Function at 0x5606f0
Capabilities:
Delete file
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Set file attributes

Disassembly:
sub esp, 0x48c
push ebx
mov ebx, dword [esp + 0x494]
push ebp
push esi
mov esi, dword [esp + 0x4a0]
push edi
xor edi, edi
or ebp, 0xffffffff
mov dword [esi + 0x3c1e], edi
push esi
mov dword [esi + 0xdb0], edi
push ebx
mov dword [esi + 8], ebp
mov dword [esp + 0x24], edi
call fcn.0055fa60
mov eax, dword [esi]
add esp, 8
cmp eax, edi
jne 0x562466
mov eax, dword [ebx + 4]
dec eax
cmp eax, 6
ja case.default.0x56073d
jmp dword [eax*4 + 0x562474]
mov dword [esi + 0x3c02], 3
jmp case.default.0x56073d
mov dword [esi + 0x3c02], edi
jmp case.default.0x56073d
mov dword [esi + 0x3c02], 2
jmp case.default.0x56073d
mov dword [esi + 0x3c02], 1
lea eax, [esi + 0x5fc]
push eax
call fcn.00565800
add esp, 4
cmp eax, edi
mov dword [esi + 0xdb0], eax
jne 0x5607ab
push esi
push edi
push 0x67
call fcn.00564160
add esp, 8
push eax
push 4
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
cmp dword [ebx + 0x38], edi
je 0x5607b6
inc dword [esi + 0xd84]
cmp dword [ebx + 0x3c], edi
je 0x5607c1
inc dword [esi + 0xd84]
push esi
call fcn.00565bb0
add esp, 4
cmp eax, edi
je 0x5607ec
mov ecx, dword [esi + 0xdb0]
push esi
push ecx
push eax
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [ebx + 0x28]
cmp eax, 9
mov dword [esi + 0xd88], eax
jle 0x560804
mov dword [esi + 0xd88], 9
cmp dword [esi + 0xd88], edi
jge 0x560812
mov dword [esi + 0xd88], edi
cmp dword [esi + 0x1a6], edi
je 0x56082c
cmp dword [esi + 0xd88], edi
jne 0x56083c
mov dword [esi + 0xd88], 1
cmp dword [esi + 0xd88], edi
jne 0x56083c
mov dword [esi + 0xd7c], edi
jmp 0x560842
mov dword [esi + 0xd7c], ebp
mov eax, dword [ebx + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, edi
je 0x5608df
mov eax, dword [ebx + 0x90]
cmp eax, edi
je 0x5609bd
push eax
call ebp
cmp eax, 0x41
jg 0x5609bd
mov edx, dword [ebx + 0x90]
push edx
call ebp
test eax, eax
jle 0x5609bd
push 0x42
call fcn.005738e8
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi + 0xda8], edi
jne 0x5608be
push esi
push eax
push 0x8f
call fcn.00564160
add esp, 8
push eax
push 4
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebx + 0x90]
mov ecx, dword [esi + 0xda8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
cmp dword [ebx + 0x4c], edi
je 0x5608ea
mov dword [esi + 0xd78], edi
mov eax, dword [ebx + 0x24]
mov ecx, 1
cmp eax, edi
je 0x5608fc
mov dword [esi + 0xd70], ecx
cmp dword [ebx + 0x48], edi
je 0x560905
mov dword [esp + 0x1c], ecx
cmp dword [ebx + 0x50], edi
je 0x560910
inc dword [esi + 0xd8c]
cmp dword [ebx + 0x54], edi
je 0x560937
cmp dword [ebx + 0x58], edi
je 0x560937
mov dword [esi + 0x3c06], ecx
mov eax, dword [ebx + 0x58]
push eax
mov dword [esi + 0xdc8], eax
call ebp
mov dword [esi + 0xdc4], eax
mov ecx, 1
test byte [ebx + 0x20], 1
je 0x560943
mov dword [esi + 0xd80], ecx
cmp dword [ebx + 0x2c], edi
je 0x56094e
mov dword [esi + 0xda0], edi
cmp dword [ebx + 0x64], edi
je 0x560959
mov dword [esi + 0x3c0a], ecx
cmp dword [ebx + 0x78], edi
je 0x560964
mov dword [esi + 0xd9c], edi
cmp dword [ebx + 0x7c], edi
je 0x56096f
mov dword [esi + 0xd94], ecx
cmp dword [ebx + 0x40], edi
je 0x56097a
mov dword [esi + 0xd98], ecx
cmp dword [ebx + 0x5c], edi
je 0x560aab
mov eax, dword [ebx + 0x60]
cmp eax, edi
je 0x560aab
push eax
call ebp
cmp eax, 6
je 0x5609e4
push esi
push edi
push 0x94
call fcn.00564160
add esp, 8
push eax
push 0x10
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
push esi
push edi
push 0x8f
call fcn.00564160
add esp, 8
push eax
push 0x10
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov edx, dword [ebx + 0x60]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x28]
push edx
push eax
call ebp
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a], 0
push ecx
call fcn.0057405e
mov edx, dword [ebx + 0x60]
add esp, 4
mov edi, eax
add edx, 2
lea eax, [esp + 0x28]
push edx
push eax
call ebp
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a], 0
push ecx
call fcn.0057405e
mov edx, dword [ebx + 0x60]
add esp, 4
mov ebp, eax
add edx, 4
lea eax, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a], 0
push ecx
call fcn.0057405e
add esp, 4
cmp edi, 1
jl 0x560b26
cmp edi, 0xc
jg 0x560b26
cmp ebp, 1
jl 0x560b26
cmp ebp, 0x1f
jg 0x560b26
xor edx, edx
cmp eax, 0x50
setge dl
dec edx
push 0
and edx, 0x64
push 0
add edx, 0x76c
push 0
push ebp
add edx, eax
push edi
push edx
call fcn.00564ef0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x18
mov dword [esi + 0x3c0e], eax
xor edi, edi
mov ecx, 1
cmp dword [ebx + 0x44], edi
je 0x560ab6
mov dword [esi + 0xd74], ecx
cmp dword [ebx + 0x48], edi
jne 0x560b38
test byte [esi + 0xdf1], 0x80
jne 0x560b38
cmp dword [ebx + 0x30], edi
je 0x560b38
cmp dword [ebx + 0x34], edi
je 0x560b38
mov dword [esi + 0x3c12], 1
mov eax, dword [ebx + 0x34]
lea edi, [esi + 0x700]
push eax
push edi
call fcn.0055f310
add esp, 8
push edi
call ebp
inc eax
push eax
call fcn.005738e8
add esp, 4
mov dword [esi + 0xdac], eax
test eax, eax
jne 0x560b2e
push esi
push eax
push 0x67
call fcn.00564160
add esp, 8
push eax
push 4
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
push esi
push 0
jmp 0x560998
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
cmp dword [ebx + 0x80], edi
je 0x560b50
mov eax, dword [ebx + 0x84]
cmp eax, edi
je 0x560b50
mov dword [esi + 0xda4], eax
xor ebp, ebp
push ebp
push ebp
push ebp
push 0x2bc
call fcn.00564160
add esp, 8
push eax
call fcn.0055c350
mov ebx, dword [ebx + 0xc]
add esp, 0xc
cmp ebx, ebp
mov dword [esp + 0x18], ebp
je 0x560cf2
mov edi, ebx
mov al, byte [edi]
test al, al
je 0x560c55
cmp al, 0x22
jne 0x560b8f
xor dword [esp + 0x18], 1
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x560c42
cmp al, 0x20
jne 0x560c42
lea ecx, [esp + 0x40]
push ebx
push ecx
mov byte [edi], 0
call fcn.0055f310
mov byte [edi], 0x20
mov eax, dword [esi + 0x1a2]
add esp, 8
test eax, eax
je 0x560be2
test ebp, ebp
jne 0x560be2
lea edx, [esp + 0x40]
push esi
push edx
call fcn.005605e0
add esp, 8
test eax, eax
jne 0x560c83
mov ebp, 1
jmp 0x560c39
mov eax, dword [esi + 0x3c02]
cmp eax, 1
je 0x560c04
cmp eax, 2
je 0x560c04
cmp eax, 3
je 0x560c04
lea eax, [esp + 0x40]
push esi
push eax
call fcn.00564df0
jmp 0x560c0f
lea ecx, [esp + 0x40]
push esi
push ecx
call fcn.00560100
add esp, 8
test eax, eax
je 0x560c39
cmp eax, 0xffffffff
push esi
jne 0x560c84
lea edx, [esp + 0x44]
push edx
push 0
push 0x84
call fcn.00564160
add esp, 8
push eax
call fcn.0055f9d0
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov ebx, eax
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov al, byte [edi]
test al, al
jne 0x560b86
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.0055f310
mov eax, dword [esi + 0x1a2]
add esp, 8
test eax, eax
je 0x560c9b
test ebp, ebp
jne 0x560c9b
lea ecx, [esp + 0x40]
push esi
push ecx
call fcn.005605e0
add esp, 8
test eax, eax
je 0x560cf2
push esi
push ebx
push eax
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0x3c02]
cmp eax, 1
je 0x560cbd
cmp eax, 2
je 0x560cbd
cmp eax, 3
je 0x560cbd
lea edx, [esp + 0x40]
push esi
push edx
call fcn.00564df0
jmp 0x560cc8
lea eax, [esp + 0x40]
push esi
push eax
call fcn.00560100
add esp, 8
test eax, eax
je 0x560cf2
cmp eax, 0xffffffff
push esi
jne 0x560c84
lea ecx, [esp + 0x44]
push ecx
push 0
push 0x84
call fcn.00564160
add esp, 8
push eax
call fcn.0055f9d0
add esp, 0xc
mov eax, dword [esi + 0x3c02]
cmp eax, 2
je 0x560d02
cmp eax, 3
jne 0x560d43
mov edi, dword [esi + 0xdbc]
test edi, edi
je 0x560d43
mov eax, dword [esi + 0xde4]
test eax, eax
je 0x560d25
mov edx, dword [edi + 0x46]
push esi
push edx
call fcn.00564a90
add esp, 8
jmp 0x560d2a
mov eax, 1
push esi
mov word [edi + 0x4a], ax
call fcn.0055c4c0
add esp, 4
cmp eax, 1
je 0x560d43
mov edi, dword [edi + 0x4e]
test edi, edi
jne 0x560d0c
push esi
call fcn.0055c4c0
add esp, 4
cmp eax, 1
push esi
jne 0x560d70
mov eax, dword [esi + 0xdb0]
push eax
push 9
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
call fcn.00564960
mov edi, eax
xor ebp, ebp
add esp, 4
cmp edi, ebp
je 0x560dbe
cmp edi, 9
jne 0x560da3
mov ecx, dword [esi + 0xdb0]
push esi
push ecx
push eax
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
cmp edi, 0x10
push esi
push ebp
jne 0x560db4
push 0x95
jmp 0x56099d
push 0x96
jmp 0x5623ff
cmp dword [esi + 0xdc0], ebp
je 0x560dd5
mov edx, dword [esi + 0xdcc]
push edx
call fcn.005737ff
add esp, 4
cmp dword [esi + 0xda4], ebp
jne 0x560e04
push esi
push ebp
push 0x97
call fcn.00564160
add esp, 8
push eax
push 0x10
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
cmp dword [esi + 0xd88], 9
jne 0x560e13
mov dword [esi + 0xda4], ebp
mov eax, dword [esi + 0x3c02]
cmp eax, ebp
jne 0x560e6d
cmp dword [esi + 0xd7c], 0xffffffff
jne 0x560e46
cmp dword [esi + 0xd74], ebp
jne 0x560e46
cmp dword [esi + 0xd70], ebp
jne 0x560e46
cmp dword [esi + 0xda8], ebp
jne 0x560e46
cmp dword [esi + 0x3c06], ebp
je 0x560e6d
push esi
push ebp
push 0x98
call fcn.00564160
add esp, 8
push eax
push 0x10
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
cmp dword [esi + 0xdc0], ebp
jne 0x560e9f
cmp eax, 1
jne 0x560e80
cmp dword [esp + 0x1c], ebp
je 0x560e9f
push esi
push ebp
push 0x87
call fcn.00564160
add esp, 8
push eax
mov eax, dword [esi + 0xdb0]
push eax
call fcn.0055f9d0
add esp, 0xc
cmp dword [esi + 0xdac], ebp
jne 0x560f38
mov ecx, dword [esi + 0xdb0]
push 0x2f
push ecx
call fcn.00564320
mov edi, eax
cmp edi, ebp
jne 0x560ee7
mov edx, dword [esi + 0xdb0]
push 0x5c
push edx
call fcn.00564320
mov edi, eax
cmp edi, ebp
jne 0x560ee7
mov eax, dword [esi + 0xdb0]
push 0x3a
push eax
call fcn.00564320
mov edi, eax
cmp edi, ebp
je 0x560f38
cmp byte [edi], 0x3a
jne 0x560ef5
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov edx, dword [esi + 0xdb0]
mov ecx, edi
sub ecx, edx
inc ecx
push ecx
call fcn.005738e8
add esp, 4
cmp eax, ebp
mov dword [esi + 0xdac], eax
jne 0x560f1c
push esi
push ebp
push 0x67
jmp 0x561c27
movsx ebx, byte [edi]
mov byte [edi], 0
mov edx, dword [esi + 0xdb0]
mov eax, dword [esi + 0xdac]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [edi], bl
mov edi, dword [esi + 0xdbc]
xor ebx, ebx
cmp edi, ebp
je 0x560fba
push esi
call fcn.0055c4c0
add esp, 4
test eax, eax
jne 0x560fba
cmp word [edi + 0x4a], bp
je 0x560fb3
cmp dword [esi + 0x3c02], ebp
je 0x560fb2
mov ecx, dword [edi + 0x36]
push esi
push ebp
push ebp
push ecx
call fcn.00564f50
add esp, 0x10
cmp eax, ebp
je 0x560f8f
cmp eax, dword [esi + 0x3c0e]
jb 0x560f8f
mov ecx, dword [esi + 0x3c02]
cmp ecx, 2
je 0x560f8a
cmp ecx, 3
jne 0x560fb2
cmp eax, dword [edi + 8]
ja 0x560fb2
cmp eax, ebp
mov word [edi + 0x4a], bp
je 0x560faa
cmp eax, dword [esi + 0x3c0e]
jb 0x560faa
mov eax, 1
mov word [edi + 0x4c], ax
jmp 0x560fb3
xor eax, eax
mov word [edi + 0x4c], ax
jmp 0x560fb3
inc ebx
mov edi, dword [edi + 0x4e]
cmp edi, ebp
jne 0x560f44
push esi
call fcn.0055c4c0
add esp, 4
cmp eax, 1
jne 0x560fe7
mov edx, dword [esi + 0xdb0]
push esi
push edx
push 9
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov edi, dword [esi + 0xdd4]
cmp edi, ebp
je 0x56102f
push esi
call fcn.0055c4c0
add esp, 4
test eax, eax
jne 0x56102f
mov eax, dword [esi + 0x3c02]
cmp eax, ebp
je 0x56101f
cmp eax, 3
je 0x56101f
mov eax, dword [edi + 8]
mov ecx, dword [esi + 0x3c0e]
cmp eax, ecx
jb 0x56101f
mov edi, dword [edi + 0x14]
jmp 0x56102b
push esi
push edi
call fcn.00564720
add esp, 8
mov edi, eax
cmp edi, ebp
jne 0x560ff1
push esi
call fcn.0055c4c0
add esp, 4
cmp eax, 1
jne 0x56105c
mov ecx, dword [esi + 0xdb0]
push esi
push ecx
push 9
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
cmp ebx, ebp
jne 0x5610fb
cmp dword [esi + 0xdd4], ebp
jne 0x5610fb
mov ecx, dword [esi + 0xdbc]
cmp ecx, ebp
je 0x561092
cmp dword [esi + 0x3c0a], ebp
jne 0x5610fb
cmp dword [esi + 0xd84], ebp
jne 0x5610fb
cmp dword [esi + 0x3c06], ebp
jne 0x5610fb
mov eax, dword [esi + 0x3c02]
cmp eax, 2
je 0x5610f4
cmp eax, 3
je 0x5610f4
cmp ecx, ebp
jne 0x5610d5
cmp dword [esi + 0x3c0a], ebp
jne 0x5610b6
cmp dword [esi + 0xd84], ebp
je 0x5610d5
mov edx, dword [esi + 0xdb0]
push esi
push edx
push 0xd
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0xdb0]
push esi
push eax
push 0xc
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
push esi
push ebp
jmp 0x56245c
cmp dword [esp + 0x1c], ebp
je 0x56111c
cmp ebx, ebp
jne 0x56111c
cmp dword [esi + 0xdb4], ebp
jne 0x561115
cmp dword [esi + 0xdbc], ebp
je 0x56111c
mov edi, 1
jmp 0x56111e
xor edi, edi
mov eax, dword [esi + 0x3c12]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebp
mov dword [esp + 0x1c], edi
je 0x561148
cmp dword [esi + 0xdbc], ebp
jne 0x561148
cmp dword [esi + 0xdb4], ebp
jne 0x561148
mov dword [esp + 0x34], ebp
jmp 0x5611c0
mov ecx, dword [esi + 0xdb0]
push ebp
push 0x80
push 4
push ebp
push ebp
push 0xc0000000
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x561184
mov edx, dword [esi + 0xdb0]
push esi
push edx
push 0xf
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xdb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xffff
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0xdbc]
cmp eax, ebp
jne 0x5611c0
cmp dword [esi + 0xdb4], ebp
jne 0x5611c0
mov ecx, dword [esi + 0xdb0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi + 0xd84], ebp
je 0x5611ce
mov dword [esi + 0xdb4], ebp
cmp edi, ebp
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0xdd0], ebp
je 0x561286
mov edx, dword [esi + 0xdb0]
push ebp
push 0x80
push 3
push ebp
push ebp
push 0xc0000000
push edx
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x561224
mov eax, dword [esi + 0xdb0]
push esi
push eax
push 0xd
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov ecx, dword [esi + 0xdb0]
push ebp
mov dword [esi + 0x3c1e], ecx
mov dword [esi + 8], eax
mov edi, dword [esi + 0xdb8]
push ebp
mov edx, edi
push edx
push eax
call fcn.00565650
add esp, 0x10
xor ecx, ecx
cmp eax, edi
jne 0x561251
cmp edx, ecx
je 0x56127b
mov eax, dword [esi + 0xdb0]
push esi
push eax
push 2
call fcn.0055f810
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov dword [esi + 0xdd0], edi
jmp 0x56146f
test byte [esi + 0xdf1], 0x80
je 0x5612e9
mov edx, dword [esi + 0xdb0]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0xc0000000
push edx
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x5612cf
mov eax, dword [esi + 0xdb0]
push esi
push eax
push 0xd
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov ecx, dword [esi + 0xdb0]
mov dword [esi + 0x3c1e], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xdd0], ebp
jmp 0x56146f
mov edx, dword [esi + 0xdb0]
push esi
push edx
call fcn.00565290
add esp, 8
cmp eax, ebp
mov dword [esi + 0x3c1e], eax
jne 0x56130f
push esi
push ebp
push 0x9a
jmp 0x561c27
push eax
call fcn.00565490
add esp, 4
test eax, eax
je 0x56132c
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0x3c1e]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0xc0000000
push eax
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 8], eax
jne 0x56136f
mov ecx, dword [esi + 0x3c1e]
push esi
push ecx
push 0xa
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
cmp dword [esi + 0xdbc], ebp
jne 0x56137f
cmp dword [esi + 0xdb4], ebp
je 0x5613dc
mov edx, dword [esi + 0xdb0]
push ebp
push 0x80
push 3
push ebp
push ebp
push closesocket
push edx
call ebx
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0x10]
jne 0x5613dc
cmp eax, 0xffffffff
je 0x5613bd
cmp dword [esi + 8], eax
je 0x5613bd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esi + 0xdb0]
push esi
push eax
push 0xd
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov ecx, dword [esi + 0xdb4]
cmp ecx, ebp
je 0x561463
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.00565380
mov edi, eax
add esp, 0x10
cmp edi, ebp
je 0x561463
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561422
cmp dword [esi + 8], eax
je 0x561422
push eax
call ebx
mov dword [esp + 0x10], 0xffffffff
cmp edi, 0xa
jne 0x561445
mov eax, dword [esi + 0x3c1e]
push esi
push eax
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0xdb0]
push esi
push eax
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0xdb4]
mov dword [esi + 0xdd0], eax
test byte [esi + 0xdf1], 0x80
push 0x2000
call fcn.005738e8
add esp, 4
cmp eax, ebp
mov dword [esi + 0x3c1a], eax
jne 0x5614d9
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x56149d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x5614ba
cmp dword [esi + 8], eax
je 0x5614ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0x3c1e]
push esi
push ecx
push 4
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0xdbc]
mov dword [esp + 0x24], ebp
cmp eax, ebp
mov dword [esi + 0xdec], ebp
je 0x561500
cmp word [eax + 0x4a], bp
je 0x5614f9
inc dword [esi + 0xdec]
mov eax, dword [eax + 0x4e]
cmp eax, ebp
jne 0x5614ed
mov edx, dword [esi + 0xddc]
mov edi, dword [esi + 0xdec]
mov ax, word [esi + 0xdf0]
add edi, edx
test ah, 0x80
mov dword [esi + 0xdec], edi
mov dword [esi + 0xe0c], ebp
mov dword [esi + 0xe08], ebp
je 0x561713
test ah, 0x10
je 0x561713
mov edi, dword [esi + 0xdd4]
cmp edi, ebp
je 0x561713
mov eax, dword [esi + 0xda8]
mov word [esi + 0xe42], bp
cmp eax, ebp
je 0x561561
mov word [esi + 0xe42], 1
cmp edi, ebp
mov dword [esi + 0xe4a], ebp
mov word [esi + 0xe88], 1
mov word [esi + 0xe66], bp
mov dword [esi + 0xe8c], ebp
je 0x561713
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [esi + 0x1fa]
test eax, eax
je 0x561684
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x144]
push eax
push ecx
call ebx
mov edx, dword [edi]
lea eax, [esp + 0x254]
push edx
push eax
call ebx
mov ecx, dword [edi + 8]
mov eax, dword [esi + 0x1fe]
mov ebx, dword [edi + 0xc]
xor edx, edx
mov dx, word [edi + 8]
push eax
shr ecx, 0x10
mov dword [esp + 0x24c], ecx
lea ecx, [esp + 0x148]
push ecx
mov dword [esp + 0x254], edx
mov dword [esp + 0x258], ebx
call dword [esi + 0x1fa]
mov edx, dword [edi + 4]
push edx
call ebp
mov edx, eax
lea eax, [esp + 0x144]
push eax
mov dword [esp + 0x1c], edx
call ebp
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jle 0x56163e
mov edx, dword [edi + 4]
push edx
call fcn.005737ff
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 4
lea eax, [esp + 0x144]
push eax
call ebp
add eax, 2
push eax
call fcn.005738e8
add esp, 4
mov dword [edi + 4], eax
jmp 0x561644
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [edi + 4]
lea ecx, [esp + 0x144]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x24c]
mov ecx, dword [esp + 0x248]
and eax, 0xffff
mov edx, ebx
shl ecx, 0x10
add eax, ecx
mov dword [edi + 8], eax
mov eax, dword [esp + 0x250]
xor edx, eax
and edx, 0x27
xor edx, ebx
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0xd80]
lea ebx, [esi + 0xe3e]
neg eax
sbb eax, eax
and eax, 0xfffff500
add eax, 0xb14
mov word [ebx], ax
mov eax, dword [edi + 4]
push eax
mov dword [esi + 0xe84], eax
call ebp
lea ecx, [esp + 0x10]
mov dword [esi + 0xe56], eax
push esi
xor eax, eax
push ecx
push ebx
mov dword [esi + 0xe5a], eax
mov dword [esi + 0xe5e], eax
mov dword [esi + 0xe62], eax
call fcn.005674d0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x5617a1
mov edx, dword [esi + 0xe5e]
mov ebx, dword [esi + 0xe56]
mov eax, dword [esi + 0xe62]
add edx, ebx
lea ecx, [edx + eax + 0x2e]
mov edx, dword [esi + 0xe08]
add edx, ecx
mov dword [esi + 0xe08], edx
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x56158b
xor ebp, ebp
mov ecx, dword [esi + 0xe08]
mov edx, dword [esi + 0xdd0]
mov ax, word [esi + 0xdf2]
add edx, ecx
mov dword [esi + 0xdd0], edx
mov word [esi + 0xdf8], ax
test byte [esi + 0xdf1], 0x80
mov eax, edx
mov dword [esi + 0xe90], ebp
je 0x5617e3
cmp eax, ebp
jne 0x5617e3
lea edx, [esp + 0x10]
push esi
push edx
call fcn.00567410
mov edi, eax
add esp, 8
cmp edi, ebp
je 0x5617dc
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561783
cmp dword [esi + 8], eax
je 0x561783
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esi + 0xdb0]
push esi
push eax
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x5617be
cmp dword [esi + 8], eax
je 0x5617be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov edx, dword [esi + 0xdb0]
push esi
push edx
push ebx
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
add dword [esi + 0xdd0], 4
lea eax, [esi + 0xdbc]
mov ebx, eax
mov dword [esp + 0x18], ebx
mov edi, dword [ebx]
cmp edi, ebp
je 0x5619af
mov eax, dword [esi + 0x1a2]
mov dword [esi + 0x1aa], 0
test eax, eax
je 0x561824
mov ecx, dword [edi + 0x36]
mov eax, dword [esi + 0x1ba]
cmp ecx, eax
jne 0x561824
mov dword [esi + 0x1aa], 1
cmp word [edi + 0x4a], 0
jne 0x561867
mov eax, dword [esi + 0x1aa]
test eax, eax
jne 0x561867
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x56185b
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push esi
push edx
push ebx
push edi
call fcn.0055d710
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x561a9c
lea ebx, [edi + 0x4e]
mov dword [esp + 0x18], ebx
jmp 0x561999
mov eax, dword [esi + 0x3c02]
test eax, eax
je 0x5618fa
lea eax, [esp + 0x10]
push esi
push eax
push edi
call fcn.0055d8e0
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x5618ee
cmp ebp, 0x12
jne 0x561aec
mov ecx, dword [edi + 0x36]
lea ebx, [esi + 0x3e36]
push ecx
push ebx
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call fcn.0055ed20
add esp, 4
push esi
push ebx
push 0
push 0x88
call fcn.00564160
add esp, 8
push eax
call fcn.0055f9d0
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push esi
push edx
push eax
push edi
call fcn.0055d710
mov ebp, eax
add esp, 0x1c
test ebp, ebp
jne 0x561b6b
mov word [edi + 0x4a], ax
lea ebx, [edi + 0x4e]
mov dword [esp + 0x18], ebx
jmp 0x561999
mov ecx, dword [edi + 0x46]
push ecx
push 2
push 0x2c0
call fcn.00564160
add esp, 8
lea edx, [esp + 0x35c]
push eax
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x364]
push eax
call fcn.0055d370
mov ecx, dword [edi + 0x36]
mov ebp, dword [edi + 0x4e]
push ecx
call fcn.005737ff
mov edx, dword [edi + 0x46]
push edx
call fcn.005737ff
mov eax, dword [edi + 0x1c]
add esp, 0x18
test eax, eax
je 0x561954
mov eax, dword [edi + 0x3a]
push eax
call fcn.005737ff
add esp, 4
mov eax, dword [edi + 0x20]
test eax, eax
je 0x56196e
mov eax, dword [edi + 0x3e]
mov ecx, dword [edi + 0x3a]
cmp eax, ecx
je 0x56196e
push eax
call fcn.005737ff
add esp, 4
mov eax, dword [edi + 0x24]
test eax, eax
je 0x561981
mov ecx, dword [edi + 0x42]
push ecx
call fcn.005737ff
add esp, 4
push edi
call fcn.005737ff
mov dword [ebx], ebp
mov eax, dword [esi + 0xdc0]
add esp, 4
dec eax
mov dword [esi + 0xdc0], eax
mov dword [esi + 0x1aa], 0
mov edi, dword [ebx]
test edi, edi
jne 0x5617f9
xor ebp, ebp
mov ebx, dword [esi + 0xdd4]
mov dword [esi + 0xe90], 1
cmp ebx, ebp
je 0x561d2b
push 0x52
call fcn.005738e8
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x561bf2
mov ecx, 0x14
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebx]
xor eax, eax
mov dword [ebp + 0x36], edx
mov ecx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebp + 0x46], ecx
mov edx, dword [ebx + 0xc]
mov dword [ebx + 4], eax
mov dword [esi + 0xe98], edx
mov ecx, dword [ebx + 8]
mov dword [esi + 0xe94], ecx
mov ecx, 1
mov word [ebp + 0x4a], cx
mov edx, dword [esi + 0x1a2]
cmp edx, eax
mov dword [esi + 0x1aa], eax
je 0x561a38
mov edx, dword [ebp + 0x36]
mov eax, dword [esi + 0x1ba]
cmp edx, eax
jne 0x561a38
mov dword [esi + 0x1aa], ecx
lea eax, [esp + 0x10]
push esi
push eax
push ebp
call fcn.0055d8e0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x561a56
cmp edi, 0x12
jne 0x561c47
cmp edi, 0x12
mov dword [esi + 0x1aa], 0
je 0x561cd5
mov ecx, dword [esp + 0x18]
push esi
push ebx
mov dword [ecx], ebp
add ebp, 0x4e
mov dword [esp + 0x20], ebp
mov ebp, dword [esi + 0xdc0]
inc ebp
mov dword [esi + 0xdc0], ebp
call fcn.00564720
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x5619c7
jmp 0x561d29
mov edx, dword [edi + 0x46]
push edx
push 0
push 0x9f
call fcn.00564160
add esp, 8
lea edi, [esi + 0xc6c]
push eax
push 0x602fe0
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp ebx, 0xffffffff
je 0x561ad1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561bda
cmp dword [esi + 8], eax
je 0x561bda
jmp 0x561bcb
mov eax, dword [edi + 0x36]
lea ebx, [esi + 0xc6c]
push eax
push 0
push 0x9e
call fcn.00564160
add esp, 8
push eax
push 0x602fe0
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
call fcn.0055ed20
mov eax, dword [esp + 0x28]
add esp, 0x14
cmp eax, 0xffffffff
je 0x561b2d
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561b4a
cmp dword [esi + 8], eax
je 0x561b4a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
push esi
push ebx
push ebp
call fcn.0055f810
mov edx, dword [esi]
push esi
push edx
call fcn.0055f680
mov eax, dword [esi]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [edi + 0x36]
lea ebx, [esi + 0x3e36]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call fcn.0055ed20
add esp, 4
lea edi, [esi + 0xc6c]
push ebx
push 0
push 0x9f
call fcn.00564160
add esp, 8
push eax
push 0x602fe0
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, 0xffffffff
je 0x561bbd
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561bda
cmp dword [esi + 8], eax
je 0x561bda
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
push esi
push edi
push ebp
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x561c02
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561c1f
cmp dword [esi + 8], eax
je 0x561c1f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
push esi
push 0
push 0x9b
call fcn.00564160
add esp, 8
push eax
push 4
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x561c57
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x36]
lea ebx, [esi + 0x3e36]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call fcn.0055ed20
add esp, 4
lea ebp, [esi + 0xc6c]
push ebx
push 0
push 0x9e
call fcn.00564160
add esp, 8
push eax
push 0x602fe0
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp eax, 0xffffffff
je 0x561cb4
cmp dword [esi + 8], eax
je 0x561cb4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
push esi
push ebp
push edi
call fcn.0055f810
mov eax, dword [esi]
push esi
push eax
call fcn.0055f680
mov eax, dword [esi]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov ecx, dword [ebp + 0x36]
lea edi, [esi + 0x3e36]
push ecx
push edi
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call fcn.0055ed20
add esp, 4
push esi
push edi
push 0
push 0x89
call fcn.00564160
add esp, 8
push eax
call fcn.0055f9d0
mov edx, dword [ebp + 0x36]
push edx
call fcn.005737ff
mov eax, dword [ebp + 0x46]
push eax
call fcn.005737ff
push ebp
call fcn.005737ff
add esp, 0x18
xor ebp, ebp
mov eax, dword [esi + 0xda8]
cmp eax, ebp
je 0x561d44
push eax
call fcn.005737ff
add esp, 4
mov dword [esi + 0xda8], ebp
cmp dword [esi], ebp
je 0x561d80
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x561d5a
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561d77
cmp dword [esi + 8], eax
je 0x561d77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov edx, dword [esi]
push esi
push edx
jmp 0x56245c
mov ax, word [esi + 0xdf0]
test ah, 0x80
je 0x56210e
test ah, 0x10
je 0x56210e
cmp dword [esi + 0xdbc], ebp
je 0x56210e
mov ax, word [esi + 0xdf2]
cmp ax, word [esi + 0xdf8]
je 0x561dbc
mov word [esi + 0xdfa], bp
mov edx, dword [esi + 0xdc8]
mov eax, dword [esi + 0xdc4]
lea ecx, [esp + 0x10]
push esi
push ecx
mov ecx, dword [esi + 0xe08]
push edx
mov edx, dword [esi + 0xdec]
push eax
push ebp
push ecx
push edx
call fcn.005678d0
mov edi, eax
add esp, 0x1c
cmp edi, ebp
je 0x561e28
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x561e0a
cmp dword [esi + 8], eax
je 0x561e0a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esi + 0x3c1e]
push esi
push eax
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0x96]
or ebx, 0xffffffff
cmp eax, ebx
je 0x561e7f
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.00563f40
mov edi, eax
add esp, 8
cmp edi, ebp
je 0x561e7f
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x561e61
cmp dword [esi + 8], eax
je 0x561e61
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
lea edx, [esi + 0x9a]
push esi
push edx
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov dword [esi + 0xe0c], 1
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x561ea4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x56209f
mov dword [esp + 0x10], ebx
cmp word [esi + 0xdf2], bp
mov dword [esi + 8], ebx
je 0x561ecc
push esi
push 0x62cce0
push ebp
push ebx
push 1
push ebp
call fcn.00563af0
add esp, 0x18
cmp eax, 1
jne 0x56103d
push ebp
push 0x80
push 3
mov dword [esi + 0xdd0], ebp
mov eax, dword [esi + 0xdb0]
push ebp
push ebp
push 0xc0000000
push eax
mov word [esi + 0xdf2], bp
mov dword [esi + 0xe04], ebp
mov dword [esi + 0x19e], 0x200000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x562018
lea ecx, [esp + 0x20]
push ebp
lea edi, [esi + 0xe10]
push ecx
push 0x2e
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x561fe7
cmp dword [esp + 0x20], 0x2e
jne 0x561fe7
cmp dword [edi], 0x2014b50
jne 0x561fe7
mov ax, word [esi + 0xe2c]
cmp ax, bp
je 0x561fe7
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
movsx eax, ax
push ebp
lea edi, [esi + 0xc6c]
push edx
push eax
push edi
push ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x561f7c
mov ebx, dword [esp + 0x20]
movsx edx, word [esi + 0xe2c]
mov byte [edx + esi + 0xc6c], 0
movsx eax, word [esi + 0xe2c]
cmp ebx, eax
jne 0x561faf
mov ecx, dword [esi + 0xdbc]
mov edx, dword [ecx + 0x46]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x56203a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x62cce0
push ebp
push ebp
push 1
push 0xa
mov dword [esp + 0x28], 0xffffffff
call fcn.00563af0
add esp, 0x18
cmp eax, 1
jne 0x56103d
or ebx, 0xffffffff
jmp 0x561e89
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x62cce0
push ebp
push ebp
push 1
push 0xa
mov dword [esp + 0x28], ebx
call fcn.00563af0
add esp, 0x18
cmp eax, 1
jne 0x560fc8
jmp 0x561e89
push esi
push 0x62cce0
push ebp
push ebp
push 1
push 0xa
call fcn.00563af0
add esp, 0x18
cmp eax, 1
jne 0x5620ef
jmp 0x561e89
mov edx, dword [esp + 0x10]
push ebp
push ebp
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esi + 0xdbc]
cmp edi, ebp
je 0x56208b
lea eax, [esp + 0x10]
push esi
push eax
push edi
call fcn.005674d0
mov ebx, eax
add esp, 0xc
cmp ebx, ebp
jne 0x5620be
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
add ecx, edx
mov edx, dword [edi + 0x18]
lea eax, [ecx + edx + 0x2e]
mov ecx, dword [esi + 0xdd0]
add ecx, eax
mov dword [esi + 0xdd0], ecx
mov edi, dword [edi + 0x4e]
cmp edi, ebp
jne 0x562052
xor ebx, ebx
mov dword [esi + 0xe0c], 0
or ebp, 0xffffffff
jmp 0x5622d6
mov ecx, dword [esi + 0xdb0]
push esi
push ecx
push 0x11
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xdb0]
push esi
push eax
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0xdb0]
push esi
push eax
push 9
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov edi, dword [esi + 0xdbc]
mov edx, dword [esi + 0xdd0]
xor ebx, ebx
xor ebp, ebp
cmp edi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], edx
je 0x56217e
lea eax, [esp + 0x10]
push esi
push eax
push edi
call fcn.005674d0
add esp, 0xc
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x56219f
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
add ecx, edx
mov edx, dword [edi + 0x18]
lea eax, [ecx + edx + 0x2e]
mov ecx, dword [esi + 0xdd0]
add ecx, eax
mov dword [esi + 0xdd0], ecx
mov eax, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
mov edi, dword [edi + 0x4e]
add ebx, eax
add ebp, edx
inc ecx
test edi, edi
mov dword [esp + 0x18], ecx
jne 0x56212a
mov eax, ecx
test eax, eax
jne 0x5621ee
push esi
xor ebx, ebx
push 0x62cce0
push ebx
push 0x8a
call fcn.00564160
add esp, 8
push eax
call fcn.0055f9d0
add esp, 0xc
jmp 0x5621f0
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x5621af
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x5621cc
cmp dword [esi + 8], eax
je 0x5621cc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0x3c1e]
mov edx, dword [esp + 0x3c]
push esi
push ecx
push edx
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
xor ebx, ebx
mov eax, dword [esi + 0xdd0]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x10]
push esi
push edx
mov edx, dword [esi + 0xdc8]
push edx
mov edx, dword [esi + 0xdc4]
sub eax, ecx
push edx
push ecx
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.005678d0
mov edi, eax
add esp, 0x1c
cmp edi, ebx
je 0x562270
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x562235
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x562252
cmp dword [esi + 8], eax
je 0x562252
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0x3c1e]
push esi
push ecx
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esi + 0x96]
or ebp, 0xffffffff
cmp eax, ebp
je 0x5622d6
lea edx, [esp + 0x10]
push esi
push edx
call fcn.00563f40
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x5622d6
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x5622a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x5622b8
cmp dword [esi + 8], eax
je 0x5622b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebp
lea eax, [esi + 0x9a]
push esi
push eax
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebp
cmp eax, ebp
je 0x562329
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
test eax, eax
jne 0x56232f
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x5622f9
push eax
call edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3c1e]
neg eax
sbb eax, eax
push esi
and eax, 4
push ecx
add eax, 0xa
mov dword [esp + 0x18], ebp
push eax
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x56233a
push eax
call edi
push esi
call fcn.00568a10
mov eax, dword [esp + 0x38]
add esp, 4
cmp eax, ebx
je 0x562359
mov edx, dword [esi + 0xdb0]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test byte [esi + 0xdf1], 0x80
je 0x56238a
mov eax, dword [esi + 0x3c1e]
push eax
call fcn.005737ff
mov ecx, dword [esi + 0x3c1e]
mov eax, dword [esi + 0xdb0]
add esp, 4
cmp ecx, eax
jne 0x562443
jmp 0x56243d
cmp dword [esp + 0x1c], ebx
jne 0x562449
mov edx, dword [esi + 0x3c1e]
mov eax, dword [esi + 0xdb0]
push esi
push edx
push eax
call fcn.00565180
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x56241e
mov ecx, dword [esi + 0x3c1e]
push esi
push ecx
push ebx
push 0x8b
call fcn.00564160
add esp, 8
push eax
call fcn.0055f9d0
mov edx, dword [esi + 0x3c1e]
push edx
call fcn.005737ff
mov eax, dword [esi + 0x3c1e]
mov ecx, dword [esi + 0xdb0]
add esp, 0x10
cmp eax, ecx
jne 0x5623f2
mov dword [esi + 0xdb0], ebx
push esi
push ebx
mov dword [esi + 0x3c1e], ebx
push 0x9c
call fcn.00564160
add esp, 8
push eax
push edi
call fcn.0055f810
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
mov ecx, dword [esi + 0x3c1e]
push ecx
call fcn.005737ff
mov edx, dword [esi + 0x3c1e]
mov eax, dword [esi + 0xdb0]
add esp, 4
cmp edx, eax
jne 0x562443
mov dword [esi + 0xdb0], ebx
mov dword [esi + 0x3c1e], ebx
mov eax, dword [esp + 0x24]
push esi
neg eax
sbb eax, eax
mov dword [esi + 0x3c1e], ebx
and eax, 0x12
push eax
call fcn.0055f680
mov eax, dword [esi]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret