Function at 0x406922
Capabilities:
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Resolve function by parsing pe exports
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8d4
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x8d0], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov dword [esp + 0x50], 1
mov eax, ecx
mov dword [esp + 0x30], ecx
or ebx, 0xffffffff
mov dword [esp + 0x44], eax
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x28], ecx
push edi
test eax, eax
je 0x419c1e
mov eax, dword [eax + 0x1c]
shr eax, 1
mov edi, 0x104
and eax, 8
mov dword [esp + 0x58], ecx
push edi
mov dword [esp + 0x50], eax
lea eax, [esp + 0x7c]
push ecx
push eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x28c], ecx
mov byte [esp + 0x290], 1
mov dword [esp + 0x294], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esp + 0x8cc], 1
xor eax, eax
mov dword [esp + 0x8d0], edi
mov dword [esp + 0x8c8], eax
push edi
push eax
lea eax, [esp + 0x6c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esp + 0x6b4], 1
xor eax, eax
mov dword [esp + 0x6b8], edi
mov dword [esp + 0x6b0], eax
push edi
push eax
lea eax, [esp + 0x4b0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esp + 0x49c], 1
xor eax, eax
mov dword [esp + 0x4a0], edi
mov dword [esp + 0x498], eax
push edi
push eax
lea eax, [esp + 0x298]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x84]
add esp, 0xc
cmp byte [esp + 0x284], al
sete al
dec eax
and eax, 0x7ee3
add eax, edi
push eax
call fcn.0040fba0
test eax, eax
js 0x41a676
xor eax, eax
lea ecx, [esp + 0x6c0]
cmp byte [esp + 0x8cc], al
sete al
dec eax
and eax, 0x7ee3
add eax, edi
push eax
call fcn.0040fba0
test eax, eax
js 0x41a676
xor eax, eax
lea ecx, [esp + 0x4a8]
cmp byte [esp + 0x6b4], al
sete al
dec eax
and eax, 0x7ee3
add eax, edi
push eax
call fcn.0040fba0
test eax, eax
js 0x41a676
xor eax, eax
lea ecx, [esp + 0x290]
cmp byte [esp + 0x49c], al
sete al
dec eax
and eax, 0xfdc6
add eax, 0x208
push eax
call fcn.0040fba0
test eax, eax
js 0x41a676
push 0x402318
lea ecx, [esp + 0x4ac]
call fcn.0040fcb9
xor ecx, ecx
lea eax, [esp + 0x44]
push ecx
push eax
mov ecx, 0xfe00
call fcn.004068dd
mov dword [esp + 0x20], eax
test eax, eax
je 0x41a676
cmp dword [0x42d568], 0
jne 0x419c26
mov edi, dword [esi + 0x20]
mov dword [esp + 0x18], edi
test edi, edi
je 0x40705f
mov ecx, dword [edi]
mov esi, dword [edi + 0x18]
call fcn.00411150
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push esi
xor esi, esi
mov ecx, fcn.0040aea0
push esi
push 0x21
call fcn.0040ad5f
test al, al
je 0x419c4f
cmp dword [0x42d54c], 0
jne 0x41a6ab
mov edx, dword [esp + 0x8c8]
test edx, edx
je 0x419c91
push dword [esp + 0x8d0]
mov ecx, edi
call fcn.00407799
cmp eax, 1
je 0x41a66d
cmp dword [0x42d56c], 0
jne 0x406f88
mov eax, dword [0x42d564]
cmp eax, 3
je 0x419c9d
test byte [edi + 0x1c], 8
je 0x4070bd
push dword [edi + 4]
push 0x402244
call fcn.0040c37c
cmp dword [0x42d564], 3
pop ecx
pop ecx
je 0x419cc4
mov eax, dword [esp + 0x280]
test eax, eax
je 0x419cd6
mov edx, dword [esp + 0x30]
mov ecx, edi
push esi
push dword [esp + 0x28c]
push eax
call fcn.00407232
cmp eax, 1
je 0x41a66d
cmp dword [0x42d564], 3
je 0x419cdf
mov eax, dword [esp + 0x280]
test eax, eax
je 0x419d12
cmp word [eax], si
je 0x406f5c
push ecx
push ecx
mov ecx, dword [edi + 4]
xor edx, edx
call fcn.004061ee
mov esi, eax
mov dword [esp + 0x24], esi
cmp esi, 0xffffffff
je 0x419d1b
mov ecx, esi
call fcn.0040f521
test eax, eax
jne 0x419d6b
cmp dword [0x42d568], eax
jne 0x419d93
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x48], ecx
mov eax, dword [edi + 0x1c]
test al, 4
jne 0x406f92
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x498]
test ecx, ecx
je 0x419de7
push dword [edi + 4]
mov edx, dword [esp + 0x4a4]
call fcn.00411ef2
mov ecx, dword [esp + 0x280]
mov edi, eax
test ecx, ecx
je 0x419df3
call fcn.00411150
mov edx, dword [esp + 0x20]
mov ecx, esi
push eax
push ebx
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0x200
call fcn.0040770c
cmp dword [0x443d00], 0
mov dword [esp + 0x6c], eax
jne 0x419dfc
mov esi, dword [0x42d564]
cmp esi, 3
je 0x419e21
mov eax, dword [esp + 0x280]
test eax, eax
je 0x419e33
mov edx, dword [esp + 0x498]
test edx, edx
je 0x419e3c
push eax
mov ecx, edi
call fcn.00407164
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x419e48
mov ecx, dword [esp + 0x30]
xor edx, edx
inc edx
xor eax, eax
mov dword [0x42d5b4], edx
cmp dword [0x42d56c], eax
jne 0x406fb8
mov eax, dword [esp + 0x280]
test eax, eax
je 0x419ec4
push edx
push dword [esp + 0x28c]
mov edx, ecx
mov ecx, esi
push eax
call fcn.00407232
cmp eax, 1
je 0x41a664
mov eax, dword [esp + 0x280]
mov ecx, eax
test eax, eax
je 0x419ecd
xor esi, esi
cmp word [ecx], si
je 0x419ed6
test eax, eax
je 0x419ee8
mov edx, dword [esp + 0x498]
test edx, edx
je 0x419ef1
push eax
mov ecx, edi
call fcn.00407164
mov edi, dword [esp + 0x18]
test eax, eax
jne 0x419efd
mov eax, dword [esp + 0x280]
test eax, eax
je 0x419f59
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov esi, dword [0x42d564]
test ecx, ecx
je 0x406ff9
cmp dword [0x42d56c], 0
jne 0x40703c
test dl, 6
je 0x4070cb
or ebx, 0xffffffff
mov dword [0x443d00], 5
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], eax
cmp dword [esp + 0x5c], 1
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
je 0x41a006
mov eax, dword [edi + 0x1c]
test al, 8
je 0x407121
mov eax, dword [edi + 0x1c]
test al, 8
je 0x406e28
cmp esi, 3
je 0x41a03f
push dword [edi + 0x1c]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x18]
call fcn.004076df
cmp esi, 3
je 0x41a389
mov ebx, dword [edi + 0x1c]
test bl, 1
je 0x41a385
mov eax, 0x800
and ebx, eax
mov edi, ebx
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x40712f
mov eax, dword [esp + 0x18]
test dword [eax + 0x1c], 0x400
jne 0x41a060
mov esi, dword [0x43389c]
mov eax, dword [esp + 0x280]
test esi, esi
je 0x41a0b8
test eax, eax
je 0x41a0d7
or edi, dword [esp + 0x4c]
xor ecx, ecx
push edi
push 0x42d54c
push ecx
push ecx
mov edi, dword [esp + 0x28]
mov ecx, esi
push eax
push dword [edi + 4]
call dword [0x4494a0]
call esi
test eax, eax
je 0x41a0e0
cmp dword [esp + 0x40], 0
jne 0x406f0a
mov eax, dword [esp + 0x280]
test eax, eax
je 0x41a164
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
je 0x406efd
mov ecx, dword [esp + 0x280]
test ecx, ecx
je 0x41a16d
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFileAttributesW]
cmp dword [0x42d568], 0
jne 0x41a176
mov ebx, dword [esp + 0x10]
mov ecx, dword [edi + 0x18]
xor esi, esi
mov dword [0x42d5d4], esi
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], eax
call fcn.0040caaa
cmp dword [0x42d564], 3
je 0x406f56
cmp dword [0x42d54c], esi
jne 0x41a616
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x70]
push eax
push ebx
mov ecx, edi
call fcn.004076a8
mov dword [0x42d56c], esi
push dword [esp + 0x1c]
mov edx, dword [edi + 0x18]
mov ecx, fcn.0040aea0
push 0x21
call fcn.0040aebc
test al, al
jne 0x406b5c
mov ecx, dword [esp + 0x1c]
call fcn.00412323
mov edi, dword [edi + 0x20]
jmp 0x406b27
mov eax, dword [0x42d564]
jmp 0x406baa
and eax, 0xfffffffb
mov dword [edi + 0x1c], eax
test al, al
js 0x419dac
or eax, 1
cmp byte [0x443cd9], 0
mov dword [edi + 0x1c], eax
jne 0x406c72
jmp 0x419db4
cmp dword [ecx + 0x20], eax
je 0x406d2e
mov dword [0x443d00], eax
mov ecx, dword [ecx + 0x20]
mov dword [0x42d5b0], edx
call fcn.004126c9
mov eax, dword [0x443d00]
cmp eax, 0x15
je 0x41a659
cmp eax, 0x458
je 0x41a659
mov ecx, dword [esp + 0x30]
xor edx, edx
inc edx
jmp 0x406d2e
cmp dword [esp + 0x54], 0
je 0x407018
xor eax, eax
mov dword [esp + 0x3c], eax
cmp edx, 0xffffffff
je 0x407014
test dl, 0x10
jne 0x419f62
mov dword [esp + 0x54], eax
and dword [edi + 0x1c], 0xfffffffb
cmp byte [0x443cd9], 0
mov eax, dword [edi + 0x1c]
je 0x419f6f
cmp dword [esp + 0x3c], 0
je 0x406dc9
jmp 0x419faf
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x407051
test byte [eax + 0x1c], 8
jne 0x407142
cmp esi, 3
jne 0x406dd6
jmp 0x419fc5
cmp dword [0x42d564], 3
je 0x41a6c2
push dword [esp + 0x498]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [esp + 0x6b0]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [esp + 0x8c8]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [esp + 0x280]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
mov eax, dword [esp + 0x3c]
pop ecx
mov ecx, dword [esp + 0x8dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x406bd0
jmp 0x406bb4
test dword [edi + 0x1c], 0x400
jne 0x4070f0
mov ecx, dword [esp + 0x280]
test ecx, ecx
je 0x40715b
call fcn.0040680b
mov esi, dword [0x42d564]
mov ebx, eax
mov dword [esp + 0x10], ebx
xor eax, eax
mov dword [esp + 0x40], eax
cmp ebx, 0xffffffff
je 0x406df6
mov ecx, ebx
mov dword [esp + 0x50], 1
call fcn.0040f521
test eax, eax
jne 0x419fe2
mov esi, dword [0x42d564]
jmp 0x406dfa
cmp esi, 3
jne 0x406e18
jmp 0x41a029
mov ecx, eax
call fcn.0040caaa
or eax, 0xffffffff
mov dword [esp + 0x10], eax
jmp 0x406e69
xor eax, eax
cmp dword [edi + 0x20], eax
jne 0x407051
xor esi, esi
inc esi
mov dword [0x42d564], esi
jmp 0x407051
lea ecx, [esp + 0x78]
jmp 0x4070df
mov eax, dword [edx + 0x1c]
jmp 0x406988
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x28]
push 1
push eax
call fcn.004068dd
mov dword [esp + 0x34], eax
test eax, eax
je 0x41a676
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], eax
jmp 0x406b24
cmp dword [0x42d564], 3
jne 0x419c64
cmp dword [0x42d56c], esi
je 0x406f80
push dword [edi]
push 0x402010
call fcn.0040c37c
push 0x40204c
call fcn.0040c37c
mov ecx, dword [0x443d00]
add esp, 0xc
call fcn.0042961f
mov ecx, dword [esp + 0x1c]
jmp 0x41a644
lea edx, [esp + 0x6c0]
jmp 0x406b78
mov ecx, dword [esp + 0x6b0]
test ecx, ecx
jne 0x419caf
lea ecx, [esp + 0x4a8]
mov edx, dword [edi + 4]
call fcn.00428d2d
test eax, eax
jne 0x406f5c
jmp 0x406f88
cmp dword [0x42d56c], 0
je 0x406c21
jmp 0x406bd0
lea eax, [esp + 0x78]
jmp 0x406bdf
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x419cee
lea eax, [esp + 0x78]
mov ecx, dword [esp + 0x6b0]
test ecx, ecx
jne 0x419d00
lea ecx, [esp + 0x4a8]
mov edx, dword [esp + 0x6b8]
push eax
call fcn.00410820
jmp 0x406c09
lea eax, [esp + 0x78]
jmp 0x406c18
mov ecx, dword [0x443d00]
call fcn.0042961f
cmp dword [0x42d564], 3
jne 0x419d5c
cmp ebx, 0xffffffff
jne 0x419d5c
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x419d43
lea ecx, [esp + 0x78]
mov edx, dword [edi + 4]
call fcn.00428d2d
test eax, eax
je 0x419d5c
mov ecx, dword [esp + 0x1c]
jmp 0x41a644
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x38], 1
xor esi, esi
jmp 0x406f5c
or dword [edi + 0x1c], 0x80
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x28], 0x80
test al, 1
je 0x406c63
and eax, 0xfffffffe
or eax, 4
mov dword [edi + 0x1c], eax
jmp 0x406c63
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x44], eax
jb 0x406c57
mov ecx, eax
mov dword [esp + 0x28], eax
jmp 0x406c5f
or eax, 2
jmp 0x406fa3
cmp dword [0x42d56c], 0
je 0x406c72
mov eax, dword [edi + 0x1c]
test al, 8
jne 0x406c72
cmp dword [0x42d564], 3
jne 0x406c72
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x406c72
lea ecx, [esp + 0x290]
jmp 0x406c81
lea ecx, [esp + 0x78]
jmp 0x406ca1
mov ecx, esi
call fcn.0040caaa
push 0x6e
pop ecx
call fcn.0042961f
cmp dword [0x42d564], 3
je 0x41a653
mov edi, dword [esp + 0x18]
jmp 0x419d5c
cmp dword [0x42d56c], 0
je 0x406dfa
jmp 0x406ce1
lea eax, [esp + 0x78]
jmp 0x406cf0
lea edx, [esp + 0x290]
jmp 0x406cff
test byte [esi + 0x1c], 0x80
jne 0x406d13
mov ecx, dword [esp + 0x24]
call fcn.0040caaa
push dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x14]
push dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
push esi
push ecx
mov ecx, edi
call fcn.00428e73
cmp dword [0x42d56c], 0
je 0x419eab
cmp dword [0x42d564], 3
jne 0x419ea3
and dword [edi + 0x1c], 0xfffffffe
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0x1c]
test ecx, ecx
jne 0x419e9e
or eax, 2
jmp 0x419ea0
or eax, ecx
mov dword [edi + 0x1c], eax
mov dword [esp + 0x5c], 1
push dword [edi + 0x1c]
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.004076df
mov ebx, dword [esp + 0x10]
xor esi, esi
jmp 0x406f56
lea eax, [esp + 0x78]
jmp 0x406d3d
lea ecx, [esp + 0x78]
jmp 0x406d69
mov ecx, dword [esp + 0x24]
call fcn.0040caaa
mov edi, dword [esp + 0x18]
jmp 0x406f5c
lea eax, [esp + 0x78]
jmp 0x406d7c
lea edx, [esp + 0x290]
jmp 0x406d8b
test byte [edi + 0x1c], 0x80
jne 0x406d9f
mov ecx, dword [esp + 0x24]
call fcn.0040caaa
cmp dword [0x42d56c], esi
je 0x419f38
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x419f38
test byte [eax + 0x1c], 8
je 0x419f38
cmp dword [edi + 0x20], esi
jne 0x419f38
mov dword [0x42d564], 1
push dword [esp + 0x1c]
lea edx, [esp + 0x14]
push dword [esp + 0x2c]
push dword [esp + 0x28]
push ecx
mov ecx, edi
call fcn.00428e73
mov ebx, dword [esp + 0x10]
jmp 0x406d9f
lea eax, [esp + 0x78]
jmp 0x406dae
mov dword [esp + 0x3c], 1
jmp 0x407014
test al, 8
je 0x40702c
cmp esi, 3
jne 0x40702c
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x58], esi
jne 0x406dc9
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x419fa6
test byte [ecx + 0x1c], 8
je 0x419fa6
mov ecx, dword [esp + 0x2c]
jmp 0x419fba
mov ecx, dword [esp + 0x2c]
or eax, 2
jmp 0x419fbd
cmp dword [esp + 0x58], 3
jne 0x406dc9
or eax, 1
mov dword [edi + 0x1c], eax
jmp 0x406dc9
test ecx, ecx
jne 0x419fda
mov eax, dword [edi + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x406dd6
mov dword [edi + 0x1c], ecx
jmp 0x406dd6
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x40], 1
jne 0x407116
mov eax, dword [edi + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x407116
cmp esi, 3
jne 0x406e0d
and dword [edi + 0x1c], 0xfffffffe
mov eax, dword [edi + 0x1c]
test ecx, ecx
jne 0x41a01f
or eax, 2
jmp 0x41a021
or eax, ecx
mov dword [edi + 0x1c], eax
jmp 0x406e0d
test ecx, ecx
jne 0x406e18
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x406e18
cmp dword [esp + 0x3c], 0
jne 0x406e28
test ecx, ecx
jne 0x406e28
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x406e28
mov ecx, dword [eax + 4]
call fcn.0042973c
test eax, eax
jne 0x41a08a
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x41a07b
lea ecx, [esp + 0x78]
call fcn.0042973c
test eax, eax
jne 0x41a08a
xor edx, edx
mov ecx, edx
jmp 0x41a08f
xor ecx, ecx
inc ecx
xor edx, edx
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a09e
lea eax, [esp + 0x78]
or edi, dword [esp + 0x4c]
mov esi, dword [0x43389c]
or edi, 2
push edi
push edx
push ecx
push 0x428200
jmp 0x406ea5
test eax, eax
jne 0x41a0c0
lea eax, [esp + 0x78]
push dword [esp + 0x4c]
mov edi, dword [esp + 0x1c]
push eax
push dword [edi + 4]
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_CopyFileW]
jmp 0x406eb7
lea eax, [esp + 0x78]
jmp 0x406e97
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
cmp eax, 1
jne 0x41a109
test ebx, ebx
je 0x41a109
mov eax, dword [edi + 0x18]
test dword [eax], 0x400
je 0x41a109
mov dword [0x443d00], 0x40002730
mov ecx, dword [esp + 0x24]
call fcn.0040caaa
mov eax, dword [esp + 0x40]
mov esi, eax
mov ecx, dword [0x443d00]
neg esi
sbb esi, esi
xor edx, edx
and esi, 0x1d
mov dword [0x42d5d4], edx
test ecx, ecx
jne 0x41a13a
push 0x70
pop ecx
mov dword [0x443d00], ecx
cmp dword [0x42d54c], edx
je 0x41a146
mov esi, edx
jmp 0x41a14f
test eax, eax
jne 0x41a14f
call fcn.0042961f
cmp dword [esp + 0x50], 0
je 0x419d58
xor edx, edx
mov ecx, esi
inc edx
jmp 0x41a64e
lea eax, [esp + 0x78]
jmp 0x406ed5
lea ecx, [esp + 0x78]
jmp 0x406ef2
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x41a185
lea ecx, [esp + 0x78]
push ecx
xor edx, edx
push ecx
inc edx
call fcn.004061ee
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, esi
je 0x41a303
mov ecx, ebx
call fcn.0040f521
test eax, eax
jne 0x41a33b
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FlushFileBuffers]
test eax, eax
je 0x41a346
mov ecx, ebx
call fcn.0040caaa
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x41a1d9
lea ecx, [esp + 0x78]
push ecx
push ecx
xor edx, edx
call fcn.004061ee
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, esi
je 0x41a303
mov ecx, ebx
call fcn.0040f521
test eax, eax
jne 0x41a346
mov esi, dword [esp + 0x24]
push eax
push eax
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
lea eax, [esp + 0x60]
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileSize]
mov esi, eax
lea eax, [esp + 0x64]
push eax
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileSize]
cmp esi, eax
jne 0x41a353
mov eax, dword [esp + 0x60]
cmp eax, dword [esp + 0x64]
jne 0x41a353
xor eax, eax
mov esi, eax
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x30]
push dword [esp + 0x2c]
push dword [esp + 0x34]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x41a372
cmp dword [esp + 0x14], 0
je 0x41a372
xor eax, eax
push eax
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x40]
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x41a2f5
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x68], eax
jne 0x41a2f5
cmp dword [esp + 0x28], eax
je 0x41a2d6
xor esi, esi
inc esi
push eax
push dword [esp + 0x38]
push dword [esp + 0x28]
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x41a2f5
test esi, esi
je 0x41a26d
jmp 0x41a372
mov ecx, ebx
call fcn.0040caaa
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a312
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.00414802
add esp, 0xc
jmp 0x406f0e
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.00414802
add esp, 0xc
mov ecx, ebx
call fcn.0040caaa
mov ebx, esi
jmp 0x41a37c
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a32b
jmp 0x41a327
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a362
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.00414802
add esp, 0xc
mov ecx, ebx
call fcn.0040caaa
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x406f0e
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
je 0x41a3e5
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetEndOfFile]
cmp dword [0x42d56c], 0
jne 0x41a43c
cmp dword [0x42d564], 3
jne 0x41a43c
mov eax, dword [edi + 0x1c]
mov ecx, 0x4002
mov esi, dword [esp + 0x20]
and eax, ecx
cmp eax, ecx
jne 0x41a440
mov eax, dword [esp + 0x14]
sub eax, 2
push eax
mov dword [esp + 0x18], eax
lea eax, [esi + 2]
push eax
push esi
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
jmp 0x41a440
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x41a3f4
lea ecx, [esp + 0x78]
push ecx
xor edx, edx
push ecx
inc edx
call fcn.004061ee
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
jne 0x41a39d
mov ecx, dword [esp + 0x24]
call fcn.0040caaa
cmp dword [0x42d5ac], 0
jne 0x41a426
mov ecx, dword [0x443d00]
call fcn.0042961f
cmp dword [0x42d564], 3
jne 0x419d5c
mov ecx, dword [esp + 0x1c]
jmp 0x41a644
mov esi, dword [esp + 0x20]
mov edx, 0x4000
test dword [edi + 0x1c], edx
je 0x41a45d
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x41a45a
or dword [eax + 0x1c], edx
jmp 0x41a45d
or dword [ecx + 0x1c], edx
mov eax, dword [0x42d5d4]
test eax, eax
je 0x41a4e1
cmp dword [esp + 0x14], 0
jle 0x406f0e
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a480
lea eax, [esp + 0x78]
push dword [esp + 0x24]
mov edx, esi
mov ecx, ebx
push eax
push dword [esp + 0x1c]
call fcn.00428f33
cmp dword [0x42d568], 0
je 0x406f0e
mov ecx, ebx
call fcn.0040f521
test eax, eax
jne 0x406f0e
mov edx, dword [esp + 0x280]
test edx, edx
jne 0x41a4bd
lea edx, [esp + 0x78]
push dword [esp + 0x34]
lea ecx, [esp + 0x14]
push esi
push dword [esp + 0x1c]
call fcn.004282ce
cmp eax, 1
jne 0x406f0a
mov ecx, dword [esp + 0x1c]
jmp 0x41a644
mov ecx, dword [esp + 0x6c]
mov esi, dword [esp + 0x24]
cmp ecx, 1
jne 0x41a58c
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a501
lea eax, [esp + 0x78]
mov edx, dword [esp + 0x20]
mov ecx, ebx
push esi
push eax
push dword [esp + 0x1c]
call fcn.00428f33
cmp dword [0x42d568], 0
je 0x41a557
mov ecx, ebx
call fcn.0040f521
test eax, eax
jne 0x41a557
mov edx, dword [esp + 0x280]
test edx, edx
jne 0x41a535
lea edx, [esp + 0x78]
push dword [esp + 0x34]
lea ecx, [esp + 0x14]
push dword [esp + 0x24]
push dword [esp + 0x1c]
call fcn.004282ce
cmp eax, 1
je 0x41a640
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a566
lea eax, [esp + 0x78]
mov edx, dword [esp + 0x20]
mov ecx, esi
push eax
push ebx
push edi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x38]
call fcn.0040770c
mov ecx, eax
mov eax, dword [0x42d5d4]
test eax, eax
je 0x41a4e9
test eax, eax
je 0x406f0e
cmp dword [esp + 0x14], 0
jle 0x406f0e
cmp ecx, 1
jne 0x406f0e
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a5b7
lea eax, [esp + 0x78]
push esi
mov esi, dword [esp + 0x24]
mov ecx, ebx
push eax
push dword [esp + 0x1c]
mov edx, esi
call fcn.00428f33
cmp dword [0x42d568], 0
je 0x406f0e
mov ecx, ebx
call fcn.0040f521
test eax, eax
jne 0x406f0e
mov edx, dword [esp + 0x280]
test edx, edx
jne 0x41a5f5
lea edx, [esp + 0x78]
push dword [esp + 0x34]
lea ecx, [esp + 0x14]
push esi
push dword [esp + 0x1c]
call fcn.004282ce
cmp eax, 1
jne 0x406f0a
mov ecx, dword [esp + 0x1c]
jmp 0x41a644
mov ecx, ebx
call fcn.0040caaa
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41a62c
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
mov dword [esp + 0x38], 1
jmp 0x406f56
mov ecx, dword [esp + 0x1c]
call fcn.00412323
xor edx, edx
inc edx
xor ecx, ecx
call fcn.004283b9
mov ecx, dword [esp + 0x1c]
jmp 0x41a644
xor ecx, ecx
push ecx
push eax
call fcn.00415469
pop ecx
pop ecx
mov ecx, dword [esp + 0x24]
call fcn.0040caaa
mov ecx, dword [esp + 0x1c]
call fcn.00412323
lea ecx, [esp + 0x290]
call fcn.0040fd18
lea ecx, [esp + 0x4a8]
call fcn.0040fd18
lea ecx, [esp + 0x6c0]
call fcn.0040fd18
lea ecx, [esp + 0x78]
call fcn.0040fd18
xor eax, eax
inc eax
jmp 0x4070a8
mov ecx, dword [esp + 0x1c]
call fcn.00412323
cmp ebx, 0xffffffff
je 0x41a676
mov ecx, ebx
call fcn.0040caaa
jmp 0x41a676
cmp ebx, 0xffffffff
je 0x40706c
mov edx, dword [esp + 0x30]
xor eax, eax
push eax
push ebx
mov ecx, edi
call fcn.004076a8
jmp 0x40706c