Function at 0x4028c0
Capabilities:
Contain obfuscated stackstrings
Get storage device properties
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1c60
call fcn.0040dad0
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xd5]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x80
xor eax, eax
mov edi, 0x436614
mov byte [esp + 0x1bc], bl
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x436820
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x436a28
rep stosd dword es:[edi], eax
mov ecx, 7
lea edi, [esp + 0x1bd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1bc]
push str..A:
push eax
mov byte [esp + 0xdc], 0x43
mov byte [esp + 0xdd], 0x6d
mov byte [esp + 0xde], 0x6a
mov byte [esp + 0xdf], 0x68
mov byte [esp + 0xe0], 0x64
mov byte [esp + 0xe1], 0x66
mov byte [esp + 0xe2], 0x30
mov byte [esp + 0xe3], 0x39
mov byte [esp + 0xe4], 0x5f
mov byte [esp + 0xe5], 0x20
mov byte [esp + 0xe6], 0x84
mov byte [esp + 0xe7], 0xef
mov byte [esp + 0xe8], 0x20
mov byte [esp + 0xe9], 0x3d
mov byte [esp + 0xea], 0x20
mov byte [esp + 0xeb], 0x8c
mov byte [esp + 0xec], 0xad
mov byte [esp + 0xed], 0x20
mov byte [esp + 0xee], 0xa3
mov byte [esp + 0xef], 0xfc
mov byte [esp + 0xf0], 0x20
mov byte [esp + 0xf1], 0xc1
mov byte [esp + 0xf2], 0x9e
mov byte [esp + 0xf3], 0x20
mov byte [esp + 0xf4], 0x5b
mov byte [esp + 0xf5], 0x7b
mov byte [esp + 0xf6], 0x2d
mov byte [esp + 0xf7], 0x58
mov byte [esp + 0xf8], 0x2a
mov byte [esp + 0xf9], 0x35
mov byte [esp + 0xfa], 0x7d
mov byte [esp + 0xfb], 0x5d
mov dword [0x436608], ebx
mov dword [0x43660c], ebx
mov dword [0x436610], ebx
mov dword [0x436818], ebx
mov dword [0x43681c], ebx
mov dword [0x436a20], ebx
mov dword [0x436a24], ebx
call fcn.0040da7c
mov cl, byte [esp + 0x1c7c]
add esp, 8
mov byte [esp + 0x1c0], cl
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
lea edx, [esp + 0x1d4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x4365e4], edx
je 0x403894
cmp edx, ebx
je 0x403894
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x268]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
mov ecx, 0x14
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x268]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x78], eax
push ebx
push ecx
lea eax, [esp + 0x6c]
push 0x50
push eax
lea ecx, [esp + 0x74]
push 0x50
push ecx
push 0x4d014
push edx
mov dword [esp + 0x3c], ebx
mov word [esp + 0x84], 0x2c
mov byte [esp + 0x87], bl
mov byte [esp + 0x88], 1
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], 0xa
mov byte [esp + 0x8c], 1
mov byte [esp + 0x8b], 0x18
mov dword [esp + 0x90], 0x200
mov dword [esp + 0x94], 3
mov dword [esp + 0x9c], 0x30
mov byte [esp + 0xa0], 0xd3
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], bl
mov byte [esp + 0xa3], bl
mov byte [esp + 0xa4], bl
mov byte [esp + 0xa5], bl
mov byte [esp + 0xa6], bl
mov byte [esp + 0xa7], bl
mov byte [esp + 0xa8], bl
mov byte [esp + 0xa9], bl
call ebp
test eax, eax
jne 0x402bab
mov edx, dword [0x4365e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c60
ret
mov al, byte [esp + 0x268]
mov cl, 0x5a
cmp al, cl
jne 0x403887
mov dl, byte [esp + 0x269]
mov al, 0xa5
cmp dl, al
jne 0x403887
cmp byte [esp + 0x26a], cl
jne 0x403887
cmp byte [esp + 0x26b], al
jne 0x403887
mov eax, dword [esp + 0x29d]
mov edx, dword [esp + 0x29e]
mov ecx, 0x80
lea esi, [esp + 0x268]
mov edi, 0x436a28
and eax, 0xff
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x29f]
and edx, 0xff
shl eax, 8
add eax, edx
and ecx, 0xff
mov dword [0x43660c], eax
mov eax, ecx
cdq
and edx, 0xff
mov dword [0x436608], ecx
add eax, edx
mov byte [esp + 0x80], 0xd4
sar eax, 8
and ecx, 0x800000ff
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], bl
mov byte [esp + 0x83], al
jns 0x402c6b
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [esp + 0x1c]
mov byte [esp + 0x84], cl
push ebx
push eax
mov eax, dword [0x4365e4]
lea ecx, [esp + 0x6c]
push 0x50
push ecx
lea edx, [esp + 0x74]
push 0x50
push edx
push 0x4d014
push eax
mov byte [esp + 0xa5], 1
mov byte [esp + 0xa6], bl
mov byte [esp + 0xa7], bl
mov byte [esp + 0xa8], bl
mov byte [esp + 0xa9], bl
call ebp
test eax, eax
je 0x403887
mov edx, dword [0x43660c]
xor ecx, ecx
cmp edx, ebx
jle 0x402ce5
mov al, byte [esp + ecx + 0x268]
cmp al, 0xff
je 0x402ce0
cmp al, bl
je 0x402ce0
mov byte [ecx + 0x436614], al
inc ecx
cmp ecx, edx
jl 0x402ccb
cmp byte [0x436614], bl
je 0x402cf9
cmp byte [0x436615], bl
jne 0x402de2
mov edx, dword [0x436608]
mov byte [esp + 0x80], 0xd4
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], bl
lea ecx, [edx + edx]
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
sar eax, 8
and ecx, 0x800000ff
mov byte [esp + 0x83], al
jns 0x402d3d
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [esp + 0x1c]
mov byte [esp + 0x84], cl
push ebx
push eax
mov eax, dword [0x4365e4]
lea ecx, [esp + 0x6c]
push 0x50
push ecx
lea edx, [esp + 0x74]
push 0x50
push edx
push 0x4d014
push eax
mov byte [esp + 0xa5], 1
mov byte [esp + 0xa6], bl
mov byte [esp + 0xa7], bl
mov byte [esp + 0xa8], bl
mov byte [esp + 0xa9], bl
call ebp
test eax, eax
je 0x403887
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xa6d]
mov edx, dword [0x43660c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp edx, ebx
jle 0x402dcc
mov cl, byte [esp + eax + 0x268]
cmp cl, 0xff
je 0x402dc7
cmp cl, bl
je 0x402dc7
mov byte [esp + eax + 0xa6c], cl
inc eax
cmp eax, edx
jl 0x402db0
mov ecx, 0x7f
lea esi, [esp + 0xa6d]
mov edi, 0x436614
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [0x436614], bl
je 0x403088
cmp byte [0x436615], bl
je 0x403088
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0xc6d]
mov byte [esp + 0xc6c], bl
rep stosd dword es:[edi], eax
mov edi, 0x436614
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 8
lea edx, [esp + 0xc70]
mov al, byte [ecx + 0x436613]
mov dword [0x436a24], eax
imul eax, dword [0x436608]
push eax
push edx
call fcn.00402500
mov eax, dword [0x436a24]
mov ecx, 0x10
mov dword [0x437cb0], eax
xor eax, eax
lea edi, [esp + 0x231]
mov byte [esp + 0x230], bl
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x1e9]
mov byte [esp + 0x1e8], bl
push 0x200
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1ec]
push ecx
push 0x436a28
call fcn.00402220
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x219]
mov byte [esp + 0x218], bl
rep stosd dword es:[edi], eax
mov edi, 0x436614
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x218]
push ecx
push edx
push 0x436614
call fcn.00402220
mov ecx, 8
lea esi, [esp + 0x200]
lea edi, [esp + 0x248]
lea eax, [esp + 0x248]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x224]
lea edi, [esp + 0x268]
push eax
rep movsd dword es:[edi], dword [esi]
push 8
lea ecx, [esp + 0xc98]
push 0x436c28
push ecx
call fcn.00402600
add esp, 0x34
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xb5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, 0x78
mov al, 0x65
mov byte [esp + 0xb4], dl
mov byte [esp + 0xb5], 0x69
mov byte [esp + 0xb6], 0x6e
mov byte [esp + 0xb7], 0x6a
mov byte [esp + 0xb8], 0x69
mov byte [esp + 0xb9], 0x6e
mov byte [esp + 0xba], 0x6b
mov byte [esp + 0xbb], al
mov byte [esp + 0xbd], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x115]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x114], dl
rep stosd dword es:[edi], eax
mov edx, dword [0x436c28]
mov ecx, dword [0x436c30]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x436c2c]
mov dword [esp + 0x134], edx
mov edx, dword [0x436c34]
mov byte [esp + 0xbc], 0x4b
mov byte [esp + 0xbe], 0x79
mov byte [esp + 0xbf], 0x31
mov byte [esp + 0xc0], 0x30
mov byte [esp + 0xc1], 0x32
mov byte [esp + 0xc2], 0x30
mov byte [esp + 0xc3], 0x31
mov byte [esp + 0x115], 0x6a
mov byte [esp + 0x116], 0x6b
mov byte [esp + 0x117], 0x5f
mov byte [esp + 0x118], 0x6a
mov byte [esp + 0x119], 0x77
mov byte [esp + 0x11a], 0x68
mov byte [esp + 0x11b], 0x31
mov byte [esp + 0x11c], 0x33
mov byte [esp + 0x11d], 0x38
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x140], edx
lea edi, [esp + 0xb4]
lea esi, [esp + 0x134]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x40307f
cmp al, bl
je 0x40307b
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x40307f
add esi, 2
add edi, 2
cmp al, bl
jne 0x403057
xor eax, eax
jmp 0x403084
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4030a1
mov eax, dword [0x4365e4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c60
ret
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x135]
mov edx, dword [0x436c5c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x436c58]
lea esi, [esp + 0x134]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x436c60]
mov dword [esp + 0x134], ecx
mov ecx, dword [0x436c64]
mov dword [esp + 0x138], edx
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
lea edi, [esp + 0x114]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x40311d
cmp al, bl
je 0x403119
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x40311d
add esi, 2
add edi, 2
cmp al, bl
jne 0x4030f5
xor eax, eax
jmp 0x403122
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x403140
mov edx, dword [0x4365e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c60
ret
xor eax, eax
lea edi, [esp + 0xd4]
mov dword [esp + 0x155], eax
or ecx, 0xffffffff
mov dword [esp + 0x159], eax
lea edx, [esp + 0xd4]
mov dword [esp + 0x15d], eax
mov byte [esp + 0x154], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x161], eax
push ecx
lea ecx, [esp + 0x158]
push ecx
push edx
call fcn.00402170
mov eax, dword [0x436c38]
mov edx, dword [0x436c40]
mov dword [0x4365bc], eax
mov eax, dword [0x436c44]
mov ecx, dword [0x436c3c]
mov dword [0x4365c8], eax
mov eax, dword [0x436c70]
mov dword [0x4365c4], edx
mov edx, dword [0x436c6c]
mov dword [0x4365f0], eax
mov eax, dword [0x436e28]
mov dword [0x4365ec], edx
mov ebp, eax
xor edx, edx
and ebp, 0xff
mov dword [0x4365c0], ecx
mov ecx, dword [0x436c68]
mov dl, ah
shl ebp, 8
mov dword [0x4365e8], ecx
mov ecx, dword [0x436c74]
or ebp, edx
xor eax, eax
mov al, byte [0x436e2a]
mov dword [0x4365f4], ecx
shl ebp, 8
or ebp, eax
xor ecx, ecx
mov cl, byte [0x436e2b]
mov esi, 0x437028
shl ebp, 8
or ebp, ecx
mov ecx, 0x20
mov eax, ebp
mov edi, 0x437c2c
cdq
and edx, 0x1ff
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
add eax, edx
mov dword [0x436814], ebp
mov ecx, eax
sar ecx, 9
and ebp, 0x800001ff
jns 0x40324d
dec ebp
or ebp, 0xfffffe00
inc ebp
test ebp, ebp
jle 0x403252
inc ecx
mov esi, dword [0x436608]
mov eax, ecx
cdq
idiv esi
mov ebp, eax
mov eax, ecx
cdq
idiv esi
test edx, edx
jle 0x403269
inc ebp
lea esi, [ebp + 0x436614]
mov ecx, 0x80
mov edi, 0x436820
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov edi, 0x436820
or ecx, 0xffffffff
inc ebp
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
mov dword [0x436818], ebp
imul ebp, dword [0x436608]
not ecx
push edx
push 0x20019
add ecx, 0xfffffffe
push ebx
push 0x43216c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x43681c], ecx
mov byte [ecx + 0x436820], bl
mov dword [0x436a20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, pe_nt_image_headers32
xor eax, eax
mov ecx, ebp
lea edi, [esp + 0x469]
mov byte [esp + 0x468], bl
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x468]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x432168
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x4a8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x432164
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x4e8]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x432160
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x528]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x43215c
push eax
mov dword [esp + 0x28], ebp
call esi
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x10]
lea edx, [esp + 0x568]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x432158
push ecx
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x5a8]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x432154
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x5e8]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x432150
push eax
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x628]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x43214c
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x668]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x432148
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x6a8]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.9876543210
push eax
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x6e8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x432140
mov dword [esp + 0x24], ebp
push ecx
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x728]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x43213c
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x768]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x432138
push eax
mov dword [esp + 0x28], ebp
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x7a8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x432134
push ecx
mov dword [esp + 0x28], ebp
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x7e8]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x432130
push edx
mov dword [esp + 0x28], ebp
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x828]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x43212c
push eax
mov dword [esp + 0x28], ebp
call esi
xor ecx, ecx
mov al, byte [esp + ecx + 0x468]
cmp al, 0x61
jb 0x403538
cmp al, 0x7a
ja 0x403538
sub al, 0x20
mov byte [esp + ecx + 0x468], al
inc ecx
cmp ecx, 0x3ff
jl 0x403520
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x21]
mov dl, 0x5c
rep stosd dword es:[edi], eax
mov cl, 0x44
mov al, 0x41
mov byte [esp + 0x26], cl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2f], cl
mov byte [esp + 0x34], al
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x179]
mov byte [esp + 0x23], dl
mov byte [esp + 0x35], dl
mov byte [esp + 0x20], 0x55
mov byte [esp + 0x21], 0x53
mov byte [esp + 0x22], 0x42
mov byte [esp + 0x24], 0x56
mov byte [esp + 0x25], 0x49
mov byte [esp + 0x27], 0x5f
mov byte [esp + 0x28], 0x35
mov byte [esp + 0x29], 0x30
mov byte [esp + 0x2a], 0x31
mov byte [esp + 0x2c], 0x26
mov byte [esp + 0x2d], 0x50
mov byte [esp + 0x2e], 0x49
mov byte [esp + 0x30], 0x5f
mov byte [esp + 0x31], 0x36
mov byte [esp + 0x32], 0x31
mov byte [esp + 0x33], 0x31
mov byte [esp + 0x36], 0x58
mov byte [esp + 0x37], 0x4a
mov byte [esp + 0x38], 0x4b
mov byte [esp + 0x39], 0x32
mov byte [esp + 0x3a], 0x30
mov byte [esp + 0x3b], 0x31
mov byte [esp + 0x3c], 0x34
mov byte [esp + 0x3d], 0x30
mov byte [esp + 0x3e], 0x30
mov byte [esp + 0x3f], 0x30
mov byte [esp + 0x40], 0x30
mov byte [esp + 0x41], 0x30
mov byte [esp + 0x42], 0x30
mov byte [esp + 0x43], 0x30
mov byte [esp + 0x44], 0x30
mov byte [esp + 0x45], 0x31
xor edx, edx
rep stosd dword es:[edi], eax
lea ebp, [esp + 0x468]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x178]
mov esi, ebp
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x10
lea edi, [esp + 0x178]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x20]
lea esi, [esp + 0x178]
mov cl, byte [esi]
mov al, cl
cmp cl, byte [edi]
jne 0x403675
cmp al, bl
je 0x403671
mov cl, byte [esi + 1]
mov al, cl
cmp cl, byte [edi + 1]
jne 0x403675
add esi, 2
add edi, 2
cmp al, bl
jne 0x403651
xor eax, eax
jmp 0x40367a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4036a1
inc edx
add ebp, 0x40
cmp edx, 0x10
jl 0x403625
mov edx, dword [0x4365e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c60
ret
lea eax, [esp + 0x168]
push ebx
push eax
mov eax, dword [0x4365e4]
lea ecx, [esp + 0x874]
push 0x200
push ecx
lea edx, [esp + 0x17c]
push 0xc
push edx
push 0x2d1400
push eax
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x878]
lea edi, [esp + 0x179]
mov ebp, 1
lea esi, [esp + 0x178]
mov edx, dword [esp + eax + 0x86c]
mov ecx, dword [esp + eax + 0x870]
mov eax, dword [esp + 0x87c]
mov dword [0x437ce0], ecx
mov dword [0x437cdc], edx
lea ecx, [esp + eax + 0x86c]
mov eax, dword [esp + eax + 0x86c]
mov dword [0x437cbc], eax
mov eax, dword [ecx + 4]
mov dword [0x437cc0], eax
mov eax, dword [ecx + 8]
mov dword [0x437cc4], eax
xor eax, eax
mov ecx, dword [ecx + 0xc]
mov dword [0x437cc8], ecx
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
mov byte [esp + 0x178], 0x58
mov byte [esp + 0x179], 0x69
mov byte [esp + 0x17a], 0x6e
mov byte [esp + 0x17b], 0x6a
mov byte [esp + 0x17c], 0x6b
mov byte [esp + 0x20], 0x58
mov byte [esp + 0x21], 0x49
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x4a
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x25], 0x5f
mov byte [esp + 0x26], 0x4b
mov byte [esp + 0x27], 0x45
mov byte [esp + 0x28], 0x59
mov byte [esp + 0x29], 0x30
mov byte [esp + 0x2a], 0x30
mov byte [esp + 0x2b], 0x35
mov byte [esp + 0x2c], 0x31
mov edi, 0x437cdc
mov cl, byte [esi]
mov al, cl
cmp cl, byte [edi]
jne 0x4037ed
cmp al, bl
je 0x4037e9
mov cl, byte [esi + 1]
mov al, cl
cmp cl, byte [edi + 1]
jne 0x4037ed
add esi, 2
add edi, 2
cmp al, bl
jne 0x4037c9
xor eax, eax
jmp 0x4037f2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4037f8
xor ebp, ebp
mov edi, 0x437cbc
lea esi, [esp + 0x20]
mov cl, byte [esi]
mov al, cl
cmp cl, byte [edi]
jne 0x403825
cmp al, bl
je 0x403821
mov cl, byte [esi + 1]
mov al, cl
cmp cl, byte [edi + 1]
jne 0x403825
add esi, 2
add edi, 2
cmp al, bl
jne 0x403801
xor eax, eax
jmp 0x40382a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403832
cmp ebp, ebx
jne 0x40384c
mov edx, dword [0x4365e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c60
ret
mov al, byte [0x437cbc]
mov bl, byte [0x437c2c]
mov cl, byte [0x437c2d]
sub dl, 0x58
sub al, 0x58
add bl, dl
add cl, al
pop edi
mov eax, 1
pop esi
mov byte [0x437c2c], bl
pop ebp
mov byte [0x437c2d], cl
mov dword [0x436610], eax
pop ebx
add esp, 0x1c60
ret
mov ecx, dword [0x4365e4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c60
ret