Function at 0x49eb80
Capabilities:
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1f30
call fcn.004c3a30
push ebx
push ebp
push esi
push edi
call fcn.0049eb50
test eax, eax
je 0x49f1b4
mov ebx, dword [esp + 0x1f48]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x184]
push str..Scsi_d:
push eax
call fcn.004c4ccf
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x49ed95
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x284]
push 8
rep stosd dword es:[edi], eax
lea edx, [esp + 0x28c]
push str.SCSIDISK
stosb byte es:[edi], al
push edx
mov dword [esp + 0x290], 0x1c
mov dword [esp + 0x29c], 0x2710
mov dword [esp + 0x2a8], 0x211
mov dword [esp + 0x2a0], 0x1b0501
call fcn.004c3b50
mov eax, ebx
add esp, 0xc
and eax, reloc.WS2_32.dll_accept
mov byte [esp + 0x2aa], 0xec
jns 0x49ec53
dec eax
or eax, 0xfffffffe
inc eax
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28c]
mov byte [esp + 0x2b4], al
push 0x22d
push edx
lea eax, [esp + 0x294]
push 0x3c
push eax
push 0x4d008
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49ed8e
mov al, byte [esp + 0x2e6]
test al, al
je 0x49ed8e
push 0x400
call fcn.004d42a3
mov ebx, eax
add esp, 4
mov ecx, ebx
lea eax, [esp + 0x2b0]
mov edx, 0x100
xor edi, edi
add ecx, 4
mov di, word [eax]
add eax, 2
mov dword [ecx - 4], edi
dec edx
jne 0x49ecb8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov edx, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.004d42cc
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.004c4ccf
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x49ef56
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push ecx
push 0x18
push edx
push eax
push eax
push 0x74080
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov al, byte [esp + 0x27]
test al, al
jbe 0x49ef4f
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
lea edx, [esp + 0x50]
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x14], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x84
xor eax, eax
mov edi, 0x61d928
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push 0x61d928
push edx
push esi
call fcn.0049eaf0
add esp, 0x18
test eax, eax
je 0x49ef4f
push 0x400
call fcn.004d42a3
mov ebx, eax
add esp, 4
mov ecx, ebx
mov eax, 0x61d938
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x61db38
jl 0x49ee75
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.004d42cc
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.004c4ccf
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x49f19e
mov ecx, 0x43
xor eax, eax
lea edi, [esp + 0x74]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 0xc0
push 0
mov dword [esp + 0x84], eax
mov byte [esp + 0x98], al
push edx
lea eax, [esp + 0x7c]
mov ecx, 0x2c
push 0x10c
push eax
mov word [esp + 0x84], cx
mov dword [esp + 0x9c], ecx
push ecx
lea ecx, [esp + 0x88]
mov byte [esp + 0x8e], 6
push ecx
push 0x4d004
push ebx
mov byte [esp + 0x9b], 0x18
mov byte [esp + 0x9c], 1
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 0x4c
mov byte [esp + 0xb0], 0x12
mov byte [esp + 0xb1], 1
mov byte [esp + 0xb2], 0x80
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49f19e
cmp byte [esp + 0xc1], 0x80
jne 0x49f19e
lea ecx, [esp + 0x284]
lea eax, [esp + 0xc1]
mov esi, 0x60
xor edx, edx
add ecx, 4
mov dh, byte [eax - 1]
mov dl, byte [eax]
add eax, 2
mov dword [ecx - 4], edx
dec esi
jne 0x49f059
push 0x14
lea eax, [esp + 0x288]
push 2
push eax
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x1f4c]
lea eax, [esp + 0x14]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea ecx, [esp + 0x734]
push esi
push eax
push 0x800
push ecx
push esi
push esi
push 0x4100c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49f179
mov eax, dword [esp + 0x73c]
cmp eax, esi
je 0x49f179
lea eax, [esp + eax + 0x748]
lea ecx, [esp + 0x4b4]
mov esi, 0xf
xor edx, edx
add ecx, 4
mov dh, byte [eax]
inc eax
mov dword [ecx - 4], edx
mov edi, dword [ecx - 4]
xor edx, edx
mov dl, byte [eax]
or edi, edx
inc eax
mov dword [ecx - 4], edi
dec esi
jne 0x49f0f3
push 0xa
lea eax, [esp + 0x4b8]
push 0
push eax
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf
mov eax, ecx
mov esi, edi
mov edi, edx
push 0xb
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c8]
push ecx
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x64], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x6c], esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1f30
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
lea ecx, [esp + 0x180]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x630]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x284]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x630]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x17f], 0x5c
je 0x49f277
mov edi, str.IOSUBSYSSMARTVSD.VXD
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SMARTVSD.VXD
jmp 0x49f2ad
mov edi, 0x5e96c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e96b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x630]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0049e9c0
add esp, 4
test eax, eax
jne 0x49f2fd
lea ecx, [esp + 0x630]
push eax
lea edx, [esp + 0x288]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0
push 1
push 0
push 0
push 0
push str..SMARTVSD
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x49f450
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push 0x18
push ecx
push 0
push 0
push 0x74080
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49f450
mov al, byte [esp + 0x27]
xor bl, bl
mov byte [esp + 0x14], bl
mov dl, al
mov cl, bl
shr dl, cl
test dl, 1
je 0x49f43a
mov esi, dword [esp + 0x14]
test dl, 0x10
jne 0x49f3d1
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
stosb byte es:[edi], al
mov dword [esp + 0x48], edx
lea eax, [esp + 0x18]
mov byte [esp + 0x4c], dl
push eax
push esi
lea edx, [esp + 0x58]
push ecx
push edx
push ebp
call fcn.0049ea90
add esp, 0x14
test eax, eax
je 0x49f3cd
mov ecx, esi
mov al, 1
and ecx, 0xff
shl al, cl
or byte [esp + 0x13], al
mov al, byte [esp + 0x27]
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x20], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [esp + 0x20]
mov ecx, 0x84
xor eax, eax
mov edi, 0x61d928
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x50]
push ecx
push esi
push edx
push 0x61d928
push eax
push ebp
call fcn.0049eaf0
add esp, 0x18
test eax, eax
je 0x49f436
mov eax, dword [esp + 0x1f48]
and esi, 0xff
cmp esi, eax
je 0x49f650
mov al, byte [esp + 0x27]
inc bl
cmp bl, 4
mov byte [esp + 0x14], bl
jb 0x49f364
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 0x403
xor eax, eax
lea edi, [esp + 0xf34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x52c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x52c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.DiskSerial.VXD
cmp byte [esp + ecx + 0x73], 0x5c
jne 0x49f4d8
mov edi, 0x5e9680
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x8000000
mov ecx, ebx
push 2
push eax
and ecx, 3
push 3
lea eax, [esp + 0x540]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x49f1a5
mov edi, dword [esp + 0x1f44]
push str.DISKSERIAL
push str.DiskSerial
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x20]
push 0
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push str..DiskSerial.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x52c]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x49f1a5
lea eax, [esp + 0x1c]
push 0
push eax
lea ecx, [esp + 0xf3c]
push 4
push ecx
push 0
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call edi
xor esi, esi
mov al, byte [esp + esi + 0xf38]
test al, al
je 0x49f63b
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov cl, byte [esp + eax + 0xf34]
test cl, cl
je 0x49f63b
push 0x400
call fcn.004d42a3
mov edi, dword [esp + 0x1f4c]
add esp, 4
mov edx, edi
mov ebp, eax
shl edx, 9
mov ecx, ebp
lea eax, [esp + edx + 0xf40]
mov edx, 0x100
xor ebx, ebx
add ecx, 4
mov bx, word [eax]
add eax, 2
mov dword [ecx - 4], ebx
dec edx
jne 0x49f615
test ebp, ebp
je 0x49f632
cmp esi, edi
je 0x49f747
push ebp
call fcn.004d42cc
add esp, 4
inc esi
cmp esi, 8
jl 0x49f5cf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
push 0x400
call fcn.004d42a3
mov ebp, eax
add esp, 4
mov ecx, ebp
mov eax, 0x61d938
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x61db38
jl 0x49f666
push 0x13
push 0xa
push ebp
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
push edx
mov dword [ebx + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.004d42cc
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push 0x13
push 0xa
push ebp
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049ea10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebx + 0x6c], ecx
call fcn.004d42cc
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc