Function at 0x4471a0
Capabilities:
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1f30
call fcn.004584e0
push ebx
push ebp
push esi
push edi
call fcn.00447170
test eax, eax
je 0x4477d4
mov ebx, dword [esp + 0x1f48]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x184]
push str..Scsi_d:
push eax
call fcn.00458446
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x4473b5
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x284]
push 8
rep stosd dword es:[edi], eax
lea edx, [esp + 0x28c]
push str.SCSIDISK
stosb byte es:[edi], al
push edx
mov dword [esp + 0x290], 0x1c
mov dword [esp + 0x29c], 0x2710
mov dword [esp + 0x2a8], 0x211
mov dword [esp + 0x2a0], 0x1b0501
call fcn.00458ab0
mov eax, ebx
add esp, 0xc
and eax, reloc.t40shapi.dll_Ordinal_1
mov byte [esp + 0x2aa], 0xec
jns 0x447273
dec eax
or eax, 0xfffffffe
inc eax
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28c]
mov byte [esp + 0x2b4], al
push 0x22d
push edx
lea eax, [esp + 0x294]
push 0x3c
push eax
push 0x4d008
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4473ae
mov al, byte [esp + 0x2e6]
test al, al
je 0x4473ae
push 0x400
call fcn.0047330d
mov ebx, eax
add esp, 4
mov ecx, ebx
lea eax, [esp + 0x2b0]
mov edx, 0x100
xor edi, edi
add ecx, 4
mov di, word [eax]
add eax, 2
mov dword [ecx - 4], edi
dec edx
jne 0x4472d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov edx, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.00473336
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.00458446
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x447576
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push ecx
push 0x18
push edx
push eax
push eax
push 0x74080
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov al, byte [esp + 0x27]
test al, al
jbe 0x44756f
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
lea edx, [esp + 0x50]
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x14], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x84
xor eax, eax
mov edi, 0x4c3b80
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push 0x4c3b80
push edx
push esi
call fcn.00447110
add esp, 0x18
test eax, eax
je 0x44756f
push 0x400
call fcn.0047330d
mov ebx, eax
add esp, 4
mov ecx, ebx
mov eax, 0x4c3b90
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x4c3d90
jl 0x447495
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.00473336
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.00458446
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4477be
mov ecx, 0x43
xor eax, eax
lea edi, [esp + 0x74]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 0xc0
push 0
mov dword [esp + 0x84], eax
mov byte [esp + 0x98], al
push edx
lea eax, [esp + 0x7c]
mov ecx, 0x2c
push 0x10c
push eax
mov word [esp + 0x84], cx
mov dword [esp + 0x9c], ecx
push ecx
lea ecx, [esp + 0x88]
mov byte [esp + 0x8e], 6
push ecx
push 0x4d004
push ebx
mov byte [esp + 0x9b], 0x18
mov byte [esp + 0x9c], 1
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 0x4c
mov byte [esp + 0xb0], 0x12
mov byte [esp + 0xb1], 1
mov byte [esp + 0xb2], 0x80
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4477be
cmp byte [esp + 0xc1], 0x80
jne 0x4477be
lea ecx, [esp + 0x284]
lea eax, [esp + 0xc1]
mov esi, 0x60
xor edx, edx
add ecx, 4
mov dh, byte [eax - 1]
mov dl, byte [eax]
add eax, 2
mov dword [ecx - 4], edx
dec esi
jne 0x447679
push 0x14
lea eax, [esp + 0x288]
push 2
push eax
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x1f4c]
lea eax, [esp + 0x14]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea ecx, [esp + 0x734]
push esi
push eax
push 0x800
push ecx
push esi
push esi
push 0x4100c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x447799
mov eax, dword [esp + 0x73c]
cmp eax, esi
je 0x447799
lea eax, [esp + eax + 0x748]
lea ecx, [esp + 0x4b4]
mov esi, 0xf
xor edx, edx
add ecx, 4
mov dh, byte [eax]
inc eax
mov dword [ecx - 4], edx
mov edi, dword [ecx - 4]
xor edx, edx
mov dl, byte [eax]
or edi, edx
inc eax
mov dword [ecx - 4], edi
dec esi
jne 0x447713
push 0xa
lea eax, [esp + 0x4b8]
push 0
push eax
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf
mov eax, ecx
mov esi, edi
mov edi, edx
push 0xb
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c8]
push ecx
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x64], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x6c], esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1f30
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
lea ecx, [esp + 0x180]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x630]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x284]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x630]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x17f], 0x5c
je 0x447897
mov edi, str.IOSUBSYSSMARTVSD.VXD
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SMARTVSD.VXD
jmp 0x4478cd
mov edi, 0x4bab90
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bab80
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x630]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00446fe0
add esp, 4
test eax, eax
jne 0x44791d
lea ecx, [esp + 0x630]
push eax
lea edx, [esp + 0x288]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0
push 1
push 0
push 0
push 0
push str..SMARTVSD
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x447a70
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push 0x18
push ecx
push 0
push 0
push 0x74080
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x447a70
mov al, byte [esp + 0x27]
xor bl, bl
mov byte [esp + 0x14], bl
mov dl, al
mov cl, bl
shr dl, cl
test dl, 1
je 0x447a5a
mov esi, dword [esp + 0x14]
test dl, 0x10
jne 0x4479f1
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
stosb byte es:[edi], al
mov dword [esp + 0x48], edx
lea eax, [esp + 0x18]
mov byte [esp + 0x4c], dl
push eax
push esi
lea edx, [esp + 0x58]
push ecx
push edx
push ebp
call fcn.004470b0
add esp, 0x14
test eax, eax
je 0x4479ed
mov ecx, esi
mov al, 1
and ecx, 0xff
shl al, cl
or byte [esp + 0x13], al
mov al, byte [esp + 0x27]
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x20], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [esp + 0x20]
mov ecx, 0x84
xor eax, eax
mov edi, 0x4c3b80
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x50]
push ecx
push esi
push edx
push 0x4c3b80
push eax
push ebp
call fcn.00447110
add esp, 0x18
test eax, eax
je 0x447a56
mov eax, dword [esp + 0x1f48]
and esi, 0xff
cmp esi, eax
je 0x447c70
mov al, byte [esp + 0x27]
inc bl
cmp bl, 4
mov byte [esp + 0x14], bl
jb 0x447984
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 0x403
xor eax, eax
lea edi, [esp + 0xf34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x52c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x52c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.DiskSerial.VXD
cmp byte [esp + ecx + 0x73], 0x5c
jne 0x447af8
mov edi, 0x4bab50
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x8000000
mov ecx, ebx
push 2
push eax
and ecx, 3
push 3
lea eax, [esp + 0x540]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4477c5
mov edi, dword [esp + 0x1f44]
push str.DISKSERIAL
push str.DiskSerial
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x20]
push 0
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push str..DiskSerial.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x52c]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x4477c5
lea eax, [esp + 0x1c]
push 0
push eax
lea ecx, [esp + 0xf3c]
push 4
push ecx
push 0
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call edi
xor esi, esi
mov al, byte [esp + esi + 0xf38]
test al, al
je 0x447c5b
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov cl, byte [esp + eax + 0xf34]
test cl, cl
je 0x447c5b
push 0x400
call fcn.0047330d
mov edi, dword [esp + 0x1f4c]
add esp, 4
mov edx, edi
mov ebp, eax
shl edx, 9
mov ecx, ebp
lea eax, [esp + edx + 0xf40]
mov edx, 0x100
xor ebx, ebx
add ecx, 4
mov bx, word [eax]
add eax, 2
mov dword [ecx - 4], ebx
dec edx
jne 0x447c35
test ebp, ebp
je 0x447c52
cmp esi, edi
je 0x447d67
push ebp
call fcn.00473336
add esp, 4
inc esi
cmp esi, 8
jl 0x447bef
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
push 0x400
call fcn.0047330d
mov ebp, eax
add esp, 4
mov ecx, ebp
mov eax, 0x4c3b90
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x4c3d90
jl 0x447c86
push 0x13
push 0xa
push ebp
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
push edx
mov dword [ebx + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.00473336
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push 0x13
push 0xa
push ebp
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00447030
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebx + 0x6c], ecx
call fcn.00473336
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc