Function at 0x433590
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51f2e5
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 4]
mov esi, dword [edx + 0x160]
mov eax, dword [edx + 0x164]
cmp esi, eax
je 0x4335d3
cmp dword [edi + 0x168], 1
jne case.0x4335f0.2
sub eax, esi
sar eax, 2
cmp eax, 1
ja case.0x4335f0.2
mov eax, dword [edi + 0x168]
cmp eax, 4
ja case.default.0x4335f0
jmp dword [eax*4 + 0x433c08]
mov dword [edi + 0xc], 0
mov ecx, 0x10
mov eax, dword [edx + 0x160]
mov esi, 0x20
cmp eax, dword [edx + 0x164]
lea eax, [edi + 0x10]
cmove ecx, esi
or ecx, 0x8000
cmp dword [eax + 0x14], 0xf
jbe 0x433628
mov eax, dword [eax]
push pe_nt_image_headers32
push ecx
push eax
call fcn.00431450
add esp, 0xc
test eax, eax
js case.default.0x4335f0
push 0x52db90
jmp 0x4336c3
cmp dword [edi + 0x24], 0xf
lea esi, [edi + 0x10]
mov eax, esi
jbe 0x433653
mov eax, dword [esi]
push 0x532fc8
push eax
call fcn.00505806
add esp, 8
mov dword [edi + 0xc], eax
test eax, eax
jne case.default.0x4335f0
cmp dword [esi + 0x14], 0xf
jbe 0x433670
mov esi, dword [esi]
push 0x52db98
push esi
call fcn.00505806
jmp 0x4336c9
cmp dword [edi + 0x24], 0xf
lea eax, [edi + 0x10]
jbe 0x433688
mov eax, dword [eax]
push 0x52db98
push eax
call fcn.00505806
jmp 0x4336c9
lea eax, [edi + 0x10]
mov dword [edi + 0xc], 0
cmp dword [eax + 0x14], 0xf
jbe 0x4336a7
mov eax, dword [eax]
push 0x180
push 0x8721
push eax
call fcn.00431450
add esp, 0xc
test eax, eax
js case.default.0x4335f0
push 0x52db98
push eax
call fcn.00507ce8
mov dword [edi + 0xc], eax
add esp, 8
mov ecx, dword [edi + 0xc]
lea esi, [edi + 0xc]
test ecx, ecx
je case.0x4335f0.2
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x160]
cmp edx, dword [eax + 0x164]
je 0x43370d
mov eax, dword [edx]
mov dword [edi + 8], eax
mov al, 1
mov byte [edi + 0x174], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x168]
cmp eax, 3
je 0x433bcb
cmp eax, 4
je 0x433bcb
mov dword [ebp - 0x24], esi
cmp eax, 1
jne 0x433742
push 0x38
push 0
push 0
push ecx
call fcn.00507e1b
lea eax, [edi + 0xc]
add esp, 0x10
mov dword [ebp - 0x24], eax
push 2
push 0
push dword [esi]
call fcn.00505ddb
push dword [esi]
call fcn.00506482
push dword [esi]
mov ebx, eax
mov dword [ebp - 0x20], ebx
call fcn.0050670f
add esp, 0x14
test ebx, ebx
je 0x433bc4
mov cl, byte [0x5d1320]
test cl, cl
jne 0x433bc4
push dword [edi + 0xc]
lea eax, [ebp - 0xdc]
push 0x10
push 1
push eax
call fcn.00505a4a
add esp, 0x10
cmp eax, 0x10
jne case.0x4335f0.2
lea ecx, [ebp - 0xdc]
mov edx, 0x53296c
lea esi, [eax - 5]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne case.0x4335f0.2
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4337a6
mov ax, word [ecx]
cmp ax, word [edx]
jne case.0x4335f0.2
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne case.0x4335f0.2
movzx eax, byte [ebp - 0xcd]
sub eax, 5
cmp eax, 1
ja case.0x4335f0.2
mov ecx, 0x10
mov eax, ebx
mov dword [ebp - 0x10], ecx
cmp ebx, ecx
jbe 0x433b5b
jmp 0x433800
mov al, byte [0x5d1320]
test al, al
jne case.0x4335f0.2
lea esi, [ecx + 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x8c], 0
cmp esi, ebx
ja 0x433b8d
push dword [edi + 0xc]
lea eax, [ebp - 0x7c]
push 0x38
push 1
push eax
call fcn.00505a4a
add esp, 0x10
cmp eax, 0x38
jne case.0x4335f0.2
movzx eax, byte [ebp - 0x52]
mov edx, esi
movzx esi, byte [ebp - 0x51]
movzx ebx, byte [ebp - 0x4d]
movzx ecx, byte [ebp - 0x49]
shl esi, 8
or esi, eax
shl ebx, 8
movzx eax, byte [ebp - 0x53]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [ebp - 0x54]
shl esi, 8
or esi, eax
mov dword [ebp - 0x10], edx
movzx eax, byte [ebp - 0x4e]
or ebx, eax
mov dword [ebp - 0x8c], esi
movzx eax, byte [ebp - 0x4f]
shl ebx, 8
or ebx, eax
movzx eax, byte [ebp - 0x50]
shl ebx, 8
or ebx, eax
movzx eax, byte [ebp - 0x4a]
or ecx, eax
mov dword [ebp - 0x88], ebx
movzx eax, byte [ebp - 0x4b]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x4c]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x46]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x84], ecx
movzx ecx, byte [ebp - 0x45]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x47]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x48]
shl ecx, 8
or ecx, eax
lea eax, [esi + edx]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x80], ecx
cmp eax, dword [ebp - 0x20]
ja 0x433b1d
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x58]
push 0x10
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa0]
push 0
push eax
mov byte [ebp - 0x90], 0
mov byte [ebp - 0xa4], 0
call fcn.005031e7
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp eax, 0xa
jae 0x433af6
push 0x10
lea eax, [ebp - 0xb4]
push 0
push eax
call fcn.00503211
add esp, 0xc
mov dword [ebp - 0x30], edx
mov ecx, eax
mov dword [ebp - 0xc4], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], ecx
push edx
push ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x10]
push ecx
mov ecx, edi
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], 0
call fcn.00434bc0
test al, al
je 0x433af6
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
shl eax, 5
push ecx
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 0x28]
add ecx, edi
call fcn.00404420
mov ecx, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x2c], eax
add ecx, 0x28
lea eax, [ebp - 0x34]
add ecx, edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00404900
cmp dword [ebp - 0x38], 0
jne 0x433af6
mov eax, dword [ebp - 0x1c]
add eax, edi
cmp dword [eax + 0x30], 0x6666666
je 0x433bfc
add eax, 0x2c
mov dword [ebp - 0x44], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0
call fcn.004fa223
mov edx, dword [ebp - 0x30]
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], eax
lea ecx, [eax + 8]
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], edx
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 0x28
mov dword [ebp - 4], 1
add ebx, edi
mov eax, dword [ebx + 8]
fld dword [ebx]
add eax, 1
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
jns 0x433a81
fadd dword [0x530074]
fstp dword [ebp - 0x14]
fld dword [ebp - 0x14]
mov eax, dword [ebx + 0x1c]
fild dword [ebx + 0x1c]
test eax, eax
jns 0x433a97
fadd dword [0x530074]
fstp dword [ebp - 0x14]
fdiv dword [ebp - 0x14]
fcompi st(1)
fstp st(0)
jbe 0x433ad0
mov ecx, ebx
call fcn.004313b0
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov esi, dword [ebp - 0x2c]
add eax, 8
push esi
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00404900
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jmp 0x433ad6
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x2c]
push dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
push ecx
push esi
mov ecx, ebx
call fcn.00431350
mov esi, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
push 1
push esi
push dword [edi + 0xc]
call fcn.00505ddb
add esp, 0xc
test eax, eax
js case.0x4335f0.2
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x20]
add ecx, esi
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
jb 0x433800
jmp 0x433b58
call fcn.0041ca10
cmp eax, 1
jg 0x433b52
push str.Detected_sliced_file._Dropping_entries_from_here._n
push 1
call fcn.0041d050
add esp, 8
test al, al
jne 0x433b52
push str.Fossilize_WARN:_Detected_sliced_file._Dropping_entries_from_here._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
add esp, 8
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp dword [edi + 0x168], 0
jne 0x433be2
cmp ecx, ebx
je 0x433be2
push 0
push eax
push dword [edi + 0xc]
call fcn.00505ddb
add esp, 0xc
test eax, eax
jns 0x433be2
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0041ca10
cmp eax, 1
jg 0x433b55
push str.Detected_sliced_file._Dropping_entries_from_here._n
push 1
call fcn.0041d050
add esp, 8
test al, al
jne 0x433b55
push str.Fossilize_WARN:_Detected_sliced_file._Dropping_entries_from_here._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
add esp, 8
jmp 0x433b55
mov eax, dword [ebp - 0x24]
push dword [eax]
jmp 0x433bcc
push ecx
push 0x10
push 1
push 0x53296c
call fcn.005066ac
add esp, 0x10
cmp eax, 0x10
jne case.0x4335f0.2
mov ecx, dword [ebp - 0xc]
mov al, 1
mov byte [edi + 0x174], 1
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call fcn.004f7e11
mov edi, edi
inc esi
inc ebx
add bh, dh
xor eax, 0x3b7a0043
inc ebx
add byte [ebp + 0x36], bh
inc ebx
add byte [ebp - 0x33ffbcca], dl
int3