Function at 0x42b2ad
Capabilities:
Check if file exists
Clear file content
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
mov ebx, eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 1
test byte [edx + 0x168], 4
je 0x42a4b0
cmp dword [ebx + 0x80], 0
jne 0x42a4b0
cmp dword [ebx + 0x2c], 0
je 0x42cac8
cmp dword [ebx + 0xa4], 0
je 0x42a4c2
mov byte [ebp - 0x13c], 0
jmp 0x42a509
mov esi, dword [ebx + 0x58]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x38], esi
lea esi, [ebp - 0x24]
mov dword [esp + 0xc], esi
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x2c], edx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], edi
call fcn.004290bc
test eax, eax
je 0x42a509
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x13c]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x42a526
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x42a511
dec eax
mov edx, dword [ebp - 4]
movsx esi, ax
add esi, 0xa
mov word [edx + 0x152], ax
lea ecx, [edx + 0x60]
push ecx
push 0
push esi
mov dword [ebp - 0x158], ecx
call fcn.004250b0
add esp, 0xc
test eax, eax
je 0x42a55c
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x13c]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x42a568
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
or edx, dword [eax + 0x9c]
jne 0x42a597
mov dword [eax + 0x98], 1
mov dword [eax + 0x9c], 0
cmp dword [ebx + 0x44], 0
je 0x42a5bb
or byte [eax + 0x169], 0x40
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0x80000000
or byte [eax + 0x16f], 0x10
jmp 0x42a5c9
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0xc0000000
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x42d7b3
cmp eax, 2
je 0x42a678
cmp eax, 1
jne 0x42a614
mov eax, dword [ebp - 4]
mov dword [ebp - 0x15c], 0
or byte [eax + 0x169], 0x40
mov edx, dword [ebp - 0x20]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x42a69e
cmp eax, 3
jne 0x42a655
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42a81f
mov dword [ebp - 0x15c], 0
or byte [eax + 0x16e], 1
mov edx, dword [ebp - 0x20]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x42a69e
mov edx, dword [ebp - 4]
mov eax, 0x2ed
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42a674
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42a81f
xor eax, eax
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0xc0000000
mov dword [ebp - 0x15c], eax
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x42a776
cmp eax, 2
je 0x42a750
cmp eax, 1
jne 0x42a6ec
mov eax, dword [ebp - 4]
mov dword [ebp - 0x15c], 0
or byte [eax + 0x169], 0x40
mov edx, dword [ebp - 0x20]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x42a776
cmp eax, 3
jne 0x42a72d
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42a81f
mov dword [ebp - 0x15c], 0
or byte [eax + 0x16e], 1
mov edx, dword [ebp - 0x20]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x14], 0x80
mov dword [ebp - 0x20], edx
jmp 0x42a776
mov edx, dword [ebp - 4]
mov eax, 0x23b
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42a74c
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42a81f
xor eax, eax
or dword [ebp - 0x14], 0x80
or dword [ebp - 0x20], 0xc0000000
mov dword [ebp - 0x15c], eax
mov eax, dword [ebx]
cmp eax, 5
ja case.default.0x42a788
mov eax, dword [eax*4 + 0x4d5384]
jmp eax
mov eax, dword [ebp - 4]
or byte [eax + 0x16b], 4
and byte [eax + 0x168], 0x7b
jmp case.0x42a788.0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 0x10
mov byte [edx + 0x16b], al
jmp 0x42a7fa
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42a81f
mov edx, eax
movzx eax, byte [edx + 0x16b]
or eax, 3
mov byte [edx + 0x16b], al
jmp 0x42a7fa
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 8
mov byte [edx + 0x16b], al
jmp 0x42a7fa
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 2
mov byte [edx + 0x16b], al
mov edx, dword [ebx + 0x58]
cmp edx, 5
ja case.default.0x42a80d
mov edx, dword [edx*4 + 0x4d539c]
jmp edx
test al, 1
je 0x42a831
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
jne 0x42a831
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
or dword [ebp - 0x18], 2
or dword [ebp - 0x14], 0x4000002
or byte [eax + 0x16a], 4
jmp 0x42a8e0
test al, 1
je 0x42a86d
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
jne 0x42a86d
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
or dword [ebp - 0x18], 1
jmp 0x42a8e0
mov eax, dword [ebp - 4]
or byte [eax + 0x16a], 2
or dword [ebp - 0x18], 3
jmp 0x42a8e0
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je case.0x42a80d.4
push str.USER
lea eax, [ebp - 0x13c]
push eax
call fcn.00468a60
add esp, 8
test eax, eax
jne case.0x42a80d.4
mov eax, dword [ebp - 4]
or byte [eax + 0x16a], 8
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
je 0x42a8c6
test byte [eax + 0x168], 4
je 0x42a8cf
test byte [eax + 0x16f], 0x10
je case.0x42a80d.5
or byte [eax + 0x16a], 2
or dword [ebp - 0x18], 3
jmp 0x42a8e0
or dword [ebp - 0x18], 4
mov eax, dword [ebx + 0x28]
cmp eax, 6
ja case.default.0x42aa5d
mov eax, dword [eax*4 + 0x4d53b4]
jmp eax
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 4
je case.0x42a8f3.2
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16a]
test al, 4
jne 0x42a81f
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x16a], al
jmp case.0x42a8f3.0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16a]
test al, 4
jne 0x42a81f
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x16a], al
jmp case.0x42a8f3.0
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42a81f
mov edx, eax
movzx eax, byte [edx + 0x16a]
or eax, 8
mov byte [edx + 0x16a], al
mov edx, dword [ebx + 0x28]
cmp edx, 5
jne 0x42a98e
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x16a], al
jmp case.0x42a8f3.0
cmp edx, 6
jne case.0x42a8f3.0
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x16a], al
jmp case.0x42a8f3.0
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 4
je case.0x42a8f3.0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x34]
cmp eax, 4
ja case.default.0x42a9d2
mov eax, dword [eax*4 + 0x4d53d0]
jmp eax
mov eax, dword [ebp - 4]
or byte [eax + 0x170], 2
jmp 0x42aa3f
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x168]
test edx, 0x80
jne 0x42aa2c
or byte [eax + 0x16a], 0x80
jmp 0x42aa3f
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
test al, 8
jne 0x42aa11
test al, 0x10
jne 0x42aa11
test al, 4
je case.0x42a9d2.1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x168]
test edx, 0x80
jne 0x42aa2c
or byte [eax + 0x16a], 0x80
jmp 0x42aa3f
or byte [eax + 0x170], 1
jmp 0x42aa3f
mov eax, dword [ebp - 4]
or byte [eax + 0x16a], 0x40
mov edx, eax
mov eax, dword [ebx + 0x4c]
mov byte [edx + 0x154], al
mov edx, dword [ebx + 0x4c]
cmp edx, 8
ja case.default.0x42aa5d
mov edx, dword [edx*4 + 0x4d53e4]
jmp edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
jne 0x42aa84
test dl, 0x10
jne 0x42aa84
test dl, 4
jne 0x42aa84
mov edx, dword [ebp - 4]
test byte [edx + 0x16a], 0x40
je case.0x42aa5d.0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 4
mov eax, 4
jmp case.0x42aa5d.0
mov edx, dword [ebp - 4]
test byte [edx + 0x16b], 4
je case.0x42aa5d.0
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov byte [ecx + 0x156], dl
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x42d730
cmp edx, 1
je 0x42ab3d
cmp edx, 2
jne 0x42ab16
mov edx, ecx
test byte [edx + 0x16b], 4
jne 0x42a81f
test byte [edx + 0x16a], 0x40
je 0x42ab4c
movsx edx, al
cmp edx, 5
jl 0x42ab4c
cmp edx, 8
jg 0x42ab4c
mov edx, ecx
mov byte [edx + 0x156], 3
jmp 0x42ab4c
cmp edx, 3
je 0x42ab4c
mov edx, ecx
mov eax, 0x2f2
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42ab39
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, ecx
test byte [edx + 0x16b], 4
jne 0x42a81f
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x42d709
cmp edx, 1
je 0x42abca
cmp edx, 2
jne 0x42ab7d
mov eax, dword [ebp - 4]
test byte [eax + 0x16b], 0x10
jne 0x42a81f
mov byte [eax + 0x155], 2
jmp 0x42ac14
cmp edx, 3
jne case.default.0x42aa5d
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
jne 0x42a81f
test dl, 1
jne 0x42a81f
test dl, 4
jne 0x42a81f
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x155], 3
mov ecx, 3
jmp 0x42ac0f
mov eax, 0x30
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
je 0x42abf7
movsx ecx, al
cmp ecx, 1
je 0x42abf7
test ecx, ecx
je 0x42abf7
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
test dl, 0x10
jne 0x42a81f
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x155], 1
mov ecx, 1
test dl, 8
je 0x42ac64
push str.FOR_DO_NOT_CASHE_DIRECT_FILE
call fcn.004675e0
add esp, 4
mov edx, eax
test edx, edx
je 0x42ac4c
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x100]
call fcn.0042d920
test eax, eax
je 0x42ac4c
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x154]
movsx ecx, byte [edx + 0x155]
jmp 0x42ac64
mov edx, dword [ebp - 4]
or dword [ebp - 0x14], 0x10000000
movsx eax, byte [edx + 0x154]
movsx ecx, byte [edx + 0x155]
cmp dword [ebx + 0x4c], 0
jne 0x42ad15
cmp ecx, 3
je 0x42ac8c
cmp ecx, 2
je 0x42ac8c
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x16b]
test dl, 8
jne 0x42ac8c
test dl, 0x10
je 0x42ac9d
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 1
mov eax, 1
jmp 0x42ad15
movzx eax, byte [eax + 0x170]
test al, 1
jne 0x42acc7
test al, 2
jne 0x42acc7
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16a]
and eax, 0x80
shr eax, 7
test dl, 4
je 0x42acd8
test eax, eax
je 0x42aced
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 5
mov eax, 5
jmp 0x42ad2e
test eax, eax
je 0x42aced
mov eax, dword [ebp - 4]
mov byte [eax + 0x154], 4
mov eax, 4
jmp 0x42ad2e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 3
je 0x42ad07
mov byte [eax + 0x154], 8
mov eax, 8
jmp 0x42ad2e
mov byte [eax + 0x154], 5
mov eax, 5
jmp 0x42ad2e
cmp ecx, 3
je 0x42ad33
cmp ecx, 2
je 0x42ad33
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 8
jne 0x42ad33
test dl, 0x10
je 0x42ad4d
movsx edx, al
cmp edx, 1
je 0x42ad50
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movsx edx, al
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x42ad82
movzx eax, byte [eax + 0x16b]
test al, 1
jne 0x42ad6b
test al, 2
je 0x42ad82
cmp edx, 5
je 0x42ad8b
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp edx, 4
je 0x42d6e7
or dword [ebp - 0x1c], 1
cmp dword [ebx + 0x54], 0
jne 0x42ada1
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x42adc2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x160], 0
or byte [eax + 0x16a], 1
and byte [eax + 0x170], 0xfb
or dword [ebp - 0x1c], 2
jmp 0x42adcc
mov dword [ebp - 0x160], 1
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x42ae0c
cmp eax, 1
je 0x42ae00
cmp eax, 2
je 0x42ae16
mov edx, dword [ebp - 4]
mov eax, 0x23d
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42adfc
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
jmp 0x42ae29
cmp dword [ebp - 0x34], 0
je 0x42d6c0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
or eax, 0x20
mov byte [edx + 0x16b], al
and eax, 4
mov edx, dword [ebx + 0x48]
shr eax, 2
mov dword [ebp - 0x164], edx
test edx, edx
je 0x42ae52
test eax, eax
je 0x42aeb9
mov eax, 0x70
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x42b013
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 0x40
je 0x42ae88
mov eax, dword [0x6e1a10]
cmp eax, 0xfffffffe
mov dword [ebp - 0x164], eax
je 0x42d82c
cmp dword [ebp - 0x164], 0xffffffff
jne 0x42aea9
jmp 0x42b013
mov eax, dword [0x6e1a14]
cmp eax, 0xfffffffe
mov dword [ebp - 0x164], eax
je 0x42d81a
cmp dword [ebp - 0x164], 0xffffffff
je 0x42b013
mov dword [ebx + 0x48], eax
cmp dword [ebp - 0x164], 0
je 0x42b013
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x42aef8
cmp dword [ebp - 0x164], 0
jle 0x42aee6
mov ecx, 0xfffffffa
xor esi, esi
mov eax, dword [ebp - 0x164]
cdq
sub eax, ecx
sbb edx, esi
jl 0x42af05
or eax, edx
je 0x42af05
mov eax, 0x245
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x164], 0
jle 0x42d83e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x164]
mov dword [edx + 0xfc], eax
movzx edx, byte [edx + 0x16a]
and edx, 0x80
shr edx, 7
test edx, edx
je 0x42af4f
mov eax, dword [ebp - 4]
test byte [eax + 0x16c], 0x10
jne 0x42af4f
mov ecx, dword [ebp - 0x164]
cmp dword [ebx + 0x7c], 0
lea eax, [ecx*4]
jne 0x42af49
mov ecx, eax
mov dword [ebp - 0x164], ecx
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x154]
dec eax
cmp eax, 7
ja case.default.0x42af6a
mov eax, dword [eax*4 + 0x4d5408]
jmp eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x164]
cmp byte [eax + 0x156], 3
lea edx, [ecx + 1]
jne 0x42af83
mov ecx, edx
mov dword [ebp - 0x164], ecx
jmp case.0x42af6a.1
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x16b]
test byte [ecx + 0x170], 2
jne 0x42afa6
test al, 4
je case.0x42af6a.1
test edx, edx
je case.0x42af6a.1
mov edx, ecx
or eax, 0xffffff80
mov dword [ebp - 0x164], 0x400
mov dword [edx + 0xfc], 0x10000
mov byte [edx + 0x16b], al
jmp case.0x42af6a.1
mov eax, dword [ebp - 0x164]
add eax, 4
mov dword [ebp - 0x164], eax
jmp case.0x42af6a.1
mov eax, dword [ebp - 0x164]
add eax, 8
mov dword [ebp - 0x164], eax
jmp case.0x42af6a.1
push 0x6ba
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0041b620
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x164]
mov dword [edx + 0xf8], eax
jmp 0x42b11f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x154], 1
je 0x42b032
mov esi, eax
movzx eax, byte [esi + 0x16b]
test al, 8
mov dword [ebp - 0x164], eax
je 0x42b055
mov edx, dword [ebp - 4]
mov eax, 0x241
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b051
mov eax, 0x25
mov esp, ebp
pop ebp
ret
mov eax, esi
movzx eax, byte [eax + 0x170]
test al, 1
jne 0x42b087
test al, 2
jne 0x42b087
mov eax, esi
mov ecx, dword [ebp - 0x164]
and ecx, 4
shr ecx, 2
movzx edx, byte [eax + 0x16a]
test ecx, ecx
je 0x42b09f
test edx, 0x80
je 0x42b09f
mov eax, esi
mov dword [eax + 0xf8], 0x400
mov dword [eax + 0xfc], 0x10000
jmp 0x42b10e
test byte [eax + 0x168], 4
je 0x42b0c2
test dl, 0x40
je 0x42b0c2
mov edx, eax
mov eax, 0x400
mov dword [edx + 0xf8], eax
mov dword [edx + 0xfc], eax
jmp 0x42b10e
test edx, 0x80
je 0x42b0e0
mov dword [eax + 0xf8], 0x800
mov dword [eax + 0xfc], 0x1fe
jmp 0x42b10e
test ecx, ecx
je 0x42b0fa
mov dword [eax + 0xf8], 0x401
mov dword [eax + 0xfc], 0x400
jmp 0x42b10e
mov dword [eax + 0xf8], 0x85
mov dword [eax + 0xfc], 0x84
mov edx, esi
mov eax, dword [ebp - 0x164]
or eax, 0xffffff80
mov byte [edx + 0x16b], al
mov eax, dword [ebx + 4]
test eax, eax
je 0x42b132
mov dword [edx + 0x54], eax
mov eax, dword [ebx + 8]
mov byte [edx + 0x157], al
mov eax, dword [ebx + 0x3c]
mov dword [edx + 0xd8], eax
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x42b1b3
mov eax, dword [ebp - 4]
test byte [eax + 0x16a], 0x40
jne 0x42b170
mov edx, eax
mov eax, 0x2ee
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b16c
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x42b1b3
cmp edx, 1
jne 0x42b183
mov byte [eax + 0x159], 0x27
jmp 0x42b1bd
cmp edx, 3
jne 0x42b191
mov byte [eax + 0x159], 0x22
jmp 0x42b1bd
mov edx, eax
mov eax, 0x2ef
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b1af
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x159], 0
mov edx, dword [ebx + 0x74]
test edx, edx
je 0x42b224
test byte [eax + 0x16a], 0x40
jne 0x42b1ef
mov edx, eax
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b1eb
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x42b224
cmp edx, 1
jne 0x42b202
and byte [eax + 0x16e], 0xfd
jmp 0x42b242
mov edx, eax
mov eax, 0x2f1
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b220
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, eax
movzx eax, byte [edx + 0x16e]
movzx esi, byte [edx + 0x168]
and eax, 0xfffffffd
and esi, 2
or eax, esi
mov byte [edx + 0x16e], al
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x42b295
cmp eax, 2
je 0x42b27b
cmp eax, 1
je 0x42b27b
cmp eax, 3
je 0x42b27b
mov edx, dword [ebp - 4]
mov eax, 0x2ec
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b277
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
test al, 8
jne 0x42a81f
test al, 0x10
jne 0x42a81f
mov eax, dword [ebx + 0x90]
cmp eax, 5
ja case.default.0x42b2ab
mov eax, dword [eax*4 + 0x4d5428]
jmp eax
mov ecx, dword [ebp - 4]
and dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x16a]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x42b464
mov ecx, dword [ebp - 4]
and dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x16a]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x42b464
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
or edx, 2
and edx, 0xfffffffe
mov dword [ebp - 0x1c], edx
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffcb
movzx edx, byte [ecx + 0x16a]
or eax, 8
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
mov dword [ebp - 0x160], 0
jmp 0x42b464
mov ecx, dword [ebp - 4]
or dword [ebp - 0x1c], 2
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
or eax, 4
movzx edx, byte [ecx + 0x16a]
and eax, 0xffffffc7
or edx, 1
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x42b464
cmp dword [ebx + 0x54], 0
jne 0x42b3c3
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x42b3f8
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x160], 0
movzx edx, byte [ecx + 0x16a]
movzx eax, byte [ecx + 0x170]
or edx, 1
or eax, 4
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x42b464
cmp dword [ebx + 0x50], 0
je 0x42b439
mov ecx, eax
and dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x160], 0
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x16a]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
jmp 0x42b464
mov ecx, eax
movzx eax, byte [ecx + 0x170]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x16a]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x16a], dl
mov dword [ebp - 0x164], eax
mov byte [ecx + 0x170], al
mov eax, edx
and eax, 0x40
mov ecx, dword [ebx + 0xb4]
shr eax, 6
test ecx, ecx
je 0x42b49d
test eax, eax
jne 0x42b49d
mov edx, dword [ebp - 4]
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b499
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov byte [esi + 0x15f], cl
mov ecx, dword [ebx + 0xb8]
test ecx, ecx
je 0x42b4d6
test eax, eax
jne 0x42b4d6
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b4d2
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x161], cl
mov ecx, dword [ebx + 0xbc]
test ecx, ecx
je 0x42b50c
test eax, eax
jne 0x42b50c
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b508
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x163], cl
mov ecx, dword [ebx + 0xc0]
test ecx, ecx
je 0x42b542
test eax, eax
jne 0x42b544
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42b53e
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
test eax, eax
mov eax, esi
mov byte [eax + 0x165], cl
je 0x42b59c
movzx eax, byte [eax + 0x16b]
test al, 2
jne 0x42b55d
test al, 1
je 0x42b56e
mov eax, esi
mov dword [eax + 0x138], 3
jmp 0x42b64d
test al, 8
je 0x42b583
mov eax, esi
mov dword [eax + 0x138], 2
jmp 0x42b64d
test al, 0x10
je 0x42b64d
mov eax, esi
mov dword [eax + 0x138], 8
jmp 0x42b64d
test edx, 0x80
jne 0x42b5ad
test byte [ebp - 0x164], 1
je 0x42b605
movzx eax, byte [eax + 0x16b]
test al, 2
jne 0x42b5bc
test al, 1
je 0x42b5e1
test byte [ebp - 0x164], 1
je 0x42b5d3
mov eax, esi
mov dword [eax + 0x138], 7
jmp 0x42b64d
mov eax, esi
mov dword [eax + 0x138], 0xb
jmp 0x42b64d
test al, 8
je 0x42b5f3
mov eax, esi
mov dword [eax + 0x138], 6
jmp 0x42b64d
test al, 0x10
je 0x42b64d
mov eax, esi
mov dword [eax + 0x138], 9
jmp 0x42b64d
test byte [ebp - 0x164], 2
movzx eax, byte [eax + 0x16b]
je 0x42b64d
test al, 2
jne 0x42b61d
test al, 1
je 0x42b62b
mov eax, esi
mov dword [eax + 0x138], 5
jmp 0x42b64d
test al, 8
je 0x42b63d
mov eax, esi
mov dword [eax + 0x138], 4
jmp 0x42b64d
test al, 0x10
je 0x42b64d
mov eax, esi
mov dword [eax + 0x138], 0xa
mov eax, dword [0x6e39a0]
cmp dword [ebx + 0x84], 0
je 0x42b671
test eax, eax
jne 0x42b671
mov eax, 0x232
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x94], 0
je 0x42d658
test eax, eax
je 0x42ca2a
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0x164], eax
mov eax, dword [ebx + 0x9c]
cmp eax, 1
je 0x42b6fb
test eax, eax
jne 0x42b6c0
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x20
jne 0x42b6c9
push str.FORT_BUFFERED
call fcn.004307b0
add esp, 4
test eax, eax
je 0x42b6fb
jmp 0x42b6c9
cmp eax, 2
jne case.default.0x42aa5d
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 4]
call fcn.0040c9e0
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x171]
shl edx, 6
and ecx, 0xffffffbf
or ecx, edx
mov byte [esi + 0x171], cl
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 4]
call fcn.0040c9e0
mov dword [ebp - 0x140], eax
add esp, 8
cmp dword [ebp - 0x140], 0xffffffff
je 0x42b785
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
cmp eax, 3
jne 0x42b739
mov eax, dword [ebp - 4]
mov dword [eax + 0x138], 1
jmp 0x42b73e
cmp eax, 5
jne 0x42b75a
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 4
je 0x42b785
or byte [eax + 0x16a], 2
mov dword [ebp - 0x18], 3
jmp 0x42b785
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x168]
test dl, 4
je 0x42b785
mov eax, 0x229
test dl, 0x20
mov ebx, dword [ebp - 0x10]
jne 0x42b77b
mov eax, 0x33
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x6e39a0]
test ecx, ecx
jne 0x42b7a4
cmp dword [ebp - 0x140], 0xfffffffa
jne 0x42b7d4
mov dword [ebp - 0x140], 1
jmp 0x42b7ee
cmp dword [ebp - 0x140], 0xfffffffa
je 0x42d49a
cmp dword [ebp - 0x140], 1
je 0x42b7ee
cmp dword [ebp - 0x164], 0
jne 0x42ca2a
cmp dword [ebx + 0x84], 0
jne 0x42b65f
cmp dword [ebp - 0x140], 0xfffffffc
je 0x42d5c9
cmp dword [ebp - 0x140], 0
jl 0x42d485
mov eax, dword [ebp - 4]
cmp dword [eax + 0x138], 1
jne 0x42b82c
cmp dword [ebp - 0x140], 0
je 0x42b815
cmp dword [ebp - 0x140], 2
je 0x42b815
cmp dword [ebp - 0x140], 1
jne 0x42b82c
mov edx, eax
shl ecx, 7
movzx eax, byte [edx + 0x170]
and eax, 0x7f
or eax, ecx
mov byte [edx + 0x170], al
cmp dword [ebp - 0x24], 0
je 0x42b8e0
cmp dword [ebx + 0xa4], 0
jne 0x42b8b9
cmp dword [ebx + 0x68], 0
je 0x42cade
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x13c]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], 0
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x42b87f
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x42b86a
dec eax
push eax
lea edx, [ebp - 0x148]
push edx
lea edi, [ebp - 0x144]
push edi
lea ecx, [ebp - 0x14]
push ecx
lea esi, [ebp - 0x18]
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x13c]
push ecx
call dword [ebx + 0x68]
add esp, 0x24
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe4], esi
jmp 0x42b8e9
push dword [ebx + 0xa8]
call fcn.0046eb80
add esp, 4
mov esi, eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], esi
mov eax, dword [ebx + 0xa8]
mov dword [edx + 0x178], eax
jmp 0x42b8e9
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xe4]
cmp esi, 0xffffffff
je 0x42d1e8
cmp dword [ebx + 0xa4], 0
jne 0x42ba17
mov eax, dword [ebp - 4]
cmp dword [0x6e1a30], 0
mov dword [eax + 0x178], 0xffffffff
je 0x42ba17
movzx eax, byte [eax + 0x16b]
test al, 8
jne 0x42ba17
cmp dword [ebp - 0x24], 0
je 0x42b99f
mov edx, dword [ebp - 4]
test byte [edx + 0x170], 2
jne 0x42b94d
test al, 4
je 0x42b954
movzx ecx, byte [edx + 0x16a]
test ecx, 0x80
je 0x42b954
mov edx, 0x8000
jmp 0x42b956
xor edx, edx
mov ecx, dword [ebp - 0x20]
test ecx, 0xc0000000
je 0x42b966
or edx, 2
jmp 0x42b975
mov edi, edx
or edi, 1
test ecx, 0x40000000
je 0x42b975
mov edx, edi
cmp dword [ebx + 0x78], 1
je 0x42b97f
test al, 1
je 0x42b982
or edx, 8
push edx
push esi
call fcn.0046ecf0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x178], eax
mov eax, dword [0x6e39a0]
jmp 0x42ba1c
cmp dword [0x6e39a0], 0
jne 0x42ba20
cmp dword [ebp - 0x140], 1
je 0x42b9fb
cmp dword [ebp - 0x140], 0
jne 0x42b9d6
call fcn.00469720
push eax
call fcn.0046f060
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x178], eax
jmp 0x42ba51
cmp dword [ebp - 0x140], 2
jne 0x42ba51
call fcn.00469720
add eax, 0x40
push eax
call fcn.0046f060
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x178], eax
jmp 0x42ba51
call fcn.00469720
add eax, 0x20
push eax
call fcn.0046f060
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x178], eax
jmp 0x42ba51
mov eax, dword [0x6e39a0]
test eax, eax
je 0x42ba48
mov eax, dword [ebp - 0x140]
lea ecx, [eax + 6]
cmp ecx, 0x20
jae 0x42ba48
mov eax, 1
shl eax, cl
test eax, 0x1c1
je 0x42ba48
mov dword [ebp - 0x164], 2
jmp 0x42ba5e
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xe4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x156]
test eax, eax
jne 0x42bb8f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x154], 1
je 0x42cb0b
movzx edx, byte [eax + 0x169]
and edx, 6
shr edx, 1
test edx, edx
je 0x42bb27
mov ecx, dword [eax + 0x100]
add ecx, 2
cmp ecx, 0x20
jae 0x42bb27
mov eax, 1
shl eax, cl
test eax, 0x103
je 0x42bb27
cmp edx, 1
je 0x42bb07
cmp edx, 2
jne 0x42bae1
mov eax, dword [ebp - 4]
mov byte [eax + 0x156], 2
movzx ecx, byte [eax + 0x168]
movzx edx, byte [eax + 0x16a]
inc dword [eax + 0xf8]
jmp 0x42bbc3
cmp edx, 3
jne case.default.0x42aa5d
mov eax, dword [ebp - 4]
mov byte [eax + 0x156], 3
movzx ecx, byte [eax + 0x168]
movzx edx, byte [eax + 0x16a]
jmp 0x42bbc3
mov eax, dword [ebp - 4]
mov byte [eax + 0x156], 1
movzx ecx, byte [eax + 0x168]
movzx edx, byte [eax + 0x16a]
inc dword [eax + 0xf8]
jmp 0x42bb83
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x168]
test cl, 4
movzx edx, byte [eax + 0x16a]
je 0x42bb63
cmp dword [eax + 0x138], 1
je 0x42bb76
test dl, 0x40
je 0x42bb54
cmp dword [ebp - 0x164], 2
je 0x42bb76
mov byte [eax + 0x156], 2
inc dword [eax + 0xf8]
jmp 0x42bbc3
test dl, 0x40
je 0x42bb54
cmp dword [ebp - 0x164], 2
jne 0x42bb54
test cl, 1
je 0x42bb54
mov byte [eax + 0x156], 1
inc dword [eax + 0xf8]
mov eax, dword [ebp - 4]
add dword [eax + 0xf8], 5
jmp 0x42bbc3
mov edx, dword [ebp - 4]
cmp eax, 3
movzx ecx, byte [edx + 0x168]
movzx edx, byte [edx + 0x16a]
je 0x42bbc3
mov esi, dword [ebp - 4]
movsx edi, byte [esi + 0x154]
cmp edi, 1
je 0x42bbba
inc dword [esi + 0xf8]
cmp eax, 1
je 0x42d1da
test cl, 1
je 0x42bbe3
mov eax, dword [ebp - 4]
test byte [eax + 0x16b], 8
je 0x42bbe3
cmp byte [eax + 0x155], 2
jne 0x42bbe3
inc dword [eax + 0xf8]
test cl, 4
je 0x42bc07
mov eax, dword [ebp - 4]
and edx, 0x40
shr edx, 6
test byte [eax + 0x16b], 8
je 0x42bc0d
test edx, edx
je 0x42bc0d
add dword [eax + 0xf8], 2
jmp 0x42bc0d
and edx, 0x40
shr edx, 6
cmp dword [ebp - 0x164], 1
jne 0x42bc25
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16c]
or eax, 8
jmp 0x42bc32
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16c]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
test edx, edx
mov byte [ecx + 0x16c], al
je 0x42bd16
push dword [ebp - 4]
call fcn.00424910
add esp, 4
test eax, eax
jne 0x42a4fc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x42bd16
movzx eax, byte [edx + 0x1e]
test eax, eax
je 0x42bd16
mov esi, dword [edx + 0xc]
movzx eax, byte [esi + 0x16d]
test al, 0x40
je 0x42bc8b
cmp byte [esi + 0x156], 1
je 0x42cb44
push esi
call fcn.0042e850
add esp, 4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
test edx, edx
je 0x42bca2
mov byte [edx + 0x1e], 0
test eax, eax
je 0x42bd01
mov edx, dword [esi + 0x18]
test edx, edx
je 0x42cb7b
test byte [edx + 0x44], 2
je 0x42bcdc
mov dword [edx + 0x38], eax
mov edx, dword [esi + 0x18]
mov dword [edx + 0x3c], eax
mov edx, dword [esi + 0x64]
test edx, edx
je 0x42bccf
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x64], ecx
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push eax
movzx edx, byte [esi + 0x16c]
push eax
and edx, 7
push edx
push 0xffffffffffffffff
push esi
call fcn.00428620
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
add dword [esi + 0x98], 1
adc dword [esi + 0x9c], 0
and byte [esi + 0x16f], 0xfb
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
test al, 8
je 0x42bd42
mov edx, dword [ebp - 4]
test byte [edx + 0x16c], 8
jne 0x42bd42
mov eax, 0x33
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 0
je 0x42c65a
cmp dword [ebx + 0x58], 5
je 0x42d08f
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x42c649
cmp eax, 2
je 0x42c649
cmp eax, 3
jne 0x42bda2
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16b]
and eax, 0xfffffffe
and byte [edx + 0x16f], 0xfb
mov byte [edx + 0x16b], al
mov dword [edx + 0x98], 1
mov dword [edx + 0x9c], 0
jmp 0x42c65a
cmp eax, 1
jne 0x42bf77
cmp dword [ebx + 0x58], 5
je 0x42d065
mov eax, dword [ebp - 4]
test byte [eax + 0x16c], 8
jne 0x42bdcd
movzx eax, byte [eax + 0x16b]
jmp 0x42c65a
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, eax
mov eax, dword [esi + 0xe4]
call fcn.0042d870
mov dword [ebp - 0x164], eax
mov eax, 0xffffffff
mov ecx, edx
mov esi, dword [ebp - 0x164]
sub ecx, eax
sub esi, eax
or esi, ecx
je 0x42d023
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x164]
movzx eax, byte [esi + 0x16b]
and byte [esi + 0x16f], 0xfb
and eax, 0xfffffffe
mov dword [esi + 0x98], 0x80000000
mov dword [esi + 0x9c], 0xffffffff
mov byte [esi + 0x16b], al
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], edx
cmp dword [esi + 0x138], 5
je 0x42c65a
mov eax, esi
movsx edx, byte [eax + 0x154]
lea eax, [edx - 1]
cmp eax, 7
ja case.default.0x42be71
mov eax, dword [eax*4 + 0x4d5440]
jmp eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
jmp 0x42c65a
push 0xdf2
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0041b620
add esp, 0x10
mov eax, esi
movzx eax, byte [eax + 0x16b]
jmp 0x42c65a
mov eax, dword [ebp - 4]
or byte [eax + 0x16f], 4
movzx eax, byte [eax + 0x16b]
test al, 1
je 0x42c701
mov edx, dword [ebp - 4]
test byte [edx + 0x16c], 8
je 0x42c72e
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.0042d870
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x42ccac
mov eax, esi
cmp dword [eax + 0x138], 7
jne 0x42c6d9
mov ecx, 0xffffffff
mov edx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov eax, dword [esi + 0xe4]
call fcn.0042d870
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x42ccac
mov eax, esi
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x16f], 0xfb
movzx eax, byte [eax + 0x16b]
test al, 1
jne 0x42c72e
mov edx, dword [ebp - 4]
test byte [edx + 0x16c], 8
je 0x42c72e
test byte [edx + 0x168], 4
je 0x42c71a
test al, 8
jne 0x42c72e
test byte [edx + 0x16a], 0x40
jne 0x42c727
test al, 4
jne 0x42c72e
or byte [edx + 0x16d], 8
test eax, 0x80
jne 0x42c747
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf8]
mov word [edx + 0x150], ax
jmp 0x42c77e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 1
je 0x42d1a1
test byte [eax + 0x168], 4
je 0x42c770
mov edx, eax
mov eax, 0x4f
mov word [edx + 0x150], ax
jmp 0x42c77e
mov edx, eax
mov eax, 0x50
mov word [edx + 0x150], ax
mov edx, dword [ebx + 0x14]
test edx, edx
jle 0x42d162
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x10]
movzx ecx, byte [ecx + 0x168]
and ecx, 4
shr ecx, 2
test ecx, ecx
je 0x42c7ae
cmp eax, 0x7ffffe00
jle 0x42c7ae
mov eax, 0x7ffffe00
jmp 0x42c7b6
test eax, eax
jle 0x42d117
add eax, 0x1ff
and eax, 0xfffffe00
mov dword [ebx + 0x10], eax
mov ecx, dword [ebp - 4]
test byte [ecx + 0x16b], 8
je 0x42c83c
mov edx, ecx
test byte [edx + 0x168], 4
je 0x42c7ec
imul edx, eax
mov esi, dword [ecx + 0xf8]
mov dword [ebp - 0x164], esi
lea ecx, [esi + 4]
cmp ecx, edx
ja 0x42c854
mov eax, 0x234
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23f
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42ca5b
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42ca7e
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42caa1
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23c
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42cac4
mov eax, 0x30
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x58], 0
jne 0x42a4b0
mov dword [ebx + 0x58], 3
jmp 0x42a4b0
xor eax, eax
lea edx, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe4], esi
jmp 0x42b8e9
movzx ecx, byte [eax + 0x168]
test cl, 4
movzx edx, byte [eax + 0x16a]
je 0x42cb38
test byte [eax + 0x16b], 8
je 0x42cb38
test dl, 0x40
je 0x42cb38
mov byte [eax + 0x156], 2
jmp 0x42bbc3
mov byte [eax + 0x156], 3
jmp 0x42bbc3
mov ecx, dword [esi + 0x38]
movsx edx, byte [ecx + 5]
cmp edx, 0x20
je 0x42cb6e
cmp edx, 0x2b
jne 0x42cb60
mov byte [ecx + 5], 0
movzx eax, byte [esi + 0x16d]
and eax, 0xffffffbf
mov byte [esi + 0x16d], al
jmp 0x42bc8b
mov byte [ecx + 5], 0x24
movzx eax, byte [esi + 0x16d]
jmp 0x42cb60
push esi
push eax
push eax
push 1
call fcn.00419550
add esp, 0x10
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xe4]
call fcn.0042d8d0
or eax, edx
jne 0x42d044
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x16b]
jmp 0x42c65a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x16f], 0xfb
movzx eax, byte [eax + 0x16b]
jmp 0x42c65a
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x42d0b1
mov eax, dword [ebp - 4]
and byte [eax + 0x16d], 0xf7
jmp 0x42bd56
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x26
mov edi, dword [ebp - 8]
and byte [edx + 0x16d], 0xf7
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x42d124
mov dword [ebx + 0x10], 0x400
jmp 0x42d13e
mov eax, dword [0x6e1a18]
cmp eax, 0xfffffffe
je 0x42d150
mov edx, dword [0x6e1a1c]
cmp edx, 0xfffffffe
je 0x42d18f
test edx, edx
je 0x42d176
cmp edx, 0xffffffff
jne 0x42d187
mov dword [ebx + 0x14], 1
mov edx, 1
jmp 0x42c789
mov dword [ebx + 0x14], edx
jmp 0x42c789
mov eax, 0x6b
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
test byte [eax + 0x168], 4
je 0x42d1b1
mov edx, 0x50
jmp 0x42d1b6
mov edx, 0x51
cmp byte [eax + 0x154], 1
je 0x42d1ce
add edx, 4
mov word [eax + 0x150], dx
jmp 0x42c77e
mov word [eax + 0x150], dx
jmp 0x42c77e
cmp edi, 1
jne 0x42bb83
jmp 0x42bbc3
cmp dword [ebx + 0xa4], 0
je 0x42d2d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.0046f2f0
mov dword [eax], ebx
cmp ebx, 2
jge 0x42d2a9
cmp ebx, 0x7b
je 0x42d7e5
cmp ebx, 0xa1
je 0x42d7e5
cmp ebx, 0xce
je 0x42d7e5
cmp ebx, 0xb7
je 0x42d7c2
cmp ebx, 0x50
je 0x42d7c2
cmp ebx, 0x13
je 0x42d7f7
cmp ebx, 5
je 0x42d7f7
cmp ebx, 0x14
je 0x42d297
cmp ebx, 0xf
je 0x42d297
cmp ebx, 4
jne 0x42d27c
mov edx, dword [ebp - 4]
mov eax, 0x25b
test byte [edx + 0x168], 0x20
jne 0x42d28a
mov eax, 0x1e
jmp 0x42d28a
mov eax, dword [ebp - 4]
mov dword [eax + 0xe8], ebx
mov eax, 0x1e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x2a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp ebx, 3
jg 0x42d20d
mov edx, dword [ebp - 4]
mov eax, 0x25a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42d2d1
mov eax, 0x1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 1
je 0x42d2ee
test byte [eax + 0x169], 0x40
je 0x42d1f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
cmp eax, 0x13
movzx edx, byte [edx + 0x168]
je 0x42d30d
cmp eax, 5
je 0x42d30d
test dl, 4
je 0x42d384
test dl, 1
jne 0x42d384
cmp dword [ebp - 0x15c], 0
je 0x42d384
mov edx, dword [ebp - 4]
test byte [edx + 0x169], 0x40
jne 0x42d384
test byte [edx + 0x16e], 1
jne 0x42d384
xor eax, eax
lea ecx, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x20]
and edx, 0x3fffffff
push dword [ebp - 0x1c]
or edx, 0x80000000
push edx
mov dword [ebp - 0x20], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
cmp esi, 0xffffffff
mov dword [eax + 0xe4], esi
je 0x42d437
or byte [eax + 0x169], 0x40
or byte [eax + 0x16f], 0x10
jmp 0x42d429
cmp eax, 0x20
jne 0x42d420
cmp dword [ebp - 0x160], 0
je 0x42d420
cmp dword [ebp - 0x15c], 0
jne 0x42d3b7
mov eax, dword [ebp - 4]
test byte [eax + 0x169], 0x40
jne 0x42d3b7
mov esi, dword [eax + 0xe4]
jmp 0x42d429
xor eax, eax
lea esi, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
and ecx, 0x3fffffff
or edx, 2
or ecx, 0x80000000
push edx
push ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
cmp esi, 0xffffffff
mov dword [eax + 0xe4], esi
je 0x42d1f5
or byte [eax + 0x169], 0x40
or byte [eax + 0x16f], 0x10
or byte [eax + 0x16a], 1
or byte [eax + 0x170], 4
jmp 0x42b8f2
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xe4]
cmp esi, 0xffffffff
je 0x42d1f5
jmp 0x42b8f2
test byte [eax + 0x168], 4
je 0x42d371
xor eax, eax
lea ecx, [ebp - 0x13c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x20]
and edx, 0x7fffffff
push dword [ebp - 0x1c]
or edx, 0x40000000
push edx
mov dword [ebp - 0x20], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe4], esi
or byte [eax + 0x16e], 1
jmp 0x42d429
test ecx, ecx
je 0x42b82c
cmp dword [ebp - 0x140], 0xfffffffa
jne 0x42b82c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], 0
or byte [eax + 0x170], 0x80
cmp dword [ebx + 0x84], 0
je 0x42d4c6
cmp dword [ebx + 0x88], 0
jne 0x42d4c6
and byte [eax + 0x171], 0xfe
jmp 0x42d4cd
or byte [eax + 0x171], 1
mov eax, dword [ebp - 0x164]
test eax, eax
lea edx, [ebp - 0x14c]
jne 0x42d4e2
mov eax, 0x100
push edx
push 0
mov dword [ebp - 0x164], eax
lea ecx, [eax + 1]
push ecx
call fcn.004250b0
add esp, 0xc
test eax, eax
jne 0x42a4fc
cmp dword [ebx + 0x98], 0
jne 0x42d526
mov eax, dword [ebp - 4]
push dword [eax + 0x100]
push str.Unit__i
push dword [ebp - 0x14c]
call fcn.00468370
add esp, 0xc
jmp 0x42d550
push dword [ebp - 0x164]
push dword [ebx + 0x94]
push dword [ebp - 0x14c]
call fcn.00468700
add esp, 0xc
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x164]
mov byte [eax + edx], 0
push dword [ebp - 0x14c]
call fcn.004bd9c0
add esp, 4
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [edx + 0xe4], eax
je 0x42d850
test byte [edx + 0x171], 1
je 0x42d5a6
push eax
call fcn.004bda80
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call fcn.004bda00
add esp, 8
test eax, eax
jne 0x42d5a6
mov eax, 0x28e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x14c]
call fcn.00425170
add esp, 4
test eax, eax
je 0x42b82c
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax + 0x152]
cmp edx, 4
jge 0x42d617
push dword [eax + 0x60]
call fcn.00425170
add esp, 4
test eax, eax
je 0x42d5f4
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x158]
push 0
push 5
call fcn.004250b0
add esp, 0xc
test eax, eax
je 0x42d617
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0x314d4f43
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x13c]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x42d634
mov edx, dword [ebp - 4]
mov eax, 4
mov ecx, dword [0x6e39a0]
mov word [edx + 0x152], ax
jmp 0x42d485
test eax, eax
jne 0x42d674
push str.USER
lea eax, [ebp - 0x13c]
push eax
call fcn.00468a60
add esp, 8
test eax, eax
je 0x42d683
mov dword [ebp - 0x164], 0
jmp 0x42b692
mov dword [ebp - 0x13c], 0x4e4f43
mov eax, esi
lea edi, [ebp - 0x13c]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x42d698
mov edx, dword [ebp - 4]
mov eax, 3
mov dword [ebp - 0x164], 0
mov word [edx + 0x152], ax
jmp 0x42b692
mov eax, dword [ebp - 4]
test byte [eax + 0x168], 1
je 0x42ae16
mov edx, eax
movzx eax, byte [edx + 0x16b]
and eax, 0xffffffdf
mov byte [edx + 0x16b], al
jmp 0x42ae29
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 3
je 0x42ad8b
mov eax, 0x2e
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x16b]
test dl, 0x10
je 0x42ac00
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x155], 3
mov ecx, 3
jmp 0x42ac0f
mov edx, ecx
test byte [edx + 0x168], 4
je 0x42d759
test byte [edx + 0x16b], 8
je 0x42d759
test byte [edx + 0x16a], 0x40
je 0x42d759
mov byte [edx + 0x156], 2
jmp 0x42ab4c
movsx edx, al
cmp edx, 4
je 0x42d7a4
cmp edx, 1
je 0x42d7a4
movzx esi, byte [ecx + 0x16a]
test esi, 0x80
jne 0x42d7a4
movzx ecx, byte [ecx + 0x170]
test cl, 1
jne 0x42d7a4
test cl, 2
jne 0x42d7a4
test esi, 0x40
je 0x42ab4c
cmp edx, 5
jl 0x42ab4c
cmp edx, 8
jg 0x42ab4c
mov edx, dword [ebp - 4]
mov byte [edx + 0x156], 3
jmp 0x42ab4c
mov dword [ebp - 0x15c], 1
jmp 0x42a69e
mov edx, dword [ebp - 4]
mov eax, 0x259
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42d7e1
mov eax, 0xa
mov esp, ebp
pop ebp
ret
mov eax, 0x2b
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x258
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42d816
mov eax, 9
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x63
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x25
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x258
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x168], 0x20
mov edi, dword [ebp - 8]
jne 0x42d86c
mov eax, 9
mov esp, ebp
pop ebp
ret