Function at 0x434c48
Capabilities:
Check if file exists
Clear file content
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], 0x101
test byte [edx + 0x170], 4
je 0x434c97
cmp dword [ebx + 0x80], 0
jne 0x434c97
cmp dword [ebx + 0x2c], 0
je 0x437447
cmp dword [ebx + 0xa4], 0
je 0x434ca9
mov byte [ebp - 0x140], 0
jmp 0x434cf6
add esp, 0xfffffff0
mov esi, dword [ebx + 0x58]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x3c], esi
lea esi, [ebp - 0x28]
mov dword [esp + 0xc], esi
mov edi, dword [ebx + 0x2c]
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], edi
call fcn.0043393c
add esp, 0x10
test eax, eax
je 0x434cf6
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x140]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x434d13
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x434cfe
dec eax
mov edx, dword [ebp - 4]
movsx esi, ax
add esi, 0xa
mov word [edx + 0x15a], ax
lea ecx, [edx + 0x60]
push ecx
push 0
push esi
mov dword [ebp - 0x154], ecx
call fcn.004172d0
add esp, 0xc
test eax, eax
je 0x434d49
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x434d55
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
or edx, dword [eax + 0x9c]
jne 0x434d84
mov dword [eax + 0x98], 1
mov dword [eax + 0x9c], 0
cmp dword [ebx + 0x44], 0
je 0x434da8
or byte [eax + 0x171], 0x40
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0x80000000
or byte [eax + 0x177], 0x10
jmp 0x434db6
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4381cd
cmp eax, 2
je 0x434e65
cmp eax, 1
jne 0x434e01
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], 0
or byte [eax + 0x171], 0x40
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x434e8b
cmp eax, 3
jne 0x434e42
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x435008
mov dword [ebp - 0x158], 0
or byte [eax + 0x176], 1
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x434e8b
mov edx, dword [ebp - 4]
mov eax, 0x2ed
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x434e61
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x435008
xor eax, eax
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov dword [ebp - 0x158], eax
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x434f63
cmp eax, 2
je 0x434f3d
cmp eax, 1
jne 0x434ed9
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], 0
or byte [eax + 0x171], 0x40
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
or edx, 0x80000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x434f63
cmp eax, 3
jne 0x434f1a
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x435008
mov dword [ebp - 0x158], 0
or byte [eax + 0x176], 1
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
or edx, 0x40000000
or dword [ebp - 0x18], 0x80
mov dword [ebp - 0x24], edx
jmp 0x434f63
mov edx, dword [ebp - 4]
mov eax, 0x23b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x434f39
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x435008
xor eax, eax
or dword [ebp - 0x18], 0x80
or dword [ebp - 0x24], 0xc0000000
mov dword [ebp - 0x158], eax
mov eax, dword [ebx]
cmp eax, 5
ja case.default.0x434f6e
jmp dword [eax*4 + 0x4d5288]
mov eax, dword [ebp - 4]
or byte [eax + 0x173], 4
and byte [eax + 0x170], 0x7b
jmp case.0x434f6e.0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 0x10
mov byte [edx + 0x173], al
jmp 0x434fe5
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x435008
mov edx, eax
movzx eax, byte [edx + 0x173]
or eax, 3
mov byte [edx + 0x173], al
jmp 0x434fe5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 8
mov byte [edx + 0x173], al
jmp 0x434fe5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 2
mov byte [edx + 0x173], al
mov edx, dword [ebx + 0x58]
cmp edx, 5
ja case.default.0x434ff1
jmp dword [edx*4 + 0x4d52a0]
test al, 1
je 0x43501a
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
jne 0x43501a
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
or dword [ebp - 0x1c], 2
or dword [ebp - 0x18], 0x4000002
or byte [eax + 0x172], 4
jmp 0x4350c9
test al, 1
je 0x435056
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
jne 0x435056
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
or dword [ebp - 0x1c], 1
jmp 0x4350c9
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 2
or dword [ebp - 0x1c], 3
jmp 0x4350c9
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je case.0x434ff1.4
push str.USER
lea eax, [ebp - 0x140]
push eax
call fcn.00464b10
add esp, 8
test eax, eax
jne case.0x434ff1.4
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 8
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
je 0x4350af
test byte [eax + 0x170], 4
je 0x4350b8
test byte [eax + 0x177], 0x10
je case.0x434ff1.5
or byte [eax + 0x172], 2
or dword [ebp - 0x1c], 3
jmp 0x4350c9
or dword [ebp - 0x1c], 4
mov eax, dword [ebx + 0x28]
cmp eax, 6
ja case.default.0x43523b
jmp dword [eax*4 + 0x4d52b8]
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 4
je case.0x4350d5.2
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
test al, 4
jne 0x435008
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x172], al
jmp case.0x4350d5.0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
test al, 4
jne 0x435008
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x172], al
jmp case.0x4350d5.0
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x435008
mov edx, eax
movzx eax, byte [edx + 0x172]
or eax, 8
mov byte [edx + 0x172], al
mov edx, dword [ebx + 0x28]
cmp edx, 5
jne 0x435175
mov edx, dword [ebp - 4]
or eax, 0x10
mov byte [edx + 0x172], al
jmp case.0x4350d5.0
cmp edx, 6
jne case.0x4350d5.0
mov edx, dword [ebp - 4]
or eax, 0x20
mov byte [edx + 0x172], al
jmp case.0x4350d5.0
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 4
je case.0x4350d5.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x34]
cmp eax, 4
ja case.default.0x4351b2
jmp dword [eax*4 + 0x4d52d4]
mov eax, dword [ebp - 4]
or byte [eax + 0x178], 2
jmp 0x435224
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test edx, 0x80
jne 0x4351e0
or byte [eax + 0x172], 0x80
jmp 0x435224
or byte [eax + 0x178], 1
jmp 0x435224
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x4351ff
test al, 0x10
jne 0x4351ff
test al, 4
je case.0x4351b2.1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test edx, 0x80
jne 0x4351e0
or byte [eax + 0x172], 0x80
jmp 0x435224
mov eax, dword [ebp - 4]
or byte [eax + 0x172], 0x40
mov edx, eax
mov eax, dword [ebx + 0x4c]
mov byte [edx + 0x15c], al
mov edx, dword [ebx + 0x4c]
cmp edx, 8
ja case.default.0x43523b
jmp dword [edx*4 + 0x4d52e8]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x435267
test dl, 0x10
jne 0x435267
test dl, 4
jne 0x435267
mov edx, dword [ebp - 4]
test byte [edx + 0x172], 0x40
je case.0x43523b.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 4
mov eax, 4
jmp case.0x43523b.0
mov edx, dword [ebp - 4]
test byte [edx + 0x173], 4
je case.0x43523b.0
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov byte [ecx + 0x15e], dl
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x438150
cmp edx, 1
je 0x43531e
cmp edx, 2
jne 0x4352f7
mov edx, ecx
test byte [edx + 0x173], 4
jne 0x435008
test byte [edx + 0x172], 0x40
je 0x43532d
movsx edx, al
add edx, 0xfffffffb
cmp edx, 3
ja 0x43532d
mov edx, ecx
mov byte [edx + 0x15e], 3
jmp 0x43532d
cmp edx, 3
je 0x43532d
mov edx, ecx
mov eax, 0x2f2
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43531a
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, ecx
test byte [edx + 0x173], 4
jne 0x435008
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x438129
cmp edx, 1
je 0x4353ab
cmp edx, 2
jne 0x43535e
mov eax, dword [ebp - 4]
test byte [eax + 0x173], 0x10
jne 0x435008
mov byte [eax + 0x15d], 2
jmp 0x4353f9
cmp edx, 3
jne case.default.0x43523b
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x435008
test dl, 1
jne 0x435008
test dl, 4
jne 0x435008
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 3
mov ecx, 3
jmp 0x4353f0
mov eax, 0x30
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
je 0x4353d8
movsx ecx, al
cmp ecx, 1
je 0x4353d8
test ecx, ecx
je 0x4353d8
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test dl, 0x10
jne 0x435008
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 1
mov ecx, 1
test dl, 8
je 0x43551d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x15c], eax
add eax, 0xf
and eax, 0xfffffff0
call fcn.0046bcc0
mov eax, esp
mov edi, eax
push dword [ebp - 0x14]
push 0
push edi
call fcn.004b4870
add esp, 0xc
push str.FOR_DO_NOT_CACHE_DIRECT_FILE
push dword [ebp - 0x14]
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.00462920
add esp, 0x10
test edi, edi
je 0x4354f5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x100]
movsx eax, byte [edi]
cmp eax, 0x20
mov dword [ebp - 0x168], edx
mov edx, edi
jne 0x43545e
inc edx
movsx eax, byte [edx]
cmp eax, 0x20
je 0x435455
mov ecx, edx
je 0x435472
movsx eax, byte [edx]
test eax, eax
je 0x435472
inc ecx
movsx eax, byte [ecx]
cmp eax, 0x20
jne 0x435465
push 0x4d5364
push edx
mov byte [ecx], 0
call fcn.0046bcf0
add esp, 8
mov esi, eax
test esi, esi
je 0x4354f5
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], edi
mov ebx, dword [ebp - 0x168]
push 0x2d
push esi
call fcn.0046b8c0
mov edi, eax
add esp, 8
test edi, edi
je 0x43745d
push esi
mov byte [edi], 0
call fcn.0046bed0
add esp, 4
inc edi
push edi
mov esi, eax
call fcn.0046bed0
add esp, 4
cmp ebx, esi
jl 0x4354d4
cmp ebx, eax
jle 0x43746e
push 0x4d5364
push 0
call fcn.0046bcf0
add esp, 8
mov esi, eax
test esi, esi
jne 0x43549b
mov edi, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x160]
or dword [ebp - 0x18], 0x10000000
mov edx, edi
mov eax, dword [ebp - 0x15c]
add eax, 0xf
and eax, 0xfffffff0
add esp, eax
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x15c]
movsx ecx, byte [edx + 0x15d]
and ecx, 0xfffffffe
cmp dword [ebx + 0x4c], 0
jne 0x4355d5
cmp ecx, 2
je 0x435546
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x173]
test dl, 8
jne 0x435543
test dl, 0x10
je 0x43555d
cmp ecx, 2
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 1
mov eax, 1
je 0x4355ee
jmp 0x4355da
movzx eax, byte [eax + 0x178]
test al, 1
jne 0x435587
test al, 2
jne 0x435587
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x172]
and eax, 0x80
shr eax, 7
test dl, 4
je 0x435598
test eax, eax
je 0x4355ad
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 5
mov eax, 5
jmp 0x4355e4
test eax, eax
je 0x4355ad
mov eax, dword [ebp - 4]
mov byte [eax + 0x15c], 4
mov eax, 4
jmp 0x4355e4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 3
je 0x4355c7
mov byte [eax + 0x15c], 8
mov eax, 8
jmp 0x4355e4
mov byte [eax + 0x15c], 5
mov eax, 5
jmp 0x4355e4
cmp ecx, 2
je 0x4355ee
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 8
jne 0x4355ee
test dl, 0x10
je 0x435608
movsx edx, al
cmp edx, 1
je 0x43560b
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
movsx edx, al
mov eax, dword [ebp - 4]
test byte [eax + 0x178], 1
je 0x43563d
movzx eax, byte [eax + 0x173]
test al, 1
jne 0x435626
test al, 2
je 0x43563d
cmp edx, 5
je 0x435646
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp edx, 4
je 0x438107
or dword [ebp - 0x20], 1
cmp dword [ebx + 0x54], 0
jne 0x43565c
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43567d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x164], 0
or byte [eax + 0x172], 1
and byte [eax + 0x178], 0xfb
or dword [ebp - 0x20], 2
jmp 0x435687
mov dword [ebp - 0x164], 1
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4356c7
cmp eax, 1
je 0x4356bb
cmp eax, 2
je 0x4356d1
mov edx, dword [ebp - 4]
mov eax, 0x23d
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x4356b7
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x4356e4
cmp dword [ebp - 0x38], 0
je 0x4380e0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
or eax, 0x20
mov byte [edx + 0x173], al
and eax, 4
mov esi, dword [ebx + 0x48]
shr eax, 2
test esi, esi
je 0x435707
test eax, eax
je 0x435757
mov eax, 0x70
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x43585b
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 0x40
je 0x435734
mov esi, dword [0x4f6f64]
cmp esi, 0xfffffffe
je 0x438223
cmp esi, 0xffffffff
jne 0x43574c
jmp 0x43585b
mov esi, dword [0x4f6f68]
cmp esi, 0xfffffffe
je 0x438211
cmp esi, 0xffffffff
je 0x43585b
mov dword [ebx + 0x48], esi
test esi, esi
je 0x43585b
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43578f
test esi, esi
jle 0x43577d
mov eax, esi
mov ecx, 0xfffffffa
cdq
mov eax, esi
xor edi, edi
sub eax, ecx
sbb edx, edi
jl 0x435797
or eax, edx
je 0x435797
mov eax, 0x245
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x438235
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x172]
and edx, 0x80
shr edx, 7
mov dword [eax + 0xfc], esi
test edx, edx
je 0x4357cc
test byte [eax + 0x174], 0x10
jne 0x4357cc
cmp dword [ebx + 0x7c], 0
lea eax, [esi*4]
jne 0x4357cc
mov esi, eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x15c]
dec eax
cmp eax, 7
ja case.default.0x4357dc
jmp dword [eax*4 + 0x4d530c]
mov eax, dword [ebp - 4]
lea edx, [esi + 1]
cmp byte [eax + 0x15e], 3
jne case.0x4357dc.1
mov esi, edx
jmp case.0x4357dc.1
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x173]
test byte [ecx + 0x178], 2
jne 0x435811
test al, 4
je case.0x4357dc.1
test edx, edx
je case.0x4357dc.1
mov edx, ecx
or eax, 0xffffff80
mov esi, 0x400
mov dword [edx + 0xfc], 0x10000
mov byte [edx + 0x173], al
jmp case.0x4357dc.1
add esi, 4
jmp case.0x4357dc.1
add esi, 8
jmp case.0x4357dc.1
push 0x6de
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0040ab30
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [eax + 0xf8], esi
jmp 0x435967
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15c], 1
je 0x43587a
mov esi, eax
movzx eax, byte [esi + 0x173]
test al, 8
mov dword [ebp - 0x168], eax
je 0x43589d
mov edx, dword [ebp - 4]
mov eax, 0x241
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435899
mov eax, 0x25
mov esp, ebp
pop ebp
ret
mov eax, esi
movzx eax, byte [eax + 0x178]
test al, 1
jne 0x4358cf
test al, 2
jne 0x4358cf
mov eax, esi
mov ecx, dword [ebp - 0x168]
and ecx, 4
shr ecx, 2
movzx edx, byte [eax + 0x172]
test ecx, ecx
je 0x4358e7
test edx, 0x80
je 0x4358e7
mov eax, esi
mov dword [eax + 0xf8], 0x400
mov dword [eax + 0xfc], 0x10000
jmp 0x435956
test byte [eax + 0x170], 4
je 0x43590a
test dl, 0x40
je 0x43590a
mov edx, eax
mov eax, 0x400
mov dword [edx + 0xf8], eax
mov dword [edx + 0xfc], eax
jmp 0x435956
test edx, 0x80
je 0x435928
mov dword [eax + 0xf8], 0x800
mov dword [eax + 0xfc], 0x1fe
jmp 0x435956
test ecx, ecx
je 0x435942
mov dword [eax + 0xf8], 0x401
mov dword [eax + 0xfc], 0x400
jmp 0x435956
mov dword [eax + 0xf8], 0x85
mov dword [eax + 0xfc], 0x84
mov edx, esi
mov eax, dword [ebp - 0x168]
or eax, 0xffffff80
mov byte [edx + 0x173], al
mov eax, dword [ebx + 4]
test eax, eax
je 0x43597d
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov eax, dword [ebx + 8]
mov byte [edx + 0x15f], al
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3c]
mov dword [edx + 0xd8], eax
mov edx, dword [ebx + 0x70]
test edx, edx
je 0x435a01
mov eax, dword [ebp - 4]
test byte [eax + 0x172], 0x40
jne 0x4359be
mov edx, eax
mov eax, 0x2ee
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x4359ba
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x435a01
cmp edx, 1
jne 0x4359d1
mov byte [eax + 0x161], 0x27
jmp 0x435a0b
cmp edx, 3
jne 0x4359df
mov byte [eax + 0x161], 0x22
jmp 0x435a0b
mov edx, eax
mov eax, 0x2ef
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x4359fd
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x161], 0
mov edx, dword [ebx + 0x74]
test edx, edx
je 0x435a72
test byte [eax + 0x172], 0x40
jne 0x435a3d
mov edx, eax
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435a39
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
cmp edx, 2
je 0x435a72
cmp edx, 1
jne 0x435a50
and byte [eax + 0x176], 0xfd
jmp 0x435a90
mov edx, eax
mov eax, 0x2f1
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435a6e
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, eax
movzx eax, byte [edx + 0x176]
movzx esi, byte [edx + 0x170]
and eax, 0xfffffffd
and esi, 2
or eax, esi
mov byte [edx + 0x176], al
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x435ae3
cmp eax, 2
je 0x435ac9
cmp eax, 1
je 0x435ac9
cmp eax, 3
je 0x435ac9
mov edx, dword [ebp - 4]
mov eax, 0x2ec
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435ac5
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x435008
test al, 0x10
jne 0x435008
mov eax, dword [ebx + 0x90]
cmp eax, 5
ja case.default.0x435af2
jmp dword [eax*4 + 0x4d532c]
mov ecx, dword [ebp - 4]
and dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x172]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x435cb0
mov ecx, dword [ebp - 4]
and dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x172]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x435cb0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
or edx, 2
and edx, 0xfffffffe
mov dword [ebp - 0x20], edx
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffcb
movzx edx, byte [ecx + 0x172]
or eax, 8
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
mov dword [ebp - 0x164], 0
jmp 0x435cb0
mov ecx, dword [ebp - 4]
or dword [ebp - 0x20], 2
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
or eax, 4
movzx edx, byte [ecx + 0x172]
and eax, 0xffffffc7
or edx, 1
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x435cb0
cmp dword [ebx + 0x54], 0
jne 0x435c0f
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x435c44
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x164], 0
movzx edx, byte [ecx + 0x172]
movzx eax, byte [ecx + 0x178]
or edx, 1
or eax, 4
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x435cb0
cmp dword [ebx + 0x50], 0
je 0x435c85
mov ecx, eax
and dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x164], 0
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffd3
movzx edx, byte [ecx + 0x172]
or eax, 0x10
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
jmp 0x435cb0
mov ecx, eax
movzx eax, byte [ecx + 0x178]
and eax, 0xffffffe3
movzx edx, byte [ecx + 0x172]
or eax, 0x20
and edx, 0xfffffffe
mov byte [ecx + 0x172], dl
mov dword [ebp - 0x168], eax
mov byte [ecx + 0x178], al
mov eax, edx
and eax, 0x40
mov ecx, dword [ebx + 0xb4]
shr eax, 6
test ecx, ecx
je 0x435ce9
test eax, eax
jne 0x435ce9
mov edx, dword [ebp - 4]
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435ce5
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov byte [esi + 0x167], cl
mov ecx, dword [ebx + 0xb8]
test ecx, ecx
je 0x435d22
test eax, eax
jne 0x435d22
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435d1e
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x169], cl
mov ecx, dword [ebx + 0xbc]
test ecx, ecx
je 0x435d58
test eax, eax
jne 0x435d58
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435d54
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x16b], cl
mov ecx, dword [ebx + 0xc0]
test ecx, ecx
je 0x435d8e
test eax, eax
jne 0x435d90
mov edx, esi
mov eax, 0x2f0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x435d8a
mov eax, 0x2e
mov esp, ebp
pop ebp
ret
test eax, eax
mov eax, esi
mov byte [eax + 0x16d], cl
je 0x435de8
movzx eax, byte [eax + 0x173]
test al, 2
jne 0x435da9
test al, 1
je 0x435dba
mov eax, esi
mov dword [eax + 0x13c], 3
jmp 0x435e99
test al, 8
je 0x435dcf
mov eax, esi
mov dword [eax + 0x13c], 2
jmp 0x435e99
test al, 0x10
je 0x435e99
mov eax, esi
mov dword [eax + 0x13c], 8
jmp 0x435e99
test edx, 0x80
jne 0x435df9
test byte [ebp - 0x168], 1
je 0x435e51
movzx eax, byte [eax + 0x173]
test al, 2
jne 0x435e08
test al, 1
je 0x435e2d
test byte [ebp - 0x168], 1
je 0x435e1f
mov eax, esi
mov dword [eax + 0x13c], 7
jmp 0x435e99
mov eax, esi
mov dword [eax + 0x13c], 0xb
jmp 0x435e99
test al, 8
je 0x435e3f
mov eax, esi
mov dword [eax + 0x13c], 6
jmp 0x435e99
test al, 0x10
je 0x435e99
mov eax, esi
mov dword [eax + 0x13c], 9
jmp 0x435e99
test byte [ebp - 0x168], 2
movzx eax, byte [eax + 0x173]
je 0x435e99
test al, 2
jne 0x435e69
test al, 1
je 0x435e77
mov eax, esi
mov dword [eax + 0x13c], 5
jmp 0x435e99
test al, 8
je 0x435e89
mov eax, esi
mov dword [eax + 0x13c], 4
jmp 0x435e99
test al, 0x10
je 0x435e99
mov eax, esi
mov dword [eax + 0x13c], 0xa
mov eax, dword [0x4f9460]
cmp dword [ebx + 0x84], 0
je 0x435ebd
test eax, eax
jne 0x435ebd
mov eax, 0x232
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x94], 0
je 0x438078
test eax, eax
je 0x4373a9
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0x168], eax
mov eax, dword [ebx + 0x9c]
cmp eax, 1
je 0x435fe1
test eax, eax
jne 0x435f77
mov eax, dword [ebp - 4]
test byte [eax + 0x179], 0x20
jne 0x435f16
push str.FORT_BUFFERED
call fcn.0041c5c0
add esp, 4
test eax, eax
je 0x435fe1
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00428510
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
lea eax, [ebp - 0x140]
sete dl
movzx ecx, byte [esi + 0x179]
shl edx, 6
and ecx, 0xffffffbf
push eax
push esi
or ecx, edx
mov byte [esi + 0x179], cl
call fcn.00428510
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x17c]
shl edx, 2
and ecx, 0xfffffffb
or ecx, edx
mov byte [esi + 0x17c], cl
jmp 0x435ff2
cmp eax, 2
jne case.default.0x43523b
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00428510
add esp, 8
mov esi, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
lea eax, [ebp - 0x140]
sete dl
movzx ecx, byte [esi + 0x179]
shl edx, 6
and ecx, 0xffffffbf
push eax
push esi
or ecx, edx
mov byte [esi + 0x179], cl
call fcn.00428510
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
movzx ecx, byte [esi + 0x17c]
shl edx, 2
and ecx, 0xfffffffb
or ecx, edx
mov byte [esi + 0x17c], cl
jmp 0x435ff2
mov eax, dword [ebp - 4]
and byte [eax + 0x179], 0xbf
and byte [eax + 0x17c], 0xfb
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call fcn.00428510
mov dword [ebp - 0x144], eax
add esp, 8
cmp dword [ebp - 0x144], 0xffffffff
je 0x43607c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x13c]
cmp eax, 3
jne 0x436030
mov eax, dword [ebp - 4]
mov dword [eax + 0x13c], 1
jmp 0x436035
cmp eax, 5
jne 0x436051
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 4
je 0x43607c
or byte [eax + 0x172], 2
mov dword [ebp - 0x1c], 3
jmp 0x43607c
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 0x170]
test dl, 4
je 0x43607c
mov eax, 0x229
test dl, 0x20
mov ebx, dword [ebp - 8]
jne 0x436072
mov eax, 0x33
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4f9460]
test ecx, ecx
jne 0x43609b
cmp dword [ebp - 0x144], 0xfffffffa
jne 0x4360cb
mov dword [ebp - 0x144], 1
jmp 0x4360e5
cmp dword [ebp - 0x144], 0xfffffffa
je 0x437eb7
cmp dword [ebp - 0x144], 1
je 0x4360e5
cmp dword [ebp - 0x168], 0
jne 0x4373a9
cmp dword [ebx + 0x84], 0
jne 0x435eab
cmp dword [ebp - 0x144], 0xfffffffc
je 0x437fe9
cmp dword [ebp - 0x144], 0
jl 0x437ea2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x13c], 1
jne 0x436123
cmp dword [ebp - 0x144], 0
je 0x43610c
cmp dword [ebp - 0x144], 2
je 0x43610c
cmp dword [ebp - 0x144], 1
jne 0x436123
mov edx, eax
shl ecx, 7
movzx eax, byte [edx + 0x178]
and eax, 0x7f
or eax, ecx
mov byte [edx + 0x178], al
cmp dword [ebp - 0x28], 0
je 0x4361df
cmp dword [ebx + 0xa4], 0
jne 0x4361b4
cmp dword [ebx + 0x68], 0
je 0x437486
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], 0
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x436176
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x436161
dec eax
push eax
lea edx, [ebp - 0x14c]
push edx
lea edi, [ebp - 0x148]
push edi
lea ecx, [ebp - 0x18]
push ecx
lea esi, [ebp - 0x1c]
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x140]
push ecx
call dword [ebx + 0x68]
mov dword [ebp - 0x168], eax
add esp, 0x24
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
jmp 0x4361ee
push dword [ebx + 0xa8]
call fcn.0046c3a0
mov dword [ebp - 0x168], eax
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe4], eax
mov edx, dword [ebx + 0xa8]
mov dword [ecx + 0x180], edx
jmp 0x4361ee
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0xffffffff
je 0x437bd6
cmp dword [ebx + 0xa4], 0
jne 0x436325
mov eax, dword [ebp - 4]
cmp dword [0x4f7f84], 0
mov dword [eax + 0x180], 0xffffffff
je 0x436325
movzx eax, byte [eax + 0x173]
test al, 8
jne 0x436325
cmp dword [ebp - 0x28], 0
je 0x4362ad
mov edx, dword [ebp - 4]
test byte [edx + 0x178], 2
jne 0x436256
test al, 4
je 0x43625d
movzx ecx, byte [edx + 0x172]
test ecx, 0x80
je 0x43625d
mov edx, 0x8000
jmp 0x43625f
xor edx, edx
mov ecx, dword [ebp - 0x24]
test ecx, 0xc0000000
je 0x43626f
or edx, 2
jmp 0x43627e
mov esi, edx
or esi, 1
test ecx, 0x40000000
je 0x43627e
mov edx, esi
cmp dword [ebx + 0x78], 1
je 0x436288
test al, 1
je 0x43628b
or edx, 8
push edx
push dword [ebp - 0x168]
call fcn.0046c530
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x180], eax
mov eax, dword [0x4f9460]
jmp 0x43632a
cmp dword [0x4f9460], 0
jne 0x43632e
cmp dword [ebp - 0x144], 1
je 0x436309
cmp dword [ebp - 0x144], 0
jne 0x4362e4
call fcn.00462ac0
push eax
call fcn.0046c860
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x436367
cmp dword [ebp - 0x144], 2
jne 0x436367
call fcn.00462ac0
add eax, 0x40
push eax
call fcn.0046c860
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x436367
call fcn.00462ac0
add eax, 0x20
push eax
call fcn.0046c860
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edx + 0x180], eax
jmp 0x436367
mov eax, dword [0x4f9460]
test eax, eax
je 0x436358
test dword [ebp - 0x144], 0xfffffffe
je 0x43634c
cmp dword [ebp - 0x144], 0xfffffffa
je 0x43634c
cmp dword [ebp - 0x144], 2
jne 0x436358
mov dword [ebp - 0x168], 2
jmp 0x436379
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x15e]
test eax, eax
jne 0x4364aa
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15c], 1
je 0x4374b7
movzx edx, byte [eax + 0x171]
and edx, 6
shr edx, 1
test edx, edx
je 0x436442
mov ecx, dword [eax + 0x100]
add ecx, 2
cmp ecx, 0x20
jae 0x436442
mov eax, 1
shl eax, cl
test eax, 0x103
je 0x436442
cmp edx, 1
je 0x436422
cmp edx, 2
jne 0x4363fc
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 2
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
inc dword [eax + 0xf8]
jmp 0x4364de
cmp edx, 3
jne case.default.0x43523b
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 3
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
jmp 0x4364de
mov eax, dword [ebp - 4]
mov byte [eax + 0x15e], 1
movzx ecx, byte [eax + 0x170]
movzx edx, byte [eax + 0x172]
inc dword [eax + 0xf8]
jmp 0x43649e
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x170]
test cl, 4
movzx edx, byte [eax + 0x172]
je 0x43647e
cmp dword [eax + 0x13c], 1
je 0x436491
test dl, 0x40
je 0x43646f
cmp dword [ebp - 0x168], 2
je 0x436491
mov byte [eax + 0x15e], 2
inc dword [eax + 0xf8]
jmp 0x4364de
test dl, 0x40
je 0x43646f
cmp dword [ebp - 0x168], 2
jne 0x43646f
test cl, 1
je 0x43646f
mov byte [eax + 0x15e], 1
inc dword [eax + 0xf8]
mov eax, dword [ebp - 4]
add dword [eax + 0xf8], 5
jmp 0x4364de
mov edx, dword [ebp - 4]
cmp eax, 3
movzx ecx, byte [edx + 0x170]
movzx edx, byte [edx + 0x172]
je 0x4364de
mov esi, dword [ebp - 4]
movsx edi, byte [esi + 0x15c]
cmp edi, 1
je 0x4364d5
inc dword [esi + 0xf8]
cmp eax, 1
je 0x437bc8
test cl, 1
je 0x4364fe
mov eax, dword [ebp - 4]
test byte [eax + 0x173], 8
je 0x4364fe
cmp byte [eax + 0x15d], 2
jne 0x4364fe
inc dword [eax + 0xf8]
test cl, 4
je 0x436522
mov eax, dword [ebp - 4]
and edx, 0x40
shr edx, 6
test byte [eax + 0x173], 8
je 0x436528
test edx, edx
je 0x436528
add dword [eax + 0xf8], 2
jmp 0x436528
and edx, 0x40
shr edx, 6
cmp dword [ebp - 0x168], 1
jne 0x436540
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x174]
or eax, 8
jmp 0x43654d
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x174]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
test edx, edx
mov byte [ecx + 0x174], al
je 0x43662f
push dword [ebp - 4]
call fcn.00416b70
add esp, 4
test eax, eax
jne 0x434ce9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
test eax, eax
je 0x43662f
cmp byte [eax + 0x1e], 0
je 0x43662f
mov esi, dword [eax + 0xc]
movzx eax, byte [esi + 0x175]
test al, 0x40
je 0x4365a4
cmp byte [esi + 0x15e], 1
je 0x4374f0
push esi
call fcn.00418c40
add esp, 4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
test edx, edx
je 0x4365bb
mov byte [edx + 0x1e], 0
test eax, eax
je 0x43661a
mov edx, dword [esi + 0x18]
test edx, edx
je 0x437527
test byte [edx + 0x44], 2
je 0x4365f5
mov dword [edx + 0x38], eax
mov edx, dword [esi + 0x18]
mov dword [edx + 0x3c], eax
mov edx, dword [esi + 0x64]
test edx, edx
je 0x4365e8
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x64], ecx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push eax
movzx edx, byte [esi + 0x174]
push eax
and edx, 7
push edx
push 0xffffffffffffffff
push esi
call fcn.00423970
add esp, 0x14
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
add dword [esi + 0x98], 1
adc dword [esi + 0x9c], 0
and byte [esi + 0x177], 0xfb
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
test al, 8
je 0x43665b
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
jne 0x43665b
mov eax, 0x33
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 0
je 0x436fc9
cmp dword [ebx + 0x58], 5
je 0x437a83
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x436fb8
cmp eax, 2
je 0x436fb8
cmp eax, 3
jne 0x4366bb
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov byte [edx + 0x173], al
mov dword [edx + 0x98], 1
mov dword [edx + 0x9c], 0
jmp 0x436fc9
cmp eax, 1
jne 0x43689b
cmp dword [ebx + 0x58], 5
je 0x437a59
mov eax, dword [ebp - 4]
test byte [eax + 0x174], 8
jne 0x4366e6
movzx eax, byte [eax + 0x173]
jmp 0x436fc9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, eax
mov eax, dword [esi + 0xe4]
call fcn.00438290
mov dword [ebp - 0x168], eax
add esp, 0x10
mov eax, 0xffffffff
mov ecx, edx
mov esi, dword [ebp - 0x168]
sub ecx, eax
sub esi, eax
or esi, ecx
je 0x437a13
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x168]
movzx eax, byte [esi + 0x173]
and byte [esi + 0x177], 0xfb
and eax, 0xfffffffe
mov dword [esi + 0x98], 0x80000000
mov dword [esi + 0x9c], 0xffffffff
mov byte [esi + 0x173], al
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], edx
cmp dword [esi + 0x13c], 5
je 0x436fc9
mov eax, esi
movsx edx, byte [eax + 0x15c]
lea eax, [edx - 1]
cmp eax, 7
ja case.default.0x436789
jmp dword [eax*4 + 0x4d5344]
cmp edx, 7
je 0x43771f
cmp edx, 5
je 0x4376ec
mov dword [ebp - 0x164], 3
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.004382f0
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov esi, dword [ebp - 0x164]
neg esi
mov dword [esp + 4], esi
mov dword [esp + 8], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xe4]
call fcn.00438290
mov dword [ebp - 0x160], eax
add esp, 0x10
mov eax, 0xffffffff
mov ecx, edx
mov edi, dword [ebp - 0x160]
sub ecx, eax
sub edi, eax
or edi, ecx
je 0x436910
mov ecx, dword [ebp - 0x15c]
sub ecx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x168]
sbb eax, edx
neg ecx
neg eax
xor edx, edx
add ecx, dword [ebp - 0x164]
add eax, edx
or ecx, eax
jne 0x436910
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x436852
cmp dword [ebx + 0x68], 0
je 0x437541
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x164]
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x4376cb
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x154]
jne 0x4368aa
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x436fc9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x436fc9
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.004382f0
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov dword [esp + 4], 0xfffffffc
mov dword [esp + 8], 0xffffffff
mov ecx, esi
mov eax, dword [ecx + 0xe4]
call fcn.00438290
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x4369e4
mov esi, dword [ebp - 0x164]
mov ecx, 4
sub esi, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
sub esi, ecx
or esi, eax
je 0x436a4a
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x436fc9
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x436a60
cmp dword [ebx + 0x68], 0
je 0x43773d
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push 4
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x4376cb
cmp dword [ebp - 0x154], 4
jne 0x436abe
movzx eax, byte [ebp - 0x15f]
shl eax, 8
movzx edx, byte [ebp - 0x160]
or edx, eax
cmp edx, 1
je 0x4377e2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x436fc9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x436fc9
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.004382f0
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
add esp, 0xfffffff4
mov edx, 1
mov dword [esp + 4], 0xfffffff7
mov dword [esp + 8], 0xffffffff
mov ecx, esi
mov eax, dword [ecx + 0xe4]
call fcn.00438290
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x436cb3
mov ecx, dword [ebp - 0x164]
sub ecx, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
mov edx, 9
sub ecx, edx
or ecx, eax
jne 0x436cb3
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x436bb0
cmp dword [ebx + 0x68], 0
je 0x437843
push 0
mov ecx, eax
lea eax, [ebp - 0x154]
push eax
push 9
lea edx, [ebp - 0x160]
push edx
push dword [ecx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x4376cb
cmp dword [ebp - 0x154], 9
jne 0x436c4d
mov eax, dword [ebp - 4]
movzx esi, byte [ebp - 0x15b]
movzx edx, byte [ebp - 0x15a]
movzx ecx, byte [ebp - 0x159]
movzx edi, byte [ebp - 0x158]
test byte [eax + 0x175], 0x20
je 0x436c1c
shl ecx, 8
shl edx, 0x10
or edi, ecx
shl esi, 0x18
or edi, edx
or edi, esi
jmp 0x436c2b
shl edx, 8
shl ecx, 0x10
or esi, edx
shl edi, 0x18
or esi, ecx
or edi, esi
cmp edi, 1
jne 0x4366da
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x436fc9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x436fc9
mov edx, esi
push eax
mov eax, dword [edx + 0xe4]
call fcn.004382f0
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x168], edx
mov edi, esi
xor ecx, ecx
add esp, 0xfffffff4
xor esi, esi
mov edx, 1
sub esi, dword [edi + 0xf8]
mov eax, dword [edi + 0xe4]
mov dword [esp + 4], esi
sbb ecx, 0
mov dword [esp + 8], ecx
call fcn.00438290
add esp, 0x10
mov edi, eax
mov ecx, 0xffffffff
mov esi, edx
sub edi, ecx
sub esi, ecx
or edi, esi
je 0x436d98
mov ecx, dword [ebp - 0x164]
sub ecx, eax
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x168]
sbb eax, edx
neg ecx
neg eax
xor edx, edx
mov esi, dword [esi + 0xf8]
add ecx, esi
add eax, edx
or ecx, eax
je 0x436dfe
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov edx, esi
movzx eax, byte [edx + 0x173]
and eax, 0xfffffffe
and byte [edx + 0x177], 0xfb
mov dword [edx + 0x98], 0x80000000
mov dword [edx + 0x9c], 0xffffffff
mov byte [edx + 0x173], al
jmp 0x436fc9
lea eax, [ebp - 0x164]
push eax
push 0
push esi
call fcn.004172d0
add esp, 0xc
test eax, eax
jne 0x434ce9
mov eax, dword [ebp - 4]
test byte [eax + 0x176], 1
je 0x436e2e
cmp dword [ebx + 0x68], 0
je 0x437920
mov edx, eax
lea eax, [ebp - 0x154]
push 0
push eax
push dword [edx + 0xf8]
push dword [ebp - 0x164]
push dword [edx + 0xe4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x4376cb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
cmp eax, dword [ebp - 0x154]
jne 0x436f1e
mov edx, dword [ebp - 4]
movzx ecx, byte [edx + 0x172]
test ecx, 0x80
jne 0x436e93
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
push 0xe2c
push str.for_nt_open_proc.c
push 2
push 8
call fcn.0040ab30
add esp, 0x10
mov eax, esi
movzx eax, byte [eax + 0x173]
jmp 0x436fc9
mov eax, dword [ebp - 4]
or byte [eax + 0x177], 4
movzx eax, byte [eax + 0x173]
test al, 1
je 0x43707c
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
je 0x4370a9
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov eax, esi
cmp dword [eax + 0x13c], 7
jne 0x437054
add esp, 0xfffffff0
mov ecx, 0xffffffff
mov edx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov eax, dword [esi + 0xe4]
call fcn.00438290
add esp, 0x10
mov ecx, 0xffffffff
sub eax, ecx
sub edx, ecx
or eax, edx
je 0x43766a
mov eax, esi
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x177], 0xfb
movzx eax, byte [eax + 0x173]
test al, 1
jne 0x4370a9
mov edx, dword [ebp - 4]
test byte [edx + 0x174], 8
je 0x4370a9
test byte [edx + 0x170], 4
je 0x437095
test al, 8
jne 0x4370a9
test byte [edx + 0x172], 0x40
jne 0x4370a2
test al, 4
jne 0x4370a9
or byte [edx + 0x175], 8
test eax, 0x80
jne 0x4370c2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf8]
mov word [edx + 0x158], ax
jmp 0x4370f9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 1
je 0x437b8f
test byte [eax + 0x170], 4
je 0x4370eb
mov edx, eax
mov eax, 0x4f
mov word [edx + 0x158], ax
jmp 0x4370f9
mov edx, eax
mov eax, 0x50
mov word [edx + 0x158], ax
mov edx, dword [ebx + 0x14]
test edx, edx
jle 0x437b50
mov ecx, dword [ebp - 4]
mov esi, dword [ebx + 0x10]
movzx ecx, byte [ecx + 0x170]
and ecx, 4
shr ecx, 2
test ecx, ecx
je 0x43712a
cmp esi, 0x7ffffe00
jle 0x43712a
mov esi, 0x7ffffe00
jmp 0x437132
test esi, esi
jle 0x437b04
add esi, 0x1ff
and esi, 0xfffffe00
mov dword [ebx + 0x10], esi
mov ecx, dword [ebp - 4]
test byte [ecx + 0x173], 8
je 0x4371aa
mov edx, ecx
test byte [edx + 0x170], 4
je 0x43716a
movzx edx, byte [ecx + 0x179]
and edx, 0xffffffbf
mov byte [ecx + 0x179], dl
jmp 0x437171
movzx edx, byte [edx + 0x179]
test dl, 0x40
mov ecx, dword [ecx + 0xf8]
je 0x4371a4
cmp esi, ecx
jae 0x437184
mov eax, ecx
mov esi, ecx
jmp 0x4371be
imul edx, esi
mov ecx, dword [ecx + 0xf8]
lea eax, [ecx + 4]
cmp eax, edx
ja 0x4371bc
mov eax, edx
mov esi, eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x172]
test edx, 0x80
je 0x4371ea
mov edi, dword [ebp - 4]
cmp byte [edi + 0x15c], 3
je 0x437acd
mov eax, dword [ebp - 4]
mov dword [eax + 0xec], esi
mov ecx, dword [ebp - 4]
test dl, 0x40
mov eax, dword [ebx + 0x10]
mov dword [ecx + 0x140], eax
je 0x4372ad
mov eax, 0x234
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23f
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x4373da
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x4373fd
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x437420
mov eax, 0x30
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x23c
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x437443
mov eax, 0x30
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x58], 0
jne 0x434c97
mov dword [ebx + 0x58], 3
jmp 0x434c97
push esi
call fcn.0046bed0
add esp, 4
cmp eax, ebx
jne 0x4354d4
mov edi, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x160]
or dword [ebp - 0x18], 0x8000000
jmp 0x4354fc
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
jmp 0x4361ee
movzx ecx, byte [eax + 0x170]
test cl, 4
movzx edx, byte [eax + 0x172]
je 0x4374e4
test byte [eax + 0x173], 8
je 0x4374e4
test dl, 0x40
je 0x4374e4
mov byte [eax + 0x15e], 2
jmp 0x4364de
mov byte [eax + 0x15e], 3
jmp 0x4364de
mov ecx, dword [esi + 0x38]
movsx edx, byte [ecx + 5]
cmp edx, 0x20
je 0x43751a
cmp edx, 0x2b
jne 0x43750c
mov byte [ecx + 5], 0
movzx eax, byte [esi + 0x175]
and eax, 0xffffffbf
mov byte [esi + 0x175], al
jmp 0x4365a4
mov byte [ecx + 5], 0x24
movzx eax, byte [esi + 0x175]
jmp 0x43750c
push esi
push eax
push eax
push 1
call fcn.00408a80
add esp, 0x10
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x4375e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x1e
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, esi
movsx eax, byte [eax + 0x15e]
cmp eax, 3
je 0x437710
xor edx, edx
cmp eax, 2
setne dl
add edx, 2
mov dword [ebp - 0x164], edx
jmp 0x4367ac
mov dword [ebp - 0x164], 1
jmp 0x4367ac
mov eax, esi
cmp byte [eax + 0x15e], 3
jne 0x4367a2
mov dword [ebp - 0x164], 2
jmp 0x4367ac
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x4376cb
add esp, 0xfffffff0
mov edx, 1
mov dword [esp + 4], 0xfffffffc
mov dword [esp + 8], 0xffffffff
call fcn.00438290
add esp, 0x10
push 0
lea eax, [ebp - 0x154]
push eax
push 4
lea edx, [ebp - 0x160]
push edx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.00438290
add esp, 0x10
jmp 0x436a82
cmp byte [ebp - 0x15e], 0x1a
je 0x4377fa
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4376cb
add esp, 0xfffffff0
mov eax, edi
mov edx, 2
mov dword [esp + 4], 0xfffffff7
mov dword [esp + 8], 0xffffffff
call fcn.00438290
add esp, 0x10
push 0
lea eax, [ebp - 0x154]
push eax
push 9
lea edx, [ebp - 0x160]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.00438290
add esp, 0x10
jmp 0x436bd2
xor eax, eax
lea edx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
je 0x4376cb
mov ecx, dword [ebp - 4]
xor esi, esi
add esp, 0xfffffff0
xor edi, edi
mov edx, 2
sub edi, dword [ecx + 0xf8]
mov dword [esp + 4], edi
sbb esi, 0
mov dword [esp + 8], esi
call fcn.00438290
add esp, 0x10
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
push 0
push eax
push dword [edx + 0xf8]
push dword [ebp - 0x164]
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xfffffff0
xor ecx, ecx
mov edx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0xe4]
call fcn.00438290
add esp, 0x10
jmp 0x436e53
mov edx, dword [ebp - 4]
push eax
mov eax, dword [edx + 0xe4]
call fcn.004382f0
add esp, 4
or eax, edx
jne 0x437a38
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x173]
jmp 0x436fc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x78
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x80000000
mov dword [eax + 0x9c], 0xffffffff
and byte [eax + 0x177], 0xfb
movzx eax, byte [eax + 0x173]
jmp 0x436fc9
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x437aa5
mov eax, dword [ebp - 4]
and byte [eax + 0x175], 0xf7
jmp 0x43666f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0xe8], eax
mov eax, 0x26
mov edi, dword [ebp - 0x10]
and byte [edx + 0x175], 0xf7
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x437b11
mov dword [ebx + 0x10], 0x400
jmp 0x437b2c
mov esi, dword [0x4f6f6c]
cmp esi, 0xfffffffe
je 0x437b3e
test esi, esi
je 0x437b25
cmp esi, 0xffffffff
jne 0x437b36
mov dword [ebx + 0x10], 0x20000
mov esi, 0x2000
jmp 0x437141
mov dword [ebx + 0x10], esi
jmp 0x437141
mov eax, 0x6a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4f6f70]
cmp edx, 0xfffffffe
je 0x437b7d
test edx, edx
je 0x437b64
cmp edx, 0xffffffff
jne 0x437b75
mov dword [ebx + 0x14], 1
mov edx, 1
jmp 0x437104
mov dword [ebx + 0x14], edx
jmp 0x437104
mov eax, 0x6b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
test byte [eax + 0x170], 4
je 0x437b9f
mov edx, 0x50
jmp 0x437ba4
mov edx, 0x51
cmp byte [eax + 0x15c], 1
je 0x437bbc
add edx, 4
mov word [eax + 0x158], dx
jmp 0x4370f9
mov word [eax + 0x158], dx
jmp 0x4370f9
cmp edi, 1
jne 0x43649e
jmp 0x4364de
cmp dword [ebx + 0xa4], 0
je 0x437cc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.0046c950
mov dword [eax], ebx
cmp ebx, 2
jge 0x437c97
cmp ebx, 0x7b
je 0x4381dc
cmp ebx, 0xa1
je 0x4381dc
cmp ebx, 0xce
je 0x4381dc
cmp ebx, 0xb7
je 0x438247
cmp ebx, 0x50
je 0x438247
cmp ebx, 0x13
je 0x4381ee
cmp ebx, 5
je 0x4381ee
cmp ebx, 0x14
je 0x437c85
cmp ebx, 0xf
je 0x437c85
cmp ebx, 4
jne 0x437c6a
mov edx, dword [ebp - 4]
mov eax, 0x25b
test byte [edx + 0x170], 0x20
jne 0x437c78
mov eax, 0x1e
jmp 0x437c78
mov eax, dword [ebp - 4]
mov dword [eax + 0xe8], ebx
mov eax, 0x1e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x2a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
cmp ebx, 3
jg 0x437bfb
mov edx, dword [ebp - 4]
mov eax, 0x25a
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x437cbf
mov eax, 0x1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x437cdc
test byte [eax + 0x171], 0x40
je 0x437be3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
cmp eax, 0x13
movzx edx, byte [edx + 0x170]
je 0x437cff
cmp eax, 5
je 0x437cff
test dl, 4
je 0x437d80
test dl, 1
jne 0x437d80
cmp dword [ebp - 0x158], 0
je 0x437d80
mov edx, dword [ebp - 4]
test byte [edx + 0x171], 0x40
jne 0x437d80
test byte [edx + 0x176], 1
jne 0x437d80
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x24]
and edx, 0x3fffffff
push dword [ebp - 0x20]
or edx, 0x80000000
push edx
mov dword [ebp - 0x24], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x168]
cmp edx, 0xffffffff
mov dword [eax + 0xe4], edx
je 0x437e50
or byte [eax + 0x171], 0x40
or byte [eax + 0x177], 0x10
jmp 0x437e3e
cmp eax, 0x20
jne 0x437e2f
cmp dword [ebp - 0x164], 0
je 0x437e2f
cmp dword [ebp - 0x158], 0
jne 0x437dbc
mov eax, dword [ebp - 4]
test byte [eax + 0x171], 0x40
jne 0x437dbc
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
jmp 0x437e3e
xor eax, eax
lea esi, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
and ecx, 0x3fffffff
or edx, 2
or ecx, 0x80000000
push edx
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x168]
cmp edx, 0xffffffff
mov dword [eax + 0xe4], edx
je 0x437be3
or byte [eax + 0x171], 0x40
or byte [eax + 0x177], 0x10
or byte [eax + 0x172], 1
or byte [eax + 0x178], 4
jmp 0x4361fb
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe4]
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0xffffffff
je 0x437be3
jmp 0x4361fb
test byte [eax + 0x170], 4
je 0x437d6d
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x24]
and edx, 0x7fffffff
push dword [ebp - 0x20]
or edx, 0x40000000
push edx
mov dword [ebp - 0x24], edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
or byte [edx + 0x176], 1
jmp 0x437e3e
test ecx, ecx
je 0x436123
cmp dword [ebp - 0x144], 0xfffffffa
jne 0x436123
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], 0
or byte [eax + 0x178], 0x80
cmp dword [ebx + 0x84], 0
je 0x437ee3
cmp dword [ebx + 0x88], 0
jne 0x437ee3
and byte [eax + 0x179], 0xfe
jmp 0x437eea
or byte [eax + 0x179], 1
mov eax, dword [ebp - 0x168]
test eax, eax
lea edx, [ebp - 0x150]
jne 0x437eff
mov eax, 0x100
push edx
push 0
mov dword [ebp - 0x168], eax
lea ecx, [eax + 1]
push ecx
call fcn.004172d0
add esp, 0xc
test eax, eax
jne 0x434ce9
cmp dword [ebx + 0x98], 0
jne 0x437f43
mov eax, dword [ebp - 4]
push dword [eax + 0x100]
push str.Unit__i
push dword [ebp - 0x150]
call fcn.00461cc0
add esp, 0xc
jmp 0x437f6d
push dword [ebp - 0x168]
push dword [ebx + 0x94]
push dword [ebp - 0x150]
call fcn.004619d0
add esp, 0xc
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x168]
mov byte [eax + edx], 0
push dword [ebp - 0x150]
call fcn.004b8d40
add esp, 4
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [edx + 0xe4], eax
je 0x43826a
test byte [edx + 0x179], 1
je 0x437fc6
push eax
call fcn.004b8e00
add esp, 4
mov eax, dword [ebp - 4]
push dword [eax + 0xe4]
call fcn.004b8d80
add esp, 4
test eax, eax
jne 0x437fc6
mov eax, 0x28e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x150]
call fcn.00417390
add esp, 4
test eax, eax
je 0x436123
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax + 0x15a]
cmp edx, 4
jge 0x438037
push dword [eax + 0x60]
call fcn.00417390
add esp, 4
test eax, eax
je 0x438014
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x154]
push 0
push 5
call fcn.004172d0
add esp, 0xc
test eax, eax
je 0x438037
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x13c], 0
mov dword [ebp - 0x140], 0x314d4f43
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x438054
mov edx, dword [ebp - 4]
mov eax, 4
mov ecx, dword [0x4f9460]
mov word [edx + 0x15a], ax
jmp 0x437ea2
test eax, eax
jne 0x438094
push str.USER
lea eax, [ebp - 0x140]
push eax
call fcn.00464b10
add esp, 8
test eax, eax
je 0x4380a3
mov dword [ebp - 0x168], 0
jmp 0x435ede
mov dword [ebp - 0x140], 0x4e4f43
mov eax, esi
lea edi, [ebp - 0x140]
mov esi, dword [eax + 0x60]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4380b8
mov edx, dword [ebp - 4]
mov eax, 3
mov dword [ebp - 0x168], 0
mov word [edx + 0x15a], ax
jmp 0x435ede
mov eax, dword [ebp - 4]
test byte [eax + 0x170], 1
je 0x4356d1
mov edx, eax
movzx eax, byte [edx + 0x173]
and eax, 0xffffffdf
mov byte [edx + 0x173], al
jmp 0x4356e4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15e], 3
je 0x435646
mov eax, 0x2e
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x173]
test dl, 0x10
je 0x4353e1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x15d], 3
mov ecx, 3
jmp 0x4353f0
mov edx, ecx
test byte [edx + 0x170], 4
je 0x438179
test byte [edx + 0x173], 8
je 0x438179
test byte [edx + 0x172], 0x40
je 0x438179
mov byte [edx + 0x15e], 2
jmp 0x43532d
movsx edx, al
cmp edx, 4
je 0x4381be
cmp edx, 1
je 0x4381be
movzx esi, byte [ecx + 0x172]
test esi, 0x80
jne 0x4381be
movzx ecx, byte [ecx + 0x178]
test cl, 1
jne 0x4381be
test cl, 2
jne 0x4381be
test esi, 0x40
je 0x43532d
add edx, 0xfffffffb
cmp edx, 3
ja 0x43532d
mov edx, dword [ebp - 4]
mov byte [edx + 0x15e], 3
jmp 0x43532d
mov dword [ebp - 0x158], 1
jmp 0x434e8b
mov eax, 0x2b
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x258
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x43820d
mov eax, 9
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x63
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov eax, 0x25
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0x259
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x438266
mov eax, 0xa
mov esp, ebp
pop ebp
ret
mov eax, 0x258
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test byte [edx + 0x170], 0x20
mov edi, dword [ebp - 0x10]
jne 0x438286
mov eax, 9
mov esp, ebp
pop ebp
ret