Function at 0x472970
Capabilities:
Encode data using base64
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e6dff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5e8
push ebx
push ebp
push esi
lea eax, [esp + 0x604]
push edi
push eax
mov dword [esp + 0x13c], ecx
call fcn.0043f2e0
push 0xc
call fcn.00445f00
xor ebp, ebp
add esp, 8
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x4729ba
mov word [eax], bp
push 0x2a
mov dword [esp + 0x604], ebp
call fcn.00445f00
add esp, 4
cmp eax, ebp
mov dword [esp + 0x24], eax
je 0x4729d6
mov word [eax], bp
push 2
call fcn.00445f00
add esp, 4
cmp eax, ebp
mov dword [esp + 0x20], eax
je 0x4729eb
mov word [eax], bp
push 2
call fcn.00445f00
add esp, 4
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x472a00
mov word [eax], bp
push 2
call fcn.00445f00
add esp, 4
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x472a15
mov word [eax], bp
mov ecx, dword [esp + 0x608]
or esi, 0xffffffff
push 0x2c
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x60c], 4
mov dword [esp + 0x8c], 0xfffc0000
mov dword [esp + 0x40], ebp
mov dword [esp + 0x130], ebp
mov dword [esp + 0xf4], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xe8], esi
mov dword [esp + 0xec], esi
mov dword [esp + 0x134], esi
mov dword [esp + 0x138], esi
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], esi
mov byte [esp + 0x92], 0
mov byte [esp + 0x7a], 0
mov byte [esp + 0xc5], 0
mov byte [esp + 0xc6], 0
mov byte [esp + 0x47], 0
mov byte [esp + 0x69], 0
mov dword [esp + 0xc8], ecx
call fcn.00449370
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xc8]
add esp, 0xc
mov word [ecx], bp
cmp word [eax], 0x2c
jne 0x472b09
mov word [eax], bp
add eax, 2
push 0x2c
lea edx, [esp + 0x20]
mov dword [esp + 0xc0], eax
push edx
lea eax, [esp + 0xc4]
push eax
call fcn.00449370
add esp, 0xc
mov dword [esp + 0xc4], esi
mov dword [esp + 0xac], esi
mov dword [esp + 0x154], esi
mov esi, dword [esp + 0x608]
mov di, word [esi]
cmp di, bp
mov eax, 0xfffffff7
mov byte [esp + 0x43], 0
mov byte [esp + 0x5c], 0
mov byte [esp + 0xb8], 0
mov byte [esp + 0x57], 0
mov byte [esp + 0x87], 0
mov byte [esp + 0xbb], 0
mov byte [esp + 0x5f], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x33], 0
mov byte [esp + 0x3a], 0
mov byte [esp + 0x42], 0
mov byte [esp + 0x8f], 0
mov byte [esp + 0x6d], 0
mov dword [esp + 0x7c], ebp
mov dword [esp + 0xcc], ebp
mov dword [esp + 0x88], ebp
mov byte [esp + 0x150], 0
mov dword [esp + 0xa4], 0xfffff000
mov dword [esp + 0xc0], 0xfffffff7
mov dword [esp + 0xa8], eax
je 0x47385e
lea ebx, [ebx]
mov eax, esi
mov ecx, str._admin
mov edx, 5
lea esp, [esp]
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
jne 0x472c3e
dec edx
jns 0x472bd0
mov ax, word [eax]
cmp ax, 9
jb 0x472bf6
cmp ax, 0xd
jbe 0x472c05
xor ebp, ebp
cmp ax, 0x20
je 0x472c07
cmp ax, bp
jne 0x472c40
jmp 0x472c07
xor ebp, ebp
add esi, 0xc
mov dword [esp + 0x608], esi
je 0x472c34
mov ax, word [esi]
cmp ax, 9
jb 0x472c22
cmp ax, 0xd
jbe 0x472c28
cmp ax, 0x20
jne 0x472c34
add esi, 2
mov dword [esp + 0x608], esi
jmp 0x472c13
or byte [esp + 0x43], 1
jmp 0x473401
xor ebp, ebp
push 6
push esi
push str._super
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472c8b
add esi, 0xc
mov dword [esp + 0x608], esi
je 0x472c81
mov ax, word [esi]
cmp ax, 9
jb 0x472c6f
cmp ax, 0xd
jbe 0x472c75
cmp ax, 0x20
jne 0x472c81
add esi, 2
mov dword [esp + 0x608], esi
jmp 0x472c60
or byte [esp + 0x43], 2
jmp 0x473401
push 6
push esi
push str._devid
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472ce1
add esi, 0xc
mov dword [esp + 0x608], esi
je 0x472cd1
jmp 0x472cb0
mov ax, word [esi]
cmp ax, 9
jb 0x472cbf
cmp ax, 0xd
jbe 0x472cc5
cmp ax, 0x20
jne 0x472cd1
add esi, 2
mov dword [esp + 0x608], esi
jmp 0x472cb0
or dword [esp + 0x124], 0x10000
jmp 0x473401
push 7
push esi
push str._devidx
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472d27
lea ecx, [esp + 0x608]
add esi, 0xe
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov eax, dword [esp + 0x128]
add esp, 4
or eax, 0x20000
mov dword [esp + 0x124], eax
jmp 0x4733fa
push 4
push esi
push str._gui
call fcn.004403f0
add esp, 0xc
test al, al
jne 0x47374c
push 4
push esi
push str._usb
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472d6f
lea edx, [esp + 0x608]
add esi, 8
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
jmp 0x4733f7
push 6
push esi
push str._hextp
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472db3
lea eax, [esp + 0x608]
add esi, 0xc
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov eax, dword [esp + 0x8c]
add esp, 4
or eax, 1
mov dword [esp + 0x88], eax
jmp 0x4733fa
push 4
push esi
push str._phy
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472df7
lea ecx, [esp + 0x608]
add esi, 8
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov eax, dword [esp + 0x8c]
add esp, 4
or eax, 2
mov dword [esp + 0x88], eax
jmp 0x4733fa
push 5
push esi
push 0x4f6280
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472e3b
lea edx, [esp + 0x608]
add esi, 0xa
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov eax, dword [esp + 0x8c]
add esp, 4
or eax, 0x10
mov dword [esp + 0x88], eax
jmp 0x4733fa
push 5
push esi
push str._fill
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472e7f
lea eax, [esp + 0x608]
add esi, 0xa
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov eax, dword [esp + 0x8c]
add esp, 4
or eax, 4
mov dword [esp + 0x88], eax
jmp 0x4733fa
push 3
push esi
push 0x4f6274
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472eb4
lea ecx, [esp + 0x608]
add esi, 6
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x37], 1
jmp 0x4733f7
push 4
push esi
push str._hup
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472ee9
lea edx, [esp + 0x608]
add esi, 8
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x3e], 1
jmp 0x4733f7
push 5
push esi
push str._ahup
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472f1e
lea eax, [esp + 0x608]
add esi, 0xa
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x3e], 0x21
jmp 0x4733f7
push 4
push esi
push str._gpt
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472f53
lea ecx, [esp + 0x608]
add esi, 8
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x46], 1
jmp 0x4733f7
push 4
push esi
push str._mbr
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472f8b
lea edx, [esp + 0x608]
add esi, 8
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0xbe], 1
jmp 0x4733f7
push 4
push esi
push str._cmp
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472fc3
lea eax, [esp + 0x608]
add esi, 8
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x93], 1
jmp 0x4733f7
push 6
push esi
push 0x4f26ec
call fcn.004403f0
add esp, 0xc
test al, al
je 0x472ffb
lea ecx, [esp + 0x608]
add esi, 0xc
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0xbd], 1
jmp 0x4733f7
push 5
push esi
push str._lock
call fcn.004403f0
add esp, 0xc
test al, al
je 0x473030
lea edx, [esp + 0x608]
add esi, 0xa
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x61], 1
jmp 0x4733f7
push 6
push esi
push str._lock_
call fcn.004403f0
add esp, 0xc
test al, al
je 0x473065
lea eax, [esp + 0x608]
add esi, 0xc
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x61], 0xff
jmp 0x4733f7
push 4
push esi
push 0x4f6234
call fcn.00440450
add esp, 0xc
test al, al
je 0x473129
lea ecx, [esi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bp
je 0x47309d
cmp ax, 0x3d
je 0x47309d
call fcn.0043f2c0
test al, al
je 0x473129
mov eax, ecx
mov dword [esp + 0x608], eax
cmp word [eax], 0x3d
mov dword [esp + 0xcc], ebp
je 0x4730d0
lea ecx, [esp + 0x608]
push ecx
mov dword [esp + 0x80], 0x4f622c
call fcn.0043f2e0
jmp 0x4733f7
lea ecx, [esp + 0x608]
add eax, 2
push ecx
mov dword [esp + 0x60c], eax
call fcn.0043f2e0
mov edx, dword [eax]
lea eax, [esp + 0x60c]
push eax
mov dword [esp + 0x84], edx
call fcn.0041676d
mov eax, dword [esp + 0x610]
add esp, 8
cmp word [eax], bp
je 0x473117
mov word [eax], bp
add dword [esp + 0x608], 2
lea ecx, [esp + 0x608]
push ecx
call fcn.0043f2e0
jmp 0x4733f7
push 4
push esi
push str._pbr
call fcn.00440450
add esp, 0xc
test al, al
je 0x4731fa
lea ecx, [esi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bp
je 0x473161
cmp ax, 0x3d
je 0x473161
call fcn.0043f2c0
test al, al
je 0x4731fa
mov eax, ecx
mov dword [esp + 0x608], eax
cmp word [eax], 0x3d
mov dword [esp + 0x7c], ebp
je 0x4731a1
lea edx, [esp + 0x608]
push edx
mov dword [esp + 0xd0], 0x4ec037
call fcn.0041676d
add esp, 4
lea eax, [esp + 0x608]
push eax
call fcn.0043f2e0
jmp 0x4733f7
add eax, 2
mov dword [esp + 0x608], eax
lea eax, [esp + 0x608]
push eax
call fcn.0043f2e0
mov ecx, dword [eax]
lea edx, [esp + 0x60c]
push edx
mov dword [esp + 0xd4], ecx
call fcn.0041676d
mov eax, dword [esp + 0x610]
add esp, 8
cmp word [eax], bp
je 0x4731e8
mov word [eax], bp
add dword [esp + 0x608], 2
lea eax, [esp + 0x608]
push eax
call fcn.0043f2e0
jmp 0x4733f7
push 9
push esi
push str._alignend
call fcn.00440450
add esp, 0xc
test al, al
je 0x4732b6
lea ecx, [esi + 0x12]
xor eax, eax
mov ax, word [ecx]
cmp ax, bp
je 0x473232
cmp ax, 0x3d
je 0x473232
call fcn.0043f2c0
test al, al
je 0x4732b6
mov dword [esp + 0x608], ecx
cmp word [ecx], 0x3d
jne 0x47327e
mov ax, word [ecx + 2]
add ecx, 2
call fcn.00445b20
test al, al
je 0x473294
mov dword [esp + 0x74], ecx
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0x78]
push edx
call fcn.0044d230
mov eax, dword [esp + 0xb4]
add esp, 8
cmp eax, ebp
jg 0x473294
jl 0x47327e
cmp dword [esp + 0xa8], ebp
ja 0x473294
mov dword [esp + 0xa8], 0xfffffffe
mov dword [esp + 0xac], 0xffffffff
lea eax, [esp + 0x608]
push eax
call fcn.0041676d
lea ecx, [esp + 0x60c]
push ecx
call fcn.0043f2e0
add esp, 8
jmp 0x4733fa
push 6
push esi
push str._align
call fcn.00440450
add esp, 0xc
test al, al
je 0x47338e
lea ecx, [esi + 0xc]
xor eax, eax
mov ax, word [ecx]
cmp ax, bp
je 0x4732ee
cmp ax, 0x3d
je 0x4732ee
call fcn.0043f2c0
test al, al
je 0x47338e
lea edx, [esp + 0x608]
push edx
mov dword [esp + 0x60c], ecx
mov esi, ecx
call fcn.0041676d
lea eax, [esp + 0x60c]
push eax
call fcn.0043f2e0
add esp, 8
cmp word [esi], 0x3d
je 0x473330
or eax, 0xffffffff
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
jmp 0x4733fa
mov ax, word [esi + 2]
lea ecx, [esi + 2]
call fcn.00445b20
test al, al
je 0x4733fa
mov dword [esp + 0x74], ecx
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x78]
push edx
call fcn.0044d230
mov eax, dword [esp + 0xcc]
add esp, 8
cmp eax, ebp
jg 0x4733fa
jl 0x47337b
cmp dword [esp + 0xc0], ebp
ja 0x4733fa
or eax, 0xffffffff
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
jmp 0x4733fa
push 6
push esi
push str._clear
call fcn.004403f0
add esp, 0xc
test al, al
je 0x4733c3
lea eax, [esp + 0x608]
add esi, 0xc
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0xbc], 1
jmp 0x4733f7
push 3
push esi
push 0x4f1b00
call fcn.004403f0
add esp, 0xc
test al, al
je 0x473463
add esi, 6
lea ecx, [esp + 0x608]
mov dword [esp + 0x608], esi
push ecx
call fcn.0043f2e0
mov byte [esp + 0x5b], 1
add esp, 4
mov esi, dword [esp + 0x608]
mov di, word [esi]
cmp di, bp
jne 0x472bc0
mov eax, dword [esp + 0xa8]
cmp eax, 0xfffffffe
jne 0x473846
mov ecx, dword [esp + 0xac]
or edi, 0xffffffff
cmp ecx, edi
jne 0x473846
mov edx, dword [esp + 0xc0]
cmp edx, 0xfffffff7
mov ecx, dword [esp + 0xc4]
jne 0x473834
cmp ecx, edi
jne 0x473834
mov eax, edi
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], edi
jmp 0x47385e
push 4
push esi
push str._del
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47348e
add esi, 8
lea edx, [esp + 0x608]
mov dword [esp + 0x608], esi
push edx
jmp 0x4733ed
push 4
push esi
push str._raw
call fcn.004403f0
add esp, 0xc
test al, al
je 0x4734da
lea eax, [esp + 0x608]
add esi, 8
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov eax, dword [esp + 0x8c]
add esp, 4
or eax, 0x20
mov byte [esp + 0x87], 1
mov dword [esp + 0x88], eax
jmp 0x4733fa
push 6
push esi
push str._swap:
call fcn.00440450
add esp, 0xc
test al, al
je 0x4735a8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x60c]
add esi, 0xc
push edx
mov dword [esp + 0x610], esi
call fcn.00449a90
add esp, 8
test eax, eax
jl 0x47352d
mov eax, dword [esp + 0xa4]
cmp eax, 1
jl 0x47352d
cmp eax, 4
jle 0x4733fa
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x473549
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebp
push edx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x47355e
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebp
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x473574
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebp
push ecx
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x47358a
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebp
push edx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4750e5
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebp
push eax
call esi
jmp 0x4750e5
push 5
push esi
push str._CHS
call fcn.00440450
add esp, 0xc
test al, al
je 0x47366c
lea eax, [esp + 0x608]
add esi, 0xa
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov esi, dword [esp + 0x60c]
lea ecx, [esp + 0x60c]
push ecx
mov dword [esp + 0x44], esi
call fcn.00416791
mov ax, word [esi]
add esp, 8
call fcn.00445b20
test al, al
je 0x473617
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0044d230
mov esi, dword [esp + 0x44]
add esp, 8
cmp word [esi], 0x3a
jne 0x4733fa
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x40]
add esi, 2
push edx
mov dword [esp + 0x44], esi
call fcn.0044d230
mov esi, dword [esp + 0x44]
add esp, 8
cmp word [esi], 0x3a
jne 0x4733fa
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x40]
add esi, 2
push ecx
mov dword [esp + 0x44], esi
call fcn.0044d230
add esp, 8
jmp 0x4733fa
push 5
push esi
push str._IMG
call fcn.00440450
add esp, 0xc
test al, al
jne 0x47340d
push 6
push esi
push str._SKIP
call fcn.00440450
add esp, 0xc
test al, al
je 0x4736e5
lea edx, [esp + 0x608]
add esi, 0xc
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x610]
push ecx
mov dword [esp + 0xd4], 0x42
call fcn.00449a90
mov dl, byte [esp + 0xd4]
add esp, 0xc
mov byte [esp + 0x150], dl
jmp 0x4733fa
push 4
push esi
push str._iv
call fcn.00440450
add esp, 0xc
test al, al
je 0x473720
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x60c]
add esi, 8
push ecx
mov dword [esp + 0x610], esi
call fcn.00449a90
add esp, 8
jmp 0x4733fa
cmp di, 0x2d
jne 0x47340d
lea edx, [esp + 0x608]
push edx
call fcn.0041676d
lea eax, [esp + 0x60c]
push eax
call fcn.0043f2e0
add esp, 8
jmp 0x4733fa
lea ecx, [esp + 0x608]
add esi, 8
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
add esp, 4
push str.21:INDATA
lea ecx, [esp + 0xcc]
call fcn.004127a5
mov ecx, dword [esp + 0x608]
push ecx
lea ecx, [esp + 0xcc]
mov byte [esp + 0x604], 5
call fcn.004462e0
mov esi, dword [esp + 0xc8]
mov ecx, dword [esp + 0x138]
push esi
call fcn.004316cd
cmp esi, ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, eax
je 0x4737c1
mov edx, dword [0x51927c]
add esi, 0xfffffff8
push esi
push ebp
push edx
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4737d6
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebp
push eax
call edi
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x4737ec
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebp
push ecx
call edi
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x473802
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebp
push edx
call edi
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x473817
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebp
push eax
call edi
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x47382d
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebp
push ecx
call edi
mov eax, ebx
jmp 0x4750ea
mov eax, edx
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ecx
jmp 0x473854
mov edx, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc4]
cmp edx, 0xfffffff7
jne 0x473877
cmp ecx, 0xffffffff
jne 0x473877
mov edi, 1
mov edx, edi
xor ecx, ecx
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], ecx
jmp 0x47387c
mov edi, 1
cmp eax, 0xfffffff7
jne 0x473899
cmp dword [esp + 0xac], 0xffffffff
jne 0x473899
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], ecx
push 4
push esi
push str.list
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47396d
lea edx, [esp + 0x608]
add esi, 8
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov esi, dword [esp + 0x60c]
push 4
push esi
push str.disk
call fcn.004403f0
add esp, 0x10
test al, al
je 0x473901
lea eax, [esp + 0x608]
add esi, 8
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x60], 1
jmp 0x473963
push 4
push esi
push str.part
call fcn.004403f0
add esp, 0xc
test al, al
je 0x473933
lea ecx, [esp + 0x608]
add esi, 8
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x60], 2
jmp 0x473963
push 3
push esi
push 0x4f61b4
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47396d
lea edx, [esp + 0x608]
add esi, 6
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov byte [esp + 0x60], 3
mov esi, dword [esp + 0x60c]
add esp, 4
push 4
push esi
push str.init
mov byte [esp + 0x61], 0
call fcn.004403f0
add esp, 0xc
test al, al
je 0x4739b0
lea eax, [esp + 0x608]
add esi, 8
push eax
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov esi, dword [esp + 0x60c]
add esp, 4
mov byte [esp + 0x3b], 1
mov dword [esp + 0x34], edi
push 6
push esi
push str.update
call fcn.004403f0
add esp, 0xc
test al, al
je 0x4739ee
lea ecx, [esp + 0x608]
add esi, 0xc
push ecx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov esi, dword [esp + 0x60c]
add esp, 4
mov byte [esp + 0x55], 1
mov dword [esp + 0x34], edi
push 7
push esi
push str.hupdate
call fcn.004403f0
add esp, 0xc
test al, al
je 0x473a2c
lea edx, [esp + 0x608]
add esi, 0xe
push edx
mov dword [esp + 0x60c], esi
call fcn.0043f2e0
mov esi, dword [esp + 0x60c]
add esp, 4
mov byte [esp + 0x55], 0x10
mov dword [esp + 0x34], edi
lea eax, [esp + 0x608]
push eax
call fcn.0041676d
mov ecx, dword [esp + 0x60c]
sub ecx, esi
add esp, 4
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.004463d0
lea edx, [esp + 0x608]
push edx
call fcn.0043f2e0
mov ecx, dword [esp + 0x60c]
xor eax, eax
mov ax, word [ecx]
add esp, 4
mov edx, eax
or edx, 0x20
cmp dx, 0x61
jne 0x473a8e
lea eax, [esp + 0x608]
mov dword [esp + 0xe8], 0x80
push eax
jmp 0x473ab1
cmp ax, 0x2d
jne 0x473ab9
mov cx, word [ecx + 2]
or cx, 0x20
cmp cx, 0x61
jne 0x473ab9
lea edx, [esp + 0x608]
mov dword [esp + 0xe8], ebp
push edx
call fcn.0041676d
add esp, 4
xor eax, eax
push 0x519504
mov dword [esp + 0x174], 0xebd0a0a2
mov word [esp + 0x178], 0xb9e5
mov word [esp + 0x17a], 0x4433
mov byte [esp + 0x17c], 0x87
mov byte [esp + 0x17d], 0xc0
mov byte [esp + 0x17e], 0x68
mov byte [esp + 0x17f], 0xb6
mov byte [esp + 0x180], 0xb7
mov byte [esp + 0x181], 0x26
mov byte [esp + 0x182], 0x99
mov byte [esp + 0x183], 0xc7
mov dword [esp + 0x1d4], ebp
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1cc], ebp
mov dword [esp + 0x1d0], ebp
mov dword [esp + 0x18c], ebp
mov dword [esp + 0x1a0], ebp
mov dword [esp + 0x188], str.MS_Basic_Data
mov dword [esp + 0x184], ebp
mov dword [esp + 0x170], ebp
mov dword [esp + 0x190], ebp
mov dword [esp + 0x164], ebp
mov dword [esp + 0x2c], 0x519504
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [esp + 0x42]
test bl, bl
mov byte [esp + 0x600], 6
jne 0x473be5
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x60c]
push ecx
call fcn.00449a90
mov eax, dword [esp + 0x610]
add esp, 8
cmp word [eax], 0x2d
jne 0x473c20
mov cx, word [eax + 2]
cmp cx, 0x30
jb 0x473bd1
cmp cx, 0x39
jbe 0x473c20
add eax, 2
mov byte [esp + 0xbb], 1
mov dword [esp + 0x608], eax
jmp 0x473c20
lea edx, [esp + 0x170]
push edx
lea eax, [esp + 0x60c]
push eax
call fcn.0045f610
add esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x180], eax
jne 0x473c19
push 0x519504
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x477792
mov eax, dword [esp + 0x608]
cmp word [eax], 0x2b
jne 0x473c39
mov cl, byte [eax]
add eax, 2
mov byte [esp + 0x86], cl
mov dword [esp + 0x608], eax
cmp word [eax], 0x2d
lea edx, [esp + 0x608]
jne 0x473c5b
push edx
call fcn.0041676d
lea eax, [esp + 0x60c]
push eax
call fcn.0043f2e0
jmp 0x473c6d
lea ecx, [esp + 0x44]
push ecx
push edx
call fcn.0044d310
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0x610]
add esp, 8
cmp word [eax], 0x40
mov byte [esp + 0xb2], 1
jne 0x473c97
add eax, 2
mov dword [esp + 0x608], eax
mov byte [esp + 0xb2], 0
cmp word [eax], 0x2d
lea eax, [esp + 0x608]
jne 0x473cb9
push eax
call fcn.0041676d
lea ecx, [esp + 0x60c]
push ecx
call fcn.0043f2e0
jmp 0x473ccb
lea edx, [esp + 0x4c]
push edx
push eax
call fcn.0044d310
mov dword [esp + 0x168], eax
add esp, 8
test bl, bl
je 0x473d0d
lea ecx, [esp + 0x1d0]
push ecx
lea edx, [esp + 0x60c]
push edx
call fcn.0045f610
mov dword [esp + 0x174], eax
lea eax, [esp + 0x1d0]
push eax
lea ecx, [esp + 0x614]
push ecx
call fcn.0044d230
add esp, 0x10
mov dword [esp + 0x188], eax
mov ecx, dword [esp + 0x608]
mov dword [esp + 0x1b8], ebp
mov ax, word [ecx]
cmp ax, 0x2d
je 0x473d71
test bl, bl
je 0x473d71
cmp ax, bp
je 0x473d71
push ebp
lea edx, [esp + 0x1bc]
push edx
lea eax, [esp + 0x1cc]
push eax
mov dword [esp + 0x1d0], ecx
call fcn.0042723f
mov eax, dword [esp + 0x1d0]
mov ecx, dword [esp + 0x1c4]
add esp, 0xc
mov dword [esp + 0x19c], 1
mov dword [esp + 0x184], eax
mov word [eax + ecx*2], bp
cmp byte [esp + 0x5c], 1
je 0x473d7f
mov dword [esp + 0x80], ebp
mov esi, dword [esp + 0x20]
push 5
push esi
push str._img
mov dword [esp + 0x614], esi
call fcn.00440450
add esp, 0xc
test al, al
je 0x473e0c
lea ecx, [esi + 0xa]
mov dword [esp + 0x608], ecx
mov ax, word [ecx]
cmp ax, bp
mov edx, ecx
je 0x473ddc
cmp ax, 9
jb 0x473dbe
cmp ax, 0xd
jbe 0x473ddc
cmp ax, 0x20
je 0x473ddc
cmp ax, 0x23
je 0x473ddc
add ecx, 2
mov dword [esp + 0x608], ecx
mov ax, word [ecx]
cmp ax, bp
jne 0x473db2
sub ecx, edx
sar ecx, 1
cmp ecx, ebp
jle 0x473dfa
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004463d0
mov dword [esp + 0x80], 0xfffc0000
lea edx, [esp + 0x608]
push edx
call fcn.0043f2e0
add esp, 4
jmp 0x473e51
push 2
push esi
push 0x4f6174
call fcn.00440450
add esp, 0xc
test al, al
je 0x473e2a
add esi, 4
mov dword [esp + 0x608], esi
mov ax, word [esi]
cmp ax, 0x30
jb 0x473e58
cmp ax, 0x39
ja 0x473e58
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x60c]
push ecx
call fcn.00449a90
add esp, 8
mov esi, dword [esp + 0x608]
mov ax, word [esi]
cmp ax, 0x23
je 0x473e6b
cmp ax, 0x3a
jne 0x473f58
add esi, 2
mov dword [esp + 0x608], esi
mov eax, esi
mov ecx, 0x4f6170
mov edx, 1
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x4740b7
dec edx
jns 0x473e81
mov dl, 1
mov byte [esp + 0x32], dl
mov eax, esi
mov ecx, 0x4f616c
mov edi, 1
mov edi, edi
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
jne 0x4740be
dec edi
jns 0x473eb0
mov al, 1
test dl, dl
mov byte [esp + 0x5f], al
jne 0x473eea
cmp word [esi], 0x2b
jne 0x473eea
add esi, 2
mov byte [esp + 0x6d], 1
mov dword [esp + 0x608], esi
test al, al
jne 0x473f1e
mov ax, word [esi]
cmp ax, 0x40
je 0x473f03
cmp ax, 0x2d
je 0x473f03
cmp ax, 0x3d
jne 0x473f1e
mov ecx, dword [esp + 0x88]
or ecx, 2
add esi, 2
mov dword [esp + 0x88], ecx
mov dword [esp + 0x608], esi
mov si, word [esi]
cmp si, 0x30
jb 0x473f58
cmp si, 0x39
ja 0x473f58
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x60c]
push eax
call fcn.00449a90
add esp, 8
test eax, eax
jle 0x473f58
mov eax, dword [esp + 0x34]
test eax, eax
mov byte [esp + 0x6e], 1
jne 0x473f58
mov byte [esp + 0x32], 1
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x80]
xor ebx, ebx
lea ecx, [esp + 0x244]
mov word [esp + 0x244], bx
cmp word [eax], bx
mov dword [esp + 0xc8], edi
mov dword [esp + 0xf8], ecx
je 0x473f8e
mov dword [esp + 0xf8], eax
mov edx, dword [esp + 0x80]
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push edx
lea eax, [esp + 0x248]
push str..PhysicalDrive_d
push eax
call ebp
mov esi, dword [esp + 0x104]
add esp, 0xc
push 0x11
push esi
push str..PhysicalDrive
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x47400b
mov eax, dword [esp + 0x80]
cdq
lea ecx, [esp + 0x158]
mov dword [esp + 0x15c], edx
push ecx
lea edx, [esp + 0x78]
add esi, 0x22
push edx
mov dword [esp + 0x7c], esi
mov dword [esp + 0x160], eax
call fcn.00449970
add esp, 8
test eax, eax
jle 0x47400b
mov edi, dword [esp + 0x158]
mov dword [esp + 0xc8], edi
mov al, byte [esp + 0x55]
test al, al
jne 0x47401f
mov al, byte [esp + 0x3a]
test al, al
je 0x4740c5
cmp dword [esp + 0x80], ebx
jge 0x4740c5
cmp edi, ebx
jge 0x4740c5
push 0x519504
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x51927c]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x47406d
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x474082
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x474098
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4750e5
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
jmp 0x4750e5
xor dl, dl
jmp 0x473e9e
xor al, al
jmp 0x473ecd
xor esi, esi
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
mov byte [esp + 0x600], 7
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0xbc], ebx
jg 0x474108
mov al, byte [esp + 0x5c]
test al, al
jg 0x474108
cmp dword [esp + 0x7c], ebx
jne 0x474108
cmp dword [esp + 0xcc], ebx
mov dword [esp + 0x190], ebx
je 0x474113
mov dword [esp + 0x190], 1
mov al, byte [esp + 0x5d]
test al, al
je 0x474130
cmp edi, ebx
jl 0x474130
movsx eax, al
push eax
push edi
call fcn.00414450
mov ecx, dword [esp + 0x3c]
add esp, 8
mov eax, dword [esp + 0xa4]
cmp eax, ebx
jle 0x47432e
mov dl, byte [esp + 0x42]
test dl, dl
jne 0x47432e
cmp dword [esp + 0x80], ebx
jge 0x474161
mov edx, dword [esp + 0x14]
cmp word [edx], bx
je 0x4742ac
cmp eax, ecx
je 0x4742ac
cmp ecx, 1
jl 0x4742ac
cmp ecx, 4
jg 0x4742ac
cmp byte [esp + 0x43], 2
jl 0x4742ac
mov eax, dword [str.21:INDATA]
mov ecx, dword [0x4f61d4]
mov edx, dword [0x4f61d8]
mov dword [esp + 0x328], eax
mov eax, dword [0x4f61dc]
mov dword [esp + 0x32c], ecx
mov ecx, dword [0x4f61e0]
mov dword [esp + 0x330], edx
mov edx, dword [0x4f61e4]
mov dword [esp + 0x334], eax
mov dword [esp + 0x338], ecx
xor eax, eax
mov dword [esp + 0x33c], edx
mov ecx, 0xae
lea edi, [esp + 0x340]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x80]
push eax
lea ecx, [esp + 0x248]
push 0x4edd14
push ecx
call ebp
mov edx, dword [esp + 0x20]
add esp, 0xc
cmp word [edx], bx
lea eax, [esp + 0x244]
je 0x47420e
mov eax, edx
movsx ecx, byte [esp + 0x33]
mov edx, dword [esp + 0xa4]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push ecx
push eax
lea edx, [esp + 0x34e]
push str.__SwapPhyID___.300s___d__d__d
push edx
call ebp
mov ecx, dword [esp + 0x150]
add esp, 0x18
lea eax, [esp + 0x328]
push eax
call fcn.004316cd
mov edi, eax
mov al, byte [esp + 0x3a]
test al, al
mov dword [esp + 0xbc], edi
je 0x474266
cmp dword [esp + 0x80], ebx
jge 0x4768a3
lea ecx, [esp + 0x10]
call fcn.004167b7
lea ecx, [esp + 0x28]
call fcn.0041d19a
lea ecx, [esp + 0x14]
call fcn.0043f290
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x24]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
mov eax, edi
jmp 0x4750ea
push 0x519504
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x14]
mov edx, dword [0x51927c]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add ecx, 0xfffffff8
push ecx
push ebx
push edx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4742e4
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4742fa
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x474310
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4750e5
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
jmp 0x4750e5
cmp byte [esp + 0x55], 0x10
jne 0x474340
test byte [esp + 0x3a], 0x20
jne 0x476880
mov al, byte [esp + 0x5d]
test al, al
je 0x47440f
cmp dword [esp + 0x190], ebx
jne 0x47440f
mov al, byte [esp + 0x33]
test al, al
jne 0x476888
mov al, byte [esp + 0x3a]
test al, al
jne 0x47688d
cmp esi, ebx
je 0x474381
cmp esi, 0xffffffff
je 0x474381
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x474390
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x4743ae
mov edx, dword [0x51927c]
mov ecx, eax
add ecx, 0xfffffff8
push ecx
push ebx
push edx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4743c3
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4743d9
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4743ef
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4777bf
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
xor eax, eax
jmp 0x4750ea
push 0x601
call fcn.00445f00
mov ebp, eax
add esp, 4
cmp ebp, ebx
mov dword [esp + 0x2c], ebp
je 0x47442a
mov byte [ebp], 0
lea eax, [ebp + 0x200]
and eax, 0xfffffe00
mov dword [esp + 0x94], eax
cmp dword [esp + 0x7c], ebx
mov byte [esp + 0x600], 8
jne 0x4768f3
cmp dword [esp + 0xcc], ebx
jne 0x476e74
mov al, byte [esp + 0x5c]
cmp al, 1
je 0x47747c
cmp al, 2
je 0x477493
cmp al, 3
je 0x47759e
mov al, byte [esp + 0x5f]
test al, al
je 0x4744a4
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov eax, 5
jmp 0x4744a8
mov eax, dword [esp + 0x34]
mov cl, byte [esp + 0x32]
test cl, cl
je 0x4744b5
mov eax, 5
mov cl, byte [esp + 0x57]
test cl, cl
je 0x4744db
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
dec eax
mov dword [esp + 0x34], eax
or eax, 0xffffffff
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov al, byte [esp + 0x42]
test al, al
mov byte [esp + 0xb1], 0
mov byte [esp + 0xb3], 0
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x8e], 0
mov byte [esp + 0x85], 0
mov dword [esp + 0x9c], ebx
jne 0x474557
cmp dword [esp + 0xb4], ebx
jne 0x474557
mov ecx, dword [esp + 0x44]
or ecx, dword [esp + 0x48]
jne 0x474557
mov edx, dword [esp + 0x4c]
or edx, dword [esp + 0x50]
jne 0x474557
mov byte [esp + 0x57], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0xf8]
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push eax
lea ecx, [esp + 0x2c]
call fcn.004167bc
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x47761c
push 1
push ebx
push esi
call fcn.0044c0b0
mov dword [esp + 0x80], eax
mov al, byte [esp + 0x61]
add esp, 0xc
cmp al, 0x10
jne 0x4745bc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x600], 7
call fcn.0043f290
jmp 0x476880
cmp byte [esp + 0x55], 1
je 0x477641
mov edx, dword [esp + 0xb4]
xor edi, edi
xor ebp, ebp
cmp edx, 0xff
jg 0x47509d
mov al, byte [esp + 0x32]
test al, al
mov ecx, dword [esp + 0x34]
jne 0x474640
cmp ecx, ebx
jge 0x474640
cmp dword [esp + 0x48], ebx
jg 0x47509d
jl 0x474604
cmp dword [esp + 0x44], ebx
jae 0x47509d
cmp dword [esp + 0x50], ebx
jg 0x47509d
jl 0x47461a
cmp dword [esp + 0x4c], ebx
jae 0x47509d
cmp edx, ebx
jge 0x47509d
or eax, 0xffffffff
mov dword [esp + 0xb4], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov edx, eax
jmp 0x474643
or eax, 0xffffffff
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov al, byte [esp + 0x32]
test al, al
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0xe4], ecx
jne 0x474699
cmp byte [esp + 0x5f], al
jne 0x474699
cmp ecx, 4
jl 0x474de3
mov cl, byte [esp + 0x42]
test cl, cl
jne 0x474de3
mov cl, byte [esp + 0x3b]
test cl, cl
jne 0x474de3
test al, al
je 0x4746bd
mov dword [esp + 0x34], 4
cmp edx, 5
je 0x47509d
cmp edx, 0xf
je 0x47509d
push 0x100000
lea ecx, [esp + 0x7c]
mov dword [esp + 0x64], ebx
call fcn.00446080
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x60]
push ecx
push edx
push esi
call fcn.00442bd0
mov ecx, dword [esp + 0x6c]
mov edx, eax
mov al, byte [esp + 0x3e]
add esp, 0xc
test al, al
mov dword [esp + 0x68], edx
jne 0x474757
mov eax, dword [esp + 0x34]
cmp ecx, eax
jge 0x474717
cmp eax, 4
jge 0x474799
mov al, byte [esp + 0x32]
test al, al
jne 0x474757
mov al, byte [esp + 0x5f]
test al, al
jne 0x474757
mov eax, dword [esp + 0x34]
xor bl, bl
inc eax
mov byte [esp + 0x5e], bl
call fcn.00442ba0
test eax, eax
jle 0x474799
cmp eax, ecx
jl 0x474746
cmp dword [esp + 0x34], 4
jg 0x474799
cmp ecx, 4
jle 0x4747a2
lea eax, [ecx - 4]
and eax, 0xfffffffc
mov dword [esp + 0x70], eax
jmp 0x4747aa
mov al, byte [esp + 0x5f]
test al, al
mov bl, 1
mov byte [esp + 0x5e], bl
jne 0x474794
mov al, byte [esp + 0x32]
test al, al
je 0x474746
mov eax, dword [esp + 0xb4]
test eax, eax
jl 0x474799
xor eax, eax
cmp word [esp + 0xe8], ax
setle al
dec eax
and eax, 0x80
mov dword [esp + 0xe8], eax
jmp 0x474746
cmp ecx, 4
jg 0x47474b
lea ecx, [esp + 0x78]
jmp 0x475098
mov dword [esp + 0x70], 0
mov al, byte [edx + 0x50]
or ecx, 0xffffffff
cmp al, 5
mov dword [esp + 0x3c], ecx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0x58], ecx
je 0x4747c7
cmp al, 0xf
jne 0x4747cd
xor ecx, ecx
mov dword [esp + 0x58], ecx
mov al, byte [edx + 0xe0]
cmp al, 5
je 0x4747db
cmp al, 0xf
jne 0x4747e4
mov ecx, 1
mov dword [esp + 0x58], ecx
mov al, byte [edx + 0x170]
cmp al, 5
je 0x4747f2
cmp al, 0xf
jne 0x4747fb
mov ecx, 2
mov dword [esp + 0x58], ecx
mov al, byte [edx + 0x200]
cmp al, 5
je 0x474809
cmp al, 0xf
jne 0x474812
mov ecx, 3
mov dword [esp + 0x58], ecx
test bl, bl
je 0x47481e
test ecx, ecx
jl 0x474799
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x68]
lea ecx, [eax + eax*8]
shl ecx, 4
mov eax, dword [ecx + edx + 0x3c]
lea edi, [ecx + edx + 0x30]
mov ecx, dword [edi + 8]
push 0
push 0x200
push eax
push ecx
call fcn.004b0800
push 0
mov dword [esp + 0x218], edx
mov dword [esp + 0x1c4], edx
mov edx, dword [edi + 0x14]
push 0x200
mov esi, eax
mov eax, dword [edi + 0x10]
push edx
push eax
mov dword [esp + 0x1cc], esi
call fcn.004b0800
mov ebx, eax
mov eax, dword [esp + 0x70]
lea ecx, [eax + eax*8]
shl ecx, 4
mov ebp, edx
mov edx, dword [esp + 0x68]
lea edi, [ecx + edx + 0x30]
mov cl, byte [esp + 0x5f]
test cl, cl
je 0x47496a
mov eax, dword [esp + 0x60]
xor edi, edi
cmp eax, 8
jne 0x4748a8
mov edx, dword [esp + 0x214]
mov eax, esi
jmp 0x474905
mov ecx, dword [esp + 0x68]
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + ecx + 0x30]
lea eax, [esi + 0x20]
nop
mov cl, byte [eax]
cmp cl, 5
je 0x4748e0
cmp cl, 0xf
je 0x4748e0
inc edi
add eax, 0x90
cmp edi, 4
jl 0x4748c0
lea ecx, [esp + 0x78]
jmp 0x475098
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push 0x200
push edx
push eax
call fcn.004b0800
mov ecx, dword [esi + 0x24]
xor esi, esi
sub eax, ecx
sbb edx, esi
test edi, edi
jl 0x474799
xor ecx, ecx
mov dword [esp + 0x204], ecx
mov dword [esp + 0x208], ecx
push edi
mov dword [esp + 0x210], ecx
lea ecx, [esp + 0x204]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push edx
mov dword [esp + 0x214], 0
call fcn.0044d640
mov al, byte [esp + 0x47]
add esp, 0x14
test al, al
je 0x474955
mov esi, dword [esp + 0x10]
mov byte [esp + 0x33], 0
call fcn.00442db0
mov al, byte [esp + 0x3a]
test al, al
lea ecx, [esp + 0x78]
je 0x477772
jmp 0x476864
cmp dword [esp + 0x60], 4
jg 0x4749a5
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
test ecx, ecx
jge 0x474989
mov dl, byte [esp + 0x32]
test dl, dl
je 0x474799
mov dl, byte [esp + 0x5e]
test dl, dl
je 0x474a12
mov dword [esp + 0xe4], 0
jmp 0x474a9b
mov cl, byte [edi + 0x20]
cmp cl, 5
je 0x4749b2
cmp cl, 0xf
jne 0x4749ba
xor ecx, ecx
mov dword [esp + 0x3c], ecx
jmp 0x4749be
mov ecx, dword [esp + 0x3c]
mov dl, byte [edi + 0xb0]
cmp dl, 5
je 0x4749ce
cmp dl, 0xf
jne 0x4749d7
mov ecx, 1
mov dword [esp + 0x3c], ecx
mov dl, byte [edi + 0x140]
cmp dl, 5
je 0x4749e7
cmp dl, 0xf
jne 0x4749f0
mov ecx, 2
mov dword [esp + 0x3c], ecx
mov dl, byte [edi + 0x1d0]
cmp dl, 5
je 0x474a04
cmp dl, 0xf
jne 0x474979
mov ecx, 3
mov dword [esp + 0x3c], ecx
jmp 0x474989
mov dl, byte [edi + 0x260]
cmp dl, 5
je 0x474a2d
cmp dl, 0xf
je 0x474a2d
mov dword [esp + 0xe4], 0
mov dl, byte [edi + 0x2f0]
test dl, dl
je 0x474a4c
cmp dl, 5
je 0x474a4c
cmp dl, 0xf
je 0x474a4c
mov dword [esp + 0xe4], 1
mov dl, byte [edi + 0x380]
test dl, dl
je 0x474a6b
cmp dl, 5
je 0x474a6b
cmp dl, 0xf
je 0x474a6b
mov dword [esp + 0xe4], 2
mov dl, byte [edi + 0x410]
test dl, dl
je 0x474a8c
cmp dl, 5
je 0x474a8c
cmp dl, 0xf
je 0x474a8c
mov dword [esp + 0xe4], 3
jmp 0x474a9b
mov edx, dword [esp + 0xe4]
test edx, edx
jl 0x474799
mov dl, byte [esp + 0x32]
test dl, dl
je 0x474cdd
test eax, eax
jg 0x474aaf
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x68]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + ecx + 0x30]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push 0x200
push ecx
push eax
mov dword [esp + 0x22c], ecx
call fcn.004b0800
cmp dword [esp + 0x60], 4
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], edx
jle 0x474bac
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jge 0x474bac
mov al, byte [edi + 0x20]
test al, al
je 0x477697
mov eax, dword [esp + 0x60]
cmp eax, 8
jle 0x474b1a
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x474b1e
mov eax, dword [esp + 0x58]
lea edx, [eax + eax*8]
mov eax, dword [esp + 0x68]
push 0
shl edx, 4
mov ecx, dword [edx + eax + 0x3c]
mov edx, dword [edx + eax + 0x38]
push 0x200
push ecx
push edx
call fcn.004b0800
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0x14]
mov dword [esp + 0x194], eax
mov eax, dword [edi + 0x10]
push 0
mov dword [esp + 0x19c], edx
mov edx, dword [edi + 0xc]
add eax, esi
push 0x200
adc ecx, edx
push ecx
push eax
call fcn.004b0800
mov edi, dword [esp + 0x1c0]
mov ecx, eax
mov esi, edx
mov edx, dword [esp + 0x1bc]
sub eax, edx
mov dword [esp + 0x10c], eax
mov eax, esi
sbb eax, edi
sub ebx, ecx
sbb ebp, esi
add ebx, edx
adc ebp, edi
mov dword [esp + 0x110], eax
mov eax, ebx
mov edi, ebp
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], edi
jmp 0x474c04
mov ecx, dword [esp + 0x70]
test ecx, ecx
jle 0x474bd6
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 8]
mov ecx, dword [esp + 0x21c]
mov eax, dword [esi + 0x14]
push 0
add edx, edi
push 0x200
adc eax, ecx
push eax
push edx
call fcn.004b0800
mov ecx, eax
mov eax, dword [esp + 0x1c0]
mov esi, edx
mov edx, dword [esp + 0x1bc]
sub ebx, ecx
sbb ebp, esi
add ebx, edx
adc ebp, eax
xor edx, edx
mov eax, ebx
mov edi, ebp
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], edx
test edi, edi
mov dword [esp + 0x104], ecx
mov dword [esp + 0x108], esi
jl 0x474799
jg 0x474c24
test eax, eax
jbe 0x474799
mov dl, byte [esp + 0x86]
test dl, dl
je 0x474c43
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
add ebx, ecx
adc edx, esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x48]
mov ebx, ecx
add ebx, 1
mov edx, esi
adc edx, 0
cmp ebp, edx
jg 0x474c65
jl 0x474c5d
cmp dword [esp + 0x44], ebx
ja 0x474c65
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x50]
sub eax, ebp
sbb edi, ebx
add eax, ecx
adc edi, esi
cmp edx, edi
jl 0x474c8f
jg 0x474c85
cmp dword [esp + 0x4c], eax
jbe 0x474c8f
mov edx, edi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], edx
test edx, edx
jl 0x474799
jg 0x474ca5
mov eax, dword [esp + 0x4c]
test eax, eax
jb 0x474799
mov eax, dword [esp + 0x70]
test eax, eax
mov eax, dword [esp + 0x60]
jle 0x474cc8
dec eax
and eax, 0xfffffffc
call fcn.00442bb0
inc eax
mov dword [esp + 0x34], eax
mov edi, ecx
mov ebp, esi
jmp 0x474dda
and eax, 0xfffffffc
call fcn.00442bb0
mov dword [esp + 0x34], eax
mov edi, ecx
mov ebp, esi
jmp 0x474dda
mov edx, dword [esp + 0x68]
lea ecx, [ecx + ecx*8]
shl ecx, 4
mov esi, dword [ecx + edx + 0x38]
mov eax, dword [ecx + edx + 0x3c]
lea edi, [ecx + edx + 0x30]
push 0
mov ecx, esi
add ecx, 0x200
mov dword [esp + 0xd8], eax
push 0x200
adc eax, 0
push eax
push ecx
call fcn.004b0800
mov ebp, edx
mov edx, dword [edi + 0x10]
mov ebx, eax
mov eax, dword [edi + 0x14]
push 0
sub edx, 0x200
push 0x200
sbb eax, 0
push eax
push edx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebp
call fcn.004b0800
mov cl, byte [esp + 0x86]
test cl, cl
je 0x474d61
mov edi, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
add edi, ebx
adc ecx, ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x48]
test ecx, ecx
jl 0x474d87
jg 0x474d73
mov edi, dword [esp + 0x44]
test edi, edi
jbe 0x474d87
cmp ecx, ebp
jg 0x474d87
jl 0x474d7f
cmp dword [esp + 0x44], ebx
ja 0x474d87
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
mov edi, dword [esp + 0x50]
test edi, edi
jl 0x474dc1
mov ecx, dword [esp + 0x4c]
jg 0x474d99
test ecx, ecx
jbe 0x474dc1
cmp edi, edx
jl 0x474daf
jg 0x474da3
cmp ecx, eax
jbe 0x474daf
mov ecx, eax
mov edi, edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], edi
test edi, edi
jl 0x474799
jg 0x474dc1
test ecx, ecx
jb 0x474799
mov ecx, dword [esp + 0xd4]
push 0
push 0x200
push ecx
push esi
call fcn.004b0800
mov edi, eax
mov ebp, edx
lea ecx, [esp + 0x78]
call fcn.0043f290
mov esi, dword [esp + 0x34]
push 0
push 0x200
push ebp
cmp esi, 4
push edi
setge byte [esp + 0x6e]
call fcn.004b08b0
mov ebx, dword [esp + 0x94]
mov ebp, eax
xor eax, eax
mov esi, edx
mov edx, dword [esp + 0x10]
push eax
push esi
add ebx, 0x200
push ebp
mov ecx, 0x80
mov edi, ebx
push edx
mov dword [esp + 0x168], ebp
mov dword [esp + 0x16c], esi
rep stosd dword es:[edi], eax
call fcn.004403b0
add esp, 0x10
cmp eax, ebp
jne 0x475de5
cmp edx, esi
jne 0x475de5
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x9c]
push eax
push 0x200
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov edi, dword [esp + 0x94]
mov ecx, 0x80
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
je 0x475de5
mov al, byte [esp + 0x3b]
test al, al
je 0x474f7a
mov al, byte [esp + 0x42]
test al, al
jne 0x474f7a
push ebx
call fcn.00442e00
mov edx, dword [esp + 0x98]
push 0x200
xor eax, eax
mov ecx, 0x10
lea edi, [ebx + 0x1be]
push ebx
rep stosd dword es:[edi], eax
push edx
mov word [ebx + 0x1fe], 0xaa55
call fcn.0043f340
add esp, 0x10
test eax, eax
je 0x474f14
mov eax, dword [esp + 0x15c]
mov esi, dword [esp + 0x10]
push 0
push eax
push ebp
push esi
call fcn.004403b0
add esp, 0x10
push 0
lea ecx, [esp + 0x9c]
push ecx
push 0x200
push ebx
push esi
mov dword [esp + 0xac], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [esp + 0xbc], esi
jmp 0x474f1b
mov esi, dword [esp + 0xbc]
mov al, byte [esp + 0x33]
test al, al
je 0x474f43
mov eax, dword [esp + 0x80]
test eax, eax
jl 0x474f43
mov esi, dword [esp + 0x10]
mov byte [esp + 0x33], 0
call fcn.00442db0
mov esi, dword [esp + 0xbc]
mov al, byte [esp + 0x3a]
test al, al
je 0x477648
mov eax, dword [esp + 0x80]
test eax, eax
jl 0x477648
lea ecx, [esp + 0x2c]
mov byte [esp + 0x600], 7
call fcn.0043f290
mov esi, dword [esp + 0x10]
xor ebx, ebx
jmp 0x4768a3
mov al, byte [esp + 0x43]
test al, al
jne 0x474f95
mov al, byte [esp + 0x6e]
test al, al
je 0x474fa9
cmp dword [esp + 0x34], 1
jle 0x47509d
mov al, byte [esp + 0x6e]
test al, al
je 0x474fa9
mov eax, dword [esp + 0x34]
test eax, eax
jl 0x47509d
mov esi, dword [esp + 0x10]
push esi
call fcn.00442780
add esp, 4
mov ebp, eax
push 0x100000
lea ecx, [esp + 0x68]
mov dword [esp + 0x94], ebp
call fcn.00446080
mov ecx, dword [esp + 0xc8]
mov edi, dword [esp + 0x64]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
jl 0x475013
mov ebx, dword [esp + 0x10]
mov esi, edi
call fcn.004428f0
push 0
push ebp
push edx
push eax
call fcn.004b0800
mov dword [esp + 0x168], edx
mov esi, ebx
jmp 0x475067
lea edx, [esp + 0x220]
push edx
push eax
mov eax, dword [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x47506e
test byte [esp + 0x220], 0x10
jne 0x47506e
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x240]
and ecx, 0xfffffe00
mov eax, ecx
xor ecx, ecx
shld ecx, eax, 0x17
shl eax, 0x17
shr edx, 9
xor ebx, ebx
or eax, edx
or ecx, ebx
mov dword [esp + 0x168], ecx
mov dword [esp + 0x164], eax
lea eax, [esp + 0xf4]
push eax
push edi
push esi
call fcn.00442bd0
mov ecx, dword [esp + 0x20]
mov cx, word [ecx]
add esp, 0xc
test cx, cx
mov dword [esp + 0x60], eax
jne 0x475105
test eax, eax
jne 0x475109
lea ecx, [esp + 0x64]
call fcn.0043f290
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
lea ecx, [esp + 0x28]
call fcn.0041d19a
lea ecx, [esp + 0x14]
call fcn.0043f290
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x24]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
mov eax, 0x80070057
mov ecx, dword [esp + 0x5f8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5f4
ret 8
test eax, eax
je 0x47510d
mov eax, dword [eax]
jmp 0x47510f
xor eax, eax
cmp eax, 1
sete al
test al, al
mov byte [esp + 0x39], al
je 0x47512c
mov al, byte [esp + 0xba]
test al, al
jne 0x47512c
mov al, 1
jmp 0x47512e
xor al, al
mov dl, byte [esp + 0xb9]
test dl, dl
mov byte [esp + 0x56], al
jne 0x47515f
mov dl, byte [esp + 0x3b]
test dl, dl
jne 0x47515f
test al, al
mov al, byte [esp + 0x42]
je 0x475157
test al, al
je 0x475094
jmp 0x47515f
test al, al
jne 0x475094
test cx, cx
mov ebx, dword [esp + 0xdc]
mov edx, dword [esp + 0x128]
mov edi, dword [esp + 0x130]
mov dword [esp + 0x58], ebx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x70], edi
jne 0x47526d
xor eax, eax
mov dword [esp + 0x1ec], eax
mov dword [esp + 0x1f0], eax
mov dword [esp + 0x1f4], eax
mov dword [esp + 0x1f8], eax
push eax
lea ecx, [esp + 0x9c]
push ecx
push 0x18
lea edx, [esp + 0x1f4]
push edx
push eax
push eax
push 0x70000
push esi
mov dword [esp + 0x208], 0
mov dword [esp + 0x21c], eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0xe0]
test eax, eax
jg 0x475207
jl 0x4751eb
test ebx, ebx
ja 0x475207
mov eax, dword [esp + 0x1f4]
mov dword [esp + 0x58], eax
cdq
mov ebx, eax
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0x12c]
test eax, eax
jg 0x475239
jl 0x47521f
mov eax, dword [esp + 0x128]
test eax, eax
ja 0x475239
mov eax, dword [esp + 0x1f8]
mov dword [esp + 0x3c], eax
cdq
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], edx
mov eax, dword [esp + 0x134]
test eax, eax
jg 0x47526d
jl 0x475251
mov eax, dword [esp + 0x130]
test eax, eax
ja 0x47526d
mov eax, dword [esp + 0x1fc]
mov edi, eax
cdq
mov dword [esp + 0x70], edi
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], edx
mov ecx, dword [esp + 0xe0]
xor eax, eax
cmp ecx, eax
jg 0x475297
jl 0x475280
cmp ebx, eax
ja 0x475297
mov ecx, 0xff
mov dword [esp + 0x58], ecx
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], eax
cmp dword [esp + 0x12c], eax
jg 0x4752c2
jl 0x4752ab
cmp dword [esp + 0x128], eax
ja 0x4752c2
mov ecx, 0x3f
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x128], ecx
mov dword [esp + 0x12c], eax
cmp dword [esp + 0x134], eax
jg 0x4752ed
jl 0x4752d6
cmp dword [esp + 0x130], eax
ja 0x4752ed
mov edi, 0x200
mov dword [esp + 0x70], edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x134], eax
mov eax, edi
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x64]
lea ebx, [eax + ebp]
mov al, byte [esp + 0x56]
test al, al
lea ecx, [ebx + ebp + 0x10000]
mov dword [esp + 0xf4], ecx
jne 0x475e37
mov al, byte [esp + 0x42]
test al, al
jne 0x475e37
mov al, byte [esp + 0x57]
test al, al
mov byte [esp + 0x39], 0
jne 0x475906
mov eax, dword [esp + 0x48]
test eax, eax
jg 0x475369
jl 0x47534f
mov eax, dword [esp + 0x44]
test eax, eax
jae 0x475369
mov eax, dword [esp + 0x50]
test eax, eax
jl 0x475906
jg 0x475369
mov eax, dword [esp + 0x4c]
test eax, eax
jb 0x475906
mov eax, dword [esp + 0x34]
test eax, eax
jl 0x475906
push 0x100000
lea ecx, [esp + 0x148]
call fcn.00446080
mov eax, edi
imul eax, dword [esp + 0x3c]
cdq
and edx, 0x1ff
add eax, edx
mov esi, eax
mov eax, dword [esp + 0x58]
sar esi, 9
imul eax, esi
test edi, edi
cdq
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], edx
jle 0x4776b5
mov edx, dword [esp + 0x14]
cmp word [edx], 0
jne 0x475411
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xf4]
push eax
push ecx
push edx
mov dword [esp + 0x100], 0
call fcn.00442bd0
add esp, 0xc
test eax, eax
je 0x4776a0
mov eax, dword [esp + 0x34]
cmp eax, 4
jl 0x475411
mov cl, byte [esp + 0x32]
test cl, cl
jne 0x475411
cmp eax, dword [esp + 0xf4]
jge 0x4776b5
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
xor eax, eax
xor edx, edx
test ebp, ebp
jl 0x4754d8
jg 0x47542f
test ebx, ebx
jbe 0x4754d8
mov ecx, dword [esp + 0xc0]
mov edi, dword [esp + 0xc4]
and ecx, edi
cmp ecx, 0xffffffff
jne 0x475472
mov eax, dword [esp + 0x1b4]
cmp ebp, eax
jl 0x47546d
jg 0x47545a
cmp ebx, dword [esp + 0x1b0]
jb 0x47546d
mov cl, byte [esp + 0x5e]
test cl, cl
jne 0x47546d
mov edx, dword [esp + 0x1b0]
push eax
push edx
jmp 0x4754c2
mov eax, esi
cdq
jmp 0x4754c0
mov cl, byte [esp + 0x87]
test cl, cl
jne 0x4754d8
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0xc0]
cdq
mov ecx, eax
add ecx, esi
mov esi, edx
adc esi, edi
push edx
sub ecx, 1
push eax
sbb esi, 0
push esi
push ecx
call fcn.004b0800
mov ecx, eax
mov eax, dword [esp + 0x68]
mov esi, edx
cdq
push edx
push eax
push esi
push ecx
call fcn.004b08b0
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], edx
push edx
push eax
push ebp
push ebx
call fcn.00442cd0
add esp, 0x10
add ebx, eax
adc ebp, edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
mov ecx, dword [esp + 0x50]
xor esi, esi
cmp ecx, esi
jl 0x475518
jg 0x4754ea
cmp dword [esp + 0x4c], esi
jbe 0x475518
cmp byte [esp + 0xbb], 0
jne 0x475518
mov edi, dword [esp + 0x4c]
sub edi, eax
sbb ecx, edx
cmp ecx, esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], ecx
jg 0x475518
jl 0x475510
mov eax, edi
cmp eax, esi
jae 0x475518
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
cmp ebp, esi
jl 0x475528
jg 0x475522
cmp ebx, esi
jbe 0x475528
mov esi, ebx
mov edi, ebp
jmp 0x47552c
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x50]
test eax, eax
jl 0x475620
jg 0x475546
mov eax, dword [esp + 0x4c]
test eax, eax
jbe 0x475620
mov edx, dword [esp + 0xa8]
and edx, dword [esp + 0xac]
cmp edx, 0xffffffff
jne 0x475595
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x1b0]
add esi, eax
mov eax, dword [esp + 0x1b4]
push eax
push ecx
adc edi, edx
push edi
push esi
call fcn.004b1940
mov ecx, dword [esp + 0x4c]
sub ecx, eax
mov eax, dword [esp + 0x50]
sbb eax, edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
jmp 0x475620
mov al, byte [esp + 0x87]
test al, al
jne 0x475620
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0xac]
cdq
mov ebx, eax
mov eax, dword [esp + 0xa8]
mov ebp, edx
mov edx, ebx
add edx, eax
mov eax, ebp
adc eax, ecx
push ebp
sub edx, 1
push ebx
sbb eax, 0
push eax
push edx
call fcn.004b0800
push ebp
push ebx
push edx
push eax
call fcn.004b08b0
push 0
push 0x200
push edx
push eax
call fcn.004b0800
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x50]
push edx
add esi, ebx
push eax
adc edi, ebp
push edi
push esi
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], edx
call fcn.004b1940
sub ebx, eax
sbb ebp, edx
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x48]
mov eax, dword [esp + 0x140]
test eax, eax
mov byte [esp + 0x39], 0
mov byte [esp + 0x6f], 0
mov byte [esp + 0x56], 0
jl 0x4757a7
jg 0x47564f
mov eax, dword [esp + 0x13c]
test eax, eax
jbe 0x4757a7
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x108]
sub ecx, eax
mov eax, dword [esp + 0x68]
cdq
sbb esi, edi
push edx
add ecx, ebx
push eax
adc esi, ebp
push esi
push ecx
call fcn.004b0800
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x10c]
mov dword [esp + 0x140], edx
xor edx, edx
push 1
mov edi, eax
mov eax, dword [esp + 0x5c]
push eax
mov dword [esp + 0x1ac], edx
mov dword [esp + 0x1b0], edx
push ecx
mov dword [esp + 0x1b8], edx
lea edx, [esp + 0x62]
push edx
mov edx, dword [esp + 0x120]
lea eax, [esp + 0x7f]
push eax
lea ecx, [esp + 0x4d]
push ecx
push edx
push esi
mov dword [esp + 0x15c], edi
mov dword [esp + 0x1c0], 0
call fcn.00442d00
mov al, byte [esp + 0x8f]
mov cl, byte [esp + 0x76]
mov dl, byte [esp + 0x59]
add esp, 0x20
push 1
mov byte [esp + 0x1a5], al
mov eax, dword [esp + 0x5c]
push eax
mov byte [esp + 0x1aa], cl
mov ecx, dword [esp + 0x44]
push ecx
mov byte [esp + 0x1af], dl
lea edx, [esp + 0x62]
push edx
mov edx, dword [esp + 0x120]
lea eax, [esp + 0x7f]
push eax
lea ecx, [esp + 0x4d]
push ecx
push 0
push 2
push edx
push esi
mov byte [esp + 0x1c8], 0
call fcn.004b08b0
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.00442d00
mov al, byte [esp + 0x8f]
mov cl, byte [esp + 0x76]
mov dl, byte [esp + 0x59]
mov byte [esp + 0x1c5], al
push 1
lea eax, [esp + 0x1c4]
mov byte [esp + 0x1c8], 5
mov byte [esp + 0x1ca], cl
mov byte [esp + 0x1cb], dl
mov dword [esp + 0x1cc], esi
mov dword [esp + 0x1d0], edi
push eax
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x1bc]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call fcn.0044d640
add esp, 0x34
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x108]
cdq
mov edi, edx
mov edx, dword [esp + 0x104]
push edi
mov esi, eax
push esi
push ecx
push edx
call fcn.004b0800
test ebp, ebp
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], edx
jl 0x4757fc
jg 0x4757e1
xor eax, eax
cmp ebx, eax
jb 0x4757fe
push edi
push esi
push ebp
push ebx
call fcn.004b0800
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], edx
xor eax, eax
jmp 0x47580c
xor eax, eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
cmp dword [esp + 0x50], eax
jl 0x475834
jg 0x47581a
cmp dword [esp + 0x4c], eax
jb 0x475834
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
push edi
push esi
push eax
push ecx
call fcn.004b0800
mov dword [esp + 0x118], edx
jmp 0x47583b
mov dword [esp + 0x118], eax
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0xec]
xor edx, edx
cmp edi, 4
mov edi, dword [esp + 0x3c]
setge dl
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0xb1]
push edx
push eax
push edi
push ecx
mov ecx, dword [esp + 0x100]
lea edx, [esp + 0xc3]
push edx
lea eax, [esp + 0xb4]
push eax
push ecx
push esi
call fcn.00442d00
add esp, 0x20
test ebp, ebp
jl 0x4758ba
jg 0x475893
test ebx, ebx
jbe 0x4758ba
mov ecx, dword [esp + 0x1e0]
mov eax, dword [esp + 0xf0]
mov edx, dword [esp + 0x1e4]
sub esi, ecx
sbb eax, edx
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], eax
mov cl, byte [esp + 0x5e]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x114]
mov byte [esp + 0x39], cl
movsx ecx, cl
push ecx
push edx
push edi
lea ecx, [esp + 0x9a]
push ecx
lea edx, [esp + 0x95]
push edx
lea ecx, [esp + 0xb0]
push ecx
lea eax, [esi + eax - 1]
push 0
push eax
call fcn.00442d00
add esp, 0x20
lea ecx, [esp + 0x144]
call fcn.0043f290
mov edi, dword [esp + 0x94]
mov edx, dword [esp + 0xe4]
mov eax, dword [esp + 0x140]
lea ebp, [edi + 0x200]
mov ebx, edx
shl ebx, 4
test eax, eax
mov ecx, 0x80
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
jl 0x47597d
jg 0x475940
mov eax, dword [esp + 0x13c]
test eax, eax
jb 0x47597d
test edx, edx
jle 0x47595c
mov ecx, ebx
mov esi, ecx
shr ecx, 2
xor eax, eax
lea edi, [ebp + 0x1be]
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, 3
sub ecx, edx
shl ecx, 4
mov edx, ecx
shr ecx, 2
xor eax, eax
lea edi, [ebx + ebp + 0x1ce]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov cl, byte [esp + 0x32]
test cl, cl
mov al, byte [ebx + ebp + 0x1c2]
jne 0x4759a3
cmp byte [esp + 0x43], 2
jge 0x4759a3
cmp al, 5
je 0x475094
cmp al, 0xf
je 0x475094
test cl, cl
mov esi, dword [ebx + ebp + 0x1c6]
mov edx, dword [ebx + ebp + 0x1ca]
jne 0x475a37
test al, al
je 0x475a37
mov ecx, dword [esp + 0xb4]
test ecx, ecx
je 0x475a3e
cmp byte [esp + 0x43], 2
jge 0x475a3e
mov al, byte [esp + 0x5e]
test al, al
jne 0x475a3e
mov eax, dword [esp + 0x48]
test eax, eax
jl 0x475a07
jg 0x4759e9
mov eax, dword [esp + 0x44]
test eax, eax
jb 0x475a07
mov edi, dword [esp + 0xec]
xor eax, eax
cmp edi, esi
jne 0x475094
cmp dword [esp + 0xf0], eax
jne 0x475094
mov eax, dword [esp + 0x50]
test eax, eax
mov edi, dword [esp + 0x4c]
jl 0x475a42
jg 0x475a19
test edi, edi
jb 0x475a42
xor eax, eax
cmp dword [esp + 0x114], edx
jne 0x475a2d
cmp dword [esp + 0x118], eax
je 0x475a42
test edx, edx
jne 0x475094
jmp 0x475a42
mov ecx, dword [esp + 0xb4]
mov edi, dword [esp + 0x4c]
mov al, byte [esp + 0x57]
test al, al
je 0x475a6e
xor eax, eax
xor edx, edx
xor esi, esi
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
jmp 0x475a70
xor eax, eax
cmp ecx, eax
jl 0x475a7b
mov byte [ebx + ebp + 0x1c2], cl
mov eax, dword [esp + 0xe8]
test ax, ax
jl 0x475a8e
mov byte [ebx + ebp + 0x1be], al
mov ecx, dword [esp + 0x48]
test ecx, ecx
jg 0x475ac3
jl 0x475aa0
mov ecx, dword [esp + 0x44]
test ecx, ecx
jae 0x475ac3
mov ecx, dword [esp + 0x50]
test ecx, ecx
jl 0x475b74
jg 0x475ab6
test edi, edi
jb 0x475b74
mov eax, dword [esp + 0x114]
lea eax, [eax + esi - 1]
jmp 0x475adc
mov ecx, dword [esp + 0x50]
test ecx, ecx
jg 0x475b1e
jl 0x475ad1
test edi, edi
jae 0x475b1e
mov ecx, dword [esp + 0xec]
lea eax, [ecx + edx - 1]
movsx edx, byte [esp + 0x39]
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x40]
push ecx
push edx
lea ecx, [esp + 0x9a]
push ecx
lea edx, [esp + 0x95]
push edx
lea ecx, [esp + 0xb0]
push ecx
push 0
push eax
call fcn.00442d00
mov eax, dword [esp + 0x108]
mov edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
add esp, 0x20
mov edx, dword [esp + 0x48]
test edx, edx
mov esi, dword [esp + 0x44]
jl 0x475b68
jg 0x475b30
test esi, esi
jb 0x475b68
mov dl, byte [esp + 0xb3]
mov byte [ebx + ebp + 0x1bf], dl
mov dl, byte [esp + 0xb1]
mov byte [ebx + ebp + 0x1c0], dl
mov dl, byte [esp + 0xa0]
mov byte [ebx + ebp + 0x1c1], dl
mov edx, dword [esp + 0xec]
mov dword [ebx + ebp + 0x1c6], edx
test ecx, ecx
jg 0x475b86
jl 0x475b78
test edi, edi
jae 0x475b86
jmp 0x475b78
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
test edx, edx
jl 0x475bb0
jg 0x475b86
test esi, esi
jb 0x475bb0
mov dl, byte [esp + 0x85]
mov byte [ebx + ebp + 0x1c3], dl
mov dl, byte [esp + 0x8e]
mov byte [ebx + ebp + 0x1c4], dl
mov dl, byte [esp + 0x9c]
mov byte [ebx + ebp + 0x1c5], dl
test ecx, ecx
jl 0x475bc8
jg 0x475bba
test edi, edi
jb 0x475bc8
mov edx, dword [esp + 0x114]
mov dword [ebx + ebp + 0x1ca], edx
mov edx, dword [esp + 0xb4]
test edx, edx
jge 0x475bf0
test ax, ax
jge 0x475bf0
mov ebx, dword [esp + 0x48]
test ebx, ebx
jg 0x475bf0
jl 0x475be6
test esi, esi
jae 0x475bf0
test ecx, ecx
jl 0x475bfe
jg 0x475bf0
test edi, edi
jb 0x475bfe
mov byte [ebp + 0x1fe], 0x55
mov byte [ebp + 0x1ff], 0xaa
test ax, ax
jge 0x475c2d
test edx, edx
jge 0x475c2d
mov eax, dword [esp + 0x48]
test eax, eax
jg 0x475c2d
jl 0x475c15
test esi, esi
jae 0x475c2d
test ecx, ecx
jg 0x475c2d
jl 0x475c1f
test edi, edi
jae 0x475c2d
mov byte [ebp + 0x1fe], 0x55
mov byte [ebp + 0x1ff], 0xaa
mov edi, dword [esp + 0x15c]
mov esi, dword [esp + 0x158]
mov ebx, dword [esp + 0x10]
push 0
push edi
push esi
push ebx
call fcn.004403b0
add esp, 0x10
cmp eax, esi
jne 0x4776ac
cmp edx, edi
jne 0x4776ac
or esi, edi
mov dword [esp + 0x3c], 1
jne 0x475c71
push ebp
call fcn.00442e00
add esp, 4
mov ecx, dword [esp + 0x94]
mov eax, 0x200
mov edx, ebp
call fcn.004465f0
test eax, eax
jne 0x475ca9
push eax
lea eax, [esp + 0x9c]
push eax
push 0x200
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, ebx
mov dword [esp + 0x3c], eax
call fcn.00442d90
mov edx, dword [esp + 0x48]
test edx, edx
jl 0x475db0
jg 0x475cc5
cmp dword [esp + 0x44], 0x200
jb 0x475db0
mov eax, dword [esp + 0x50]
test eax, eax
jl 0x475db0
jg 0x475ce1
cmp dword [esp + 0x4c], 0x200
jbe 0x475db0
mov al, byte [esp + 0xb8]
test al, al
je 0x475db0
xor eax, eax
push eax
push 0x200
mov ecx, 0x80
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x4c]
push edx
push ecx
call fcn.004b08b0
push 0
mov edi, edx
mov esi, eax
push edi
push esi
push ebx
call fcn.004403b0
add esp, 0x10
cmp eax, esi
jne 0x475da8
cmp edx, edi
jne 0x475da8
mov eax, dword [esp + 0x94]
push 0
lea edx, [esp + 0x9c]
push edx
push 0x200
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [esp + 0x3c], eax
je 0x475da8
cmp dword [esp + 0x98], 0x200
jne 0x475da8
mov ecx, dword [esp + 0x94]
mov eax, 0x200
mov edx, ebp
call fcn.004465f0
test eax, eax
jne 0x475db0
push eax
push edi
push esi
push ebx
call fcn.004403b0
add esp, 0x10
cmp eax, esi
jne 0x475da8
cmp edx, edi
jne 0x475da8
push 0
lea ecx, [esp + 0x9c]
push ecx
push 0x200
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x3c], eax
jmp 0x475db0
mov dword [esp + 0x3c], 0
mov al, byte [esp + 0x33]
test al, al
je 0x475dc4
mov esi, ebx
mov byte [esp + 0x33], 0
call fcn.00442db0
mov al, byte [esp + 0x3a]
test al, al
jne 0x476860
mov eax, dword [esp + 0x3c]
test eax, eax
lea ecx, [esp + 0x64]
jne 0x477772
call fcn.0043f290
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
lea ecx, [esp + 0x28]
call fcn.0041d19a
lea ecx, [esp + 0x14]
call fcn.0043f290
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x24]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
mov eax, 1
jmp 0x4750ea
mov al, byte [esp + 0x57]
test al, al
je 0x475e44
mov byte [esp + 0x6d], 0
mov al, byte [esp + 0x39]
test al, al
je 0x475e61
mov al, byte [esp + 0x3b]
test al, al
jne 0x475e61
mov edx, dword [esp + 0x60]
mov eax, dword [edx + 0x28]
mov dword [esp + 0x60], eax
jmp 0x475e69
mov dword [esp + 0x60], 0x80
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov dl, byte [esp + 0xb2]
mov esi, eax
mov edi, ecx
test dl, dl
mov edx, dword [esp + 0x44]
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], edi
je 0x475eae
mov eax, dword [esp + 0x48]
add esi, edx
adc edi, eax
sub esi, 1
sbb edi, 0
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], edi
mov cl, byte [esp + 0x3b]
xor eax, eax
test cl, cl
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
je 0x475f23
cmp dword [esp + 0x48], eax
jg 0x475ee0
jl 0x475ed3
cmp edx, 1
jae 0x475ee0
mov edx, 1
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
cmp edi, eax
mov dword [esp + 0x11c], esi
mov dword [esp + 0x120], edi
jg 0x475f1b
jl 0x475ef9
cmp esi, 1
jae 0x475f1b
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x168]
sub eax, 1
sbb ecx, 0
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], ecx
mov ecx, dword [esp + 0x48]
mov eax, edx
jmp 0x475f27
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x11c]
push edx
push ecx
mov ecx, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push ebp
push eax
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.0044beb0
mov cl, byte [esp + 0x55]
add esp, 0x1c
test cl, cl
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], edx
jne 0x475f79
or eax, edx
jne 0x475f79
mov dword [esp + 0x148], 1
mov dword [esp + 0x14c], 0
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x60]
cmp edi, eax
mov dword [esp + 0x9c], 1
jae 0x475fb6
cmp dword [esp + 0xa4], eax
jge 0x475fb6
mov ecx, edi
shl ecx, 7
lea eax, [ebx + ebp]
add ecx, eax
mov eax, 0x10
mov edx, 0x4f31f8
call fcn.004465f0
test eax, eax
je 0x475fc1
mov dword [esp + 0x9c], 0
mov al, byte [esp + 0x3b]
test al, al
je 0x47619f
mov eax, dword [esp + 0x60]
cmp edi, eax
jae 0x475094
shl eax, 7
xor edx, edx
div ebp
lea esi, [ebx + ebp]
test eax, eax
jle 0x476014
mov edx, eax
lea esp, [esp]
xor eax, eax
mov edi, esi
mov ecx, 0x6c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [esi + 0x1b4]
mov ecx, 0x12
rep stosd dword es:[edi], eax
add esi, ebp
dec edx
stosw word es:[edi], ax
jne 0x475ff0
mov ebp, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
xor eax, eax
mov ecx, 0x17
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [str.EFI_PART]
mov dword [ebx], eax
mov ecx, dword [0x4f6124]
mov eax, dword [esp + 0x120]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x11c]
mov esi, ebp
add esi, 0x21
mov edi, edx
adc edi, 0
mov dword [ebx + 0x20], ecx
add ecx, 0xffffffe0
mov dword [ebx + 0x24], eax
adc eax, 0xffffffff
mov dword [ebx + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x30], ecx
or eax, dword [ebx + 0x3c]
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], edi
jne 0x4760a5
mov ecx, dword [0x4f6110]
mov dword [ebx + 0x38], ecx
mov eax, dword [0x4f6114]
mov dword [ebx + 0x3c], eax
mov ecx, dword [0x4f6118]
mov dword [ebx + 0x40], ecx
mov eax, dword [0x4f611c]
mov dword [ebx + 0x44], eax
mov ecx, ebp
add ecx, 1
mov dword [ebx + 0x48], ecx
mov eax, edx
adc eax, 0
mov dword [ebx + 0x4c], eax
mov eax, 0x80
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov eax, dword [esp + 0xf4]
mov edi, eax
mov ecx, 0x17
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x20]
mov edi, dword [esp + 0x64]
mov dword [eax + 0x18], ecx
mov ecx, dword [ebx + 0x24]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebx + 0x18]
mov dword [eax + 0x20], ecx
mov ecx, dword [ebx + 0x1c]
mov dword [eax + 0x24], ecx
xor eax, eax
add edi, 0x1be
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x100]
test eax, eax
jg 0x476125
jl 0x476114
cmp dword [esp + 0xfc], 1
jae 0x476125
or eax, 0xffffffff
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x64]
mov edi, dword [esp + 0x3c]
shl eax, 4
lea esi, [eax + ecx]
mov ecx, dword [esp + 0x58]
push 1
push ecx
lea eax, [esi + 0x1bf]
push edi
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push edx
push ebp
mov dword [esi + 0x1c2], 0xee
call fcn.00442d00
mov edx, dword [esp + 0x78]
push 1
push edx
mov edx, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x128]
lea eax, [esi + 0x1c3]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push edx
push edi
call fcn.00442d00
mov dword [esi + 0x1c6], ebp
add esp, 0x40
mov dword [esi + 0x1ca], edi
jmp 0x47659d
mov al, byte [esp + 0x8f]
test al, al
je 0x4761b6
test edi, edi
jl 0x47659d
mov edi, dword [esp + 0x34]
mov al, byte [esp + 0x32]
test al, al
je 0x476226
mov eax, dword [esp + 0x60]
xor edi, edi
test eax, eax
mov byte [esp + 0x6d], 0
mov dword [esp + 0x34], 0xffffffff
jbe 0x47621b
lea esi, [ebx + ebp]
jmp 0x4761e0
mov eax, 0x10
mov edx, 0x4f31f8
mov ecx, esi
call fcn.004465f0
test eax, eax
jne 0x476206
mov eax, dword [esp + 0x60]
inc edi
add esi, 0x80
cmp edi, eax
jb 0x4761e0
jmp 0x47621b
mov dword [esp + 0x34], edi
shl edi, 7
xor eax, eax
lea edx, [ebx + ebp]
mov ecx, 0x20
add edi, edx
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0xfc]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0x60]
dec edx
cmp edi, eax
mov dword [esp + 0xa4], edx
jae 0x475094
mov ecx, edx
cmp ecx, eax
jge 0x475094
mov al, byte [esp + 0x6d]
test al, al
je 0x4763a8
mov cl, byte [esp + 0x39]
xor eax, eax
test cl, cl
je 0x4762cd
mov edx, dword [esp + 0x60]
lea ecx, [ebx + ebp + 0x20]
lea esp, [esp]
cmp eax, edx
jae 0x4762cd
mov esi, dword [ecx]
cmp esi, dword [esp + 0x44]
jne 0x476285
mov esi, dword [ecx + 4]
cmp esi, dword [esp + 0x48]
je 0x47628e
inc eax
add ecx, 0x80
jmp 0x476270
mov edx, eax
shl edx, 7
lea ecx, [ebx + ebp]
lea edi, [edx + ecx]
mov edx, dword [0x4f31f8]
mov ecx, edi
mov dword [ecx], edx
mov edx, dword [0x4f31fc]
mov dword [ecx + 4], edx
mov edx, dword [0x4f3200]
mov dword [ecx + 8], edx
mov edx, dword [0x4f3204]
mov dword [ecx + 0xc], edx
cmp eax, dword [esp + 0x34]
je 0x4762cd
mov ecx, 0x20
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x34]
shl ecx, 7
lea eax, [ebx + ebp]
lea edi, [ecx + eax]
mov dword [esp + 0xa0], eax
mov eax, 0x10
mov edx, 0x4f31f8
mov ecx, edi
mov dword [esp + 0x9c], edi
call fcn.004465f0
test eax, eax
jne 0x47638d
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x60]
inc ebp
cmp ebp, edi
jae 0x475094
mov eax, dword [esp + 0xa0]
mov esi, ebp
shl esi, 7
add esi, eax
mov eax, 0x10
mov edx, 0x4f31f8
mov ecx, esi
call fcn.004465f0
test eax, eax
jne 0x476345
inc ebp
add esi, 0x80
cmp ebp, edi
jb 0x476320
jmp 0x475094
cmp ebp, dword [esp + 0x34]
jle 0x476375
mov edx, dword [esp + 0x90]
lea eax, [ebx + edx]
mov edi, ebp
shl edi, 7
add edi, eax
mov eax, dword [esp + 0x34]
mov edx, ebp
sub edx, eax
dec edx
lea eax, [edi - 0x80]
mov ecx, 0x20
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
jne 0x476364
cmp ebp, dword [esp + 0x60]
jae 0x475094
mov edi, dword [esp + 0x9c]
mov ebp, dword [esp + 0x90]
mov esi, dword [esp + 0xfc]
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x34]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa4]
test eax, eax
jge 0x476525
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x4763f3
mov eax, 1
mov dword [esp + 0x160], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x19c], eax
jmp 0x4763fe
mov eax, dword [esp + 0x180]
test eax, eax
jle 0x47642f
mov edx, dword [esp + 0x170]
mov ecx, edi
shl ecx, 7
lea eax, [ebx + ebp]
add ecx, eax
mov eax, dword [esp + 0x174]
mov dword [ecx], edx
mov edx, dword [esp + 0x178]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x17c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x16c]
test eax, eax
jle 0x47646d
mov ecx, edi
shl ecx, 7
lea eax, [ebx + ebp]
lea edx, [ecx + eax + 0x10]
mov eax, dword [esp + 0x1d0]
mov ecx, dword [esp + 0x1d4]
mov dword [edx], eax
mov eax, dword [esp + 0x1d8]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x1dc]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov eax, dword [esp + 0x18c]
test eax, eax
jle 0x476490
mov ecx, dword [esp + 0x44]
mov edx, edi
lea eax, [ebx + ebp]
shl edx, 7
mov dword [edx + eax + 0x20], ecx
mov ecx, dword [esp + 0x48]
mov dword [edx + eax + 0x24], ecx
mov eax, dword [esp + 0x160]
test eax, eax
jle 0x4764b2
mov ecx, dword [esp + 0x100]
mov edx, edi
lea eax, [ebx + ebp]
shl edx, 7
mov dword [edx + eax + 0x28], esi
mov dword [edx + eax + 0x2c], ecx
mov eax, dword [esp + 0x188]
test eax, eax
jle 0x4764d9
mov edx, dword [esp + 0x1c8]
mov ecx, dword [esp + 0x1cc]
lea eax, [ebx + ebp]
shl edi, 7
mov dword [edi + eax + 0x30], edx
mov dword [edi + eax + 0x34], ecx
mov eax, dword [esp + 0x19c]
test eax, eax
jle 0x476580
mov edx, dword [esp + 0x184]
cmp word [edx], 0
je 0x476580
mov ecx, dword [esp + 0x34]
shl ecx, 7
lea eax, [ebx + ebp]
lea edx, [ecx + eax + 0x38]
xor eax, eax
mov edi, edx
mov ecx, 0x12
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x184]
push 0x24
push eax
push edx
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x476580
cmp eax, edi
je 0x476580
mov ecx, dword [esp + 0x34]
shl ecx, 7
lea eax, [ebx + ebp]
lea edx, [ecx + eax]
mov esi, edx
mov ecx, 0x20
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xa4]
shl ecx, 7
add eax, ecx
mov esi, eax
mov edi, edx
mov edx, dword [esp + 0xa4]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov edi, eax
cmp dword [esp + 0x34], edx
mov ecx, 0x20
lea esi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
jge 0x476580
mov eax, edx
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x57]
test al, al
je 0x47659d
mov edi, dword [esp + 0x34]
shl edi, 7
xor eax, eax
lea edx, [ebx + ebp]
mov ecx, 0x20
add edi, edx
rep stosd dword es:[edi], eax
mov al, byte [esp + 0x8f]
test al, al
mov dword [esp + 0x70], 0
je 0x4766cb
mov al, byte [esp + 0x3b]
test al, al
jne 0x4766cb
mov ecx, dword [esp + 0x60]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x9c], eax
jle 0x4766cb
mov ecx, dword [esp + 0x90]
lea ebp, [ebx + ecx]
mov dword [esp + 0x94], ebp
mov esi, eax
lea esp, [esp]
mov eax, 0x10
mov edx, 0x4f31f8
mov ecx, ebp
call fcn.004465f0
test al, al
jne 0x476616
cmp esi, dword [esp + 0x68]
mov dword [esp + 0xa0], 0
je 0x476621
mov dword [esp + 0xa0], 1
xor edx, edx
test al, al
jne 0x476670
cmp esi, dword [esp + 0x68]
je 0x476654
mov eax, 0x10
mov edx, ebp
mov ecx, ebp
call fcn.004465f0
mov edi, dword [esp + 0x94]
mov ecx, 0x20
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x9c]
mov edx, eax
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x94]
inc ecx
add eax, 0x80
mov dword [esp + 0x68], ecx
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4766a6
lea ecx, [ebp + 0x80]
cmp ebp, ecx
mov eax, ebp
jae 0x47669b
mov edi, dword [eax]
add eax, 4
test edi, edi
jne 0x476696
cmp eax, ecx
jb 0x476687
jmp 0x47669b
mov edx, 1
mov ecx, 0x20
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
test edx, edx
je 0x4766b1
lea edx, [esi + 1]
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x60]
inc esi
add ebp, 0x80
cmp esi, eax
mov dword [esp + 0x9c], esi
jl 0x4765f0
mov eax, dword [esp + 0x64]
push eax
call fcn.00442e00
lea ecx, [ebx - 0x174]
push ecx
call fcn.00442e00
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x3c]
add esp, 8
cmp eax, ecx
jg 0x4766f3
lea eax, [ecx + 1]
mov cl, byte [esp + 0x3b]
test cl, cl
mov ecx, dword [esp + 0x60]
je 0x476701
mov eax, ecx
mov esi, dword [esp + 0x90]
shl eax, 7
push 0
shl ecx, 7
mov dword [esp + 0xa4], eax
push ecx
lea eax, [ebx + esi]
push eax
call fcn.00455940
mov edi, dword [esp + 0x100]
mov dword [ebx + 0x58], eax
mov dword [edi + 0x58], eax
mov ebp, dword [ebx + 0xc]
add esp, 0xc
cmp ebp, 0x20000
mov dword [ebx + 0x10], 0
ja 0x475094
push 0
push ebp
push ebx
call fcn.00455940
push 0
push ebp
mov dword [ebx + 0x10], eax
push edi
mov dword [edi + 0x10], 0
call fcn.00455940
mov edx, dword [esp + 0xb8]
mov dword [edi + 0x10], eax
lea eax, [esi + edx - 1]
xor edx, edx
div esi
add esp, 0x18
mov ebp, eax
mov al, byte [esp + 0x3b]
imul ebp, esi
test al, al
je 0x4767a3
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
call fcn.0041d1a8
mov eax, dword [esp + 0x64]
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.0043f210
mov ecx, dword [esp + 0x14c]
mov edx, dword [esp + 0x148]
xor edi, edi
push edi
push ecx
push edx
push edi
push esi
call fcn.004b08b0
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041d1a8
lea eax, [esi + ebp]
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.0043f210
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push edi
push edi
sub ecx, 0x20
push esi
sbb edx, edi
push edx
push ecx
call fcn.004b08b0
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041d1a8
push ebp
push ebx
lea ecx, [esp + 0x18]
call fcn.0043f210
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push edi
push eax
push ecx
push edi
push esi
call fcn.004b08b0
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041d1a8
mov edx, dword [esp + 0xf4]
push esi
push edx
lea ecx, [esp + 0x18]
call fcn.0043f210
mov al, byte [esp + 0x33]
test al, al
je 0x476854
mov esi, dword [esp + 0x10]
mov byte [esp + 0x33], 0
call fcn.00442db0
mov al, byte [esp + 0x3a]
test al, al
je 0x47776e
lea ecx, [esp + 0x64]
call fcn.0043f290
lea ecx, [esp + 0x2c]
mov byte [esp + 0x600], 7
call fcn.0043f290
mov esi, dword [esp + 0x10]
xor ebx, ebx
mov al, byte [esp + 0x33]
test al, al
je 0x47688d
call fcn.00442db0
cmp esi, ebx
je 0x47689d
cmp esi, 0xffffffff
je 0x47689d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [esp + 0x10], esi
mov cl, byte [esp + 0x3a]
xor eax, eax
test cl, 0x20
jne 0x4768b5
cmp dword [esp + 0x74], 0xc
je 0x4768ce
mov eax, dword [esp + 0xf8]
push 1
push ebx
push eax
call fcn.0044b540
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, byte [esp + 0x5d]
test cl, cl
je 0x4776c6
cmp dword [esp + 0x190], ebx
je 0x4776c6
mov edi, dword [esp + 0xc8]
jmp 0x474340
cmp dword [esp + 0x80], ebx
jge 0x4769b6
mov ecx, dword [esp + 0x14]
cmp word [ecx], bx
jne 0x4769b6
cmp ebp, ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x476925
mov edx, dword [0x51927c]
add ebp, 0xfffffff8
push ebp
push ebx
push edx
call edi
cmp esi, ebx
je 0x476935
cmp esi, 0xffffffff
je 0x476935
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x476944
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call edi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x47696c
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call edi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x476981
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call edi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x476997
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call edi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4750e5
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call edi
jmp 0x4750e5
xor ebx, ebx
or esi, 0xffffffff
mov dword [esp + 0x3c], esi
mov edi, str.INDATA
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x10c], esi
mov dword [esp + 0x110], esi
mov dword [esp + 0x68], ebx
mov eax, dword [esp + 0x7c]
cmp word [eax], bx
mov byte [esp + 0x600], 0xa
je 0x476afc
mov ecx, eax
push ecx
push 0x4f610c
call fcn.00440490
add esp, 8
test al, al
jne 0x476afc
mov edx, dword [esp + 0x7c]
push edx
push 0x4f24fc
call fcn.00440490
add esp, 8
test al, al
jne 0x476afc
mov eax, dword [esp + 0x7c]
push eax
push 0x4f6108
call fcn.00440490
add esp, 8
test al, al
je 0x476a52
mov eax, 0xe
jmp 0x476b01
mov ecx, dword [esp + 0x7c]
push ecx
push 0x4f6104
call fcn.00440490
add esp, 8
test al, al
je 0x476a72
mov eax, 0xf
jmp 0x476b01
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x3c], 0
cmp word [eax], 0x2a
jne 0x476abe
add eax, 2
lea edx, [esp + 0x10c]
mov dword [esp + 0x7c], eax
push edx
lea eax, [esp + 0x80]
push eax
call fcn.0044d230
mov eax, dword [esp + 0x84]
mov esi, dword [esp + 0x114]
add esp, 8
cmp word [eax], 0x2a
jne 0x476abe
add eax, 2
mov dword [esp + 0x7c], eax
cmp word [eax], 0x23
jne 0x476adf
mov ecx, dword [esp + 0x7c]
push ecx
lea ecx, [esp + 0x6c]
call fcn.004575a0
mov ebx, dword [esp + 0x68]
mov eax, ebx
mov edi, str.EXEDATA
jmp 0x476b01
lea edx, [esp + 0x3c]
push edx
push 0
push eax
call fcn.0041d97f
mov ecx, dword [esp + 0x48]
add esp, 0xc
mov dword [esp + 0xd0], eax
jmp 0x476b22
mov eax, 0x10
push 0
lea ecx, [esp + 0xd4]
push ecx
push edi
push eax
push 0
call fcn.00422b90
mov ecx, dword [esp + 0xe8]
add esp, 0x14
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x110]
test edx, edx
mov dword [esp + 0x74], eax
jl 0x476b50
jg 0x476b37
test esi, esi
jb 0x476b50
mov edi, dword [esp + 0x110]
xor edx, edx
cmp edx, edi
jl 0x476b50
jg 0x476b4a
cmp ecx, esi
jbe 0x476b50
mov ecx, esi
mov dword [esp + 0x3c], ecx
test ecx, ecx
jbe 0x476d82
test eax, eax
je 0x476d82
mov edx, dword [esp + 0xf8]
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
push edx
lea ecx, [esp + 0x2c]
call fcn.004167bc
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x476bc1
lea ecx, [esp + 0x68]
call fcn.0043f290
lea ecx, [esp + 0xd0]
call fcn.00415ebc
lea ecx, [esp + 0x2c]
call fcn.0043f290
mov eax, dword [esp + 0x28]
test eax, eax
je 0x475e00
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x475e00
mov ebx, dword [esp + 0x3c]
add ebx, 0x1ff
and ebx, 0xfffffe00
lea eax, [ebx + ebx + 0x200]
push eax
lea ecx, [esp + 0x94]
call fcn.00446080
mov ebp, dword [esp + 0x90]
mov edx, dword [esp + 0x10]
push 0
add ebp, 0x200
lea ecx, [esp + 0x9c]
push ecx
and ebp, 0xfffffe00
push ebx
mov dword [esp + 0xac], ebp
add ebp, ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x476c78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x476c2d
mov esi, 1
lea ecx, [esp + 0x90]
call fcn.0043f290
lea ecx, [esp + 0x68]
call fcn.0043f290
lea ecx, [esp + 0xd0]
call fcn.00415ebc
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
mov eax, dword [esp + 0x28]
test eax, eax
je 0x477663
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x477663
mov edi, dword [esp + 0xa0]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x476cde
lea ecx, [esp + 0x90]
call fcn.0043f290
lea ecx, [esp + 0x68]
call fcn.0043f290
lea ecx, [esp + 0xd0]
call fcn.00415ebc
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
jmp 0x476ba9
mov ecx, dword [esp + 0x3c]
cmp ecx, 0x1b8
jle 0x476cef
mov ecx, 0x1b8
mov edx, dword [esp + 0x74]
mov eax, ecx
shr ecx, 2
mov esi, edx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + 0x1fe], 0x55
mov byte [ebp + 0x1ff], 0xaa
mov eax, dword [esp + 0x3c]
cmp eax, 0x200
jbe 0x476d3e
lea ecx, [eax - 0x200]
lea esi, [edx + 0x200]
mov edx, ecx
shr ecx, 2
lea edi, [ebp + 0x200]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xa0]
mov eax, ebx
mov edx, ebp
mov edi, 1
call fcn.004465f0
test eax, eax
jne 0x476d74
mov esi, dword [esp + 0x10]
push eax
lea eax, [esp + 0x9c]
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
call fcn.00442d90
xor ecx, ecx
test edi, edi
sete cl
mov esi, ecx
jmp 0x476c2d
test ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x476d9b
mov edx, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push edx
call edi
mov eax, dword [esp + 0xd0]
test eax, eax
je 0x476db4
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push 0
push eax
call edi
test ebp, ebp
mov dword [esp + 0xd0], 0
je 0x476dd2
mov ecx, dword [0x51927c]
add ebp, 0xfffffff8
push ebp
push 0
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x476de6
cmp eax, 0xffffffff
je 0x476de6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x476df5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x476e0c
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x476e22
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push 0
push eax
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x476e39
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x476e50
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x475e2d
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push 0
push eax
call edi
mov eax, 1
jmp 0x4750ea
cmp dword [esp + 0x34], ebx
jg 0x476f2c
cmp ebp, ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x476e96
mov ecx, dword [0x51927c]
add ebp, 0xfffffff8
push ebp
push ebx
push ecx
call edi
cmp esi, ebx
je 0x476ea6
cmp esi, 0xffffffff
je 0x476ea6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x476eb5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x476ecc
mov edx, eax
mov eax, dword [0x51927c]
add edx, 0xfffffff8
push edx
push ebx
push eax
call edi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x476ee2
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call edi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x476ef8
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call edi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x476f0d
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call edi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4750e5
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call edi
jmp 0x4750e5
cmp dword [esp + 0x80], ebx
jge 0x476f68
mov edx, dword [esp + 0x14]
cmp word [edx], bx
jne 0x476f68
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4750b8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4750b8
mov eax, dword [esp + 0x150]
push eax
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0xe4]
push edx
mov edx, dword [esp + 0x8c]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x90], 0xffffffff
call fcn.0044c730
mov eax, dword [esp + 0x90]
add esp, 0x1c
cmp eax, ebx
jg 0x476fe7
lea ecx, [esp + 0x2c]
call fcn.0043f290
cmp esi, ebx
je 0x476fdc
cmp esi, 0xffffffff
je 0x476fdc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, ebx
jmp 0x476baf
xor ebp, ebp
mov dword [esp + 0x58], 0x200
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xd4], ebp
mov dword [esp + 0xd8], ebp
mov esi, dword [esp + 0xcc]
cmp word [esi], bp
mov bl, 0xb
mov byte [esp + 0x600], bl
je 0x4771df
push esi
push 0x4f610c
call fcn.00440490
add esp, 8
test al, al
jne 0x4771df
push esi
push 0x4f24fc
call fcn.00440490
add esp, 8
test al, al
jne 0x4771df
push esi
push 0x4f6104
call fcn.00440490
add esp, 8
test al, al
je 0x477067
mov eax, 8
jmp 0x4771e4
push esi
push str.nt6fat
call fcn.00440490
add esp, 8
test al, al
jne 0x4771d8
push esi
push str.winfat
call fcn.00440490
add esp, 8
test al, al
jne 0x4771d8
push esi
push 0x4f6108
call fcn.00440490
add esp, 8
test al, al
je 0x4770af
mov eax, 6
jmp 0x4771e4
push esi
push str.nt5fat
call fcn.00440490
add esp, 8
test al, al
je 0x4770cb
mov eax, 5
jmp 0x4771e4
or edi, 0xffffffff
mov dword [esp + 0x58], ebp
cmp word [esi], 0x2a
mov dword [esp + 0x148], edi
mov dword [esp + 0x14c], edi
jne 0x47711f
lea ecx, [esp + 0x148]
push ecx
lea edx, [esp + 0xd0]
add esi, 2
push edx
mov dword [esp + 0xd4], esi
call fcn.0044d230
mov esi, dword [esp + 0xd4]
mov edi, dword [esp + 0x150]
add esp, 8
cmp word [esi], 0x2a
jne 0x47711f
add esi, 2
cmp word [esi], 0x23
jne 0x47717d
push esi
lea ecx, [esp + 0x158]
call fcn.004127a5
mov eax, dword [eax]
push ebp
lea ecx, [esp + 0xd4]
push ecx
push str.EXEDATA
push eax
push ebp
mov byte [esp + 0x614], 0xc
call fcn.00422b90
mov esi, eax
add esp, 0x14
lea ecx, [esp + 0x154]
mov dword [esp + 0x90], esi
mov byte [esp + 0x600], bl
call fcn.0043f290
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x58], eax
jmp 0x4771a0
lea edx, [esp + 0x58]
push edx
push ebp
push esi
call fcn.0041d97f
mov esi, eax
mov eax, dword [esp + 0x64]
add esp, 0xc
mov dword [esp + 0x90], esi
mov dword [esp + 0xd0], esi
mov edx, dword [esp + 0x14c]
cmp edx, ebp
jl 0x4771c3
jg 0x4771b1
cmp edi, ebp
jb 0x4771c3
xor ecx, ecx
cmp ecx, edx
jl 0x4771c3
jg 0x4771bd
cmp eax, edi
jbe 0x4771c3
mov eax, edi
mov dword [esp + 0x58], eax
cmp esi, ebp
jne 0x47721c
lea ecx, [esp + 0xd0]
call fcn.00415ebc
jmp 0x475de5
mov eax, 7
jmp 0x4771e4
mov eax, 9
push ebp
lea ecx, [esp + 0xd4]
push ecx
push str.INDATA
push eax
push ebp
call fcn.00422b90
mov esi, eax
mov eax, dword [esp + 0x6c]
add esp, 0x14
cmp eax, ebp
mov dword [esp + 0x90], esi
je 0x477453
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x58], eax
cmp eax, ebp
jbe 0x477453
cmp esi, ebp
je 0x477453
mov edx, dword [esp + 0xf8]
push ebp
push 0x20000000
push 3
push ebp
push 3
push 0xc0000000
push edx
lea ecx, [esp + 0x2c]
call fcn.004167bc
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4771c7
mov edi, dword [esp + 0xe0]
mov esi, dword [esp + 0xdc]
push ebp
push edi
push esi
push eax
call fcn.004403b0
add esp, 0x10
cmp eax, esi
jne 0x4771c7
cmp edx, edi
jne 0x4771c7
mov ebp, dword [esp + 0x58]
add ebp, 0x1ff
and ebp, 0xfffffe00
lea eax, [ebp + ebp + 0x200]
push eax
lea ecx, [esp + 0x74]
call fcn.00446080
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x10]
push 0
add ebx, 0x200
lea ecx, [esp + 0x9c]
push ecx
and ebx, 0xfffffe00
push ebp
mov dword [esp + 0x80], ebx
add ebx, ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4772f2
lea ecx, [esp + 0x70]
call fcn.0043f290
lea ecx, [esp + 0xd0]
call fcn.00415ebc
jmp 0x475de5
mov edi, dword [esp + 0x74]
mov edx, dword [esp + 0xdc]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xe0]
push 0
push ecx
push edx
push eax
call fcn.004403b0
mov ecx, dword [esp + 0xec]
add esp, 0x10
cmp eax, ecx
jne 0x4772d8
cmp edx, dword [esp + 0xe0]
jne 0x4772d8
mov ecx, dword [esp + 0x90]
mov si, word [ecx]
mov eax, dword [esp + 0x58]
cmp eax, 0x1fe
mov edx, ebx
mov word [edx], si
mov cl, byte [ecx + 2]
mov byte [edx + 2], cl
jle 0x477360
mov eax, 0x1fe
mov edx, dword [esp + 0x90]
lea ecx, [eax - 0x1e]
mov eax, ecx
shr ecx, 2
lea esi, [edx + 0x1e]
lea edi, [ebx + 0x1e]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x1fe], 0x55
mov byte [ebx + 0x1ff], 0xaa
mov eax, dword [esp + 0x58]
cmp eax, 0x200
jbe 0x4773b7
lea ecx, [eax - 0x200]
lea esi, [edx + 0x200]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x200]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x74]
mov eax, ebp
mov edx, ebx
mov edi, 1
call fcn.004465f0
test eax, eax
jne 0x4773ea
mov esi, dword [esp + 0x10]
push eax
lea eax, [esp + 0x9c]
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
call fcn.00442d90
lea ecx, [esp + 0x70]
call fcn.0043f290
lea ecx, [esp + 0xd0]
call fcn.00415ebc
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
lea ecx, [esp + 0x28]
call fcn.0041d19a
lea ecx, [esp + 0x14]
call fcn.0043f290
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x24]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
xor eax, eax
test edi, edi
sete al
jmp 0x4750ea
lea ecx, [esp + 0xd0]
call fcn.00415ebc
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
mov eax, dword [esp + 0x28]
cmp eax, ebp
jmp 0x476baf
or edi, dword [esp + 0x124]
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.0044c1a0
add esp, 8
jmp 0x4774b8
mov edx, dword [esp + 0x150]
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x34]
push edx
push ebx
push ebx
push eax
push ecx
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.0044c730
add esp, 0x1c
mov eax, dword [esp + 0x154]
cmp eax, ebx
jle 0x4774d8
push eax
mov eax, dword [esp + 0x13c]
push eax
lea eax, [esp + 0x20]
call fcn.0044c160
add esp, 8
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x138]
push esi
push ebx
call fcn.00444550
test ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x477507
mov ecx, dword [0x51927c]
add ebp, 0xfffffff8
push ebp
push 0
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47751b
cmp eax, 0xffffffff
je 0x47751b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x47752a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x477541
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
test ebx, ebx
je 0x477553
mov eax, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push eax
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x47756a
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x477581
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
test esi, esi
je 0x4777bf
mov eax, dword [0x51927c]
add esi, 0xfffffff8
push esi
push 0
push eax
call edi
xor eax, eax
jmp 0x4750ea
mov ecx, dword [esp + 0x20]
mov ax, word [ecx]
cmp ax, bx
mov edx, dword [esp + 0x18]
mov word [edx], ax
je 0x4775dc
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x8c]
push ebx
push ebx
and eax, 0xfffffffd
or eax, 0xc
push eax
push ecx
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.0044c730
add esp, 0x1c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x140]
call fcn.00444550
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x477792
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x477792
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
mov eax, dword [esp + 0x28]
cmp eax, ebx
jmp 0x476c66
call fcn.00442db0
mov esi, eax
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
lea ecx, [esp + 0x28]
call fcn.0041d19a
lea ecx, [esp + 0x14]
call fcn.0043f290
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x24]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
mov eax, esi
jmp 0x4750ea
lea ecx, [esp + 0x78]
jmp 0x475de0
lea ecx, [esp + 0x144]
call fcn.0043f290
lea ecx, [esp + 0x64]
jmp 0x475de0
lea ecx, [esp + 0x144]
call fcn.0043f290
jmp 0x475094
cmp byte [esp + 0x55], 0x10
mov edi, eax
je 0x4776d6
mov edi, dword [esp + 0xbc]
cmp esi, ebx
je 0x4776e6
cmp esi, 0xffffffff
je 0x4776e6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4776f5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x477711
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x477726
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x47773c
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x477752
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x477767
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
mov eax, edi
jmp 0x4750ea
lea ecx, [esp + 0x64]
call fcn.0043f290
lea ecx, [esp + 0x2c]
call fcn.0043f290
lea ecx, [esp + 0x10]
call fcn.004167b7
lea ecx, [esp + 0x28]
call fcn.0041d19a
lea ecx, [esp + 0x14]
call fcn.0043f290
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x24]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
xor eax, eax
jmp 0x4750ea