Function at 0x100663a0
Capabilities:
Check for time delay via gettickcount
Encode data using base64
Get disk information
Inspect section memory permissions
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3d0
push ebx
push esi
lea eax, [ebp + 0x78]
push edi
push eax
mov dword [ebp - 0xc4], ecx
call fcn.1003f9c4
pop ecx
push 5
lea ecx, [ebp + 0x1c]
call fcn.10046141
push 0x14
lea ecx, [ebp - 0x1e0]
call fcn.10046141
lea ecx, [ebp - 0xf0]
call fcn.10046123
lea ecx, [ebp - 0xd0]
call fcn.10046123
lea ecx, [ebp - 0xdc]
call fcn.10046123
mov eax, dword [ebp + 0x78]
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 0x30], eax
push 0x2c
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xc], 0xfffc0000
mov dword [ebp + 0x60], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x64], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], esi
mov byte [ebp - 0x5d], bl
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x95], bl
mov byte [ebp - 0x9d], bl
mov byte [ebp + 0x51], bl
mov byte [ebp + 0x50], bl
mov byte [ebp - 0x3e], bl
mov byte [ebp - 0x9e], bl
mov byte [ebp + 7], bl
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x120], 0x1f4
call fcn.1004907a
mov eax, dword [ebp - 0xd0]
mov word [eax], bx
mov eax, dword [ebp - 0x30]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x100664f2
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x30], eax
push 0x2c
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1004907a
add esp, 0xc
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
mov byte [ebp + 0x13], 0
mov byte [ebp + 0x5b], 0
mov byte [ebp - 0x8e], 0xff
mov byte [ebp + 0x10], 0
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x8d], 0
mov byte [ebp + 0x23], 0
mov byte [ebp + 0x6a], 0
mov byte [ebp + 0x47], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x6b], 0
mov byte [ebp + 0x52], 0
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x29], 0xff
mov byte [ebp - 0x11], 0xff
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp + 8], ebx
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x21], 0
mov dword [ebp - 0x68], 0xfffff000
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0xc0], esi
je 0x10066ff2
push 6
lea eax, [ebp + 0x78]
push eax
push str._admin
call fcn.10048195
add esp, 0xc
test al, al
je 0x100665a3
or byte [ebp + 0x13], 1
jmp 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push 0x100d0c14
call fcn.10048195
add esp, 0xc
test al, al
je 0x100665c3
or byte [ebp + 0x13], 2
jmp 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push str._devid
call fcn.10048195
add esp, 0xc
test al, al
je 0x100665e3
or byte [ebp - 0x7a], 1
jmp 0x10066f65
push 7
lea eax, [ebp + 0x78]
push eax
push str._devidx
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066603
or byte [ebp - 0x7a], 2
jmp 0x10066f65
push 7
lea eax, [ebp + 0x78]
push eax
push str._devidn
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066623
or byte [ebp - 0x7a], 8
jmp 0x10066f65
push 7
lea eax, [ebp + 0x78]
push eax
push str._devida
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066643
or byte [ebp - 0x7a], 4
jmp 0x10066f65
push 4
lea eax, [ebp + 0x78]
push eax
push str._gui
call fcn.10048195
add esp, 0xc
test al, al
jne 0x10066f9d
push 4
lea eax, [ebp + 0x78]
push eax
push str._usb
call fcn.10048195
add esp, 0xc
test al, al
jne 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push str._hextp
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066699
or dword [ebp + 8], 1
jmp 0x10066f65
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._phy
call fcn.10048195
add esp, 0xc
test al, al
je 0x100666bb
or dword [ebp + 8], 2
jmp 0x10066f65
push 5
lea eax, [ebp + 0x78]
push eax
push 0x100d0bd4
call fcn.10048195
add esp, 0xc
test al, al
je 0x100666db
or dword [ebp + 8], 0x10
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._drv
call fcn.10048195
add esp, 0xc
test al, al
je 0x100666fa
or dword [ebp + 8], 8
jmp 0x10066f65
push 5
lea eax, [ebp + 0x78]
push eax
push str._fill
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066719
or dword [ebp + 8], edi
jmp 0x10066f65
push 5
lea eax, [ebp + 0x78]
push eax
push str._dvol
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066739
or byte [ebp + 9], 1
jmp 0x10066f65
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d0bb8
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066759
mov byte [ebp + 0x47], 1
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._xup
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066778
mov byte [ebp + 0x65], 1
jmp 0x10066f65
push 5
lea eax, [ebp + 0x78]
push eax
push str._axup
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066798
mov byte [ebp + 0x65], 0x21
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._hup
call fcn.10048195
add esp, 0xc
test al, al
je 0x100667b7
mov byte [ebp + 0x6b], 1
jmp 0x10066f65
push 5
lea eax, [ebp + 0x78]
push eax
push str._ahup
call fcn.10048195
add esp, 0xc
test al, al
je 0x100667d7
mov byte [ebp + 0x6b], 0x21
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpt
call fcn.10048195
add esp, 0xc
test al, al
je 0x100667f6
mov byte [ebp + 0x52], 1
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._gptmini
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066815
mov byte [ebp + 0x52], 2
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpth
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066834
mov byte [ebp + 0x52], 4
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._mbr
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066856
mov byte [ebp - 0x9d], 1
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._cmp
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066875
mov byte [ebp - 0x52], 1
jmp 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push 0x100cbc94
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066898
mov byte [ebp - 0x95], 1
jmp 0x10066f65
push 5
lea eax, [ebp + 0x78]
push eax
push str._fs0:
call fcn.10048288
add esp, 0xc
test al, al
je 0x100668ca
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 7], 0x10
call fcn.10042554
pop ecx
pop ecx
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._fs0
call fcn.10048195
add esp, 0xc
test al, al
je 0x100668e9
mov byte [ebp + 7], 0x10
jmp 0x10066f65
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d0b60
call fcn.10048195
add esp, 0xc
test al, al
je 0x1006690c
mov byte [ebp - 0x9e], 1
jmp 0x10066f65
push 2
lea eax, [ebp + 0x78]
push eax
push 0x100d021c
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066932
add dword [ebp - 0x9c], 0x100
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100d0b58
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066951
mov byte [ebp - 0x41], 1
jmp 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push str._lskip
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066971
or byte [ebp - 0x3e], 0x40
jmp 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push str._locku
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066991
mov byte [ebp + 0x50], 3
jmp 0x10066f65
mov edi, dword [ebp + 0x78]
push 7
push edi
push str._locku:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x100669b0
inc edi
mov byte [ebp + 0x50], 3
inc edi
jmp 0x100669c8
push 6
push edi
push 0x100d0b38
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066a26
mov byte [ebp + 0x50], 1
add edi, 0xc
xor ecx, ecx
mov dword [ebp + 0x78], edi
mov cx, word [edi]
cmp cx, bx
je 0x10066a01
mov eax, ecx
call fcn.10002df6
test al, al
jne 0x10066a01
push ecx
call fcn.10045b88
add esp, 4
test al, al
jne 0x10066a01
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x34], edi
call fcn.10005b74
jmp 0x10066b56
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.1007edb8
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.1007edb8
add esp, 0x10
jmp 0x10066b66
push 5
lea eax, [ebp + 0x78]
push eax
push str._lock
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066a46
mov byte [ebp + 0x50], 1
jmp 0x10066f65
push 6
lea eax, [ebp + 0x78]
push eax
push str._lockx
call fcn.10048195
add esp, 0xc
test al, al
jne 0x10066988
push 6
lea eax, [ebp + 0x78]
push eax
push str._lock_
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066a87
mov byte [ebp + 0x50], 0xf0
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
jmp 0x10066f65
mov edi, dword [ebp + 0x78]
push 4
push edi
push 0x100d0b18
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066ae9
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x10066aba
cmp ax, 0x3d
je 0x10066aba
call fcn.10002df6
test al, al
je 0x10066ae9
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
mov dword [ebp - 0xd8], ebx
je 0x10066ad5
mov dword [ebp - 0x78], 0x100d0b10
jmp 0x10066b66
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
jmp 0x10066b4c
push 4
push edi
push str._pbr
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066b74
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x10066b19
cmp ax, 0x3d
je 0x10066b19
call fcn.10002df6
test al, al
je 0x10066b74
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
lea eax, [ebp + 0x78]
mov dword [ebp - 0x78], ebx
push eax
je 0x10066b3b
mov dword [ebp - 0xd8], 0x100c78c2
call fcn.10005b74
pop ecx
jmp 0x10066b66
add dword [ebp + 0x78], 2
call fcn.1003f9c4
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
lea eax, [ebp + 0x78]
push eax
call fcn.10005b74
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x10066b66
mov word [eax], bx
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
jmp 0x100668c4
push 9
push edi
push str._alignend
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066c04
lea ecx, [edi + 0x12]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x10066ba4
cmp ax, 0x3d
je 0x10066ba4
call fcn.10002df6
test al, al
je 0x10066c04
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
jne 0x10066bf2
xor eax, eax
add ecx, 2
mov ax, word [ecx]
push eax
call fcn.10045b88
add esp, 4
test al, al
je 0x10066f4a
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ecx
call fcn.1004bbf7
cmp dword [ebp - 0x80], ebx
pop ecx
pop ecx
jg 0x10066f4a
jl 0x10066bf2
cmp dword [ebp - 0x84], ebx
ja 0x10066f4a
mov dword [ebp - 0x84], 0xfffffffe
mov dword [ebp - 0x80], esi
jmp 0x10066f4a
push 6
push edi
push str._align
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066cb2
lea ecx, [edi + 0xc]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x10066c38
cmp ax, 0x3d
je 0x10066c38
call fcn.10002df6
test al, al
je 0x10066cb2
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], ecx
mov edi, ecx
call fcn.10005b74
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
cmp word [edi], 0x3d
pop ecx
pop ecx
je 0x10066c68
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
jmp 0x10066f65
xor eax, eax
lea ecx, [edi + 2]
mov ax, word [ecx]
push eax
call fcn.10045b88
add esp, 4
test al, al
je 0x10066f65
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ecx
call fcn.1004bbf7
cmp dword [ebp - 0xac], ebx
pop ecx
pop ecx
jg 0x10066f65
jl 0x10066c57
cmp dword [ebp - 0xb0], ebx
ja 0x10066f65
jmp 0x10066c57
push 6
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._clear
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066cd7
mov byte [ebp - 0x8e], 1
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._clean
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066cf6
mov byte [ebp - 0x11], 1
jmp 0x10066f65
push 7
lea eax, [ebp + 0x78]
push eax
push str._clean_
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066d16
mov byte [ebp - 0x11], 0
jmp 0x10066f65
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100ca4c8
call fcn.10048195
add esp, 0xc
test al, al
jne 0x10066f61
push 4
lea eax, [ebp + 0x78]
push eax
push str._del
call fcn.10048195
add esp, 0xc
test al, al
jne 0x10066f61
push 4
lea eax, [ebp + 0x78]
push eax
push 0x100d0294
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066d70
or dword [ebp + 8], 0x20
mov byte [ebp - 0x51], 1
jmp 0x10066f65
push edi
push dword [ebp + 0x78]
push str._swap:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066da9
add dword [ebp + 0x78], 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.10053a89
test eax, eax
pop ecx
pop ecx
jl 0x10069036
mov byte [ebp - 0x21], 1
jmp 0x10066f65
push 5
push dword [ebp + 0x78]
push str._CHS
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066e48
add dword [ebp + 0x78], 0xa
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x34], edi
call fcn.10008e60
xor eax, eax
mov ax, word [edi]
push eax
call fcn.10045b88
add esp, 0xc
test al, al
je 0x10066e03
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1004bbf7
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x3a
jne 0x10066e22
add dword [ebp - 0x34], 2
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1004bbf7
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x3a
jne 0x10066f65
add dword [ebp - 0x34], 2
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1004bbf7
jmp 0x100668c3
push 5
push dword [ebp + 0x78]
push str._IMG
call fcn.10040df5
add esp, 0xc
test al, al
jne 0x10066f71
push edi
push dword [ebp + 0x78]
push str._SKIP
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066ea6
add dword [ebp + 0x78], 0xc
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x48], 0x42
call fcn.10053a89
mov al, byte [ebp - 0x48]
add esp, 0xc
mov byte [ebp - 0x6c], al
jmp 0x10066f65
push 4
push dword [ebp + 0x78]
push str._iv
call fcn.10040df5
add esp, 0xc
test al, al
je 0x10066edb
add dword [ebp + 0x78], 8
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.10053a89
or byte [ebp + 9], 8
pop ecx
pop ecx
jmp 0x10066f65
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d0ab0
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066efc
or byte [ebp + 9], 8
or byte [ebp - 0x7a], 0x10
jmp 0x10066f65
push edi
lea eax, [ebp + 0x78]
push eax
push str._cdrom
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066f1e
mov dword [ebp - 0x8c], 8
jmp 0x10066f65
push 7
lea eax, [ebp + 0x78]
push eax
push str._floppy
call fcn.10048195
add esp, 0xc
test al, al
je 0x10066f41
mov dword [ebp - 0x8c], 0x10
jmp 0x10066f65
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2d
jne 0x10066f71
lea eax, [ebp + 0x78]
push eax
call fcn.10005b74
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
jmp 0x100668c3
mov byte [ebp + 0x10], 1
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
jne 0x10066583
cmp dword [ebp - 0x84], 0xfffffffe
jne 0x10066fe1
cmp dword [ebp - 0x80], esi
jne 0x10066fe1
mov eax, dword [ebp - 0xb0]
cmp eax, 0xfffffff7
jne 0x10066fd2
cmp dword [ebp - 0xac], esi
jne 0x10066fd2
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
jmp 0x10066ff2
push str._._21:INDATA
lea ecx, [ebp - 0x6c]
call fcn.100501eb
push dword [ebp + 0x78]
lea ecx, [ebp - 0x6c]
call fcn.1004618f
push dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc4]
call fcn.1002335d
lea ecx, [ebp - 0x6c]
mov edi, eax
call fcn.1003f96c
jmp 0x1006b3fc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0xb0], 0xfffffff7
jne 0x10067002
cmp dword [ebp - 0xac], esi
jne 0x10067002
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xac], ebx
cmp dword [ebp - 0x84], 0xfffffff7
jne 0x10067025
cmp dword [ebp - 0x80], esi
jne 0x10067025
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100d0a78
call fcn.10048195
add esp, 0xc
test al, al
je 0x10067143
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100d0a70
call fcn.10048195
add esp, 0xc
test al, al
je 0x10067061
mov byte [ebp + 0x5b], 1
jmp 0x10067143
push edi
lea eax, [ebp + 0x78]
push eax
push str.part
call fcn.10048195
add esp, 0xc
test al, al
je 0x10067080
mov byte [ebp + 0x5b], 2
jmp 0x10067143
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d0a6c
call fcn.10048195
add esp, 0xc
test al, al
je 0x100670a0
mov byte [ebp + 0x5b], 3
jmp 0x10067143
push 5
lea eax, [ebp + 0x78]
push eax
push str.cdrom
call fcn.10048195
add esp, 0xc
test al, al
je 0x100670c7
mov byte [ebp + 0x5b], 4
mov dword [ebp - 0x8c], 8
jmp 0x10067143
push 6
lea eax, [ebp + 0x78]
push eax
push str.floppy
call fcn.10048195
add esp, 0xc
test al, al
je 0x100670ee
mov byte [ebp + 0x5b], 5
mov dword [ebp - 0x8c], 0x10
jmp 0x10067143
push 6
lea eax, [ebp + 0x78]
push eax
push str.parent
call fcn.10048195
add esp, 0xc
test al, al
je 0x1006710b
mov byte [ebp + 0x5b], 6
jmp 0x10067143
push 6
lea eax, [ebp + 0x78]
push eax
push str.volume
call fcn.10048195
add esp, 0xc
test al, al
je 0x10067128
mov byte [ebp + 0x5b], 7
jmp 0x10067143
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d0a48
call fcn.10048195
add esp, 0xc
test al, al
je 0x10067143
mov byte [ebp + 0x5b], 8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100d0598
mov byte [ebp + 0x64], 0
call fcn.10048195
xor edi, edi
add esp, 0xc
inc edi
test al, al
je 0x10067167
mov byte [ebp + 0x51], 1
mov dword [ebp + 0x60], edi
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d0a44
call fcn.10048195
add esp, 0xc
test al, al
je 0x10067182
mov byte [ebp + 0x51], 0x10
push 6
lea eax, [ebp + 0x78]
push eax
push str.update
call fcn.10048195
add esp, 0xc
test al, al
je 0x1006719f
mov byte [ebp + 0x64], 1
jmp 0x100671f4
push 7
lea eax, [ebp + 0x78]
push eax
push str.xupdate
call fcn.10048195
add esp, 0xc
test al, al
je 0x100671bc
mov byte [ebp + 0x64], 0x20
jmp 0x100671f4
push 7
lea eax, [ebp + 0x78]
push eax
push str.hupdate
call fcn.10048195
add esp, 0xc
test al, al
je 0x100671d9
mov byte [ebp + 0x64], 0x10
jmp 0x100671f4
push 8
lea eax, [ebp + 0x78]
push eax
push str.hupdatef
call fcn.10048195
add esp, 0xc
test al, al
je 0x100671f7
mov byte [ebp + 0x64], 0x18
mov dword [ebp + 0x60], edi
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x78]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xf0]
call fcn.10046247
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2a
pop ecx
mov dword [ebp - 0xd4], ebx
jne 0x10067240
inc eax
inc eax
mov dword [ebp - 0xd4], 0x40000000
mov dword [ebp + 0x78], eax
xor ecx, ecx
mov cx, word [eax]
mov edx, ecx
or edx, 0x20
cmp dx, 0x61
jne 0x10067266
mov dword [ebp - 0x88], 0x80
lea eax, [ebp + 0x78]
push eax
call fcn.10005b74
pop ecx
jmp 0x10067288
cmp cx, 0x2d
jne 0x10067282
mov ax, word [eax + 2]
or ax, 0x20
cmp ax, 0x61
jne 0x10067282
mov dword [ebp - 0x88], ebx
jmp 0x1006725a
mov dword [ebp - 0xd4], ebx
xor eax, eax
mov dword [ebp - 0x230], ebx
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x100e392c
push edi
mov dword [ebp - 0x1d4], 0xebd0a0a2
mov word [ebp - 0x1d0], 0xb9e5
mov word [ebp - 0x1ce], 0x4433
mov byte [ebp - 0x1cc], 0x87
mov byte [ebp - 0x1cb], 0xc0
mov byte [ebp - 0x1ca], 0x68
mov byte [ebp - 0x1c9], 0xb6
mov byte [ebp - 0x1c8], 0xb7
mov byte [ebp - 0x1c7], 0x26
mov byte [ebp - 0x1c6], 0x99
mov byte [ebp - 0x1c5], 0xc7
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x48], str.MS_Basic_Data
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x194], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp + 0x52], 0
jne 0x10067371
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.10053a89
pop ecx
pop ecx
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2d
jne 0x100673a0
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.10045b88
add esp, 4
test al, al
jne 0x100673a0
mov ecx, edx
mov byte [ebp - 0x8d], 1
mov dword [ebp + 0x78], ecx
jmp 0x100673a0
push ebx
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.100563b5
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x1a0], eax
jne 0x1006739d
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x1006b3fc
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2b
jne 0x100673b0
mov al, byte [ecx]
inc ecx
inc ecx
mov byte [ebp - 0x5d], al
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2d
jne 0x100673c1
lea eax, [ebp + 0x78]
push eax
call fcn.10008e60
jmp 0x100673d5
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.1004bca7
pop ecx
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x40
pop ecx
mov byte [ebp - 0x40], 1
jne 0x100673ec
inc eax
inc eax
mov dword [ebp + 0x78], eax
mov byte [ebp - 0x40], 0
cmp word [eax], 0x2d
jne 0x100673fd
lea eax, [ebp + 0x78]
push eax
call fcn.10008e60
jmp 0x10067411
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.1004bca7
pop ecx
mov dword [ebp - 0x194], eax
cmp byte [ebp + 0x52], 0
pop ecx
je 0x10067477
push ebx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.100563b5
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.1004bbf7
add esp, 0x14
cmp byte [ebp + 7], 0
mov dword [ebp - 0x19c], eax
je 0x10067477
mov ecx, dword [ebp - 0x174]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
jne 0x10067477
mov eax, dword [ebp - 0x178]
or dword [ebp - 0x174], edx
or byte [ebp + 7], 0x20
mov dword [ebp - 0x178], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x1dc], ebx
mov cx, word [eax]
cmp cx, 0x2d
je 0x100674ce
cmp byte [ebp + 0x52], 0
je 0x100674ce
cmp cx, bx
je 0x100674ce
mov dword [ebp - 0x1d8], eax
push ebx
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.1001a65a
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x1dc]
add esp, 0xc
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x48], eax
mov word [eax + ecx*2], bx
cmp byte [ebp + 0x5b], 1
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x59], 0
je 0x100674e9
cmp byte [ebp + 0x5b], 4
jge 0x100674e9
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xf0]
push 5
push ebx
mov edi, ebx
push 0x100d09fc
mov dword [ebp + 0x78], edi
call fcn.10040df5
add esp, 0xc
test al, al
je 0x100675ca
lea ecx, [ebx + 0xa]
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2a
mov edi, ecx
jne 0x1006756a
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x10]
add ecx, 2
push eax
mov dword [ebp - 0x10], ecx
call fcn.1004bca7
mov edi, dword [ebp - 0x10]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x59], 1
jne 0x10067565
lea eax, [ebp - 0x114]
push eax
inc edi
lea eax, [ebp - 0x10]
inc edi
push eax
mov dword [ebp - 0x10], edi
call fcn.1004bca7
mov edi, dword [ebp - 0x10]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x59], 0x11
jne 0x10067565
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x78], ecx
xor edx, edx
mov dx, word [ecx]
cmp dx, 0x5c
je 0x1006759a
cmp dx, 0x2f
je 0x1006759a
mov byte [ebp - 0x29], 1
jmp 0x1006759a
mov eax, edx
call fcn.10002df6
test al, al
jne 0x1006759f
cmp dx, 0x23
je 0x1006759f
inc ecx
inc ecx
mov dword [ebp + 0x78], ecx
mov dx, word [ecx]
test dx, dx
jne 0x10067581
sub ecx, edi
sar ecx, 1
test ecx, ecx
jle 0x100675bb
push ecx
push edi
lea ecx, [ebp - 0xdc]
call fcn.10046247
mov dword [ebp - 0xc], 0xfffc0000
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
mov edi, dword [ebp + 0x78]
pop ecx
jmp 0x1006760a
push 2
push ebx
push 0x100d09f8
call fcn.10040df5
add esp, 0xc
test al, al
je 0x100675e4
lea edi, [ebx + 4]
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.10014a5c
test al, al
je 0x10067602
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.10042554
mov edi, dword [ebp + 0x78]
pop ecx
pop ecx
cmp word [ebx], 0
setne byte [ebp - 0x3f]
push 0
push 0x200
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call fcn.100b4200
mov dword [ebp - 0x3c], eax
mov ax, word [edi]
cmp ax, 0x23
mov dword [ebp - 0x38], edx
je 0x10067641
cmp ax, 0x3a
jne 0x100676e5
cmp ax, 0x23
jne 0x10067645
or byte [ebp + 9], 4
inc edi
inc edi
push 2
push edi
push 0x100d09f4
mov dword [ebp + 0x78], edi
call fcn.10040df5
push 2
push edi
push 0x100d09f0
mov byte [ebp + 0x6a], al
call fcn.10040df5
mov byte [ebp + 0x23], al
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
add esp, 0x18
neg al
sbb al, al
inc al
cmp byte [ebp + 0x6a], 0
mov byte [ebp - 0x44], al
jne 0x10067691
cmp word [edi], 0x2b
jne 0x10067691
inc edi
inc edi
mov byte [ebp - 0x3d], 1
mov dword [ebp + 0x78], edi
cmp byte [ebp + 0x23], 0
jne 0x100676b5
mov ax, word [edi]
cmp ax, 0x40
je 0x100676ac
cmp ax, 0x2d
je 0x100676ac
cmp ax, 0x3d
jne 0x100676b5
or dword [ebp + 8], 2
inc edi
inc edi
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.10014a5c
test al, al
je 0x100676e5
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.10053a89
test eax, eax
pop ecx
pop ecx
jle 0x100676e5
xor eax, eax
cmp dword [ebp + 0x60], eax
mov byte [ebp - 0x43], 1
jne 0x100676e5
mov byte [ebp + 0x6a], 1
jmp 0x100676ec
xor eax, eax
cmp dword [ebp + 0x60], eax
jg 0x10067702
cmp byte [ebp + 0x5b], 0
jg 0x10067702
cmp dword [ebp - 0x78], eax
jne 0x10067702
cmp dword [ebp - 0xd8], eax
mov dword [ebp + 0x5c], eax
je 0x10067709
mov dword [ebp + 0x5c], 1
cmp byte [ebp + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
je 0x1006772a
cmp dword [ebp + 0x5c], eax
jne 0x1006772a
cmp word [ebx], ax
jne 0x1006772a
mov eax, 0xfffc0000
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xdc]
xor ebx, ebx
lea edi, [ebp - 0x2e0]
mov word [ebp - 0x2e0], bx
cmp word [eax], bx
mov dword [ebp - 0x34], edi
je 0x1006774c
mov edi, eax
mov dword [ebp - 0x34], edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x2e0]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp byte [ebp - 0x41], 0
jg 0x1006779f
mov eax, dword [ebp - 0xcc]
or eax, dword [ebp - 0xc8]
jne 0x1006779f
push 0x11
push edi
push str..PhysicalDrive
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1006779f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
add edi, 0x22
push eax
mov dword [ebp - 0x20], edi
call fcn.10049634
pop ecx
pop ecx
cmp byte [ebp + 0x64], 0
jne 0x100677b1
cmp byte [ebp + 0x65], 0
jne 0x100677b1
cmp byte [ebp + 0x6b], 0
je 0x100677c5
cmp dword [ebp - 0xc], ebx
jge 0x100677c5
cmp dword [ebp - 8], ebx
jge 0x100677c5
push 0x100e392c
jmp 0x10069030
cmp byte [ebp + 0x50], 0
mov edi, 0x80070057
mov dword [ebp + 0x6c], ebx
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
mov byte [ebp + 0x66], 0
je 0x10067895
cmp dword [ebp - 8], ebx
jge 0x100677fe
cmp dword [ebp - 0x70], esi
jl 0x100677fe
jg 0x100677f5
cmp dword [ebp - 0x74], esi
jbe 0x100677fe
cmp dword [ebp + 0x34], ebx
je 0x10067895
mov eax, dword [ebp + 0x34]
cmp eax, ebx
je 0x10067833
cmp word [eax], 0x2a
jne 0x10067833
xor eax, eax
mov al, byte [ebp + 0x50]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 8]
call fcn.1005658b
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
or byte [0x100e3478], 0x20
pop ecx
mov byte [ebp + 0x66], 0x20
cmp dword [ebp - 8], ebx
jge 0x10067848
cmp dword [ebp - 0x70], esi
jl 0x10067848
jg 0x10067844
cmp dword [ebp - 0x74], esi
jbe 0x10067848
cmp eax, ebx
je 0x10067895
push eax
xor eax, eax
mov al, byte [ebp + 0x50]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 8]
call fcn.1000572f
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x70]
add esp, 0x1c
cmp eax, esi
je 0x1006788e
or byte [ebp + 0x66], 0x10
or byte [0x100e3478], 0x10
jmp 0x10067895
mov byte [0x100e3478], 0
cmp byte [ebp - 0x21], 0
jbe 0x10067acc
cmp byte [ebp + 0x52], 0
jne 0x10067acc
cmp dword [ebp - 0xc], ebx
jge 0x100678bd
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
je 0x1006797a
mov eax, dword [ebp - 0x68]
cmp eax, ebx
jle 0x100678cd
cmp eax, dword [ebp + 0x60]
je 0x1006797a
cmp dword [ebp + 0x60], 4
jg 0x1006797a
cmp byte [ebp + 0x13], 2
jl 0x1006797a
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.10005b9d
mov ebx, dword [ebp + 0x6c]
cmp ebx, esi
je 0x10067a1f
push 0x800
push 1
push esi
push ebx
call fcn.1004b0ea
mov esi, 0x200
push esi
push ebx
mov dword [ebp - 0x50], eax
call fcn.1004342a
add esp, 0x18
cmp eax, esi
mov edi, eax
jge 0x10067931
mov edi, esi
lea eax, [edi + edi*2]
push eax
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x34], edi
call fcn.10045fcc
mov eax, dword [ebp + 0x14]
lea esi, [eax + edi]
lea eax, [edi - 1]
not eax
and esi, eax
push 0
lea eax, [ebp - 0x58]
push eax
push edi
mov dword [ebp - 0x30], esi
add esi, edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006799a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x10067972
inc edi
lea ecx, [ebp + 0x14]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
push 0x100e392c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1006b3fc
push 0x200
push esi
push dword [ebp - 0x30]
call fcn.100144ff
dec dword [ebp - 0x68]
mov edi, dword [ebp - 0x68]
dec dword [ebp + 0x60]
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp + 0x60]
or byte [ebp - 0x21], 2
shl edi, 4
lea eax, [eax + edi + 0x1be]
push 0x10
push eax
shl ebx, 4
lea eax, [esi + ebx + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
call fcn.100144ff
mov eax, dword [ebp - 0x30]
lea eax, [eax + ebx + 0x1be]
push 0x10
push eax
lea eax, [esi + edi + 0x1be]
push eax
call fcn.100144ff
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x34
test eax, eax
je 0x10067a42
lea ecx, [ebp + 0x14]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
push 0x100e392c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
jmp 0x1006b3fc
push dword [ebp + 0x34]
xor edi, edi
push esi
push dword [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x10067a89
push edi
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x34]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10067a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x10067a7d
xor eax, eax
inc eax
mov dword [ebp - 4], eax
push dword [ebp + 0x6c]
call fcn.10043a48
pop ecx
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x47]
lea ecx, [ebp + 0x14]
or byte [ebp + 0x65], al
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x65]
or al, byte [ebp + 0x47]
je 0x10067aad
mov dword [ebp + 0x5c], edi
call fcn.1003f96c
jmp 0x1006a29b
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
push 0x100e392c
jmp 0x1006b3f3
cmp byte [ebp + 0x64], 0x10
mov dword [ebp - 0x1c], ebx
jne 0x10067ae2
test byte [ebp + 0x6b], 0x20
jne 0x1006a29b
or esi, 0xffffffff
mov edi, dword [ebp - 0xf0]
xor ebx, ebx
cmp byte [ebp + 0x50], bl
je 0x10067b37
cmp dword [ebp + 0x5c], ebx
jne 0x10067b37
cmp byte [ebp + 0x47], bl
jne 0x1006a29b
cmp byte [ebp + 0x65], bl
jne 0x1006a29b
cmp byte [ebp + 0x6b], bl
jne 0x1006a29b
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
test eax, eax
je 0x10067b2f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x10]
jmp 0x1006b3fc
cmp dword [ebp - 0x78], ebx
jne 0x1006a396
cmp dword [ebp - 0xd8], ebx
jne 0x1006a721
mov al, byte [ebp + 0x5b]
cmp al, 6
mov dword [ebp - 4], 0x80070057
je 0x1006ab46
cmp al, 1
je 0x1006ac4f
cmp al, 2
jne 0x10067b74
cmp byte [ebp - 0x41], 0
je 0x1006ac8f
cmp al, 8
jne 0x10067b82
cmp byte [ebp - 0x41], 0
je 0x1006acef
cmp al, 3
mov dword [ebp + 0x54], ebx
je 0x1006ad87
cmp al, 4
je 0x1006b877
cmp al, 5
je 0x1006b877
cmp al, 7
je 0x1006ae58
cmp byte [ebp + 0x23], 0
je 0x10067bc7
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x6a], 0
mov dword [ebp - 4], ebx
je 0x10067bd7
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x10], 0
je 0x10067bf2
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
cmp byte [ebp - 0x3f], 0
je 0x10067c01
cmp dword [ebp - 8], ebx
jl 0x1006b04e
cmp byte [ebp - 0x44], 0
je 0x10067c10
cmp dword [ebp + 0x60], ebx
jl 0x1006b04e
test byte [ebp - 0x21], 2
jne 0x10067c19
dec dword [ebp + 0x60]
cmp byte [ebp + 0x52], 0
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], esi
mov byte [ebp + 0x12], 0
mov byte [ebp - 0x42], 0
mov dword [ebp - 0x14c], ebx
mov byte [ebp - 0x5a], 0
mov byte [ebp - 0x5b], 0
mov dword [ebp - 0x94], ebx
jne 0x10067c6c
cmp dword [ebp - 0x64], ebx
jne 0x10067c6c
mov eax, dword [ebp + 0x48]
or eax, dword [ebp + 0x4c]
jne 0x10067c6c
mov eax, dword [ebp + 0x28]
or eax, dword [ebp + 0x2c]
jne 0x10067c6c
mov byte [ebp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [ebp - 0x9e], 1
je 0x10067c9e
cmp dword [ebp + 0x4c], ebx
jl 0x10067c9e
jg 0x10067c88
cmp dword [ebp + 0x48], ebx
jb 0x10067c9e
cmp dword [ebp + 0x2c], ebx
jl 0x10067c9e
jg 0x10067c95
cmp dword [ebp + 0x28], 1
jb 0x10067c9e
mov dword [ebp + 0x34], 1
jmp 0x10067ca1
mov dword [ebp + 0x34], ebx
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.10005b9d
cmp dword [ebp + 0x6c], ebx
je 0x1006af5e
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.1004342a
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp + 0x40], eax
jge 0x10067cdf
mov dword [ebp + 0x40], edi
cmp dword [ebp + 0x34], ebx
je 0x10067d50
cmp dword [ebp + 0x4c], ebx
jl 0x10067d17
jg 0x10067cf0
cmp dword [ebp + 0x48], ebx
jb 0x10067d17
mov eax, dword [ebp + 0x40]
push ebx
push ebx
push ebx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push ebx
push edi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.100b4200
push edx
push eax
push dword [ebp - 8]
lea ecx, [ebp + 0x66]
call fcn.10043ac9
cmp byte [ebp + 0x6a], 0
jne 0x10067d50
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xcc]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc8]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.1003eb47
add esp, 0x18
lea ecx, [ebp + 0x66]
call fcn.10043b07
mov dword [ebp - 0x10], ebx
push 0x800
push 1
push ebx
push dword [ebp + 0x6c]
call fcn.1004b0ea
add esp, 0x10
cmp dword [ebp - 8], ebx
mov dword [ebp - 0x50], eax
jl 0x10067da2
cmp byte [ebp + 0x64], 0x20
je 0x10067d77
cmp byte [ebp + 0x64], 0x10
jne 0x10067d7c
cmp eax, 0xb
je 0x10067d9e
test byte [ebp + 0x65], 0x20
jne 0x10067d9e
cmp byte [ebp + 0x65], 0
je 0x10067d8d
cmp eax, 0xb
je 0x10067d9e
test byte [ebp + 0x6b], 0x20
jne 0x10067d9e
cmp byte [ebp + 0x6b], 0
je 0x10067da2
cmp eax, 0xb
jne 0x10067da2
or dword [ebp - 0x1c], 1
cmp byte [ebp - 0x29], 0
jg 0x10067dc4
cmp byte [ebp + 0x47], 0
jne 0x10067dc0
cmp byte [ebp + 0x64], 1
je 0x10067dc0
cmp byte [ebp + 0x64], 0x20
je 0x10067dc0
cmp byte [ebp + 0x65], 0
je 0x10067dc4
or dword [ebp - 0x1c], 2
cmp byte [ebp + 0x64], 1
je 0x10067dd0
cmp byte [ebp + 0x64], 0x20
jne 0x10067dd4
or dword [ebp - 0x1c], 4
mov cl, byte [ebp + 0x6b]
and cl, 0x20
jne 0x10067df2
cmp byte [ebp + 0x6b], 0
je 0x10067de7
cmp eax, 0xb
je 0x10067df2
test byte [ebp + 0x64], 0x10
je 0x10067df6
cmp eax, 0xc
je 0x10067df6
or dword [ebp - 0x1c], 8
cmp byte [ebp - 0x29], 0
jg 0x10067e00
or dword [ebp - 0x1c], 0x10
cmp byte [ebp + 0x64], 0x10
jne 0x10067e0a
or dword [ebp - 0x1c], 0x20
cmp byte [ebp + 0x50], 0
je 0x10067e15
cmp dword [ebp + 0x5c], ebx
jne 0x10067e19
or dword [ebp - 0x1c], 0x40
cmp byte [ebp + 0x64], 0x18
jne 0x10067e23
or byte [ebp - 0x1c], 0x80
cmp eax, 0xc
jne 0x10067e38
cmp byte [ebp + 0x65], 0
jne 0x10067e34
cmp byte [ebp + 0x47], 0
je 0x10067e38
or byte [ebp - 0x1b], 1
cmp byte [ebp + 0x50], 0
je 0x10067e43
cmp dword [ebp + 0x5c], ebx
je 0x10067e53
cmp byte [ebp + 0x64], 0x10
jne 0x10067e4d
test cl, cl
jne 0x10067e53
cmp byte [ebp + 0x64], 0
je 0x10067e5b
mov dword [ebp + 0x5c], ebx
jmp 0x1006a293
cmp dword [ebp - 0x64], 0xff
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
jg 0x1006af6b
cmp byte [ebp + 0x6a], 0
jne 0x10067ebf
cmp dword [ebp + 0x60], ebx
jge 0x10067ebf
cmp dword [ebp + 0x4c], ebx
jg 0x1006af6b
jl 0x10067e93
cmp dword [ebp + 0x48], ebx
jae 0x1006af6b
cmp dword [ebp + 0x2c], ebx
jg 0x1006af6b
jl 0x10067ea7
cmp dword [ebp + 0x28], ebx
jae 0x1006af6b
cmp dword [ebp - 0x64], ebx
jge 0x1006af6b
mov dword [ebp - 0x64], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
cmp byte [ebp + 0x6a], 0
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x1b4], esi
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp + 0x14], eax
jne 0x10067f04
cmp byte [ebp + 0x23], 0
jne 0x10067f04
cmp eax, 4
jl 0x100684f5
cmp byte [ebp + 0x52], 0
jne 0x100684f5
cmp byte [ebp + 0x51], 0
jne 0x100684f5
cmp byte [ebp + 0x6a], 0
je 0x10067f25
mov dword [ebp + 0x60], 4
cmp dword [ebp - 0x64], 5
je 0x1006b04e
cmp dword [ebp - 0x64], 0xf
je 0x1006b04e
push 0x100000
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0x5c], ebx
call fcn.10002da5
lea eax, [ebp + 0x5c]
push eax
push dword [ebp - 0x4c]
push dword [ebp + 0x6c]
call fcn.100437ab
mov edx, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov edi, eax
jne 0x10067f9f
cmp edx, ecx
jge 0x10067f72
cmp ecx, 4
jge 0x10067f97
cmp byte [ebp + 0x6a], 0
jne 0x10067f9f
cmp byte [ebp + 0x23], 0
jne 0x10067f9f
lea eax, [ecx + 1]
mov byte [ebp + 0x3b], 0
call fcn.1004378c
cmp eax, ebx
jle 0x10067f97
cmp eax, edx
jl 0x10067fd6
cmp ecx, 4
jle 0x10067fd6
lea ecx, [ebp - 0x4c]
jmp 0x1006b049
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x3b], 1
jne 0x10067fd1
cmp byte [ebp + 0x6a], 0
je 0x10067fd6
cmp dword [ebp - 0x64], ebx
jl 0x10067f97
cmp word [ebp - 0x88], bx
jle 0x10067fc9
mov dword [ebp - 0x88], 0x80
jmp 0x10067fd6
mov dword [ebp - 0x88], ebx
jmp 0x10067fd6
cmp edx, 4
jle 0x10067f97
cmp edx, 4
jle 0x10067fe6
lea eax, [edx - 4]
and eax, 0xfffffffc
mov dword [ebp + 0x30], eax
jmp 0x10067fe9
mov dword [ebp + 0x30], ebx
cmp byte [ebp + 0x3b], 0
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x14], esi
jne 0x10068009
cmp ecx, 4
jl 0x10068006
lea eax, [ecx*4 - 0x10]
mov dword [ebp + 0x30], eax
jmp 0x10068009
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x24], esi
xor edx, edx
lea eax, [edi + 0x50]
mov cl, byte [eax]
cmp cl, 5
je 0x1006801d
cmp cl, 0xf
jne 0x10068020
mov dword [ebp + 0x24], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x10068011
cmp byte [ebp + 0x3b], 0
je 0x1006803a
cmp dword [ebp + 0x24], ebx
jl 0x10067f97
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
push 0
shl eax, 4
lea esi, [eax + edi + 0x30]
mov ebx, 0x200
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x20], esi
push dword [esi + 8]
call fcn.100b4150
push 0
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0x100], eax
push dword [esi + 0x10]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], edx
call fcn.100b4150
mov ebx, eax
mov eax, dword [ebp + 0x30]
lea eax, [eax + eax*8]
shl eax, 4
cmp byte [ebp + 0x23], 0
mov dword [ebp - 0x1fc], edx
lea esi, [eax + edi + 0x30]
je 0x10068166
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp eax, 8
jne 0x100680ba
mov ecx, dword [ebp - 0x100]
mov edx, dword [ebp - 0xfc]
jmp 0x1006810d
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + edi + 0x30]
lea eax, [edi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x100680ec
cmp cl, 0xf
je 0x100680ec
inc esi
add eax, 0x90
cmp esi, 4
jl 0x100680cd
lea ecx, [ebp - 0x4c]
jmp 0x10069009
push 0
push 0x200
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.100b4150
mov ecx, eax
mov eax, dword [edi + 0x24]
xor edi, edi
sub ecx, eax
sbb edx, edi
test esi, esi
jl 0x100680e4
and dword [ebp - 0x258], 0
xor eax, eax
add ecx, dword [ebp - 0xcc]
lea edi, [ebp - 0x254]
adc edx, dword [ebp - 0xc8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x258]
push eax
push edx
push ecx
push dword [ebp + 0x6c]
call fcn.1005628b
and dword [ebp - 4], 0
add esp, 0x14
cmp byte [ebp + 0x6b], 0
jne 0x1006815a
cmp byte [ebp + 0x65], 0
jne 0x1006815a
cmp byte [ebp + 0x47], 0
je 0x1006af8f
and dword [ebp + 0x5c], 0
lea ecx, [ebp - 0x4c]
jmp 0x1006a28e
cmp dword [ebp + 0x5c], 4
jg 0x10068174
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x3c], eax
jmp 0x1006819f
xor edx, edx
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x10068185
cmp cl, 0xf
jne 0x10068188
mov dword [ebp + 0x3c], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x10068179
cmp byte [ebp + 0x3b], 0
jne 0x1006819f
mov eax, dword [ebp + 0x30]
add dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], 0
jge 0x100681af
cmp byte [ebp + 0x6a], 0
je 0x100680e4
cmp byte [ebp + 0x3b], 0
je 0x100681bb
and dword [ebp + 0x14], 0
jmp 0x100681e5
xor edx, edx
lea eax, [esi + 0x260]
mov cl, byte [eax]
test cl, cl
jne 0x100681cd
test edx, edx
jne 0x100681da
cmp cl, 5
je 0x100681da
cmp cl, 0xf
je 0x100681da
mov dword [ebp + 0x14], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x100681c3
cmp byte [ebp + 0x3b], 0
jne 0x100681f5
cmp dword [ebp + 0x14], 0
jl 0x100680e4
cmp byte [ebp + 0x6a], 0
je 0x10068426
mov eax, dword [ebp + 0x30]
test eax, eax
jg 0x10068209
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
shl eax, 4
lea eax, [eax + edi + 0x30]
mov ecx, dword [eax + 8]
push 0
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 0xc]
push 0x200
push eax
push ecx
mov dword [ebp - 0x1a4], eax
call fcn.100b4150
cmp dword [ebp + 0x5c], 4
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], edx
jle 0x10068334
cmp dword [ebp + 0x3c], 0
jge 0x10068334
cmp byte [esi + 0x20], 0
je 0x100682eb
mov eax, dword [ebp + 0x5c]
cmp eax, 8
jle 0x1006826b
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x1006826e
mov eax, dword [ebp + 0x24]
push 0
lea eax, [eax + eax*8]
push 0x200
shl eax, 4
push dword [eax + edi + 0x3c]
push dword [eax + edi + 0x38]
call fcn.100b4150
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x168], eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 8]
push 0
adc ecx, dword [esi + 0xc]
push 0x200
push ecx
push eax
mov dword [ebp - 0x164], edx
call fcn.100b4150
mov ecx, eax
sub ecx, dword [ebp - 0x188]
mov dword [ebp - 0x1b4], ecx
mov ecx, edx
sbb ecx, dword [ebp - 0x184]
sub ebx, eax
mov dword [ebp - 0x1b0], ecx
mov ecx, dword [ebp - 0x1fc]
sbb ecx, edx
add ebx, dword [ebp - 0x188]
adc ecx, dword [ebp - 0x184]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ecx
jmp 0x10068378
cmp dword [ebp + 0x30], 4
jne 0x1006af97
mov eax, dword [ebp + 0x24]
test eax, eax
jl 0x1006af97
mov ecx, dword [ebp - 0x20]
cmp byte [ecx + 0x20], 0
je 0x1006af97
mov edx, dword [ebp - 0xfc]
or dword [ebp + 0x30], 0xffffffff
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], edx
jmp 0x10068370
cmp dword [ebp + 0x30], 0
jle 0x1006835a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
mov eax, dword [eax + 0x14]
adc eax, dword [ebp - 0x1a4]
push 0
push 0x200
push eax
push ecx
call fcn.100b4150
mov ecx, dword [ebp - 0x1fc]
sub ebx, eax
sbb ecx, edx
add ebx, dword [ebp - 0x188]
adc ecx, dword [ebp - 0x184]
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
test ecx, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edx
jl 0x100680e4
jg 0x10068396
test ebx, ebx
jbe 0x100680e4
cmp byte [ebp - 0x5d], 0
je 0x100683a2
add dword [ebp + 0x48], eax
adc dword [ebp + 0x4c], edx
mov edi, eax
add edi, 1
mov esi, edx
adc esi, 0
cmp dword [ebp + 0x4c], esi
jg 0x100683be
jl 0x100683b8
cmp dword [ebp + 0x48], edi
ja 0x100683be
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], esi
sub ebx, dword [ebp + 0x48]
sbb ecx, dword [ebp + 0x4c]
add ebx, eax
adc ecx, edx
cmp dword [ebp + 0x2c], ecx
jl 0x100683da
jg 0x100683d4
cmp dword [ebp + 0x28], ebx
jbe 0x100683da
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ecx
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x100680e4
jg 0x100683f0
cmp dword [ebp + 0x28], eax
jb 0x100680e4
cmp dword [ebp + 0x30], eax
mov eax, dword [ebp + 0x5c]
jle 0x10068404
dec eax
and eax, 0xfffffffc
call fcn.1004379b
inc eax
jmp 0x1006840c
and eax, 0xfffffffc
call fcn.1004379b
mov dword [ebp + 0x60], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0xe0]
jmp 0x100684e0
mov eax, dword [ebp + 0x3c]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + edi + 0x30]
push 0
mov edi, 0x200
push edi
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.100b4150
push 0
push edi
push dword [esi + 0x14]
mov ebx, eax
push dword [esi + 0x10]
mov eax, edx
mov dword [ebp - 0x204], eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], eax
call fcn.100b4150
cmp byte [ebp - 0x5d], 0
je 0x1006847c
add dword [ebp + 0x48], ebx
mov ecx, dword [ebp - 0x204]
adc dword [ebp + 0x4c], ecx
xor esi, esi
cmp dword [ebp + 0x4c], esi
jl 0x100684a2
jg 0x1006848a
cmp dword [ebp + 0x48], esi
jbe 0x100684a2
mov ecx, dword [ebp - 0x204]
cmp dword [ebp + 0x4c], ecx
jg 0x100684a2
jl 0x1006849c
cmp dword [ebp + 0x48], ebx
ja 0x100684a2
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ecx
cmp dword [ebp + 0x2c], esi
jl 0x100684d4
jg 0x100684ae
cmp dword [ebp + 0x28], esi
jbe 0x100684d4
cmp dword [ebp + 0x2c], edx
jl 0x100684c0
jg 0x100684ba
cmp dword [ebp + 0x28], eax
jbe 0x100684c0
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], esi
jl 0x1006afac
jg 0x100684d4
cmp dword [ebp + 0x28], esi
jb 0x1006afac
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x170], ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x16c], eax
call fcn.1003f96c
xor ebx, ebx
mov edi, 0x200
cmp dword [ebp + 0x60], 4
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x16c]
setge byte [ebp - 0x5c]
add eax, dword [ebp - 0xcc]
push ebx
adc ecx, dword [ebp - 0xc8]
push edi
push ecx
push eax
call fcn.100b4200
cmp dword [ebp + 0x34], ebx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edx
je 0x10068568
cmp byte [ebp + 0x6a], 0
je 0x10068568
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xcc]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc8]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.1003eb47
add esp, 0x18
lea ecx, [ebp + 0x66]
call fcn.10043b07
mov dword [ebp - 0x10], ebx
push ebx
push dword [ebp - 0x144]
push dword [ebp - 0x148]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x10
cmp eax, dword [ebp - 0x148]
jne 0x1006b029
cmp edx, dword [ebp - 0x144]
jne 0x1006b029
mov esi, dword [ebp + 0x40]
lea eax, [esi + esi*2]
push eax
lea ecx, [ebp]
call fcn.10002da5
mov eax, dword [ebp]
push dword [ebp + 0x40]
lea edi, [eax + esi]
lea eax, [esi - 1]
not eax
and edi, eax
add esi, edi
push ebx
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp + 0x24], esi
call fcn.100b40f0
add esp, 0xc
push ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006b021
push dword [ebp + 0x40]
push esi
push edi
call fcn.100144ff
add esp, 0xc
cmp byte [ebp + 0x51], 0
je 0x100686dc
cmp byte [ebp + 0x52], 0
jne 0x100686dc
push esi
call fcn.10043a9b
cmp byte [ebp - 0x11], 0
pop ecx
jg 0x1006862d
jge 0x10068629
cmp dword [ebp - 0x38], ebx
mov eax, dword [ebp + 0x40]
lea eax, [eax + eax + 0x4000]
jg 0x1006862d
jl 0x10068629
cmp dword [ebp - 0x3c], eax
ja 0x1006862d
xor al, al
jmp 0x1006862f
mov al, 1
cmp byte [ebp + 0x51], 1
jne 0x1006866d
test al, al
je 0x1006865b
cmp dword [ebp + 0x40], 0x200
jbe 0x1006865b
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
lea eax, [esi + 0x200]
push ebx
push eax
call fcn.100b40f0
add esp, 0xc
push 0x40
lea eax, [esi + 0x1be]
push ebx
push eax
call fcn.100b40f0
add esp, 0xc
push dword [ebp + 0x40]
mov word [esi + 0x1fe], 0xaa55
push esi
push edi
call fcn.1003fa82
add esp, 0xc
test eax, eax
je 0x100686bc
push ebx
push dword [ebp - 0x144]
push dword [ebp - 0x148]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x10
push ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
mov dword [ebp - 0x58], ebx
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x65]
or al, byte [ebp + 0x47]
je 0x1006afd8
cmp dword [ebp - 0xc], ebx
jl 0x1006afd8
mov dword [ebp + 0x5c], ebx
jmp 0x1006a28b
cmp byte [ebp + 0x5b], 2
je 0x100686f8
cmp byte [ebp + 0x13], 0
jne 0x100686f8
cmp byte [ebp - 0x43], 0
je 0x10068707
cmp dword [ebp + 0x60], 1
jle 0x1006b046
cmp byte [ebp - 0x43], 0
je 0x10068707
cmp dword [ebp + 0x60], ebx
jl 0x1006b046
push 0x200010
lea ecx, [ebp + 0x18]
call fcn.10002da5
xor esi, esi
cmp word [ebp - 0x88], bx
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x58], ebx
mov byte [ebp + 0x53], 0xff
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x17c], ebx
jl 0x10068747
mov esi, dword [ebp + 0x60]
inc esi
cmp word [ebp - 0x88], bx
jne 0x10068747
neg esi
movzx esi, si
mov eax, esi
or eax, dword [ebp - 0xd4]
push eax
lea eax, [ebp + 0x53]
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x6c]
call fcn.1004c08b
mov al, byte [ebp + 0x53]
add esp, 0x14
cmp esi, ebx
je 0x10068776
test al, al
jge 0x1006b004
cmp al, 0x10
jl 0x1006877c
and al, 0xf
test al, al
jl 0x1006878f
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
or al, byte [ebp + 0x10]
jne 0x1006b03e
cmp dword [ebp - 8], ebx
jl 0x100687b3
push dword [ebp + 0x6c]
mov esi, dword [ebp + 0x18]
call fcn.100435bd
pop ecx
push ebx
push dword [ebp + 0x40]
push edx
push eax
call fcn.100b4150
mov esi, dword [ebp - 0x110]
jmp 0x1006881a
mov esi, dword [ebp - 0x110]
cmp esi, ebx
jl 0x100687d9
jg 0x100687c7
cmp dword [ebp - 0x114], ebx
jb 0x100687d9
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], esi
lea eax, [ebp - 0x27c]
push eax
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10068860
test byte [ebp - 0x27c], 0x10
jne 0x10068860
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x25c]
and eax, 0xfffffe00
xor edx, edx
shld edx, eax, 0x17
shl eax, 0x17
shr ecx, 9
xor edi, edi
or eax, ecx
or edx, edi
sub eax, dword [ebp - 0xcc]
sbb edx, dword [ebp - 0xc8]
cmp esi, ebx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], edx
jl 0x10068860
jg 0x10068840
cmp dword [ebp - 0x114], ebx
jbe 0x10068860
cmp edx, esi
ja 0x10068860
jb 0x1006884e
cmp eax, dword [ebp - 0x114]
jae 0x10068860
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], esi
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x6c]
call fcn.100437ab
mov esi, eax
mov eax, dword [ebp - 0xdc]
mov cx, word [eax]
add esp, 0xc
cmp cx, bx
jne 0x10068890
cmp esi, ebx
jne 0x10068894
test byte [ebp + 0x51], 0x10
je 0x1006b03e
cmp esi, ebx
je 0x10068898
mov eax, dword [esi]
jmp 0x1006889a
xor eax, eax
cmp eax, 1
sete byte [ebp + 0x53]
cmp byte [ebp + 0x53], 0
je 0x100688b4
cmp byte [ebp - 0x9d], 0
mov byte [ebp + 0x11], 1
je 0x100688b8
mov byte [ebp + 0x11], 0
cmp byte [ebp - 0x95], 0
jne 0x100688e3
cmp byte [ebp + 0x51], 0
jne 0x100688e3
cmp byte [ebp + 0x11], 0
je 0x100688d9
cmp byte [ebp + 0x52], 0
je 0x1006b03e
jmp 0x100688e3
cmp byte [ebp + 0x52], 0
jne 0x1006b03e
cmp cx, bx
mov eax, dword [ebp - 0x140]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp + 0x30], eax
jne 0x100689b0
xor eax, eax
mov dword [ebp - 0x248], ebx
lea edi, [ebp - 0x244]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
push 0x18
lea eax, [ebp - 0x248]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x13c], ebx
jg 0x10068960
jl 0x1006894a
cmp dword [ebp - 0x140], ebx
ja 0x10068960
mov eax, dword [ebp - 0x23c]
mov dword [ebp + 0x5c], eax
cdq
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x12c], ebx
jg 0x10068988
jl 0x10068972
cmp dword [ebp - 0x130], ebx
ja 0x10068988
mov eax, dword [ebp - 0x238]
mov dword [ebp + 0x3c], eax
cdq
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x150], ebx
jg 0x100689b0
jl 0x1006899a
cmp dword [ebp - 0x154], ebx
ja 0x100689b0
mov eax, dword [ebp - 0x234]
mov dword [ebp + 0x30], eax
cdq
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x13c], ebx
jg 0x100689d6
jl 0x100689c2
cmp dword [ebp - 0x140], ebx
ja 0x100689d6
mov eax, 0xff
mov dword [ebp + 0x5c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], ebx
cmp dword [ebp - 0x12c], ebx
jg 0x100689fa
jl 0x100689e8
cmp dword [ebp - 0x130], ebx
ja 0x100689fa
push 0x3f
pop eax
mov dword [ebp + 0x3c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x150], ebx
jg 0x10068a2d
jl 0x10068a0c
cmp dword [ebp - 0x154], ebx
ja 0x10068a2d
mov eax, dword [ebp + 0x40]
cmp eax, ebx
mov dword [ebp + 0x30], eax
ja 0x10068a1d
mov dword [ebp + 0x30], 0x200
mov eax, dword [ebp + 0x30]
cdq
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
mov eax, dword [ebp + 0x30]
cdq
mov edi, 0x200
mov ecx, edi
idiv ecx
cmp byte [ebp + 0x11], 0
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x40]
lea ebx, [ecx + eax]
lea ecx, [ebx + eax]
mov dword [ebp - 0x18], ecx
jne 0x10069438
cmp byte [ebp + 0x52], 0
jne 0x10069438
cmp byte [ebp + 0x10], 0
mov byte [ebp + 0x53], 0
jne 0x10068f0c
xor ebx, ebx
cmp dword [ebp + 0x4c], ebx
jg 0x10068a90
jl 0x10068a7c
cmp dword [ebp + 0x48], ebx
jae 0x10068a90
cmp dword [ebp + 0x2c], ebx
jl 0x10068f0c
jg 0x10068a90
cmp dword [ebp + 0x28], ebx
jb 0x10068f0c
mov esi, dword [ebp + 0x60]
cmp esi, ebx
jl 0x10068f0c
push 0x100000
lea ecx, [ebp - 0x30]
call fcn.10002da5
mov eax, dword [ebp + 0x30]
imul eax, dword [ebp + 0x3c]
cdq
idiv edi
mov edi, eax
mov eax, dword [ebp + 0x5c]
imul eax, edi
cmp dword [ebp + 0x30], ebx
cdq
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jle 0x1006b036
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
jne 0x10068b0c
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 4], ebx
push dword [ebp + 0x6c]
call fcn.100437ab
add esp, 0xc
test eax, eax
je 0x1006b011
cmp esi, 4
jl 0x10068b0c
cmp byte [ebp + 0x6a], 0
jne 0x10068b0c
cmp esi, dword [ebp - 4]
jge 0x1006b036
xor eax, eax
xor edx, edx
cmp dword [ebp + 0x4c], ebx
jl 0x10068bc1
jg 0x10068b24
cmp dword [ebp + 0x48], ebx
jbe 0x10068bc1
mov ecx, dword [ebp - 0xb0]
and ecx, dword [ebp - 0xac]
cmp ecx, 0xffffffff
jne 0x10068b66
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + 0x4c], eax
jl 0x10068b61
jg 0x10068b4d
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + 0x48], eax
jb 0x10068b61
cmp byte [ebp - 0x5c], 0
jne 0x10068b61
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
jmp 0x10068bad
mov eax, edi
cdq
jmp 0x10068bab
cmp byte [ebp - 0x51], 0
jne 0x10068bc1
mov eax, dword [ebp + 0x30]
cdq
mov ecx, eax
add ecx, dword [ebp - 0xb0]
mov esi, edx
adc esi, dword [ebp - 0xac]
push edx
sub ecx, 1
push eax
sbb esi, ebx
push esi
push ecx
call fcn.100b4150
mov ecx, eax
mov eax, dword [ebp + 0x34]
mov esi, edx
cdq
push edx
push eax
push esi
push ecx
call fcn.100b4200
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
push edx
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.100439a4
add esp, 0x10
add dword [ebp + 0x48], eax
adc dword [ebp + 0x4c], edx
cmp dword [ebp + 0x2c], ebx
jl 0x10068bee
jg 0x10068bcd
cmp dword [ebp + 0x28], ebx
jbe 0x10068bee
cmp byte [ebp - 0x8d], 0
jne 0x10068bee
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], ebx
jg 0x10068bee
jl 0x10068be8
cmp dword [ebp + 0x28], ebx
jae 0x10068bee
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
cmp dword [ebp + 0x4c], ebx
jl 0x10068c08
jg 0x10068bfa
cmp dword [ebp + 0x48], ebx
jbe 0x10068c08
mov eax, dword [ebp + 0x4c]
mov esi, dword [ebp + 0x48]
mov dword [ebp - 0x1e4], eax
jmp 0x10068c10
xor esi, esi
mov dword [ebp - 0x1e4], esi
xor ebx, ebx
cmp dword [ebp + 0x2c], ebx
jl 0x10068cc4
jg 0x10068c26
cmp dword [ebp + 0x28], ebx
jbe 0x10068cc4
mov eax, dword [ebp - 0x84]
and eax, dword [ebp - 0x80]
cmp eax, 0xffffffff
jne 0x10068c5d
push dword [ebp - 0xa4]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x2c]
push dword [ebp - 0xa8]
add eax, esi
adc ecx, dword [ebp - 0x1e4]
push ecx
push eax
call fcn.100b64f0
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
jmp 0x10068cc4
cmp byte [ebp - 0x51], 0
jne 0x10068cc4
mov eax, dword [ebp + 0x30]
cdq
mov edi, eax
add eax, dword [ebp - 0x84]
mov ebx, edx
mov ecx, edx
adc ecx, dword [ebp - 0x80]
push ebx
sub eax, 1
push edi
sbb ecx, 0
push ecx
push eax
call fcn.100b4150
push ebx
push edi
push edx
push eax
call fcn.100b4200
push 0
push 0x200
push edx
push eax
call fcn.100b4150
mov ecx, dword [ebp + 0x28]
add ecx, esi
mov esi, dword [ebp + 0x2c]
adc esi, dword [ebp - 0x1e4]
push edx
push eax
push esi
push ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], edx
call fcn.100b64f0
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
xor ebx, ebx
cmp dword [ebp - 0x70], ebx
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x3b], 0
mov byte [ebp + 0x11], 0
jl 0x10068deb
jg 0x10068ce4
cmp dword [ebp - 0x74], ebx
jbe 0x10068deb
mov ecx, dword [ebp + 0x28]
sub ecx, dword [ebp - 0xe4]
mov esi, dword [ebp + 0x2c]
sbb esi, dword [ebp - 0xe0]
mov eax, dword [ebp + 0x34]
add ecx, dword [ebp + 0x48]
cdq
adc esi, dword [ebp + 0x4c]
push edx
push eax
push esi
push ecx
call fcn.100b4150
mov esi, eax
xor eax, eax
mov dword [ebp - 0x1c4], ebx
push 1
push dword [ebp + 0x5c]
lea edi, [ebp - 0x1c0]
push dword [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1b4]
lea eax, [ebp + 0x11]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x53]
push eax
push dword [ebp - 0x1b0]
mov dword [ebp - 0x74], esi
push edi
mov dword [ebp - 0x70], edx
call fcn.100439ce
mov al, byte [ebp + 0x3b]
add esp, 0x20
push 1
push dword [ebp + 0x5c]
mov byte [ebp - 0x1c3], al
mov al, byte [ebp + 0x11]
push dword [ebp + 0x3c]
mov byte [ebp - 0x1c2], al
mov al, byte [ebp + 0x53]
mov byte [ebp - 0x1c1], al
lea eax, [ebp + 0x11]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x53]
push eax
push ebx
push 2
push dword [ebp - 0x1b0]
mov byte [ebp - 0x1c4], 0
push edi
call fcn.100b4200
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.100439ce
mov al, byte [ebp + 0x3b]
mov byte [ebp - 0x1bf], al
mov al, byte [ebp + 0x11]
mov byte [ebp - 0x1be], al
mov al, byte [ebp + 0x53]
push 1
mov byte [ebp - 0x1bd], al
lea eax, [ebp - 0x1c4]
push eax
push dword [ebp - 0x164]
mov byte [ebp - 0x1c0], 5
push dword [ebp - 0x168]
mov dword [ebp - 0x1bc], edi
push dword [ebp + 0x6c]
mov dword [ebp - 0x1b8], esi
call fcn.1005628b
add esp, 0x34
mov eax, dword [ebp + 0x34]
cdq
mov ebx, edx
push ebx
mov edi, eax
push edi
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
call fcn.100b4150
cmp dword [ebp + 0x4c], 0
mov esi, eax
mov dword [ebp - 0x158], edx
jl 0x10068e39
jg 0x10068e1c
cmp dword [ebp + 0x48], 0
jb 0x10068e39
push ebx
push edi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.100b4150
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edx
xor eax, eax
jmp 0x10068e47
xor eax, eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp + 0x2c], eax
jl 0x10068e68
jg 0x10068e53
cmp dword [ebp + 0x28], eax
jb 0x10068e68
push ebx
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
call fcn.100b4150
mov dword [ebp - 0x124], edx
jmp 0x10068e6e
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
xor eax, eax
cmp dword [ebp + 0x60], 4
mov edi, dword [ebp - 0xf4]
setge al
push eax
push dword [ebp + 0x5c]
lea eax, [ebp + 0x12]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x42]
push eax
lea eax, [ebp - 0x14c]
push eax
push edi
push dword [ebp - 0xf8]
call fcn.100439ce
xor ecx, ecx
add esp, 0x20
cmp dword [ebp + 0x4c], ecx
jl 0x10068ec8
jg 0x10068eb6
cmp dword [ebp + 0x48], ecx
jbe 0x10068ec8
sub dword [ebp - 0xf8], esi
sbb edi, dword [ebp - 0x158]
mov dword [ebp - 0xf4], edi
mov al, byte [ebp - 0x5c]
mov edx, dword [ebp - 0x128]
mov byte [ebp + 0x53], al
movsx eax, al
push eax
push dword [ebp + 0x5c]
lea eax, [ebp - 0x5a]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x5b]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0xf8]
lea eax, [eax + edx - 1]
push ecx
push eax
call fcn.100439ce
add esp, 0x20
lea ecx, [ebp - 0x30]
call fcn.1003f96c
mov eax, dword [ebp + 0x40]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x24]
shl edi, 4
cmp byte [ebp + 0x5b], 2
lea ebx, [edi + esi]
je 0x1006b05b
push eax
push esi
push dword [ebp - 0x28]
call fcn.100144ff
add esp, 0xc
cmp dword [ebp - 0x70], 0
jl 0x10068f6c
jg 0x10068f3d
cmp dword [ebp - 0x74], 0
jb 0x10068f6c
cmp dword [ebp + 0x14], 0
jle 0x10068f55
push edi
push 0
add esi, 0x1be
push esi
call fcn.100b40f0
add esp, 0xc
push 0x30
pop eax
sub eax, edi
push eax
lea eax, [ebx + 0x1ce]
push 0
push eax
call fcn.100b40f0
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov al, byte [ebx + 0x1c2]
jne 0x10068f86
cmp byte [ebp + 0x13], 2
jge 0x10068f86
cmp al, 5
je 0x10068ffe
cmp al, 0xf
je 0x10068ffe
cmp byte [ebp + 0x6a], 0
mov esi, dword [ebx + 0x1c6]
mov edi, dword [ebx + 0x1ca]
jne 0x10069040
test al, al
je 0x10069040
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x10069042
cmp byte [ebp + 0x13], 2
jge 0x10069042
cmp byte [ebp - 0x5c], al
jne 0x10069042
cmp dword [ebp + 0x4c], eax
jl 0x10068fde
jg 0x10068fce
cmp dword [ebp + 0x48], eax
jb 0x10068fde
cmp dword [ebp - 0xf8], esi
jne 0x10068ffe
cmp dword [ebp - 0xf4], eax
jne 0x10068ffe
cmp dword [ebp + 0x2c], eax
jl 0x10069042
jg 0x10068fea
cmp dword [ebp + 0x28], eax
jb 0x10069042
cmp dword [ebp - 0x128], edi
jne 0x10068ffa
cmp dword [ebp - 0x124], eax
je 0x10069042
cmp edi, eax
je 0x10069042
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
test eax, eax
je 0x10069036
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0x80070057
jmp 0x1006b3fc
xor eax, eax
cmp byte [ebp + 0x10], 0
je 0x10069064
xor edi, edi
xor esi, esi
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x64]
cmp ecx, eax
jl 0x10069071
mov byte [ebx + 0x1c2], cl
mov ecx, dword [ebp - 0x88]
cmp cx, ax
jle 0x1006909e
cmp dword [ebp - 0xd4], eax
je 0x1006909e
mov edx, dword [ebp + 0x24]
lea eax, [edx + 0x1be]
mov byte [eax + 0x30], 0
mov byte [eax + 0x20], 0
mov byte [eax + 0x10], 0
mov byte [eax], 0
jmp 0x100690a1
mov edx, dword [ebp + 0x24]
test cx, cx
jl 0x100690ac
mov byte [ebx + 0x1be], cl
cmp dword [ebp + 0x4c], 0
jg 0x100690dc
jl 0x100690ba
cmp dword [ebp + 0x48], 0
jae 0x100690dc
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x10069168
jg 0x100690d0
cmp dword [ebp + 0x28], eax
jb 0x10069168
mov eax, dword [ebp - 0x128]
lea eax, [eax + esi - 1]
jmp 0x100690f4
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x10069124
jl 0x100690ea
cmp dword [ebp + 0x28], eax
jae 0x10069124
mov eax, dword [ebp - 0xf8]
lea eax, [eax + edi - 1]
movsx ecx, byte [ebp + 0x53]
push ecx
push dword [ebp + 0x5c]
lea ecx, [ebp - 0x5a]
push dword [ebp + 0x3c]
push ecx
lea ecx, [ebp - 0x5b]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push 0
push eax
call fcn.100439ce
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp + 0x24]
add esp, 0x20
xor eax, eax
cmp dword [ebp + 0x4c], eax
jl 0x1006915c
jg 0x10069130
cmp dword [ebp + 0x48], eax
jb 0x1006915c
mov al, byte [ebp - 0x42]
mov byte [ebx + 0x1bf], al
mov al, byte [ebp + 0x12]
mov byte [ebx + 0x1c0], al
mov al, byte [ebp - 0x14c]
mov byte [ebx + 0x1c1], al
mov eax, dword [ebp - 0xf8]
mov dword [ebx + 0x1c6], eax
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x10069174
jl 0x10069168
cmp dword [ebp + 0x28], eax
jae 0x10069174
cmp dword [ebp + 0x4c], eax
jl 0x10069194
jg 0x10069174
cmp dword [ebp + 0x48], eax
jb 0x10069194
mov al, byte [ebp - 0x5b]
mov byte [ebx + 0x1c3], al
mov al, byte [ebp - 0x5a]
mov byte [ebx + 0x1c4], al
mov al, byte [ebp - 0x94]
mov byte [ebx + 0x1c5], al
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x100691ac
jg 0x100691a0
cmp dword [ebp + 0x28], eax
jb 0x100691ac
mov esi, dword [ebp - 0x128]
mov dword [ebx + 0x1ca], esi
cmp dword [ebp - 0x64], eax
jge 0x100691ce
cmp cx, ax
jge 0x100691ce
cmp dword [ebp + 0x4c], eax
jg 0x100691ce
jl 0x100691c2
cmp dword [ebp + 0x48], eax
jae 0x100691ce
cmp dword [ebp + 0x2c], eax
jl 0x100691dc
jg 0x100691ce
cmp dword [ebp + 0x28], eax
jb 0x100691dc
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
cmp cx, ax
jge 0x1006920c
cmp dword [ebp - 0x64], eax
jge 0x1006920c
cmp dword [ebp + 0x4c], eax
jg 0x1006920c
jl 0x100691f2
cmp dword [ebp + 0x48], eax
jae 0x1006920c
cmp dword [ebp + 0x2c], eax
jg 0x1006920c
jl 0x100691fe
cmp dword [ebp + 0x28], eax
jae 0x1006920c
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
xor esi, esi
push esi
push dword [ebp - 0x144]
push dword [ebp - 0x148]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x10
cmp eax, dword [ebp - 0x148]
jne 0x1006b20b
cmp edx, dword [ebp - 0x144]
jne 0x1006b20b
mov eax, dword [ebp - 0x170]
or eax, dword [ebp - 0x16c]
mov dword [ebp + 0x5c], 1
jne 0x1006925c
push dword [ebp + 0x24]
call fcn.10043a9b
pop ecx
push dword [ebp + 0x40]
mov edi, dword [ebp + 0x24]
push edi
push dword [ebp - 0x28]
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x10069290
push esi
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x5c], eax
call fcn.10043a48
pop ecx
cmp dword [ebp + 0x4c], esi
mov eax, dword [edi + 0x1b8]
mov dword [ebp - 0x20], eax
jl 0x10069395
jg 0x100692b1
cmp dword [ebp + 0x48], 0x200
jb 0x10069395
cmp dword [ebp + 0x2c], 0
jl 0x10069395
jg 0x100692ca
cmp dword [ebp + 0x28], 0x200
jbe 0x10069395
cmp byte [ebp - 0x8e], 0
jle 0x10069395
push dword [ebp + 0x40]
push 0
push dword [ebp + 0x24]
call fcn.100b40f0
add esp, 0xc
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.100b4200
mov ebx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov esi, eax
add ebx, esi
push 0
adc edi, edx
push edi
push ebx
push dword [ebp + 0x6c]
mov dword [ebp - 0x21c], edx
call fcn.10040d01
add esp, 0x10
cmp eax, esi
jne 0x10069391
cmp edx, dword [ebp - 0x21c]
jne 0x10069391
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
push dword [ebp - 0x28]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [ebp + 0x5c], eax
je 0x10069391
mov eax, dword [ebp + 0x40]
cmp dword [ebp - 0x58], eax
jne 0x10069391
and dword [ebp + 0x5c], 0
xor eax, eax
cmp dword [ebp + 0x5c], eax
sete al
cmp byte [ebp + 7], 0
mov dword [ebp - 4], eax
je 0x10069419
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.100b4200
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
push eax
push edx
push ecx
add esi, 0x1b8
push str._04X_04X_04X
push dword [ebp + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0xc
push esi
push 3
push dword [ebp + 0x24]
mov edi, 0x80000002
push str.SYSTEMMountedDevices
push edi
call dword [0x100e3274]
cmp byte [ebp + 0x65], 0
jne 0x1006940f
cmp byte [ebp + 0x6b], 0
jne 0x1006940f
cmp byte [ebp + 0x47], 0
je 0x1006b3c1
cmp dword [ebp - 8], 0
jge 0x1006b246
cmp byte [ebp + 0x65], 0
jne 0x1006942f
cmp byte [ebp + 0x6b], 0
jne 0x1006942f
cmp byte [ebp + 0x47], 0
je 0x1006b3c1
and dword [ebp + 0x5c], 0
jmp 0x1006a283
cmp byte [ebp + 0x10], 0
je 0x10069442
mov byte [ebp - 0x3d], 0
cmp byte [ebp + 0x53], 0
je 0x10069456
cmp byte [ebp + 0x51], 0
jne 0x10069456
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x24], eax
jmp 0x1006945d
mov dword [ebp + 0x24], 0x80
mov eax, dword [ebp + 0x34]
cdq
mov edi, edx
push edi
mov esi, eax
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.100b4150
push edi
push esi
push dword [ebp - 0x110]
mov dword [ebp + 0x48], eax
push dword [ebp - 0x114]
mov dword [ebp + 0x4c], edx
call fcn.100b4150
push edi
push esi
push dword [ebp + 0x2c]
mov dword [ebp - 0x114], eax
push dword [ebp + 0x28]
mov dword [ebp - 0x110], edx
call fcn.100b4150
mov esi, eax
sub esi, 1
mov edi, edx
sbb edi, 0
cmp byte [ebp - 0x40], 0
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], edi
je 0x100694e2
mov esi, eax
add esi, dword [ebp + 0x48]
mov edi, edx
adc edi, dword [ebp + 0x4c]
sub esi, 1
sbb edi, 0
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], edi
and dword [ebp - 0xec], 0
and dword [ebp - 0xe8], 0
cmp byte [ebp + 0x51], 1
jne 0x1006956e
test byte [ebp - 0x59], 0x10
je 0x10069520
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x110]
mov esi, eax
sub esi, 1
mov edi, ecx
sbb edi, 0
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], edi
jmp 0x1006952c
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x17c]
cmp dword [ebp + 0x4c], 0
jg 0x10069545
jl 0x1006953a
cmp dword [ebp + 0x48], 1
jae 0x10069545
and dword [ebp + 0x4c], 0
mov dword [ebp + 0x48], 1
test edi, edi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], edi
jg 0x10069574
jl 0x1006955c
cmp esi, 1
jae 0x10069574
sub eax, 1
sbb ecx, 0
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], ecx
cmp byte [ebp + 0x51], 0
je 0x1006957c
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x4c]
jmp 0x10069580
xor eax, eax
xor ecx, ecx
push dword [ebp - 0x38]
lea edx, [ebp - 0xec]
push dword [ebp - 0x3c]
push edx
push ecx
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x6c]
push dword [ebp + 0x24]
push dword [ebp + 0x18]
push eax
call fcn.1004af4c
add esp, 0x24
cmp byte [ebp + 0x53], 0
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
jne 0x100695cb
or eax, edx
jne 0x100695cb
and dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 1
cmp dword [ebp - 0xe8], 0
jl 0x10068ffe
jg 0x100695e7
cmp dword [ebp - 0xec], 0x20
jb 0x10068ffe
cmp byte [ebp + 0x5b], 2
mov eax, dword [ebp + 0x24]
je 0x1006b437
cmp dword [ebp + 0x60], eax
mov dword [ebp + 0x34], 1
jae 0x10069628
cmp dword [ebp - 0x68], eax
jge 0x10069628
cmp dword [ebp + 0x60], 0
jl 0x1006962c
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x18]
push 0x10
push 0x100cd498
push eax
call fcn.10046443
add esp, 0xc
test eax, eax
je 0x1006962c
and dword [ebp + 0x34], 0
mov ecx, dword [ebp + 0x40]
xor edx, edx
lea eax, [ecx + 0x3fff]
div ecx
cmp byte [ebp + 0x51], 1
mov dword [ebp + 0x30], eax
jne 0x1006996b
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x60], eax
jae 0x10068ffe
mov edx, dword [ebp - 0x18]
mov dword [ebp + 0x14], edx
mov edx, dword [ebp - 0x138]
shl eax, 7
inc edx
imul edx, ecx
mov ecx, 0x4800
sub ecx, edx
cmp byte [ebp - 0x11], 0
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x20], ecx
jg 0x100696a5
jge 0x10069692
xor edx, edx
cmp dword [ebp - 0x38], edx
jg 0x100696a5
jl 0x10069692
mov edx, dword [ebp + 0x40]
lea edx, [edx + edx + 0x4000]
cmp dword [ebp - 0x3c], edx
ja 0x100696a5
xor edx, edx
test eax, eax
mov byte [ebp + 0x12], 0
mov dword [ebp - 0x28], edx
jle 0x10069748
jmp 0x100696f7
cmp dword [ebp + 0x40], 0x200
mov byte [ebp + 0x12], 1
jbe 0x100696ce
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
mov eax, dword [ebp + 0x18]
add eax, 0x200
push 0
push eax
call fcn.100b40f0
add esp, 0xc
mov eax, dword [ebp + 0x40]
add eax, 0xffffffa4
push eax
lea eax, [ebx + 0x5c]
push 0
push eax
call fcn.100b40f0
push 0x4000
push 0
push dword [ebp - 0x18]
call fcn.100b40f0
add esp, 0x18
jmp 0x10069748
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
jl 0x10069711
push 0x10
push 0
push dword [ebp + 0x14]
call fcn.100b40f0
add esp, 0xc
mov eax, 0x80
jmp 0x1006973a
push 0x1b0
push 0
push dword [ebp + 0x14]
call fcn.100b40f0
mov eax, dword [ebp + 0x14]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.100b40f0
add esp, 0x18
mov eax, 0x200
add dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
add dword [ebp + 0x14], eax
cmp edx, dword [ebp + 0xc]
jl 0x100696f4
push 0x38
push 0
push ebx
call fcn.100b40f0
push 0x14
lea eax, [ebx + 0x48]
push 0
push eax
call fcn.100b40f0
mov eax, dword [ebp + 0x18]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.100b40f0
mov eax, dword [ebp + 0x18]
add esp, 0x24
cmp byte [ebp + 0x12], 0
mov word [eax + 0x1fe], 0xaa55
jne 0x10069795
cmp dword [ebp + 0x40], 0x200
jbe 0x10069795
mov word [ebx - 2], 0xaa55
push 8
push str.EFI_PART
push ebx
call fcn.100144ff
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp - 0xec]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x4c]
push dword [ebp + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x30]
cdq
mov dword [ebp - 0x11c], eax
add eax, dword [ebp + 0x48]
mov dword [ebp - 0x118], edx
adc edx, dword [ebp + 0x4c]
add eax, 1
adc edx, 0
mov dword [ebx + 0x20], ecx
sub ecx, dword [ebp - 0x11c]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xe8]
sbb eax, dword [ebp - 0x118]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], eax
call fcn.10043a9b
lea eax, [ebx + 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0x10
cmp ecx, 0x20323354
jne 0x10069831
cmp edx, 0x2020
je 0x1006986b
cmp ecx, 0x20363154
jne 0x10069841
cmp edx, 0x2020
je 0x1006986b
mov esi, ecx
or esi, edx
je 0x10069865
cmp ecx, 0xffffffff
jne 0x10069850
cmp edx, ecx
je 0x10069865
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
mov esi, ecx
or esi, edx
je 0x10069865
cmp ecx, 0xffffffff
jne 0x10069889
cmp edx, ecx
jne 0x10069889
mov esi, dword [ebp - 0x108]
push 0xc
push 0x100d09b8
push eax
call fcn.100144ff
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x1b8]
add esp, 0xc
mov dword [ebx + 0x44], eax
jmp 0x1006988f
mov esi, dword [ebp - 0x108]
lea eax, [ebx - 0x174]
push eax
call fcn.10043a9b
mov eax, dword [ebp + 0x48]
add eax, 1
pop ecx
mov ecx, dword [ebp + 0x4c]
adc ecx, 0
test edi, edi
mov dword [ebx + 0x48], eax
mov eax, 0x80
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
jg 0x100698d2
jl 0x100698c4
cmp esi, 1
jae 0x100698d2
or dword [ebp - 0x108], 0xffffffff
or dword [ebp - 0x104], 0xffffffff
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x18]
push 1
push dword [ebp + 0x5c]
shl eax, 4
push dword [ebp + 0x3c]
lea edi, [eax + ecx]
lea eax, [edi + 0x1bf]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push dword [ebp + 0x4c]
mov dword [edi + 0x1c2], 0xee
push dword [ebp + 0x48]
call fcn.100439ce
lea eax, [edi + 0x1c3]
add esp, 0x20
cmp byte [ebp + 0x52], 2
lea ecx, [eax + 1]
lea edx, [eax + 2]
mov byte [eax], 0xfe
mov byte [ecx], 0xff
mov byte [edx], 0xfe
jne 0x10069947
push 1
push dword [ebp + 0x5c]
push dword [ebp + 0x3c]
push ecx
push eax
push edx
push dword [ebp - 0x104]
push dword [ebp - 0x108]
call fcn.100439ce
add esp, 0x20
mov eax, dword [ebp + 0x48]
mov dword [edi + 0x1c6], eax
add edi, 0x1ca
or dword [edi], 0xffffffff
cmp byte [ebp + 0x52], 2
jne 0x10069c7f
mov eax, dword [ebp - 0x108]
mov dword [edi], eax
cmp byte [ebp + 0x51], 0
jg 0x10069c7f
cmp byte [ebp - 0x52], 0
jle 0x10069985
cmp dword [ebp + 0x60], 0
jl 0x10069c7f
cmp byte [ebp + 0x6a], 0
je 0x100699e4
or dword [ebp + 0x60], 0xffffffff
xor esi, esi
cmp dword [ebp + 0x24], esi
mov byte [ebp - 0x3d], 0
jbe 0x100699e4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x94], eax
mov edi, 0x80
push 0x10
push 0x100cd498
push dword [ebp - 0x94]
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x100699cf
add dword [ebp - 0x94], edi
inc esi
cmp esi, dword [ebp + 0x24]
jb 0x100699a8
jmp 0x100699e4
mov dword [ebp + 0x60], esi
push edi
shl esi, 7
add esi, dword [ebp - 0x18]
push 0
push esi
call fcn.100b40f0
add esp, 0xc
mov eax, dword [ebp + 0x24]
dec dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
jae 0x10068ffe
cmp dword [ebp - 0x68], eax
jge 0x10068ffe
cmp byte [ebp - 0x3d], 0
je 0x10069afc
xor ecx, ecx
cmp byte [ebp + 0x53], cl
je 0x10069a59
mov eax, dword [ebp - 0x18]
add eax, 0x20
cmp ecx, dword [ebp + 0x24]
jae 0x10069a59
mov edx, dword [eax]
cmp edx, dword [ebp + 0x48]
jne 0x10069a27
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x4c]
je 0x10069a2f
inc ecx
add eax, 0x80
jmp 0x10069a13
mov edx, dword [ebp - 0x18]
mov eax, ecx
shl eax, 7
add eax, edx
cmp ecx, dword [ebp + 0x60]
mov esi, 0x100cd498
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10069a59
push 0x80
push 0
push eax
call fcn.100b40f0
add esp, 0xc
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x18]
shl eax, 7
push 0x10
add eax, ecx
push 0x100cd498
push eax
mov dword [ebp - 0x20], eax
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x10069ae6
mov edi, dword [ebp + 0x60]
inc edi
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jae 0x10068ffe
mov esi, edi
shl esi, 7
add esi, dword [ebp - 0x18]
push 0x10
push 0x100cd498
push esi
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x10069ab8
inc edi
add esi, 0x80
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jb 0x10069a93
jmp 0x10069ada
cmp edi, dword [ebp + 0x60]
jle 0x10069ada
mov eax, dword [ebp + 0x3c]
mov edi, eax
shl edi, 7
add edi, dword [ebp - 0x18]
sub eax, dword [ebp + 0x60]
dec eax
lea edx, [edi - 0x80]
push 0x20
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, edx
jne 0x10069acb
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x3c], eax
jae 0x10068ffe
push 0x80
push 0
push dword [ebp - 0x20]
call fcn.100b40f0
add esp, 0xc
and dword [ebp + 0x34], 0
cmp byte [ebp + 0x51], 1
je 0x10069c60
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp eax, ecx
jge 0x10069c19
cmp dword [ebp + 0x34], ecx
jne 0x10069b3f
xor eax, eax
inc eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x1a0], ecx
jle 0x10069b5c
mov edi, dword [ebp + 0x60]
shl edi, 7
add edi, dword [ebp - 0x18]
lea esi, [ebp - 0x1d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x198], ecx
jle 0x10069b7d
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x18]
shl eax, 7
lea edi, [eax + ecx + 0x10]
lea esi, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x18]
jle 0x10069b9c
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x48]
shl edx, 7
mov dword [edx + eax + 0x20], esi
mov esi, dword [ebp + 0x4c]
mov dword [edx + eax + 0x24], esi
cmp dword [ebp - 0x194], ecx
jle 0x10069bbe
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x108]
shl edx, 7
mov dword [edx + eax + 0x28], esi
mov esi, dword [ebp - 0x104]
mov dword [edx + eax + 0x2c], esi
cmp dword [ebp - 0x19c], ecx
jle 0x10069be0
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x178]
shl edx, 7
mov dword [edx + eax + 0x30], esi
mov esi, dword [ebp - 0x174]
mov dword [edx + eax + 0x34], esi
cmp dword [ebp - 0x190], ecx
jle 0x10069c60
mov eax, dword [ebp - 0x48]
cmp word [eax], 0
je 0x10069c60
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x18]
shl eax, 7
push 0x48
lea esi, [eax + ecx + 0x38]
push 0
push esi
call fcn.100b40f0
add esp, 0xc
push 0x24
push dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x10069c60
cmp eax, dword [ebp + 0x60]
je 0x10069c60
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp - 0x18]
shl ecx, 7
lea edx, [ecx + eax]
push 0x20
pop ecx
mov esi, edx
lea edi, [ebp - 0x360]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x68]
shl ecx, 7
add eax, ecx
push 0x20
pop ecx
mov esi, eax
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
push 0x20
pop ecx
lea esi, [ebp - 0x360]
rep movsd dword es:[edi], dword [esi]
jge 0x10069c60
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x10], 0
je 0x10069c7f
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x18]
push 0x80
push 0
push eax
call fcn.100b40f0
add esp, 0xc
mov al, byte [ebp + 7]
and dword [ebp + 0x34], 0
and al, 0x20
mov byte [ebp - 0x42], al
je 0x10069c98
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x14c], eax
jmp 0x10069ca2
mov dword [ebp - 0x14c], 0xfffffff8
cmp byte [ebp - 0x52], 1
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x20], eax
jne 0x10069ddc
cmp byte [ebp + 0x51], 1
je 0x10069ddc
mov eax, dword [ebp + 0x24]
xor esi, esi
dec eax
cmp eax, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x94], esi
jl 0x10069ddc
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x5c], eax
xor edi, edi
push 0x10
push 0x100cd498
push dword [ebp + 0x14]
call fcn.10046443
add esp, 0xc
test al, al
mov byte [ebp + 0x12], al
jne 0x10069d05
cmp esi, dword [ebp - 0x28]
mov dword [ebp + 0xc], edi
je 0x10069d0c
mov dword [ebp + 0xc], 1
cmp esi, dword [ebp - 0x14c]
mov dword [ebp + 0x3c], edi
jne 0x10069d24
mov eax, dword [ebp - 0x28]
mov dword [ebp + 0x3c], 2
mov dword [ebp - 0x20], eax
cmp byte [ebp + 0x12], 0
jne 0x10069d91
cmp esi, dword [ebp - 0x28]
je 0x10069d85
push 0x38
push dword [ebp + 0x14]
push dword [ebp + 0x5c]
call fcn.100b6680
add esp, 0xc
test eax, eax
je 0x10069d5a
push 0x38
push dword [ebp + 0x14]
mov dword [ebp + 0x3c], 1
push dword [ebp + 0x5c]
call fcn.100b47a0
add esp, 0xc
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x5c]
push 0x24
add esi, 0x38
push esi
add edi, 0x38
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
je 0x10069d85
push 0x24
push esi
push edi
mov dword [ebp + 0x3c], 1
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
inc dword [ebp - 0x28]
add dword [ebp + 0x5c], 0x80
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x10069db1
cmp byte [ebp + 0x12], 0
jne 0x10069db1
push 0x10
push edi
push dword [ebp + 0x14]
mov dword [ebp + 0x3c], 1
call fcn.100b40f0
add esp, 0xc
cmp dword [ebp + 0x3c], edi
mov esi, dword [ebp - 0x94]
je 0x10069dc2
lea eax, [esi + 1]
mov dword [ebp + 0x34], eax
add dword [ebp + 0x14], 0x80
inc esi
cmp esi, dword [ebp - 0x10c]
mov dword [ebp - 0x94], esi
jle 0x10069ce4
push 8
push str.EFI_PART
push ebx
call fcn.100144ff
push dword [ebp + 0x18]
call fcn.10043a9b
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, eax
add esp, 0x10
or edx, ecx
je 0x10069e09
cmp eax, 0xffffffff
jne 0x10069e16
cmp ecx, eax
jne 0x10069e16
lea eax, [ebx - 0x174]
push eax
call fcn.10043a9b
pop ecx
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x34], eax
jg 0x10069e22
inc eax
mov dword [ebp + 0x34], eax
cmp byte [ebp + 0x51], 1
jne 0x10069e2e
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x24]
xor edi, edi
push edi
shl eax, 7
push edi
push eax
push dword [ebp - 0x18]
call fcn.1009f587
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0xc]
add esp, 0x10
cmp eax, 0x20000
mov dword [ebp - 0x28], eax
ja 0x1006b63f
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.1009f587
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x18]
push ebx
add esi, 0x10000
push esi
mov dword [ebx + 0x10], eax
call fcn.100144ff
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x24], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [esi + 0x10], edi
push esi
call fcn.1009f587
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x30]
mov esi, dword [ebp + 0x40]
add esp, 0x2c
inc eax
imul eax, esi
push eax
lea ecx, [ebp - 0xb4]
call fcn.10002da5
mov eax, dword [ebp - 0xb4]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x34]
shl eax, 7
lea eax, [eax + esi - 1]
xor edx, edx
div esi
push edi
push dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x3c]
imul eax, esi
mov dword [ebp - 0x10c], eax
call fcn.1000f647
push esi
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.10002d70
push esi
push dword [ebp + 0x18]
push dword [ebp - 0xb4]
call fcn.100b6680
add esp, 0xc
test eax, eax
je 0x10069f31
push edi
push dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x3c]
call fcn.1000f647
push esi
push dword [ebp + 0x18]
lea ecx, [ebp + 0x6c]
call fcn.1003f86c
mov eax, dword [ebp - 0x10c]
xor edx, edx
div esi
mov ecx, dword [ebp - 0x134]
push edi
xor edx, edx
push edx
push esi
push ecx
mov dword [ebp + 0x40], ebx
mov dword [ebp - 0xb8], ecx
inc eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x138]
push eax
mov dword [ebp - 0xbc], eax
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
mov eax, dword [ebp + 0x14]
imul eax, esi
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.10002d70
cmp dword [ebp + 0x14], edi
mov dword [ebp + 0x3c], edi
jle 0x1006a071
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x14]
jge 0x10069fd3
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.100b6680
add esp, 0xc
test eax, eax
jne 0x10069fd0
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x14]
jl 0x10069f9f
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x30]
jge 0x1006a071
mov ecx, dword [ebp + 0x40]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x214], ecx
jmp 0x1006a028
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.100b6680
add esp, 0xc
test eax, eax
je 0x1006a02d
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x14]
jl 0x10069ffc
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.1003f86c
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x3c], eax
jl 0x10069f97
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp - 0xec]
cdq
sub ecx, eax
mov eax, dword [ebp - 0xe8]
sbb eax, edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp + 0x5c], edx
mov edx, dword [ebp - 0x18]
push edi
mov dword [ebp + 0x40], edx
xor edx, edx
push edx
push esi
push eax
push ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], eax
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
mov eax, dword [ebp + 0x30]
imul eax, esi
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.10002d70
cmp dword [ebp + 0x30], edi
mov dword [ebp + 0x3c], edi
jle 0x1006a1c5
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jge 0x1006a1c5
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.100b6680
add esp, 0xc
test eax, eax
jne 0x1006a126
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x30]
jl 0x1006a0f5
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jge 0x1006a1c5
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1ec], eax
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.100b6680
add esp, 0xc
test eax, eax
je 0x1006a181
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x30]
jl 0x1006a150
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x1ec]
push dword [ebp - 0x1f0]
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.1003f86c
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jl 0x1006a0e9
xor eax, eax
push eax
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call fcn.100b4200
add eax, dword [ebp - 0x3c]
push edi
adc edx, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push edx
push eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], edx
call fcn.1000f647
push esi
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.10002d70
mov eax, dword [ebp - 0x18]
add eax, 0x10000
push esi
push eax
push dword [ebp - 0xb4]
mov dword [ebp + 0x34], eax
call fcn.100b6680
add esp, 0xc
test eax, eax
je 0x1006a246
push edi
push dword [ebp - 0x1f4]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x1f8]
call fcn.1000f647
push esi
push dword [ebp + 0x34]
lea ecx, [ebp + 0x6c]
call fcn.1003f86c
movsx ecx, byte [ebp + 0x65]
movsx eax, byte [ebp + 0x6b]
or eax, ecx
movsx ecx, byte [ebp + 0x47]
or eax, ecx
cmp byte [ebp - 0x42], 0
je 0x1006a26d
cmp eax, edi
je 0x1006b867
cmp dword [ebp - 8], edi
jge 0x1006b673
cmp eax, edi
je 0x1006b867
lea ecx, [ebp - 0xb4]
mov dword [ebp + 0x5c], edi
call fcn.1003f96c
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
xor cl, cl
cmp byte [ebp + 0x50], cl
je 0x1006a2a8
cmp dword [ebp + 0x5c], 0
jne 0x1006a2b6
mov al, byte [ebp + 0x64]
cmp al, 0x10
mov cl, 0x40
jne 0x1006a2b9
add cl, 0x20
jmp 0x1006a2b9
mov al, byte [ebp + 0x64]
cmp dword [ebp - 8], 0
jl 0x1006a2fa
cmp al, 0x20
je 0x1006a2c7
cmp al, 0x10
jne 0x1006a2cd
cmp dword [ebp - 0x50], 0xb
je 0x1006a2f1
test byte [ebp + 0x65], 0x20
jne 0x1006a2f1
cmp byte [ebp - 0x29], 0
jg 0x1006a323
cmp byte [ebp - 0x29], 0
jg 0x1006a323
cmp byte [ebp + 0x47], 0
jne 0x1006a314
cmp al, 1
je 0x1006a314
or cl, 2
cmp al, 1
je 0x1006a31f
test byte [ebp + 0x6b], 0x20
jne 0x1006a33f
cmp byte [ebp + 0x6b], 0
je 0x1006a335
or cl, 8
push dword [ebp - 0x34]
movsx eax, cl
or dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x66]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x6c]
push dword [ebp - 8]
push eax
call fcn.1005661e
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x10067adf
je 0x1006a38f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
jmp 0x1006b3fc
cmp dword [ebp - 0xc], ebx
jge 0x1006a3c2
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
jne 0x1006a3c2
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
jmp 0x1006902d
mov eax, dword [ebp - 0x78]
mov edi, 0x1b8
mov dword [ebp + 0x5c], edi
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a4], ebx
cmp word [eax], bx
je 0x1006a51f
push eax
push 0x100d09b4
call fcn.10040e34
test al, al
pop ecx
pop ecx
jne 0x1006a51f
push dword [ebp - 0x78]
push 0x100cc5c8
call fcn.10040e34
test al, al
pop ecx
pop ecx
jne 0x1006a51f
mov edi, dword [ebp - 0x78]
push edi
push 0x100d09b0
call fcn.10040e34
test al, al
pop ecx
pop ecx
je 0x1006a43b
mov dword [ebp - 0x10], 0x100e1378
mov dword [ebp + 0x5c], 0x190
jmp 0x1006a53b
push edi
push 0x100d09ac
call fcn.10040e34
test al, al
pop ecx
pop ecx
je 0x1006a45f
mov dword [ebp - 0x10], 0x100e1508
mov dword [ebp + 0x5c], 0x180
jmp 0x1006a53b
mov dword [ebp + 0x5c], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
jne 0x1006a496
lea eax, [ebp - 0xa8]
push eax
inc edi
lea eax, [ebp - 0x78]
inc edi
push eax
mov dword [ebp - 0x78], edi
call fcn.1004bbf7
mov edi, dword [ebp - 0x78]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x1006a496
inc edi
inc edi
cmp word [edi], 0x23
jne 0x1006a4d4
push edi
lea ecx, [ebp + 0xc]
call fcn.100501eb
push ebx
lea eax, [ebp - 0x1ac]
push eax
push 0x100c7cf8
push dword [ebp + 0xc]
push ebx
call fcn.100155e3
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.1003f96c
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + 0x5c], eax
jmp 0x1006a4eb
lea eax, [ebp + 0x5c]
push eax
push ebx
push edi
call fcn.1000ffcc
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0xa4], ebx
jl 0x1006a529
jg 0x1006a4fd
cmp dword [ebp - 0xa8], ebx
jb 0x1006a529
xor eax, eax
cmp eax, dword [ebp - 0xa4]
jl 0x1006a529
jg 0x1006a514
mov eax, dword [ebp + 0x5c]
cmp eax, dword [ebp - 0xa8]
jbe 0x1006a529
mov eax, dword [ebp - 0xa8]
mov dword [ebp + 0x5c], eax
jmp 0x1006a529
mov dword [ebp - 0x10], 0x100e1688
mov dword [ebp + 0x5c], edi
cmp dword [ebp + 0x5c], ebx
jbe 0x1006a6fa
cmp dword [ebp - 0x10], ebx
je 0x1006a6fa
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.10005b9d
cmp dword [ebp + 0x6c], ebx
je 0x1006a6fa
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.1004342a
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x1006a577
mov edi, esi
mov ecx, dword [ebp + 0x5c]
lea eax, [edi - 1]
add ecx, eax
not eax
and ecx, eax
cmp ecx, edi
mov dword [ebp + 0x34], ecx
mov ebx, ecx
jge 0x1006a58e
mov ebx, edi
lea eax, [edi + ebx*2]
push eax
lea ecx, [ebp - 0x48]
call fcn.10045fcc
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xcc]
lea esi, [edi - 1]
add eax, edi
not esi
and esi, eax
xor eax, eax
xor edx, edx
or ecx, dword [ebp - 0xc8]
lea edi, [esi + ebx]
je 0x1006a5cd
push edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x10
cmp eax, dword [ebp - 0x3c]
jne 0x1006a6be
cmp edx, dword [ebp - 0x38]
jne 0x1006a6be
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x34]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006a6be
push dword [ebp + 0x34]
push edi
push esi
call fcn.100144ff
mov ecx, dword [ebp + 0x5c]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x1006a615
mov ecx, eax
mov ebx, dword [ebp - 0x10]
push ecx
push ebx
push edi
call fcn.100144ff
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp eax, 0x200
jbe 0x1006a657
add eax, 0xfffffe00
push eax
add ebx, 0x200
lea eax, [edi + 0x200]
push ebx
push eax
call fcn.100144ff
add esp, 0xc
push dword [ebp + 0x34]
push edi
push esi
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x1006a6a6
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x10
cmp eax, dword [ebp - 0x3c]
jne 0x1006a6be
cmp edx, dword [ebp - 0x38]
jne 0x1006a6be
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x34]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.10043a48
test esi, esi
pop ecx
je 0x1006a6be
lea ecx, [ebp - 0x48]
call fcn.1003f96c
lea ecx, [ebp - 0x1ac]
call fcn.1003f96c
jmp 0x1006b1e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x1006a6cb
inc edi
lea ecx, [ebp - 0x48]
call fcn.1003f96c
lea ecx, [ebp - 0x1ac]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
test eax, eax
jmp 0x1006b3b9
lea ecx, [ebp - 0x1ac]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
jmp 0x1006b23a
cmp dword [ebp + 0x60], ebx
jle 0x1006a3a6
cmp dword [ebp - 0xc], ebx
jge 0x1006a73e
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
je 0x1006a3a6
xor eax, eax
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp + 0xc], esi
jge 0x1006a75d
xor al, al
jne 0x1006a785
jmp 0x1006a3a6
push dword [ebp - 0x6c]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x60]
push dword [ebp - 0xc]
push eax
call fcn.100655b2
add esp, 0x1c
cmp dword [ebp + 0xc], ebx
jle 0x1006a705
mov edi, dword [ebp - 0xd8]
mov dword [ebp + 0x30], 0x200
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
cmp word [edi], bx
je 0x1006a91c
push edi
push 0x100d09b4
call fcn.10040e34
test al, al
pop ecx
pop ecx
jne 0x1006a91c
push edi
push 0x100cc5c8
call fcn.10040e34
test al, al
pop ecx
pop ecx
jne 0x1006a91c
push edi
push 0x100d09ac
call fcn.10040e34
test al, al
pop ecx
pop ecx
je 0x1006a7ef
push 8
jmp 0x1006a91e
push edi
push str.nt6fat
call fcn.10040e34
test al, al
pop ecx
pop ecx
jne 0x1006a918
push edi
push str.winfat
call fcn.10040e34
test al, al
pop ecx
pop ecx
jne 0x1006a918
push edi
push 0x100d09b0
call fcn.10040e34
test al, al
pop ecx
pop ecx
je 0x1006a831
push 6
jmp 0x1006a91e
push edi
push str.nt5fat
call fcn.10040e34
test al, al
pop ecx
pop ecx
je 0x1006a849
push 5
jmp 0x1006a91e
mov dword [ebp + 0x30], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
jne 0x1006a889
lea eax, [ebp - 0xa8]
push eax
inc edi
lea eax, [ebp - 0xd8]
inc edi
push eax
mov dword [ebp - 0xd8], edi
call fcn.1004bbf7
mov edi, dword [ebp - 0xd8]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x1006a889
inc edi
inc edi
cmp word [edi], 0x23
jne 0x1006a8c7
push edi
lea ecx, [ebp + 0xc]
call fcn.100501eb
push ebx
lea eax, [ebp - 0x160]
push eax
push 0x100c7cf8
push dword [ebp + 0xc]
push ebx
call fcn.100155e3
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x50], eax
call fcn.1003f96c
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x30], eax
jmp 0x1006a8de
lea eax, [ebp + 0x30]
push eax
push ebx
push edi
call fcn.1000ffcc
add esp, 0xc
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0xa4], ebx
jl 0x1006a90e
jg 0x1006a8f0
cmp dword [ebp - 0xa8], ebx
jb 0x1006a90e
cmp ebx, dword [ebp - 0xa4]
jl 0x1006a90e
jg 0x1006a905
mov eax, dword [ebp + 0x30]
cmp eax, dword [ebp - 0xa8]
jbe 0x1006a90e
mov eax, dword [ebp - 0xa8]
mov dword [ebp + 0x30], eax
cmp dword [ebp - 0x50], ebx
jne 0x1006a947
jmp 0x1006a9ba
push 7
jmp 0x1006a91e
push 9
pop eax
push ebx
lea ecx, [ebp - 0x160]
push ecx
push str.INDATA
push eax
push ebx
call fcn.100155e3
add esp, 0x14
cmp dword [ebp + 0x30], ebx
mov dword [ebp - 0x50], eax
je 0x1006a9ba
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x30], ebx
jbe 0x1006a9ba
cmp dword [ebp - 0x50], ebx
je 0x1006a9ba
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.10005b9d
cmp dword [ebp + 0x6c], ebx
je 0x1006a9ba
push ebx
push 0x200
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call fcn.100b4200
mov esi, eax
add esi, dword [ebp - 0x11c]
mov edi, edx
adc edi, dword [ebp - 0x118]
push ebx
push edi
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], edi
call fcn.10040d01
add esp, 0x10
cmp eax, esi
jne 0x1006a9ba
cmp edx, edi
je 0x1006a9c5
lea ecx, [ebp - 0x160]
jmp 0x1006a700
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.1004342a
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x1006a9dd
mov edi, esi
mov ecx, dword [ebp + 0x30]
lea eax, [edi - 1]
lea esi, [eax + ecx]
not eax
and esi, eax
lea eax, [edi + esi*2]
push eax
lea ecx, [ebp - 0xd4]
call fcn.10045fcc
mov eax, dword [ebp - 0xd4]
lea ebx, [edi - 1]
add eax, edi
push 0
not ebx
and ebx, eax
lea eax, [ebp - 0x58]
push eax
push esi
lea edi, [ebx + esi]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006aa52
lea ecx, [ebp - 0xd4]
call fcn.1003f96c
lea ecx, [ebp - 0x160]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
test eax, eax
jmp 0x1006b23a
push esi
push edi
push ebx
call fcn.100144ff
push 0
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
push dword [ebp + 0x6c]
call fcn.10040d01
add esp, 0x1c
cmp eax, dword [ebp - 0x100]
jne 0x1006aa20
cmp edx, dword [ebp - 0xfc]
jne 0x1006aa20
mov eax, dword [ebp + 0x30]
push 3
push dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
push edi
call fcn.100144ff
mov eax, 0x1fe
add esp, 0xc
cmp dword [ebp - 0x48], eax
jle 0x1006aaa4
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0xffffffe2
push eax
mov eax, dword [ebp - 0x50]
add eax, 0x1e
push eax
lea eax, [edi + 0x1e]
push eax
call fcn.100144ff
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x30]
add esp, 0xc
cmp eax, 0x200
jbe 0x1006aaf4
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x50]
add eax, 0x200
push eax
lea eax, [edi + 0x200]
push eax
call fcn.100144ff
add esp, 0xc
push esi
push edi
push ebx
mov dword [ebp + 0x5c], 1
call fcn.10046443
add esp, 0xc
test eax, eax
jne 0x1006ab26
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x5c], eax
call fcn.10043a48
pop ecx
xor eax, eax
cmp dword [ebp + 0x5c], eax
lea ecx, [ebp - 0xd4]
sete al
mov edi, eax
call fcn.1003f96c
lea ecx, [ebp - 0x160]
jmp 0x1006a6d9
push 0x103c
lea ecx, [ebp + 0x1c]
call fcn.10046168
mov esi, dword [ebp + 0x1c]
mov ax, word [edi]
add esi, 0x2000
cmp ax, bx
mov dword [ebp + 0x34], 0x100c8078
je 0x1006abb2
cmp word [edi + 2], 0x3a
jne 0x1006abb2
movzx eax, ax
push eax
push 0x100d0984
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x1006aba4
cmp dword [ebp - 0x8c], 0x10
jne 0x1006ac05
mov dword [ebp + 0x34], 0x100c8048
cmp eax, 5
jne 0x1006ac05
mov dword [ebp + 0x34], 0x100c8068
jmp 0x1006ac05
cmp dword [ebp - 0xc], ebx
jl 0x1006ac05
cmp dword [ebp - 0x8c], 8
jne 0x1006abd8
push dword [ebp - 0xc]
push str..CDROM_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp + 0x34], 0x100c8068
jmp 0x1006ac02
cmp dword [ebp - 0x8c], 0x10
jne 0x1006abf3
mov esi, dword [ebp - 0xc]
and esi, 0xfff
mov dword [ebp + 0x34], 0x100c8048
jmp 0x1006ac05
push dword [ebp - 0xc]
push str..PhysicalDrive_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
movzx eax, word [ebp - 0x9c]
push dword [ebp + 0x34]
or eax, 0x20
push eax
push dword [ebp + 0x1c]
push esi
call fcn.10054fe7
mov ecx, dword [ebp - 0xc4]
add esp, 0x10
push dword [ebp + 0x1c]
push dword [ebp - 0xd0]
call fcn.100457c2
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
jmp 0x1006b1ff
cmp byte [ebp - 0x3f], 0
je 0x1006ac5e
cmp dword [ebp - 8], ebx
jl 0x1006b93e
mov al, byte [ebp - 0x3e]
neg al
sbb eax, eax
and eax, 0x200000
or eax, dword [ebp - 8]
or eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.100649fc
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
xor eax, eax
cmp word [ecx], bx
sete al
mov dword [ebp - 4], eax
jmp 0x1006b93e
cmp dword [ebp - 8], ebx
jl 0x1006acc8
cmp byte [ebp - 0x44], 0
je 0x1006ac9f
cmp dword [ebp + 0x60], ebx
jl 0x1006acc8
push dword [ebp - 0x6c]
movsx eax, byte [ebp - 0x3e]
or eax, dword [ebp + 8]
push ebx
push ebx
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 8]
push eax
call fcn.100655b2
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc0], ebx
jle 0x1006b95c
mov eax, dword [ebp - 0xc0]
and eax, 0x9fffffff
or eax, 0x10000000
mov dword [ebp - 0xc0], eax
jmp 0x1006b93e
cmp dword [ebp - 0xc], ebx
jge 0x1006ad4f
cmp word [edi], bx
je 0x1006ad4f
cmp word [edi + 2], 0x3a
mov eax, edi
jne 0x1006ad4c
cmp word [edi + 4], bx
jne 0x1006ad4c
mov word [ebp - 0x2e0], 0x5c
mov word [ebp - 0x2de], 0x5c
mov word [ebp - 0x2dc], 0x2e
mov word [ebp - 0x2da], 0x5c
mov ax, word [edi]
mov word [ebp - 0x2d8], ax
mov word [ebp - 0x2d6], 0x3a
mov word [ebp - 0x2d4], bx
lea eax, [ebp - 0x2e0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jl 0x1006b93e
cmp byte [ebp - 0x44], 0
je 0x1006ad67
cmp dword [ebp + 0x60], ebx
jl 0x1006b93e
push dword [ebp - 0x8c]
lea eax, [ebp + 0x1c]
push dword [ebp - 8]
push eax
push dword [ebp - 0xc4]
call fcn.1005607f
add esp, 0x10
jmp 0x1006ac87
mov eax, dword [ebp - 0xf0]
movzx edi, word [eax]
and edi, 0xffffffdf
cmp dword [ebp - 0x8c], ebx
lea esi, [edi - 0x41]
jle 0x1006ae0a
push 0x3b60
lea ecx, [ebp + 0xc]
call fcn.10045fcc
mov eax, dword [ebp + 0xc]
mov ecx, edi
shl ecx, 0x10
or ecx, dword [ebp - 0x8c]
lea ebx, [eax + 0x200]
push ecx
push eax
push ebx
call fcn.10055460
imul esi, esi, 0x220
add esi, ebx
add esp, 0xc
cmp dword [esi + 8], 0
jle 0x1006adfb
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.10046168
push edi
push dword [esi + 4]
push str._d__c:
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
and dword [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.1003f96c
xor ebx, ebx
jmp 0x1006b936
mov cx, word [eax]
mov edx, dword [ebp + 0x1c]
mov word [edx], cx
cmp word [eax], 0x5c
jne 0x1006ae1c
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
je 0x1006b936
push dword [ebp - 0x6c]
mov eax, dword [ebp + 8]
push ebx
and eax, 0xfffffffd
push ebx
or eax, 0xc
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 8]
push eax
call fcn.100655b2
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp - 4], ecx
jmp 0x1006b936
cmp dword [ebp - 0xc], ebx
jge 0x1006aed8
cmp word [edi], bx
je 0x1006aed5
cmp word [edi + 2], 0x3a
jne 0x1006aecc
cmp word [edi + 4], 0x5c
jne 0x1006ae7a
cmp word [edi + 6], bx
jne 0x1006ae7a
mov word [edi + 4], bx
cmp word [edi + 4], bx
jne 0x1006aec7
push 9
lea ecx, [ebp + 0x54]
call fcn.10046168
mov eax, dword [ebp + 0x54]
mov word [eax], 0x5c
mov eax, dword [ebp + 0x54]
mov word [eax + 2], 0x5c
mov eax, dword [ebp + 0x54]
mov word [eax + 4], 0x2e
mov eax, dword [ebp + 0x54]
mov word [eax + 6], 0x5c
mov ax, word [edi]
mov ecx, dword [ebp + 0x54]
mov word [ecx + 8], ax
mov eax, dword [ebp + 0x54]
mov word [eax + 0xa], 0x3a
mov eax, dword [ebp + 0x54]
mov word [eax + 0xc], bx
cmp dword [ebp + 0x54], ebx
jne 0x1006aed5
push edi
lea ecx, [ebp + 0x54]
call fcn.100502c8
mov dword [ebp + 0x60], esi
cmp dword [ebp + 0x60], ebx
jg 0x1006aee0
mov dword [ebp + 0x60], esi
test byte [ebp - 0x7a], 1
mov eax, dword [ebp + 0x60]
je 0x1006aeed
or dword [ebp + 8], 0x20
test word [ebp + 8], 0x402
je 0x1006af1f
cmp dword [ebp - 0xc], ebx
jl 0x1006af1f
cmp dword [ebp + 0x60], ebx
jle 0x1006af1f
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
push dword [ebp + 0x60]
mov word [eax], bx
push dword [ebp - 0xc]
lea eax, [ebp + 0x1c]
push eax
call fcn.100655b2
add esp, 0x1c
push dword [ebp + 0x54]
mov ecx, dword [ebp + 8]
and eax, 0xf000ffff
shl ecx, 0x10
or eax, ecx
push eax
push dword [ebp - 0xc]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004e95
add esp, 0x10
cmp eax, ebx
je 0x1006af52
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
mov dword [ebp - 4], ebx
jne 0x1006b936
mov dword [ebp - 4], 0x80070057
jmp 0x1006b936
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1006b39a
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
jmp 0x10067b26
lea ecx, [ebp - 0x4c]
jmp 0x1006b1db
lea ecx, [ebp - 0x4c]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
jmp 0x1006aa36
lea ecx, [ebp - 0x4c]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, esi
jmp 0x1006902d
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
jmp 0x1006b3f0
and eax, 0x10
shr eax, 4
mov edi, eax
jmp 0x1006b38a
lea ecx, [ebp - 0x30]
call fcn.1003f96c
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
jmp 0x1006a705
lea ecx, [ebp - 0x30]
call fcn.1003f96c
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
jmp 0x1006a3a6
push 0x28
lea ecx, [ebp + 0x1c]
call fcn.10046168
mov esi, dword [ebp + 0x60]
mov ebx, dword [ebp + 0x1c]
xor ecx, ecx
test esi, esi
push 4
mov dword [ebp - 0x9c], 0x100c6a64
pop eax
jl 0x1006b091
lea edx, [esi + 1]
cmp edx, eax
mov ecx, esi
jge 0x1006b089
mov eax, edx
cmp esi, eax
jge 0x1006b19d
mov esi, dword [ebp + 0x24]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], edx
mov edx, ecx
shl edx, 4
sub eax, ecx
lea esi, [edx + esi + 0x1c6]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x60], 0
mov al, byte [esi - 4]
mov byte [ebp - 0x40], al
jge 0x1006b103
cmp al, 5
je 0x1006b0ca
cmp al, 0xf
mov ecx, 0x100c6a64
jne 0x1006b0cf
mov ecx, 0x100d0980
xor edx, edx
test al, al
setne dl
lea edx, [edx + edx - 1]
imul edx, dword [ebp - 0x6c]
push edx
push ecx
push dword [ebp - 0x9c]
push str._s_s_d
push ebx
call edi
add esp, 0x14
lea ebx, [ebx + eax*2]
mov dword [ebp - 0x9c], 0x100c7598
jmp 0x1006b18e
test al, al
je 0x1006b18e
push dword [ebp - 0x6c]
push dword [ebp - 0x9c]
push str._s_d
push ebx
call edi
add esp, 0x10
test byte [ebp + 8], 1
lea ebx, [ebx + eax*2]
mov eax, str._0x_X
jne 0x1006b132
mov eax, 0x100d0824
movzx ecx, byte [ebp - 0x40]
push ecx
push eax
push ebx
call edi
lea ebx, [ebx + eax*2]
movzx eax, byte [esi - 8]
shr eax, 7
push eax
push 0x100d0824
push ebx
call edi
lea ebx, [ebx + eax*2]
mov eax, dword [esi]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.100a0df8
add esp, 0x28
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2]
mov eax, dword [esi + 4]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.100a0df8
add esp, 0x10
inc dword [ebp - 0x6c]
add esi, 0x10
dec dword [ebp + 0xc]
jne 0x1006b0b1
cmp dword [ebp - 0xc0], 0
jle 0x1006b1bc
push dword [ebp - 0xc0]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xc4]
call fcn.1004b1e0
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0xd0]
call fcn.100457c2
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
test eax, eax
je 0x10067396
push eax
jmp 0x10067390
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, esi
je 0x10067a3a
push eax
jmp 0x10067a34
push dword [ebp - 0x34]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x66]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x6c]
push dword [ebp - 8]
push eax
call fcn.1005661e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x60]
xor ebx, ebx
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x10], ebx
jl 0x1006b344
mov ecx, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
inc eax
push eax
push dword [ebp - 8]
lea eax, [ebp + 0x1c]
push eax
mov word [ecx], bx
call fcn.100655b2
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jle 0x1006b344
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x120], ebx
mov dword [ebp - 0x20], eax
jle 0x1006b2ba
mov dword [ebp - 0x120], ebx
mov ebx, dword [ebp - 0x10c]
push 0
or ebx, 0x100000
push ebx
push dword [ebp - 0xc]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004e95
add esp, 0x10
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x1006b30e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
cmp eax, 0x1388
ja 0x1006b308
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x10]
lea ebx, [eax + 0x78]
add eax, 0x7a
push eax
mov word [ebx], 0x23
call fcn.1003f92f
mov eax, dword [ebp + 0x24]
pop ecx
pop ecx
push 0xc
push esi
push 3
push ebx
push str.SYSTEMMountedDevices
push edi
mov word [eax + 0x7c], 0x3f
call dword [0x100e3274]
xor ebx, ebx
cmp dword [ebp - 0x120], ebx
jge 0x1006b357
cmp dword [ebp - 0x10], ebx
je 0x1006b380
cmp dword [ebp - 0x120], ebx
jle 0x1006b371
cmp dword [ebp - 0x10], ebx
jne 0x1006b371
mov ecx, dword [ebp - 0xc4]
push ebx
push ebx
push dword [ebp - 0x120]
call fcn.10011621
push dword [ebp + 0x24]
push str.SYSTEMMountedDevices
push edi
call dword [0x100e3278]
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jge 0x1006b38a
mov edi, dword [ebp - 4]
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
je 0x1006b3fc
push eax
jmp 0x1006798f
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
test eax, eax
je 0x1006b3f9
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0xdc]
call fcn.1003f96c
lea ecx, [ebp - 0xd0]
call fcn.1003f96c
lea ecx, [ebp - 0xf0]
call fcn.1003f96c
lea ecx, [ebp - 0x1e0]
call fcn.1003f96c
lea ecx, [ebp + 0x1c]
call fcn.1003f96c
mov eax, edi
jmp 0x1006b9c7
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea ecx, [ebp + 0x1c]
call fcn.10046168
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x24]
xor ecx, ecx
test edx, edx
mov dword [ebp - 0x9c], 0x100c6a64
jl 0x1006b467
mov ecx, edx
inc edx
cmp eax, edx
jle 0x1006b467
mov eax, edx
cmp ecx, eax
jge 0x1006b5d7
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [ecx + 1]
mov dword [ebp - 0x30], edx
mov edx, ecx
shl edx, 7
add edx, dword [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 0x48], edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
jne 0x1006b4a1
mov ecx, dword [eax + 8]
or ecx, dword [eax + 0xc]
je 0x1006b5c4
cmp dword [ebp + 0x60], 0
push dword [ebp - 0x30]
push dword [ebp - 0x9c]
jge 0x1006b4ce
push str._s_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x9c], 0x100c7598
jmp 0x1006b5c1
push 0x100d093c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x18]
lea esi, [esi + eax*2]
mov eax, dword [ebp + 0x60]
shl eax, 7
lea edi, [eax + ecx]
push 0
push edi
push esi
call fcn.1004363d
add esp, 0x1c
push esi
call ebx
lea esi, [esi + eax*2]
push str._GPT
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x200
push dword [edi + 0x24]
add esi, 0xa
push dword [edi + 0x20]
call fcn.100b4200
push edx
push eax
push esi
call fcn.100a0e43
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
inc esi
inc esi
sub eax, dword [edi + 0x20]
push 0
sbb ecx, dword [edi + 0x24]
add eax, 1
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.100b4200
push edx
push eax
push esi
call fcn.100a0e43
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push str._016I64X
push dword [edi + 0x34]
inc esi
push dword [edi + 0x30]
inc esi
push esi
call fcn.100a0df8
add esp, 0x10
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push 0
inc esi
add edi, 0x10
inc esi
push edi
push esi
call fcn.1004363d
add esp, 0xc
test byte [ebp + 8], 0x10
je 0x1006b5c4
push esi
call ebx
push dword [ebp - 0x30]
lea esi, [esi + eax*2]
mov word [esi], 0x20
inc esi
inc esi
push 0x100c72f0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
add dword [ebp - 0x48], 0x80
inc dword [ebp - 0x30]
dec dword [ebp + 0xc]
jne 0x1006b48b
xor edi, edi
cmp dword [ebp - 0xc0], edi
jle 0x1006b5f7
push dword [ebp - 0xc0]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xc4]
call fcn.1004b1e0
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0xd0]
call fcn.100457c2
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, edi
jmp 0x1006b3b9
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, edi
jmp 0x1006902d
mov eax, dword [ebp - 0x20]
shl eax, 7
mov dword [ebp - 0x10c], eax
xor edx, edx
div esi
push dword [ebp - 0x34]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x66]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x6c]
push dword [ebp - 8]
push eax
call fcn.1005661e
add esp, 0x18
push edi
push 0x20000000
push 3
push edi
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
mov dword [ebp - 0x20], eax
call fcn.10005b9d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
lea eax, [ecx + eax + 0x30]
mov edx, dword [eax]
and byte [eax + 7], 0x7f
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
push edi
shl eax, 7
push edi
push eax
push ecx
mov dword [ebx + 0x58], edi
call fcn.1009f587
mov dword [ebx + 0x58], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.1009f587
push edi
xor ecx, ecx
push ecx
push dword [ebp - 0x28]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x34]
push eax
mov dword [eax + 0x10], edi
call fcn.1009f587
mov ecx, dword [ebp + 0x34]
add esp, 0x30
push edi
mov dword [ecx + 0x10], eax
xor eax, eax
push eax
push esi
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.1003f86c
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x11c]
push edi
adc ecx, edx
add eax, 1
adc ecx, edi
mov dword [ebp - 0x118], edx
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
imul ebx, esi
mov eax, dword [ebp - 0x18]
add ebx, eax
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.1003f86c
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x20c]
adc ecx, dword [ebp - 0x118]
push edi
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.1003f86c
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call fcn.100b4200
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.1000f647
push esi
push dword [ebp + 0x34]
lea ecx, [ebp + 0x6c]
call fcn.1003f86c
push dword [ebp + 0x6c]
call fcn.10043a60
cmp dword [ebp - 0x20], edi
pop ecx
jl 0x1006b826
mov esi, dword [ebp - 0x20]
jmp 0x1006b828
xor esi, esi
lea ecx, [ebp - 0xb4]
call fcn.1003f96c
lea ecx, [ebp + 0x18]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp + 0x54]
call fcn.1003f96c
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, edi
jmp 0x1006a386
lea ecx, [ebp - 0xb4]
call fcn.1003f96c
jmp 0x1006b60b
push 0x1000
lea ecx, [ebp + 0x1c]
call fcn.10046168
cmp dword [ebp - 0xc], ebx
jl 0x1006b90d
push 0x3b60
lea ecx, [ebp - 0x20]
call fcn.10045fcc
mov edi, dword [ebp - 0x20]
push 0x3960
lea esi, [edi + 0x200]
push ebx
push esi
call fcn.100b40f0
push dword [ebp - 0x8c]
push edi
push esi
call fcn.10055460
add esp, 0x18
xor edi, edi
lea eax, [esi + 4]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0xc]
je 0x1006b8d8
inc edi
add eax, 0x220
cmp edi, 0x1a
jle 0x1006b8c4
jmp 0x1006b903
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.10046168
imul edi, edi, 0x220
add esi, edi
movzx eax, byte [esi + 0x10]
push eax
push dword [esi + 4]
push str._d___c_
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.1003f96c
jmp 0x1006b933
cmp byte [ebp - 0x3f], 0
jne 0x1006b933
cmp byte [ebp + 0x5b], 4
mov eax, 0x100c8068
je 0x1006b923
mov eax, 0x100c8048
push eax
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
call fcn.10054fe7
add esp, 0x10
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0x54]
call fcn.1003f96c
cmp dword [ebp - 0xc0], ebx
jle 0x1006b95c
push dword [ebp - 0xc0]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xc4]
call fcn.1004b1e0
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0xd0]
call fcn.100457c2
lea ecx, [ebp + 0x66]
call fcn.10043b07
lea ecx, [ebp + 0x6c]
call fcn.10002d56
mov eax, 0x100e392c
cmp eax, ebx
je 0x1006b990
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0xdc]
call fcn.1003f96c
lea ecx, [ebp - 0xd0]
call fcn.1003f96c
lea ecx, [ebp - 0xf0]
call fcn.1003f96c
lea ecx, [ebp - 0x1e0]
call fcn.1003f96c
lea ecx, [ebp + 0x1c]
call fcn.1003f96c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8