Function at 0x407110
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Delete file
Get file attributes
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4705af
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], ecx
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
mov dword [ebp - 0x30], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x408851
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
push str.invoked
mov ecx, esi
call fcn.00402f20
test al, al
jne 0x407186
push str.invoked
mov ecx, esi
call fcn.0045d070
mov dword [ebp - 4], 1
push ecx
mov dword [ebp - 0x30], esp
mov esi, esp
mov dword [ebp - 0x50], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x40885b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
push str._Bitlocker_Recovery_solution_getting
mov ecx, esi
call fcn.00402f20
test al, al
jne 0x4071cf
push str._Bitlocker_Recovery_solution_getting
mov ecx, esi
call fcn.0045d070
mov byte [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x408865
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], 5
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x40886f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 7
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x408879
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 9
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x408883
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 0xb
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x40888d
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x40], edi
mov byte [ebp - 4], 0xd
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x408897
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xe
push str.C:WinBDERecoveryKey
lea ecx, [ebp - 0x5c]
call fcn.00402f20
test al, al
jne 0x4072bd
push str.C:WinBDERecoveryKey
lea ecx, [ebp - 0x5c]
call fcn.0045d070
mov byte [ebp - 4], 0xf
push dword [ebp - 0x5c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x5c]
call ebx
cmp eax, 0xffffffff
jne 0x4072ec
push 0
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or ebx, 0xffffffff
jmp 0x40735a
push str.BitLockerKeyExtracted.txt
lea ecx, [ebp - 0x18]
call fcn.0045d100
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x28]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40733c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40735a
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0
push 0
push 0xffffffffffffffff
push 0x48780e
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [eax - 1]
mov dword [ebp - 0x18], edx
test edx, edx
jle 0x4073c3
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
sub eax, edx
or eax, ecx
jge 0x407399
push edx
lea ecx, [ebp - 0x3c]
call fcn.004032b0
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
push edx
push esi
push 0xffffffffffffffff
push 0x48780e
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x18]
cmp eax, dword [esi - 8]
jg 0x4088a6
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4073ce
lea ecx, [ebp - 0x3c]
call fcn.00403250
mov esi, dword [ebp - 0x3c]
push 0
push 0
push 0xffffffffffffffff
push 0x48780e
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [eax - 1]
mov dword [ebp - 0x18], edx
test edx, edx
jle 0x407437
mov ecx, 1
sub ecx, dword [edi - 4]
mov eax, dword [edi - 8]
sub eax, edx
or eax, ecx
jge 0x40740d
push edx
lea ecx, [ebp - 0x40]
call fcn.004032b0
mov edi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x18]
push edx
push edi
push 0xffffffffffffffff
push 0x48780e
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi - 8]
jg 0x4088a6
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x407442
lea ecx, [ebp - 0x40]
call fcn.00403250
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x14
mov byte [ebp - 0x11], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.wmic_logicaldisk_get_name
call fcn.0045d100
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x14
mov dl, byte [ebp - 0x11]
lea ecx, [ebp - 0x74]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x16
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x64], ecx
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x4074da
lea eax, [ecx + 0xc]
mov dword [ebp - 0x38], eax
cmp dword [ecx + 0xc], 0
jl 0x4074ce
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x4074ce
mov ecx, dword [ebp - 0x28]
call fcn.00403060
mov dword [ebp - 0x28], eax
mov ecx, ebx
mov eax, dword [ebp - 0x38]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4074c3
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x4074da
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x34]
call fcn.004030c0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4074fc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x38], esp
mov ebx, dword [ebp - 0x34]
add ebx, 0xfffffff0
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [ebx + 0xc]
cmp dword [eax], 0
jl 0x407526
cmp ecx, dword [ebx]
jne 0x407526
lock inc dword [eax]
jmp 0x407559
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x4088a1
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov edx, dword [ebx + 4]
inc edx
push edx
lea eax, [ebx + 0x10]
push eax
add ecx, 0x10
call fcn.004031c0
add esp, 8
mov ebx, dword [ebp - 0x28]
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x19
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._Bitlocker_Recovery_solution_is_now_inside_the_trial
call fcn.0045d100
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x14
or ecx, 0xffffffff
call fcn.0045f800
add esp, 4
push 0x487d70
lea ecx, [ebp - 0x34]
call fcn.0045cc50
mov ebx, eax
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045c870
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax - 0xc]
sub ecx, ebx
push ecx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045c980
mov byte [ebp - 4], 0x1c
mov edx, dword [eax]
lea ebx, [edx - 0x10]
mov ecx, dword [ebp - 0x18]
cmp ebx, ecx
je 0x40761f
lea eax, [ecx + 0xc]
mov dword [ebp - 0x28], eax
cmp dword [eax], 0
jl 0x407613
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x407613
mov ecx, ebx
call fcn.00403060
mov dword [ebp - 0x38], eax
or ebx, 0xffffffff
mov ecx, ebx
mov edx, dword [ebp - 0x28]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40760b
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x38]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x407622
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x34]
call fcn.004030c0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407644
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
push 0x487d74
lea ecx, [ebp - 0x34]
call fcn.0045cc50
mov dword [ebp - 0x28], eax
lea ecx, [eax + 1]
push ecx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045c870
mov byte [ebp - 4], 0x1e
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x18], ecx
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x4076d1
lea eax, [ecx + 0xc]
mov dword [ebp - 0x48], eax
cmp dword [eax], 0
jl 0x4076c5
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x4076c5
mov ecx, dword [ebp - 0x20]
call fcn.00403060
mov dword [ebp - 0x20], eax
mov ecx, ebx
mov edx, dword [ebp - 0x48]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4076bd
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x24], eax
jmp 0x4076d1
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x24]
call fcn.004030c0
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0xa4]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4076f6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov dword [ebp - 0x6c], eax
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x80], edx
movzx eax, word [eax]
test ax, ax
je 0x40774f
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
add esp, 4
test eax, eax
je 0x407739
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
test edx, edx
jne 0x407744
mov edx, eax
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x18], edx
add eax, 2
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x24]
jmp 0x407706
xor edx, edx
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x18], edx
add eax, 2
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x24]
jmp 0x407706
test edx, edx
je 0x407798
sub edx, ebx
sar edx, 1
mov dword [ebp - 0x18], edx
js 0x4088a6
mov ecx, 1
sub ecx, dword [ebx - 4]
mov eax, dword [ebx - 8]
sub eax, edx
or eax, ecx
jge 0x407780
push edx
lea ecx, [ebp - 0x24]
call fcn.004032b0
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebx - 8]
jg 0x4088a6
mov dword [ebx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov word [eax + edx*2], cx
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x84], ebx
movzx eax, word [ebx]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
add esp, 4
test eax, eax
je 0x4077b4
add ebx, 2
jmp 0x407798
mov eax, dword [ebp - 0x24]
cmp ebx, eax
je 0x407845
sub ebx, eax
sar ebx, 1
mov dword [ebp - 0x48], ebx
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x20], ecx
test ecx, ecx
js 0x4088b0
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, dword [eax - 0xc]
or ecx, edx
jge 0x4077f4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
call fcn.004032b0
mov eax, dword [ebp - 0x24]
lea ebx, [eax + ebx*2]
mov dword [ebp - 0x84], ebx
mov edx, dword [eax - 0xc]
mov ecx, edx
sub ecx, dword [ebp - 0x48]
mov dword [ebp - 0x20], ecx
lea ecx, [ecx*2 + 2]
push ecx
push ebx
lea ecx, [edx*2 + 2]
push ecx
push eax
call fcn.0045d860
add esp, 0x10
mov ecx, dword [ebp - 0x20]
test ecx, ecx
js 0x4088a6
mov eax, dword [ebp - 0x24]
cmp ecx, dword [eax - 8]
jg 0x4088a6
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov word [eax + ecx*2], dx
mov edx, 0x48780e
lea ecx, [ebp - 0x24]
call fcn.0045c510
test al, al
jne 0x408101
push str.manage_bde__status
lea ecx, [ebp - 0x88]
call fcn.0045d100
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x1c]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x88]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4078ab
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.manage_bde__status
lea ecx, [ebp - 0x8c]
call fcn.0045d100
mov byte [ebp - 4], 0x24
mov byte [ebp - 0x11], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x8c]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x24
mov dl, byte [ebp - 0x11]
lea ecx, [ebp - 0x60]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x8c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407916
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
push str.ERROR
lea ecx, [ebp - 0x60]
call fcn.0045cc50
cmp eax, 0xffffffff
jne 0x408011
mov byte [ebp - 0x11], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.wmic_logicaldisk_get_caption_description_filesystem
call fcn.0045d100
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x27
mov dl, byte [ebp - 0x11]
lea ecx, [ebp - 0x50]
call fcn.00460ee0
mov byte [ebp - 4], 0x2a
push str.__Conversion_Status:____Fully_Encrypted
lea ecx, [ebp - 0x60]
call fcn.0045cc50
test eax, eax
jns 0x40797f
push ecx
push str.__Conversion_Status:____Used_Space_Only_Encrypted
lea ecx, [ebp - 0x60]
call fcn.0045cc50
test eax, eax
mov byte [ebp - 0x11], 0
js 0x407983
mov byte [ebp - 0x11], 1
push ecx
push str._Conversion_Status:____Unknown
lea ecx, [ebp - 0x60]
call fcn.0045cc50
test eax, eax
js 0x407ccd
push ecx
push str.Lock_Status:__________Locked
lea ecx, [ebp - 0x60]
call fcn.0045cc50
test eax, eax
js 0x407ccd
push str.manage_bde__protectors__get
lea ecx, [ebp - 0x54]
call fcn.0045d100
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov ecx, edx
mov eax, dword [ebp - 0x54]
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x4c], ecx
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [edx - 0xc]
test eax, eax
js 0x4088ba
push eax
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edx, eax
mov dword [ebp - 0x20], edx
mov ecx, 0x7fffffff
sub ecx, edx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
jl 0x4088c4
add eax, edx
mov dword [ebp - 0x18], eax
js 0x4088ce
mov eax, dword [ebp - 0x54]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, dword [ebp - 0x18]
or ecx, edx
jge 0x407a33
push dword [ebp - 0x18]
lea ecx, [ebp - 0x54]
call fcn.004032b0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x407a43
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x20]
push ecx
lea ecx, [eax + edx*2]
mov edx, dword [ebp - 0x20]
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax - 8]
jg 0x4088a6
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x54]
mov word [eax + ecx*2], dx
push ecx
mov dword [ebp - 0x4c], esp
mov dword [ebp - 0xa8], esp
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [eax], 0
jl 0x407aa8
cmp edx, dword [ecx]
jne 0x407aa8
mov eax, ecx
mov ecx, dword [ebp - 0x2c]
lock inc dword [ecx]
jmp 0x407ae3
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x48], edx
test edx, edx
je 0x4088d8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
inc edx
push edx
lea eax, [ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x10
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x48]
add eax, 0x10
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
mov byte [ebp - 4], 0x2c
mov byte [ebp - 4], 0x2d
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str._Bitlocker_Recovery_solution_in_working
call fcn.0045d100
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2b
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea ecx, [ebp - 0x7c]
call fcn.0045d100
mov byte [ebp - 4], 0x2f
mov byte [ebp - 0x41], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x54]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
mov dl, byte [ebp - 0x41]
lea ecx, [ebp - 0x94]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x7c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407b7e
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0x487f7c
lea ecx, [ebp - 0x74]
call fcn.0045d100
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xb0]
call fcn.0045c7c0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x74]
push ecx
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.0045c7c0
add esp, 8
mov byte [ebp - 4], 0x36
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
lea edx, [eax - 0x10]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x2c], ecx
cmp edx, ecx
je 0x407c1a
lea edi, [ecx + 0xc]
cmp dword [edi], 0
jl 0x407c0b
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x407c08
mov ecx, edx
call fcn.00403060
mov dword [ebp - 0x4c], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x407c00
mov edi, dword [ebp - 0x2c]
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [ebp - 0x4c]
lea edi, [eax + 0x10]
mov dword [ebp - 0x40], edi
jmp 0x407c1a
mov eax, dword [ebp - 0x4c]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.004030c0
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x35
mov edx, dword [ebp - 0xac]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407c3f
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0xb0]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407c64
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407c86
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407cab
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407ccd
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp byte [ebp - 0x11], 1
jne 0x407fef
push str.manage_bde__protectors__get
lea ecx, [ebp - 0x58]
call fcn.0045d100
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x4c], edx
mov ecx, edx
mov eax, dword [ebp - 0x58]
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 0xc]
test eax, eax
js 0x4088dd
push eax
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edx, eax
mov dword [ebp - 0x48], edx
mov ecx, 0x7fffffff
sub ecx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4088e7
add eax, edx
mov dword [ebp - 0x18], eax
js 0x4088f1
mov eax, dword [ebp - 0x58]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, dword [ebp - 0x18]
or ecx, edx
jge 0x407d5b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x58]
call fcn.004032b0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x407d6b
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x48]
push ecx
lea ecx, [eax + edx*2]
mov edx, dword [ebp - 0x48]
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax - 8]
jg 0x4088a6
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x58]
mov word [eax + ecx*2], dx
push ecx
mov dword [ebp - 0x4c], esp
mov dword [ebp - 0x98], esp
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [eax], 0
jl 0x407dd0
cmp edx, dword [ecx]
jne 0x407dd0
mov eax, ecx
mov ecx, dword [ebp - 0x2c]
lock inc dword [ecx]
jmp 0x407e0b
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x48], edx
test edx, edx
je 0x4088fb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
inc edx
push edx
lea eax, [ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x10
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x48]
add eax, 0x10
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3e
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str._Bitlocker_Recovery_solution_in_working
call fcn.0045d100
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x3c
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea ecx, [ebp - 0x64]
call fcn.0045d100
mov byte [ebp - 4], 0x40
mov byte [ebp - 0x41], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x64]
push eax
lea edx, [ebp - 0x58]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x40
mov dl, byte [ebp - 0x41]
lea ecx, [ebp - 0x78]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x43
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407ea3
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0x487f7c
lea ecx, [ebp - 0x38]
call fcn.0045d100
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0xa0]
call fcn.0045c7c0
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x38]
push ecx
mov edx, eax
lea ecx, [ebp - 0x9c]
call fcn.0045c7c0
add esp, 8
mov byte [ebp - 4], 0x47
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
lea edx, [eax - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x2c], ecx
cmp edx, ecx
je 0x407f3f
lea esi, [ecx + 0xc]
cmp dword [esi], 0
jl 0x407f30
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x407f2d
mov ecx, edx
call fcn.00403060
mov dword [ebp - 0x4c], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x407f25
mov esi, dword [ebp - 0x2c]
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x4c]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
jmp 0x407f3f
mov eax, dword [ebp - 0x4c]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004030c0
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x48
mov byte [ebp - 4], 0x46
mov edx, dword [ebp - 0x9c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407f64
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 0x45
mov edx, dword [ebp - 0xa0]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407f89
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4a
mov byte [ebp - 4], 0x43
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407fab
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x78]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407fcd
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407fef
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4d
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408011
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp - 0x28]
dec eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045c980
mov byte [ebp - 4], 0x4e
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea edx, [eax - 0x10]
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x4c], ecx
cmp edx, ecx
je 0x40808f
lea eax, [ecx + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [eax], 0
jl 0x408080
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x408080
mov ecx, edx
call fcn.00403060
mov dword [ebp - 0x20], eax
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408078
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x40808f
mov eax, dword [ebp - 0x20]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x34]
call fcn.004030c0
mov byte [ebp - 4], 0x4f
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4080b1
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4080d3
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4080f5
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [ebp - 0x28], 0
jg 0x407644
jmp 0x408104
or ebx, 0xffffffff
mov edx, 0x48780e
lea ecx, [ebp - 0x3c]
call fcn.0045c400
test al, al
je 0x4082d2
mov eax, dword [esi - 0xc]
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0045c870
mov byte [ebp - 4], 0x52
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x1c], eax
lea ecx, [esi - 0x10]
mov dword [ebp - 0x30], ecx
cmp eax, ecx
je 0x40818b
lea esi, [ecx + 0xc]
cmp dword [esi], 0
jl 0x40817c
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x40817c
mov ecx, dword [ebp - 0x1c]
call fcn.00403060
mov dword [ebp - 0x1c], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x408174
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
jmp 0x40818b
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x3c]
call fcn.004030c0
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4081ad
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.working
call fcn.0045d100
mov byte [ebp - 4], 0x54
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._Bitlocker_Recovery_solution_finally
call fcn.0045d100
mov byte [ebp - 4], 0x55
mov byte [ebp - 4], 0x1b
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push str._.The_recovery_and_password_key_has_been_saved_to__C:WinBDERecoveryKey_.Please_review_and__Click_on_NEXT_STEP
lea ecx, [ebp - 0x38]
call fcn.0045d100
mov byte [ebp - 4], 0x56
push str.The_drives_with_bitlocker_enabled_are
lea ecx, [ebp - 0x28]
call fcn.0045d100
mov byte [ebp - 4], 0x57
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.0045c7c0
mov byte [ebp - 4], 0x59
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp - 0x38]
push edx
mov edx, eax
call fcn.0045c7c0
mov byte [ebp - 4], 0x5a
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0x68]
call fcn.0045fd10
add esp, 0xc
mov byte [ebp - 4], 0x5d
mov byte [ebp - 4], 0x57
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408285
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x56
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4082a7
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40859d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x40859d
mov edx, 0x48780e
lea ecx, [ebp - 0x40]
call fcn.0045c400
test al, al
je 0x4084a0
mov eax, dword [edi - 0xc]
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x40]
call fcn.0045c870
mov byte [ebp - 4], 0x60
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x1c], eax
lea ecx, [edi - 0x10]
mov dword [ebp - 0x30], ecx
cmp eax, ecx
je 0x408359
lea edi, [ecx + 0xc]
cmp dword [edi], 0
jl 0x40834a
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x40834a
mov ecx, dword [ebp - 0x1c]
call fcn.00403060
mov dword [ebp - 0x1c], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x408342
mov edi, dword [ebp - 0x30]
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
lea edi, [eax + 0x10]
mov dword [ebp - 0x40], edi
jmp 0x408359
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x40]
call fcn.004030c0
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40837b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.working
call fcn.0045d100
mov byte [ebp - 4], 0x62
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._Bitlocker_Recovery_solution_finally
call fcn.0045d100
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x1b
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push str._is_locked.Please_unlock_them_in_order_to_save_complete_extraction_keys._Click_on_NEXT_STEP
lea ecx, [ebp - 0x38]
call fcn.0045d100
mov byte [ebp - 4], 0x64
push str.The_drive
lea ecx, [ebp - 0x28]
call fcn.0045d100
mov byte [ebp - 4], 0x65
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x66
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.0045c7c0
mov byte [ebp - 4], 0x67
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp - 0x38]
push edx
mov edx, eax
call fcn.0045c7c0
mov byte [ebp - 4], 0x68
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.DLocked
call fcn.0045d100
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x6a
mov ecx, dword [ebp - 0x68]
call fcn.0045fd10
add esp, 0xc
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x65
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408453
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x64
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408475
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40859d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x40859d
push str.Please_contact_IT_Support_for_your_problem.
lea ecx, [ebp - 0x70]
call fcn.0045d070
push ecx
mov dword [ebp - 0x50], esp
mov dword [ebp - 0x30], esp
mov ecx, dword [ebp - 0x90]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0
jl 0x4084e5
cmp edx, dword [ecx]
jne 0x4084e5
mov eax, ecx
mov ecx, dword [ebp - 0x1c]
lock inc dword [ecx]
jmp 0x408520
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x38], edx
test edx, edx
je 0x408900
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
inc edx
push edx
lea eax, [ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x38]
add eax, 0x10
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x6f
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._Bitlocker_Recovery_key_Extraction_Error
call fcn.0045d100
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x1b
or ecx, 0xffffffff
call fcn.0045f800
add esp, 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x71
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.Bitlocker_is_not_enabled_on_any_drive
call fcn.0045d100
mov byte [ebp - 4], 0x72
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push str.Failure
call fcn.0045d100
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x68]
call fcn.0045fd10
add esp, 0xc
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4085bf
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xf
jmp 0x4086b5
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4086d3
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xb
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4086ee
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408709
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408727
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408745
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x90]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x408767
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
call fcn.004031b0
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
call fcn.004031b0
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
int3