Function at 0x42d350
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5851
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x672014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x2c]
call fcn.00407dfc
mov dword [ebp - 4], 0
mov byte [ebp - 0x30], 0
push 0x19
push str.srl::LogicalDrive::Detect
lea ecx, [ebp - 0x2c]
call fcn.004075f5
mov dword [ebp - 4], 1
mov eax, dword [0x67e3a8]
test eax, eax
jne 0x42d3e0
push 0x68
call fcn.0046f39a
add esp, 4
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x42d3d5
push ecx
mov ecx, eax
call fcn.0041d120
jmp 0x42d3d7
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x67e3a8], eax
cmp dword [eax + 4], 4
jl 0x42d3ef
push ecx
lea ecx, [ebp - 0x30]
call fcn.004127e0
mov byte [ebp - 4], 4
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x158]
call fcn.0042db70
mov byte [ebp - 4], 8
mov byte [ebp - 4], 7
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x168], eax
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x15c], 0x42d320
lea eax, [ebp - 0x15c]
push eax
mov edx, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x14c]
sub edx, ecx
mov eax, 0x78787879
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov edx, dword [ebp - 0x168]
call fcn.0042e5c0
add esp, 8
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
mov byte [ebp - 4], 5
cmp eax, ecx
je 0x42d581
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x1e
push 0
push 0x1170c
lea ecx, [ebp - 0x58]
call fcn.0041eb10
mov byte [ebp - 4], 0x1f
push 0
lea ecx, [ebp - 0x180]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x58], vtable.srl::GroupID.0
lea ecx, [ebp - 0x50]
call fcn.00407420
mov byte [ebp - 4], 0x21
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov byte [ebp - 4], 0x22
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x23
mov esi, dword [ebp - 0x158]
mov dword [ebp - 0x170], esi
mov byte [ebp - 4], 0x2c
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2a
mov edi, dword [ebp - 0x154]
mov dword [ebp - 0x15c], edi
mov byte [ebp - 4], 5
nop dword [eax]
cmp esi, edi
je 0x42d93c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], ecx
mov byte [ebp - 4], 0x31
push 0
push 0x115a4
lea ecx, [ebp - 0x80]
call fcn.0041eb10
mov byte [ebp - 4], 0x32
push ebx
lea ecx, [ebp - 0x190]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x80], vtable.srl::GroupID.0
lea ecx, [ebp - 0x78]
call fcn.00407420
mov byte [ebp - 4], 0x34
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov byte [ebp - 4], 0x35
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], ecx
mov byte [ebp - 4], 0x36
push 0
push 0x115a3
lea ecx, [ebp - 0xa8]
call fcn.0041eb10
mov byte [ebp - 4], 0x37
push ebx
lea ecx, [ebp - 0x1a0]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x38
mov dword [ebp - 0xa8], vtable.srl::GroupID.0
lea ecx, [ebp - 0xa0]
call fcn.00407420
mov byte [ebp - 4], 0x39
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov byte [ebp - 4], 0x3a
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], ecx
mov byte [ebp - 4], 0x3b
push 0
push 0x116d3
lea ecx, [ebp - 0xd0]
call fcn.0041eb10
mov byte [ebp - 4], 0x3c
push ebx
lea ecx, [ebp - 0x1b0]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0xd0], vtable.srl::GroupID.0
lea ecx, [ebp - 0xc8]
call fcn.00407420
mov byte [ebp - 4], 0x3e
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov byte [ebp - 4], 0x3f
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Name.virtual_0], vtable.srl::Name.0
call fcn.0040cdf0
mov ecx, eax
test ecx, ecx
jne 0x42d79c
push 0x80004005
call fcn.004021c2
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x42d7b1
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x42d7b3
call edx
add eax, 0x10
mov dword [ebp - 0x160], eax
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x164]
call fcn.00446330
mov byte [ebp - 4], 0x40
push 0
push 0x116db
lea ecx, [ebp - 0xf8]
call fcn.0041eb10
mov byte [ebp - 4], 0x41
push ebx
lea ecx, [ebp - 0x164]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x42
mov dword [ebp - 0xf8], vtable.srl::GroupID.0
lea ecx, [ebp - 0xf0]
call fcn.00407420
mov byte [ebp - 4], 0x43
mov dword [ebp - method.srl::Name.virtual_0], vtable.srl::Name.0
mov ecx, dword [ebp - 0x160]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x42d885
mov edx, dword [ecx]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x14c], edi
cmp eax, vtable.ATL::CAtlStringMgr.0
mov edi, dword [ebp - 0x15c]
push ecx
jne 0x42d87d
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x14c], edi
cmp eax, vtable.ATL::CWin32Heap.0
mov edi, dword [ebp - 0x15c]
jne 0x42d873
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x42d885
mov ecx, edx
call dword [ebp - 0x14c]
jmp 0x42d885
mov ecx, edx
call dword [ebp - 0x14c]
mov byte [ebp - 4], 0x44
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x218]
mov ecx, dword [esi + 0x21c]
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Count.0
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], ecx
mov byte [ebp - 4], 0x45
push 0
push 0x1170b
lea ecx, [ebp - 0x120]
call fcn.0041eb10
mov byte [ebp - 4], 0x46
push ebx
lea ecx, [ebp - 0x1c0]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x47
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x118]
call fcn.00407420
mov byte [ebp - 4], 0x48
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Count.0
mov byte [ebp - 4], 0x49
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
inc ebx
mov dword [ebp - 0x16c], ebx
add esi, 0x220
mov dword [ebp - 0x170], esi
jmp 0x42d5e0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 0x4a
push 0
push 0x116d4
lea ecx, [ebp - 0x148]
call fcn.0041eb10
mov byte [ebp - 4], 0x4b
push 0
lea ecx, [ebp - 0x1d0]
push ecx
push eax
call fcn.0044a260
mov byte [ebp - 4], 0x4c
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x140]
call fcn.00407420
mov byte [ebp - 4], 0x4d
mov dword [ebp - method.srl::Speed.virtual_0], vtable.srl::Size.0
mov byte [ebp - 4], 0x4e
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 0x54
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x52
mov byte [ebp - 4], 0x4f
cmp dword [ebp - 0x158], 0
je 0x42daf0
mov byte [ebp - 4], 0x57
mov byte [ebp - 4], 0x56
mov byte [ebp - 4], 0x55
mov byte [ebp - 4], 0x5a
mov byte [ebp - 4], 0x59
mov byte [ebp - 4], 0x58
mov byte [ebp - 4], 0x5d
mov byte [ebp - 4], 0x5c
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 0x60
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x150]
mov ebx, dword [ebp - 0x158]
sub ecx, ebx
mov eax, 0x78787879
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x787878
jbe 0x42da5e
call fcn.005bcb11
imul eax, eax, 0x220
cmp eax, 0x1000
jb 0x42da99
test bl, 0x1f
je 0x42da75
call fcn.005bcb11
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x42da81
call fcn.005bcb11
sub ebx, eax
cmp ebx, 4
jae 0x42da8d
call fcn.005bcb11
cmp ebx, 0x23
jbe 0x42da97
call fcn.005bcb11
mov ebx, eax
push ebx
call fcn.0046f3d1
add esp, 4
mov byte [ebp - 4], 0x68
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], 0x4f
mov dword [ebp - 0x158], 0
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x6a
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x4f
mov dword [ebp - 0x154], 0
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x4f
mov dword [ebp - 0x150], 0
mov byte [ebp - 4], 3
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004141f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret