Function at 0x645150
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck
Get storage device properties
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov ebx, edx
mov ebp, ecx
mov eax, dword [esp + 0xe0]
mov byte [esp + 0xbb], 0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov edi, eax
xor esi, esi
cmp edi, 0xffffffff
je 0x646ba5
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebx
mov ebx, 0xe4
xor ebx, 0x44
mov al, bl
xor al, 0x86
mov byte [esp + 0x9f], al
lea esi, [esp + 0xac]
mov dword [esp], esi
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
call fcn.007c51a0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xbc], 0
lea ebp, [esp + 0xbc]
mov dword [esp + 0x18], ebp
lea eax, [esp + 0xa4]
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0xc], 0xc
mov dword [esp + 4], 0x2d1400
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
xor edx, edx
test eax, eax
je 0x64534e
mov dword [esp + 0xa0], edi
xor eax, eax
test al, al
jne 0x646b86
cmp dword [esp + 0xbc], 8
jne 0x646b86
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00493840
test eax, eax
jne 0x6452b2
mov ecx, eax
imul ecx, ecx
and ecx, 3
xor edx, edx
cmp ecx, 2
jb 0x646b86
mov edi, eax
mov dword [esp + 0x90], edi
mov dword [esp], esi
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
call fcn.007c51a0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xbc], 0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 8], esi
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0xc
mov dword [esp + 4], 0x2d1400
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
sete cl
movzx ecx, cl
cmp eax, ecx
jne 0x64535a
mov edx, edi
jmp 0x646b86
mov dword [esp + 0xa0], edi
jmp 0x646b86
mov esi, dword [edi + 4]
cmp esi, 8
mov edx, edi
jb 0x646b86
xor eax, eax
test al, al
jne 0x646b86
mov edi, edx
mov eax, dword [esp + 0xbc]
cmp eax, esi
sbb cl, cl
mov edx, esi
or edx, 2
mov ebp, esi
xor ebp, 2
add ebp, edx
setne dl
test cl, dl
jne 0x6454ea
cmp eax, dword [esp + 0xa8]
mov edx, edi
ja 0x646b86
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
je 0x646b86
mov eax, dword [edx]
cmp eax, 0x20
jb 0x646b86
cmp eax, esi
ja 0x646b86
movzx ecx, byte [edx + 0xa]
mov eax, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete byte [esp + 0x57]
mov eax, dword [edx + 0x1c]
cmp eax, 7
jne 0x6453f1
imul eax, eax
and eax, 3
cmp eax, 2
jb 0x646b86
mov dword [esp + 0x44], ecx
lea ebp, [esp + 0xbb]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x88], 0
test eax, eax
mov ecx, ebp
mov edi, 0
je 0x645514
cmp eax, esi
mov ecx, ebp
mov edi, 0
jae 0x645514
mov edi, eax
or eax, 2
mov ecx, edi
xor ecx, 2
add ecx, eax
mov eax, edi
mov ecx, ebp
mov edi, 0
je 0x645514
mov edi, edx
xor ebx, 3
add ebx, 0x2f
add ebx, 0xd
xor ebx, 0xc5
mov ecx, 0x101
mov edx, eax
mov dword [esp + 0x84], eax
movzx eax, byte [edi + edx]
test eax, eax
jne 0x645476
mov ebp, eax
or ebp, 2
xor eax, 2
add eax, ebp
jne 0x6454f1
mov eax, edx
or eax, 2
mov ebp, edx
xor ebp, 2
add ebp, eax
setne al
movzx eax, al
add edx, eax
mov eax, ecx
and eax, 1
xor eax, ecx
cmp eax, 0xffffffff
setne al
movzx eax, al
sub ecx, eax
cmp edx, esi
setb al
mov ebp, edx
and ebp, 1
inc ebp
xor ebp, edx
sete byte [esp + 0x8c]
mov ebp, ecx
imul ebp, ebp
and ebp, 3
cmp ebp, 3
sete ah
movzx ebp, ah
cmp ecx, ebp
je 0x6454db
and ebx, 0xfffffff1
add ebx, 0x7c
xor ebx, 0x98
or al, byte [esp + 0x8c]
jne 0x645462
lea ebp, [esp + 0xbb]
mov ecx, ebp
mov edx, edi
xor edi, edi
jmp 0x645514
mov edx, edi
jmp 0x646b86
mov esi, dword [esp + 0x84]
add esi, dword [esp + 0x90]
mov dword [esp], esi
call fcn.007c3e70
mov ecx, esi
mov edx, edi
mov edi, eax
lea ebp, [esp + 0xbb]
mov dword [esp + 0x84], ecx
mov ebx, ebp
mov esi, dword [edx + 0x18]
test esi, esi
je 0x645554
xor ecx, ecx
test cl, cl
mov eax, dword [esp + 0x98]
jne 0x645688
mov ebp, eax
mov al, 0x13
movzx ecx, al
cmp ecx, 0xa
je 0x645560
cmp ecx, 0x13
je 0x64556f
cmp ecx, 0x60
jne 0x645589
mov ecx, dword [edx + 4]
cmp esi, ecx
jb 0x6455af
jmp 0x64559d
mov eax, dword [esp + 0x98]
jmp 0x645688
mov ecx, dword [edx + 4]
cmp esi, ecx
jb 0x6455af
xor eax, eax
test al, al
je 0x64559d
jmp 0x6455af
mov ecx, dword [edx + 4]
cmp esi, ecx
jae 0x64559d
mov eax, edx
mov edx, esi
and edx, 1
xor edx, esi
not edx
test edx, edx
mov edx, eax
jne 0x6455af
jmp 0x64559d
mov ecx, dword [edx + 4]
cmp esi, ecx
jb 0x6455af
mov eax, esi
imul eax, eax
and eax, 3
cmp eax, 2
je 0x6455af
mov dword [esp + 0x88], 0
mov eax, ebp
jmp 0x645688
mov dword [esp + 0x58], edi
mov edi, edx
lea edx, [esi + 1]
mov dword [esp + 0x8c], esi
mov esi, 0x101
movzx ebx, byte [edi + edx - 1]
mov ebp, ebx
imul ebp, ebp
and ebp, 3
cmp ebp, 3
sete al
movzx eax, al
cmp ebx, eax
je 0x64561c
mov eax, esi
or eax, 2
mov ebx, esi
xor ebx, 2
add ebx, eax
setne al
movzx eax, al
sub esi, eax
je 0x6455fb
cmp edx, ecx
lea edx, [edx + 1]
jb 0x6455c4
mov dword [esp + 0x88], 0
mov edx, edi
mov eax, dword [esp + 0x98]
lea ebx, [esp + 0xbb]
mov edi, dword [esp + 0x58]
jmp 0x645688
mov al, 0x67
movzx eax, al
cmp eax, 0x23
mov ebx, dword [esp + 0x98]
jne 0x64564e
mov esi, dword [esp + 0x90]
add esi, dword [esp + 0x8c]
mov dword [esp], esi
call fcn.007c3e70
mov ecx, 3
sub ecx, eax
xor ecx, eax
jmp 0x645670
mov esi, dword [esp + 0x90]
add esi, dword [esp + 0x8c]
mov dword [esp], esi
call fcn.007c3e70
mov edx, eax
or edx, 2
mov ecx, eax
xor ecx, 2
add ecx, edx
setne cl
shl eax, cl
mov dword [esp + 0x88], eax
mov ebp, esi
mov edx, edi
mov edi, dword [esp + 0x58]
mov eax, ebx
mov ebx, ebp
mov dword [esp + 0x8c], ebx
mov ebp, dword [eax]
lea eax, [edi + ebp]
mov ecx, dword [esp + 0x88]
lea ecx, [ecx + eax + 0x19]
mov eax, dword [esp + 0xd4]
mov esi, dword [eax]
mov dword [esp + 0x90], esi
cmp ecx, esi
jbe 0x645743
mov ebp, eax
mov dword [esp + 0x58], edi
mov dword [esp + 0x8c], ebx
mov esi, edx
mov cl, 0x16
movzx ecx, cl
mov ebx, ecx
xor ebx, 0xf9
cmp ecx, 0x16
je 0x64575e
cmp ecx, 0x1d
je 0x64579a
cmp ecx, 0x6b
jne 0x6457de
add bl, 0x52
xor bl, 0x67
mov eax, dword [esp + 0x90]
mov ecx, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
setb cl
shl eax, cl
mov dword [ebp], eax
mov ecx, dword [esp + 0x94]
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00492a60
test eax, eax
jne 0x64580d
mov ecx, eax
and ecx, 1
xor ecx, eax
not ecx
test ecx, ecx
mov edx, esi
jne 0x646b86
jmp 0x64580f
mov ecx, edi
mov dword [esp + 0x40], edx
mov edi, dword [esp + 0x94]
mov eax, dword [edi]
mov esi, dword [esp + 0x98]
jmp 0x645878
mov eax, dword [esp + 0x90]
mov ecx, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
setb cl
shl eax, cl
mov dword [ebp], eax
mov ecx, dword [esp + 0x94]
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00492a60
test eax, eax
je 0x646bb8
add bl, 0x37
jmp 0x64580d
mov eax, dword [esp + 0x90]
add eax, eax
mov dword [ebp], eax
mov ecx, dword [esp + 0x94]
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00492a60
test eax, eax
je 0x646bc0
mov ecx, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
mov edx, esi
je 0x646b86
xor bl, 0xf2
add bl, 9
jmp 0x64580f
mov eax, dword [esp + 0x90]
add eax, eax
mov dword [ebp], eax
mov ecx, dword [esp + 0x94]
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00492a60
test eax, eax
je 0x646bbc
xor bl, 0x84
add bl, 0xbb
mov edx, esi
movzx esi, bl
cmp esi, 0x17
je 0x645844
cmp esi, 0x52
mov ebp, dword [esp + 0x98]
mov ebx, dword [esp + 0x8c]
je 0x645863
mov dword [esp + 0x40], edx
cmp esi, 0x55
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0x94]
mov dword [edi], eax
mov esi, ebp
mov ebp, dword [esi]
jmp 0x645878
mov dword [esp + 0x40], edx
mov edi, dword [esp + 0x94]
mov dword [edi], eax
mov esi, dword [esp + 0x98]
mov ebp, dword [esi]
mov ebx, dword [esp + 0x8c]
jmp 0x645874
mov dword [esp + 0x40], edx
mov edi, dword [esp + 0x94]
mov dword [edi], eax
mov esi, ebp
mov ebp, dword [esi]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x8c], ebx
mov ebx, ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x98], esi
add ebp, eax
mov dword [esp + 0x3c], ebp
mov dword [esp], ebp
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
call fcn.007c51a0
mov eax, dword [edi]
mov ecx, dword [esi]
lea esi, [eax + ecx + 0x14]
mov eax, ebx
or eax, 2
mov ecx, ebx
xor ecx, 2
add ecx, eax
setne al
movzx ebp, al
add ebp, ebx
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x84]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.007c51d0
add ebp, esi
mov dword [esp + 0x70], ebp
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.007c3e70
mov esi, eax
mov dword [esp + 0x60], esi
imul eax, eax
and eax, 3
cmp eax, 2
sete al
movzx eax, al
cmp esi, eax
jle 0x646a5f
mov byte [esp + 0x34], 1
mov byte [esp + 0x67], 0x53
mov byte [esp + 0x56], 0x70
mov byte [esp + 0x55], 0x17
mov byte [esp + 0x51], 0x4f
mov byte [esp + 0x4b], 0x48
mov byte [esp + 0x54], 5
mov byte [esp + 0x4a], 0x7f
mov byte [esp + 0x53], 0x38
mov byte [esp + 0x52], 0xc
mov byte [esp + 0x23], 0x33
mov byte [esp + 0x3b], 0x6f
mov edx, 0xdc
add edx, 0xffffff45
mov dword [esp + 0x78], edx
mov ebp, dword [esp + 0x70]
mov byte [esp + 0x33], 0x50
mov byte [esp + 0x37], 0x1f
mov byte [esp + 0x83], 0x30
mov byte [esp + 0x3a], 0x6b
mov byte [esp + 0x2b], 0x58
mov byte [esp + 0x32], 0x75
mov byte [esp + 0x39], 0x5f
mov byte [esp + 0x38], 4
mov byte [esp + 0x5f], 2
mov byte [esp + 0x82], 0x45
mov byte [esp + 0x35], 0xe
mov byte [esp + 0x36], 0x2e
mov al, 0x43
mov dword [esp + 0x68], eax
mov al, 0x7a
mov dword [esp + 0x24], eax
mov al, 0xe
mov dword [esp + 0x2c], eax
mov bl, 0x2e
mov dword [esp + 0x4c], 0
mov al, 0x3d
mov dword [esp + 0x84], eax
mov al, 0x1e
mov dword [esp + 0x6c], eax
mov al, 0x21
mov dword [esp + 0x74], eax
mov eax, 0x3d
xor edi, edi
jmp 0x6459fb
add cl, 0x38
mov eax, dword [esp + 0x88]
or eax, 0xb
mov dword [esp + 0x2c], ecx
mov ecx, eax
jmp 0x646a48
mov edx, dword [esp + 0x78]
jmp 0x64682c
and eax, 0xffffffc0
add eax, 0x6b
movzx ecx, byte [esp + 0x82]
cmp ecx, 0xf
je 0x645a1b
cmp ecx, 0x45
jne 0x645a5d
mov dword [esp + 0x7c], ebx
xor al, 0x64
jmp 0x645a63
mov dword [esp + 0x7c], ebx
mov cl, al
add cl, 0xda
mov byte [esp + 0x82], cl
mov ecx, edi
mov dword [esp + 0x90], edi
or ecx, 2
cmp ecx, esi
jl 0x645a50
mov dword [esp + 0x88], 0
xor ebx, ebx
test bl, bl
je 0x645d64
mov dword [esp + 0x94], ebp
mov bl, byte [esp + 0x5f]
jmp 0x645a93
mov dword [esp + 0x7c], ebx
add al, 0xb4
mov ecx, edi
or ecx, 2
mov dword [esp + 0x88], 0
cmp ecx, esi
jge 0x645ac7
mov dword [esp + 0x94], ebp
mov dword [esp + 0x90], edi
mov bl, byte [esp + 0x5f]
mov byte [esp + 0x82], al
movzx eax, al
mov ebp, esi
and eax, 0xffffff8b
add eax, 0x31
movzx edx, bl
mov bl, al
cmp edx, 0x59
jne 0x645ada
add bl, 0xc6
mov edx, dword [esp + 0x8c]
movsx edx, byte [edx + ecx]
lea esi, [edx - 0x31]
cmp esi, 8
ja case.default.0x645ac0
mov ecx, eax
movzx eax, bl
jmp dword [esi*4 + 0x7e2868]
mov byte [esp + 0x82], al
mov cl, byte [esp + 0x83]
jmp 0x645dd7
add bl, 0x1d
mov edx, dword [esp + 0x8c]
movsx edx, byte [edx + ecx]
movzx ecx, bl
lea esi, [edx - 0x31]
cmp esi, 8
ja case.default.0x645af3
jmp dword [esi*4 + 0x7e282c]
and ecx, 0xffffff9a
xor ecx, 0xdf
movzx eax, byte [esp + 0x35]
cmp eax, 0xe
jne 0x645cf3
add cl, 0x47
jmp 0x645cf6
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x645b40
mov ecx, eax
mov esi, ebp
jmp dword [edx*4 + 0x7e288c]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x645b40
mov eax, ecx
mov esi, ebp
jmp dword [edx*4 + 0x7e2850]
and eax, 0xffffff9a
xor eax, 0x95
movzx ecx, byte [esp + 0x36]
cmp ecx, 0x2e
mov ebp, dword [esp + 0x94]
jne 0x645d0c
add al, 0x99
jmp 0x645d0e
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0x30
jmp 0x645c13
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0x50
jmp 0x645c13
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0xc0
jmp 0x645cdc
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0xe0
jmp 0x645cdc
and eax, 0xffffffc1
xor eax, 0xd5
movzx ecx, byte [esp + 0x38]
cmp ecx, 0x50
jne 0x645d1f
xor al, 0x85
jmp 0x645d21
and eax, 0xffffffc1
or eax, 0x28
movzx ecx, byte [esp + 0x39]
cmp ecx, 0x5f
jne 0x645d35
add al, 0x37
jmp 0x645d37
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0x60
jmp 0x645c13
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0x70
mov edx, dword [esp + 0x78]
jmp 0x645dc0
and ecx, 0xffffff9a
add ecx, 0xc9
movzx eax, byte [esp + 0x32]
cmp eax, 0xc
je 0x645d74
xor ecx, 0xfb
cmp eax, 0x75
mov edx, dword [esp + 0x78]
mov esi, ebp
jne 0x645d8a
xor cl, 0x6f
jmp 0x645d8d
mov al, bl
and al, 0xa4
movzx ecx, al
mov eax, ecx
xor eax, 0xc7
movzx edx, byte [esp + 0x2b]
cmp edx, 3
je 0x645da7
cmp edx, 0x58
mov esi, ebp
jne 0x64618a
add al, 0x63
mov dword [esp + 0x88], 0x90
jmp 0x64619d
mov dword [esp + 0x88], 0
jmp 0x645db8
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0xb0
jmp 0x645cdc
and ecx, 0xffffff9a
add ecx, 0x92
movzx eax, byte [esp + 0x3a]
cmp eax, 0x6b
mov ebp, dword [esp + 0x94]
jne 0x645d48
xor cl, 0xc1
jmp 0x645d4b
mov byte [esp + 0x5f], bl
mov dword [esp + 0x88], 0xf0
mov edx, dword [esp + 0x78]
mov edi, dword [esp + 0x90]
mov cl, byte [esp + 0x83]
jmp 0x645dd0
xor cl, 0xeb
mov dword [esp + 0x88], 0x10
mov al, cl
mov byte [esp + 0x35], al
jmp 0x645db8
add al, 0xa1
mov dword [esp + 0x88], 0xa0
mov byte [esp + 0x36], al
jmp 0x645d5c
xor al, 0xd1
mov dword [esp + 0x88], 0x20
mov byte [esp + 0x38], al
jmp 0x645db8
add al, 0x1c
mov dword [esp + 0x88], 0x40
mov byte [esp + 0x39], al
jmp 0x645db8
add cl, 0xd4
mov dword [esp + 0x88], 0xd0
mov al, cl
mov byte [esp + 0x3a], al
mov edx, dword [esp + 0x78]
mov byte [esp + 0x5f], bl
mov edi, dword [esp + 0x90]
mov cl, byte [esp + 0x83]
jmp 0x645dd7
add cl, 0x76
mov dword [esp + 0x88], pe_nt_image_headers32
mov al, cl
mov byte [esp + 0x32], al
jmp 0x645db8
xor cl, 0x16
mov dword [esp + 0x88], pe_nt_image_headers32
mov al, cl
mov byte [esp + 0x32], al
mov byte [esp + 0x5f], bl
jmp 0x645ce0
add al, 0x91
mov dword [esp + 0x88], 0x90
mov byte [esp + 0x2b], al
mov edx, dword [esp + 0x78]
mov byte [esp + 0x5f], bl
mov edi, dword [esp + 0x90]
mov cl, byte [esp + 0x83]
mov esi, ebp
mov ebp, dword [esp + 0x94]
mov eax, edi
or eax, 3
cmp eax, esi
jge 0x6460d7
movzx ecx, cl
cmp ecx, 0x23
je 0x645e27
cmp ecx, 0x29
je 0x645e5d
cmp ecx, 0x49
jne 0x645e8b
mov cl, dl
add cl, 0x28
mov byte [esp + 0x83], cl
mov ebx, dword [esp + 0x8c]
movsx edx, byte [ebx + eax]
movzx eax, cl
lea ecx, [edx - 0x31]
cmp ecx, 8
ja case.default.0x645e20
jmp dword [ecx*4 + 0x7e28a4]
mov cl, dl
mov ebx, edx
add cl, 0xf
mov byte [esp + 0x83], cl
mov edx, dword [esp + 0x8c]
movsx edx, byte [edx + eax]
movzx eax, cl
lea ecx, [edx - 0x31]
cmp ecx, 8
ja case.default.0x645e56
mov ebx, dword [esp + 0x8c]
jmp dword [ecx*4 + 0x7e28e0]
mov cl, dl
add cl, 2
mov byte [esp + 0x83], cl
mov esi, edx
mov ebx, dword [esp + 0x8c]
movsx edx, byte [ebx + eax]
lea ecx, [edx - 0x31]
mov eax, esi
cmp ecx, 8
ja case.default.0x645e84
jmp dword [ecx*4 + 0x7e291c]
mov bl, dl
mov esi, edx
add bl, 8
mov ecx, dword [esp + 0x8c]
movsx edx, byte [ecx + eax]
lea ecx, [edx - 0x31]
cmp ecx, 8
ja case.default.0x645eba
movzx eax, bl
mov byte [esp + 0x83], bl
mov ebx, dword [esp + 0x8c]
jmp dword [ecx*4 + 0x7e2958]
mov edx, dword [esp + 0x88]
mov eax, edx
and eax, 1
xor eax, edx
cmp eax, 0xffffffff
setne al
movzx eax, al
or edx, eax
jmp 0x6461d6
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x645f3a
mov dword [esp + 0x90], edi
mov ebx, eax
mov ecx, eax
jmp dword [edx*4 + 0x7e28c8]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x645f16
mov dword [esp + 0x90], edi
mov edi, ebx
mov ecx, eax
mov eax, edi
jmp dword [edx*4 + 0x7e2904]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x645f3a
mov dword [esp + 0x90], edi
movzx ebx, byte [esp + 0x83]
mov ecx, eax
jmp dword [edx*4 + 0x7e2940]
mov byte [esp + 0x83], bl
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x645f16
mov dword [esp + 0x90], edi
mov ebx, esi
mov ecx, esi
mov eax, esi
jmp dword [edx*4 + 0x7e297c]
mov edx, dword [esp + 0x88]
or edx, 0xa
jmp 0x6460b4
mov edx, dword [esp + 0x88]
or edx, 3
jmp 0x6461d6
mov edx, dword [esp + 0x88]
or edx, 5
jmp 0x6461d6
and ecx, 0xffffff86
add ecx, 0x3e
movzx eax, byte [esp + 0x33]
cmp eax, 0x1e
mov ebx, dword [esp + 0x8c]
je 0x6461ae
cmp eax, 0x62
mov edi, dword [esp + 0x90]
mov edx, dword [esp + 0x88]
jne 0x6461ca
add cl, 0xe0
jmp 0x6461cd
and ebx, 0xffffff95
add ebx, 0xb3
movzx eax, byte [esp + 0x37]
cmp eax, 0x1f
jne 0x6460a1
xor ebx, 0x91
add bl, 0xfa
jmp 0x6460a4
and eax, 0xffffff86
add eax, 0x91
movzx ecx, byte [esp + 0x3b]
cmp ecx, 0x6f
mov edx, dword [esp + 0x88]
jne 0x64615e
xor al, 0xa0
jmp 0x646160
mov edx, dword [esp + 0x88]
or edx, 4
jmp 0x6461d6
mov edx, dword [esp + 0x88]
or edx, 6
jmp 0x6461d6
mov edx, dword [esp + 0x88]
or edx, 7
jmp 0x6461d6
mov edx, dword [esp + 0x88]
or edx, 8
jmp 0x6461d6
mov edx, dword [esp + 0x88]
or edx, 9
jmp 0x6461d6
mov edx, dword [esp + 0x88]
or edx, 0xb
jmp 0x6460b4
mov edx, dword [esp + 0x88]
or edx, 0xd
jmp 0x6460b4
and eax, 0xffffff97
lea ecx, [eax + 0xc8]
movzx edx, byte [esp + 0x23]
cmp edx, 0x37
mov ebx, dword [esp + 0x8c]
jne 0x646169
add cl, 0x6a
jmp 0x646171
add bl, 0x5c
mov edx, dword [esp + 0x88]
or edx, 0xe
mov al, bl
mov byte [esp + 0x37], al
mov ebx, dword [esp + 0x8c]
mov edi, dword [esp + 0x90]
jmp 0x6461d6
mov cl, byte [esp + 0x83]
jmp 0x6460de
mov cl, byte [esp + 0x83]
mov ebx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x6c]
movzx eax, al
cmp eax, 7
je 0x64610b
cmp eax, 0x1e
je 0x64612f
mov byte [esp + 0x83], cl
cmp eax, 0x69
jne 0x64613f
mov eax, 0xaa
add al, 0x5d
jmp 0x646146
mov byte [esp + 0x83], cl
mov eax, 0xaa
xor al, 0xc3
mov dword [esp + 0x6c], eax
mov eax, edx
and eax, 1
inc eax
xor eax, edx
sete al
movzx eax, al
cmp edx, eax
jmp 0x64614c
mov byte [esp + 0x83], cl
mov eax, 0xaa
add al, 0x85
jmp 0x646146
mov eax, 0xaa
xor al, 0xb4
mov dword [esp + 0x6c], eax
test edx, edx
mov ecx, dword [esp + 0x84]
jne 0x6461dd
jmp 0x646215
add al, 0xde
or edx, 2
mov byte [esp + 0x3b], al
jmp 0x6461d6
xor ecx, eax
add ecx, 0xffffffdc
xor cl, 0x93
mov edx, dword [esp + 0x88]
or edx, 0xf
mov al, cl
mov byte [esp + 0x23], al
mov edi, dword [esp + 0x90]
jmp 0x6461d6
xor ecx, 0x2a
xor cl, 0x29
mov dword [esp + 0x88], 0x90
mov al, cl
mov byte [esp + 0x2b], al
mov edx, dword [esp + 0x78]
mov byte [esp + 0x5f], bl
jmp 0x645ce0
add cl, 0x24
mov edx, dword [esp + 0x88]
or edx, 0xc
mov al, cl
mov byte [esp + 0x33], al
mov edi, dword [esp + 0x90]
jmp 0x6461d6
xor cl, 0x6e
or edx, 0xc
mov al, cl
mov byte [esp + 0x33], al
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x74]
movzx eax, al
cmp eax, 0x21
je 0x6461fa
cmp eax, 0x2d
jne 0x646203
mov eax, 0xc6
lea eax, [eax + 0x2d]
add al, 0x3a
jmp 0x64620d
mov eax, 0xc6
add al, 0x68
jmp 0x64620d
mov eax, 0xc6
xor eax, 0xa
add al, 0x55
mov dword [esp + 0x74], eax
mov byte [ebp], dl
inc ebp
mov eax, 0x88
test cl, cl
je 0x64627b
movzx ecx, cl
cmp ecx, 0x24
je 0x6462c2
mov dword [esp + 0x94], ebp
cmp ecx, 0x3d
jne 0x646303
mov ecx, 0x88
add cl, 0xe0
movsx edx, byte [ebx + edi]
movzx esi, cl
lea ebp, [edx - 0x31]
cmp ebp, 8
ja case.default.0x646274
mov dword [esp + 0x84], ecx
mov dword [esp + 0x90], edi
mov edi, ebx
mov ebx, 0x88
mov edx, 0x88
mov ecx, 0x88
jmp dword [ebp*4 + 0x7e29d0]
mov dword [esp + 0x94], ebp
mov ecx, 0x88
xor cl, 0xac
mov dword [esp + 0x84], ecx
movsx edx, byte [ebx + edi]
movzx ecx, cl
lea ebp, [edx - 0x31]
cmp ebp, 8
ja case.default.0x6462bb
mov dword [esp + 0x90], edi
mov edi, ebx
mov ebx, ecx
mov eax, ecx
mov edx, 0x88
mov esi, 0x88
jmp dword [ebp*4 + 0x7e2994]
mov dword [esp + 0x94], ebp
mov ecx, 0x88
add cl, 0xb5
mov dword [esp + 0x84], ecx
movsx edx, byte [ebx + edi]
movzx ecx, cl
lea ebp, [edx - 0x31]
cmp ebp, 8
ja case.default.0x6462fc
mov dword [esp + 0x90], edi
mov edi, ebx
mov ebx, ecx
mov eax, ecx
mov edx, ecx
mov esi, ecx
jmp dword [ebp*4 + 0x7e2a0c]
mov ecx, 0x88
add cl, 0x78
movsx edx, byte [ebx + edi]
lea ebp, [edx - 0x31]
cmp ebp, 8
ja case.default.0x646337
mov dword [esp + 0x90], edi
mov edi, ebx
movzx ebx, cl
mov dword [esp + 0x84], ecx
mov edx, ebx
mov esi, 0x88
mov ecx, ebx
jmp dword [ebp*4 + 0x7e2a48]
and ecx, 0x42
add ecx, 0xeb
movzx eax, byte [esp + 0x56]
cmp eax, 0x70
mov edi, dword [esp + 0x90]
jne 0x6465be
add cl, 0x1a
jmp 0x6465c1
mov dword [esp + 0x84], ecx
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x64639c
mov ecx, esi
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jmp dword [edx*4 + 0x7e29f4]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x64639c
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jmp dword [edx*4 + 0x7e29b8]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x64639c
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jmp dword [edx*4 + 0x7e2a30]
mov dword [esp + 0x84], ecx
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x64639c
mov ecx, 0x88
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jmp dword [edx*4 + 0x7e2a6c]
mov dword [esp + 0x88], 0xa0
jmp 0x6466bd
mov dword [esp + 0x88], 0x30
jmp 0x6466ae
mov eax, dword [esp + 0x84]
and al, 0x82
movzx eax, al
add eax, 0x17
movzx ecx, byte [esp + 0x51]
cmp ecx, 0x2d
mov edi, dword [esp + 0x90]
je 0x64662f
cmp ecx, 0x4f
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jne 0x646642
xor al, 0x4f
jmp 0x646644
mov dword [esp + 0x88], 0xc0
jmp 0x6466bd
add eax, 0xffffffb4
movzx ecx, byte [esp + 0x52]
cmp ecx, 0x10
jne 0x6465a8
add al, 0xd4
jmp 0x6465aa
and esi, 0xa
mov eax, esi
xor eax, 0xf
mov ecx, eax
sub ecx, esi
xor ecx, 0xffffff77
mov edx, dword [esp + 0x4c]
test dl, dl
mov edi, dword [esp + 0x90]
je 0x646655
movzx edx, dl
cmp edx, 0x74
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jne 0x646671
add eax, 0x97
add al, 0xd6
jmp 0x646675
and edx, 0x42
add edx, 0x62
movzx eax, byte [esp + 0x55]
cmp eax, 0x17
mov edi, dword [esp + 0x90]
jne 0x6465d7
xor dl, 0x75
jmp 0x6465da
and eax, 0x42
add eax, 0x59
movzx ecx, byte [esp + 0x4b]
cmp ecx, 0x48
mov edi, dword [esp + 0x90]
jne 0x6465ed
add al, 0xe4
jmp 0x6465f2
mov dword [esp + 0x88], 0x70
jmp 0x6466ae
mov eax, dword [esp + 0x84]
and al, 0x82
movzx eax, al
or eax, 0x50
movzx ecx, byte [esp + 0x54]
cmp ecx, 5
mov edi, dword [esp + 0x90]
jne 0x646603
xor al, 0x59
jmp 0x646605
and ebx, 0x42
add ebx, 0x76
movzx eax, byte [esp + 0x4a]
cmp eax, 1
je 0x646686
cmp eax, 0x1b
je 0x64668e
cmp eax, 0x7f
jne 0x646693
add bl, 0xa5
jmp 0x646696
mov dword [esp + 0x88], 0
jmp 0x646667
mov dword [esp + 0x88], 0xb0
jmp 0x6466bd
and ecx, 2
or ecx, 0x25
movzx eax, byte [esp + 0x53]
cmp eax, 0x7e
jne 0x646616
add cl, 0x59
jmp 0x646619
mov dword [esp + 0x88], 0xf0
jmp 0x6466bd
xor al, 0x30
mov dword [esp + 0x88], 0xe0
mov byte [esp + 0x52], al
jmp 0x6466bd
xor cl, 0x9b
mov dword [esp + 0x88], 0x10
mov al, cl
mov byte [esp + 0x56], al
jmp 0x646667
add dl, 0xe8
mov dword [esp + 0x88], 0x40
mov al, dl
mov byte [esp + 0x55], al
jmp 0x646667
add eax, 0x70
xor al, 0x81
mov dword [esp + 0x88], 0x60
mov byte [esp + 0x4b], al
jmp 0x646667
xor al, 0x55
mov dword [esp + 0x88], pe_nt_image_headers32
mov byte [esp + 0x54], al
jmp 0x646667
xor cl, 0x1d
mov dword [esp + 0x88], 0xd0
mov al, cl
mov byte [esp + 0x53], al
jmp 0x6466bd
add al, 0x16
mov dword [esp + 0x88], 0x50
mov byte [esp + 0x51], al
jmp 0x646667
add al, 0x38
mov dword [esp + 0x88], 0x50
mov byte [esp + 0x51], al
jmp 0x6466bd
add cl, 0x99
mov dword [esp + 0x88], 0x20
mov dword [esp + 0x4c], ecx
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
jmp 0x6466bd
xor eax, ecx
xor al, 0x8f
mov dword [esp + 0x88], 0x20
mov dword [esp + 0x4c], eax
jmp 0x6466bd
xor ebx, 0x57
add bl, 0xb
jmp 0x646696
add bl, 9
jmp 0x646696
xor bl, 0x77
mov dword [esp + 0x88], 0x90
mov al, bl
mov byte [esp + 0x4a], al
mov dword [esp + 0x8c], edi
mov ebp, dword [esp + 0x60]
mov edi, dword [esp + 0x90]
mov ebx, dword [esp + 0x7c]
mov eax, 0x3a
movzx ecx, bl
mov ebx, 0x3a
cmp ecx, 0x2e
jne 0x6466f4
dec bl
mov eax, edi
and eax, 1
xor eax, edi
cmp eax, 0xffffffff
setne al
movzx esi, al
or esi, edi
cmp esi, ebp
mov edx, dword [esp + 0x78]
jge 0x64682a
movzx eax, bl
jmp 0x646713
add bl, 0xf4
mov ecx, edi
or ecx, 2
mov edx, edi
xor edx, 2
add edx, ecx
setne cl
movzx esi, cl
or esi, edi
cmp esi, ebp
jge case.default.0x646805
and eax, 0xfc
add eax, 0x45
movzx ecx, byte [esp + 0x67]
cmp ecx, 5
je 0x646756
cmp ecx, 0x18
je 0x646779
cmp ecx, 0x39
jne 0x64679c
mov cl, al
add cl, 0x88
mov byte [esp + 0x67], cl
mov ecx, dword [esp + 0x8c]
movsx edx, byte [ecx + esi]
lea ecx, [edx - 0x31]
cmp ecx, 8
ja case.default.0x64674f
jmp dword [ecx*4 + 0x7e2ac0]
mov cl, al
xor cl, 0x2e
mov byte [esp + 0x67], cl
mov ecx, dword [esp + 0x8c]
movsx edx, byte [ecx + esi]
lea ecx, [edx - 0x31]
cmp ecx, 8
ja case.default.0x646772
jmp dword [ecx*4 + 0x7e2afc]
add al, 0x9b
mov byte [esp + 0x67], al
mov ecx, dword [esp + 0x8c]
movsx edx, byte [ecx + esi]
movzx eax, al
lea ecx, [edx - 0x31]
cmp ecx, 8
ja case.default.0x646795
jmp dword [ecx*4 + 0x7e2a84]
lea ecx, [eax - 0x71]
mov dl, cl
xor dl, 0x35
mov byte [esp + 0x67], dl
mov edx, dword [esp + 0x8c]
movsx edx, byte [edx + esi]
lea esi, [edx - 0x31]
cmp esi, 8
ja case.default.0x6467bf
jmp dword [esi*4 + 0x7e2b38]
mov ecx, dword [esp + 0x88]
or ecx, 1
jmp 0x64691a
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x646805
mov ecx, eax
mov esi, ebp
mov ebp, dword [esp + 0x94]
jmp dword [edx*4 + 0x7e2ae4]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x646805
movzx ecx, byte [esp + 0x67]
mov esi, ebp
mov ebp, dword [esp + 0x94]
jmp dword [edx*4 + 0x7e2b20]
add edx, 0xffffff9f
cmp edx, 5
ja case.default.0x646805
mov ecx, eax
mov esi, ebp
mov ebp, dword [esp + 0x94]
jmp dword [edx*4 + 0x7e2aa8]
mov edx, dword [esp + 0x78]
mov esi, ebp
mov ebp, dword [esp + 0x94]
mov eax, 0x53
mov ecx, dword [esp + 0x68]
movzx ecx, cl
cmp ecx, 0x43
jne 0x646864
mov ecx, 0x53
add cl, 0xf0
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x88]
test ecx, ecx
jne 0x646a48
jmp 0x646a51
mov eax, 0x53
xor al, 0x51
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x64687f
mov dword [esp + 0x68], eax
jmp 0x646a48
mov dword [esp + 0x68], eax
movzx eax, al
jmp 0x646a51
add edx, 0xffffff9f
cmp edx, 5
mov esi, ebp
ja case.default.0x6468a0
mov ebp, dword [esp + 0x94]
jmp dword [edx*4 + 0x7e2b5c]
mov ecx, dword [esp + 0x88]
or ecx, 0xa
jmp 0x646a44
mov ecx, dword [esp + 0x88]
or ecx, 3
jmp 0x64691a
mov ecx, dword [esp + 0x88]
or ecx, 5
jmp 0x64691a
mov ecx, dword [esp + 0x88]
or ecx, 0xc
jmp 0x646a44
mov ecx, dword [esp + 0x88]
or ecx, 0xe
jmp 0x646a44
mov ecx, dword [esp + 0x88]
or ecx, 2
jmp 0x64691a
mov ecx, dword [esp + 0x88]
or ecx, 4
jmp 0x64691a
mov ecx, dword [esp + 0x88]
or ecx, 6
jmp 0x64691a
mov ecx, dword [esp + 0x88]
or ecx, 7
mov edx, dword [esp + 0x78]
mov esi, ebp
mov ebp, dword [esp + 0x94]
jmp 0x646a48
and eax, 0xffffff9a
xor eax, 0x49
movzx ecx, byte [esp + 0x34]
cmp ecx, 1
mov edx, dword [esp + 0x78]
je 0x6469cd
cmp ecx, 0x4f
mov esi, ebp
jne 0x6469e2
xor al, 0x1e
jmp 0x6469e4
and eax, 0xffffff9a
xor eax, 0xf3
mov ecx, dword [esp + 0x24]
movzx ecx, cl
cmp ecx, 0x5f
mov edx, dword [esp + 0x78]
je 0x6469fb
cmp ecx, 0x66
mov esi, ebp
jne 0x646a16
xor al, 0xb4
jmp 0x646a18
and ecx, 0xffffff80
xor ecx, 0xd6
mov eax, dword [esp + 0x2c]
movzx eax, al
cmp eax, 0xa
je 0x646a2f
cmp eax, 0xe
mov edx, dword [esp + 0x78]
jne 0x6459da
add cl, 0x34
jmp 0x6459dd
mov ecx, dword [esp + 0x88]
or ecx, 0xd
jmp 0x646a44
mov ecx, dword [esp + 0x88]
or ecx, 0xf
jmp 0x646a44
add al, 0x1a
mov ecx, dword [esp + 0x88]
or ecx, 8
mov byte [esp + 0x34], al
jmp 0x64691e
add al, 0xb0
mov ecx, dword [esp + 0x88]
or ecx, 8
mov byte [esp + 0x34], al
mov ebp, dword [esp + 0x94]
jmp 0x646a48
lea ecx, [eax + 5]
xor ecx, eax
add cl, 0x5f
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x88]
or ecx, 9
jmp 0x64691e
xor al, 0x8d
mov ecx, dword [esp + 0x88]
or ecx, 9
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x94]
jmp 0x646a48
lea eax, [ecx - 0x1d]
xor eax, ecx
dec al
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x88]
or ecx, 0xb
mov edx, dword [esp + 0x78]
mov eax, 0xe2
mov byte [ebp], cl
inc ebp
and eax, 0xe
add edi, 4
cmp edi, esi
jl 0x6459fb
mov edi, dword [esp + 0x8c]
mov eax, ebp
mov dl, 0x3c
mov cl, 0x35
mov ebp, eax
movzx ecx, cl
cmp ecx, 0x35
je 0x646a8a
cmp ecx, 0x62
jne 0x646a99
cmp ebp, dword [esp + 0x70]
mov cl, 0x35
mov ebx, 0xe6
ja 0x646ab5
jmp 0x646b08
cmp ebp, dword [esp + 0x70]
mov cl, 0xe
mov ebx, 0xe
ja 0x646ab5
jmp 0x646b08
cmp ebp, dword [esp + 0x70]
jbe 0x646b08
mov ecx, 3
sub ecx, ebp
xor ecx, ebp
je 0x646b08
mov ecx, 0xe6
xor cl, 0x84
movzx ebx, cl
and ebx, 0x13
add ebx, 0xb
movzx edx, dl
cmp edx, 0x34
je 0x646aee
cmp edx, 0x5b
jne 0x646af3
movzx edx, byte [ebp - 1]
cmp edx, 0x20
jne 0x646b08
xor ebx, 0xa1
add bl, 0xaf
lea eax, [ebp - 1]
mov esi, edx
and esi, 1
xor esi, edx
not esi
test esi, esi
mov dl, bl
jne 0x646a6c
jmp 0x646b08
xor bl, 0x39
jmp 0x646af6
add bl, 0x2f
lea eax, [ebp - 1]
movzx edx, byte [ebp - 1]
cmp edx, 0x20
mov dl, bl
je 0x646a6c
mov byte [ebp], 0
mov esi, dword [esp + 0x70]
mov dword [esp], esi
call fcn.007c3e70
mov ebx, eax
lea esi, [ebx + esi + 1]
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.007cbb60
mov dword [esp], esi
call fcn.007c3e70
mov ecx, dword [esp + 0x44]
movzx ecx, cl
movzx edx, byte [esp + 0x57]
cmp ecx, edx
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0xdc]
mov dword [edx + 4], ecx
setne cl
movzx ecx, cl
or ecx, 0x1000
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0xd8]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x58]
add ebx, ecx
lea eax, [eax + ebx + 0x17]
lea ecx, [ecx + 0x15]
mov dword [edx], eax
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x98]
add dword [ecx], eax
mov edx, dword [esp + 0x40]
mov esi, edx
movzx eax, byte [esp + 0x9f]
cmp eax, 0x26
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], esi
call fcn.004936c0
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, esi
jmp 0x646b86
mov edx, esi
jmp 0x646b86
mov edx, esi
jmp 0x646b86