byte [eax + 0x168]
movzx edx, byte [eax + 0x16a]
inc dword [eax + 0xf8]
jmp 0x423d63
cmp edx, 3
jne case.default.0x422bfd
mov eax, dword [ebp - 4]
mov byte [eax + 0x156], 3
movzx ecx, byte [eax + 0x168]
movzx edx, byte [eax + 0x16a]
jmp 0x423d63
mov eax, dword [ebp - 4]
mov byte [eax + 0x156], 1
movzx ecx, byte [eax + 0x168]
movzx edx, byte [eax + 0x16a]
inc dword [eax + 0xf8]
jmp 0x423d23
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x168]
test cl, 4
movzx edx, byte [eax + 0x16a]
je 0x423d03
cmp dword [eax + 0x138], 1
je 0x423d16
test dl, 0x40
je 0x423cf4
cmp dword [ebp - 0x164], 2
je 0x423d16
mov byte [eax + 0x156], 2
inc dword [eax + 0xf8]
jmp 0x423d63
test dl, 0x40
je 0x423cf4
cmp dword [ebp - 0x164], 2
jne 0x423cf4
test cl, 1
je 0x423cf4
mov byte [eax + 0x156], 1
inc dword [eax + 0xf8]
mov eax, dword [ebp - 4]
add dword [eax + 0xf8], 5
jmp 0x423d63
mov edx, dword [ebp - 4]
cmp eax, 3
movzx ecx, byte [edx + 0x168]
movzx edx, byte [edx + 0x16a]
je 0x423d63
mov esi, dword [ebp - 4]
movsx edi, byte [esi + 0x154]
cmp edi, 1
je 0x423d5a
inc dword [esi + 0xf8]
cmp eax, 1
je 0x42537a
test cl, 1
je 0x423d83
mov eax, dword [ebp - 4]
test byte [eax + 0x16b], 8
je 0x423d83
cmp byte [eax + 0x155], 2
jne 0x423d83
inc dword [eax + 0xf8]
test cl, 4
je 0x423da7
mov eax, dword [ebp - 4]
and edx, 0x40
shr edx, 6
test byte [eax + 0x16b], 8
je 0x423dad
test edx, edx
je 0x423dad
add dword [eax + 0xf8], 2
jmp 0x423dad
and edx, 0x40
shr edx, 6
cmp dword [ebp - 0x164], 1
jne 0x423dc5
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16c]
or eax, 8
jmp 0x423dd2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16c]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
test edx, edx
mov byte [ecx + 0x16c], al
je 0x423eb6
push dword [ebp - 4]
call fcn.0041cdc0
add esp, 4
test eax, eax
jne 0x42269c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x423eb6
movzx eax, byte [edx + 0x1e]
test eax, eax
je 0x423eb6
mov esi, dword [edx + 0xc]
movzx eax, byte [esi + 0x16d]
test al, 0x40
je 0x423e2b
cmp byte [esi + 0x156], 1
je 0x424ce4
push esi
call fcn.004271a0
add esp, 4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
test edx, edx
je 0x423e42
mov byte [edx + 0x1e], 0
test eax, eax
je 0x423ea1
mov edx, dword [esi + 0x18]
test edx, edx
je 0x424d1b
test byte [edx + 0x44], 2
je 0x423e7c
mov dword [edx + 0x38], eax
mov edx, dword [esi + 0x18]
mov dword [edx + 0x3c], eax
mov edx, dword [esi + 0x64]
test edx, edx
je 0x423e6f
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x64], ecx
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push eax
movzx edx, byte [esi + 0x16c]
push eax
and edx, 7
push edx
push 0xffffffffffffffff
push esi
call fcn.004207d0
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
add dword [esi + 0x98], 1
adc dword [esi + 0x9c], 0
and byte [esi + 0x16f], 0xfb
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
test al, 8
je 0x423ee2
mov edx, dword [ebp - 4]
test byte [edx + 0x16c], 8
jne 0x423ee2
mov eax, 0x33
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 0
je 0x4247fa
cmp dword [ebx + 0x58], 5
je 0x42522f
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x4247e9
cmp eax, 2
je 0x4247e9
cmp eax, 3
jne 0x423f42
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
and eax, 0xfffffffe
and byte [edx + 0x16f], 0xfb
mov byte [edx + 0x16b], al
mov dword [edx + 0x98], 1
mov dword [edx + 0x9c], 0
jmp 0x4247fa
cmp eax, 1
jne 0x424117
cmp dword [ebx + 0x58], 5
je 0x425205
mov eax, dword [ebp - 4]
test byte [eax + 0x16c], 8
jne 0x423f6d
movzx eax, byte [eax + 0x16b]
jmp 0x4247fa
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, eax
mov eax, dword [esi + 0xe4]
call fcn.00425a10
mov dword [ebp - 0x164], eax
mov eax, 0xffffffff
mov ecx, edx
mov esi, dword [ebp - 0x164]
sub ecx, eax
sub esi, eax
or esi, ecx
je 0x4251c3
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x164]
movzx eax, byte [esi + 0x16b]
and byte [esi + 0x16f], 0xfb
and eax, 0xfffffffe
mov dword [esi + 0x98], 0x80000000
mov dword [esi + 0x9c], 0xffffffff
mov byte [esi + 0x16b], al
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], edx
cmp dword [esi + 0x138], 5
je 0x4247fa
mov eax, esi
movsx edx, byte [eax + 0x154]
lea eax, [edx - 1]
cmp eax, 7
ja case.default.0x424011
mov eax, dword [eax*4 + 0x4cedec]
jmp eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
jmp 0x4247fa
push 0xdf2
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0040e820
add esp, 0x10
mov eax, esi
movzx eax, byte [eax + 0x16b]
jmp 0x4247fa
mov eax, dword [ebp - 4]
or byte [eax + 0x16f], 4
movzx eax, byte [eax + 0x16b]
test al, 1
je 0x4248a1
mov edx, dword [ebp - 4]
test byte [edx + 0x16c], 8
je 0x4248ce
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00425a10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x424e4c
mov eax, esi
cmp dword [eax + 0x138], 7
jne 0x424879
mov ecx, 0xffffffff
mov edx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov eax, dword [esi + 0xe4]
call fcn.00425a10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x424e4c
mov eax, esi
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x16f], 0xfb
movzx eax, byte [eax + 0x16b]
test al, 1
jne 0x4248ce
mov edx, dword [ebp - 4]
test byte [edx + 0x16c], 8
je 0x4248ce
test byte [edx + 0x168], 4
je 0x4248ba
test al, 8
jne 0x4248ce
test byte [edx + 0x16a], 0x40
jne 0x4248c7
test al, 4
jne 0x4248ce
or byte [edx + 0x16d], 8
test eax, 0x80
jne 0x4248e7
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf8]
mov word [edx + 0x150], ax
jmp 0x42491e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 1
je 0x425341
test byte [eax + 0x168], 4
je 0x424910
mov edx, eax
mov eax, 0x4f
mov word [edx + 0x150], ax
jmp 0x42491e
mov edx, eax
mov eax, 0x50
mov word [edx + 0x150], ax
mov edx, dword [ebx + 0x14]
test edx, edx
jle 0x425302
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x10]
movzx ecx, byte [ecx + 0x168]
and ecx, 4
shr ecx, 2
test ecx, ecx
je 0x42494e
cmp eax, 0x7ffffe00
jle 0x42494e
mov eax, 0x7ffffe00
jmp 0x424956
test eax, eax
jle 0x4252b7
add eax, 0x1ff
and eax, 0xfffffe00
mov dword [ebx + 0x10], eax
mov ecx, dword [ebp - 4]
test byte [ecx + 0x16b], 8
je 0x4249dc
mov edx, ecx
test byte [edx + 0x168], 4
je 0x42498c
imul edx, eax
mov esi, dword [ecx + 0xf8]
mov dword [ebp - 0x164], esi
lea ecx, [esi + 4]
cmp ecx, edx
ja 0x4249f4
mov eax, 0x234
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23f
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x424bfb
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x424c1e
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x424c41
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23c
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x424c64
mov eax, 0x30
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x58], 0
jne 0x422650
mov dword [ebx + 0x58], 3
jmp 0x422650
xor eax, eax
lea edx, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe4], esi
jmp 0x423a89
movzx ecx, byte [eax + 0x168]
test cl, 4
movzx edx, byte [eax + 0x16a]
je 0x424cd8
test byte [eax + 0x16b], 8
je 0x424cd8
test dl, 0x40
je 0x424cd8
mov byte [eax + 0x156], 2
jmp 0x423d63
mov byte [eax + 0x156], 3
jmp 0x423d63
mov ecx, dword [esi + 0x38]
movsx edx, byte [ecx + 5]
cmp edx, 0x20
je 0x424d0e
cmp edx, 0x2b
jne 0x424d00
mov byte [ecx + 5], 0
movzx eax, byte [esi + 0x16d]
and eax, 0xffffffbf
mov byte [esi + 0x16d], al
jmp 0x423e2b
mov byte [ecx + 5], 0x24
movzx eax, byte [esi + 0x16d]
jmp 0x424d00
push esi
push eax
push eax
push 1
call fcn.0040c750
add esp, 0x10
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xe4]
call fcn.00425a70
or eax, edx
jne 0x4251e4
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
jmp 0x4247fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x16f], 0xfb
movzx eax, byte [eax + 0x16b]
jmp 0x4247fa
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x425251
mov eax, dword [ebp - 4]
and byte [eax + 0x16d], 0xf7
jmp 0x423ef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x26
mov edi, dword [ebp - 8]
and byte [edx + 0x16d], 0xf7
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x4252c4
mov dword [ebx + 0x10], 0x400
jmp 0x4252de
mov eax, dword [0x501454]
cmp eax, 0xfffffffe
je 0x4252f0
mov edx, dword [0x501458]
cmp edx, 0xfffffffe
je 0x42532f
test edx, edx
je 0x425316
cmp edx, 0xffffffff
jne 0x425327
mov dword [ebx + 0x14], 1
mov edx, 1
jmp 0x424929
mov dword [ebx + 0x14], edx
jmp 0x424929
mov eax, 0x6b
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
test byte [eax + 0x168], 4
je 0x425351
mov edx, 0x50
jmp 0x425356
mov edx, 0x51
cmp byte [eax + 0x154], 1
je 0x42536e
add edx, 4
mov word [eax + 0x150], dx
jmp 0x42491e
mov word [eax + 0x150], dx
jmp 0x42491e
cmp edi, 1
jne 0x423d23
jmp 0x423d63
cmp dword [ebx + 0xa4], 0
je 0x425475
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.00469ed0
mov dword [eax], ebx
cmp ebx, 2
jge 0x425449
cmp ebx, 0x7b
je 0x425985
cmp ebx, 0xa1
je 0x425985
cmp ebx, 0xce
je 0x425985
cmp ebx, 0xb7
je 0x425962
cmp ebx, 0x50
je 0x425962
cmp ebx, 0x13
je 0x425997
cmp ebx, 5
je 0x425997
cmp ebx, 0x14
je 0x425437
cmp ebx, 0xf
je 0x425437
cmp ebx, 4
jne 0x42541c
mov edx, dword [ebp - 4]
mov eax, 0x25b
test byte [edx + 0x168], 0x20
jne 0x42542a
mov eax, 0x1e
jmp 0x42542a
mov eax, dword [ebp - 4]
mov dword [eax + 0xe8], ebx
mov eax, 0x1e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x2a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp ebx, 3
jg 0x4253ad
mov edx, dword [ebp - 4]
mov eax, 0x25a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x425471
mov eax, 0x1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 1
je 0x42548e
test byte [eax + 0x169], 0x40
je 0x425395
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
cmp eax, 0x13
movzx edx, byte [edx + 0x168]
je 0x4254ad
cmp eax, 5
je 0x4254ad
test dl, 4
je 0x425524
test dl, 1
jne 0x425524
cmp dword [ebp - 0x15c], 0
je 0x425524
mov edx, dword [ebp - 4]
test byte [edx + 0x169], 0x40
jne 0x425524
test byte [edx + 0x16e], 1
jne 0x425524
xor eax, eax
lea ecx, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x20]
and edx, 0x3fffffff
push dword [ebp - 0x1c]
or edx, 0x80000000
push edx
mov dword [ebp - 0x20], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
cmp esi, 0xffffffff
mov dword [eax + 0xe4], esi
je 0x4255d7
or byte [eax + 0x169], 0x40
or byte [eax + 0x16f], 0x10
jmp 0x4255c9
cmp eax, 0x20
jne 0x4255c0
cmp dword [ebp - 0x160], 0
je 0x4255c0
cmp dword [ebp - 0x15c], 0
jne 0x425557
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x425557
mov esi, dword [eax + 0xe4]
jmp 0x4255c9
xor eax, eax
lea esi, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
and ecx, 0x3fffffff
or edx, 2
or ecx, 0x80000000
push edx
push ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
cmp esi, 0xffffffff
mov dword [eax + 0xe4], esi
je 0x425395
or byte [eax + 0x169], 0x40
or byte [eax + 0x16f], 0x10
or byte [eax + 0x16a], 1
or byte [eax + 0x170], 4
jmp 0x423a92
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xe4]
cmp esi, 0xffffffff
je 0x425395
jmp 0x423a92
test byte [eax + 0x168], 4
je 0x425511
xor eax, eax
lea ecx, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x20]
and edx, 0x7fffffff
push dword [ebp - 0x1c]
or edx, 0x40000000
push edx
mov dword [ebp - 0x20], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe4], esi
or byte [eax + 0x16e], 1
jmp 0x4255c9
test ecx, ecx
je 0x4239cc
cmp dword [ebp - 0x140], 0xfffffffa
jne 0x4239cc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], 0
or byte [eax + 0x170], 0x80
cmp dword [ebx + 0x84], 0
je 0x425666
cmp dword [ebx + 0x88], 0
jne 0x425666
and byte [eax + 0x171], 0xfe
jmp 0x42566d
or byte [eax + 0x171], 1
mov eax, dword [ebp - 0x164]
test eax, eax
lea edx, [ebp - 0x14c]
jne 0x425682
mov eax, 0x100
push edx
push 0
mov dword [ebp - 0x164], eax
lea ecx, [eax + 1]
push ecx
call fcn.004085a0
add esp, 0xc
test eax, eax
jne 0x42269c
cmp dword [ebx + 0x98], 0
jne 0x4256c6
mov eax, dword [ebp - 4]
push dword [eax + 0x100]
push str.Unit__i
push dword [ebp - 0x14c]
call fcn.004665d0
add esp, 0xc
jmp 0x4256f0
push dword [ebp - 0x164]
push dword [ebx + 0x94]
push dword [ebp - 0x14c]
call fcn.00466960
add esp, 0xc
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x164]
mov byte [eax + edx], 0
push dword [ebp - 0x14c]
call fcn.004b7ec0
add esp, 4
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [edx + 0xe4], eax
je 0x4259f0
test byte [edx + 0x171], 1
je 0x425746
push eax
call fcn.004b7f80
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call fcn.004b7f00
add esp, 8
test eax, eax
jne 0x425746
mov eax, 0x28e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x14c]
call fcn.00408660
add esp, 4
test eax, eax
je 0x4239cc
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax + 0x152]
cmp edx, 4
jge 0x4257b7
push dword [eax + 0x60]
call fcn.00408660
add esp, 4
test eax, eax
je 0x425794
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x158]
push 0
push 5
call fcn.004085a0
add esp, 0xc
test eax, eax
je 0x4257b7
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0x314d4f43
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x13c]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4257d4
mov edx, dword [ebp - 4]
mov eax, 4
mov ecx, dword [0x5033e0]
mov word [edx + 0x152], ax
jmp 0x425625
test eax, eax
jne 0x425814
push str.USER
lea eax, [ebp - 0x13c]
push eax
call fcn.00466cc0
add esp, 8
test eax, eax
je 0x425823
mov dword [ebp - 0x164], 0
jmp 0x423832
mov dword [ebp - 0x13c], 0x4e4f43
mov eax, esi
lea edi, [ebp - 0x13c]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x425838
mov edx, dword [ebp - 4]
mov eax, 3
mov dword [ebp - 0x164], 0
mov word [edx + 0x152], ax
jmp 0x423832
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 1
je 0x422fb6
mov edx, eax
movzx eax, byte [edx + 0x16b]
and eax, 0xffffffdf
mov byte [edx + 0x16b], al
jmp 0x422fc9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 3
je 0x422f2b
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 0x10
je 0x422da0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x155], 3
mov ecx, 3
jmp 0x422daf
mov edx, ecx
test byte [edx + 0x168], 4
je 0x4258f9
test byte [edx + 0x16b], 8
je 0x4258f9
test byte [edx + 0x16a], 0x40
je 0x4258f9
mov byte [edx + 0x156], 2
jmp 0x422cec
movsx edx, al
cmp edx, 4
je 0x425944
cmp edx, 1
je 0x425944
movzx esi, byte [ecx + 0x16a]
test esi, 0x80
jne 0x425944
movzx ecx, byte [ecx + 0x170]
test cl, 1
jne 0x425944
test cl, 2
jne 0x425944
test esi, 0x40
je 0x422cec
cmp edx, 5
jl 0x422cec
cmp edx, 8
jg 0x422cec
mov edx, dword [ebp - 4]
mov byte [edx + 0x156], 3
jmp 0x422cec
mov dword [ebp - 0x15c], 1
jmp 0x42283e
mov edx, dword [ebp - 4]
mov eax, 0x259
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x425981
mov eax, 0xa
mov esp, ebp
pop ebp
ret
mov eax, 0x2b
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x258
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x4259b6
mov eax, 9
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x63
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x25
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x258
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x425a0c
mov eax, 9
mov esp, ebp
pop ebp
ret