Function at 0x43b7e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465228
mov eax, dword fs:[0]
push eax
sub esp, 0x4fc
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x60], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x508], ecx
mov ecx, dword [ebp + 8]
call fcn.00403a10
mov ecx, dword [ebp + 0xc]
call fcn.00403a10
mov ecx, dword [ebp + 0x10]
call fcn.00403a10
mov dword [ebp - 0x3c], 0
push 0x468e68
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x43b84b
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x38], 0
push str.RtlInitUnicodeString
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x43b871
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x48], 0
push str.ZwOpenDirectoryObject
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x43b897
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x5c], 0
push str.ZwQuerySymbolicLinkObject
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x43b8bd
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x14], 0
push str.ZwQueryDirectoryObject
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43b8e3
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x10], 0
push str.ZwOpenSymbolicLinkObject
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43b909
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x34], 0
push str.ZwClose
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x43b92f
xor al, al
jmp 0x43bd7c
mov word [ebp - 0x44], 0
xor eax, eax
mov dword [ebp - 0x42], eax
mov word [ebp - 0x3e], ax
push str.GLOBAL__
lea ecx, [ebp - 0x44]
push ecx
call dword [ebp - 0x38]
mov dword [ebp - 0x30], 0
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0x40
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x30]
push ecx
push 1
lea edx, [ebp - 0x58]
push edx
call dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43b9b6
xor al, al
jmp 0x43bd7c
push 0x800000
push 0
push 0x487020
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4c]
push ecx
push 1
push 0
push 0x800000
push 0x487020
mov edx, dword [ebp - 0x58]
push edx
call dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43ba0c
mov eax, dword [ebp - 0x58]
push eax
call dword [ebp - 0x34]
xor al, al
jmp 0x43bd7c
mov dword [ebp - 0x54], 0x487020
mov ecx, dword [ebp - 0x54]
movzx edx, word [ecx + 2]
test edx, edx
je 0x43bd73
push 0x468f10
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x7c]
call dword [0x46831c]
mov word [ebp - 0xcc], 0
xor edx, edx
mov dword [ebp - 0xca], edx
mov word [ebp - 0xc6], dx
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [ebp - 0x38]
mov dword [ebp - 0x504], 0
xor ecx, ecx
mov dword [ebp - 0x500], ecx
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x4f8], ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x504], 0x18
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x4f8], 0x40
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0x504]
push eax
push 1
lea ecx, [ebp - 0xbc]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43bb1f
mov edx, dword [ebp - 0x54]
add edx, 0x10
mov dword [ebp - 0x54], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x43ba13
mov word [ebp - 0xc4], 0
xor eax, eax
mov dword [ebp - 0xc2], eax
mov word [ebp - 0xbe], ax
mov word [ebp - 0x4ec], 0
push 0x3fe
push 0
lea ecx, [ebp - 0x4ea]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x4ec]
mov dword [ebp - 0xc0], edx
mov word [ebp - 0xc2], 0x400
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
call dword [ebp - 0x5c]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43bbbe
mov eax, dword [ebp - 0xbc]
push eax
call dword [ebp - 0x34]
mov ecx, dword [ebp - 0x54]
add ecx, 0x10
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x43ba13
mov edx, dword [ebp - 0xc0]
push edx
lea ecx, [ebp - 0xe8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 1
push 0
push str.DeviceHarddiskVolume
lea ecx, [ebp - 0xe8]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
test eax, eax
je 0x43bc24
mov eax, dword [ebp - 0xbc]
push eax
call dword [ebp - 0x34]
mov ecx, dword [ebp - 0x54]
add ecx, 0x10
mov dword [ebp - 0x54], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x43ba13
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 4]
push edx
lea ecx, [ebp - 0xb8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 3
push 0
push str.Volume
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
test eax, eax
jne 0x43bc8f
push str.___
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x98]
call dword [0x46831c]
jmp 0x43bca0
push 0x468f68
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push 0
push str.STORAGEVolume
lea ecx, [ebp - 0xb8]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
test eax, eax
jne 0x43bcdd
push 0x468f8c
lea ecx, [ebp - 0xb8]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0xb8]
call dword [0x46831c]
jmp 0x43bcee
push 0x468f98
lea ecx, [ebp - 0xb8]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea ecx, [ebp - 0x98]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406d00
lea edx, [ebp - 0xe8]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00406d00
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00406d00
mov ecx, dword [ebp - 0x54]
add ecx, 0x10
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0xbc]
push edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x43ba13
mov eax, dword [ebp - 0x58]
push eax
call dword [ebp - 0x34]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x60]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 0xc