Function at 0x4109b0
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44fb63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4666b4]
xor ebx, ebx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov edi, dword [esp + 0x1a0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, 0x46c16c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x46c16c
mov byte [esp + 0x198], 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404f90
add esp, 4
cmp eax, ebx
mov dword [0x46c168], eax
je 0x411239
cmp eax, 0xffffffff
je 0x411239
mov ecx, dword [0x46bb84]
cmp ecx, ebx
je 0x4111d0
mov al, byte [ecx + 0x140]
test al, al
jne 0x410dac
mov eax, dword [0x46bd6c]
cmp eax, ebx
je 0x410a72
mov esi, dword [ecx + 0x30]
cmp esi, ebx
je 0x410a72
xor edx, edx
div esi
mov dword [0x46bda4], eax
jmp 0x410a78
mov dword [0x46bda4], ebx
mov edx, dword [0x46bb88]
mov eax, dword [ecx + 0x60]
push ebx
push ebx
push 0x80
push edx
push eax
call fcn.00404100
add esp, 0x14
cmp eax, ebx
jne 0x410a9c
xor ecx, ecx
xor esi, esi
jmp 0x410ab0
mov cl, byte [eax + 8]
test cl, cl
jne 0x410aaa
mov ecx, dword [eax + 0x10]
xor esi, esi
jmp 0x410ab0
mov ecx, dword [eax + 0x30]
mov esi, dword [eax + 0x34]
mov eax, dword [0x46bd6c]
cdq
cmp eax, ecx
jne 0x410abe
cmp edx, esi
je 0x410ae0
push str.mftsize__Get_Attr_Datasize_attrptr_
push 0x5ff
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x410ae0
push eax
call fcn.0041c4fb
mov ecx, dword [0x46bb88]
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x60]
push ebx
push ebx
push 0xb0
push ecx
push eax
call fcn.00404100
add esp, 0x14
cmp eax, ebx
jne 0x410b0a
xor esi, esi
xor ecx, ecx
jmp 0x410b1e
mov cl, byte [eax + 8]
test cl, cl
jne 0x410b18
mov esi, dword [eax + 0x10]
xor ecx, ecx
jmp 0x410b1e
mov esi, dword [eax + 0x30]
mov ecx, dword [eax + 0x34]
mov eax, dword [0x46bd6c]
mov edi, dword [0x46bb84]
xor edx, edx
div dword [edi + 0x30]
xor edx, edx
add eax, 7
shr eax, 3
cmp edx, ecx
jl 0x410b62
jg 0x410b40
cmp eax, esi
jbe 0x410b62
push str.__mftsize_Vcb__BytesPerFileRecordSegment7__8__Get_Attr_Datasize_attrptr_
push 0x602
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x410b62
push eax
call fcn.0041c4fb
mov ecx, dword [0x46bb88]
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x60]
push ebx
push ecx
push eax
call fcn.00403e50
mov ecx, dword [0x46bb94]
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x60]
push ebx
push ebx
push 0x60
push ecx
push eax
call fcn.00404100
mov esi, eax
add esp, 0x20
cmp esi, ebx
jne 0x410ba2
xor eax, eax
xor ecx, ecx
jmp 0x410bb6
mov al, byte [esi + 8]
test al, al
jne 0x410bb0
mov eax, dword [esi + 0x10]
xor ecx, ecx
jmp 0x410bb6
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 1
push ecx
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
push eax
push ebx
push ebx
push esi
push edx
call fcn.004037c0
add esp, 0x1c
cmp esi, ebx
mov edi, eax
jne 0x410bdb
xor eax, eax
xor edx, edx
jmp 0x410bef
mov al, byte [esi + 8]
test al, al
jne 0x410be9
mov eax, dword [esi + 0x10]
xor edx, edx
jmp 0x410bef
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov ecx, 1
call fcn.0041c950
push eax
lea eax, [esp + 0x90]
push edi
push eax
call fcn.0041cb7a
add esp, 0xc
cmp esi, ebx
jne 0x410c15
xor eax, eax
xor esi, esi
jmp 0x410c29
mov al, byte [esi + 8]
test al, al
jne 0x410c23
mov eax, dword [esi + 0x10]
xor esi, esi
jmp 0x410c29
mov eax, dword [esi + 0x30]
mov esi, dword [esi + 0x34]
mov ecx, 1
mov edx, esi
call fcn.0041c950
mov ecx, dword [0x46bb94]
mov edx, dword [0x46bb84]
push ebx
push ebx
push 0x70
mov byte [esp + eax + 0x98], 0
mov eax, dword [edx + 0x60]
push ecx
push eax
call fcn.00404100
add esp, 0x14
cmp eax, ebx
jne 0x410c64
xor ecx, ecx
xor edx, edx
jmp 0x410c78
mov cl, byte [eax + 8]
test cl, cl
jne 0x410c72
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x410c78
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 1
push edx
push ecx
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
push ebx
push ebx
push eax
push edx
call fcn.004037c0
mov eax, dword [0x46bba0]
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
push ebx
push ebx
push 0x80
push eax
push edx
call fcn.00404100
add esp, 0x30
cmp eax, ebx
jne 0x410cb7
xor edi, edi
xor esi, esi
jmp 0x410ccb
mov cl, byte [eax + 8]
test cl, cl
jne 0x410cc5
mov edi, dword [eax + 0x10]
xor esi, esi
jmp 0x410ccb
mov edi, dword [eax + 0x30]
mov esi, dword [eax + 0x34]
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
push ebx
add ecx, 7
push 8
adc edx, ebx
push edx
push ecx
call fcn.0041c8a0
cmp edx, esi
jl 0x410d11
jg 0x410cef
cmp eax, edi
jbe 0x410d11
push str._Vcb__TotalClusters7__8_Get_Attr_Datasize_attrptr_
push 0x626
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x410d11
push eax
call fcn.0041c4fb
mov ecx, 0x46b1e0
call fcn.00402720
mov ecx, dword [0x46bb84]
mov esi, dword [ecx + 0x18]
mov edx, dword [ecx + 0x10]
mov ebp, dword [ecx + 0x1c]
xor edi, edi
sub edx, esi
mov esi, dword [ecx + 0x14]
sbb esi, ebp
sub edx, eax
sbb esi, edi
js 0x410d71
jg 0x410d3f
cmp edx, ebx
jbe 0x410d71
mov ebp, dword [0x46b1e4]
mov eax, dword [ebp]
shr eax, 0xf
test al, 1
jne 0x410d71
xor edi, edi
mov eax, edi
shr eax, 5
mov eax, dword [ebp + eax*4]
mov ecx, edi
and ecx, 0x1f
shr eax, cl
test al, 1
jne 0x410d6b
add edx, 0xffffffff
adc esi, 0xffffffff
inc edi
cmp edi, 0x10
jl 0x410d51
call fcn.0040dcd0
mov eax, dword [esp + 0x1a4]
xor ecx, ecx
mov cl, byte [eax + 0x79]
lea edx, [eax + 0x58]
add eax, 0x54
push ecx
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00434b58
mov eax, dword [esp + 0x1a8]
push eax
call fcn.0040f960
add esp, 0x10
jmp 0x4111ca
push ebx
lea ecx, [esp + 0x34]
call fcn.00414250
mov ecx, dword [0x46bb84]
mov ecx, dword [ecx + 0x68]
mov ax, word [ecx + 0xe]
cmp ax, bx
mov byte [esp + 0x194], 4
jne 0x410dda
mov eax, dword [ecx + 0x1c]
xor edx, edx
mov dx, word [ecx]
jmp 0x410de4
and eax, 0xffff
xor edx, edx
mov dx, word [ecx]
imul eax, edx
push 4
push 0x1000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [0x46bb84]
mov dword [0x46bfe8], eax
mov ecx, dword [esi + 0x68]
xor edx, edx
mov dx, word [ecx + 0xe]
cmp dx, bx
jne 0x410e14
mov edx, dword [ecx + 0x1c]
jmp 0x410e1a
and edx, 0xffff
push edx
push eax
xor eax, eax
mov ax, word [ecx + 4]
cdq
push edx
push eax
mov eax, dword [esi + 0x60]
push eax
call fcn.00405950
add esp, 0x14
push ebx
lea ecx, [esp + 0x34]
call fcn.004142a0
push 0x3ec
lea ecx, [esp + 0x34]
call fcn.0043428a
push str.Scanning_FAT_drive
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00434e51
mov ecx, dword [0x46bb84]
mov ecx, dword [ecx + 0x68]
mov si, word [ecx + 0xe]
cmp si, bx
mov byte [esp + 0x194], 5
jne 0x410e7a
mov eax, 0x20
jmp 0x410ed7
xor eax, eax
mov ax, word [ecx + 0xa]
cmp ax, bx
je 0x410e8e
and eax, 0xffff
mov ebx, eax
jmp 0x410e91
mov ebx, dword [ecx + 0x18]
xor eax, eax
mov ax, word [ecx + 8]
xor ebp, ebp
mov bp, word [ecx]
xor edx, edx
and esi, 0xffff
shl eax, 5
div ebp
mov edx, eax
mov eax, ebx
sub eax, edx
xor edx, edx
mov dl, byte [ecx + 6]
xor ebx, ebx
mov bl, byte [ecx + 2]
imul edx, esi
sub eax, edx
xor edx, edx
mov dx, word [ecx + 4]
sub eax, edx
xor edx, edx
div ebx
cmp eax, 0xff7
sbb eax, eax
and eax, 0xfffffffc
add eax, 0x10
and eax, 0xff
push eax
lea eax, [esp + 0x18]
push str.Scanning_FAT_d_drive
push eax
call fcn.0042e13c
mov ecx, dword [0x46bb84]
xor edx, edx
mov dl, byte [ecx + 0x64]
add esp, 0xc
lea ecx, [esp + 0x14]
push edx
call fcn.004351e6
push str.__Please_wait...
lea ecx, [esp + 0x18]
call fcn.004351bf
mov eax, dword [esp + 0x14]
push eax
mov ecx, edi
call fcn.004343da
push 0x3eb
lea ecx, [esp + 0x34]
call fcn.0043428a
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x27100000
mov edi, eax
mov ecx, dword [edi + 0x1c]
push 0
push 0x401
push ecx
mov dword [esp + 0x2c], edi
call esi
mov edx, dword [edi + 0x1c]
push 0
push 1
push 0x404
push edx
call esi
push 0x463294
lea ecx, [esp + 0x28]
call fcn.00434e51
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x68]
cmp word [ecx + 0xe], 0
mov ebp, dword [eax + 0x70]
mov esi, dword [eax + 0x6c]
mov byte [esp + 0x194], 6
mov dword [esp + 0x10], ebp
jne 0x4110ae
mov edi, dword [ecx + 0x28]
xor edx, edx
mov dl, byte [ecx + 6]
lea ebx, [edi - 2]
xor ebp, ebp
mov bp, word [ecx]
mov esi, edx
imul esi, dword [ecx + 0x1c]
xor edx, edx
mov dl, byte [ecx + 2]
imul edx, ebx
add esi, edx
xor edx, edx
mov dx, word [ecx + 4]
add esi, edx
xor edx, edx
imul esi, ebp
mov dx, word [ecx + 8]
mov ebp, dword [esp + 0x10]
shl edx, 5
add esi, edx
cmp edi, 0xfffffff
je 0x4110ae
mov ecx, dword [eax + 0x68]
xor edx, edx
mov dl, byte [ecx + 2]
xor ebx, ebx
mov bx, word [ecx]
imul edx, ebx
add ebp, edx
cmp edi, dword [ecx + 0x28]
jbe 0x411009
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
add edx, 1
adc ecx, 0
xor ebx, ebx
cmp ebx, ecx
jg 0x4110ae
jl 0x411009
cmp edi, edx
ja 0x4110ae
cmp edi, 1
ja 0x411033
push str.RootDirectoryCluster_1
push 0x68c
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
je 0x4111de
mov eax, dword [0x46bb84]
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
add edx, 1
adc ecx, 0
xor ebx, ebx
cmp ebx, ecx
jl 0x411070
jg 0x41104b
cmp edi, edx
jbe 0x411070
push str.RootDirectoryCluster___Vcb__TotalClusters1
push 0x68d
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
je 0x4111e5
mov eax, dword [0x46bb84]
mov ecx, dword [0x46bfe8]
push ecx
push edi
push eax
call fcn.00406340
mov edx, dword [0x46bb84]
mov edi, eax
push edi
push edx
call fcn.004062d0
add esp, 0x14
test eax, eax
jl 0x41109d
cmp eax, 2
jle 0x4111ec
cmp edi, 0xfffffff
mov eax, dword [0x46bb84]
jne 0x410fd2
mov eax, dword [eax + 0x28]
push 0
push eax
xor eax, eax
push eax
push esi
call fcn.0041c8a0
push 4
push 0x1000
push ebp
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x46bb84]
mov edi, eax
xor edx, edx
mov eax, ebp
div dword [ecx + 0x28]
mov ecx, dword [ecx + 0x60]
push eax
mov eax, esi
cdq
push edi
push edx
push eax
push ecx
call fcn.00405950
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0x68]
xor esi, esi
mov si, word [eax + 8]
add esp, 0x14
cmp word [eax + 0xe], 0
jne 0x41110c
shr ebp, 5
mov esi, ebp
add ecx, 0x64
push ecx
lea ecx, [esp + 0x14]
call fcn.00434e51
mov eax, dword [esp + 0x1a4]
xor edx, edx
mov dl, byte [eax + 0x79]
push 0
lea ecx, [eax + 0x58]
add eax, 0x54
mov byte [esp + 0x198], 8
push edx
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00434b58
mov edx, dword [esp + 0x2c]
mov ecx, dword [0x46bb84]
push esi
push edx
mov edx, dword [esp + 0x1b4]
lea eax, [esp + 0x28]
push eax
push edi
push ecx
push edx
call fcn.0040fcf0
add esp, 0x28
lea ecx, [esp + 0x10]
mov byte [esp + 0x194], 6
call fcn.00434de3
mov eax, dword [0x46bfe8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push eax
call esi
push 0x8000
push 0
push edi
call esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x194], 5
call fcn.00434de3
lea ecx, [esp + 0x14]
mov byte [esp + 0x194], 4
call fcn.00434de3
lea ecx, [esp + 0x30]
mov byte [esp + 0x194], 3
call fcn.004307b2
mov ecx, dword [0x46bb84]
mov ecx, dword [ecx + 0x60]
push ecx
call fcn.00405560
add esp, 4
jmp 0x41123e
push 1
call fcn.0041c4fb
push 1
call fcn.0041c4fb
push 0xc
call fcn.004353c7
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x194], 7
je 0x41121c
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov dword [esp + 0x14], str.Bad_Root
call fcn.0041ddd5
jmp 0x41121e
xor eax, eax
push 0x45c5d0
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x19c], 6
mov dword [esp + 0x30], eax
call fcn.0041de35
call fcn.004028e0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x194], 2
call fcn.00434de3
lea ecx, [esp + 0x20]
mov byte [esp + 0x194], 1
call fcn.00434de3
lea ecx, [esp + 0x18]
mov byte [esp + 0x194], 0
call fcn.00434de3
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x194], 0xffffffff
call fcn.00434de3
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x188
ret