Function at 0x418d15
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102e0
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push 0x50
lea eax, [ebp - 0x102dc]
push ebx
push eax
mov dword [ebp - 0x10258], edi
mov dword [ebp - 0x1023c], ebx
mov dword [ebp - 0x10230], ebx
mov dword [ebp - 0x1022c], ebx
mov dword [ebp - 0x10270], ebx
mov dword [ebp - 0x1026c], ebx
mov dword [ebp - 0x10254], ebx
mov dword [ebp - 0x10250], ebx
mov dword [ebp - 0x102e0], ebx
call fcn.00450230
add esp, 0xc
push 1
lea eax, [ebp - 0x102e0]
push eax
push ebx
push edi
mov dword [ebp - 0x10238], ebx
call fcn.0041fd96
push eax
call fcn.00421a88
test eax, eax
jne 0x419863
cmp dword [ebp - 0x102e0], ebx
jbe 0x419863
mov eax, dword [ebp - 0x102dc]
cmp byte [eax + 0xaf], 0x44
push ebx
jne 0x418dec
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push edi
push str._s_is_a_differential_image.__nHash_file_creation_not_possible_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x577
push str.HashFileUtils
call fcn.0044dc85
xor eax, eax
add esp, 0x14
inc eax
jmp 0x419885
push 1
push 0x40000000
push esi
push edi
call fcn.00418796
test eax, eax
js 0x419882
push ebx
push edi
call fcn.0041fd96
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x418e11
call fcn.004234aa
push ebx
push ebx
push 3
push ebx
push 1
push Ordinal_2
push ebx
push edi
call fcn.0041fd96
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [0x4cce9c], eax
cmp eax, 0xffffffff
jne 0x418e5b
push edi
push 0x46cf34
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x589
jmp 0x419875
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call fcn.0043deb7
push ebx
push ebx
push ebx
push dword [0x4cce9c]
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x10244], ebx
call fcn.0044df99
call fcn.0043dd77
push ebx
push 0x3e8
push ebx
push 0x3f3
call fcn.0044803f
mov dword [ebp - 0x1025c], 0x64
rdtsc
mov dword [ebp - 0x10248], edx
mov dword [ebp - 0x1024c], eax
cmp dword [0x4d659c], ebx
jne 0x419882
mov eax, dword [0x4d4668]
mov dword [ebp - 0x10264], eax
mov eax, dword [0x4d466c]
mov dword [ebp - 0x10260], eax
lea eax, [ebp - 0x10218]
push eax
push 0xc
lea eax, [ebp - 0x10214]
push eax
or edi, 0xffffffff
push edi
push edi
push dword [0x4cce9c]
call fcn.0043deb7
test eax, eax
je 0x4196f5
mov eax, dword [ebp - 0x10214]
cmp eax, 0x30484e53
je 0x419882
cmp eax, 0x5f444e45
je 0x41970b
cmp eax, 0x45544e53
jne 0x418f32
lea eax, [ebp - 0x10214]
push eax
push dword [0x4cce9c]
call fcn.0043e4ba
jmp 0x418ea0
cmp eax, 0x49524453
je 0x418f1b
cmp eax, 0x30564e53
jne 0x418f7f
lea eax, [ebp - 0x1021c]
push eax
lea eax, [ebp - 0x10214]
push eax
push dword [0x4cce9c]
call fcn.0043e520
mov eax, dword [ebp - 0x1021c]
mov eax, dword [eax + 0x5f]
shr eax, 4
cmp eax, 1
jae 0x418f6d
xor eax, eax
inc eax
push ebx
push eax
push ebx
push 0x3f3
call fcn.0044803f
jmp 0x418ea0
cmp eax, 0x5458454e
jne 0x4190e9
push dword [0x4cce9c]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
inc dword [ebp - 0x1023c]
push dword [ebp - 0x1023c]
push dword [ebp - 0x10258]
call fcn.0041fd96
lea esi, [ebp - 0x108]
sub esi, eax
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
cmp cl, bl
jne 0x418fb5
mov esi, 0x469ec0
push ebx
push ebx
push 3
push ebx
push 1
push Ordinal_2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [0x4cce9c], eax
cmp eax, edi
jne 0x418ffa
lea eax, [ebp - 0x108]
push eax
push 0x46cf20
call fcn.0042f614
pop ecx
jmp 0x419047
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call fcn.0043deb7
lea eax, [ebp - 0x10218]
push eax
push 0xc
lea eax, [ebp - 0x10214]
push eax
push edi
push edi
push dword [0x4cce9c]
call fcn.0043deb7
test eax, eax
jne 0x41902d
push 0x46cef8
jmp 0x419042
cmp dword [ebp - 0x10214], 0x4f434e53
je 0x4190cb
push 0x46ced4
call fcn.0042f614
pop ecx
cmp eax, ebx
je 0x4190cb
push dword [ebp - 0x1023c]
push dword [ebp - 0x10258]
call fcn.0041fd96
push 0x2e
push eax
call fcn.00452730
mov edi, eax
push edi
push 0x46ced0
call fcn.0042f614
add esp, 0x10
push eax
push edi
push ebx
push esi
push 0x46ceb4
call fcn.0042f614
add esp, 0x10
push eax
push dword [ebp - 0x1023c]
push dword [ebp - 0x10258]
call fcn.0041fd96
push eax
push esi
push 0x46cea4
call fcn.0042f614
add esp, 0xc
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push dword [0x4d617c]
call fcn.00449908
test eax, eax
je 0x419882
or edi, 0xffffffff
jmp 0x418fc4
lea eax, [ebp - 0x108]
push eax
push 0x46ce94
push 0x3f6
call fcn.00447f71
add esp, 0xc
jmp 0x418f1b
cmp eax, 0x304f4e53
je 0x418f1b
cmp eax, 0x4f434e53
je 0x418f1b
cmp eax, 0x52434e53
jne 0x41914d
lea eax, [ebp - 0x10234]
push eax
lea eax, [ebp - 0x10214]
push eax
push dword [0x4cce9c]
call fcn.0043e520
push dword [ebp - 0x10234]
mov ecx, 0x4a301c
call fcn.0040d465
test eax, eax
je 0x419814
push dword [ebp - 0x10210]
push dword [ebp - 0x10234]
call fcn.004176f1
jmp 0x418ea0
cmp eax, 0x30444e53
je 0x419168
push eax
push 0x46ce74
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x62a
jmp 0x41918b
cmp dword [ebp - 0x10210], 0x10028
jbe 0x41919d
push dword [ebp - 0x10210]
push 0x46ce4c
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x630
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x14
jmp 0x419500
lea eax, [ebp - 0x10218]
push eax
push dword [ebp - 0x10210]
mov esi, 0x4bce28
push esi
push edi
push edi
push dword [0x4cce9c]
call fcn.0043deb7
test eax, eax
jne 0x4191d7
push 0x46ce34
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x637
jmp 0x4194f3
mov eax, dword [0x4bce34]
lea ecx, [eax + 0x14]
cmp dword [ebp - 0x10218], ecx
jne 0x419834
push 1
push 8
lea eax, [ebp - 0x10214]
push eax
call fcn.0040b3a7
push eax
push dword [ebp - 0x10210]
push esi
call fcn.0040b3a7
mov esi, eax
cmp esi, dword [ebp - 0x1020c]
je 0x41937b
lea eax, [ebp - 0x1021d]
push eax
lea eax, [ebp - 0x1021e]
push eax
lea eax, [ebp - 0x1028c]
push eax
push dword [ebp - 0x1020c]
lea eax, [ebp - 0x10214]
push dword [0x4bce34]
push 0x4bce3c
push 0x14
push 0x4bce28
push 8
push eax
call fcn.0040cfc5
dec eax
je 0x419290
push dword [ebp - 0x1020c]
push esi
push dword [0x4bce34]
push dword [ebp - 0x10260]
push dword [ebp - 0x10264]
push 0x46cdd8
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x675
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x24
jmp 0x419500
add dword [ebp - 0x10270], 1
movzx eax, byte [ebp - 0x1021d]
adc dword [ebp - 0x1026c], ebx
mov esi, dword [ebp - 0x1028c]
xor edi, edi
add esi, dword [ebp - 0x10264]
push eax
adc edi, dword [ebp - 0x10260]
movzx eax, byte [ebp - 0x1021e]
add esi, 4
push eax
adc edi, ebx
push edi
push esi
push 0x46cda0
call fcn.00450f5c
movzx eax, byte [ebp - 0x1021d]
push eax
movzx eax, byte [ebp - 0x1021e]
push eax
push edi
push esi
push 0x46cd28
call fcn.0042f614
add esp, 0x28
mov esi, eax
cmp dword [0x4cddcc], ebx
je 0x419341
push ebx
push 0x31
push 0x469ec0
push 0x46cd14
call fcn.0042f614
pop ecx
pop ecx
push eax
push 0x46ccf0
push esi
push 0x46aaa0
call fcn.0042f614
add esp, 0xc
push eax
push 1
push dword [0x4d617c]
call fcn.0041ee88
cmp eax, 1
je 0x41937b
cmp eax, 2
je 0x419882
jmp 0x41937b
push esi
mov edi, 0x46ccec
push edi
call fcn.00450f5c
call fcn.004552b3
add eax, 0x20
push eax
call fcn.00450a39
push eax
call fcn.0045525d
add esp, 0x10
test eax, eax
jne 0x41937b
push esi
push edi
call fcn.004552b3
add eax, 0x40
push eax
call fcn.00455151
add esp, 0xc
cmp dword [0x4a3020], ebx
je 0x4193ca
test byte [0x4bce38], 0x10
je 0x4193ca
rdtsc
push dword [0x4bce28]
mov esi, 0x4bce3c
push dword [0x4bce34]
mov ecx, 0x4a301c
push esi
mov dword [ebp - 0x10274], edx
mov dword [ebp - 0x10278], eax
call fcn.0040d3e2
lea eax, [ebp - 0x10278]
push eax
call fcn.0041dfd7
add dword [0x4cce84], eax
jmp 0x4193cf
mov esi, 0x4bce3c
test byte [0x4bce38], 4
mov dword [ebp - 0x10228], ebx
je 0x4193ef
push 0x4bce34
push esi
call fcn.0043e636
mov dword [ebp - 0x10228], eax
mov edi, dword [0x4bce34]
lea eax, [ebp - 0x1024c]
push eax
mov dword [ebp - 0x10240], esi
call fcn.0041dfd7
add dword [0x4cce74], eax
mov eax, dword [ebp - 0x10218]
add dword [ebp - 0x10230], eax
adc dword [ebp - 0x1022c], ebx
test byte [0x4bce38], 2
je 0x41945f
rdtsc
mov dword [ebp - 0x10288], eax
push esi
lea eax, [ebp - 0x10208]
push eax
mov dword [ebp - 0x10284], edx
call fcn.0041a030
mov edi, eax
lea eax, [ebp - 0x10288]
push eax
lea esi, [ebp - 0x10208]
call fcn.0041dfd7
add dword [0x4bcb84], eax
jmp 0x419465
mov esi, dword [ebp - 0x10240]
test byte [0x4bce38], 1
je 0x41949d
rdtsc
push edi
push esi
mov esi, 0x4ac38c
push esi
mov dword [ebp - 0x1027c], edx
mov dword [ebp - 0x10280], eax
call fcn.0044283b
mov edi, eax
lea eax, [ebp - 0x10280]
push eax
call fcn.0041dfd7
add dword [0x4cce94], eax
mov eax, dword [0x4bce30]
cmp edi, eax
je 0x4194c8
push eax
push edi
push 0x46ccc0
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x6af
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x18
jmp 0x419500
test byte [0x4bce38], 4
je 0x419524
push 1
push edi
push esi
call fcn.0040b3a7
cmp eax, dword [ebp - 0x10228]
je 0x419524
push str.verifikation_of_data_failed
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x6b7
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
push dword [ebp - 0x10260]
push dword [ebp - 0x10264]
push dword [ebp - 0x10258]
push 0x46cc6c
call fcn.00450f5c
add esp, 0x10
jmp 0x418ea0
movzx eax, word [0x4a3fa8]
inc dword [ebp - 0x10244]
add dword [ebp - 0x1025c], 0x64
shl eax, 4
push eax
lea eax, [ebp - 0x208]
push 0xc3
push eax
call fcn.00450230
mov dword [ebp - 0x10268], edi
mov dword [ebp - 0x10240], esi
add esp, 0xc
mov dword [ebp - 0x10228], ebx
lea edi, [ebp - 0x208]
mov esi, 0x1000
mov eax, dword [ebp - 0x10268]
cmp eax, ebx
jle 0x4195a8
cmp eax, esi
jl 0x41957d
mov eax, esi
push edi
push eax
push dword [ebp - 0x10240]
call fcn.0041dc38
sub dword [ebp - 0x10268], esi
inc dword [ebp - 0x10228]
add dword [ebp - 0x10240], esi
add edi, 0x10
cmp dword [ebp - 0x10228], 0x10
jb 0x41956d
push 0x10
lea eax, [ebp - 0x208]
push eax
push dword [0x4bce2c]
push dword [0x4bce28]
call fcn.00416fc2
cdq
add dword [ebp - 0x10254], eax
push 0x3e8
lea eax, [ebp - 0x10224]
adc dword [ebp - 0x10250], edx
push eax
call fcn.004430f8
test eax, eax
je 0x418ea0
mov eax, dword [ebp - 0x1021c]
xor edi, edi
inc edi
cmp eax, ebx
je 0x41962f
mov ecx, dword [eax + 0x5f]
mov esi, ecx
cmp ecx, edi
ja 0x419600
mov esi, edi
mov eax, dword [ebp - 0x1025c]
xor edx, edx
div esi
push 0x64
pop edx
cmp eax, edx
jbe 0x419619
mov dword [ebp - 0x10238], edx
jmp 0x41962f
cmp ecx, edi
ja 0x41961f
mov ecx, edi
mov eax, dword [ebp - 0x1025c]
xor edx, edx
div ecx
mov dword [ebp - 0x10238], eax
push dword [ebp - 0x10238]
push 0xc
push dword [ebp - 0x1022c]
push dword [ebp - 0x10230]
call fcn.0040c6f5
push eax
push str.generating_hash_total__s____d___done_r
call fcn.00450f5c
add esp, 0xc
push dword [ebp - 0x10238]
push 0xc
push dword [ebp - 0x10250]
push dword [ebp - 0x10254]
call fcn.0040c6f5
push eax
push 0xc
push dword [ebp - 0x1022c]
push dword [ebp - 0x10230]
call fcn.0040c6f5
push eax
push str.read__s___written__s____d___done
push 0x516
call fcn.00447f71
mov eax, dword [ebp - 0x1021c]
add esp, 0x14
cmp eax, ebx
je 0x4196e1
mov eax, dword [eax + 0x5f]
cmp eax, 0x100
jbe 0x4196c8
shr eax, 4
mov ecx, edi
cmp eax, edi
jb 0x4196b5
mov ecx, eax
mov eax, dword [ebp - 0x10244]
shr eax, 4
cmp eax, edi
jae 0x4196c4
mov eax, edi
push ebx
push ecx
jmp 0x4196d6
shl eax, 6
push ebx
push eax
mov eax, dword [ebp - 0x10244]
shl eax, 6
push eax
push 0x3f3
call fcn.0044803f
call fcn.004552b3
add eax, 0x20
push eax
call fcn.004550f5
pop ecx
jmp 0x418ea0
push 0x46ce34
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x5af
jmp 0x419825
push 0x46a57c
call fcn.00450f5c
mov eax, dword [ebp - 0x1021c]
pop ecx
cmp eax, ebx
je 0x419798
mov ecx, dword [eax + 0x5f]
xor ebx, ebx
inc ebx
cmp ecx, ebx
jbe 0x41972c
mov ebx, ecx
mov edi, dword [ebp - 0x10244]
lea esi, [edi + 1]
imul esi, esi, 0x64
xor edx, edx
mov eax, esi
div ebx
xor ebx, ebx
inc ebx
cmp eax, 0x64
jbe 0x41974b
push 0x64
pop esi
jmp 0x419767
mov dword [ebp - 0x10234], ecx
cmp ecx, ebx
ja 0x41975b
mov dword [ebp - 0x10234], ebx
mov eax, esi
xor edx, edx
div dword [ebp - 0x10234]
mov esi, eax
cmp ecx, 0x100
jbe 0x419790
shr ecx, 4
cmp ecx, ebx
jae 0x419778
mov ecx, ebx
shr edi, 4
cmp edi, ebx
jae 0x419781
mov edi, ebx
push ebx
push ecx
push edi
push 0x3f3
call fcn.0044803f
jmp 0x41979e
shl ecx, 6
shl edi, 6
jmp 0x419781
mov esi, dword [ebp - 0x10238]
push esi
push 0xc
push dword [ebp - 0x10250]
push dword [ebp - 0x10254]
call fcn.0040c6f5
push eax
push 0xc
push dword [ebp - 0x1022c]
push dword [ebp - 0x10230]
call fcn.0040c6f5
push eax
push str.read__s___written__s____d___done
push 0x516
call fcn.00447f71
add esp, 0x14
push esi
push 0xc
push dword [ebp - 0x1022c]
push dword [ebp - 0x10230]
call fcn.0040c6f5
push eax
lea eax, [ebp - 0x108]
push eax
push str.generating_hash_for__s:_total__s____d___done_r
call fcn.004552b3
add eax, 0x40
push eax
call fcn.00455151
add esp, 0x14
call fcn.00417370
xor eax, eax
jmp 0x419885
push 0x46cba8
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x61d
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x10
jmp 0x419882
push 0x14
push eax
push dword [ebp - 0x10218]
push dword [ebp - 0x10210]
push str._nillegal_header_size_recsize_x__rd__x____x_x_a_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x63d
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x20
jmp 0x419882
push edi
push str._s_is_not_a_valid_volume_image
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x570
push str.HashFileUtils
call fcn.0044dc85
add esp, 0x14
push 0x14
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 8