Function at 0x435e50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f0
mov eax, dword [0x4703d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x43c], eax
xor eax, eax
lea esi, [edi*4 + 2]
push esi
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x440], eax
call fcn.0043c073
add esp, 4
test eax, eax
mov dword [ebp - 0x444], eax
jne 0x435efb
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436b6f
test byte [eax + 0x3c], 1
je 0x436b6f
cmp byte [eax + 0x39], 5
jb 0x436b6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push 0x45fbac
push 0x12
push edx
push eax
call fcn.00401230
jmp 0x436b6f
push esi
push 0
push eax
call fcn.0043c140
add esp, 0xc
xor esi, esi
test edi, edi
jbe 0x435f39
mov edi, dword [ebp - 0x444]
mov ecx, dword [ebp - 0x450]
movzx edx, byte [ecx + esi]
push edx
push str._02X
push 2
push edi
call fcn.0043ca7b
add esi, 1
add esp, 0x10
add edi, 4
cmp esi, dword [ebp + 0x14]
jb 0x435f13
mov ecx, dword [0x471c30]
test ecx, ecx
je 0x43602d
test byte [ebp + 0x1c], 8
jne 0x43602d
mov edx, dword [ebp - 0x444]
lea eax, [ebp - 0x220]
push eax
push edx
call fcn.00439a10
test al, al
je 0x43602d
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x220]
push 0x400
mov dword [ebp - 0x440], eax
push edx
lea eax, [ebx + 0x828]
push eax
mov dword [ebx + 0x820], ecx
call fcn.0043bfd5
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
mov dword [ebx + 0x1028], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x102c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x1030], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x210]
add esp, 0xc
or dword [ebx + 0x824], eax
mov ecx, dword [ebx + 0x824]
mov dword [ebx + 0x1034], edx
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436b6f
test byte [eax + 0x3c], 1
je 0x436b6f
cmp byte [eax + 0x39], 5
jb 0x436b6f
mov edx, dword [ebp - 0x43c]
push edx
mov edx, dword [ebp - 0x440]
push ecx
mov ecx, dword [ebx + 0x820]
push ecx
mov ecx, dword [eax + 0x34]
push edx
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x13
push ecx
push edx
call fcn.00435990
jmp 0x436b6f
lea eax, [ebp - 0x4f0]
push eax
call fcn.0043a4a0
push 0x471c04
mov dword [ebp - 0x4dc], 2
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov byte [ebp - 0x431], 0
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4360e0
mov ecx, 0xe
mov esi, str.System32CatRoot2dberr.txt
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x448], 0
jmp 0x436110
cmp dword [ebp - 0x440], 0
jne 0x4369c5
lea edx, [ebp - 0x49c]
push edx
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x43616f
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436174
test byte [eax + 0x3c], 1
je 0x436174
cmp byte [eax + 0x39], 5
jb 0x436174
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x15
push ecx
push edx
call fcn.00401230
mov eax, dword [0x46500c]
test byte [ebp + 0x1c], 8
je 0x436239
cmp eax, 0x46500c
je 0x4361a5
test byte [eax + 0x3c], 1
je 0x4361a5
cmp byte [eax + 0x39], 2
jb 0x4361a5
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x16
push ecx
push edx
call fcn.0041b140
mov ecx, dword [0x471c20]
mov edx, dword [ecx]
push 0
push 0x45fbbc
lea eax, [ebp - 0x430]
push eax
call edx
test eax, eax
jne 0x43621a
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x4361f9
test byte [eax + 0x3c], 1
je 0x4361f9
cmp byte [eax + 0x39], 5
jb 0x4361f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x17
push ecx
push edx
call fcn.00401230
xor eax, eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x448], 2
mov dword [ebp - 0x454], 0x45fbbc
jmp 0x4362c2
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x448], 2
mov dword [ebp - 0x454], 0x45fbbc
jmp 0x4362c2
mov ecx, dword [ebp - 0x448]
mov eax, dword [ecx*4 + 0x471c24]
test eax, eax
mov dword [ebp - 0x430], eax
jne 0x4362b8
shl ecx, 4
push eax
add ecx, 0x45fbbc
push ecx
mov ecx, dword [0x471c20]
mov edx, dword [ecx]
lea eax, [ebp - 0x430]
push eax
call edx
test eax, eax
jne 0x4362b2
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x4362a8
test byte [eax + 0x3c], 1
je 0x4362a8
cmp byte [eax + 0x39], 5
jb 0x4362a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x18
push ecx
push edx
call fcn.00401230
xor eax, eax
mov dword [ebp - 0x430], eax
jmp 0x4362b8
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x454], 0x466310
test eax, eax
je 0x4367df
mov edi, dword [ebp - 0x440]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x438]
push ecx
mov ecx, dword [ebp - 0x450]
push 0
push edx
mov edx, dword [0x471c20]
push ecx
push eax
mov eax, dword [edx + 0x10]
call eax
mov esi, eax
test esi, esi
je 0x4367d9
mov eax, dword [ebp - 0x438]
test eax, eax
mov byte [ebp - 0x431], 1
je 0x43635c
mov ecx, dword [ebp - 0x430]
mov edx, dword [0x471c20]
push 0
push eax
mov eax, dword [edx + 8]
push ecx
call eax
test eax, eax
jne 0x43635c
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x43635c
test byte [eax + 0x3c], 1
je 0x43635c
cmp byte [eax + 0x39], 2
jb 0x43635c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x19
push ecx
push edx
call fcn.00401230
xor eax, eax
push 0x20c
mov dword [ebp - 0x478], eax
push eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x478], 0x24
call fcn.0043c140
mov edx, dword [0x471c20]
add esp, 0xc
push 0
lea ecx, [ebp - 0x42c]
push ecx
mov dword [ebp - 0x42c], 0x20c
mov eax, dword [edx + 0xc]
push esi
call eax
test eax, eax
je 0x436a2c
mov edx, dword [ebp - 0x444]
mov eax, dword [ebp - 0x450]
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x470], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x46c], edx
lea edx, [ebp - 0x478]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x4d8], edx
mov dword [ebp - 0x4c8], 0x1010
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436456
test byte [eax + 0x3c], 1
je 0x436456
cmp byte [eax + 0x39], 5
jb 0x436456
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x428]
push ecx
push 0x45fbac
push 0x1b
push edx
push eax
call fcn.00401260
mov edx, dword [ebp - 0x454]
mov eax, dword [0x471c20]
lea ecx, [ebp - 0x4f0]
push ecx
mov ecx, dword [eax + 0x18]
push edx
push 0xffffffffffffffff
call ecx
cmp eax, 0x800b0101
jg 0x4365ac
je 0x4365ca
cmp eax, 0x800b0001
jg 0x4364db
je 0x4364f1
cmp eax, 0x80092026
je 0x4365ca
cmp eax, 0x80096001
jne 0x43661f
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x4364cc
test byte [eax + 0x3c], 1
je 0x4364cc
cmp byte [eax + 0x39], 5
jb 0x4364cc
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push 0x45fbac
push 0x1f
push edx
push eax
call fcn.0041b140
mov dword [ebx + 0x820], 0xffffffff
jmp 0x436738
cmp eax, 0x800b0004
je 0x43657e
cmp eax, 0x800b0100
jne 0x43661f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x800b0100
je 0x436534
cmp eax, 0x800b0003
je 0x436534
cmp eax, 0x800b0001
je 0x436534
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436567
test byte [eax + 0x3c], 1
je 0x436567
cmp byte [eax + 0x39], 5
jb 0x436567
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x45fbac
push 0x21
jmp 0x43655a
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436567
test byte [eax + 0x3c], 1
je 0x436567
cmp byte [eax + 0x39], 5
jb 0x436567
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x45fbac
push 0x20
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push edx
push eax
call fcn.00401260
mov ecx, dword [ebx + 0x824]
and ecx, 0xfffffffd
or ecx, 1
mov dword [ebx + 0x824], ecx
jmp 0x436738
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436567
test byte [eax + 0x3c], 1
je 0x436567
cmp byte [eax + 0x39], 5
jb 0x436567
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push 0x45fbac
push 0x23
push edx
push eax
call fcn.0041b140
jmp 0x436567
cmp eax, 0x800b0111
jg 0x43661b
je 0x4365de
cmp eax, 0x800b0109
jl 0x43661f
cmp eax, 0x800b010a
jle 0x4365ca
cmp eax, 0x800b010e
jne 0x43661f
test eax, eax
jne 0x436666
or dword [ebx + 0x824], 0x10
jmp 0x4366cd
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436567
test byte [eax + 0x3c], 1
je 0x436567
cmp byte [eax + 0x39], 5
jb 0x436567
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push 0x45fbac
push 0x22
push edx
push eax
call fcn.0041b140
jmp 0x436567
test eax, eax
je 0x4365d2
mov ecx, dword [0x46500c]
cmp ecx, 0x46500c
je 0x436738
test byte [ecx + 0x3c], 1
je 0x436738
cmp byte [ecx + 0x39], 2
jb 0x436738
mov edx, dword [ebp - 0x43c]
push eax
mov eax, dword [ecx + 0x34]
mov ecx, dword [ecx + 0x30]
push edx
push 0x45fbac
push 0x24
push eax
push ecx
call fcn.00435ab0
jmp 0x436738
cmp eax, 0x800b0109
jne 0x43669a
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x43670a
test byte [eax + 0x3c], 1
je 0x4366d2
cmp byte [eax + 0x39], 5
jb 0x4366d2
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push 0x45fbac
push 0x1c
push edx
push eax
jmp 0x4366c8
cmp eax, 0x800b010a
jne 0x4366cd
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x43670a
test byte [eax + 0x3c], 1
je 0x4366d2
cmp byte [eax + 0x39], 5
jb 0x4366d2
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x1d
push ecx
push edx
call fcn.0041b140
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x43670a
test byte [eax + 0x3c], 1
je 0x43670a
cmp byte [eax + 0x39], 5
jb 0x43670a
mov ecx, dword [ebx + 0x824]
mov edx, dword [ebp - 0x43c]
and ecx, 0x10
push ecx
mov ecx, dword [eax + 0x34]
push edx
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x1e
push ecx
push edx
call fcn.00435ab0
mov eax, dword [ebp + 0x1c]
push eax
push ebx
lea ecx, [ebp - 0x4f0]
push ecx
call fcn.0043a6a0
mov edx, dword [ebx + 0x824]
and edx, 0xfffffffe
or edx, 2
mov edi, 1
mov dword [ebx + 0x824], edx
mov dword [ebp - 0x440], edi
cmp dword [ebp - 0x4d0], 0
je 0x4367be
mov edx, dword [0x471c20]
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x21c], 0xaac56b
mov word [ebp - 0x218], 0xcd44
mov word [ebp - 0x216], 0x11d0
mov byte [ebp - 0x214], 0x8c
mov byte [ebp - 0x213], 0xc2
mov byte [ebp - 0x212], 0
mov byte [ebp - 0x211], 0xc0
mov byte [ebp - 0x210], 0x4f
mov byte [ebp - 0x20f], 0xc2
mov byte [ebp - 0x20e], 0x95
mov byte [ebp - 0x20d], 0xee
mov dword [ebp - 0x4d4], 2
mov eax, dword [edx + 0x18]
push 0
call eax
test edi, edi
jne 0x436917
mov eax, dword [ebp - 0x430]
test eax, eax
jne 0x4362d0
jmp 0x4369ad
mov eax, dword [ebp - 0x430]
cmp byte [ebp - 0x431], 0
jne 0x43691d
lea ecx, [ebp - 0x4c0]
push ecx
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x436840
mov edi, dword [0x46500c]
cmp edi, 0x46500c
je 0x436846
test byte [edi + 0x3c], 1
je 0x436846
cmp byte [edi + 0x39], 2
jb 0x436846
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x25
push ecx
push edx
call fcn.00401230
mov edi, dword [0x46500c]
mov eax, 0x24
lea ecx, [ebp - 0x4c0]
lea edx, [ebp - 0x49c]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x43686f
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x436857
test eax, eax
je 0x4368d8
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x4368be
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4368d2
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x4368be
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4368d2
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x4368be
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4368d2
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x4368d2
test esi, esi
mov ebx, dword [ebp - 0x44c]
mov eax, 1
jg 0x4368da
or eax, 0xffffffff
jmp 0x4368da
mov ebx, dword [ebp - 0x44c]
xor eax, eax
test eax, eax
je 0x436917
cmp edi, 0x46500c
je 0x43690d
test byte [edi + 0x3c], 1
je 0x43690d
cmp byte [edi + 0x39], 5
jb 0x43690d
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x30]
lea ecx, [ebp - 0x20c]
push ecx
push 0x45fbac
push 0x26
push edx
push eax
call fcn.00401260
mov dword [ebx + 0x820], 0xffffffff
mov eax, dword [ebp - 0x430]
xor esi, esi
cmp eax, esi
je 0x4369ad
mov ecx, dword [ebp - 0x438]
cmp ecx, esi
je 0x436987
push esi
push ecx
mov ecx, dword [0x471c20]
mov edx, dword [ecx + 8]
push eax
call edx
test eax, eax
jne 0x43697b
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x43697b
test byte [eax + 0x3c], 1
je 0x43697b
cmp byte [eax + 0x39], 2
jb 0x43697b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x27
push ecx
push edx
call fcn.00401230
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x438], esi
cmp eax, esi
je 0x4369ad
mov ecx, dword [ebp - 0x448]
cmp eax, dword [ecx*4 + 0x471c24]
je 0x4369ad
mov edx, dword [0x471c20]
push esi
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x430], esi
mov eax, dword [ebp - 0x448]
add eax, 1
cmp eax, 2
mov dword [ebp - 0x448], eax
jl 0x436110
push 0x471c04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [ebx + 0x824], 1
mov esi, dword [ebp - 0x43c]
je 0x436aa1
push esi
push 0
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0x436a74
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436a20
test byte [eax + 0x3c], 1
je 0x436a20
cmp byte [eax + 0x39], 5
jb 0x436a20
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push esi
push 0x45fbac
push 0x28
push ecx
push edx
call fcn.00401260
mov dword [ebx + 0x820], 0xffffffff
jmp 0x436aa1
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436a64
test byte [eax + 0x3c], 1
je 0x436a64
cmp byte [eax + 0x39], 2
jb 0x436a64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x1a
push ecx
push edx
call fcn.00401230
push 0x471c04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x436b6f
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436aa1
test byte [eax + 0x3c], 1
je 0x436aa1
cmp byte [eax + 0x39], 5
jb 0x436aa1
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push esi
push 0x45fbac
push 0x29
push ecx
push edx
call fcn.00401260
cmp dword [0x471c30], 0
je 0x436b6f
cmp dword [ebx + 0x820], 0xffffffff
je 0x436b78
mov eax, dword [ebx + 0x824]
test eax, eax
je 0x436b6f
test byte [ebp + 0x1c], 8
jne 0x436b6f
test al, 2
jne 0x436b38
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x436b38
push eax
lea ecx, [ebp - 0x428]
push esi
push ecx
call fcn.00429600
add esp, 0xc
test eax, eax
jne 0x436b38
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436b6f
test byte [eax + 0x3c], 1
je 0x436b6f
cmp byte [eax + 0x39], 3
jb 0x436b6f
mov edx, dword [ebx + 0x824]
mov ecx, dword [eax + 0x34]
push edx
mov edx, dword [eax + 0x30]
push esi
push 0x45fbac
push 0x2a
push ecx
push edx
call fcn.00435ab0
jmp 0x436b6f
mov eax, dword [ebx + 0x824]
mov ecx, eax
and ecx, 0x10
push ecx
lea edx, [ebx + 0x1028]
push edx
mov edx, dword [ebx + 0x820]
lea ecx, [ebx + 0x828]
push ecx
mov ecx, dword [0x471c30]
push edx
and eax, 2
push eax
mov eax, dword [ebp - 0x444]
push eax
call fcn.004399a0
cmp dword [ebx + 0x820], 0xffffffff
jne 0x436b89
mov dword [ebx + 0x824], 8
mov edi, 1
jmp 0x436b8f
mov edi, dword [ebp - 0x440]
mov eax, dword [ebp - 0x430]
xor esi, esi
cmp eax, esi
je 0x436c11
mov ecx, dword [ebp - 0x438]
cmp ecx, esi
je 0x436bfb
push esi
push ecx
mov ecx, dword [0x471c20]
mov edx, dword [ecx + 8]
push eax
call edx
test eax, eax
jne 0x436bef
mov eax, dword [0x46500c]
cmp eax, 0x46500c
je 0x436bef
test byte [eax + 0x3c], 1
je 0x436bef
cmp byte [eax + 0x39], 2
jb 0x436bef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x46500c]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x45fbac
push 0x2b
push ecx
push edx
call fcn.00401230
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x438], esi
cmp eax, esi
je 0x436c11
push esi
push eax
mov eax, dword [0x471c20]
mov ecx, dword [eax + 4]
call ecx
mov dword [ebp - 0x430], esi
mov eax, dword [ebp - 0x444]
cmp eax, esi
je 0x436c24
push eax
call fcn.0043c1ba
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0x18