Function at 0x402630
Capabilities:
Contain obfuscated stackstrings
Get storage device properties
Query or enumerate registry value

Disassembly:
mov eax, 0x1c20
call fcn.0040de70
push ebx
push ebp
push esi
push edi
mov ecx, 0x80
xor eax, eax
mov edi, 0x43f808
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x43fa14
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x43fc1c
rep stosd dword es:[edi], eax
mov ecx, 7
lea edi, [esp + 0x17d]
mov byte [esp + 0x17c], bl
push str..A:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x180]
mov dword [0x43f7fc], ebx
push eax
mov dword [0x43f800], ebx
mov dword [0x43f804], ebx
mov dword [0x43fa0c], ebx
mov dword [0x43fa10], ebx
mov dword [0x43fc14], ebx
mov dword [0x43fc18], ebx
call fcn.0040de9f
add esp, 8
mov cl, byte [esp + 0x1c38]
lea edx, [esp + 0x17c]
mov byte [esp + 0x180], cl
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x43f7d8], edx
je 0x403585
cmp edx, ebx
je 0x403585
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x228]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
mov ecx, 0x14
lea edi, [esp + 0x84]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x228]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x98], eax
push ebx
push ecx
lea eax, [esp + 0x8c]
push 0x50
push eax
lea ecx, [esp + 0x94]
push 0x50
push ecx
push 0x4d014
push edx
mov dword [esp + 0x3c], ebx
mov word [esp + 0xa4], 0x2c
mov byte [esp + 0xa7], bl
mov byte [esp + 0xa8], 1
mov byte [esp + 0xa9], bl
mov byte [esp + 0xaa], 0xa
mov byte [esp + 0xac], 1
mov byte [esp + 0xab], 0x18
mov dword [esp + 0xb0], 0x200
mov dword [esp + 0xb4], 3
mov dword [esp + 0xbc], 0x30
mov byte [esp + 0xc0], 0xd3
mov byte [esp + 0xc1], bl
mov byte [esp + 0xc2], bl
mov byte [esp + 0xc3], bl
mov byte [esp + 0xc4], bl
mov byte [esp + 0xc5], bl
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], bl
mov byte [esp + 0xc8], bl
mov byte [esp + 0xc9], bl
call ebp
test eax, eax
jne 0x402814
mov edx, dword [0x43f7d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret
mov al, byte [esp + 0x228]
mov cl, 0x5a
cmp al, cl
jne 0x403578
mov dl, byte [esp + 0x229]
mov al, 0xa5
cmp dl, al
jne 0x403578
cmp byte [esp + 0x22a], cl
jne 0x403578
cmp byte [esp + 0x22b], al
jne 0x403578
mov eax, dword [esp + 0x25d]
mov edx, dword [esp + 0x25e]
mov ecx, 0x80
lea esi, [esp + 0x228]
mov edi, 0x43fc1c
and eax, 0xff
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x25f]
and edx, 0xff
shl eax, 8
add eax, edx
and ecx, 0xff
mov dword [0x43f800], eax
mov eax, ecx
cdq
and edx, 0xff
mov dword [0x43f7fc], ecx
add eax, edx
mov byte [esp + 0xa0], 0xd4
sar eax, 8
and ecx, 0x800000ff
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], bl
mov byte [esp + 0xa3], al
jns 0x4028d4
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [esp + 0x1c]
mov byte [esp + 0xa4], cl
push ebx
push eax
mov eax, dword [0x43f7d8]
lea ecx, [esp + 0x8c]
push 0x50
push ecx
lea edx, [esp + 0x94]
push 0x50
push edx
push 0x4d014
push eax
mov byte [esp + 0xc5], 1
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], bl
mov byte [esp + 0xc8], bl
mov byte [esp + 0xc9], bl
call ebp
test eax, eax
je 0x403578
mov edx, dword [0x43f800]
xor ecx, ecx
cmp edx, ebx
jle 0x402954
mov al, byte [esp + ecx + 0x228]
cmp al, 0xff
je 0x40294f
cmp al, bl
je 0x40294f
mov byte [ecx + 0x43f808], al
inc ecx
cmp ecx, edx
jl 0x40293a
cmp byte [0x43f808], bl
je 0x402968
cmp byte [0x43f809], bl
jne 0x402a57
mov edx, dword [0x43f7fc]
mov byte [esp + 0xa0], 0xd4
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], bl
lea ecx, [edx + edx]
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
sar eax, 8
and ecx, 0x800000ff
mov byte [esp + 0xa3], al
jns 0x4029ac
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [esp + 0x1c]
mov byte [esp + 0xa4], cl
push ebx
push eax
mov eax, dword [0x43f7d8]
lea ecx, [esp + 0x8c]
push 0x50
push ecx
lea edx, [esp + 0x94]
push 0x50
push edx
push 0x4d014
push eax
mov byte [esp + 0xc5], 1
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], bl
mov byte [esp + 0xc8], bl
mov byte [esp + 0xc9], bl
call ebp
test eax, eax
je 0x403578
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xa2d]
mov edx, dword [0x43f800]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp edx, ebx
jle 0x402a41
mov cl, byte [esp + eax + 0x228]
cmp cl, 0xff
je 0x402a3c
cmp cl, bl
je 0x402a3c
mov byte [esp + eax + 0xa2c], cl
inc eax
cmp eax, edx
jl 0x402a25
mov ecx, 0x7f
lea esi, [esp + 0xa2d]
mov edi, 0x43f808
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [0x43f808], bl
je 0x402cc7
cmp byte [0x43f809], bl
je 0x402cc7
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0xc2d]
mov byte [esp + 0xc2c], bl
rep stosd dword es:[edi], eax
mov edi, 0x43f808
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 8
lea edx, [esp + 0xc30]
mov al, byte [ecx + 0x43f807]
mov dword [0x43fc18], eax
imul eax, dword [0x43f7fc]
push eax
push edx
call fcn.00402040
mov eax, dword [0x43fc18]
mov ecx, 0x10
mov dword [0x440ea4], eax
xor eax, eax
lea edi, [esp + 0x1f1]
mov byte [esp + 0x1f0], bl
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x1a9]
mov byte [esp + 0x1a8], bl
push 0x200
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1ac]
push ecx
push 0x43fc1c
call fcn.00401d60
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x1d9]
mov byte [esp + 0x1d8], bl
rep stosd dword es:[edi], eax
mov edi, 0x43f808
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x1d8]
push ecx
push edx
push 0x43f808
call fcn.00401d60
mov ecx, 8
lea esi, [esp + 0x1c0]
lea edi, [esp + 0x208]
lea eax, [esp + 0x208]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x1e4]
lea edi, [esp + 0x228]
push eax
rep movsd dword es:[edi], dword [esi]
push 8
lea ecx, [esp + 0xc58]
push 0x43fe1c
push ecx
call fcn.004024b0
add esp, 0x34
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x65]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, 0x78
mov al, 0x65
mov byte [esp + 0x64], dl
mov byte [esp + 0x65], 0x69
mov byte [esp + 0x66], 0x6e
mov byte [esp + 0x67], 0x6a
mov byte [esp + 0x68], 0x69
mov byte [esp + 0x69], 0x6e
mov byte [esp + 0x6a], 0x6b
mov byte [esp + 0x6b], al
mov byte [esp + 0x6d], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x109]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xe9]
mov byte [esp + 0x108], dl
rep stosd dword es:[edi], eax
mov edx, dword [0x43fe1c]
mov ecx, dword [0x43fe24]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x43fe20]
mov dword [esp + 0xe8], edx
mov edx, dword [0x43fe28]
mov byte [esp + 0x6c], 0x4b
mov byte [esp + 0x6e], 0x79
mov byte [esp + 0x6f], 0x31
mov byte [esp + 0x70], 0x30
mov byte [esp + 0x71], 0x32
mov byte [esp + 0x72], 0x30
mov byte [esp + 0x73], 0x31
mov byte [esp + 0x109], 0x6a
mov byte [esp + 0x10a], 0x6b
mov byte [esp + 0x10b], 0x5f
mov byte [esp + 0x10c], 0x6a
mov byte [esp + 0x10d], 0x77
mov byte [esp + 0x10e], 0x68
mov byte [esp + 0x10f], 0x31
mov byte [esp + 0x110], 0x33
mov byte [esp + 0x111], 0x38
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], ecx
mov dword [esp + 0xf4], edx
lea edi, [esp + 0x64]
lea esi, [esp + 0xe8]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x402cbe
cmp al, bl
je 0x402cba
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x402cbe
add esi, 2
add edi, 2
cmp al, bl
jne 0x402c96
xor eax, eax
jmp 0x402cc3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x402ce0
mov eax, dword [0x43f7d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xe9]
mov edx, dword [0x43fe50]
rep stosd dword es:[edi], eax
mov ecx, dword [0x43fe4c]
lea esi, [esp + 0xe8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x43fe54]
mov dword [esp + 0xe8], ecx
mov ecx, dword [0x43fe58]
mov dword [esp + 0xec], edx
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], ecx
lea edi, [esp + 0x108]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x402d5c
cmp al, bl
je 0x402d58
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x402d5c
add esi, 2
add edi, 2
cmp al, bl
jne 0x402d34
xor eax, eax
jmp 0x402d61
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x402d7f
mov edx, dword [0x43f7d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret
mov edx, dword [esp + 0x1c34]
xor eax, eax
mov dword [esp + 0xd5], eax
mov edi, edx
mov dword [esp + 0xd9], eax
or ecx, 0xffffffff
mov dword [esp + 0xdd], eax
mov byte [esp + 0xd4], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xe1], eax
push ecx
lea ecx, [esp + 0xd8]
push ecx
push edx
call fcn.00401cb0
mov eax, dword [0x43fe2c]
mov ecx, dword [0x43fe30]
add esp, 0xc
xor edx, edx
mov dword [esp + 0x65], edx
mov dword [esp + 0x64], eax
mov eax, dword [0x43fe38]
mov dword [esp + 0x69], edx
mov dword [esp + 0x6d], edx
mov dword [esp + 0x68], ecx
mov ecx, dword [0x43fe5c]
mov dword [esp + 0x71], edx
mov edx, dword [0x43fe34]
mov dword [esp + 0x70], eax
mov eax, dword [0x43fe64]
mov dword [esp + 0x6c], edx
mov edx, dword [0x43fe60]
mov dword [0x43f7dc], ecx
mov ecx, dword [0x43fe68]
mov dword [0x43f7e0], edx
mov dword [0x43f7e4], eax
mov dword [0x43f7e8], ecx
lea edi, [esp + 0xd4]
lea esi, [esp + 0x64]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x402e60
cmp al, bl
je 0x402e5c
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x402e60
add esi, 2
add edi, 2
cmp al, bl
jne 0x402e38
xor eax, eax
jmp 0x402e65
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x402e83
mov edx, dword [0x43f7d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret
mov eax, dword [0x44001c]
xor ecx, ecx
mov ebp, eax
mov cl, ah
and ebp, 0xff
mov esi, 0x44021c
shl ebp, 8
or ebp, ecx
mov ecx, 0x20
mov edi, 0x440e20
xor edx, edx
mov dl, byte [0x44001e]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x44001f]
mov ecx, 0x40
mov esi, 0x43ff1c
mov edi, 0x4355cc
rep movsd dword es:[edi], dword [esi]
shl ebp, 8
mov ecx, 0x40
mov esi, 0x44011c
mov edi, 0x43b7d0
or ebp, edx
rep movsd dword es:[edi], dword [esi]
shl ebp, 8
mov ecx, 0x80
mov esi, 0x44061c
mov edi, 0x4357d0
or ebp, eax
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
mov ecx, 0x80
mov esi, 0x44081c
mov edi, 0x4377d0
cdq
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x80
mov esi, 0x440a1c
mov edi, 0x4397d0
and edx, 0x1ff
rep movsd dword es:[edi], dword [esi]
add eax, edx
mov dword [0x43fa08], ebp
mov ecx, eax
sar ecx, 9
and ebp, 0x800001ff
jns 0x402f3e
dec ebp
or ebp, 0xfffffe00
inc ebp
test ebp, ebp
jle 0x402f43
inc ecx
mov esi, dword [0x43f7fc]
mov eax, ecx
cdq
idiv esi
mov ebp, eax
mov eax, ecx
cdq
idiv esi
test edx, edx
jle 0x402f5a
inc ebp
lea esi, [ebp + 0x43f808]
mov ecx, 0x80
mov edi, 0x43fa14
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov edi, 0x43fa14
or ecx, 0xffffffff
inc ebp
repne scasb al, byte es:[edi]
not ecx
mov dword [0x43fa0c], ebp
imul ebp, dword [0x43f7fc]
add ecx, 0xfffffffe
mov dword [0x43fc14], ebp
mov dword [0x43fa10], ecx
mov byte [ecx + 0x43fa14], bl
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push 0x431298
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, pe_nt_image_headers32
xor eax, eax
mov ecx, ebp
lea edi, [esp + 0x429]
mov byte [esp + 0x428], bl
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x428]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x431294
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x468]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x431290
push eax
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x4a8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x43128c
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x4e8]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x431288
push edx
mov dword [esp + 0x28], ebp
call esi
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
lea ecx, [esp + 0x528]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x431284
push eax
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x568]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x431280
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x5a8]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x43127c
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x5e8]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x431278
push eax
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x628]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x431274
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x668]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.9876543210
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x6a8]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x43126c
mov dword [esp + 0x24], ebp
push eax
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x6e8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x431268
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x728]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x431264
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x768]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x431260
push eax
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x7a8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x43125c
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x7e8]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x431258
push edx
mov dword [esp + 0x28], ebp
call esi
xor ecx, ecx
mov al, byte [esp + ecx + 0x428]
cmp al, 0x61
jb 0x403229
cmp al, 0x7a
ja 0x403229
sub al, 0x20
mov byte [esp + ecx + 0x428], al
inc ecx
cmp ecx, 0x3ff
jl 0x403211
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x21]
mov dl, 0x5c
rep stosd dword es:[edi], eax
mov cl, 0x44
mov al, 0x41
mov byte [esp + 0x26], cl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2f], cl
mov byte [esp + 0x34], al
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x139]
mov byte [esp + 0x23], dl
mov byte [esp + 0x35], dl
mov byte [esp + 0x20], 0x55
mov byte [esp + 0x21], 0x53
mov byte [esp + 0x22], 0x42
mov byte [esp + 0x24], 0x56
mov byte [esp + 0x25], 0x49
mov byte [esp + 0x27], 0x5f
mov byte [esp + 0x28], 0x35
mov byte [esp + 0x29], 0x30
mov byte [esp + 0x2a], 0x31
mov byte [esp + 0x2c], 0x26
mov byte [esp + 0x2d], 0x50
mov byte [esp + 0x2e], 0x49
mov byte [esp + 0x30], 0x5f
mov byte [esp + 0x31], 0x36
mov byte [esp + 0x32], 0x31
mov byte [esp + 0x33], 0x31
mov byte [esp + 0x36], 0x58
mov byte [esp + 0x37], 0x4a
mov byte [esp + 0x38], 0x4b
mov byte [esp + 0x39], 0x32
mov byte [esp + 0x3a], 0x30
mov byte [esp + 0x3b], 0x31
mov byte [esp + 0x3c], 0x34
mov byte [esp + 0x3d], 0x30
mov byte [esp + 0x3e], 0x30
mov byte [esp + 0x3f], 0x30
mov byte [esp + 0x40], 0x30
mov byte [esp + 0x41], 0x30
mov byte [esp + 0x42], 0x30
mov byte [esp + 0x43], 0x30
mov byte [esp + 0x44], 0x30
mov byte [esp + 0x45], 0x31
xor edx, edx
rep stosd dword es:[edi], eax
lea ebp, [esp + 0x428]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x138]
mov esi, ebp
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x10
lea edi, [esp + 0x138]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x20]
lea esi, [esp + 0x138]
mov cl, byte [esi]
mov al, cl
cmp cl, byte [edi]
jne 0x403366
cmp al, bl
je 0x403362
mov cl, byte [esi + 1]
mov al, cl
cmp cl, byte [edi + 1]
jne 0x403366
add esi, 2
add edi, 2
cmp al, bl
jne 0x403342
xor eax, eax
jmp 0x40336b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x403392
inc edx
add ebp, 0x40
cmp edx, 0x10
jl 0x403316
mov edx, dword [0x43f7d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret
lea eax, [esp + 0x128]
push ebx
push eax
mov eax, dword [0x43f7d8]
lea ecx, [esp + 0x834]
push 0x200
push ecx
lea edx, [esp + 0x13c]
push 0xc
push edx
push 0x2d1400
push eax
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x838]
lea edi, [esp + 0x139]
mov ebp, 1
lea esi, [esp + 0x138]
mov edx, dword [esp + eax + 0x82c]
mov ecx, dword [esp + eax + 0x830]
mov eax, dword [esp + 0x83c]
mov dword [0x440ecc], ecx
mov dword [0x440ec8], edx
lea ecx, [esp + eax + 0x82c]
mov eax, dword [esp + eax + 0x82c]
mov dword [0x440ea8], eax
mov eax, dword [ecx + 4]
mov dword [0x440eac], eax
mov eax, dword [ecx + 8]
mov dword [0x440eb0], eax
xor eax, eax
mov ecx, dword [ecx + 0xc]
mov dword [0x440eb4], ecx
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
mov byte [esp + 0x138], 0x58
mov byte [esp + 0x139], 0x69
mov byte [esp + 0x13a], 0x6e
mov byte [esp + 0x13b], 0x6a
mov byte [esp + 0x13c], 0x6b
mov byte [esp + 0x20], 0x58
mov byte [esp + 0x21], 0x49
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x4a
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x25], 0x5f
mov byte [esp + 0x26], 0x4b
mov byte [esp + 0x27], 0x45
mov byte [esp + 0x28], 0x59
mov byte [esp + 0x29], 0x30
mov byte [esp + 0x2a], 0x30
mov byte [esp + 0x2b], 0x35
mov byte [esp + 0x2c], 0x31
mov edi, 0x440ec8
mov cl, byte [esi]
mov al, cl
cmp cl, byte [edi]
jne 0x4034de
cmp al, bl
je 0x4034da
mov cl, byte [esi + 1]
mov al, cl
cmp cl, byte [edi + 1]
jne 0x4034de
add esi, 2
add edi, 2
cmp al, bl
jne 0x4034ba
xor eax, eax
jmp 0x4034e3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4034e9
xor ebp, ebp
mov edi, 0x440ea8
lea esi, [esp + 0x20]
mov cl, byte [esi]
mov al, cl
cmp cl, byte [edi]
jne 0x403516
cmp al, bl
je 0x403512
mov cl, byte [esi + 1]
mov al, cl
cmp cl, byte [edi + 1]
jne 0x403516
add esi, 2
add edi, 2
cmp al, bl
jne 0x4034f2
xor eax, eax
jmp 0x40351b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403523
cmp ebp, ebx
jne 0x40353d
mov edx, dword [0x43f7d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret
mov al, byte [0x440ea8]
mov bl, byte [0x440e20]
mov cl, byte [0x440e21]
sub dl, 0x58
sub al, 0x58
add bl, dl
add cl, al
pop edi
mov eax, 1
pop esi
mov byte [0x440e20], bl
pop ebp
mov byte [0x440e21], cl
mov dword [0x43f804], eax
pop ebx
add esp, 0x1c20
ret
mov ecx, dword [0x43f7d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c20
ret