Function at 0x45b010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x17c
lea eax, [esp + 0x90]
mov ebx, dword [esp + 0x190]
mov ebp, dword [esp + 0x198]
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [eax + 0xc]
test eax, eax
mov edi, eax
je 0x45b230
mov eax, dword [ebx + 0x44]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x48]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x6c]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x70]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x74]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x78]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x4c]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x50]
mov dword [ebx + 0x4c], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x54]
mov dword [ebx + 0x50], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x58]
mov dword [ebx + 0x54], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x5c]
mov dword [ebx + 0x58], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x60]
mov dword [ebx + 0x5c], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x64]
mov dword [ebx + 0x60], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x64], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov dword [ebx + 0x68], 0
mov edx, ebp
mov eax, ebx
call fcn.00459e20
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
add esp, 0x17c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0xe0]
mov dword [esp + 0xc], 0x11
mov dword [esp + 8], 0x20
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp], eax
call fcn.0045e820
test eax, eax
mov edi, eax
jne 0x45b068
cmp byte [esp + 0xe0], 0x37
jne 0x45b361
cmp byte [esp + 0xe1], 0x7a
jne 0x45b361
cmp byte [esp + 0xe2], 0xbc
jne 0x45b361
cmp byte [esp + 0xe3], 0xaf
jne 0x45b361
cmp byte [esp + 0xe4], 0x27
jne 0x45b361
cmp byte [esp + 0xe5], 0x1c
jne GetFileSecurityW
movzx eax, byte [esp + 0xe6]
mov edi, 4
test al, al
mov byte [esp + 0x38], al
jne 0x45b068
mov eax, dword [esp + 0xec]
mov edx, dword [esp + 0xf0]
mov edi, 3
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0xf8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x90]
add eax, 0x20
mov dword [ebx + 0x30], eax
lea eax, [esp + 0xec]
adc edx, 0
mov dword [ebx + 0x34], edx
mov dword [esp + 4], 0x14
mov dword [esp], eax
call fcn.0045c9a0
cmp eax, dword [esp + 0xe8]
jne RegSetValueExW
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x45b36b
mov edi, 2
jmp SetFileSecurityW
cmp esi, eax
jbe 0x45b3b1
mov edi, 0x11
jmp 0x45b068
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
test esi, esi
mov dword [esp + 0x3c], esi
je 0x45b511
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
add eax, esi
mov esi, dword [esp + 0x20]
adc edx, edi
mov edi, dword [esp + 0x24]
cmp edi, edx
ja 0x45b361
jb GetOpenFileNameW
cmp esi, eax
ja 0x45b361
mov edi, dword [esp + 0x24]
add eax, 0x20
mov esi, dword [esp + 0x20]
adc edx, 0
cmp edi, edx
ja 0x45b361
jae 0x45b35d
lea eax, [esp + 0x130]
mov dword [esp + 0x130], 0
mov dword [esp + CreateCompatibleBitmapx134], 0
mov dword [esp + 8], 2
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp], eax
call dword [eax + 0xc]
test eax, eax
mov edi, eax
jne 0x45b068
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x90]
mov edx, dword [esp + 0x24]
adc edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x134]
mov esi, dword [esp + 0x130]
cmp edx, ecx
mov dword [esp + 0x20], esi
ja reloc.GDI32.dll_SetBkColor
jb 0x45b42b
cmp eax, esi
ja reloc.GDI32.dll_SetBkColor
mov esi, eax
mov edi, edx
add esi, 0x20
adc edi, 0
mov dword [esp + 0x40], esi
cmp ecx, edi
mov dword [esp + 0x44], edi
jb reloc.GDI32.dll_SetBkColor
ja 0x45b451
cmp dword [esp + 0x20], esi
jb reloc.GDI32.dll_SetBkColor
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
add esi, 0x20
adc edi, 0
add eax, esi
adc edx, edi
cmp ecx, edx
jb reloc.GDI32.dll_SetBkColor
ja 0x45b477
cmp dword [esp + 0x20], eax
jb reloc.GDI32.dll_SetBkColor
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0045e770
test eax, eax
mov edi, eax
jne 0x45b068
mov eax, dword [esp + 0x19c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
lea eax, [esp + 0xb0]
mov dword [esp], eax
call fcn.0045c8e0
test eax, eax
je 0x45b353
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp], eax
call fcn.0045e890
test eax, eax
mov edi, eax
je 0x45b522
mov eax, dword [esp + 0x19c]
mov dword [esp + 4], eax
lea eax, [esp + 0xb0]
mov dword [esp], eax
call fcn.0045c940
jmp 0x45b068
xor edi, edi
jmp 0x45b222
mov edi, 6
jmp 0x45b068
mov eax, dword [esp + 0x3c]
mov edi, 0x10
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call fcn.0045c9a0
cmp dword [esp + 0x30], eax
jne 0x45b4f2
mov eax, dword [esp + 0xb0]
lea edx, [esp + 0x98]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0xbc], eax
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
mov dword [esp + 0x48], eax
jne 0x45b74e
mov eax, dword [esp + 0x98]
mov edx, eax
xor edx, 0x17
or edx, dword [esp + 0x9c]
je 0x45b757
xor eax, 1
or eax, dword [esp + 0x9c]
je reloc.KERNEL32.dll_CopyFileExW
mov edi, 4
mov eax, dword [esp + 0x19c]
mov dword [esp + 4], eax
lea eax, [esp + 0xb0]
mov dword [esp], eax
call fcn.0045c940
test edi, edi
jne CompareFileTime
add esp, 0x17c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x130]
mov dword [esp + 0x198], ebp
mov esi, ebx
mov ebp, dword [esp + 0x194]
mov ebx, dword [esp + 0x198]
lea edi, [esp + 0x170]
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.0045c8c0
add dword [esp + 0x4c], 8
mov eax, dword [esp + 0x4c]
cmp edi, eax
jne CreateEventA
lea edx, [esp + 0xa8]
lea eax, [esp + 0xb8]
mov dword [esp + 0x198], ebx
mov dword [esp + 0x194], ebp
mov dword [esp + CreateIoCompletionPortxd0], 0
mov ebx, esi
mov ebp, dword [esp + 0x198]
mov dword [esp + 0xd4], 0
mov dword [esp + CreateMutexWxd8], 0
mov dword [esp + CreateProcessWxdc], 0
mov dword [esp + 0xc8], 0
mov dword [esp + CreateSemaphoreAxcc], 0
mov dword [esp + 0xc4], 0
mov dword [esp + CreateSemaphoreWxc0], 0
call fcn.00459f00
test eax, eax
mov edi, eax
jne 0x45b70c
mov eax, dword [esp + 0xa8]
mov edx, eax
xor edx, 2
or edx, dword [esp + 0xac]
je DeleteCriticalSection
mov edx, eax
xor edx, 3
or edx, dword [esp + 0xac]
je _fdopen
mov dword [esp + DeleteFileWx20], 0
mov edx, eax
xor edx, 4
or edx, dword [esp + 0xac]
je 0x45c346
mov edx, dword [esp + 0xac]
mov esi, edx
or esi, eax
je DosDateTimeToFileTime
xor eax, 5
mov edi, 0x10
or eax, edx
je 0x45b8b4
mov esi, dword [esp + 0x60]
mov dword [esp + 0x48], edi
mov eax, dword [esp + 0x19c]
mov dword [esp], esi
add esi, 8
mov dword [esp + 4], eax
call fcn.0045c940
cmp dword [esp + 0x4c], esi
jne 0x45b714
mov ecx, dword [esp + 0x48]
test ecx, ecx
jne 0x45b74e
cmp dword [esp + 0xbc], 0
mov eax, 0xb
mov esi, eax
cmove esi, ecx
mov dword [esp + 0x48], esi
mov edi, dword [esp + 0x48]
jmp ExpandEnvironmentStringsW
lea eax, [esp + 0x100]
mov dword [esp], eax
mov esi, eax
call fcn.0045c8c0
mov eax, dword [esp + 0x19c]
mov ecx, esi
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 0
mov dword [esp + FileTimeToLocalFileTimex138], 0
mov dword [esp + 0x13c], 0
mov dword [esp + FileTimeToSystemTimex140], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x130]
mov dword [esp + FindClosex144], 0
mov dword [esp + FindCloseChangeNotificationx148], 0
mov dword [esp + 0x14c], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
mov dword [esp], 1
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 8], edx
lea edx, [esp + 0xb8]
mov dword [esp + FindNextFileWx158], 0
call fcn.006ebf93
mov edx, dword [esp + 0x19c]
mov edi, eax
lea eax, [esp + 0x130]
call fcn.00459e20
mov eax, dword [esp + 0x19c]
test edi, edi
mov dword [esp + 4], eax
je 0x45b852
mov dword [esp], esi
call fcn.0045c940
jmp CancelIo
lea eax, [esp + 0xb0]
mov dword [esp], eax
call fcn.0045c940
mov edx, dword [esp + 0x100]
mov eax, dword [esp + 0x104]
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], edx
mov dword [esp + 0xbc], eax
lea edx, [esp + 0x98]
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
mov edi, eax
jne CancelIo
mov eax, dword [esp + 0x98]
jmp GetConsoleScreenBufferInfo
lea edx, [esp + 0x88]
lea eax, [esp + 0xb8]
mov dword [esp + 0x88], 0
call fcn.0045a1e0
test eax, eax
je 0x45b8e3
mov dword [esp + 0x48], eax
mov esi, dword [esp + 0x60]
jmp GetCurrentDirectoryW
mov eax, dword [esp + 0x88]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x54], 0
mov dword [esp + GetCurrentProcessx28], 0
mov dword [ebx + 0x40], eax
lea edx, [esp + 0xa0]
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
jne 0x45b8d6
mov eax, dword [esp + 0xa4]
or eax, dword [esp + 0xa0]
je 0x45b99d
lea edx, [esp + 0xa8]
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
jne 0x45b8d6
xor edx, edx
cmp edx, dword [esp + 0xac]
mov ecx, dword [esp + 0xbc]
mov esi, dword [esp + 0xa8]
ja 0x45b96a
jb GetDiskFreeSpaceExW
cmp ecx, esi
jb GetHandleInformation
cmp dword [esp + 0xa4], 0
mov eax, dword [esp + 0xa0]
jne case.0x45b996.16
cmp eax, 0xff
ja case.0x45b996.16
sub eax, 0xe
cmp eax, 7
ja case.0x45b996.16
jmp dword [eax*4 + 0x7310fc]
mov edx, dword [esp + 0x88]
sub edx, dword [esp + 0x28]
mov eax, 0x10
cmp edx, dword [esp + 0xc0]
jne GetExitCodeProcess
lea eax, [esp + 0x100]
mov dword [esp + 0x64], eax
mov edx, dword [esp + 0x64]
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
jne 0x45b8d6
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x100]
mov esi, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
or esi, eax
je 0x45bb60
lea eax, [esp + 0xb8]
call fcn.006eb100
test eax, eax
je GetFileSizeEx
jmp 0x45b8d6
mov ebp, dword [esp + 0x198]
mov eax, 0x10
jmp 0x45b8d6
mov esi, dword [esp + 0x20]
lea eax, [ebx + 0x5c]
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
lea esi, [esp + 0x130]
mov dword [esp], esi
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0xb8]
call fcn.006eb39f
test eax, eax
je 0x45b905
jmp 0x45b8d6
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x130]
lea eax, [ebx + 0x64]
mov dword [esp + 8], ebp
mov dword [esp], ecx
mov dword [esp + 4], esi
jmp 0x45ba3c
mov eax, dword [ebx + 0x54]
mov dword [esp], ebp
lea esi, [ebx + 0x54]
mov dword [esp + 4], eax
call dword [ebp + 4]
mov eax, dword [ebx + 0x58]
mov dword [ebx + 0x54], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp + 4]
mov edx, dword [esp + 0x88]
lea eax, [esp + 0xb8]
mov dword [ebx + 0x58], 0
mov ecx, esi
mov dword [esp], ebp
call fcn.006eb2e9
test eax, eax
jne 0x45b8d6
mov eax, dword [esp + 0xbc]
test eax, eax
je GetHandleInformation
sub eax, 1
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xb8]
lea edx, [eax + 1]
mov dword [esp + 0xb8], edx
cmp byte [eax], 0
je VerSetConditionMask
lea edx, [esp + 0x8c]
lea eax, [esp + 0xb8]
call fcn.0045a1e0
test eax, eax
jne 0x45b8d6
mov eax, dword [esp + 0x8c]
cmp eax, dword [esp + 0x20]
jae GetHandleInformation
lea eax, [esp + eax*8 + 0x130]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x104], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x100], edx
mov edx, dword [esp + 0x88]
mov dword [esp], ebp
mov ecx, esi
call fcn.006eb18b
test eax, eax
je GetSystemDirectoryA
jmp 0x45b8d6
mov eax, dword [ebx + 4]
mov dword [esp + GetSystemDirectoryWxa8], 0
mov dword [esp], ebp
lea eax, [eax*4 + 4]
mov dword [esp + 4], eax
call dword [ebp]
test eax, eax
mov dword [ebx + 0x6c], eax
je 0x45c1a7
mov esi, dword [ebx + 0x40]
test esi, esi
jne GetSystemPowerStatus
mov dword [ebx + 0x70], 0
lea eax, [esi*8 + 8]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [ebp]
test eax, eax
mov dword [ebx + 0x44], eax
je 0x45c1a7
mov esi, dword [ebx + 0x40]
lea eax, [esi + 7]
shr eax, 3
test eax, eax
jne GetTempPathW
mov dword [ebx + 0x48], 0
test esi, esi
jne GetThreadContext
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov eax, dword [esp + 0xdc]
test eax, eax
jne 0x45c126
mov byte [esp + 0x6b], 0
mov dword [esp + GetTickCountx50], 0
mov dword [esp + 0x58], 0
xor edi, edi
mov byte [esp + GetTimeZoneInformationx6a], 0
mov byte [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 0x5c], 0
mov dword [esp + 0x3c], 0
xor esi, esi
mov dword [esp + 0x78], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x198], ebp
cmp esi, dword [esp + 0x88]
jae 0x45bd34
cmp byte [esp + 0x28], 0
jne 0x45bc7a
movzx ecx, byte [esp + 0x38]
mov edx, dword [ebx + 0x48]
lea eax, [esi - 1]
mov byte [esp + 0x38], 0
mov byte [esp + 0x28], pe_nt_image_headers32
shr eax, 3
mov byte [edx + eax], cl
movzx ecx, byte [esp + 0x6a]
mov edx, dword [ebx + 0x4c]
mov byte [esp + 0x6a], 0
mov byte [edx + eax], cl
mov eax, dword [ebx + 0x44]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov dword [eax + esi*8 + 4], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + esi*8], edx
lea eax, [esi*4]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0x50]
test ecx, ecx
mov dword [eax + esi*4], 0
je 0x45c105
mov eax, esi
shr eax, 3
movzx edx, byte [ecx + eax]
mov ecx, esi
mov eax, pe_nt_image_headers32
and ecx, 7
mov edi, eax
sar edi, cl
test edx, edi
je GlobalUnlock
mov edi, dword [esp + 0x6c]
test edi, edi
je InitializeCriticalSection
mov ecx, dword [esp + 0x78]
mov edx, ecx
shr edx, 3
movzx edx, byte [edi + edx]
mov edi, ecx
and ecx, 7
sar eax, cl
movzx ecx, byte [esp + 0x38]
or ecx, dword [esp + 0x28]
test edx, eax
movzx eax, byte [esp + 0x38]
cmove eax, ecx
mov ecx, edi
add ecx, 1
mov byte [esp + 0x38], al
mov dword [esp + 0x78], ecx
cmp dword [esp + 0x3c], 0
mov eax, dword [ebx + 0x70]
lea ecx, [esi*4]
jne 0x45bddc
mov dword [eax + ecx], 0xffffffff
add esi, 1
shr byte [esp + 0x28], 1
jmp GetVersionExW
cmp byte [esp + 0x28], 0x80
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x198]
je 0x45bd62
movzx ecx, byte [esp + 0x38]
mov edx, dword [ebx + 0x48]
lea eax, [esi - 1]
shr eax, 3
mov byte [edx + eax], cl
movzx ecx, byte [esp + 0x6a]
mov edx, dword [ebx + 0x4c]
mov byte [edx + eax], cl
cmp dword [esp + 0x3c], 0
mov eax, dword [ebx + 0x44]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [eax + esi*8], edx
mov dword [eax + esi*8 + 4], ecx
jne LoadResource
lea ecx, [edi*4]
mov eax, dword [ebx + 0x6c]
mov dword [esp + 0x38], ecx
mov dword [eax + ecx], esi
cmp edi, dword [ebx + 4]
jae MapViewOfFile
cmp dword [esp + 0xc8], 0
je MoveFileExW
lea edx, [esp + 0xa8]
lea eax, [esp + 0xc8]
call fcn.0045a1e0
test eax, eax
jne MultiByteToWideChar
mov ecx, dword [esp + 0x38]
add ecx, 4
cmp dword [esp + 0xa8], 0
jne OpenEventW
add edi, 1
jmp 0x45bd86
mov edx, dword [esp + 0x20]
mov dword [eax + ecx], edx
mov ecx, dword [esp + 0x54]
mov eax, esi
shr eax, 3
movzx edx, byte [ecx + eax]
mov ecx, esi
mov eax, pe_nt_image_headers32
and ecx, 7
sar eax, cl
test edx, eax
jne 0x45bd28
sub dword [esp + 0x3c], 1
jne PostQueuedCompletionStatus
mov ecx, dword [esp + 0x20]
mov edx, dword [ebx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
lea eax, [ecx*4]
mov dword [esp + 0x7c], eax
mov eax, dword [ebx + 0x20]
movzx eax, byte [eax + ecx]
add eax, dword [edx + ecx*4]
mov edx, dword [ebx + 0x24]
lea edx, [edx + eax*8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov dword [esp + 0x70], eax
mov eax, dword [ebx + 0x6c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + ecx*4]
mov eax, dword [ebx + 0x44]
lea edx, [eax + edx*8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
sub edi, eax
sbb ebp, edx
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x70]
mov ecx, ebp
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x74]
cmp ebp, ecx
jb RaiseException
ja ReadDirectoryChangesW
mov ecx, dword [esp + 0x30]
cmp edi, ecx
jb 0x45ba12
mov edi, dword [esp + 0x70]
mov ebp, dword [esp + 0x74]
add eax, edi
adc edx, ebp
mov dword [esp + 0x30], eax
cmp ebp, edx
mov dword [esp + 0x34], edx
ja ReadFile
jb 0x45bea9
cmp edi, eax
ja ReadFileScatter
cmp dword [esp + 0xa8], 1
je 0x45befa
cmp byte [esp + 0x6b], 0
jne 0x45bed1
mov eax, dword [esp + 0x58]
test eax, eax
je 0x45bec7
cmp byte [eax], 0
js 0x45bed1
add dword [esp + 0x20], 1
jmp 0x45bd28
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x50]
mov eax, dword [ebx + 0x50]
mov edi, dword [esp + 0x40]
mov edx, dword [edx + ecx*4]
mov dword [eax + edi], edx
mov eax, ecx
add eax, 1
mov dword [esp + 0x5c], eax
movzx eax, byte [esp + 0x28]
or byte [esp + 0x6a], al
jmp 0x45bec7
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x45beb3
mov edx, esi
mov ecx, esi
shr edx, 3
and ecx, 7
movzx edx, byte [eax + edx]
mov eax, 0x80
sar eax, cl
test edx, eax
je 0x45beb3
mov eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x7c]
mov edx, dword [eax + ecx]
mov eax, dword [ebx + 0x50]
mov ecx, dword [esp + 0x40]
mov dword [eax + ecx], edx
movzx eax, byte [esp + 0x28]
or byte [esp + 0x6a], al
jmp 0x45bec7
mov edx, dword [esp + 0x64]
lea eax, [esp + 0xd0]
call fcn.00459f00
test eax, eax
jne 0x45bfc5
mov eax, dword [esp + 0x100]
add dword [esp + 0x30], eax
mov edx, dword [esp + 0x104]
adc dword [esp + 0x34], edx
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
cmp edx, ebp
ja SetConsoleCtrlHandler
jb 0x45bf7d
cmp eax, edi
ja 0x45ba12
cmp byte [esp + 0x6b], 0
jne 0x45bf99
mov eax, dword [esp + 0x58]
test eax, eax
je SetConsoleMode
cmp byte [eax], 0
jns 0x45bd28
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x50]
mov eax, dword [ebx + 0x50]
mov edi, dword [esp + 0x40]
mov edx, dword [edx + ecx*4]
mov dword [eax + edi], edx
mov eax, ecx
add eax, 1
mov dword [esp + 0x5c], eax
movzx eax, byte [esp + 0x28]
or byte [esp + 0x6a], al
jmp SetEvent
mov ebp, dword [esp + 0x198]
jmp SetFileApisToOEM
movzx eax, byte [esp + 0x28]
or byte [esp + 0x38], al
jmp 0x45bd0c
cmp dword [esp + 0xc8], 0
je 0x45bff7
cmp dword [esp + 0xcc], 0
jne GetHandleInformation
mov esi, dword [esp + 0x60]
jmp 0x45b714
cmp dword [esp + 0x3c], 0
jne 0x45c0ef
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x40]
lea ecx, [eax*4]
mov edi, eax
cmp dword [ebx + 4], edi
jbe SetFileTime
cmp dword [esp + 0xc8], 0
mov eax, dword [ebx + 0x6c]
mov dword [esp + 0x20], ecx
mov dword [eax + ecx], esi
mov dword [esp + 0xa8], 1
je 0x45c0dd
lea edx, [esp + 0xa8]
lea eax, [esp + 0xc8]
call fcn.0045a1e0
test eax, eax
jne 0x45bfc5
mov eax, dword [esp + 0xa8]
test eax, eax
jne SetThreadPriority
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
mov ecx, dword [esp + 0x20]
movzx eax, byte [eax + edi]
add eax, dword [edx + ecx]
mov edx, dword [ebx + 0x24]
lea edx, [edx + eax*8]
mov eax, dword [edx]
add dword [esp + 0x30], eax
mov edx, dword [edx + 4]
adc dword [esp + 0x34], edx
add ecx, 4
cmp edx, dword [esp + 0x34]
ja SetWaitableTimer
jb 0x45c0ab
cmp eax, dword [esp + 0x30]
ja 0x45ba12
add edi, 1
jmp SizeofResource
mov dword [esp + 0x20], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebp
cmp dword [esp + 0x54], 0
mov eax, dword [ebx + 0x70]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x20]
mov dword [eax + ecx], edx
jne SuspendThread
jmp 0x45be04
mov dword [esp + 0x20], edi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], 1
jmp 0x45c0bf
mov eax, dword [ebx + 0x70]
mov edx, dword [esp + 0x20]
lea ecx, [esi*4]
mov dword [eax + ecx], edx
jmp OpenFileMappingW
cmp dword [esp + 0x3c], 0
je SetFilePointerEx
mov eax, dword [ebx + 0x70]
mov edx, dword [esp + 0x20]
lea ecx, [esi*4]
mov dword [eax + ecx], edx
jmp TlsAlloc
sub eax, 1
mov dword [esp + TlsFreex58], 0
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0xd8]
lea ecx, [eax + 1]
mov dword [esp + 0xd8], ecx
movzx eax, byte [eax]
mov dword [esp + 0x50], ecx
test al, al
mov byte [esp + 0x6b], al
jne TryEnterCriticalSection
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x58], ecx
add eax, 7
shr eax, 3
add eax, ecx
mov dword [esp + 0x50], eax
jmp GetTimeZoneInformation
lea eax, [esi + 7]
mov dword [esp], ebp
shr eax, 3
mov dword [esp + 4], eax
call dword [ebp]
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x45c1a7
shl esi, 2
mov dword [esp], ebp
mov dword [esp + 4], esi
call dword [ebp]
test eax, eax
mov dword [ebx + 0x50], eax
jne GetThreadPriority
mov eax, 2
jmp 0x45b8d6
lea eax, [esp + 0xb8]
jmp GetStdHandle
mov dword [esp + 4], eax
mov dword [esp], ebp
call dword [ebp]
test eax, eax
mov dword [ebx + 0x48], eax
je 0x45c1a7
mov esi, dword [ebx + 0x40]
jmp GetThreadContext
shl esi, 2
mov dword [esp], ebp
mov dword [esp + 4], esi
call dword [ebp]
test eax, eax
mov dword [ebx + 0x70], eax
je 0x45c1a7
mov esi, dword [ebx + 0x40]
jmp VirtualFree
test ecx, ecx
je GetHandleInformation
mov eax, dword [esp + 0xb8]
sub ecx, 1
mov dword [esp + 0xbc], ecx
lea edi, [eax + 1]
mov dword [esp + 0xb8], edi
movzx eax, byte [eax]
test al, al
mov byte [esp + 0x3c], al
jne reloc.msvcrt.dll_fputws
sub esi, 1
test esi, 1
jne GetHandleInformation
mov eax, dword [esp + 0x88]
mov dword [esp], ebp
lea eax, [eax*4 + 4]
mov dword [esp + 4], eax
call dword [ebp]
test eax, eax
mov dword [ebx + 0x74], eax
je 0x45c1a7
test esi, esi
je 0x45c338
mov dword [esp + 4], esi
mov dword [esp], ebp
call dword [ebp]
test eax, eax
mov dword [ebx + 0x78], eax
je 0x45c1a7
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x88]
mov edi, dword [ebx + 0x74]
mov ecx, dword [ebx + 0x78]
test eax, eax
mov dword [edi], 0
je WriteFile
cmp esi, 1
je WriteFileGather
cmp byte [ecx + esi - 2], 0
jne GetHandleInformation
cmp byte [ecx + esi - 1], 0
jne lstrcmpW
sub eax, 1
xor edx, edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], eax
xor eax, eax
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp word [eax], 0
je 0x45c311
add eax, 2
jmp AlphaBlend
mov eax, dword [esp + 0x28]
add eax, 7
shr eax, 3
cmp ecx, eax
jb __dllonexit
mov esi, dword [esp + 0xb8]
sub ecx, eax
mov dword [esp + 0xbc], ecx
add eax, esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0xb8], eax
jmp 0x45b905
sub eax, ecx
mov dword [esp + 0x30], ecx
add eax, 2
mov ecx, eax
shr ecx, 1
cmp dword [esp + 0x40], edx
mov dword [edi + edx*4 + 4], ecx
je fwrite
add edx, 1
cmp esi, eax
jne __mb_cur_max
jmp GetHandleInformation
mov eax, dword [0x74]
ud2
xor edi, edi
jmp __pioinfo
lea eax, [esp + 0xc0]
lea edx, [esp + 0xb8]
mov dword [esp + 0x10], ebp
mov ecx, 0x40000000
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
lea eax, [esp + 0x130]
mov dword [esp], eax
mov eax, ebx
call fcn.006eb4d0
test eax, eax
mov edi, eax
jne DuplicateHandle
mov eax, dword [ebx + 0x30]
add dword [ebx + 0x38], eax
lea eax, [esp + 0xb8]
mov edx, dword [ebx + 0x34]
adc dword [ebx + 0x3c], edx
lea edx, [esp + 0xa8]
call fcn.00459f00
test eax, eax
mov edi, eax
jne DuplicateHandle
mov eax, dword [esp + 0xa8]
jmp 0x45b6eb
mov eax, dword [esp + 0x19c]
lea ecx, [esp + 0x130]
mov dword [esp + 0x100], 0
mov dword [esp + _filenox104], 0
mov dword [esp + _filenox108], 0
mov dword [esp + _fmodex10c], 0
mov dword [esp + _fstat64x110], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x100]
mov dword [esp + _inittermx114], 0
mov dword [esp + _iobx118], 0
mov dword [esp + _lockx11c], 0
mov dword [esp + 0xc], eax
mov esi, eax
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
mov dword [esp], 8
mov dword [esp + _onexitx120], 0
mov dword [esp + _setjmp3x124], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 8], edx
lea edx, [esp + 0xb8]
mov dword [esp + _strcmpix128], 0
call fcn.006ebf93
mov edi, eax
mov eax, dword [esp + 0x104]
mov edx, dword [esp + 0x19c]
mov dword [esp + 0x20], eax
mov eax, esi
call fcn.00459e20
test edi, edi
jne DuplicateHandle
lea edx, [esp + 0xa8]
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
mov edi, eax
jne DuplicateHandle
mov eax, dword [esp + 0xa8]
jmp 0x45b6d9
lea eax, [esp + 0x100]
mov esi, dword [esp + 0x194]
mov dword [esp + 0x64], eax
mov edx, dword [esp + 0x64]
lea eax, [esp + 0xb8]
call fcn.00459f00
test eax, eax
jne 0x45c516
mov eax, dword [esp + 0x104]
or eax, dword [esp + 0x100]
je isspace
lea eax, [esp + 0xb8]
call fcn.006eb100
test eax, eax
je 0x45c4de
mov edi, eax
jmp _wtoi
mov edx, dword [esp + 0x88]
lea eax, [edx + 7]
shr eax, 3
cmp ecx, eax
jb GetHandleInformation
mov esi, dword [esp + 0xb8]
sub ecx, eax
xor edi, edi
mov dword [esp + 0xbc], ecx
mov dword [esp + exitx28], 0
xor ecx, ecx
add eax, esi
mov dword [esp + 0x54], esi
mov dword [esp + 0xb8], eax
test edx, edx
je reloc.msvcrt.dll_fopen
test ecx, ecx
jne 0x45c56e
movzx edi, byte [esi]
mov ecx, 8
add esi, 1
mov eax, edi
sub ecx, 1
sub edx, 1
movzx eax, al
sar eax, cl
and eax, 1
add dword [esp + 0x28], eax
jmp 0x45c55b
mov dword [esp + fopenx6c], 0
jmp fprintf
sub ecx, esi
add dword [esp + 0xb8], esi
mov dword [esp + 0xbc], ecx
jmp 0x45b905
lea edx, [esp + 0x100]
lea eax, [esp + 0xb8]
call fcn.0045a1e0
test eax, eax
jne fsetpos
mov eax, dword [esp + 0x100]
cmp eax, dword [esp + 0x20]
jae GetHandleInformation
lea eax, [esp + eax*8 + 0x130]
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp gmtime
cmp esi, eax
jne fwrite
cmp byte [esp + 0x3c], 0
jne getc
sub dword [esp + 0xbc], esi
add dword [esp + 0xb8], esi
jmp islower
lea edx, [esp + 0xa8]
lea eax, [esp + 0xb8]
mov dword [esp + 0x194], esi
call fcn.00459f00
test eax, eax
mov edi, eax
jne DuplicateHandle
mov eax, dword [esp + 0xa8]
jmp 0x45b6bf