Function at 0xf048e2e
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
inc ebx
push edi
mov dword [ebp - 8], 0x80
mov dword [ebp - 0xc], ebx
mov eax, dword fs:[0x18]
push dword [ebp + 8]
lea edi, [eax + 0xbf8]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x14]
push eax
push edi
call dword [0xf09ce38]
test eax, eax
jl 0xf049070
mov edx, dword [ebp + 0xc]
test dl, 8
je 0xf048e85
mov eax, 0x80070001
jmp 0xf049070
mov ecx, dword [ebp + 0x14]
mov eax, ecx
and eax, 0xf
sub eax, 0
push esi
je 0xf048ebd
dec eax
je 0xf048ead
dec eax
jne 0xf04906a
not cl
movzx esi, cl
and esi, 0x10
or esi, 0x40
shr esi, 4
jmp 0xf048ec9
and cl, 0x10
neg cl
sbb ecx, ecx
neg ecx
add ecx, 3
mov esi, ecx
jmp 0xf048ec9
cmp cx, 0x10
jne 0xf04906a
mov esi, ebx
movzx eax, dx
mov ecx, eax
and ecx, 0x70
je 0xf048f08
cmp ecx, 0x10
je 0xf048f02
cmp ecx, 0x20
je 0xf048efd
cmp ecx, 0x30
je 0xf048ef4
cmp ecx, 0x40
jne 0xf04906a
mov dword [ebp + 8], 3
jmp 0xf048f0f
mov dword [ebp + 8], 2
jmp 0xf048f0f
mov dword [ebp + 8], ebx
jmp 0xf048f0f
and dword [ebp + 8], 0
jmp 0xf048f0f
mov dword [ebp + 8], 7
and eax, 0xf
sub eax, 0
mov ecx, 0x80000000
je 0xf048f2e
dec eax
je 0xf048fa3
dec eax
je 0xf048f9c
dec eax
dec eax
jne 0xf04906a
mov ebx, ecx
test dh, 0x98
jne 0xf04906a
test dh, 1
je 0xf048f45
mov dword [ebp - 8], 0x20000080
test dh, 0x40
je 0xf048f4d
or dword [ebp - 8], ecx
push edi
call fcn.0f046a8f
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x1c], 0
push 0
and eax, 0x27
or eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xc
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], 1
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp edi, 0xffffffff
jne 0xf048faa
or eax, 0x80070000
jmp 0xf04906f
mov ebx, 0xc0000000
jmp 0xf048f30
mov ebx, 0x40000000
jmp 0xf048f30
cmp eax, 0xb7
jne 0xf048ff0
cmp word [ebp + 0x14], 0x12
jne 0xf048ffd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0xf048ff6
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xf048fe7
call esi
mov esi, eax
push edi
or esi, 0x80070000
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0xf04906f
mov dword [ebp - 0xc], 3
jmp 0xf048ffd
test byte [ebp + 0x14], 0x10
je 0xf048ffd
mov dword [ebp - 0xc], 2
push 0
lea eax, [ebp - 4]
push eax
push 0
call sym.ntvdm.exe_VDDAllocateDosHandle
mov esi, eax
test si, si
jge 0xf049022
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx eax, si
neg eax
jmp 0xf048f92
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, al
and eax, 0x80
shl eax, 5
and ecx, 0x7f
mov word [edx + 2], cx
mov ecx, dword [ebp - 4]
mov byte [ecx + 4], 0
mov ecx, dword [ebp - 4]
mov word [ecx + 5], ax
mov eax, dword [ebp - 4]
or dword [eax + 7], 0xffffffff
mov eax, dword [ebp - 4]
mov cx, word [ebp - 0xc]
mov dword [eax + 0x1d], edi
mov eax, dword [ebp + 0x20]
mov word [eax], cx
mov eax, dword [ebp + 0x1c]
mov word [eax], si
xor eax, eax
jmp 0xf04906f
mov eax, 0x80070057
pop esi
pop edi
pop ebx
leave
ret 0x1c