Function at 0x42ac60
Capabilities:
Get disk information
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1d4c
call fcn.0047e4b0
mov eax, dword [0x4d4214]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x42ac87
pop edi
pop esi
pop ebp
mov eax, 0x17
pop ebx
add esp, 0x1d4c
ret
mov eax, dword [0x4d4218]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c018
mov eax, dword [0x4d4214]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 2
jne 0x42acc9
mov esi, 0x4d3d5c
mov eax, dword [esi]
test eax, eax
je 0x42acbe
push eax
call ebx
add esi, 0x24
cmp esi, 0x4d4098
jl 0x42acb5
mov ecx, 0xd8
xor eax, eax
mov edi, 0x4d3d40
rep stosd dword es:[edi], eax
mov ecx, dword [0x4d4214]
lea eax, [ecx - 1]
cmp eax, 0xa
ja case.0x42acf1.6
xor edx, edx
mov dl, byte [eax + 0x42c238]
jmp dword [edx*4 + 0x42c220]
mov ebp, dword [esp + 0x1d60]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov byte [esp + 0x24], 0x44
mov dword [ebp], 0
cmp dword [ebp], 0x17
jge case.0x42acf1.6
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x104]
and esi, 0xff
push esi
push str.._c:
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x42af71
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 3
lea edx, [esp + 0x118]
push 0x80
push edx
call edi
mov ebp, dword [esp + 0x1d60]
mov ecx, dword [ebp]
lea ecx, [ecx + ecx*8]
mov dword [ecx*4 + 0x4d3d60], eax
mov eax, dword [ebp]
lea edx, [eax + eax*8]
cmp dword [edx*4 + 0x4d3d60], 0xffffffff
je 0x42af78
push 0
push 0
push 3
push 0
push 3
lea eax, [esp + 0x118]
push 0xc0000000
push eax
call edi
mov ecx, dword [ebp]
lea ecx, [ecx + ecx*8]
mov dword [ecx*4 + 0x4d3d5c], eax
mov eax, dword [ebp]
lea eax, [eax + eax*8]
shl eax, 2
mov ecx, dword [eax + 0x4d3d5c]
cmp ecx, 0xffffffff
jne 0x42adf3
mov edx, dword [eax + 0x4d3d60]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp]
lea eax, [eax + eax*8]
mov dword [eax*4 + 0x4d3d60], 0
jmp 0x42af78
xor edx, edx
lea eax, [esp + 0x10]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], edx
push edx
push eax
lea edx, [esp + 0x5c]
push 8
push edx
push 0
push 0
push 0x41018
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42ae29
mov al, byte [esp + 0x108]
mov byte [esp + 0x58], al
mov ecx, 6
xor eax, eax
lea edi, [esp + 0xac]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0xb0]
push ecx
push 0x18
push edx
push eax
push eax
mov eax, dword [ebp]
push 0x41010
lea eax, [eax + eax*8]
mov ecx, dword [eax*4 + 0x4d3d5c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp]
push esi
push 0x4a00d0
lea edx, [eax + eax*8]
lea eax, [edx*4 + 0x4d3d40]
push eax
call ebx
mov eax, dword [ebp]
mov ecx, dword [esp + 0x64]
and ecx, 0xff
add esp, 0xc
lea edx, [eax + eax*8]
mov dword [edx*4 + 0x4d3d48], ecx
mov eax, dword [ebp]
mov ecx, dword [esp + 0x5a]
lea edx, [eax + eax*8]
and ecx, 0xff
mov dword [edx*4 + 0x4d3d4c], ecx
mov eax, dword [ebp]
mov ecx, dword [esp + 0x5b]
lea edx, [eax + eax*8]
and ecx, 0xff
mov dword [edx*4 + 0x4d3d50], ecx
mov eax, dword [ebp]
mov edx, dword [0x4d4218]
mov ecx, dword [esp + 0xbc]
lea eax, [eax + eax*8]
push edx
mov dword [eax*4 + 0x4d3d58], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 3
lea eax, [esp + 0x7c]
push 0x28
push eax
mov eax, dword [ebp]
push 1
lea ecx, [esp + 0x28]
push 6
lea edx, [eax + eax*8]
push ecx
mov byte [esp + 0x30], 0x12
mov byte [esp + 0x31], 0
lea eax, [edx*4 + 0x4d3d40]
mov byte [esp + 0x32], 0
push eax
mov byte [esp + 0x37], 0
mov byte [esp + 0x38], 0x24
mov byte [esp + 0x39], 0
call fcn.0042c710
mov ecx, dword [0x4d4218]
add esp, 0x1c
mov esi, eax
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c018
test esi, esi
jne 0x42af78
mov dl, byte [esp + 0x78]
and dl, 0x1f
cmp dl, 5
jne 0x42af78
mov ecx, 5
mov edi, str.VOBID
lea esi, [esp + 0x80]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x42af78
inc dword [ebp]
jmp 0x42af78
mov ebp, dword [esp + 0x1d60]
mov al, byte [esp + 0x24]
inc al
cmp al, 0x5a
mov byte [esp + 0x24], al
jbe 0x42ad11
jmp case.0x42acf1.6
call dword [0x4c0b60]
mov ecx, dword [esp + 0x1d60]
and eax, 0xff
mov dword [esp + 0x48], eax
mov byte [esp + 0x14], 0
mov dword [ecx], 0
jle case.0x42acf1.6
mov edx, dword [esp + 0x1d60]
cmp dword [edx], 0x17
jge case.0x42acf1.6
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x204]
rep stosd dword es:[edi], eax
mov al, byte [esp + 0x14]
lea ecx, [esp + 0x204]
push ecx
mov byte [esp + 0x20a], al
mov byte [esp + 0x208], 0
call dword [0x4c0b64]
add esp, 4
cmp eax, 1
jne 0x42b26a
mov byte [esp + 0x28], 0
mov edx, dword [esp + 0x1d60]
cmp dword [edx], 0x17
jge 0x42b26a
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
and ebp, 0xff
and ebx, 0xff
push ebp
push ebx
lea eax, [esp + 0x10c]
push str.h_dt_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x1d70]
lea edi, [esp + 0x114]
add esp, 0x10
mov byte [esp + 0x18], 0x12
mov eax, dword [ecx]
or ecx, 0xffffffff
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
lea edx, [eax + eax*8]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [edx*4 + 0x4d3d40]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x1b], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov byte [esp + 0x1c], 0x24
and ecx, 3
mov byte [esp + 0x1d], 0
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1d60]
mov eax, dword [esi]
lea ecx, [eax + eax*8]
mov dword [ecx*4 + 0x4d3d48], ebx
mov eax, dword [esi]
mov ecx, dword [0x4d4218]
lea edx, [eax + eax*8]
push ecx
mov dword [edx*4 + 0x4d3d4c], ebp
mov eax, dword [esi]
lea eax, [eax + eax*8]
mov dword [eax*4 + 0x4d3d50], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 3
lea edx, [esp + 0x7c]
push 0x28
push edx
push 1
lea eax, [esp + 0x28]
push 6
push eax
mov eax, dword [esi]
lea ecx, [eax + eax*8]
lea edx, [ecx*4 + 0x4d3d40]
push edx
call fcn.0042c710
add esp, 0x1c
mov esi, eax
mov eax, dword [0x4d4218]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c018
test esi, esi
jne 0x42b258
mov cl, byte [esp + 0x78]
and cl, 0x1f
cmp cl, 5
jne 0x42b258
mov ecx, 5
mov edi, str.VOBID
lea esi, [esp + 0x80]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42b258
cmp dword [0x4d3d38], 0x7d0
jl 0x42b24f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [esp + 0x24], 0x44
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x104]
and eax, 0xff
push eax
push str.._c:
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x42b204
push 0
push 0
push 3
push 0
push 3
lea eax, [esp + 0x118]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b204
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x54], ecx
lea eax, [esp + 0x54]
push ecx
push edx
push 8
push eax
push ecx
push ecx
push 0x41018
push esi
mov dword [esp + 0x78], ecx
call ebp
push esi
mov edi, eax
call ebx
test edi, edi
je 0x42b204
mov cl, byte [esp + 0x14]
mov al, byte [esp + 0x58]
cmp al, cl
jne 0x42b204
mov dl, byte [esp + 0x5a]
mov al, byte [esp + 0x28]
cmp dl, al
je 0x42b218
mov al, byte [esp + 0x24]
inc al
cmp al, 0x5a
mov byte [esp + 0x24], al
jbe 0x42b16b
jmp 0x42b24f
mov eax, dword [esp + 0x1d60]
lea edi, [esp + 0x108]
mov eax, dword [eax]
lea ecx, [eax + eax*8]
xor eax, eax
lea edx, [ecx*4 + 0x4d3d40]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1d60]
inc dword [eax]
mov al, byte [esp + 0x28]
inc al
cmp al, 7
mov byte [esp + 0x28], al
jb 0x42b008
mov bl, byte [esp + 0x14]
mov eax, dword [esp + 0x48]
inc bl
mov byte [esp + 0x14], bl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
cmp ecx, eax
jl 0x42afb6
jmp case.0x42acf1.6
xor edx, edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x54], edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x34]
lea ecx, [esp + 0x6c]
push eax
mov eax, dword [0x4d3d28]
push ecx
lea edx, [esp + 0x248]
push 0x63
push edx
push 0
push 0
push 0x222004
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42b34c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x42b311
mov ecx, dword [esp + 0x44]
push ecx
call ebx
mov edx, dword [0x4d4218]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
mov eax, 0x15
pop ebx
add esp, 0x1d4c
ret
mov eax, dword [esp + 0x44]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42b34c
mov ecx, dword [esp + 0x44]
push ecx
call ebx
mov edx, dword [0x4d4218]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
mov eax, 0x15
pop ebx
add esp, 0x1d4c
ret
mov eax, dword [esp + 0x1d60]
mov dword [eax], 0
mov al, byte [esp + 0x240]
cmp al, 0xff
je case.0x42acf1.6
lea ecx, [esp + 0x241]
mov dword [esp + 0x14], ecx
mov eax, ecx
jmp 0x42b37d
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x1d60]
cmp dword [edx], 0x17
jge case.0x42acf1.6
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov byte [esp + 0x34c], cl
mov al, byte [eax + 1]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x34], ecx
push edi
mov dword [esp + 0x3c], ecx
push edi
mov dword [esp + 0x44], ecx
push 1
mov dword [esp + 0x4c], ecx
push edi
mov byte [esp + 0x35d], dl
mov byte [esp + 0x35e], al
mov dword [esp + 0x54], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x44], eax
lea edx, [esp + 0x34]
lea eax, [esp + 0x10]
push edx
push eax
mov eax, dword [0x4d3d28]
lea ecx, [esp + 0x354]
push 0x20b
push ecx
lea edx, [esp + 0x35c]
push 0x20b
push edx
push 0x222014
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42b43a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x42b42e
mov ecx, dword [esp + 0x44]
push 0x7d0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42b43a
mov edx, dword [esp + 0x44]
push edx
call ebx
jmp 0x42bd16
mov eax, dword [esp + 0x44]
push eax
call ebx
cmp dword [esp + 0x34f], edi
je 0x42bb6e
cmp dword [esp + 0x453], edi
je 0x42bb6e
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push edi
lea ecx, [esp + 0xcc]
push 0x40
push ecx
lea edx, [esp + 0x363]
push 0xffffffffffffffff
push edx
push edi
push edi
call esi
push edi
push edi
lea eax, [esp + 0xe60]
push pe_nt_image_headers32
push eax
lea ecx, [esp + 0x467]
push 0xffffffffffffffff
push ecx
push edi
push edi
call esi
lea edx, [esp + 0xc4]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov esi, str.SCSI
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42b4da
test cl, cl
je 0x42b4d6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42b4da
add eax, 2
add esi, 2
test cl, cl
jne 0x42b4b2
xor eax, eax
jmp 0x42b4df
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x42b4ff
mov eax, dword [esp + 0x1d60]
mov eax, dword [eax]
lea ecx, [eax + eax*8]
mov dword [ecx*4 + 0x4d3d54], 0x73
jmp 0x42b65f
mov esi, 0x4a03e0
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42b533
test cl, cl
je 0x42b52f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42b533
add eax, 2
add esi, 2
test cl, cl
jne 0x42b50b
xor eax, eax
jmp 0x42b538
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x42b558
mov eax, dword [esp + 0x1d60]
mov eax, dword [eax]
lea ecx, [eax + eax*8]
mov dword [ecx*4 + 0x4d3d54], 0x61
jmp 0x42b65f
mov esi, str.USBSTOR
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42b58c
test cl, cl
je 0x42b588
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42b58c
add eax, 2
add esi, 2
test cl, cl
jne 0x42b564
xor eax, eax
jmp 0x42b591
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x42b5b1
mov eax, dword [esp + 0x1d60]
mov eax, dword [eax]
lea ecx, [eax + eax*8]
mov dword [ecx*4 + 0x4d3d54], 0x75
jmp 0x42b65f
mov esi, str.SBP2
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42b5e5
test cl, cl
je 0x42b5e1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42b5e5
add eax, 2
add esi, 2
test cl, cl
jne 0x42b5bd
xor eax, eax
jmp 0x42b5ea
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x42b607
mov eax, dword [esp + 0x1d60]
mov eax, dword [eax]
lea ecx, [eax + eax*8]
mov dword [ecx*4 + 0x4d3d54], 0x66
jmp 0x42b65f
mov esi, str.DVDRAM
lea eax, [esp + 0xc4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42b63b
test cl, cl
je 0x42b637
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42b63b
add eax, 2
add esi, 2
test cl, cl
jne 0x42b613
xor eax, eax
jmp 0x42b640
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x42bd16
mov eax, dword [esp + 0x1d60]
mov eax, dword [eax]
lea ecx, [eax + eax*8]
mov dword [ecx*4 + 0x4d3d54], 0x78
mov dword [esp + 0x30], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x50], edi
mov ecx, 7
mov esi, str.SYSTEMCurrentControlSetEnum_
lea edi, [esp + 0x658]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x658]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x50]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x65c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42bb6e
lea edx, [esp + 0x70]
xor esi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edx
mov edx, dword [esp + 0x54]
push esi
push esi
lea eax, [esp + 0x1c]
push esi
lea ecx, [esp + 0x114]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x68], esi
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x42bb6e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x104]
lea ecx, [esp + 0x658]
push eax
push ecx
lea edx, [esp + 0x860]
push 0x4a03a0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, esi
je 0x42b74c
push eax
call ebx
mov dword [esp + 0x2c], esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x858]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42bb38
lea edx, [esp + 0x70]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x30]
push esi
push esi
push esi
lea ecx, [esp + 0x568]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x88], esi
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x42bb38
jmp 0x42b7a4
xor esi, esi
lea eax, [esp + 0x558]
lea ecx, [esp + 0x858]
push eax
push ecx
lea edx, [esp + 0xd60]
push 0x4a03a0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x5c]
add esp, 0x10
cmp eax, esi
je 0x42b7d9
push eax
call ebx
mov dword [esp + 0x4c], esi
lea eax, [esp + 0x4c]
lea ecx, [esp + 0xd58]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42bafa
lea edx, [esp + 0x10]
lea eax, [esp + 0xc58]
push edx
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0xac]
push eax
push ecx
push 0
push str.Driver
push edx
mov dword [esp + 0x28], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42bafa
lea edi, [esp + 0xc58]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x958]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x958]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
lea edi, [esp + 0xe58]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x758]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x758]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
lea esi, [esp + 0x758]
lea eax, [esp + 0x958]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42b8d2
test cl, cl
je 0x42b8ce
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42b8d2
add eax, 2
add esi, 2
test cl, cl
jne 0x42b8ae
xor eax, eax
jmp 0x42b8d7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42bafa
mov ecx, 5
mov esi, str.SYSTEMMountedDevices
lea edi, [esp + 0xa58]
mov eax, dword [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
cmp eax, esi
je 0x42b905
push eax
call ebx
mov dword [esp + 0x30], esi
lea eax, [esp + 0x30]
lea ecx, [esp + 0xa58]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42bb6e
lea edx, [esp + 0x60]
lea eax, [esp + 0xf58]
push edx
push eax
mov eax, dword [esp + 0x38]
push esi
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x114]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x84], esi
mov dword [esp + 0x30], pe_nt_image_headers32
mov dword [esp + 0x80], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x42bafa
push 0
push 0
lea ecx, [esp + 0xb60]
push pe_nt_image_headers32
push ecx
lea edx, [esp + 0xf68]
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x104]
push str.DosDevices
push eax
call fcn.0047e200
add esp, 8
test eax, eax
je 0x42baa0
lea ecx, [esp + 0x558]
lea edx, [esp + 0xb58]
push ecx
push edx
call fcn.0047e200
add esp, 8
test eax, eax
je 0x42baa0
lea ebp, [esp + 0x104]
lea edi, [esp + 0x104]
or ecx, 0xffffffff
xor eax, eax
sub ebp, 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp]
lea ecx, [esp + 0xa0]
push eax
push str._c:_
push ecx
call fcn.0047ee63
add esp, 0xc
lea edx, [esp + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x42baa0
mov eax, dword [esp + 0x1d60]
mov dword [esp + 0x28], 0
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x24], eax
jle 0x42ba96
mov edx, 0x4d3d40
lea edi, [esp + 0x104]
or ecx, 0xffffffff
xor eax, eax
mov esi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
mov bl, byte [esi]
mov al, bl
cmp bl, byte [ecx]
jne 0x42ba73
test al, al
je 0x42ba6f
mov bl, byte [esi + 1]
mov al, bl
cmp bl, byte [ecx + 1]
jne 0x42ba73
add esi, 2
add ecx, 2
test al, al
jne 0x42ba4f
xor eax, eax
jmp 0x42ba78
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42ba92
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc ecx
add edx, 0x24
cmp ecx, eax
mov dword [esp + 0x28], ecx
jl 0x42ba3a
jmp 0x42ba96
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x28], eax
je 0x42bbb8
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x60]
lea edx, [esp + 0xf58]
push ecx
push edx
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x114]
inc eax
push ecx
push edx
mov dword [esp + 0x7c], eax
push eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2c], pe_nt_image_headers32
push eax
mov dword [esp + 0x80], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x42b96f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x70]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
push 0
lea ecx, [esp + 0x568]
inc eax
push edx
mov edx, dword [esp + 0x40]
push ecx
push eax
push edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x42b7a2
xor esi, esi
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x70]
push ecx
push esi
push esi
lea edx, [esp + 0x1c]
push esi
lea ecx, [esp + 0x114]
inc eax
push edx
mov edx, dword [esp + 0x64]
push ecx
push eax
push edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x42b717
mov eax, dword [esp + 0x14]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax]
mov dl, byte [eax - 1]
mov eax, dword [esp + 0x1d60]
push ecx
push edx
push str.h_dt_d
mov eax, dword [eax]
lea ecx, [eax + eax*8]
lea edx, [ecx*4 + 0x4d3d40]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [esp + 0x50]
xor edi, edi
cmp eax, edi
je 0x42bc09
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov dword [esp + 0x50], edi
jmp 0x42bc0f
lea edi, [esp + 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x104]
mov edi, ecx
mov ecx, dword [esp + 0x1d60]
sub eax, 2
add edi, eax
mov eax, dword [ecx]
or ecx, 0xffffffff
lea edx, [eax + eax*8]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [edx*4 + 0x4d3d40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x42bb9f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x42bc1e
push eax
call esi
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x4c]
cmp eax, edi
je 0x42bc2d
push eax
call esi
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x42bc3c
push eax
call esi
mov dword [esp + 0x30], edi
mov esi, dword [esp + 0x1d60]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esi]
mov dl, byte [ecx - 1]
lea eax, [eax + eax*8]
mov dword [eax*4 + 0x4d3d48], edx
mov eax, dword [esi]
xor edx, edx
mov dl, byte [ecx]
lea eax, [eax + eax*8]
mov dword [eax*4 + 0x4d3d4c], edx
mov eax, dword [esi]
xor edx, edx
mov dl, byte [ecx + 1]
mov ecx, dword [0x4d4218]
lea eax, [eax + eax*8]
push ecx
mov dword [eax*4 + 0x4d3d50], edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 3
lea edx, [esp + 0x7c]
push 0x28
push edx
push 1
lea eax, [esp + 0x28]
push 6
push eax
mov eax, dword [esi]
mov byte [esp + 0x30], 0x12
mov byte [esp + 0x31], 0
mov byte [esp + 0x32], 0
lea ecx, [eax + eax*8]
mov byte [esp + 0x33], 0
mov byte [esp + 0x34], 0x24
mov byte [esp + 0x35], 0
lea edx, [ecx*4 + 0x4d3d40]
push edx
call fcn.0042c710
add esp, 0x1c
mov esi, eax
mov eax, dword [0x4d4218]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c018
cmp esi, edi
jne 0x42bd16
mov cl, byte [esp + 0x78]
and cl, 0x1f
cmp cl, 5
jne 0x42bd16
mov ecx, 5
mov edi, str.VOBID
lea esi, [esp + 0x80]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42bd16
mov eax, dword [esp + 0x1d60]
inc dword [eax]
mov eax, dword [esp + 0x14]
add eax, 3
mov dword [esp + 0x14], eax
cmp byte [eax - 1], 0xff
jne 0x42b377
jmp case.0x42acf1.6
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x6c]
mov dword [esp + 0x44], eax
push ecx
mov ecx, dword [0x4d4210]
push edx
mov edx, dword [0x4d3d28]
lea eax, [esp + 0x1360]
push 0xa04
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42bdf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x42bdb8
mov eax, dword [esp + 0x44]
push eax
call ebx
mov ecx, dword [0x4d4218]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
mov eax, 0x15
pop ebx
add esp, 0x1d4c
ret
mov edx, dword [esp + 0x44]
push 0x7d0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42bdf3
mov eax, dword [esp + 0x44]
push eax
call ebx
mov ecx, dword [0x4d4218]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
mov eax, 0x15
pop ebx
add esp, 0x1d4c
ret
mov edx, dword [esp + 0x1d60]
mov eax, dword [esp + 0x1358]
test eax, eax
mov dword [esp + 0x48], 0
mov dword [edx], 0
jle case.0x42acf1.6
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea ebx, [esp + 0x135e]
mov eax, dword [esp + 0x1d60]
cmp dword [eax], 0x17
jge case.0x42acf1.6
cmp byte [ebx - 2], 0x55
jne 0x42bf6c
mov al, byte [ebx]
cmp al, 0x43
je 0x42bf6c
and eax, 0xff
lea ecx, [esp + 0x104]
push eax
push 0x4a00d0
push ecx
call ebp
mov edx, dword [esp + 0x1d6c]
lea edi, [esp + 0x110]
or ecx, 0xffffffff
add esp, 0xc
mov eax, dword [edx]
mov byte [esp + 0x18], 0x12
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
lea eax, [eax + eax*8]
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0x24
mov byte [esp + 0x1d], 0
lea edx, [eax*4 + 0x4d3d40]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1d60]
xor ecx, ecx
mov cl, byte [ebx + 1]
mov eax, dword [esi]
lea edx, [eax + eax*8]
mov dword [edx*4 + 0x4d3d48], ecx
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [ebx + 2]
lea edx, [eax + eax*8]
mov dword [edx*4 + 0x4d3d4c], ecx
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [ebx + 3]
lea edx, [eax + eax*8]
mov eax, dword [0x4d4218]
push eax
mov dword [edx*4 + 0x4d3d50], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi]
push 3
lea ecx, [esp + 0x7c]
push 0x28
lea eax, [eax + eax*8]
push ecx
push 1
lea edx, [esp + 0x28]
push 6
lea ecx, [eax*4 + 0x4d3d40]
push edx
push ecx
call fcn.0042c710
mov edx, dword [0x4d4218]
add esp, 0x1c
mov esi, eax
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c018
test esi, esi
jne 0x42bf6c
mov al, byte [esp + 0x78]
and al, 0x1f
cmp al, 5
jne 0x42bf6c
mov ecx, 5
mov edi, str.VOBID
lea esi, [esp + 0x80]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42bf6c
mov eax, dword [esp + 0x1d60]
inc dword [eax]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x1358]
inc eax
add ebx, 0x28
cmp eax, ecx
mov dword [esp + 0x48], eax
jl 0x42be24
jmp case.0x42acf1.6
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x6c]
mov dword [esp + 0x44], eax
push ecx
mov ecx, dword [0x4d3d28]
push edx
lea eax, [esp + 0x2ac]
push 0xa5
push eax
push 0
push 0
push 0x801
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x42c028
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x42c005
mov ecx, dword [esp + 0x44]
push 0x7d0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42c028
mov edx, dword [esp + 0x44]
push edx
call ebx
mov eax, dword [0x4d4218]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
mov eax, 0x15
pop ebx
add esp, 0x1d4c
ret
mov ecx, dword [esp + 0x1d60]
mov al, byte [esp + 0x2a4]
cmp al, 0xff
mov dword [ecx], 0
je case.0x42acf1.6
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea ebx, [esp + 0x2a5]
mov edx, dword [esp + 0x1d60]
cmp dword [edx], 0x17
jge case.0x42acf1.6
xor eax, eax
lea ecx, [esp + 0x104]
mov al, byte [ebx + 3]
push eax
push 0x4a00d0
push ecx
call ebp
mov edx, dword [esp + 0x1d6c]
lea edi, [esp + 0x110]
or ecx, 0xffffffff
add esp, 0xc
mov eax, dword [edx]
mov byte [esp + 0x18], 0x12
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
lea eax, [eax + eax*8]
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0x24
mov byte [esp + 0x1d], 0
lea edx, [eax*4 + 0x4d3d40]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1d60]
xor ecx, ecx
mov cl, byte [ebx - 1]
mov eax, dword [esi]
lea edx, [eax + eax*8]
mov dword [edx*4 + 0x4d3d48], ecx
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [eax + eax*8]
mov dword [edx*4 + 0x4d3d4c], ecx
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [ebx + 1]
lea edx, [eax + eax*8]
mov eax, dword [0x4d4218]
push eax
mov dword [edx*4 + 0x4d3d50], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi]
push 3
lea ecx, [esp + 0x7c]
push 0x28
lea eax, [eax + eax*8]
push ecx
push 1
lea edx, [esp + 0x28]
push 6
lea ecx, [eax*4 + 0x4d3d40]
push edx
push ecx
call fcn.0042c710
mov edx, dword [0x4d4218]
add esp, 0x1c
mov esi, eax
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c018
test esi, esi
jne 0x42c184
mov al, byte [esp + 0x78]
and al, 0x1f
cmp al, 5
jne 0x42c184
mov ecx, 5
mov edi, str.VOBID
lea esi, [esp + 0x80]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42c184
mov eax, dword [esp + 0x1d60]
inc dword [eax]
mov al, byte [ebx + 4]
add ebx, 5
cmp al, 0xff
jne 0x42c051
mov esi, dword [esp + 0x1d60]
mov ecx, 9
xor eax, eax
mov edx, dword [esi]
lea edx, [edx + edx*8]
lea edi, [edx*4 + 0x4d3d40]
rep stosd dword es:[edi], eax
mov eax, dword [0x4d4218]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi]
cmp eax, 1
jle 0x42c1d6
push 0x42ac20
push 0x24
push eax
push 0x4d3d40
call fcn.0047ec95
add esp, 0x10
xor cl, cl
mov edx, 0x4d3d40
xor eax, eax
mov bl, byte [edx + eax]
add cl, bl
inc eax
cmp eax, 0x14
jl 0x42c1df
add edx, 0x24
cmp edx, 0x4d407c
jl 0x42c1dd
cmp cl, byte [0x4a02c8]
je 0x42c213
pop edi
pop esi
pop ebp
mov byte [0x4a02c8], cl
mov eax, 1
pop ebx
add esp, 0x1d4c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1d4c
ret