Function at 0x441260
Capabilities:
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e9ca1
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0xdc
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x441295
cmp word [eax], di
jne 0x441295
mov dword [esp + 0x104], edi
mov ebx, dword [esp + 0x108]
mov eax, ebx
and eax, 0x100000
mov ebp, ebx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x110]
and ebp, 0x10000
cmp eax, edi
mov dword [esp + 0x7c], ebp
mov byte [esp + 0x32], bl
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc8], edi
je 0x4412e3
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc8], edx
lea ecx, [esp + 0x50]
call fcn.00449780
mov ecx, dword [esp + 0x10c]
mov eax, ebx
and eax, 0x80000000
or eax, ecx
mov dword [esp + 0xf4], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe8], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], edi
je 0x44132f
mov esi, 1
jmp 0x441331
xor esi, esi
mov eax, ebx
and eax, 0x60000
xor ecx, ecx
xor edx, edx
or eax, ecx
mov dword [esp + 0x60], esi
je 0x44134a
xor ebp, ebp
mov dword [esp + 0x7c], ebp
mov eax, ebx
and eax, 0x200000
xor ecx, ecx
or eax, ecx
mov byte [esp + 0x31], 1
jne 0x441360
mov byte [esp + 0x31], cl
mov eax, ebx
and eax, 0x400000
xor ecx, ecx
or eax, ecx
mov byte [esp + 0x33], 1
jne 0x441376
mov byte [esp + 0x33], cl
mov eax, ebx
and eax, 0x800000
xor ecx, ecx
or eax, ecx
mov byte [esp + 0x2f], 1
jne 0x44138c
mov byte [esp + 0x2f], cl
or esi, edx
mov eax, dword [esp + 0x104]
mov byte [esp + 0x2e], 0
je 0x441426
cmp eax, edi
je 0x4414bb
mov dword [esp + 0x88], eax
push 0x125
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x90]
push ecx
mov dword [esp + 0x54], edi
call fcn.00428699
add esp, 0xc
mov dword [esp + 0x104], eax
cmp word [eax], di
jne 0x4413e0
mov byte [esp + 0x2e], 1
jmp 0x441400
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x108]
push eax
call fcn.0044f5a0
add esp, 8
test eax, eax
jle 0x442454
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x108]
push edx
call fcn.0044f5a0
mov eax, dword [esp + 0x90]
add esp, 8
mov dword [esp + 0x104], eax
cmp eax, edi
je 0x4414bb
cmp word [eax], di
mov ecx, eax
je 0x4414bb
mov edx, 0x2f
mov edi, edi
mov si, word [ecx]
add ecx, 2
cmp si, 0x5c
jne 0x441457
mov word [ecx - 2], dx
mov eax, dword [esp + 0x104]
cmp word [ecx], di
jne 0x441440
cmp word [eax], di
je 0x4414bb
mov dword [esp + 0x24], eax
push 0xd
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x54], edi
call fcn.00428699
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x104], eax
cmp word [ecx], di
je 0x4414b6
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x60]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.004496c0
mov eax, dword [esp + 0x118]
add esp, 0x14
cmp word [eax], di
jne 0x441461
mov ecx, dword [esp + 0x58]
cmp ecx, edi
mov dword [esp + 0x74], ecx
je 0x4415a5
cmp ecx, 1
mov eax, dword [esp + 0x50]
mov dword [esp + 0x84], eax
jne 0x4414f4
mov eax, dword [eax]
cmp word [eax], 0x3c
jne 0x4414f4
cmp word [eax + 2], 0x3e
jne 0x4414f4
cmp word [eax + 4], di
mov byte [esp + 0x1f], cl
je 0x4414f9
mov byte [esp + 0x1f], 0
cmp ebp, edi
jne 0x441561
xor esi, esi
cmp ecx, edi
jle 0x441561
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
lea esp, [esp]
mov eax, dword [esp + 0x84]
mov eax, dword [eax + esi*4]
push 6
push eax
push str._udext
call ebp
test eax, eax
jne 0x441551
mov ecx, dword [esp + 0x74]
mov eax, 1
cmp ecx, eax
jne 0x441539
mov byte [esp + 0x1f], al
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0x78], eax
or ebx, 0x20000
mov dword [esp + 0x10c], ecx
mov eax, dword [esp + 0x74]
inc esi
cmp esi, eax
jl 0x441510
mov dword [esp + 0x108], ebx
mov edx, dword [esp + 0x60]
mov ecx, edx
xor eax, eax
or ecx, eax
je 0x44158e
cmp dword [esp + 0x74], edi
jl 0x442454
mov ecx, dword [esp + 0x84]
cmp ecx, edi
je 0x44158e
mov ecx, dword [ecx]
cmp word [ecx], 0x3c
je 0x442454
mov dword [esp + 0x18], edi
or edx, eax
mov byte [esp + 0xf4], 1
je 0x4415b1
mov eax, 0x40000000
jmp 0x4415b3
mov dword [esp + 0x84], edi
jmp 0x4414f4
xor eax, eax
mov edx, dword [esp + 0xfc]
push edi
push 0x80
push 3
push edi
push 7
or eax, 0x80000000
push eax
push edx
lea ecx, [esp + 0x34]
call fcn.00417e55
mov ebx, dword [esp + 0x18]
cmp ebx, edi
je 0x4425da
push 0xe0000
lea ecx, [esp + 0x24]
call fcn.004494b0
mov ebp, dword [esp + 0x20]
push edi
lea eax, [esp + 0x18]
push eax
push 0x200
push ebp
push ebx
mov byte [esp + 0x108], 2
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 0x200
jb 0x4425a6
cmp dword [ebp + 0x1b4], 0x46424246
jne 0x4425a6
cmp word [ebp + 0x1fe], 0xaa55
jne 0x4425a6
movzx esi, word [ebp + 0x1b2]
inc esi
mov eax, esi
shl eax, 9
cdq
push 0
push edx
mov edi, eax
push edi
push ebx
mov dword [esp + 0xac], edx
call fcn.00444930
add esp, 0x10
cmp edi, eax
jne 0x4425a6
cmp dword [esp + 0x9c], edx
jne 0x4425a6
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x200
push ebp
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 0x200
jb 0x4425a6
movzx eax, word [ebp + 0xa]
mov cx, word [ebp]
cdq
mov ebx, edx
mov edx, dword [ebp + 0xc]
mov edi, eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0x68], edx
xor edx, edx
movzx eax, cx
add edi, 8
mov dword [esp + 0xc0], ebx
adc ebx, edx
add eax, esi
mov dword [esp + 0x44], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
cdq
mov dword [esp + 0x90], eax
movzx eax, word [ebp + 8]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x108]
push 0
mov esi, eax
push 0
and eax, 0x60000
push 0x8600
lea ecx, [esp + 0x24]
mov dword [esp + 0x4c], 8
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xa0], edx
mov dword [esp + 0x30], 0
and esi, 0x80000
mov dword [esp + 0xc0], eax
call fcn.0041ebdc
cmp eax, 0x8600
jne 0x4417e3
test edx, edx
jne 0x4417e3
push edx
lea ecx, [esp + 0x18]
push ecx
push 0x200
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4417e3
cmp dword [esp + 0x14], 0x200
jne 0x4417e3
mov al, byte [ebp + 0x1f8]
mov cl, al
and al, 0x1f
movzx eax, al
cdq
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x1b4]
and cl, 0xe0
cmp eax, 0x46424246
mov dword [esp + 0x44], edx
jne 0x4417e3
test cl, cl
mov dword [esp + 0x24], 0x10000
jne 0x441896
mov edi, dword [ebp + 0x1f0]
mov ebx, dword [ebp + 0x1f4]
mov eax, dword [ebp + 0x1e8]
mov ecx, dword [ebp + 0x1ec]
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
jmp 0x441896
mov ecx, dword [esp + 0x44]
xor eax, eax
cmp eax, ecx
jb 0x441896
ja 0x441801
mov edx, dword [esp + 0x40]
cmp dword [esp + 0x68], edx
jbe 0x441896
test esi, esi
je 0x441896
push 0
push 0x200
push ebx
push edi
call fcn.004b4970
push 0
mov esi, eax
push edx
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0xa8], edx
call fcn.0041ebdc
cmp esi, eax
jne 0x441896
cmp dword [esp + 0x9c], edx
jne 0x441896
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push 0x200
push ebp
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441896
cmp dword [esp + 0x14], 0x200
jne 0x441896
cmp byte [ebp], 0xeb
jne 0x441896
cmp word [ebp + 0x1fe], 0xaa55
jne 0x441896
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
sub eax, edx
mov dword [esp + 0x34], eax
mov eax, 0
sbb eax, ecx
mov dword [esp + 0x38], eax
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x100]
lea edx, [esi + esi*4]
shl edx, 9
add edx, 0xc64
push edx
call fcn.004494e0
mov ecx, dword [esp + 0x100]
mov edx, dword [ecx]
lea eax, [esi + esi*4]
shl eax, 0xa
lea eax, [eax + edx + 0x200]
and eax, 0xfffffe00
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x94]
test eax, eax
jl 0x4418fc
jg 0x4418e9
cmp dword [esp + 0x90], 0x44
jbe 0x4418fc
mov eax, esi
shl eax, 0xa
push eax
lea ecx, [esp + 0x24]
call fcn.004494e0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
push 0
push 0x200
push edx
lea ecx, [eax + esi]
push eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x4c], ebp
call fcn.004b4970
push 0
mov esi, eax
push edx
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0xa8], edx
call fcn.0041ebdc
cmp esi, eax
jne 0x44210e
cmp dword [esp + 0x9c], edx
jne 0x44210e
mov eax, dword [esp + 0x100]
mov ecx, dword [eax]
mov eax, dword [esp + 0xb4]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x4c], ecx
je 0x44196e
cmp dword [esp + 0x7c], esi
je 0x441986
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], ebx
jmp 0x44198a
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x68]
push 0
push 0x200
xor eax, eax
push eax
push edx
call fcn.004b4970
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xb4]
test eax, eax
mov dword [esp + 0x44], edx
je 0x441a85
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x441a85
xor eax, eax
test esi, esi
ja 0x4419cf
mov ecx, dword [esp + 0x34]
test ecx, ecx
jbe 0x441a13
mov eax, dword [esp + 0x34]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x200
push esi
push eax
call fcn.004b4970
mov ecx, dword [esp + 0x64]
push edx
push eax
mov eax, dword [esp + 0x44]
push ebx
push edi
push str._udext_
or eax, 0xff00
push eax
push str.0x_02X___s__0x_I64X__I64u__u__02u__02u__02u__02u__02u_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x38
test esi, esi
mov edx, dword [esp + 0x4c]
lea eax, [edx + eax*2]
mov dword [esp + 0x4c], eax
mov word [eax], 0
ja 0x441a2f
mov eax, dword [esp + 0x34]
test eax, eax
jbe 0x441a54
mov eax, dword [esp + 0x34]
push 0
push 0x200
push esi
push eax
mov dword [esp + 0x88], 0xffffffff
call fcn.004b4970
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x108]
and eax, 0x40000
xor ecx, ecx
or eax, ecx
je 0x441a85
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00417e50
jmp 0x44258e
mov al, byte [esp + 0x1f]
test al, al
jne 0x441b11
mov eax, dword [esp + 0x90]
cmp eax, dword [esp + 0x5c]
mov ebx, eax
jge 0x441b11
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x200
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 0x200
jne 0x44210e
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x28]
mov edi, eax
mov ecx, 0x80
add eax, 0x1fe
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x3c], eax
lea esp, [esp]
mov al, byte [ebp]
test al, al
je 0x441b11
movzx ecx, al
lea eax, [ecx + ebp + 2]
cmp eax, dword [esp + 0x3c]
ja 0x441b08
mov ebp, eax
jmp 0x441af0
mov eax, dword [esp + 0x5c]
inc ebx
cmp ebx, eax
jl 0x441aa0
mov edx, dword [esp + 0x100]
mov eax, dword [edx]
test eax, eax
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x34], eax
je 0x441b31
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], 0xfde9
mov dword [esp + 0xb0], 8
jmp 0x441b50
mov eax, dword [esp + 0x20]
mov dword [esp + 0xb8], eax
mov dword [esp + 0x3c], eax
mov al, byte [esp + 0x1f]
test al, al
mov byte [esp + 0x30], 0
mov dword [esp + 0x80], ebp
mov dword [esp + 0x5c], 0
je 0x441b82
mov dword [esp + 0xb8], ebp
mov ecx, dword [esp + 0xb8]
cmp ecx, dword [esp + 0x8c]
jae 0x4421bc
movzx ax, byte [ecx]
mov ebx, dword [esp + 0xc0]
mov ebp, ecx
mov dl, byte [ebp + 1]
mov dword [esp + 0x80], ecx
lea esi, [ecx + 0xe]
mov byte [esp + 0x13], dl
add eax, 2
movzx eax, ax
add ecx, eax
lea edi, [eax - 0xe]
xor eax, eax
cmp eax, ebx
mov dword [esp + 0xb8], ecx
mov ecx, dword [ebp + 2]
jb 0x441be1
ja 0x441bda
cmp ecx, dword [esp + 0xbc]
jb 0x441be1
or dl, 1
mov byte [esp + 0x13], dl
mov al, byte [esp + 0x32]
test al, al
je 0x441bed
test al, dl
je 0x441b82
test edi, edi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x70], 0
mov word [eax], 0
jle 0x441c56
cmp byte [esi], 0
je 0x441c56
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0xb0]
movzx eax, word [esp + 0x24]
mov bl, byte [edi + esi]
push 0x800
push ecx
push 0xffffffffffffffff
push esi
push edx
push eax
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x28]
movzx eax, al
test eax, eax
mov byte [edi + esi], bl
mov dword [esp + 0x70], eax
mov word [ecx + eax*2], 0
jg 0x441c56
mov eax, dword [esp + 0xb0]
test eax, eax
jne 0x441f39
mov al, byte [esp + 0x33]
test al, al
je 0x441c74
mov eax, dword [ebp + 6]
test eax, 0x1ff
jne 0x441b82
test eax, eax
je 0x441b82
mov al, byte [esp + 0x31]
test al, al
je 0x441c83
test byte [esp + 0x13], 0x7c
jne 0x441cbf
mov eax, dword [esp + 0x74]
test eax, eax
je 0x441cbf
xor esi, esi
test eax, eax
jle 0x441b82
mov ebx, dword [esp + 0x84]
mov edi, dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov edx, dword [ebx + esi*4]
mov eax, dword [esp + 0x28]
push edx
push eax
call edi
test eax, eax
jne 0x441cbf
mov eax, dword [esp + 0x74]
inc esi
cmp esi, eax
jl 0x441ca2
jmp 0x441b82
mov esi, dword [ebp + 6]
mov al, byte [esp + 0x13]
xor edi, edi
test al, al
mov ebx, esi
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], edi
jns 0x441cfb
push edi
push 0x200
push edi
push ebx
call fcn.004b4970
mov ebx, eax
mov edi, edx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], edi
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x441f52
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x441def
cmp esi, 0x8000
jb 0x441b82
test esi, 0x1ff
jne 0x441b82
test byte [esp + 0x13], 0x7c
jne 0x441def
mov eax, dword [esp + 0x70]
cmp eax, 4
jle 0x441d5e
mov ecx, dword [esp + 0x28]
lea edx, [ecx + eax*2 - 0xa]
push edx
push str..iso
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x441def
mov eax, dword [ebp + 2]
mov ebx, dword [esp + 0x18]
mov ecx, 0x200
mul ecx
push 0
mov edi, edx
mov esi, eax
push edi
push esi
push ebx
call fcn.00444930
add esp, 0x10
cmp esi, eax
jne 0x441b82
cmp edi, edx
jne 0x441b82
mov esi, dword [esp + 0x28]
push 0
lea edx, [esp + 0x18]
push edx
push 0x200
add esi, 0x400
push esi
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441b82
cmp dword [esp + 0x14], 0x200
jne 0x441b82
cmp byte [esi], 0xeb
jne 0x441b82
cmp word [esi + 0x1fe], 0xaa55
jne 0x441b82
mov ebx, dword [esp + 0xdc]
mov edi, dword [esp + 0xe0]
mov eax, dword [ebp + 0xa]
xor ecx, ecx
add eax, 0xb6109100
adc ecx, 2
xor esi, esi
push esi
push 0x989680
push ecx
push eax
call fcn.004b4970
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x9c], edx
xor edx, edx
mov dword [esp + 0xce], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0xd2], edx
xor eax, eax
or ecx, eax
mov dword [esp + 0xd6], edx
mov word [esp + 0xcc], si
mov word [esp + 0xda], dx
mov byte [esp + 0x30], 1
jne 0x4421bc
lea edx, [esp + 0xcc]
push edx
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x78]
inc edx
cmp eax, 0xffffffff
mov dword [esp + 0x5c], edx
jne 0x441ea6
mov eax, dword [ebp + 2]
mov edx, dword [esp + 0xa8]
xor ecx, ecx
cmp edx, eax
jne 0x441ed3
cmp dword [esp + 0xac], ecx
jne 0x441ed3
cmp dword [esp + 0x40], ebx
jne 0x441ed3
cmp dword [esp + 0x44], edi
je 0x441b82
jmp 0x441ed3
cmp eax, esi
jle 0x441ed3
mov eax, dword [ebp + 2]
mov edx, dword [esp + 0xbc]
xor ecx, ecx
cmp edx, eax
jne 0x441ed3
cmp dword [esp + 0xc0], ecx
jne 0x441ed3
cmp dword [esp + 0x40], ebx
jne 0x441ed3
cmp dword [esp + 0x44], edi
jne 0x441ed3
mov dword [esp + 0x78], esi
movzx ecx, word [esp + 0xd8]
movzx edx, word [esp + 0xd6]
movzx eax, word [esp + 0xd4]
push ecx
movzx ecx, word [esp + 0xd6]
push edx
movzx edx, word [esp + 0xd6]
mov esi, dword [esp + 0x54]
push eax
movzx eax, word [esp + 0xd8]
push ecx
mov ecx, dword [ebp + 2]
push edx
mov edx, dword [esp + 0x3c]
push eax
movzx eax, byte [esp + 0x2b]
push edi
push ebx
push ecx
push edx
push eax
push str.0x_02X___s__0x_lX__I64u__u__02u__02u__02u__02u__02u_r_n
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [esi + eax*2]
add esp, 0x34
mov dword [esp + 0x4c], ecx
jmp 0x441b82
mov ebp, dword [esp + 0x8c]
xor eax, eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0x24], eax
jmp 0x441b50
mov eax, dword [ebp + 2]
mov edx, 0x200
mul edx
mov dword [esp + 0x60], eax
mov al, byte [esp + 0x13]
and al, 1
neg al
mov dword [esp + 0x64], edx
sbb eax, eax
and eax, 2
add eax, 0x1fe
test edi, edi
mov dword [esp + 0x70], eax
jg 0x441f8c
jl 0x44256d
test ebx, ebx
jbe 0x44256d
mov ebp, dword [esp + 0xc8]
cmp ebp, edi
jl 0x441faa
jg 0x441fa4
mov esi, dword [esp + 0xc4]
cmp esi, ebx
jbe 0x441fb1
mov esi, ebx
mov ebp, edi
jmp 0x441fb1
mov esi, dword [esp + 0xc4]
sub ebx, esi
sbb edi, ebp
cmp edi, 0xf
mov dword [esp + 0x68], ebx
jb 0x441fd0
ja 0x44206e
cmp ebx, 0xfffffde0
jae 0x44206e
mov eax, dword [esp + 0x70]
cdq
push edx
push eax
push ebp
push esi
call fcn.004b48c0
mov edi, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov ecx, eax
shl eax, 9
cdq
add edi, eax
adc ebx, edx
mov eax, ecx
imul eax, dword [esp + 0x70]
cdq
push 0
sub esi, eax
push ebx
sbb ebp, edx
mov ebp, dword [esp + 0x20]
push edi
push ebp
call fcn.00444930
add esp, 0x10
cmp edi, eax
jne 0x442015
cmp ebx, edx
je 0x442035
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
cmp ebp, 0xffffffff
je 0x4425da
push ebp
jmp 0x4425d4
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x100]
lea ebx, [eax + esi + 0x1ff]
lea eax, [eax + esi + 0x20f]
and eax, 0xfffffe00
add eax, 0x200
push eax
mov ecx, edi
and ebx, 0xfffffe00
call fcn.004492e0
test eax, eax
mov dword [esp + 0x3c], eax
jne 0x442092
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x4425da
push eax
jmp 0x4425d4
mov ebp, dword [edi]
add ebp, 0x200
and ebp, 0xfffffe00
lea eax, [ebp + 0x200]
mov dword [esp + 0x48], eax
mov dword [eax], 0
test byte [esp + 0x13], 0x3d
je 0x44212d
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebp
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44210e
cmp dword [esp + 0x14], ebx
jb 0x44210e
sub esi, dword [edi]
add esi, ebp
mov dword [edi + 8], esi
mov edx, dword [edi + 8]
mov ebx, dword [edi]
mov eax, dword [esp + 0x68]
add edx, ebx
xor ecx, ecx
mov dword [edi + 4], eax
add edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
jmp 0x44256d
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00417e50
jmp 0x4425da
test ebx, ebx
jle 0x4420ec
mov edi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push 0x200
push ebp
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 0x200
jne 0x44219c
mov eax, dword [esp + 0x3c]
mov ecx, 0x1fe
sub ecx, esi
mov dword [esp + 0x14], ecx
mov edx, ecx
shr ecx, 2
add esi, ebp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, dword [esp + 0x14]
sub ebx, 0x1fe
xor esi, esi
test ebx, ebx
mov dword [esp + 0x3c], eax
jg 0x442131
mov edi, dword [esp + 0x100]
jmp 0x4420ec
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
cmp edi, 0xffffffff
je 0x4425da
push edi
jmp 0x4425d4
mov al, byte [esp + 0x2f]
test al, al
je 0x4421fb
mov eax, dword [esp + 0x5c]
test eax, eax
jle 0x4421fb
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x4c]
sub eax, edx
add eax, 2
sar eax, 1
test edx, edx
je 0x44225a
mov ecx, dword [esp + 0x100]
mov ecx, dword [ecx]
add eax, eax
push eax
push edx
push ecx
call fcn.004b3b10
add esp, 0xc
jmp 0x44225a
mov eax, dword [esp + 0x78]
test eax, eax
jle 0x44225a
xor eax, eax
ja 0x44220f
mov eax, dword [esp + 0x68]
test eax, eax
jbe 0x44225a
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x44225a
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0xc0]
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0xd8]
push edx
mov edx, dword [esp + 0x6c]
push eax
push ecx
push str._udext.norm_
push 0x2ff00
push str.0x_02X___s__0x_I64X__I64u__u__02u__02u__02u__02u__02u_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x38
mov eax, dword [esp + 0x60]
xor ecx, ecx
or eax, ecx
je 0x44256d
mov dl, byte [esp + 0x30]
mov al, byte [esp + 0x2e]
test dl, dl
sete cl
test al, cl
jne 0x44256d
test dl, dl
mov esi, dword [esp + 0x8c]
jne 0x442293
mov ebp, esi
mov dword [esp + 0x80], ebp
jmp 0x44229a
mov ebp, dword [esp + 0x80]
test al, al
je 0x4422d3
movzx ebx, byte [ebp]
add ebx, 2
mov edi, esi
sub edi, ebx
mov eax, edi
sub eax, ebp
inc eax
push eax
lea edx, [ebx + ebp]
push edx
push ebp
call fcn.004b3b10
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 0xc
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4423f2
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xe8]
shrd eax, ecx, 9
mov dword [ebp + 2], eax
mov eax, dword [esp + 0xa0]
mov dword [ebp + 6], eax
mov al, byte [ebp + 1]
shr ecx, 9
test al, 0xbc
jne 0x442303
mov cl, byte [esp + 0x32]
mov byte [ebp + 1], cl
mov ecx, dword [esp + 0xa4]
cmp ecx, 1
jb 0x442327
ja 0x44231c
mov eax, dword [esp + 0xa0]
test eax, eax
jb 0x44232e
or byte [ebp + 1], 0x80
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
mov bl, byte [ebp + 1]
test bl, bl
jns 0x442347
add eax, 0x1ff
adc ecx, 0
shrd eax, ecx, 9
shr ecx, 9
mov dword [ebp + 6], eax
test dl, dl
lea esi, [ebp + 0xc]
jne 0x4423f2
lea edx, [esp + 0x60]
xor edi, edi
push edx
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
push edi
push 0x989680
push eax
push ecx
call fcn.004b5410
mov esi, dword [esp + 0x28]
push edi
push edi
push 0x100
add eax, 0x49ef6f00
push esi
adc edx, 0xfffffffd
mov dword [ebp + 0xa], eax
movzx eax, word [esp + 0x34]
push 0xffffffffffffffff
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x9c]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
jle 0x4423be
mov cl, byte [eax + esi - 1]
test cl, cl
jne 0x4423be
dec eax
cmp eax, 0xf1
jle 0x4423ca
mov eax, 0xf1
lea ecx, [eax + 1]
mov edx, ecx
mov byte [eax + esi], 0
shr ecx, 2
lea edi, [ebp + 0xe]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add al, 0xd
mov byte [ebp], al
movzx eax, al
lea esi, [eax + ebp + 3]
mov byte [esi - 1], 0
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x80]
sub ecx, edi
mov eax, 0x80808081
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x48]
sar edx, 8
mov ebp, edx
sub esi, edi
shr ebp, 0x1f
add ebp, edx
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ecx
mov dword [esp + 0x34], eax
jl 0x442472
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x442454
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x50]
mov dword [esp + 0xf4], 0xffffffff
call fcn.00443880
mov eax, 0x80070057
jmp 0x4425f1
cmp ebp, eax
jg 0x44256d
mov eax, ebp
imul eax, eax, 0x1fe
lea ecx, [eax + edi]
sub esi, eax
mov dword [esp + 0x24], ecx
mov ebx, esi
lea ecx, [ecx]
mov esi, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
mov eax, ebp
cdq
push 0
add eax, esi
push 0x200
adc edx, ecx
push edx
push eax
call fcn.004b4970
push 0
push edx
mov dword [esp + 0x74], edx
mov edx, dword [esp + 0x20]
push eax
push edx
mov dword [esp + 0x78], eax
call fcn.00444930
add esp, 0x10
cmp ebx, 0x1fe
mov esi, ebx
jle 0x4424db
mov esi, 0x1fe
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push 0x200
push edi
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x6c]
mov ecx, esi
mov esi, dword [esp + 0x24]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x6c]
mov esi, dword [esp + 0x1c]
push eax
push ecx
push esi
call fcn.00444930
mov eax, dword [esp + 0x38]
add esp, 0x10
push 0
lea edx, [esp + 0x18]
push edx
push 0x200
push eax
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
inc ebp
add ecx, 0x1fe
sub ebx, 0x1fe
cmp ebp, eax
mov dword [esp + 0x24], ecx
jle 0x442490
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x44258e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x50]
mov dword [esp + 0xf4], 0xffffffff
call fcn.00443880
xor eax, eax
jmp 0x4425f1
mov esi, dword [esp + 0x100]
push 0x64
mov ecx, esi
call fcn.004494e0
mov ecx, dword [esi]
mov word [ecx], 0
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 1
call fcn.00443880
cmp ebx, 0xffffffff
je 0x4425da
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x50]
mov dword [esp + 0xf4], 0xffffffff
call fcn.00443880
or eax, 0xffffffff
mov ecx, dword [esp + 0xec]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe8
ret