Function at 0x4262d0
Capabilities:
Check os version
Create process on windows
Enumerate files on windows
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d28da
mov eax, dword fs:[0]
push eax
mov eax, 0x1ae4
call fcn.0055b970
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x38], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a94], ecx
mov dword [ebp - 0x1a90], 0
mov ecx, dword [ebp + 0xc]
call fcn.00435950
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004553f0
push eax
push str.Searching_for_white_listed_repair_file_for:_r_n_s_r_n
call fcn.0054eca8
add esp, 8
mov eax, dword [0x63e870]
push eax
lea ecx, [ebp - 0x29c]
call fcn.004b3550
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2b4]
push edx
call fcn.00413220
add esp, 8
mov byte [ebp - 4], 2
push 0x104
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.dllcache
lea ecx, [ebp - 0x18c8]
call fcn.004b3550
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x18d4]
call fcn.004b3550
mov byte [ebp - 4], 4
lea edx, [ebp - 0x18c8]
push edx
lea eax, [ebp - 0x18d4]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18d4]
call fcn.004b3860
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x18c8]
call fcn.004b3860
push 0x104
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.i386
lea ecx, [ebp - 0x18e0]
call fcn.004b3550
mov byte [ebp - 4], 8
push str.ServicePackFiles
lea ecx, [ebp - 0x18ec]
call fcn.004b3550
mov byte [ebp - 4], 9
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x18f8]
call fcn.004b3550
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x18ec]
push ecx
lea edx, [ebp - 0x18f8]
push edx
lea eax, [ebp - 0x1904]
push eax
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x1a98], eax
mov ecx, dword [ebp - 0x1a98]
mov dword [ebp - 0x1a9c], ecx
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x18e0]
push edx
mov eax, dword [ebp - 0x1a9c]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1904]
call fcn.004b3860
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x18f8]
call fcn.004b3860
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x18ec]
call fcn.004b3860
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x18e0]
call fcn.004b3860
push str.winsxs
lea ecx, [ebp - 0x1910]
call fcn.004b3550
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x244]
push edx
lea ecx, [ebp - 0x191c]
call fcn.004b3550
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x1910]
push eax
lea ecx, [ebp - 0x191c]
push ecx
lea edx, [ebp - 0x270]
push edx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x191c]
call fcn.004b3860
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1910]
call fcn.004b3860
push str.Backup
lea ecx, [ebp - 0x1928]
call fcn.004b3550
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1928]
push eax
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1928]
call fcn.004b3860
push 0x104
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.FileRepository
lea ecx, [ebp - 0x1934]
call fcn.004b3550
mov byte [ebp - 4], 0x19
push str.DriverStore
lea ecx, [ebp - 0x1940]
call fcn.004b3550
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x194c]
call fcn.004b3550
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x1940]
push edx
lea eax, [ebp - 0x194c]
push eax
lea ecx, [ebp - 0x1958]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x1aa0], eax
mov edx, dword [ebp - 0x1aa0]
mov dword [ebp - 0x1aa4], edx
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x1934]
push eax
mov ecx, dword [ebp - 0x1aa4]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1958]
call fcn.004b3860
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x194c]
call fcn.004b3860
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1940]
call fcn.004b3860
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1934]
call fcn.004b3860
lea ecx, [ebp - 0x264]
call fcn.00432a70
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x290]
call fcn.0042fe80
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x2b8], 0
jmp 0x426663
mov eax, dword [ebp - 0x2b8]
add eax, 1
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 4
jg 0x426d4f
lea ecx, [ebp - 0x29c]
call fcn.00404b70
test eax, eax
jle 0x426689
jmp 0x426d4f
cmp dword [ebp - 0x2b8], 0
jne 0x42674e
lea ecx, [ebp - 0x2b4]
push ecx
lea edx, [ebp - 0x2a8]
push edx
lea eax, [ebp - 0x1964]
push eax
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x1aa8], eax
mov ecx, dword [ebp - 0x1aa8]
mov dword [ebp - 0x1aac], ecx
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x1aac]
push edx
lea eax, [ebp - 0x1970]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042feb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x1964]
call fcn.004b3860
lea ecx, [ebp - 0x2b4]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x197c]
push eax
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x1ab0], eax
mov ecx, dword [ebp - 0x1ab0]
mov dword [ebp - 0x1ab4], ecx
mov byte [ebp - 4], 0x25
mov edx, dword [ebp - 0x1ab4]
push edx
lea eax, [ebp - 0x1988]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042feb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x197c]
call fcn.004b3860
jmp 0x426a5c
cmp dword [ebp - 0x2b8], 1
jne 0x4267ae
lea ecx, [ebp - 0x290]
call fcn.0040f520
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x1a94]
call fcn.0041e330
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0
je 0x4267a9
push 0
lea edx, [ebp - 0x290]
push edx
push 1
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x2e4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [eax + 4]
call edx
jmp 0x426a5c
cmp dword [ebp - 0x2b8], 2
jne 0x426814
lea ecx, [ebp - 0x290]
call fcn.0040f520
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0x1a94]
call fcn.0041e330
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
je 0x42680f
push 0
lea ecx, [ebp - 0x290]
push ecx
push 1
lea edx, [ebp - 0x2b4]
push edx
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0x2e8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2e8]
mov eax, dword [edx + 4]
call eax
jmp 0x426a5c
cmp dword [ebp - 0x2b8], 3
jne 0x426968
lea ecx, [ebp - 0x290]
call fcn.0040f520
lea ecx, [ebp - 0x2b4]
call fcn.004553f0
push eax
push 0x5fe720
lea ecx, [ebp - 0x1994]
push ecx
call fcn.004b4d50
add esp, 0xc
mov dword [ebp - 0x1ab8], eax
mov edx, dword [ebp - 0x1ab8]
mov dword [ebp - 0x1abc], edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x1abc]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2f4]
push edx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1994]
call fcn.004b3860
lea eax, [ebp - 0x54c]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xffffffff
je 0x426954
mov ecx, dword [ebp - 0x54c]
and ecx, 0x10
je 0x4268c4
jmp 0x42692b
lea edx, [ebp - 0x520]
push edx
lea ecx, [ebp - 0x19a0]
call fcn.004b3550
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x19a0]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x558]
push edx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x19a0]
call fcn.004b3860
lea eax, [ebp - 0x558]
push eax
lea ecx, [ebp - 0x19ac]
push ecx
lea ecx, [ebp - 0x290]
call fcn.0042feb0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x558]
call fcn.004b3860
lea edx, [ebp - 0x54c]
push edx
mov eax, dword [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4268b7
mov ecx, dword [ebp - 0x2f8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2f4]
call fcn.004b3860
jmp 0x426a5c
cmp dword [ebp - 0x2b8], 4
jne 0x426a5c
lea ecx, [ebp - 0x290]
call fcn.0040f520
push 0x104
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [ebp - 0x23e], ax
lea ecx, [ebp - 0x2b4]
call fcn.00404b70
sub eax, 1
push eax
push 0
lea ecx, [ebp - 0x19b8]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.004b6620
mov dword [ebp - 0x1ac0], eax
mov edx, dword [ebp - 0x1ac0]
mov dword [ebp - 0x1ac4], edx
mov byte [ebp - 4], 0x2c
push 0x5fe72c
mov eax, dword [ebp - 0x1ac4]
push eax
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x564]
push edx
call fcn.004b4380
add esp, 0x10
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x19b8]
call fcn.004b3860
lea eax, [ebp - 0x564]
push eax
call fcn.004bc0e0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x426a4d
lea ecx, [ebp - 0x564]
call fcn.004553f0
push eax
push str._s_r_n
call fcn.0054eca8
add esp, 8
lea edx, [ebp - 0x564]
push edx
lea eax, [ebp - 0x19c4]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042feb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x564]
call fcn.004b3860
lea ecx, [ebp - 0x2d8]
call fcn.0042fc80
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x56c]
call fcn.0047f810
lea ecx, [ebp - 0x19cc]
push ecx
lea ecx, [ebp - 0x290]
call fcn.00435230
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x56c], edx
mov dword [ebp - 0x568], eax
jmp 0x426aa6
lea ecx, [ebp - 0x56c]
call fcn.0040c980
lea ecx, [ebp - 0x19d4]
push ecx
lea ecx, [ebp - 0x290]
call fcn.0040c9a0
push eax
lea ecx, [ebp - 0x56c]
call fcn.0047f720
movzx edx, al
test edx, edx
je 0x426c62
lea ecx, [ebp - 0x56c]
call fcn.0047f6d0
push eax
lea ecx, [ebp - 0x57c]
call fcn.004b34d0
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x57c]
push eax
mov ecx, dword [ebp - 0x1a94]
call fcn.0041e330
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
je 0x426c4e
lea ecx, [ebp - 0x59c]
call fcn.00407bf0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x57d]
push ecx
lea edx, [ebp - 0x59c]
push edx
lea eax, [ebp - 0x5a4]
push eax
lea ecx, [ebp - 0x57c]
push ecx
mov edx, dword [ebp - 0x570]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x570]
mov edx, dword [eax + 0x10]
call edx
movzx eax, al
test eax, eax
je 0x426c3f
mov ecx, dword [ebp + 0xc]
call fcn.004b7130
xor ecx, ecx
mov dword [ebp - 0x1acc], eax
mov dword [ebp - 0x1ac8], ecx
mov edx, dword [ebp - 0x5a4]
cmp edx, dword [ebp - 0x1acc]
jne 0x426ba3
mov eax, dword [ebp - 0x5a0]
cmp eax, dword [ebp - 0x1ac8]
jne 0x426ba3
lea ecx, [ebp - 0x57c]
push ecx
lea edx, [ebp - 0x19e0]
push edx
lea ecx, [ebp - 0x2d8]
call fcn.0042fcb0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x1a00], esp
lea eax, [ebp - 0x57c]
push eax
call fcn.004b34d0
mov dword [ebp - 0x1ad0], eax
lea ecx, [ebp - 0x59c]
call fcn.004b2050
push edx
push eax
lea ecx, [ebp - 0x1a1c]
push ecx
call fcn.00439220
add esp, 0x18
mov dword [ebp - 0x1ad4], eax
mov edx, dword [ebp - 0x1ad4]
mov dword [ebp - 0x1ad8], edx
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x1ad8]
push eax
lea ecx, [ebp - 0x19fc]
call fcn.00438e90
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x19fc]
push ecx
lea edx, [ebp - 0x1a28]
push edx
lea ecx, [ebp - 0x264]
call fcn.00432b00
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x19fc]
call fcn.004a3de0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1a1c]
call fcn.004a3de0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x59c]
call fcn.00407c30
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x57c]
call fcn.004b3860
jmp 0x426a9b
lea ecx, [ebp - 0x2e0]
call fcn.0047f810
lea eax, [ebp - 0x1a30]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00435230
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2dc], edx
jmp 0x426c9d
lea ecx, [ebp - 0x2e0]
call fcn.0040c980
lea eax, [ebp - 0x1a38]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.0040c9a0
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0047f720
movzx ecx, al
test ecx, ecx
je 0x426d3b
mov byte [ebp - 0x5a5], 0
lea edx, [ebp - 0x5a5]
push edx
lea ecx, [ebp - 0x2e0]
call fcn.0047f6d0
push eax
mov ecx, dword [ebp - 0x1a94]
call fcn.00427420
movzx eax, al
test eax, eax
jne 0x426cf0
jmp 0x426d36
movzx ecx, byte [ebp - 0x5a5]
test ecx, ecx
je 0x426d36
lea ecx, [ebp - 0x2e0]
call fcn.0047f6d0
push eax
lea ecx, [ebp - 0x29c]
call fcn.004b3890
lea ecx, [ebp - 0x29c]
call fcn.004553f0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004b7130
push eax
push 0x5fe730
call fcn.0054eca8
add esp, 0xc
jmp 0x426d3b
jmp 0x426c92
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2d8]
call fcn.00409100
jmp 0x426654
lea ecx, [ebp - 0x29c]
call fcn.00404b70
test eax, eax
jne 0x426e58
lea ecx, [ebp - 0x5b0]
call fcn.00432cd0
lea edx, [ebp - 0x1a48]
push edx
lea ecx, [ebp - 0x264]
call fcn.00432aa0
push eax
lea ecx, [ebp - 0x1a40]
call fcn.00439290
mov eax, dword [ebp - 0x1a40]
mov dword [ebp - 0x5b0], eax
mov ecx, dword [ebp - 0x1a3c]
mov dword [ebp - 0x5ac], ecx
jmp 0x426db9
push 0
lea edx, [ebp - 0x1a50]
push edx
lea ecx, [ebp - 0x5b0]
call fcn.00432cf0
lea eax, [ebp - 0x1a58]
push eax
lea ecx, [ebp - 0x264]
call fcn.00432ad0
push eax
lea ecx, [ebp - 0x5b0]
push ecx
call fcn.004392d0
add esp, 8
movzx edx, al
test edx, edx
je 0x426e58
mov byte [ebp - 0x5b1], 0
lea eax, [ebp - 0x5b1]
push eax
lea ecx, [ebp - 0x5b0]
call fcn.00432d30
add eax, 8
push eax
mov ecx, dword [ebp - 0x1a94]
call fcn.00427420
movzx ecx, al
test ecx, ecx
jne 0x426e13
jmp 0x426e53
movzx edx, byte [ebp - 0x5b1]
test edx, edx
je 0x426e53
lea ecx, [ebp - 0x5b0]
call fcn.00432d30
add eax, 8
push eax
lea ecx, [ebp - 0x29c]
call fcn.004b3890
lea ecx, [ebp - 0x29c]
call fcn.004553f0
push eax
push str.__Recent:__s_r_n
call fcn.0054eca8
add esp, 8
jmp 0x426e58
jmp 0x426da5
lea ecx, [ebp - 0x29c]
call fcn.00404b70
test eax, eax
jne 0x426e99
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1a94]
call fcn.004275c0
movzx ecx, al
test ecx, ecx
je 0x426e99
push str._tAPI_serves_white__r_n
call fcn.0054eca8
add esp, 4
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x29c]
call fcn.004b3890
lea ecx, [ebp - 0x29c]
call fcn.00404b70
test eax, eax
jne 0x427366
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x427366
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x5b8], eax
mov ecx, dword [ebp - 0x5b8]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
movzx eax, dl
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 5
jne 0x427366
mov ecx, dword [0x5fd484]
mov dword [ebp - 0x5c8], ecx
mov edx, dword [0x5fd488]
mov dword [ebp - 0x5c4], edx
xor eax, eax
mov word [ebp - 0x5cc], ax
lea ecx, [ebp - 0xdcc]
push ecx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x5c0], 0
mov edx, dword [ebp - 0x5c0]
movzx eax, word [ebp + edx*2 - 0xdcc]
test eax, eax
je 0x426fb3
mov ecx, dword [ebp - 0x5c0]
mov dx, word [ebp + ecx*2 - 0xdcc]
mov word [ebp - 0x5c8], dx
lea eax, [ebp - 0x5c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x426f7c
mov ecx, dword [ebp - 0x5c0]
mov dx, word [ebp + ecx*2 - 0xdcc]
mov word [ebp - 0x5cc], dx
jmp 0x426fb3
mov eax, dword [ebp - 0x5c0]
add eax, 1
mov dword [ebp - 0x5c0], eax
mov ecx, dword [ebp - 0x5c0]
movzx edx, word [ebp + ecx*2 - 0xdcc]
test edx, edx
je 0x426f9f
jmp 0x426f7c
mov eax, dword [ebp - 0x5c0]
add eax, 1
mov dword [ebp - 0x5c0], eax
jmp 0x426f2c
movzx ecx, word [ebp - 0x5cc]
test ecx, ecx
je 0x427366
push str.Labels_RepairXpFile
lea ecx, [ebp - 0x1a64]
call fcn.004b3550
mov byte [ebp - 4], 0x34
lea edx, [ebp - 0x1a64]
push edx
lea eax, [ebp - 0xdd8]
push eax
mov ecx, dword [ebp - 0x1a94]
call fcn.0041b330
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x1a64]
call fcn.004b3860
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xde4]
call fcn.004b34d0
mov byte [ebp - 4], 0x37
push str._r_n_r_n
lea ecx, [ebp - 0xde4]
call fcn.004b3b40
movzx edx, word [ebp - 0x5cc]
push edx
lea ecx, [ebp - 0xdd8]
call fcn.004553f0
push eax
lea eax, [ebp - 0xde4]
push eax
call fcn.004b3ce0
add esp, 0xc
lea ecx, [ebp - 0x1a74]
push ecx
mov edx, dword [ebp - 0x1a94]
mov ecx, dword [edx + 0x1e4]
call fcn.004b89e0
mov dword [ebp - 0x1adc], eax
mov eax, dword [ebp - 0x1adc]
mov dword [ebp - 0x1ae0], eax
mov byte [ebp - 4], 0x38
push 0x31
mov ecx, dword [ebp - 0x1ae0]
call fcn.004553f0
push eax
lea ecx, [ebp - 0xde4]
call fcn.004553f0
push eax
mov ecx, dword [ebp - 0x1a94]
mov ecx, dword [ecx + 0x1e4]
mov edx, dword [ebp - 0x1a94]
mov eax, dword [edx + 0x1e4]
mov edx, dword [eax]
mov eax, dword [edx]
call eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x1a65], al
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x1a74]
call fcn.004b3860
movzx ecx, byte [ebp - 0x1a65]
test ecx, ecx
je 0x427348
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0xdf0]
push eax
call fcn.00413220
add esp, 8
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xdf0]
call fcn.00404b70
cmp eax, 0xc
jg 0x427122
push 0x5f
lea ecx, [ebp - 0xdf0]
call fcn.00404b70
sub eax, 1
push eax
lea ecx, [ebp - 0xdf0]
call fcn.004b3e40
movzx ecx, word [ebp - 0x5cc]
push ecx
push str._c:I386_
lea edx, [ebp - 0xdfc]
push edx
call fcn.004b4d50
add esp, 0xc
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0xdfc]
push eax
push 0
lea ecx, [ebp - 0xdf0]
call fcn.004b54c0
lea ecx, [ebp - 0x1054]
push ecx
lea ecx, [ebp - 0xdf0]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xe00], eax
cmp dword [ebp - 0xe00], 0xffffffff
je 0x42732a
mov edx, dword [ebp - 0xe00]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x1a80]
push ecx
call fcn.00413220
add esp, 8
mov dword [ebp - 0x1ae4], eax
mov edx, dword [ebp - 0x1ae4]
mov dword [ebp - 0x1ae8], edx
mov byte [ebp - 4], 0x3b
lea eax, [ebp - 0x1a8c]
push eax
call fcn.004133a0
add esp, 4
mov dword [ebp - 0x1aec], eax
mov ecx, dword [ebp - 0x1aec]
mov dword [ebp - 0x1af0], ecx
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x1ae8]
push edx
mov eax, dword [ebp - 0x1af0]
push eax
lea ecx, [ebp - 0x18b8]
push ecx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x1a8c]
call fcn.004b3860
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x1a80]
call fcn.004b3860
lea ecx, [ebp - 0x18b8]
call fcn.004553f0
push eax
lea ecx, [ebp - 0xdf0]
call fcn.004553f0
push eax
movzx edx, word [ebp - 0x5cc]
push edx
push str._c:I386EXPAND.EXE___s____s_
push 0x400
lea eax, [ebp - 0x1864]
push eax
call fcn.0054e0f2
add esp, 0x18
mov dword [ebp - 0x18ac], 0
push 0x40
push 0
lea ecx, [ebp - 0x18a8]
push ecx
call fcn.00555bf0
add esp, 0xc
mov dword [ebp - 0x1064], 0
xor edx, edx
mov dword [ebp - 0x1060], edx
mov dword [ebp - 0x105c], edx
mov dword [ebp - 0x1058], edx
mov dword [ebp - 0x18ac], 0x44
lea eax, [ebp - 0x1064]
push eax
lea ecx, [ebp - 0x18ac]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1864]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4272c5
jmp 0x42731b
push 0x7530
mov eax, dword [ebp - 0x1064]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x18b9], al
mov ecx, dword [ebp - 0x1060]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1064]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x18b9]
test eax, eax
je 0x42731b
lea ecx, [ebp - 0x18b8]
push ecx
lea ecx, [ebp - 0x29c]
call fcn.004b3890
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x18b8]
call fcn.004b3860
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xdfc]
call fcn.004b3860
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xdf0]
call fcn.004b3860
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xde4]
call fcn.004b3860
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xdd8]
call fcn.004b3860
lea edx, [ebp - 0x29c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004b34d0
mov eax, dword [ebp - 0x1a90]
or eax, 1
mov dword [ebp - 0x1a90], eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x290]
call fcn.00409100
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x264]
call fcn.004b0a00
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x34]
call fcn.004b3860
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x28]
call fcn.004b3860
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x270]
call fcn.004b3860
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x18]
call fcn.004b3860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a8]
call fcn.004b3860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b4]
call fcn.004b3860
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x29c]
call fcn.004b3860
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 0xc