Function at 0x405170
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
sub esp, 0x864
mov dl, byte [0x412674]
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], dl
mov byte [esp + 0x464], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x465]
mov byte [esp + 0x770], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x771]
mov byte [esp + 0x66c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x66d]
mov byte [esp + 0x360], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x361]
mov byte [esp + 0x568], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x569]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404d60
cmp eax, 9
jne 0x405236
mov dword [esp + 0x14], 1
call fcn.00401610
mov esi, eax
lea eax, [esp + 0x11c]
push 0x104
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x405266
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x864
ret
test esi, esi
je 0x40531b
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x11c]
mov edx, ecx
sub eax, 8
add edx, eax
or ecx, 0xffffffff
mov edi, str.syswow64
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x568]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x568]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x568]
mov edx, ecx
sub eax, 8
add edx, eax
mov edi, str.system32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x878]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
je 0x40539f
call fcn.00402d70
mov edi, str.C:Program_Files__x86_BOCOM2010USBKeyHuaDa
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x360]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4055f1
call fcn.00402cb0
or ecx, 0xffffffff
mov edi, str.C:Program_FilesBOCOM2010USBKeyHuaDa
xor eax, eax
lea edx, [esp + 0x360]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.usbccid.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x770]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x220]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x405485
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x18]
push ecx
push 0x40f880
push 0xa3
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.usbccid.sys
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40552f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0xa1
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.usbccid.cat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4055d9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0xa2
push ebp
call fcn.00401a50
add esp, 0x10
mov eax, dword [0x41266c]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4056c7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call fcn.00401970
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x40f83c
push 0x75
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
push 0x402
push 0x3e8
push edx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDADM_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4057b2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call fcn.00401970
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x40f83c
push 0x76
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
push 0x402
push 0x3e8
push edx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon_Srv.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40589d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call fcn.004019e0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x40f83c
push 0x7b
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
push 0x402
push 0x3e8
push edx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405988
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call fcn.00401970
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x40f83c
push 0x75
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
push 0x402
push 0x3e8
push edx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDADM_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405a73
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call fcn.00401970
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x40f83c
push 0x76
push ebp
call fcn.00401a50
lea edx, [esp + 0x28]
push edx
call fcn.00402040
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2c]
add esp, 0x14
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDUNI_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405b24
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f83c
push 0x8d
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDUNI_JH.exe.manifest
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405bfc
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x81
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405cd4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x70
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.sig
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405da9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x84
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDAPP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405e81
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x71
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCOS_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x405f56
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x72
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDIFD_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40602b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x73
push ebp
call fcn.00401a50
mov eax, dword [0x41266c]
add esp, 0x10
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406e1f
mov eax, dword [esp + 0x10]
mov ecx, 0x41
test eax, eax
je 0x4067e9
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.minidriver64.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406118
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x99
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hsminidriver.cat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4061c2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x98
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver64.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40626c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x97
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406316
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x95
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.48A7CE70_103B_49ea_BC6F_BB85EEA9BADE.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4063cb
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x7f
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_cn
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_cn], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.2f5fee00_b238_4c4e_83ab_6ad0c3400b06.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40647d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x7a
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_tw
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_tw], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.4a22ace8_6a22_4ff1_8298_1f8318c54c69.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40652f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x80
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.VISTA64_DriverInstall.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x66c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x220]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x4065ff
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x18]
push ecx
push 0x40f83c
push 0x8f
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ed627732_be64_4a02_98cf_c833a28f4c21.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4066a9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f83c
push 0x93
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.JHCSPSetup_HSIC
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406753
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f83c
push 0x90
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.JHCSPSetup.exe.manifest
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406e07
jmp 0x406dea
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.minidriver.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x66c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x220]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x40689c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x18]
push ecx
push 0x40f880
push 0x94
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hsminidriver.cat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406946
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x92
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4069f0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x95
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStoreen_US], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.48A7CE70_103B_49ea_BC6F_BB85EEA9BADE.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406aa5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x7f
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_cn
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_cn], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.2f5fee00_b238_4c4e_83ab_6ad0c3400b06.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406b57
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x7a
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x11c]
mov edi, str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_tw
mov byte [str.C:ProgramDataMicrosoftWindowsDeviceMetadataStorezh_tw], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.4a22ace8_6a22_4ff1_8298_1f8318c54c69.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406c09
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f880
push 0x80
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ed627732_be64_4a02_98cf_c833a28f4c21.devicemetadata_ms
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406cb3
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f83c
push 0x93
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.JHCSPSetup_HSIC
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406d5d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f83c
push 0x90
push ebp
call fcn.00401a50
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.JHCSPSetup.exe.manifest
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406e07
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push 0x40f83c
push 0x91
push ebp
call fcn.00401a50
add esp, 0x10
mov eax, dword [0x41266c]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406e67
lea edx, [esp + 0x66c]
push edx
call fcn.00404f30
add esp, 4
jmp 0x406e84
lea eax, [esp + 0x770]
push eax
call fcn.00404ef0
lea ecx, [esp + 0x670]
push ecx
call fcn.00404f10
add esp, 8
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x41266c], eax
call ebp
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
call fcn.00403150
mov eax, dword [0x41266c]
push 0
mov ecx, eax
inc eax
mov dword [0x41266c], eax
mov eax, dword [0x412670]
push ecx
push 0x402
push 0x3e8
push eax
call ebp
push eax
call esi
call fcn.00401b00
mov eax, dword [0x41266c]
push 0
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call ebp
push eax
call esi
call fcn.00401ef0
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x41266c], eax
call ebp
push eax
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HS_MiniDriver.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x220]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406fbd
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x41266c]
push 0
mov ecx, eax
inc eax
mov dword [0x41266c], eax
mov eax, dword [0x412670]
push ecx
push 0x402
push 0x3e8
push eax
call ebp
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BOCOM_2010USBKey_HDE_mon_Srv.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004018a0
mov eax, dword [0x41266c]
add esp, 4
mov ecx, eax
inc eax
push 0
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call ebp
push eax
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x360]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.HDADM_JH.exe
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x468]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
lea edi, [esp + 0x468]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x468]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDUNI_JH.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x41266c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
inc eax
mov dword [0x41266c], eax
mov eax, dword [0x412670]
push ecx
push 0x402
push 0x3e8
push eax
call ebp
push eax
call ebx
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x568]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x41266c]
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
inc eax
push ecx
mov ecx, dword [0x412670]
push 0x402
push 0x3e8
push ecx
mov dword [0x41266c], eax
call ebp
push eax
call ebx
lea edx, [esp + 0x464]
push 0
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00402e30
lea ecx, [esp + 0x470]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.00404f90
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2c]
add esp, 0x14
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
test eax, eax
mov edi, str._SystemRoot__
je 0x40722a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.syswow64
jmp 0x407250
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.system32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call fcn.004025d0
add esp, 8
test eax, eax
jne 0x4072c5
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x864
ret
mov eax, dword [0x41266c]
mov edx, dword [0x412670]
mov ecx, eax
push 0
push ecx
push 0x402
inc eax
push 0x3e8
push edx
mov dword [0x41266c], eax
call ebp
push eax
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov edi, str._SystemRoot__
test eax, eax
je 0x407331
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.syswow64
jmp 0x407357
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.system32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HDCSP_JH.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call fcn.00402120
add esp, 8
test eax, eax
jne 0x4073cc
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x864
ret
call fcn.00401f60
call fcn.00402a50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x864
ret