Function at 0x4034e0
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
sub esp, 0x65c
mov dl, byte [0x4100f0]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], dl
mov byte [esp + 0x560], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x561]
mov dword [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004017f0
mov esi, eax
mov dword [esp + 8], esi
call fcn.00401260
cmp eax, 9
jne 0x40354d
mov dword [esp + 0x110], 1
lea eax, [esp + 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x403570
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x65c
ret
test esi, esi
je 0x403625
or ecx, 0xffffffff
lea edi, [esp + 0x114]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x114]
mov edx, ecx
sub eax, 8
add edx, eax
or ecx, 0xffffffff
mov edi, str.syswow64
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x358]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x358]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x358]
mov edx, ecx
sub eax, 8
add edx, eax
mov edi, str.system32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
lea ecx, [esp + 0x118]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x4100e4]
mov edx, dword [0x4100e8]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x4100e4], eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4036a6
mov al, byte [esp + 0x11c]
mov edi, str.C:Program_Files__x86_BOCOM2010USBKeyHuaDa
mov byte [str.C:Program_Files__x86_BOCOM2010USBKeyHuaDa], al
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x464]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4036e1
mov cl, byte [esp + 0x11c]
mov edi, str.C:Program_FilesBOCOM2010USBKeyHuaDa
mov byte [str.C:Program_FilesBOCOM2010USBKeyHuaDa], cl
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x464]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00403300
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x4100e8]
push 0x402
push 0x3e8
push ecx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
call fcn.00401d30
mov eax, dword [0x4100e4]
mov edx, dword [0x4100e8]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
call fcn.00402240
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
call fcn.00402620
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x4100e8]
push 0x402
push 0x3e8
push ecx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon_Srv.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40382a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call fcn.00402700
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x464]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon_Srv.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4038cd
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call fcn.00402700
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x4100e8]
push 0x402
push 0x3e8
push ecx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40397e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.sig
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403a2e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hdpkcs11_bc.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403ade
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDAPP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403b8e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCOS_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403c3e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDIFD_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403cee
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403d9e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDADM_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403e4e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x464]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403efe
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x464]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDADM_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403fae
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDLNK_JH.url
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40405e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDUNI_JH.exe.manifest
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40410e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDSET_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4041be
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov eax, dword [esp + 0x118]
test eax, eax
je 0x404bd4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404902
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.VISTA64_DriverInstall.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x568]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4042ca
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x568]
push eax
call fcn.00403320
add esp, 4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
mov edx, dword [0x4100e8]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.minidriver64.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40437b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hsminidriver.cat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40442b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver64.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4044db
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40458b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.974beaf6_4271_4682_bd9a_14622b794641.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404646
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4046df
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDAPP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40478f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCOS_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40483f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDIFD_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4048ef
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x404bd4
call fcn.00403310
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.minidriver.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x568]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4049b8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x4100e8]
push 0x402
push 0x3e8
push ecx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hsminidriver.cat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404a69
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404b19
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.974beaf6_4271_4682_bd9a_14622b794641.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404bd4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ed627732_be64_4a02_98cf_c833a28f4c21.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404c84
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.JHCSPSetup_HSIC
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404d34
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.JHCSPSetup.exe.manifest
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404de4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404e1b
call fcn.00402180
jmp 0x404fe7
call fcn.004020c0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.usbccid.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x464]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404ed1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.usbccid.sys
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404f5c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.usbccid.cat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404fe7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDIFD20B_jzh.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40507f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call fcn.00403380
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x670]
lea eax, [esp + 0x14]
push eax
push 0x40d464
push 0x73
push ecx
call fcn.00403430
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HD_Interface_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x405133
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call fcn.00403380
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x670]
lea eax, [esp + 0x14]
push eax
push 0x40d464
push 0x74
push ecx
call fcn.00403430
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hdpkcs11_jh.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4051e7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x14]
push edx
call fcn.00403380
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x670]
lea eax, [esp + 0x14]
push eax
push 0x40d464
push 0x75
push ecx
call fcn.00403430
mov eax, dword [0x4100e4]
mov edx, dword [0x4100e8]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
push 0x402
push 0x3e8
push edx
mov dword [0x4100e4], eax
call ebx
push eax
call ebp
call fcn.00401bc0
call fcn.00401c30
call fcn.00401a60
call fcn.00401a00
call fcn.00401950
call fcn.00401b50
call fcn.00401840
call fcn.00401ac0
mov eax, dword [0x4100e4]
push 0
mov ecx, eax
inc eax
mov dword [0x4100e4], eax
mov eax, dword [0x4100e8]
push ecx
push 0x402
push 0x3e8
push eax
call ebx
push eax
call ebp
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x65c
ret