Function at 0x4648bb
Capabilities:
Check for time delay via gettickcount
Encode data using base64
Get disk information
Inspect section memory permissions
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3c4
push ebx
push esi
lea eax, [ebp + 0x78]
push edi
push eax
mov dword [ebp - 0xb4], ecx
call fcn.0043e611
pop ecx
push 5
lea ecx, [ebp + 0x1c]
call fcn.00444e50
push 0x14
lea ecx, [ebp - 0x1d4]
call fcn.00444e50
lea ecx, [ebp - 0xbc]
call fcn.00444e32
lea ecx, [ebp - 0xc8]
call fcn.00444e32
lea ecx, [ebp - 0xd4]
call fcn.00444e32
mov eax, dword [ebp + 0x78]
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 0x2c], eax
push 0x2c
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp + 0x30], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0x18], 0xfffc0000
mov dword [ebp + 0x60], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x60], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
mov byte [ebp - 0x59], bl
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x8b], bl
mov byte [ebp - 0x8c], bl
mov byte [ebp + 0x57], bl
mov byte [ebp + 0x54], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x8a], bl
mov byte [ebp + 0xb], bl
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x114], 0x1f4
call fcn.00447c46
mov eax, dword [ebp - 0xc8]
mov word [eax], bx
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x464a0d
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x2c], eax
push 0x2c
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00447c46
add esp, 0xc
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
mov byte [ebp + 0x11], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp - 0x91], 0xff
mov byte [ebp + 0x10], 0
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x89], 0
mov byte [ebp + 0x23], 0
mov byte [ebp + 0x6a], 0
mov byte [ebp + 0x47], 0
mov byte [ebp + 0x69], 0
mov byte [ebp + 0x6b], 0
mov byte [ebp + 0x55], 0
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x21], 0xff
mov byte [ebp - 9], 0xff
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x22], 0
mov dword [ebp - 0x68], 0xfffff000
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0xb8], esi
je 0x465491
push 6
lea eax, [ebp + 0x78]
push eax
push str._admin
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464abb
or byte [ebp + 0x11], 1
jmp 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push str._super
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464adb
or byte [ebp + 0x11], 2
jmp 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push str._devid
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464afb
or byte [ebp - 0x6a], 1
jmp 0x46540d
push 7
lea eax, [ebp + 0x78]
push eax
push str._devidx
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464b1b
or byte [ebp - 0x6a], 2
jmp 0x46540d
push 4
lea eax, [ebp + 0x78]
push eax
push str._gui
call fcn.00446de5
add esp, 0xc
test al, al
jne 0x46543f
push 4
lea eax, [ebp + 0x78]
push eax
push str._usb
call fcn.00446de5
add esp, 0xc
test al, al
jne 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push str._hextp
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464b71
or dword [ebp - 8], 1
jmp 0x46540d
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._phy
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464b93
or dword [ebp - 8], 2
jmp 0x46540d
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4ca854
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464bb3
or dword [ebp - 8], 0x10
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._drv
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464bd2
or dword [ebp - 8], 8
jmp 0x46540d
push 5
lea eax, [ebp + 0x78]
push eax
push str._fill
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464bf1
or dword [ebp - 8], edi
jmp 0x46540d
push 5
lea eax, [ebp + 0x78]
push eax
push str._dvol
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464c11
or byte [ebp - 7], 1
jmp 0x46540d
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca838
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464c31
mov byte [ebp + 0x47], 1
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._xup
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464c50
mov byte [ebp + 0x69], 1
jmp 0x46540d
push 5
lea eax, [ebp + 0x78]
push eax
push str._axup
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464c70
mov byte [ebp + 0x69], 0x21
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._hup
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464c8f
mov byte [ebp + 0x6b], 1
jmp 0x46540d
push 5
lea eax, [ebp + 0x78]
push eax
push str._ahup
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464caf
mov byte [ebp + 0x6b], 0x21
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpt
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464cce
mov byte [ebp + 0x55], 1
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._gptmini
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464ced
mov byte [ebp + 0x55], 2
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpth
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464d0c
mov byte [ebp + 0x55], 4
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._mbr
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464d2e
mov byte [ebp - 0x8c], 1
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._cmp
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464d4d
mov byte [ebp - 0x5b], 1
jmp 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c5b7c
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464d70
mov byte [ebp - 0x8b], 1
jmp 0x46540d
push 5
lea eax, [ebp + 0x78]
push eax
push str._fs0:
call fcn.00446ed8
add esp, 0xc
test al, al
je 0x464da2
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0xb], 0x10
call fcn.00441162
pop ecx
pop ecx
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._fs0
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464dc1
mov byte [ebp + 0xb], 0x10
jmp 0x46540d
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca7e0
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464de4
mov byte [ebp - 0x8a], 1
jmp 0x46540d
push 2
lea eax, [ebp + 0x78]
push eax
push 0x4c9f14
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464e0a
add dword [ebp - 0xa8], 0x100
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4ca7d8
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464e29
mov byte [ebp - 0x41], 1
jmp 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push str._lskip
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464e49
or byte [ebp - 0x40], 0x40
jmp 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push str._locku
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464e69
mov byte [ebp + 0x54], 3
jmp 0x46540d
mov edi, dword [ebp + 0x78]
push 7
push edi
push str._locku:
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x464e88
inc edi
mov byte [ebp + 0x54], 3
inc edi
jmp 0x464ea0
push 6
push edi
push str._lock:
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x464efe
mov byte [ebp + 0x54], 1
add edi, 0xc
xor ecx, ecx
mov dword [ebp + 0x78], edi
mov cx, word [edi]
cmp cx, bx
je 0x464ed9
mov eax, ecx
call fcn.0040f8eb
test al, al
jne 0x464ed9
push ecx
call fcn.004ab8fe
add esp, 4
test al, al
jne 0x464ed9
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x30], edi
call fcn.00405b4a
jmp 0x46502e
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405bc5
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405bc5
add esp, 0x10
jmp 0x46503e
push 5
lea eax, [ebp + 0x78]
push eax
push str._lock
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464f1e
mov byte [ebp + 0x54], 1
jmp 0x46540d
push 6
lea eax, [ebp + 0x78]
push eax
push str._lockx
call fcn.00446de5
add esp, 0xc
test al, al
jne 0x464e60
push 6
lea eax, [ebp + 0x78]
push eax
push str._lock_
call fcn.00446de5
add esp, 0xc
test al, al
je 0x464f5f
mov byte [ebp + 0x54], 0xf0
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
jmp 0x46540d
mov edi, dword [ebp + 0x78]
push 4
push edi
push 0x4ca798
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x464fc1
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x464f92
cmp ax, 0x3d
je 0x464f92
call fcn.0040f8eb
test al, al
je 0x464fc1
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
mov dword [ebp - 0xcc], ebx
je 0x464fad
mov dword [ebp - 0x20], 0x4ca790
jmp 0x46503e
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
jmp 0x465024
push 4
push edi
push str._pbr
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x46504c
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x464ff1
cmp ax, 0x3d
je 0x464ff1
call fcn.0040f8eb
test al, al
je 0x46504c
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
lea eax, [ebp + 0x78]
mov dword [ebp - 0x20], ebx
push eax
je 0x465013
mov dword [ebp - 0xcc], 0x4c1872
call fcn.00405b4a
pop ecx
jmp 0x46503e
add dword [ebp + 0x78], 2
call fcn.0043e611
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405b4a
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x46503e
mov word [eax], bx
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
jmp 0x464d9c
push 9
push edi
push str._alignend
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x4650d3
lea ecx, [edi + 0x12]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x46507c
cmp ax, 0x3d
je 0x46507c
call fcn.0040f8eb
test al, al
je 0x4650d3
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
jne 0x4650c4
xor eax, eax
add ecx, 2
mov ax, word [ecx]
push eax
call fcn.004ab8fe
add esp, 4
test al, al
je 0x4653f2
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0044a751
cmp dword [ebp - 0x78], ebx
pop ecx
pop ecx
jg 0x4653f2
jl 0x4650c4
cmp dword [ebp - 0x7c], ebx
ja 0x4653f2
mov dword [ebp - 0x7c], 0xfffffffe
mov dword [ebp - 0x78], esi
jmp 0x4653f2
push 6
push edi
push str._align
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x465181
lea ecx, [edi + 0xc]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x465107
cmp ax, 0x3d
je 0x465107
call fcn.0040f8eb
test al, al
je 0x465181
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], ecx
mov edi, ecx
call fcn.00405b4a
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
cmp word [edi], 0x3d
pop ecx
pop ecx
je 0x465137
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
jmp 0x46540d
xor eax, eax
lea ecx, [edi + 2]
mov ax, word [ecx]
push eax
call fcn.004ab8fe
add esp, 4
test al, al
je 0x46540d
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0044a751
cmp dword [ebp - 0xac], ebx
pop ecx
pop ecx
jg 0x46540d
jl 0x465126
cmp dword [ebp - 0xb0], ebx
ja 0x46540d
jmp 0x465126
push 6
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._clear
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4651a6
mov byte [ebp - 0x91], 1
jmp 0x46540d
push edi
lea eax, [ebp + 0x78]
push eax
push str._clean
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4651c5
mov byte [ebp - 9], 1
jmp 0x46540d
push 7
lea eax, [ebp + 0x78]
push eax
push str._clean_
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4651e5
mov byte [ebp - 9], 0
jmp 0x46540d
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c43f0
call fcn.00446de5
add esp, 0xc
test al, al
jne 0x465409
push 4
lea eax, [ebp + 0x78]
push eax
push str._del
call fcn.00446de5
add esp, 0xc
test al, al
jne 0x465409
push 4
lea eax, [ebp + 0x78]
push eax
push str._raw
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46523f
or dword [ebp - 8], 0x20
mov byte [ebp - 0x52], 1
jmp 0x46540d
push edi
push dword [ebp + 0x78]
push str._swap:
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x465278
add dword [ebp + 0x78], 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451cdf
test eax, eax
pop ecx
pop ecx
jl 0x4674d3
mov byte [ebp - 0x22], 1
jmp 0x46540d
push 5
push dword [ebp + 0x78]
push str._CHS
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x465317
add dword [ebp + 0x78], 0xa
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x30], edi
call fcn.00405b6e
xor eax, eax
mov ax, word [edi]
push eax
call fcn.004ab8fe
add esp, 0xc
test al, al
je 0x4652d2
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a751
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x3a
jne 0x4652f1
add dword [ebp - 0x30], 2
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a751
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x3a
jne 0x46540d
add dword [ebp - 0x30], 2
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a751
jmp 0x464d9b
push 5
push dword [ebp + 0x78]
push str._IMG
call fcn.0043fac4
add esp, 0xc
test al, al
jne 0x465419
push edi
push dword [ebp + 0x78]
push str._SKIP
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x465375
add dword [ebp + 0x78], 0xc
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x48], 0x42
call fcn.00451cdf
mov al, byte [ebp - 0x48]
add esp, 0xc
mov byte [ebp - 0x64], al
jmp 0x46540d
push 4
push dword [ebp + 0x78]
push str._iv
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x4653a4
add dword [ebp + 0x78], 8
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451cdf
jmp 0x464d9b
push edi
lea eax, [ebp + 0x78]
push eax
push str._cdrom
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4653c6
mov dword [ebp - 0x84], 8
jmp 0x46540d
push 7
lea eax, [ebp + 0x78]
push eax
push str._floppy
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4653e9
mov dword [ebp - 0x84], 0x10
jmp 0x46540d
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2d
jne 0x465419
lea eax, [ebp + 0x78]
push eax
call fcn.00405b4a
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
jmp 0x464d9b
mov byte [ebp + 0x10], 1
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
jne 0x464a9b
cmp dword [ebp - 0x7c], 0xfffffffe
jne 0x465480
cmp dword [ebp - 0x78], esi
jne 0x465480
mov eax, dword [ebp - 0xb0]
cmp eax, 0xfffffff7
jne 0x465474
cmp dword [ebp - 0xac], esi
jne 0x465474
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
jmp 0x465491
push str.21:INDATA
lea ecx, [ebp - 0x64]
call fcn.0044e66d
push dword [ebp + 0x78]
lea ecx, [ebp - 0x64]
call fcn.00444e9e
push dword [ebp - 0x64]
mov ecx, dword [ebp - 0xb4]
call fcn.004221d9
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.0043e679
jmp 0x469838
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0xb0], 0xfffffff7
jne 0x4654a1
cmp dword [ebp - 0xac], esi
jne 0x4654a1
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xac], ebx
cmp dword [ebp - 0x7c], 0xfffffff7
jne 0x4654be
cmp dword [ebp - 0x78], esi
jne 0x4654be
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x78], eax
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4ca704
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4655dc
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4ca6fc
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4654fa
mov byte [ebp + 0x5f], 1
jmp 0x4655dc
push edi
lea eax, [ebp + 0x78]
push eax
push str.part
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465519
mov byte [ebp + 0x5f], 2
jmp 0x4655dc
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca6f8
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465539
mov byte [ebp + 0x5f], 3
jmp 0x4655dc
push 5
lea eax, [ebp + 0x78]
push eax
push str.cdrom
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465560
mov byte [ebp + 0x5f], 4
mov dword [ebp - 0x84], 8
jmp 0x4655dc
push 6
lea eax, [ebp + 0x78]
push eax
push str.floppy
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465587
mov byte [ebp + 0x5f], 5
mov dword [ebp - 0x84], 0x10
jmp 0x4655dc
push 6
lea eax, [ebp + 0x78]
push eax
push str.parent
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4655a4
mov byte [ebp + 0x5f], 6
jmp 0x4655dc
push 6
lea eax, [ebp + 0x78]
push eax
push str.volume
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4655c1
mov byte [ebp + 0x5f], 7
jmp 0x4655dc
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca6d4
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4655dc
mov byte [ebp + 0x5f], 8
push edi
lea eax, [ebp + 0x78]
push eax
push str.init
mov byte [ebp + 0x68], 0
call fcn.00446de5
xor edi, edi
add esp, 0xc
inc edi
test al, al
je 0x465600
mov byte [ebp + 0x57], 1
mov dword [ebp + 0x60], edi
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca6d0
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46561b
mov byte [ebp + 0x57], 0x10
push 6
lea eax, [ebp + 0x78]
push eax
push str.update
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465638
mov byte [ebp + 0x68], 1
jmp 0x46568d
push 7
lea eax, [ebp + 0x78]
push eax
push str.xupdate
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465655
mov byte [ebp + 0x68], 0x20
jmp 0x46568d
push 7
lea eax, [ebp + 0x78]
push eax
push str.hupdate
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465672
mov byte [ebp + 0x68], 0x10
jmp 0x46568d
push 8
lea eax, [ebp + 0x78]
push eax
push str.hupdatef
call fcn.00446de5
add esp, 0xc
test al, al
je 0x465690
mov byte [ebp + 0x68], 0x18
mov dword [ebp + 0x60], edi
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
call fcn.00405b4a
mov eax, dword [ebp + 0x78]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xbc]
call fcn.00444f56
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2a
pop ecx
mov dword [ebp - 0xd0], ebx
jne 0x4656d9
inc eax
inc eax
mov dword [ebp - 0xd0], 0x40000000
mov dword [ebp + 0x78], eax
xor ecx, ecx
mov cx, word [eax]
mov edx, ecx
or edx, 0x20
cmp dx, 0x61
jne 0x4656ff
mov dword [ebp - 0x88], 0x80
lea eax, [ebp + 0x78]
push eax
call fcn.00405b4a
pop ecx
jmp 0x465721
cmp cx, 0x2d
jne 0x46571b
mov ax, word [eax + 2]
or ax, 0x20
cmp ax, 0x61
jne 0x46571b
mov dword [ebp - 0x88], ebx
jmp 0x4656f3
mov dword [ebp - 0xd0], ebx
xor eax, eax
mov dword [ebp - 0x224], ebx
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4dc8e0
push edi
mov dword [ebp - 0x1b8], 0xebd0a0a2
mov word [ebp - 0x1b4], 0xb9e5
mov word [ebp - 0x1b2], 0x4433
mov byte [ebp - 0x1b0], 0x87
mov byte [ebp - 0x1af], 0xc0
mov byte [ebp - 0x1ae], 0x68
mov byte [ebp - 0x1ad], 0xb6
mov byte [ebp - 0x1ac], 0xb7
mov byte [ebp - 0x1ab], 0x26
mov byte [ebp - 0x1aa], 0x99
mov byte [ebp - 0x1a9], 0xc7
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x48], str.MS_Basic_Data
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x184], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp + 0x55], 0
jne 0x46580a
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451cdf
pop ecx
pop ecx
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2d
jne 0x465839
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.004ab8fe
add esp, 4
test al, al
jne 0x465839
mov ecx, edx
mov byte [ebp - 0x89], 1
mov dword [ebp + 0x78], ecx
jmp 0x465839
push ebx
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453e0c
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x18c], eax
jne 0x465836
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x469838
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2b
jne 0x465849
mov al, byte [ecx]
inc ecx
inc ecx
mov byte [ebp - 0x59], al
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2d
jne 0x46585a
lea eax, [ebp + 0x78]
push eax
call fcn.00405b6e
jmp 0x46586e
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044a801
pop ecx
mov dword [ebp - 0x194], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x40
pop ecx
mov byte [ebp - 0x43], 1
jne 0x465885
inc eax
inc eax
mov dword [ebp + 0x78], eax
mov byte [ebp - 0x43], 0
cmp word [eax], 0x2d
jne 0x465896
lea eax, [ebp + 0x78]
push eax
call fcn.00405b6e
jmp 0x4658aa
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044a801
pop ecx
mov dword [ebp - 0x184], eax
cmp byte [ebp + 0x55], 0
pop ecx
je 0x465910
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453e0c
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044a751
add esp, 0x14
cmp byte [ebp + 0xb], 0
mov dword [ebp - 0x190], eax
je 0x465910
mov ecx, dword [ebp - 0x168]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
jne 0x465910
mov eax, dword [ebp - 0x16c]
or dword [ebp - 0x168], edx
or byte [ebp + 0xb], 0x20
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x1cc], ebx
mov cx, word [eax]
cmp cx, 0x2d
je 0x465967
cmp byte [ebp + 0x55], 0
je 0x465967
cmp cx, bx
je 0x465967
mov dword [ebp - 0x1d0], eax
push ebx
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041a317
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x1cc]
add esp, 0xc
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x48], eax
mov word [eax + ecx*2], bx
cmp byte [ebp + 0x5f], 1
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x51], 0
je 0x465982
cmp byte [ebp + 0x5f], 4
jge 0x465982
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xbc]
push 5
push ebx
mov edi, ebx
push 0x4ca688
mov dword [ebp + 0x78], edi
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x465a63
lea ecx, [ebx + 0xa]
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2a
mov edi, ecx
jne 0x465a03
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x3c]
add ecx, 2
push eax
mov dword [ebp - 0x3c], ecx
call fcn.0044a801
mov edi, dword [ebp - 0x3c]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x51], 1
jne 0x4659fe
lea eax, [ebp - 0xfc]
push eax
inc edi
lea eax, [ebp - 0x3c]
inc edi
push eax
mov dword [ebp - 0x3c], edi
call fcn.0044a801
mov edi, dword [ebp - 0x3c]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x51], 0x11
jne 0x4659fe
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x78], ecx
xor edx, edx
mov dx, word [ecx]
cmp dx, 0x5c
je 0x465a33
cmp dx, 0x2f
je 0x465a33
mov byte [ebp - 0x21], 1
jmp 0x465a33
mov eax, edx
call fcn.0040f8eb
test al, al
jne 0x465a38
cmp dx, 0x23
je 0x465a38
inc ecx
inc ecx
mov dword [ebp + 0x78], ecx
mov dx, word [ecx]
test dx, dx
jne 0x465a1a
sub ecx, edi
sar ecx, 1
test ecx, ecx
jle 0x465a54
push ecx
push edi
lea ecx, [ebp - 0xd4]
call fcn.00444f56
mov dword [ebp - 0x18], 0xfffc0000
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
mov edi, dword [ebp + 0x78]
pop ecx
jmp 0x465aa3
push 2
push ebx
push 0x4ca684
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x465a7d
lea edi, [ebx + 4]
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.004449cb
test al, al
je 0x465a9b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00441162
mov edi, dword [ebp + 0x78]
pop ecx
pop ecx
cmp word [ebx], 0
setne byte [ebp - 0x3f]
push 0
push 0x200
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
call fcn.004adbb0
mov dword [ebp - 0x38], eax
mov ax, word [edi]
cmp ax, 0x23
mov dword [ebp - 0x34], edx
je 0x465ada
cmp ax, 0x3a
jne 0x465b7e
cmp ax, 0x23
jne 0x465ade
or byte [ebp - 7], 4
inc edi
inc edi
push 2
push edi
push 0x4ca680
mov dword [ebp + 0x78], edi
call fcn.0043fac4
push 2
push edi
push 0x4ca67c
mov byte [ebp + 0x6a], al
call fcn.0043fac4
mov byte [ebp + 0x23], al
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
add esp, 0x18
neg al
sbb al, al
inc al
cmp byte [ebp + 0x6a], 0
mov byte [ebp - 0x44], al
jne 0x465b2a
cmp word [edi], 0x2b
jne 0x465b2a
inc edi
inc edi
mov byte [ebp - 0x3e], 1
mov dword [ebp + 0x78], edi
cmp byte [ebp + 0x23], 0
jne 0x465b4e
mov ax, word [edi]
cmp ax, 0x40
je 0x465b45
cmp ax, 0x2d
je 0x465b45
cmp ax, 0x3d
jne 0x465b4e
or dword [ebp - 8], 2
inc edi
inc edi
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.004449cb
test al, al
je 0x465b7e
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451cdf
test eax, eax
pop ecx
pop ecx
jle 0x465b7e
xor eax, eax
cmp dword [ebp + 0x60], eax
mov byte [ebp - 0x42], 1
jne 0x465b7e
mov byte [ebp + 0x6a], 1
jmp 0x465b85
xor eax, eax
cmp dword [ebp + 0x60], eax
jg 0x465b9b
cmp byte [ebp + 0x5f], 0
jg 0x465b9b
cmp dword [ebp - 0x20], eax
jne 0x465b9b
cmp dword [ebp - 0xcc], eax
mov dword [ebp + 0x58], eax
je 0x465ba2
mov dword [ebp + 0x58], 1
cmp byte [ebp + 0x54], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
je 0x465bc3
cmp dword [ebp + 0x58], eax
jne 0x465bc3
cmp word [ebx], ax
jne 0x465bc3
mov eax, 0xfffc0000
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 0xd4]
and word [ebp - 0x2d4], 0
cmp word [ebx], 0
lea edi, [ebp - 0x2d4]
mov dword [ebp - 0x30], edi
je 0x465be5
mov edi, ebx
mov dword [ebp - 0x30], edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x2d4]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp byte [ebp - 0x41], 0
jg 0x465c38
mov eax, dword [ebp - 0xc4]
or eax, dword [ebp - 0xc0]
jne 0x465c38
push 0x11
push edi
push str..PhysicalDrive
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x465c38
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
add edi, 0x22
push eax
mov dword [ebp - 0x1c], edi
call fcn.004481e9
pop ecx
pop ecx
cmp byte [ebp + 0x68], 0
jne 0x465c4a
cmp byte [ebp + 0x69], 0
jne 0x465c4a
cmp byte [ebp + 0x6b], 0
je 0x465c60
cmp dword [ebp - 0x18], 0
jge 0x465c60
cmp dword [ebp - 4], 0
jge 0x465c60
push 0x4dc8e0
jmp 0x4674cd
and dword [ebp + 0x6c], 0
and dword [ebp], 0
cmp byte [ebp + 0x54], 0
mov edi, 0x80070057
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x3c], edi
mov byte [ebp + 0x64], 0
je 0x465d3b
cmp dword [ebp - 4], 0
jge 0x465c9d
cmp dword [ebp - 0x70], esi
jl 0x465c9d
jg 0x465c93
cmp dword [ebp - 0x74], esi
jbe 0x465c9d
cmp dword [ebp + 0x30], 0
je 0x465d3b
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x465cd4
cmp word [eax], 0x2a
jne 0x465cd4
xor eax, eax
mov al, byte [ebp + 0x54]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 4]
call fcn.00453fe2
and dword [ebp + 0x30], 0
or byte [0x4dc468], 0x20
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp], eax
mov byte [ebp + 0x64], 0x20
cmp dword [ebp - 4], 0
jge 0x465cec
cmp dword [ebp - 0x70], esi
jl 0x465cec
jg 0x465ce6
cmp dword [ebp - 0x74], esi
jbe 0x465cec
cmp dword [ebp + 0x30], 0
je 0x465d3b
push dword [ebp + 0x30]
xor eax, eax
mov al, byte [ebp + 0x54]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 4]
call fcn.00405728
mov dword [ebp], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x70]
add esp, 0x1c
cmp eax, esi
je 0x465d34
or byte [ebp + 0x64], 0x10
or byte [0x4dc468], 0x10
jmp 0x465d3b
mov byte [0x4dc468], 0
cmp byte [ebp - 0x22], 0
jbe 0x465f68
cmp byte [ebp + 0x55], 0
jne 0x465f68
cmp dword [ebp - 0x18], 0
jge 0x465d5f
cmp word [ebx], 0
je 0x465e1c
mov eax, dword [ebp - 0x68]
test eax, eax
jle 0x465d6f
cmp eax, dword [ebp + 0x60]
je 0x465e1c
cmp dword [ebp + 0x60], 4
jg 0x465e1c
cmp byte [ebp + 0x11], 2
jl 0x465e1c
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405bea
mov ebx, dword [ebp + 0x6c]
cmp ebx, esi
je 0x465ebb
push 0x800
push 1
push esi
push ebx
call fcn.00449c52
mov esi, 0x200
push esi
push ebx
mov dword [ebp - 0x58], eax
call fcn.00441fa2
add esp, 0x18
cmp eax, esi
mov edi, eax
jge 0x465dd3
mov edi, esi
lea eax, [edi + edi*2]
push eax
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x14], edi
call fcn.00444cdb
mov eax, dword [ebp + 0x30]
lea esi, [eax + edi]
lea eax, [edi - 1]
not eax
and esi, eax
push 0
lea eax, [ebp - 0x50]
push eax
push edi
mov dword [ebp - 0x2c], esi
add esi, edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x465e36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x465e14
inc edi
lea ecx, [ebp + 0x30]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
push 0x4dc8e0
jmp 0x46880c
push 0x200
push esi
push dword [ebp - 0x2c]
call fcn.00414409
dec dword [ebp - 0x68]
mov edi, dword [ebp - 0x68]
dec dword [ebp + 0x60]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp + 0x60]
or byte [ebp - 0x22], 2
shl edi, 4
lea eax, [eax + edi + 0x1be]
push 0x10
push eax
shl ebx, 4
lea eax, [esi + ebx + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
call fcn.00414409
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x1be]
push 0x10
push eax
lea eax, [esi + edi + 0x1be]
push eax
call fcn.00414409
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x34
test eax, eax
je 0x465ede
lea ecx, [ebp + 0x30]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
push 0x4dc8e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
jmp 0x469838
push dword [ebp + 0x14]
xor edi, edi
push esi
push dword [ebp - 0x2c]
mov dword [ebp], edi
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x465f25
push edi
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x465f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x465f19
xor eax, eax
inc eax
mov dword [ebp], eax
push dword [ebp + 0x6c]
call fcn.0044263c
pop ecx
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x47]
lea ecx, [ebp + 0x30]
or byte [ebp + 0x69], al
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x69]
or al, byte [ebp + 0x47]
je 0x465f49
mov dword [ebp + 0x58], edi
call fcn.0043e679
jmp 0x46871a
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
push 0x4dc8e0
jmp 0x46982f
and dword [ebp - 0x14], 0
cmp byte [ebp + 0x68], 0x10
jne 0x465f7f
test byte [ebp + 0x6b], 0x20
jne 0x46871a
or esi, 0xffffffff
mov eax, dword [ebp - 0xbc]
xor ebx, ebx
cmp byte [ebp + 0x54], bl
je 0x465fd4
cmp dword [ebp + 0x58], ebx
jne 0x465fd4
cmp byte [ebp + 0x47], bl
jne 0x46871a
cmp byte [ebp + 0x69], bl
jne 0x46871a
cmp byte [ebp + 0x6b], bl
jne 0x46871a
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
test eax, eax
je 0x465fcc
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x3c]
jmp 0x469838
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x468817
cmp dword [ebp - 0xcc], ebx
jne 0x468b8a
mov cl, byte [ebp + 0x5f]
cmp cl, 6
mov dword [ebp], 0x80070057
je 0x468faf
cmp cl, 1
je 0x4690ae
cmp cl, 2
jne 0x466016
cmp byte [ebp - 0x41], 0
je 0x4690ee
cmp cl, 8
jne 0x466025
cmp byte [ebp - 0x41], 0
je 0x46914e
xor edi, edi
cmp cl, 3
mov dword [ebp + 0x50], edi
je 0x4691e4
cmp cl, 4
je 0x469cb8
cmp cl, 5
je 0x469cb8
cmp cl, 7
je 0x4692af
cmp byte [ebp + 0x23], 0
je 0x466070
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x6a], 0
mov dword [ebp], ebx
je 0x466080
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x10], 0
je 0x46609b
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
cmp byte [ebp - 0x3f], 0
je 0x4660aa
cmp dword [ebp - 4], ebx
jl 0x466d8a
cmp byte [ebp - 0x44], 0
je 0x4660b9
cmp dword [ebp + 0x60], ebx
jl 0x466d8a
test byte [ebp - 0x22], 2
jne 0x4660c2
dec dword [ebp + 0x60]
cmp byte [ebp + 0x55], 0
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], esi
mov byte [ebp + 0x13], 0
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x5a], 0
mov dword [ebp - 0x90], ebx
jne 0x466115
cmp dword [ebp - 0x60], ebx
jne 0x466115
mov eax, dword [ebp + 0x48]
or eax, dword [ebp + 0x4c]
jne 0x466115
mov eax, dword [ebp + 0x28]
or eax, dword [ebp + 0x2c]
jne 0x466115
mov byte [ebp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [ebp - 0x8a], 1
je 0x466147
cmp dword [ebp + 0x4c], ebx
jl 0x466147
jg 0x466131
cmp dword [ebp + 0x48], ebx
jb 0x466147
cmp dword [ebp + 0x2c], ebx
jl 0x466147
jg 0x46613e
cmp dword [ebp + 0x28], 1
jb 0x466147
mov dword [ebp + 0x14], 1
jmp 0x46614a
mov dword [ebp + 0x14], ebx
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405bea
cmp dword [ebp + 0x6c], ebx
je 0x4693ad
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.00441fa2
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp + 0x40], eax
jge 0x466188
mov dword [ebp + 0x40], edi
cmp dword [ebp + 0x14], ebx
je 0x4661f9
cmp dword [ebp + 0x4c], ebx
jl 0x4661c0
jg 0x466199
cmp dword [ebp + 0x48], ebx
jb 0x4661c0
mov eax, dword [ebp + 0x40]
push ebx
push ebx
push ebx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push ebx
push edi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004adbb0
push edx
push eax
push dword [ebp - 4]
lea ecx, [ebp + 0x64]
call fcn.004426bd
cmp byte [ebp + 0x6a], 0
jne 0x4661f9
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xc4]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc0]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043d790
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.004426fb
mov dword [ebp - 0x3c], ebx
push 0x800
push 1
push ebx
push dword [ebp + 0x6c]
call fcn.00449c52
add esp, 0x10
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x58], eax
jl 0x46624b
cmp byte [ebp + 0x68], 0x20
je 0x466220
cmp byte [ebp + 0x68], 0x10
jne 0x466225
cmp eax, 0xb
je 0x466247
test byte [ebp + 0x69], 0x20
jne 0x466247
cmp byte [ebp + 0x69], 0
je 0x466236
cmp eax, 0xb
je 0x466247
test byte [ebp + 0x6b], 0x20
jne 0x466247
cmp byte [ebp + 0x6b], 0
je 0x46624b
cmp eax, 0xb
jne 0x46624b
or dword [ebp - 0x14], 1
cmp byte [ebp - 0x21], 0
jg 0x46626d
cmp byte [ebp + 0x47], 0
jne 0x466269
cmp byte [ebp + 0x68], 1
je 0x466269
cmp byte [ebp + 0x68], 0x20
je 0x466269
cmp byte [ebp + 0x69], 0
je 0x46626d
or dword [ebp - 0x14], 2
cmp byte [ebp + 0x68], 1
je 0x466279
cmp byte [ebp + 0x68], 0x20
jne 0x46627d
or dword [ebp - 0x14], 4
mov cl, byte [ebp + 0x6b]
and cl, 0x20
jne 0x46629b
cmp byte [ebp + 0x6b], 0
je 0x466290
cmp eax, 0xb
je 0x46629b
test byte [ebp + 0x68], 0x10
je 0x46629f
cmp eax, 0xc
je 0x46629f
or dword [ebp - 0x14], 8
cmp byte [ebp - 0x21], 0
jg 0x4662a9
or dword [ebp - 0x14], 0x10
cmp byte [ebp + 0x68], 0x10
jne 0x4662b3
or dword [ebp - 0x14], 0x20
cmp byte [ebp + 0x54], 0
je 0x4662be
cmp dword [ebp + 0x58], ebx
jne 0x4662c2
or dword [ebp - 0x14], 0x40
cmp byte [ebp + 0x68], 0x18
jne 0x4662cc
or byte [ebp - 0x14], 0x80
cmp eax, 0xc
jne 0x4662e1
cmp byte [ebp + 0x69], 0
jne 0x4662dd
cmp byte [ebp + 0x47], 0
je 0x4662e1
or byte [ebp - 0x13], 1
cmp byte [ebp + 0x54], 0
je 0x4662ec
cmp dword [ebp + 0x58], ebx
je 0x4662fc
cmp byte [ebp + 0x68], 0x10
jne 0x4662f6
test cl, cl
jne 0x4662fc
cmp byte [ebp + 0x68], 0
je 0x466304
mov dword [ebp + 0x58], ebx
jmp 0x468712
cmp dword [ebp - 0x60], 0xff
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], ebx
jg 0x4693ba
cmp byte [ebp + 0x6a], 0
jne 0x466368
cmp dword [ebp + 0x60], ebx
jge 0x466368
cmp dword [ebp + 0x4c], ebx
jg 0x4693ba
jl 0x46633c
cmp dword [ebp + 0x48], ebx
jae 0x4693ba
cmp dword [ebp + 0x2c], ebx
jg 0x4693ba
jl 0x466350
cmp dword [ebp + 0x28], ebx
jae 0x4693ba
cmp dword [ebp - 0x60], ebx
jge 0x4693ba
mov dword [ebp - 0x60], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
cmp byte [ebp + 0x6a], 0
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp + 0x30], eax
jne 0x4663ad
cmp byte [ebp + 0x23], 0
jne 0x4663ad
cmp eax, 4
jl 0x46699e
cmp byte [ebp + 0x55], 0
jne 0x46699e
cmp byte [ebp + 0x57], 0
jne 0x46699e
cmp byte [ebp + 0x6a], 0
je 0x4663ce
mov dword [ebp + 0x60], 4
cmp dword [ebp - 0x60], 5
je 0x466d8a
cmp dword [ebp - 0x60], 0xf
je 0x466d8a
push 0x100000
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0x58], ebx
call fcn.00402d17
lea eax, [ebp + 0x58]
push eax
push dword [ebp - 0x4c]
push dword [ebp + 0x6c]
call fcn.0044239f
mov edx, dword [ebp + 0x58]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov edi, eax
jne 0x466448
cmp edx, ecx
jge 0x46641b
cmp ecx, 4
jge 0x466440
cmp byte [ebp + 0x6a], 0
jne 0x466448
cmp byte [ebp + 0x23], 0
jne 0x466448
lea eax, [ecx + 1]
mov byte [ebp + 0x3b], 0
call fcn.00442380
cmp eax, ebx
jle 0x466440
cmp eax, edx
jl 0x46647f
cmp ecx, 4
jle 0x46647f
lea ecx, [ebp - 0x4c]
jmp 0x466d85
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x3b], 1
jne 0x46647a
cmp byte [ebp + 0x6a], 0
je 0x46647f
cmp dword [ebp - 0x60], ebx
jl 0x466440
cmp word [ebp - 0x88], bx
jle 0x466472
mov dword [ebp - 0x88], 0x80
jmp 0x46647f
mov dword [ebp - 0x88], ebx
jmp 0x46647f
cmp edx, 4
jle 0x466440
cmp edx, 4
jle 0x46648f
lea eax, [edx - 4]
and eax, 0xfffffffc
mov dword [ebp + 0x34], eax
jmp 0x466492
mov dword [ebp + 0x34], ebx
cmp byte [ebp + 0x3b], 0
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x30], esi
jne 0x4664b2
cmp ecx, 4
jl 0x4664af
lea eax, [ecx*4 - 0x10]
mov dword [ebp + 0x34], eax
jmp 0x4664b2
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x24], esi
xor edx, edx
lea eax, [edi + 0x50]
mov cl, byte [eax]
cmp cl, 5
je 0x4664c6
cmp cl, 0xf
jne 0x4664c9
mov dword [ebp + 0x24], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x4664ba
cmp byte [ebp + 0x3b], 0
je 0x4664e3
cmp dword [ebp + 0x24], ebx
jl 0x466440
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
push 0
shl eax, 4
lea esi, [eax + edi + 0x30]
mov ebx, 0x200
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x1c], esi
push dword [esi + 8]
call fcn.004adb00
push 0
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0xec], eax
push dword [esi + 0x10]
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], edx
call fcn.004adb00
mov ebx, eax
mov eax, dword [ebp + 0x34]
lea eax, [eax + eax*8]
shl eax, 4
cmp byte [ebp + 0x23], 0
mov dword [ebp - 0x1f0], edx
lea esi, [eax + edi + 0x30]
je 0x46660f
mov eax, dword [ebp + 0x58]
xor esi, esi
cmp eax, 8
jne 0x466563
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0xe8]
jmp 0x4665b6
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + edi + 0x30]
lea eax, [edi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x466595
cmp cl, 0xf
je 0x466595
inc esi
add eax, 0x90
cmp esi, 4
jl 0x466576
lea ecx, [ebp - 0x4c]
jmp 0x4674a6
push 0
push 0x200
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.004adb00
mov ecx, eax
mov eax, dword [edi + 0x24]
xor edi, edi
sub ecx, eax
sbb edx, edi
test esi, esi
jl 0x46658d
and dword [ebp - 0x24c], 0
xor eax, eax
add ecx, dword [ebp - 0xc4]
lea edi, [ebp - 0x248]
adc edx, dword [ebp - 0xc0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x24c]
push eax
push edx
push ecx
push dword [ebp + 0x6c]
call fcn.00453ce2
and dword [ebp], 0
add esp, 0x14
cmp byte [ebp + 0x6b], 0
jne 0x466603
cmp byte [ebp + 0x69], 0
jne 0x466603
cmp byte [ebp + 0x47], 0
je 0x4693de
and dword [ebp + 0x58], 0
lea ecx, [ebp - 0x4c]
jmp 0x46870d
cmp dword [ebp + 0x58], 4
jg 0x46661d
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x3c], eax
jmp 0x466648
xor edx, edx
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x46662e
cmp cl, 0xf
jne 0x466631
mov dword [ebp + 0x3c], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x466622
cmp byte [ebp + 0x3b], 0
jne 0x466648
mov eax, dword [ebp + 0x34]
add dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], 0
jge 0x466658
cmp byte [ebp + 0x6a], 0
je 0x46658d
cmp byte [ebp + 0x3b], 0
je 0x466664
and dword [ebp + 0x30], 0
jmp 0x46668e
xor edx, edx
lea eax, [esi + 0x260]
mov cl, byte [eax]
test cl, cl
jne 0x466676
test edx, edx
jne 0x466683
cmp cl, 5
je 0x466683
cmp cl, 0xf
je 0x466683
mov dword [ebp + 0x30], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x46666c
cmp byte [ebp + 0x3b], 0
jne 0x46669e
cmp dword [ebp + 0x30], 0
jl 0x46658d
cmp byte [ebp + 0x6a], 0
je 0x4668cf
mov eax, dword [ebp + 0x34]
test eax, eax
jg 0x4666b2
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
shl eax, 4
lea eax, [eax + edi + 0x30]
mov ecx, dword [eax + 8]
push 0
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 0xc]
push 0x200
push eax
push ecx
mov dword [ebp - 0x198], eax
call fcn.004adb00
cmp dword [ebp + 0x58], 4
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], edx
jle 0x4667dd
cmp dword [ebp + 0x3c], 0
jge 0x4667dd
cmp byte [esi + 0x20], 0
je 0x466794
mov eax, dword [ebp + 0x58]
cmp eax, 8
jle 0x466714
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x466717
mov eax, dword [ebp + 0x24]
push 0
lea eax, [eax + eax*8]
push 0x200
shl eax, 4
push dword [eax + edi + 0x3c]
push dword [eax + edi + 0x38]
call fcn.004adb00
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x164], eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 8]
push 0
adc ecx, dword [esi + 0xc]
push 0x200
push ecx
push eax
mov dword [ebp - 0x160], edx
call fcn.004adb00
mov ecx, eax
sub ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x1a8], ecx
mov ecx, edx
sbb ecx, dword [ebp - 0x178]
sub ebx, eax
mov dword [ebp - 0x1a4], ecx
mov ecx, dword [ebp - 0x1f0]
sbb ecx, edx
add ebx, dword [ebp - 0x17c]
adc ecx, dword [ebp - 0x178]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ecx
jmp 0x466821
cmp dword [ebp + 0x34], 4
jne 0x4693e6
mov eax, dword [ebp + 0x24]
test eax, eax
jl 0x4693e6
mov ecx, dword [ebp - 0x1c]
cmp byte [ecx + 0x20], 0
je 0x4693e6
mov edx, dword [ebp - 0xe8]
or dword [ebp + 0x34], 0xffffffff
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], edx
jmp 0x466819
cmp dword [ebp + 0x34], 0
jle 0x466803
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
mov eax, dword [eax + 0x14]
adc eax, dword [ebp - 0x198]
push 0
push 0x200
push eax
push ecx
call fcn.004adb00
mov ecx, dword [ebp - 0x1f0]
sub ebx, eax
sbb ecx, edx
add ebx, dword [ebp - 0x17c]
adc ecx, dword [ebp - 0x178]
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
test ecx, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edx
jl 0x46658d
jg 0x46683f
test ebx, ebx
jbe 0x46658d
cmp byte [ebp - 0x59], 0
je 0x46684b
add dword [ebp + 0x48], eax
adc dword [ebp + 0x4c], edx
mov edi, eax
add edi, 1
mov esi, edx
adc esi, 0
cmp dword [ebp + 0x4c], esi
jg 0x466867
jl 0x466861
cmp dword [ebp + 0x48], edi
ja 0x466867
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], esi
sub ebx, dword [ebp + 0x48]
sbb ecx, dword [ebp + 0x4c]
add ebx, eax
adc ecx, edx
cmp dword [ebp + 0x2c], ecx
jl 0x466883
jg 0x46687d
cmp dword [ebp + 0x28], ebx
jbe 0x466883
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ecx
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x46658d
jg 0x466899
cmp dword [ebp + 0x28], eax
jb 0x46658d
cmp dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x58]
jle 0x4668ad
dec eax
and eax, 0xfffffffc
call fcn.0044238f
inc eax
jmp 0x4668b5
and eax, 0xfffffffc
call fcn.0044238f
mov dword [ebp + 0x60], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0xe0]
jmp 0x466989
mov eax, dword [ebp + 0x3c]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + edi + 0x30]
push 0
mov edi, 0x200
push edi
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004adb00
push 0
push edi
push dword [esi + 0x14]
mov ebx, eax
push dword [esi + 0x10]
mov eax, edx
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], eax
call fcn.004adb00
cmp byte [ebp - 0x59], 0
je 0x466925
add dword [ebp + 0x48], ebx
mov ecx, dword [ebp - 0x1f8]
adc dword [ebp + 0x4c], ecx
xor esi, esi
cmp dword [ebp + 0x4c], esi
jl 0x46694b
jg 0x466933
cmp dword [ebp + 0x48], esi
jbe 0x46694b
mov ecx, dword [ebp - 0x1f8]
cmp dword [ebp + 0x4c], ecx
jg 0x46694b
jl 0x466945
cmp dword [ebp + 0x48], ebx
ja 0x46694b
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ecx
cmp dword [ebp + 0x2c], esi
jl 0x46697d
jg 0x466957
cmp dword [ebp + 0x28], esi
jbe 0x46697d
cmp dword [ebp + 0x2c], edx
jl 0x466969
jg 0x466963
cmp dword [ebp + 0x28], eax
jbe 0x466969
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], esi
jl 0x4693ee
jg 0x46697d
cmp dword [ebp + 0x28], esi
jb 0x4693ee
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x174], ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x170], eax
call fcn.0043e679
xor ebx, ebx
mov edi, 0x200
cmp dword [ebp + 0x60], 4
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x170]
setge byte [ebp - 0x5c]
add eax, dword [ebp - 0xc4]
push ebx
adc ecx, dword [ebp - 0xc0]
push edi
push ecx
push eax
call fcn.004adbb0
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edx
je 0x466a11
cmp byte [ebp + 0x6a], 0
je 0x466a11
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xc4]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc0]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043d790
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.004426fb
mov dword [ebp - 0x3c], ebx
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x10
cmp eax, dword [ebp - 0x128]
jne 0x469422
cmp edx, dword [ebp - 0x124]
jne 0x469422
mov esi, dword [ebp + 0x40]
lea eax, [esi + esi*2]
push eax
lea ecx, [ebp + 4]
call fcn.00402d17
mov eax, dword [ebp + 4]
push dword [ebp + 0x40]
lea edi, [eax + esi]
lea eax, [esi - 1]
not eax
and edi, eax
add esi, edi
push ebx
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp + 0x24], esi
call fcn.004adaa0
add esp, 0xc
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46941a
push dword [ebp + 0x40]
push esi
push edi
call fcn.00414409
add esp, 0xc
cmp byte [ebp + 0x57], 0
je 0x466b87
cmp byte [ebp + 0x55], 0
jne 0x466b87
push esi
call fcn.0044268f
cmp byte [ebp - 9], 0
pop ecx
jg 0x466ad8
jge 0x466ad4
mov eax, dword [ebp + 0x40]
xor ecx, ecx
cmp dword [ebp - 0x34], ecx
lea eax, [eax + eax + 0x4000]
jg 0x466ad8
jl 0x466ad4
cmp dword [ebp - 0x38], eax
ja 0x466ad8
xor al, al
jmp 0x466ada
mov al, 1
cmp byte [ebp + 0x57], 1
jne 0x466b18
test al, al
je 0x466b06
cmp dword [ebp + 0x40], 0x200
jbe 0x466b06
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
lea eax, [esi + 0x200]
push ebx
push eax
call fcn.004adaa0
add esp, 0xc
push 0x40
lea eax, [esi + 0x1be]
push ebx
push eax
call fcn.004adaa0
add esp, 0xc
push dword [ebp + 0x40]
mov word [esi + 0x1fe], 0xaa55
push esi
push edi
call fcn.0043e718
add esp, 0xc
test eax, eax
je 0x466b67
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x10
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
mov dword [ebp - 0x50], ebx
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
inc eax
mov dword [ebp], eax
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x69]
or al, byte [ebp + 0x47]
je 0x46942f
cmp dword [ebp - 0x18], ebx
jl 0x46942f
mov dword [ebp + 0x58], ebx
jmp 0x46870a
cmp byte [ebp + 0x5f], 2
je 0x466ba3
cmp byte [ebp + 0x11], 0
jne 0x466ba3
cmp byte [ebp - 0x42], 0
je 0x466bb2
cmp dword [ebp + 0x60], 1
jle 0x466d82
cmp byte [ebp - 0x42], 0
je 0x466bb2
cmp dword [ebp + 0x60], ebx
jl 0x466d82
push 0x200010
lea ecx, [ebp + 0x18]
call fcn.00402d17
xor esi, esi
cmp word [ebp - 0x88], bx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x50], ebx
mov byte [ebp + 0x56], 0xff
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
jl 0x466bf2
mov esi, dword [ebp + 0x60]
inc esi
cmp word [ebp - 0x88], bx
jne 0x466bf2
neg esi
movzx esi, si
mov eax, esi
or eax, dword [ebp - 0xd0]
push eax
lea eax, [ebp + 0x56]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x6c]
call fcn.0044abe5
mov al, byte [ebp + 0x56]
add esp, 0x14
cmp esi, ebx
je 0x466c21
test al, al
jge 0x46945b
cmp al, 0x10
jl 0x466c27
and al, 0xf
test al, al
jl 0x466c3a
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
or al, byte [ebp + 0x10]
jne 0x466d7a
cmp dword [ebp - 4], ebx
jl 0x466c5e
push dword [ebp + 0x6c]
mov esi, dword [ebp + 0x18]
call fcn.0044212c
pop ecx
push ebx
push dword [ebp + 0x40]
push edx
push eax
call fcn.004adb00
mov esi, dword [ebp - 0xf8]
jmp 0x466cc5
mov esi, dword [ebp - 0xf8]
cmp esi, ebx
jl 0x466c84
jg 0x466c72
cmp dword [ebp - 0xfc], ebx
jb 0x466c84
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], esi
lea eax, [ebp - 0x270]
push eax
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x466d0b
test byte [ebp - 0x270], 0x10
jne 0x466d0b
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x250]
and eax, 0xfffffe00
xor edx, edx
shld edx, eax, 0x17
shl eax, 0x17
shr ecx, 9
xor edi, edi
or eax, ecx
or edx, edi
sub eax, dword [ebp - 0xc4]
sbb edx, dword [ebp - 0xc0]
cmp esi, ebx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], edx
jl 0x466d0b
jg 0x466ceb
cmp dword [ebp - 0xfc], ebx
jbe 0x466d0b
cmp edx, esi
ja 0x466d0b
jb 0x466cf9
cmp eax, dword [ebp - 0xfc]
jae 0x466d0b
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x6c]
call fcn.0044239f
mov esi, eax
mov eax, dword [ebp - 0xd4]
mov cx, word [eax]
add esp, 0xc
cmp cx, bx
jne 0x466d37
cmp esi, ebx
jne 0x466d3b
test byte [ebp + 0x57], 0x10
je 0x466d7a
cmp esi, ebx
je 0x466d3f
mov eax, dword [esi]
jmp 0x466d41
xor eax, eax
cmp eax, 1
sete byte [ebp + 0x56]
cmp byte [ebp + 0x56], 0
je 0x466d5b
cmp byte [ebp - 0x8c], 0
mov byte [ebp + 0x12], 1
je 0x466d5f
mov byte [ebp + 0x12], 0
cmp byte [ebp - 0x8b], 0
jne 0x466d9d
cmp byte [ebp + 0x57], 0
jne 0x466d9d
cmp byte [ebp + 0x12], 0
je 0x466d97
cmp byte [ebp + 0x55], 0
jne 0x466d9d
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
jmp 0x468827
cmp byte [ebp + 0x55], 0
jne 0x466d7a
cmp cx, bx
mov eax, dword [ebp - 0x140]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp + 0x34], eax
jne 0x466e6a
xor eax, eax
mov dword [ebp - 0x23c], ebx
lea edi, [ebp - 0x238]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
push 0x18
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x13c], ebx
jg 0x466e1a
jl 0x466e04
cmp dword [ebp - 0x140], ebx
ja 0x466e1a
mov eax, dword [ebp - 0x230]
mov dword [ebp + 0x58], eax
cdq
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x144], ebx
jg 0x466e42
jl 0x466e2c
cmp dword [ebp - 0x148], ebx
ja 0x466e42
mov eax, dword [ebp - 0x22c]
mov dword [ebp + 0x3c], eax
cdq
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x134], ebx
jg 0x466e6a
jl 0x466e54
cmp dword [ebp - 0x138], ebx
ja 0x466e6a
mov eax, dword [ebp - 0x228]
mov dword [ebp + 0x34], eax
cdq
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
cmp dword [ebp - 0x13c], ebx
jg 0x466e90
jl 0x466e7c
cmp dword [ebp - 0x140], ebx
ja 0x466e90
mov eax, 0xff
mov dword [ebp + 0x58], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], ebx
cmp dword [ebp - 0x144], ebx
jg 0x466eb4
jl 0x466ea2
cmp dword [ebp - 0x148], ebx
ja 0x466eb4
push 0x3f
pop eax
mov dword [ebp + 0x3c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], ebx
cmp dword [ebp - 0x134], ebx
jg 0x466ee7
jl 0x466ec6
cmp dword [ebp - 0x138], ebx
ja 0x466ee7
mov eax, dword [ebp + 0x40]
cmp eax, ebx
mov dword [ebp + 0x34], eax
ja 0x466ed7
mov dword [ebp + 0x34], 0x200
mov eax, dword [ebp + 0x34]
cdq
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
mov eax, dword [ebp + 0x34]
cdq
mov edi, 0x200
mov ecx, edi
idiv ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x40]
lea ebx, [ecx + eax]
add eax, ebx
cmp byte [ebp + 0x12], 0
mov dword [ebp - 0x10], eax
jne 0x4678d5
cmp byte [ebp + 0x55], 0
jne 0x4678d5
cmp byte [ebp + 0x10], 0
mov byte [ebp + 0x56], 0
jne 0x4673a7
mov esi, dword [ebp + 0x4c]
xor eax, eax
cmp esi, eax
jg 0x466f4b
jl 0x466f37
cmp dword [ebp + 0x48], eax
jae 0x466f4b
cmp dword [ebp + 0x2c], eax
jl 0x4673a7
jg 0x466f4b
cmp dword [ebp + 0x28], eax
jb 0x4673a7
mov ebx, dword [ebp + 0x60]
cmp ebx, eax
jl 0x4673a7
push 0x100000
lea ecx, [ebp - 0x2c]
call fcn.00402d17
mov eax, dword [ebp + 0x34]
imul eax, dword [ebp + 0x3c]
cdq
idiv edi
mov edi, eax
imul eax, dword [ebp + 0x58]
cmp dword [ebp + 0x34], 0
cdq
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], edx
jle 0x469468
mov eax, dword [ebp - 0xd4]
cmp word [eax], 0
jne 0x466fc8
and dword [ebp], 0
lea eax, [ebp]
push eax
push dword [ebp - 0x2c]
push dword [ebp + 0x6c]
call fcn.0044239f
add esp, 0xc
test eax, eax
je 0x469475
cmp ebx, 4
jl 0x466fc8
cmp byte [ebp + 0x6a], 0
jne 0x466fc8
cmp ebx, dword [ebp]
jge 0x469468
xor edx, edx
xor eax, eax
cmp esi, edx
jl 0x46707a
jg 0x466fdf
cmp dword [ebp + 0x48], edx
jbe 0x46707a
mov ecx, dword [ebp - 0xb0]
and ecx, dword [ebp - 0xac]
cmp ecx, 0xffffffff
jne 0x46701e
cmp esi, dword [ebp - 0xa0]
jl 0x467019
jg 0x467005
mov eax, dword [ebp + 0x48]
cmp eax, dword [ebp - 0xa4]
jb 0x467019
cmp byte [ebp - 0x5c], 0
jne 0x467019
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
jmp 0x467066
mov eax, edi
cdq
jmp 0x467064
cmp byte [ebp - 0x52], 0
jne 0x46707a
mov eax, dword [ebp + 0x34]
cdq
mov ecx, eax
add ecx, dword [ebp - 0xb0]
mov edi, edx
adc edi, dword [ebp - 0xac]
push edx
sub ecx, 1
push eax
sbb edi, 0
push edi
push ecx
call fcn.004adb00
mov ecx, eax
mov eax, dword [ebp + 0x14]
mov edi, edx
cdq
push edx
push eax
push edi
push ecx
call fcn.004adbb0
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
push edx
push eax
push esi
push dword [ebp + 0x48]
call fcn.00442598
add esp, 0x10
add dword [ebp + 0x48], eax
adc esi, edx
mov dword [ebp + 0x4c], esi
xor ecx, ecx
cmp dword [ebp + 0x2c], ecx
jl 0x4670a9
jg 0x467088
cmp dword [ebp + 0x28], ecx
jbe 0x4670a9
cmp byte [ebp - 0x89], 0
jne 0x4670a9
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], ecx
jg 0x4670a9
jl 0x4670a3
cmp dword [ebp + 0x28], ecx
jae 0x4670a9
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
cmp esi, ecx
jl 0x4670bb
jg 0x4670b4
cmp dword [ebp + 0x48], ecx
jbe 0x4670bb
mov edi, dword [ebp + 0x48]
mov ebx, esi
jmp 0x4670bf
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0x2c], 0
jl 0x46715e
jg 0x4670d5
cmp dword [ebp + 0x28], 0
jbe 0x46715e
mov eax, dword [ebp - 0x7c]
and eax, dword [ebp - 0x78]
cmp eax, 0xffffffff
jne 0x4670fb
push dword [ebp - 0xa0]
add edi, dword [ebp + 0x28]
push dword [ebp - 0xa4]
adc ebx, dword [ebp + 0x2c]
push ebx
push edi
call fcn.004afea0
jmp 0x467158
cmp byte [ebp - 0x52], 0
jne 0x46715e
mov eax, dword [ebp + 0x34]
cdq
mov esi, eax
add eax, dword [ebp - 0x7c]
mov ecx, edx
adc ecx, dword [ebp - 0x78]
push edx
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
mov dword [ebp - 0x14c], edx
call fcn.004adb00
push dword [ebp - 0x14c]
push esi
push edx
push eax
call fcn.004adbb0
push 0
push 0x200
push edx
push eax
call fcn.004adb00
add edi, dword [ebp + 0x28]
push edx
adc ebx, dword [ebp + 0x2c]
push eax
push ebx
push edi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], edx
call fcn.004afea0
mov esi, dword [ebp + 0x4c]
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp - 0x70], 0
mov byte [ebp + 0x56], 0
mov byte [ebp + 0x3b], 0
mov byte [ebp + 0x12], 0
jl 0x467288
jg 0x467180
cmp dword [ebp - 0x74], 0
jbe 0x467288
mov ecx, dword [ebp + 0x28]
sub ecx, dword [ebp - 0xe4]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x2c]
sbb edi, dword [ebp - 0xe0]
add ecx, dword [ebp + 0x48]
cdq
push edx
push eax
adc edi, esi
push edi
push ecx
call fcn.004adb00
and dword [ebp - 0x1c8], 0
mov ebx, eax
xor eax, eax
push 1
push dword [ebp + 0x58]
lea edi, [ebp - 0x1c4]
push dword [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1a8]
lea eax, [ebp + 0x12]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x56]
push eax
push dword [ebp - 0x1a4]
mov dword [ebp - 0x74], ebx
push edi
mov dword [ebp - 0x70], edx
call fcn.004425c2
mov al, byte [ebp + 0x3b]
add esp, 0x20
push 1
push dword [ebp + 0x58]
mov byte [ebp - 0x1c7], al
mov al, byte [ebp + 0x12]
push dword [ebp + 0x3c]
mov byte [ebp - 0x1c6], al
mov al, byte [ebp + 0x56]
mov byte [ebp - 0x1c5], al
lea eax, [ebp + 0x12]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x56]
push eax
push 0
push 2
push dword [ebp - 0x1a4]
mov byte [ebp - 0x1c8], 0
push edi
call fcn.004adbb0
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.004425c2
mov al, byte [ebp + 0x3b]
mov byte [ebp - 0x1c3], al
mov al, byte [ebp + 0x12]
mov byte [ebp - 0x1c2], al
mov al, byte [ebp + 0x56]
push 1
mov byte [ebp - 0x1c1], al
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp - 0x160]
mov byte [ebp - 0x1c4], 5
push dword [ebp - 0x164]
mov dword [ebp - 0x1c0], edi
push dword [ebp + 0x6c]
mov dword [ebp - 0x1bc], ebx
call fcn.00453ce2
add esp, 0x34
mov eax, dword [ebp + 0x14]
cdq
mov ebx, edx
push ebx
mov edi, eax
push edi
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
call fcn.004adb00
test esi, esi
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], edx
jl 0x4672d7
jg 0x4672bc
xor eax, eax
cmp dword [ebp + 0x48], eax
jb 0x4672d9
push ebx
push edi
push esi
push dword [ebp + 0x48]
call fcn.004adb00
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], edx
xor eax, eax
jmp 0x4672e5
xor eax, eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp + 0x2c], eax
jl 0x467306
jg 0x4672f1
cmp dword [ebp + 0x28], eax
jb 0x467306
push ebx
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
call fcn.004adb00
mov dword [ebp - 0x118], edx
jmp 0x46730c
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
xor eax, eax
cmp dword [ebp + 0x60], 4
mov ebx, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xf4]
setge al
push eax
push dword [ebp + 0x58]
lea eax, [ebp + 0x13]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x120]
push eax
push ebx
push edi
call fcn.004425c2
add esp, 0x20
test esi, esi
jl 0x46736b
jg 0x467353
cmp dword [ebp + 0x48], 0
jbe 0x46736b
sub edi, dword [ebp - 0x1dc]
sbb ebx, dword [ebp - 0x1d8]
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0xf0], ebx
mov al, byte [ebp - 0x5c]
mov byte [ebp + 0x56], al
movsx eax, al
push eax
push dword [ebp + 0x58]
lea eax, [ebp - 0x53]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x5a]
push eax
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x11c]
lea eax, [edi + eax - 1]
push 0
push eax
call fcn.004425c2
add esp, 0x20
lea ecx, [ebp - 0x2c]
call fcn.0043e679
mov edi, dword [ebp + 0x30]
mov esi, dword [ebp + 0x24]
shl edi, 4
cmp byte [ebp + 0x5f], 2
lea ebx, [edi + esi]
je 0x46949a
push dword [ebp + 0x40]
push esi
push dword [ebp - 0x28]
call fcn.00414409
add esp, 0xc
cmp dword [ebp - 0x70], 0
jl 0x467409
jg 0x4673da
cmp dword [ebp - 0x74], 0
jb 0x467409
cmp dword [ebp + 0x30], 0
jle 0x4673f2
push edi
push 0
add esi, 0x1be
push esi
call fcn.004adaa0
add esp, 0xc
push 0x30
pop eax
sub eax, edi
push eax
lea eax, [ebx + 0x1ce]
push 0
push eax
call fcn.004adaa0
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov al, byte [ebx + 0x1c2]
jne 0x467423
cmp byte [ebp + 0x11], 2
jge 0x467423
cmp al, 5
je 0x46749b
cmp al, 0xf
je 0x46749b
cmp byte [ebp + 0x6a], 0
mov esi, dword [ebx + 0x1c6]
mov edi, dword [ebx + 0x1ca]
jne 0x4674dd
test al, al
je 0x4674dd
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x4674df
cmp byte [ebp + 0x11], 2
jge 0x4674df
cmp byte [ebp - 0x5c], al
jne 0x4674df
cmp dword [ebp + 0x4c], eax
jl 0x46747b
jg 0x46746b
cmp dword [ebp + 0x48], eax
jb 0x46747b
cmp dword [ebp - 0xf4], esi
jne 0x46749b
cmp dword [ebp - 0xf0], eax
jne 0x46749b
cmp dword [ebp + 0x2c], eax
jl 0x4674df
jg 0x467487
cmp dword [ebp + 0x28], eax
jb 0x4674df
cmp dword [ebp - 0x11c], edi
jne 0x467497
cmp dword [ebp - 0x118], eax
je 0x4674df
cmp edi, eax
je 0x4674df
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
test eax, eax
je 0x4674d3
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0x80070057
jmp 0x469838
xor eax, eax
cmp byte [ebp + 0x10], 0
je 0x467501
xor edi, edi
xor esi, esi
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, eax
jl 0x46750e
mov byte [ebx + 0x1c2], cl
mov ecx, dword [ebp - 0x88]
cmp cx, ax
jle 0x46753b
cmp dword [ebp - 0xd0], eax
je 0x46753b
mov edx, dword [ebp + 0x24]
lea eax, [edx + 0x1be]
mov byte [eax + 0x30], 0
mov byte [eax + 0x20], 0
mov byte [eax + 0x10], 0
mov byte [eax], 0
jmp 0x46753e
mov edx, dword [ebp + 0x24]
test cx, cx
jl 0x467549
mov byte [ebx + 0x1be], cl
cmp dword [ebp + 0x4c], 0
jg 0x467579
jl 0x467557
cmp dword [ebp + 0x48], 0
jae 0x467579
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x467605
jg 0x46756d
cmp dword [ebp + 0x28], eax
jb 0x467605
mov eax, dword [ebp - 0x11c]
lea eax, [eax + esi - 1]
jmp 0x467591
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x4675c1
jl 0x467587
cmp dword [ebp + 0x28], eax
jae 0x4675c1
mov eax, dword [ebp - 0xf4]
lea eax, [eax + edi - 1]
movsx ecx, byte [ebp + 0x56]
push ecx
push dword [ebp + 0x58]
lea ecx, [ebp - 0x53]
push dword [ebp + 0x3c]
push ecx
lea ecx, [ebp - 0x5a]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push 0
push eax
call fcn.004425c2
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp + 0x24]
add esp, 0x20
xor eax, eax
cmp dword [ebp + 0x4c], eax
jl 0x4675f9
jg 0x4675cd
cmp dword [ebp + 0x48], eax
jb 0x4675f9
mov al, byte [ebp - 0x3d]
mov byte [ebx + 0x1bf], al
mov al, byte [ebp + 0x13]
mov byte [ebx + 0x1c0], al
mov al, byte [ebp - 0x120]
mov byte [ebx + 0x1c1], al
mov eax, dword [ebp - 0xf4]
mov dword [ebx + 0x1c6], eax
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x467611
jl 0x467605
cmp dword [ebp + 0x28], eax
jae 0x467611
cmp dword [ebp + 0x4c], eax
jl 0x467631
jg 0x467611
cmp dword [ebp + 0x48], eax
jb 0x467631
mov al, byte [ebp - 0x5a]
mov byte [ebx + 0x1c3], al
mov al, byte [ebp - 0x53]
mov byte [ebx + 0x1c4], al
mov al, byte [ebp - 0x90]
mov byte [ebx + 0x1c5], al
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x467649
jg 0x46763d
cmp dword [ebp + 0x28], eax
jb 0x467649
mov esi, dword [ebp - 0x11c]
mov dword [ebx + 0x1ca], esi
cmp dword [ebp - 0x60], eax
jge 0x46766b
cmp cx, ax
jge 0x46766b
cmp dword [ebp + 0x4c], eax
jg 0x46766b
jl 0x46765f
cmp dword [ebp + 0x48], eax
jae 0x46766b
cmp dword [ebp + 0x2c], eax
jl 0x467679
jg 0x46766b
cmp dword [ebp + 0x28], eax
jb 0x467679
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
cmp cx, ax
jge 0x4676a9
cmp dword [ebp - 0x60], eax
jge 0x4676a9
cmp dword [ebp + 0x4c], eax
jg 0x4676a9
jl 0x46768f
cmp dword [ebp + 0x48], eax
jae 0x4676a9
cmp dword [ebp + 0x2c], eax
jg 0x4676a9
jl 0x46769b
cmp dword [ebp + 0x28], eax
jae 0x4676a9
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
xor esi, esi
push esi
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x10
cmp eax, dword [ebp - 0x128]
jne 0x46964a
cmp edx, dword [ebp - 0x124]
jne 0x46964a
mov eax, dword [ebp - 0x174]
or eax, dword [ebp - 0x170]
mov dword [ebp + 0x34], 1
jne 0x4676f9
push dword [ebp + 0x24]
call fcn.0044268f
pop ecx
push dword [ebp + 0x40]
mov edi, dword [ebp + 0x24]
push edi
push dword [ebp - 0x28]
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x46772d
push esi
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x34], eax
call fcn.0044263c
pop ecx
cmp dword [ebp + 0x4c], esi
mov eax, dword [edi + 0x1b8]
mov dword [ebp - 0x1c], eax
jl 0x467832
jg 0x46774e
cmp dword [ebp + 0x48], 0x200
jb 0x467832
cmp dword [ebp + 0x2c], 0
jl 0x467832
jg 0x467767
cmp dword [ebp + 0x28], 0x200
jbe 0x467832
cmp byte [ebp - 0x91], 0
jle 0x467832
push dword [ebp + 0x40]
push 0
push dword [ebp + 0x24]
call fcn.004adaa0
add esp, 0xc
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004adbb0
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov esi, eax
add ebx, esi
push 0
adc edi, edx
push edi
push ebx
push dword [ebp + 0x6c]
mov dword [ebp - 0x210], edx
call fcn.0043f9d0
add esp, 0x10
cmp eax, esi
jne 0x46782e
cmp edx, dword [ebp - 0x210]
jne 0x46782e
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
push dword [ebp - 0x28]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [ebp + 0x34], eax
je 0x46782e
mov eax, dword [ebp + 0x40]
cmp dword [ebp - 0x50], eax
jne 0x46782e
and dword [ebp + 0x34], 0
xor eax, eax
cmp dword [ebp + 0x34], eax
sete al
cmp byte [ebp + 0xb], 0
mov dword [ebp], eax
je 0x4678b6
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004adbb0
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
push eax
push edx
push ecx
add esi, 0x1b8
push str._04X_04X_04X
push dword [ebp + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0xc
push esi
push 3
push dword [ebp + 0x24]
mov edi, 0x80000002
push str.SYSTEMMountedDevices
push edi
call dword [0x4dc264]
cmp byte [ebp + 0x69], 0
jne 0x4678ac
cmp byte [ebp + 0x6b], 0
jne 0x4678ac
cmp byte [ebp + 0x47], 0
je 0x4697fd
cmp dword [ebp - 4], 0
jge 0x469685
cmp byte [ebp + 0x69], 0
jne 0x4678cc
cmp byte [ebp + 0x6b], 0
jne 0x4678cc
cmp byte [ebp + 0x47], 0
je 0x4697fd
and dword [ebp + 0x58], 0
jmp 0x468702
cmp byte [ebp + 0x10], 0
je 0x4678df
mov byte [ebp - 0x3e], 0
cmp byte [ebp + 0x56], 0
je 0x4678f3
cmp byte [ebp + 0x57], 0
jne 0x4678f3
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x24], eax
jmp 0x4678fa
mov dword [ebp + 0x24], 0x80
mov eax, dword [ebp + 0x14]
cdq
mov edi, edx
push edi
mov esi, eax
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004adb00
push edi
push esi
push dword [ebp - 0xf8]
mov dword [ebp + 0x48], eax
push dword [ebp - 0xfc]
mov dword [ebp + 0x4c], edx
call fcn.004adb00
push edi
push esi
push dword [ebp + 0x2c]
mov dword [ebp - 0xfc], eax
push dword [ebp + 0x28]
mov dword [ebp - 0xf8], edx
call fcn.004adb00
mov esi, eax
sub esi, 1
mov edi, edx
sbb edi, 0
cmp byte [ebp - 0x43], 0
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], edi
je 0x46797f
mov esi, eax
add esi, dword [ebp + 0x48]
mov edi, edx
adc edi, dword [ebp + 0x4c]
sub esi, 1
sbb edi, 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], edi
and dword [ebp - 0xdc], 0
and dword [ebp - 0xd8], 0
cmp byte [ebp + 0x57], 1
jne 0x467a0b
test byte [ebp - 0x51], 0x10
je 0x4679bd
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xf8]
mov esi, eax
sub esi, 1
mov edi, ecx
sbb edi, 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], edi
jmp 0x4679c9
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
cmp dword [ebp + 0x4c], 0
jg 0x4679e2
jl 0x4679d7
cmp dword [ebp + 0x48], 1
jae 0x4679e2
and dword [ebp + 0x4c], 0
mov dword [ebp + 0x48], 1
test edi, edi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], edi
jg 0x467a11
jl 0x4679f9
cmp esi, 1
jae 0x467a11
sub eax, 1
sbb ecx, 0
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], ecx
cmp byte [ebp + 0x57], 0
je 0x467a19
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x4c]
jmp 0x467a1d
xor eax, eax
xor ecx, ecx
push dword [ebp - 0x34]
lea edx, [ebp - 0xdc]
push dword [ebp - 0x38]
push edx
push ecx
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x6c]
push dword [ebp + 0x24]
push dword [ebp + 0x18]
push eax
call fcn.00449ab4
add esp, 0x24
cmp byte [ebp + 0x56], 0
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
jne 0x467a68
or eax, edx
jne 0x467a68
and dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], 1
cmp dword [ebp - 0xd8], 0
jl 0x46749b
jg 0x467a84
cmp dword [ebp - 0xdc], 0x20
jb 0x46749b
cmp byte [ebp + 0x5f], 2
mov eax, dword [ebp + 0x24]
je 0x469873
cmp dword [ebp + 0x60], eax
mov dword [ebp + 0x14], 1
jae 0x467ac5
cmp dword [ebp - 0x68], eax
jge 0x467ac5
cmp dword [ebp + 0x60], 0
jl 0x467ac9
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x10]
push 0x10
push 0x4c7350
push eax
call fcn.00445104
add esp, 0xc
test eax, eax
je 0x467ac9
and dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x40]
xor edx, edx
lea eax, [ecx + 0x3fff]
div ecx
cmp byte [ebp + 0x57], 1
mov dword [ebp + 0x34], eax
jne 0x467e08
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x60], eax
jae 0x46749b
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x30], edx
mov edx, dword [ebp - 0x130]
shl eax, 7
inc edx
imul edx, ecx
mov ecx, 0x4800
sub ecx, edx
cmp byte [ebp - 9], 0
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x1c], ecx
jg 0x467b42
jge 0x467b2f
xor edx, edx
cmp dword [ebp - 0x34], edx
jg 0x467b42
jl 0x467b2f
mov edx, dword [ebp + 0x40]
lea edx, [edx + edx + 0x4000]
cmp dword [ebp - 0x38], edx
ja 0x467b42
xor edx, edx
test eax, eax
mov byte [ebp + 0x13], 0
mov dword [ebp - 0x28], edx
jle 0x467be5
jmp 0x467b94
cmp dword [ebp + 0x40], 0x200
mov byte [ebp + 0x13], 1
jbe 0x467b6b
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
mov eax, dword [ebp + 0x18]
add eax, 0x200
push 0
push eax
call fcn.004adaa0
add esp, 0xc
mov eax, dword [ebp + 0x40]
add eax, 0xffffffa4
push eax
lea eax, [ebx + 0x5c]
push 0
push eax
call fcn.004adaa0
push 0x4000
push 0
push dword [ebp - 0x10]
call fcn.004adaa0
add esp, 0x18
jmp 0x467be5
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jl 0x467bae
push 0x10
push 0
push dword [ebp + 0x30]
call fcn.004adaa0
add esp, 0xc
mov eax, 0x80
jmp 0x467bd7
push 0x1b0
push 0
push dword [ebp + 0x30]
call fcn.004adaa0
mov eax, dword [ebp + 0x30]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.004adaa0
add esp, 0x18
mov eax, 0x200
add dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
add dword [ebp + 0x30], eax
cmp edx, dword [ebp + 0xc]
jl 0x467b91
push 0x38
push 0
push ebx
call fcn.004adaa0
push 0x14
lea eax, [ebx + 0x48]
push 0
push eax
call fcn.004adaa0
mov eax, dword [ebp + 0x18]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.004adaa0
mov eax, dword [ebp + 0x18]
add esp, 0x24
cmp byte [ebp + 0x13], 0
mov word [eax + 0x1fe], 0xaa55
jne 0x467c32
cmp dword [ebp + 0x40], 0x200
jbe 0x467c32
mov word [ebx - 2], 0xaa55
push 8
push str.EFI_PART
push ebx
call fcn.00414409
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp - 0xdc]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x4c]
push dword [ebp + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x34]
cdq
mov dword [ebp - 0x110], eax
add eax, dword [ebp + 0x48]
mov dword [ebp - 0x10c], edx
adc edx, dword [ebp + 0x4c]
add eax, 1
adc edx, 0
mov dword [ebx + 0x20], ecx
sub ecx, dword [ebp - 0x110]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xd8]
sbb eax, dword [ebp - 0x10c]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], eax
call fcn.0044268f
lea eax, [ebx + 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0x10
cmp ecx, 0x20323354
jne 0x467cce
cmp edx, 0x2020
je 0x467d08
cmp ecx, 0x20363154
jne 0x467cde
cmp edx, 0x2020
je 0x467d08
mov esi, ecx
or esi, edx
je 0x467d02
cmp ecx, 0xffffffff
jne 0x467ced
cmp edx, ecx
je 0x467d02
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
mov esi, ecx
or esi, edx
je 0x467d02
cmp ecx, 0xffffffff
jne 0x467d26
cmp edx, ecx
jne 0x467d26
mov esi, dword [ebp - 0x104]
push 0xc
push 0x4ca644
push eax
call fcn.00414409
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x1b8]
add esp, 0xc
mov dword [ebx + 0x44], eax
jmp 0x467d2c
mov esi, dword [ebp - 0x104]
lea eax, [ebx - 0x174]
push eax
call fcn.0044268f
mov eax, dword [ebp + 0x48]
add eax, 1
pop ecx
mov ecx, dword [ebp + 0x4c]
adc ecx, 0
test edi, edi
mov dword [ebx + 0x48], eax
mov eax, 0x80
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
jg 0x467d6f
jl 0x467d61
cmp esi, 1
jae 0x467d6f
or dword [ebp - 0x104], 0xffffffff
or dword [ebp - 0x100], 0xffffffff
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x18]
push 1
push dword [ebp + 0x58]
shl eax, 4
push dword [ebp + 0x3c]
lea edi, [eax + ecx]
lea eax, [edi + 0x1bf]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push dword [ebp + 0x4c]
mov dword [edi + 0x1c2], 0xee
push dword [ebp + 0x48]
call fcn.004425c2
lea eax, [edi + 0x1c3]
add esp, 0x20
cmp byte [ebp + 0x55], 2
lea ecx, [eax + 1]
lea edx, [eax + 2]
mov byte [eax], 0xfe
mov byte [ecx], 0xff
mov byte [edx], 0xfe
jne 0x467de4
push 1
push dword [ebp + 0x58]
push dword [ebp + 0x3c]
push ecx
push eax
push edx
push dword [ebp - 0x100]
push dword [ebp - 0x104]
call fcn.004425c2
add esp, 0x20
mov eax, dword [ebp + 0x48]
mov dword [edi + 0x1c6], eax
add edi, 0x1ca
or dword [edi], 0xffffffff
cmp byte [ebp + 0x55], 2
jne 0x46811c
mov eax, dword [ebp - 0x104]
mov dword [edi], eax
cmp byte [ebp + 0x57], 0
jg 0x46811c
cmp byte [ebp - 0x5b], 0
jle 0x467e22
cmp dword [ebp + 0x60], 0
jl 0x46811c
cmp byte [ebp + 0x6a], 0
je 0x467e81
or dword [ebp + 0x60], 0xffffffff
xor esi, esi
cmp dword [ebp + 0x24], esi
mov byte [ebp - 0x3e], 0
jbe 0x467e81
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x90], eax
mov edi, 0x80
push 0x10
push 0x4c7350
push dword [ebp - 0x90]
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x467e6c
add dword [ebp - 0x90], edi
inc esi
cmp esi, dword [ebp + 0x24]
jb 0x467e45
jmp 0x467e81
mov dword [ebp + 0x60], esi
push edi
shl esi, 7
add esi, dword [ebp - 0x10]
push 0
push esi
call fcn.004adaa0
add esp, 0xc
mov eax, dword [ebp + 0x24]
dec dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
jae 0x46749b
cmp dword [ebp - 0x68], eax
jge 0x46749b
cmp byte [ebp - 0x3e], 0
je 0x467f99
xor ecx, ecx
cmp byte [ebp + 0x56], cl
je 0x467ef6
mov eax, dword [ebp - 0x10]
add eax, 0x20
cmp ecx, dword [ebp + 0x24]
jae 0x467ef6
mov edx, dword [eax]
cmp edx, dword [ebp + 0x48]
jne 0x467ec4
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x4c]
je 0x467ecc
inc ecx
add eax, 0x80
jmp 0x467eb0
mov edx, dword [ebp - 0x10]
mov eax, ecx
shl eax, 7
add eax, edx
cmp ecx, dword [ebp + 0x60]
mov esi, 0x4c7350
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x467ef6
push 0x80
push 0
push eax
call fcn.004adaa0
add esp, 0xc
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x10]
shl eax, 7
push 0x10
add eax, ecx
push 0x4c7350
push eax
mov dword [ebp - 0x1c], eax
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x467f83
mov edi, dword [ebp + 0x60]
inc edi
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jae 0x46749b
mov esi, edi
shl esi, 7
add esi, dword [ebp - 0x10]
push 0x10
push 0x4c7350
push esi
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x467f55
inc edi
add esi, 0x80
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jb 0x467f30
jmp 0x467f77
cmp edi, dword [ebp + 0x60]
jle 0x467f77
mov eax, dword [ebp + 0x3c]
mov edi, eax
shl edi, 7
add edi, dword [ebp - 0x10]
sub eax, dword [ebp + 0x60]
dec eax
lea edx, [edi - 0x80]
push 0x20
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, edx
jne 0x467f68
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x3c], eax
jae 0x46749b
push 0x80
push 0
push dword [ebp - 0x1c]
call fcn.004adaa0
add esp, 0xc
and dword [ebp + 0x14], 0
cmp byte [ebp + 0x57], 1
je 0x4680fd
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp eax, ecx
jge 0x4680b6
cmp dword [ebp + 0x14], ecx
jne 0x467fdc
xor eax, eax
inc eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x18c], ecx
jle 0x467ff9
mov edi, dword [ebp + 0x60]
shl edi, 7
add edi, dword [ebp - 0x10]
lea esi, [ebp - 0x1b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x180], ecx
jle 0x46801a
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x10]
shl eax, 7
lea edi, [eax + ecx + 0x10]
lea esi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x194], ecx
mov eax, dword [ebp - 0x10]
jle 0x468039
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x48]
shl edx, 7
mov dword [edx + eax + 0x20], esi
mov esi, dword [ebp + 0x4c]
mov dword [edx + eax + 0x24], esi
cmp dword [ebp - 0x184], ecx
jle 0x46805b
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x104]
shl edx, 7
mov dword [edx + eax + 0x28], esi
mov esi, dword [ebp - 0x100]
mov dword [edx + eax + 0x2c], esi
cmp dword [ebp - 0x190], ecx
jle 0x46807d
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x16c]
shl edx, 7
mov dword [edx + eax + 0x30], esi
mov esi, dword [ebp - 0x168]
mov dword [edx + eax + 0x34], esi
cmp dword [ebp - 0x188], ecx
jle 0x4680fd
mov eax, dword [ebp - 0x48]
cmp word [eax], 0
je 0x4680fd
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x10]
shl eax, 7
push 0x48
lea esi, [eax + ecx + 0x38]
push 0
push esi
call fcn.004adaa0
add esp, 0xc
push 0x24
push dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x4680fd
cmp eax, dword [ebp + 0x60]
je 0x4680fd
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp - 0x10]
shl ecx, 7
lea edx, [ecx + eax]
push 0x20
pop ecx
mov esi, edx
lea edi, [ebp - 0x354]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x68]
shl ecx, 7
add eax, ecx
push 0x20
pop ecx
mov esi, eax
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
push 0x20
pop ecx
lea esi, [ebp - 0x354]
rep movsd dword es:[edi], dword [esi]
jge 0x4680fd
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x10], 0
je 0x46811c
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x10]
push 0x80
push 0
push eax
call fcn.004adaa0
add esp, 0xc
mov al, byte [ebp + 0xb]
and dword [ebp + 0x14], 0
and al, 0x20
mov byte [ebp - 0x3d], al
je 0x468135
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x120], eax
jmp 0x46813f
mov dword [ebp - 0x120], 0xfffffff8
cmp byte [ebp - 0x5b], 1
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x1c], eax
jne 0x468279
cmp byte [ebp + 0x57], 1
je 0x468279
mov eax, dword [ebp + 0x24]
xor esi, esi
dec eax
cmp eax, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x90], esi
jl 0x468279
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x58], eax
xor edi, edi
push 0x10
push 0x4c7350
push dword [ebp + 0x30]
call fcn.00445104
add esp, 0xc
test al, al
mov byte [ebp + 0x13], al
jne 0x4681a2
cmp esi, dword [ebp - 0x28]
mov dword [ebp + 0xc], edi
je 0x4681a9
mov dword [ebp + 0xc], 1
cmp esi, dword [ebp - 0x120]
mov dword [ebp + 0x3c], edi
jne 0x4681c1
mov eax, dword [ebp - 0x28]
mov dword [ebp + 0x3c], 2
mov dword [ebp - 0x1c], eax
cmp byte [ebp + 0x13], 0
jne 0x46822e
cmp esi, dword [ebp - 0x28]
je 0x468222
push 0x38
push dword [ebp + 0x30]
push dword [ebp + 0x58]
call fcn.004b0030
add esp, 0xc
test eax, eax
je 0x4681f7
push 0x38
push dword [ebp + 0x30]
mov dword [ebp + 0x3c], 1
push dword [ebp + 0x58]
call fcn.004ae150
add esp, 0xc
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x58]
push 0x24
add esi, 0x38
push esi
add edi, 0x38
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
je 0x468222
push 0x24
push esi
push edi
mov dword [ebp + 0x3c], 1
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
inc dword [ebp - 0x28]
add dword [ebp + 0x58], 0x80
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x46824e
cmp byte [ebp + 0x13], 0
jne 0x46824e
push 0x10
push edi
push dword [ebp + 0x30]
mov dword [ebp + 0x3c], 1
call fcn.004adaa0
add esp, 0xc
cmp dword [ebp + 0x3c], edi
mov esi, dword [ebp - 0x90]
je 0x46825f
lea eax, [esi + 1]
mov dword [ebp + 0x14], eax
add dword [ebp + 0x30], 0x80
inc esi
cmp esi, dword [ebp - 0x108]
mov dword [ebp - 0x90], esi
jle 0x468181
push 8
push str.EFI_PART
push ebx
call fcn.00414409
push dword [ebp + 0x18]
call fcn.0044268f
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, eax
add esp, 0x10
or edx, ecx
je 0x4682a6
cmp eax, 0xffffffff
jne 0x4682b3
cmp ecx, eax
jne 0x4682b3
lea eax, [ebx - 0x174]
push eax
call fcn.0044268f
pop ecx
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x14], eax
jg 0x4682bf
inc eax
mov dword [ebp + 0x14], eax
cmp byte [ebp + 0x57], 1
jne 0x4682cb
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x24]
xor edi, edi
push edi
shl eax, 7
push edi
push eax
push dword [ebp - 0x10]
call fcn.0049a174
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0xc]
add esp, 0x10
cmp eax, 0x20000
mov dword [ebp - 0x28], eax
ja 0x469a4c
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.0049a174
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x10]
push ebx
add esi, 0x10000
push esi
mov dword [ebx + 0x10], eax
call fcn.00414409
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x24], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [esi + 0x10], edi
push esi
call fcn.0049a174
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x34]
mov esi, dword [ebp + 0x40]
add esp, 0x2c
inc eax
imul eax, esi
push eax
lea ecx, [ebp - 0x80]
call fcn.00402d17
mov eax, dword [ebp - 0x80]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x14]
shl eax, 7
lea eax, [eax + esi - 1]
xor edx, edx
div esi
push edi
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x38]
imul eax, esi
mov dword [ebp - 0x108], eax
call fcn.0040f75d
push esi
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cca
push esi
push dword [ebp + 0x18]
push dword [ebp - 0x80]
call fcn.004b0030
add esp, 0xc
test eax, eax
je 0x4683c2
push edi
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x38]
call fcn.0040f75d
push esi
push dword [ebp + 0x18]
lea ecx, [ebp + 0x6c]
call fcn.0043e4b5
mov eax, dword [ebp - 0x108]
xor edx, edx
div esi
mov ecx, dword [ebp - 0x12c]
push edi
xor edx, edx
push edx
push esi
push ecx
mov dword [ebp + 0x40], ebx
mov dword [ebp - 0x98], ecx
inc eax
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0x130]
push eax
mov dword [ebp - 0x9c], eax
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
mov eax, dword [ebp + 0x30]
imul eax, esi
push eax
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cca
cmp dword [ebp + 0x30], edi
mov dword [ebp + 0x3c], edi
jle 0x4684ff
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x30]
jge 0x468461
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0030
add esp, 0xc
test eax, eax
jne 0x46845e
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x30]
jl 0x46842d
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x34]
jge 0x4684ff
mov ecx, dword [ebp + 0x40]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x20c], ecx
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x208], ecx
jmp 0x4684b6
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0030
add esp, 0xc
test eax, eax
je 0x4684bb
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x30]
jl 0x46848a
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x208]
push dword [ebp - 0x20c]
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.0043e4b5
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jl 0x468425
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp - 0xdc]
cdq
sub ecx, eax
mov eax, dword [ebp - 0xd8]
sbb eax, edx
mov edx, dword [ebp - 0x80]
mov dword [ebp + 0x58], edx
mov edx, dword [ebp - 0x10]
push edi
mov dword [ebp + 0x40], edx
xor edx, edx
push edx
push esi
push eax
push ecx
mov dword [ebp - 0x204], ecx
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], eax
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
mov eax, dword [ebp + 0x34]
imul eax, esi
push eax
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cca
cmp dword [ebp + 0x34], edi
mov dword [ebp + 0x3c], edi
jle 0x46864d
mov eax, dword [ebp + 0x34]
cmp dword [ebp + 0x3c], eax
jge 0x46864d
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0030
add esp, 0xc
test eax, eax
jne 0x4685ae
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x34]
jl 0x46857d
mov eax, dword [ebp + 0x34]
cmp dword [ebp + 0x3c], eax
jge 0x46864d
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1e0], eax
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0030
add esp, 0xc
test eax, eax
je 0x468609
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x34]
jl 0x4685d8
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x1e0]
push dword [ebp - 0x1e4]
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.0043e4b5
mov eax, dword [ebp + 0x34]
cmp dword [ebp + 0x3c], eax
jl 0x468571
xor eax, eax
push eax
push esi
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
call fcn.004adbb0
add eax, dword [ebp - 0x38]
push edi
adc edx, dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
push edx
push eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], edx
call fcn.0040f75d
push esi
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cca
mov eax, dword [ebp - 0x10]
add eax, 0x10000
push esi
push eax
push dword [ebp - 0x80]
mov dword [ebp + 0x14], eax
call fcn.004b0030
add esp, 0xc
test eax, eax
je 0x4686c8
push edi
push dword [ebp - 0x1e8]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x1ec]
call fcn.0040f75d
push esi
push dword [ebp + 0x14]
lea ecx, [ebp + 0x6c]
call fcn.0043e4b5
movsx ecx, byte [ebp + 0x69]
movsx eax, byte [ebp + 0x6b]
or eax, ecx
movsx ecx, byte [ebp + 0x47]
or eax, ecx
cmp byte [ebp - 0x3d], 0
je 0x4686ef
cmp eax, edi
je 0x469c7c
cmp dword [ebp - 4], edi
jge 0x469a80
cmp eax, edi
je 0x469c7c
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x58], edi
call fcn.0043e679
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
xor cl, cl
cmp byte [ebp + 0x54], cl
je 0x468727
cmp dword [ebp + 0x58], 0
jne 0x468735
mov al, byte [ebp + 0x68]
cmp al, 0x10
mov cl, 0x40
jne 0x468738
add cl, 0x20
jmp 0x468738
mov al, byte [ebp + 0x68]
cmp dword [ebp - 4], 0
jl 0x468779
cmp al, 0x20
je 0x468746
cmp al, 0x10
jne 0x46874c
cmp dword [ebp - 0x58], 0xb
je 0x468770
test byte [ebp + 0x69], 0x20
jne 0x468770
cmp byte [ebp - 0x21], 0
jg 0x4687a2
cmp byte [ebp - 0x21], 0
jg 0x4687a2
cmp byte [ebp + 0x47], 0
jne 0x468793
cmp al, 1
je 0x468793
or cl, 2
cmp al, 1
je 0x46879e
test byte [ebp + 0x6b], 0x20
jne 0x4687be
cmp byte [ebp + 0x6b], 0
je 0x4687b4
or cl, 8
push dword [ebp - 0x30]
movsx eax, cl
or dword [ebp - 0x14], eax
lea eax, [ebp]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x6c]
push dword [ebp - 4]
push eax
call fcn.00454075
mov edi, eax
add esp, 0x18
test edi, edi
jl 0x465f7c
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
test eax, eax
je 0x469838
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x469838
cmp dword [ebp - 0x18], ebx
jge 0x468843
mov eax, dword [ebp - 0xd4]
cmp word [eax], bx
jne 0x468843
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
jmp 0x4674ca
mov edi, 0x1b8
mov dword [ebp + 0x58], edi
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
cmp word [ecx], bx
je 0x46899f
push dword [ebp - 0x20]
push 0x4ca640
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x46899f
push dword [ebp - 0x20]
push 0x4c6438
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x46899f
mov edi, dword [ebp - 0x20]
push edi
push 0x4ca63c
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x4688bb
mov dword [ebp - 0x3c], 0x4da380
mov dword [ebp + 0x58], 0x190
jmp 0x4689bb
push edi
push 0x4ca638
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x4688df
mov dword [ebp - 0x3c], 0x4da510
mov dword [ebp + 0x58], 0x180
jmp 0x4689bb
mov dword [ebp + 0x58], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
jne 0x468916
lea eax, [ebp - 0xa4]
push eax
inc edi
lea eax, [ebp - 0x20]
inc edi
push eax
mov dword [ebp - 0x20], edi
call fcn.0044a751
mov edi, dword [ebp - 0x20]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x468916
inc edi
inc edi
cmp word [edi], 0x23
jne 0x468954
push edi
lea ecx, [ebp + 0xc]
call fcn.0044e66d
push ebx
lea eax, [ebp - 0x1a0]
push eax
push str.EXEDATA
push dword [ebp + 0xc]
push ebx
call fcn.004153c9
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
call fcn.0043e679
mov eax, dword [ebp - 0x19c]
mov dword [ebp + 0x58], eax
jmp 0x46896b
lea eax, [ebp + 0x58]
push eax
push ebx
push edi
call fcn.00410068
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0xa0], ebx
jl 0x4689a9
jg 0x46897d
cmp dword [ebp - 0xa4], ebx
jb 0x4689a9
xor eax, eax
cmp eax, dword [ebp - 0xa0]
jl 0x4689a9
jg 0x468994
mov eax, dword [ebp + 0x58]
cmp eax, dword [ebp - 0xa4]
jbe 0x4689a9
mov eax, dword [ebp - 0xa4]
mov dword [ebp + 0x58], eax
jmp 0x4689a9
mov dword [ebp - 0x3c], 0x4da690
mov dword [ebp + 0x58], edi
cmp dword [ebp + 0x58], ebx
jbe 0x468b63
cmp dword [ebp - 0x3c], ebx
je 0x468b63
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405bea
cmp dword [ebp + 0x6c], ebx
je 0x468b63
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.00441fa2
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x4689f7
mov edi, esi
mov ecx, dword [ebp + 0x58]
lea eax, [edi - 1]
add ecx, eax
not eax
and ecx, eax
cmp ecx, edi
mov dword [ebp + 0x14], ecx
mov ebx, ecx
jge 0x468a0e
mov ebx, edi
lea eax, [edi + ebx*2]
push eax
lea ecx, [ebp - 0x48]
call fcn.00444cdb
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc4]
lea esi, [edi - 1]
add eax, edi
not esi
and esi, eax
xor eax, eax
xor edx, edx
or ecx, dword [ebp - 0xc0]
lea edi, [esi + ebx]
je 0x468a4d
push edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x10
cmp eax, dword [ebp - 0x38]
jne 0x468b3e
cmp edx, dword [ebp - 0x34]
jne 0x468b3e
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x468b3e
push dword [ebp + 0x14]
push edi
push esi
call fcn.00414409
mov ecx, dword [ebp + 0x58]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x468a95
mov ecx, eax
mov ebx, dword [ebp - 0x3c]
push ecx
push ebx
push edi
call fcn.00414409
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x58]
add esp, 0xc
cmp eax, 0x200
jbe 0x468ad7
add eax, 0xfffffe00
push eax
add ebx, 0x200
lea eax, [edi + 0x200]
push ebx
push eax
call fcn.00414409
add esp, 0xc
push dword [ebp + 0x14]
push edi
push esi
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x468b26
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x10
cmp eax, dword [ebp - 0x38]
jne 0x468b3e
cmp edx, dword [ebp - 0x34]
jne 0x468b3e
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.0044263c
test esi, esi
pop ecx
je 0x468b3e
lea ecx, [ebp - 0x48]
call fcn.0043e679
lea ecx, [ebp - 0x1a0]
call fcn.0043e679
jmp 0x469627
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x468b4b
inc edi
lea ecx, [ebp - 0x48]
call fcn.0043e679
lea ecx, [ebp - 0x1a0]
call fcn.0043e679
jmp 0x4687ee
lea ecx, [ebp - 0x1a0]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
jmp 0x469679
cmp dword [ebp + 0x60], ebx
jle 0x468827
cmp dword [ebp - 0x18], ebx
jge 0x468ba7
mov eax, dword [ebp - 0xd4]
cmp word [eax], bx
je 0x468827
xor eax, eax
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp + 0xc], esi
jge 0x468bc6
xor al, al
jne 0x468bee
jmp 0x468827
push dword [ebp - 0x64]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x60]
push dword [ebp - 0x18]
push eax
call fcn.00463c0b
add esp, 0x1c
cmp dword [ebp + 0xc], ebx
jle 0x468b6e
mov edi, dword [ebp - 0xcc]
mov dword [ebp - 0x20], 0x200
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
cmp word [edi], bx
je 0x468d87
push edi
push 0x4ca640
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x468d87
push edi
push 0x4c6438
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x468d87
push edi
push 0x4ca638
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x468c58
push 8
jmp 0x468d89
push edi
push str.nt6fat
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x468d83
push edi
push str.winfat
call fcn.0043fb03
test al, al
pop ecx
pop ecx
jne 0x468d83
push edi
push 0x4ca63c
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x468c9a
push 6
jmp 0x468d89
push edi
push str.nt5fat
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x468cb2
push 5
jmp 0x468d89
mov dword [ebp - 0x20], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
jne 0x468cf2
lea eax, [ebp - 0xa4]
push eax
inc edi
lea eax, [ebp - 0xcc]
inc edi
push eax
mov dword [ebp - 0xcc], edi
call fcn.0044a751
mov edi, dword [ebp - 0xcc]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x468cf2
inc edi
inc edi
cmp word [edi], 0x23
jne 0x468d30
push edi
lea ecx, [ebp + 0xc]
call fcn.0044e66d
push ebx
lea eax, [ebp - 0x154]
push eax
push str.EXEDATA
push dword [ebp + 0xc]
push ebx
call fcn.004153c9
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x58], eax
call fcn.0043e679
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x20], eax
jmp 0x468d47
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
call fcn.00410068
add esp, 0xc
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0xa0], ebx
jl 0x468d79
jg 0x468d59
cmp dword [ebp - 0xa4], ebx
jb 0x468d79
xor eax, eax
cmp eax, dword [ebp - 0xa0]
jl 0x468d79
jg 0x468d70
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xa4]
jbe 0x468d79
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x58], ebx
jne 0x468db2
jmp 0x468e25
push 7
jmp 0x468d89
push 9
pop eax
push ebx
lea ecx, [ebp - 0x154]
push ecx
push str.INDATA
push eax
push ebx
call fcn.004153c9
add esp, 0x14
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x58], eax
je 0x468e25
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jbe 0x468e25
cmp dword [ebp - 0x58], ebx
je 0x468e25
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405bea
cmp dword [ebp + 0x6c], ebx
je 0x468e25
push ebx
push 0x200
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
call fcn.004adbb0
mov esi, eax
add esi, dword [ebp - 0x110]
mov edi, edx
adc edi, dword [ebp - 0x10c]
push ebx
push edi
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], edi
call fcn.0043f9d0
add esp, 0x10
cmp eax, esi
jne 0x468e25
cmp edx, edi
je 0x468e30
lea ecx, [ebp - 0x154]
jmp 0x468b69
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.00441fa2
cmp eax, edi
pop ecx
pop ecx
jl 0x468e46
mov edi, eax
mov ecx, dword [ebp - 0x20]
lea eax, [edi - 1]
lea esi, [eax + ecx]
not eax
and esi, eax
lea eax, [edi + esi*2]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00444cdb
mov eax, dword [ebp - 0xd0]
lea ebx, [edi - 1]
add eax, edi
push 0
not ebx
and ebx, eax
lea eax, [ebp - 0x50]
push eax
push esi
lea edi, [ebx + esi]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x468ebb
lea ecx, [ebp - 0xd0]
call fcn.0043e679
lea ecx, [ebp - 0x154]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
test eax, eax
jmp 0x469679
push esi
push edi
push ebx
call fcn.00414409
push 0
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
push dword [ebp + 0x6c]
call fcn.0043f9d0
add esp, 0x1c
cmp eax, dword [ebp - 0xec]
jne 0x468e89
cmp edx, dword [ebp - 0xe8]
jne 0x468e89
mov eax, dword [ebp - 0x20]
push 3
push dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
push edi
call fcn.00414409
mov eax, 0x1fe
add esp, 0xc
cmp dword [ebp - 0x48], eax
jle 0x468f0d
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0xffffffe2
push eax
mov eax, dword [ebp - 0x58]
add eax, 0x1e
push eax
lea eax, [edi + 0x1e]
push eax
call fcn.00414409
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x200
jbe 0x468f5d
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x58]
add eax, 0x200
push eax
lea eax, [edi + 0x200]
push eax
call fcn.00414409
add esp, 0xc
push esi
push edi
push ebx
mov dword [ebp + 0x34], 1
call fcn.00445104
add esp, 0xc
test eax, eax
jne 0x468f8f
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x34], eax
call fcn.0044263c
pop ecx
xor eax, eax
cmp dword [ebp + 0x34], eax
lea ecx, [ebp - 0xd0]
sete al
mov edi, eax
call fcn.0043e679
lea ecx, [ebp - 0x154]
jmp 0x468b59
push 0x103c
lea ecx, [ebp + 0x1c]
call fcn.00444e77
mov ecx, dword [ebp - 0xbc]
mov esi, dword [ebp + 0x1c]
mov ax, word [ecx]
add esi, 0x2000
cmp ax, bx
mov edi, 0x4c2028
je 0x46901b
cmp word [ecx + 2], 0x3a
jne 0x46901b
movzx eax, ax
push eax
push 0x4ca610
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x46900f
cmp dword [ebp - 0x84], 0x10
jne 0x469066
mov edi, 0x4c1ff8
cmp eax, 5
jne 0x469066
mov edi, 0x4c2018
jmp 0x469066
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jl 0x469066
cmp dword [ebp - 0x84], 8
jne 0x46903f
push eax
push str..CDROM_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x4c2018
jmp 0x469063
cmp dword [ebp - 0x84], 0x10
jne 0x469056
and eax, 0xfff
mov esi, eax
mov edi, 0x4c1ff8
jmp 0x469066
push eax
push str..PhysicalDrive_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
movzx eax, word [ebp - 0xa8]
push edi
or eax, 0x20
push eax
push dword [ebp + 0x1c]
push esi
call fcn.004530af
mov ecx, dword [ebp - 0xb4]
add esp, 0x10
push dword [ebp + 0x1c]
push dword [ebp - 0xc8]
call fcn.0044451e
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
jmp 0x46963e
cmp byte [ebp - 0x3f], 0
je 0x4690bd
cmp dword [ebp - 4], ebx
jl 0x469d7f
mov al, byte [ebp - 0x40]
neg al
sbb eax, eax
and eax, 0x200000
or eax, dword [ebp - 4]
or eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00463105
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
xor eax, eax
cmp word [ecx], bx
sete al
mov dword [ebp], eax
jmp 0x469d7f
cmp dword [ebp - 4], ebx
jl 0x469127
cmp byte [ebp - 0x44], 0
je 0x4690fe
cmp dword [ebp + 0x60], ebx
jl 0x469127
push dword [ebp - 0x64]
movsx eax, byte [ebp - 0x40]
or eax, dword [ebp - 8]
push ebx
push ebx
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 4]
push eax
call fcn.00463c0b
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp], ecx
cmp dword [ebp - 0xb8], ebx
jle 0x469d9d
mov eax, dword [ebp - 0xb8]
and eax, 0x9fffffff
or eax, 0x10000000
mov dword [ebp - 0xb8], eax
jmp 0x469d7f
cmp dword [ebp - 0x18], ebx
jge 0x4691ac
cmp word [eax], bx
je 0x4691ac
cmp word [eax + 2], 0x3a
jne 0x4691a9
cmp word [eax + 4], bx
jne 0x4691a9
mov word [ebp - 0x2d4], 0x5c
mov word [ebp - 0x2d2], 0x5c
mov word [ebp - 0x2d0], 0x2e
mov word [ebp - 0x2ce], 0x5c
mov ax, word [eax]
mov word [ebp - 0x2cc], ax
mov word [ebp - 0x2ca], 0x3a
mov word [ebp - 0x2c8], bx
lea eax, [ebp - 0x2d4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jl 0x469d7f
cmp byte [ebp - 0x44], 0
je 0x4691c4
cmp dword [ebp + 0x60], ebx
jl 0x469d7f
push dword [ebp - 0x84]
lea eax, [ebp + 0x1c]
push dword [ebp - 4]
push eax
push dword [ebp - 0xb4]
call fcn.00453ad6
add esp, 0x10
jmp 0x4690e6
movzx edi, word [eax]
and edi, 0xffffffdf
cmp dword [ebp - 0x84], ebx
lea esi, [edi - 0x41]
jle 0x469261
push 0x3b60
lea ecx, [ebp + 0xc]
call fcn.00444cdb
mov eax, dword [ebp + 0xc]
mov ecx, edi
shl ecx, 0x10
or ecx, dword [ebp - 0x84]
lea ebx, [eax + 0x200]
push ecx
push eax
push ebx
call fcn.004534ce
imul esi, esi, 0x220
add esi, ebx
add esp, 0xc
cmp dword [esi + 8], 0
jle 0x469252
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.00444e77
push edi
push dword [esi + 4]
push str._d__c:
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
and dword [ebp], 0
lea ecx, [ebp + 0xc]
call fcn.0043e679
xor ebx, ebx
jmp 0x469d77
mov cx, word [eax]
mov edx, dword [ebp + 0x1c]
mov word [edx], cx
cmp word [eax], 0x5c
jne 0x469273
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
je 0x469d77
push dword [ebp - 0x64]
mov eax, dword [ebp - 8]
push ebx
and eax, 0xfffffffd
push ebx
or eax, 0xc
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 4]
push eax
call fcn.00463c0b
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp], ecx
jmp 0x469d77
cmp dword [ebp - 0x18], ebx
jge 0x469329
cmp word [eax], bx
je 0x469326
cmp word [eax + 2], 0x3a
jne 0x469314
cmp word [eax + 4], 0x5c
jne 0x4692d1
cmp word [eax + 6], bx
jne 0x4692d1
mov word [eax + 4], bx
cmp word [eax + 4], bx
jne 0x469314
push 9
lea ecx, [ebp + 0x50]
call fcn.00444e77
mov edi, dword [ebp + 0x50]
mov eax, dword [ebp - 0xbc]
mov word [edi], 0x5c
mov word [edi + 2], 0x5c
mov word [edi + 4], 0x2e
mov word [edi + 6], 0x5c
mov ax, word [eax]
mov word [edi + 8], ax
mov word [edi + 0xa], 0x3a
mov word [edi + 0xc], bx
jmp 0x469326
push esi
push dword [ebp - 0xbc]
lea ecx, [ebp + 0x50]
call fcn.00444f56
mov edi, dword [ebp + 0x50]
mov dword [ebp + 0x60], esi
cmp dword [ebp + 0x60], ebx
jg 0x469331
mov dword [ebp + 0x60], esi
test byte [ebp - 0x6a], 1
mov eax, dword [ebp + 0x60]
je 0x46933e
or dword [ebp - 8], 0x20
test word [ebp - 8], 0x402
je 0x469370
cmp dword [ebp - 0x18], ebx
jl 0x469370
cmp dword [ebp + 0x60], ebx
jle 0x469370
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
push dword [ebp + 0x60]
mov word [eax], bx
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00463c0b
add esp, 0x1c
mov ecx, dword [ebp - 8]
and eax, 0xf000ffff
shl ecx, 0x10
push edi
or eax, ecx
push eax
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00404ec1
add esp, 0x10
cmp eax, ebx
je 0x4693a1
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
mov dword [ebp], ebx
jne 0x469d77
mov dword [ebp], 0x80070057
jmp 0x469d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4697d9
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
jmp 0x465fc3
lea ecx, [ebp - 0x4c]
jmp 0x46961a
lea ecx, [ebp - 0x4c]
jmp 0x469488
lea ecx, [ebp - 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, esi
jmp 0x4674ca
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
jmp 0x468b6e
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
jmp 0x46982c
and eax, 0x10
shr eax, 4
mov edi, eax
jmp 0x4697c9
lea ecx, [ebp - 0x2c]
call fcn.0043e679
jmp 0x46749b
lea ecx, [ebp - 0x2c]
call fcn.0043e679
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
jmp 0x468e9f
push 0x28
lea ecx, [ebp + 0x1c]
call fcn.00444e77
mov esi, dword [ebp + 0x60]
mov ebx, dword [ebp + 0x1c]
xor ecx, ecx
test esi, esi
push 4
mov dword [ebp - 0xa8], 0x4c0a1c
pop eax
jl 0x4694d0
lea edx, [esi + 1]
cmp edx, eax
mov ecx, esi
jge 0x4694c8
mov eax, edx
cmp esi, eax
jge 0x4695dc
mov esi, dword [ebp + 0x24]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ecx + 1]
mov dword [ebp - 0x64], edx
mov edx, ecx
shl edx, 4
sub eax, ecx
lea esi, [edx + esi + 0x1c6]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x60], 0
mov al, byte [esi - 4]
mov byte [ebp - 0x43], al
jge 0x469542
cmp al, 5
je 0x469509
cmp al, 0xf
mov ecx, 0x4c0a1c
jne 0x46950e
mov ecx, 0x4ca60c
xor edx, edx
test al, al
setne dl
lea edx, [edx + edx - 1]
imul edx, dword [ebp - 0x64]
push edx
push ecx
push dword [ebp - 0xa8]
push str._s_s_d
push ebx
call edi
add esp, 0x14
lea ebx, [ebx + eax*2]
mov dword [ebp - 0xa8], 0x4c1548
jmp 0x4695cd
test al, al
je 0x4695cd
push dword [ebp - 0x64]
push dword [ebp - 0xa8]
push str._s_d
push ebx
call edi
add esp, 0x10
test byte [ebp - 8], 1
lea ebx, [ebx + eax*2]
mov eax, str._0x_X
jne 0x469571
mov eax, 0x4ca5dc
movzx ecx, byte [ebp - 0x43]
push ecx
push eax
push ebx
call edi
lea ebx, [ebx + eax*2]
movzx eax, byte [esi - 8]
shr eax, 7
push eax
push 0x4ca5dc
push ebx
call edi
lea ebx, [ebx + eax*2]
mov eax, dword [esi]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.0049b74b
add esp, 0x28
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2]
mov eax, dword [esi + 4]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.0049b74b
add esp, 0x10
inc dword [ebp - 0x64]
add esi, 0x10
dec dword [ebp + 0xc]
jne 0x4694f0
cmp dword [ebp - 0xb8], 0
jle 0x4695fb
push dword [ebp - 0xb8]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xb4]
call fcn.00449d48
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xb4]
push dword [ebp - 0xc8]
call fcn.0044451e
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
test eax, eax
je 0x46582f
push eax
jmp 0x465829
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, esi
je 0x465ed6
push eax
jmp 0x465ed0
push dword [ebp - 0x30]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x6c]
push dword [ebp - 4]
push eax
call fcn.00454075
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x60]
xor ebx, ebx
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x6c], ebx
jl 0x469783
mov ecx, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
inc eax
push eax
push dword [ebp - 4]
lea eax, [ebp + 0x1c]
push eax
mov word [ecx], bx
call fcn.00463c0b
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x108], eax
jle 0x469783
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x114], ebx
mov dword [ebp - 0x1c], eax
jle 0x4696f9
mov dword [ebp - 0x114], ebx
mov ebx, dword [ebp - 0x108]
push 0
or ebx, 0x100000
push ebx
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00404ec1
add esp, 0x10
test eax, eax
mov dword [ebp - 0x6c], eax
jne 0x46974d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x1388
ja 0x469747
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x6c]
lea ebx, [eax + 0x78]
add eax, 0x7a
push eax
mov word [ebx], 0x23
call fcn.0043e578
mov eax, dword [ebp + 0x24]
pop ecx
pop ecx
push 0xc
push esi
push 3
push ebx
push str.SYSTEMMountedDevices
push edi
mov word [eax + 0x7c], 0x3f
call dword [0x4dc264]
xor ebx, ebx
cmp dword [ebp - 0x114], ebx
jge 0x469796
cmp dword [ebp - 0x6c], ebx
je 0x4697bf
cmp dword [ebp - 0x114], ebx
jle 0x4697b0
cmp dword [ebp - 0x6c], ebx
jne 0x4697b0
mov ecx, dword [ebp - 0xb4]
push ebx
push ebx
push dword [ebp - 0x114]
call fcn.00415ff0
push dword [ebp + 0x24]
push str.SYSTEMMountedDevices
push edi
call dword [0x4dc268]
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jge 0x4697c9
mov edi, dword [ebp]
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
jmp 0x468805
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
test eax, eax
je 0x469835
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp]
lea ecx, [ebp - 0xd4]
call fcn.0043e679
lea ecx, [ebp - 0xc8]
call fcn.0043e679
lea ecx, [ebp - 0xbc]
call fcn.0043e679
lea ecx, [ebp - 0x1d4]
call fcn.0043e679
lea ecx, [ebp + 0x1c]
call fcn.0043e679
mov eax, edi
jmp 0x469e08
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea ecx, [ebp + 0x1c]
call fcn.00444e77
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x24]
xor ecx, ecx
test edx, edx
mov dword [ebp - 0xa8], 0x4c0a1c
jl 0x4698a3
mov ecx, edx
inc edx
cmp eax, edx
jle 0x4698a3
mov eax, edx
cmp ecx, eax
jge 0x469a13
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], edx
mov edx, ecx
shl edx, 7
add edx, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 0x48], edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
jne 0x4698dd
mov ecx, dword [eax + 8]
or ecx, dword [eax + 0xc]
je 0x469a00
cmp dword [ebp + 0x60], 0
push dword [ebp - 0x2c]
push dword [ebp - 0xa8]
jge 0x46990a
push str._s_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0xa8], 0x4c1548
jmp 0x4699fd
push 0x4ca5c0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x10]
lea esi, [esi + eax*2]
mov eax, dword [ebp + 0x60]
shl eax, 7
lea edi, [eax + ecx]
push 0
push edi
push esi
call fcn.004421ac
add esp, 0x1c
push esi
call ebx
lea esi, [esi + eax*2]
push str._GPT
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x200
push dword [edi + 0x24]
add esi, 0xa
push dword [edi + 0x20]
call fcn.004adbb0
push edx
push eax
push esi
call fcn.0049b796
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
inc esi
inc esi
sub eax, dword [edi + 0x20]
push 0
sbb ecx, dword [edi + 0x24]
add eax, 1
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.004adbb0
push edx
push eax
push esi
call fcn.0049b796
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push str._016I64X
push dword [edi + 0x34]
inc esi
push dword [edi + 0x30]
inc esi
push esi
call fcn.0049b74b
add esp, 0x10
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push 0
inc esi
add edi, 0x10
inc esi
push edi
push esi
call fcn.004421ac
add esp, 0xc
test byte [ebp - 8], 0x10
je 0x469a00
push esi
call ebx
push dword [ebp - 0x2c]
lea esi, [esi + eax*2]
mov word [esi], 0x20
inc esi
inc esi
push 0x4c12a0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
add dword [ebp - 0x48], 0x80
inc dword [ebp - 0x2c]
dec dword [ebp + 0xc]
jne 0x4698c7
xor edi, edi
cmp dword [ebp - 0xb8], edi
jle 0x469a33
push dword [ebp - 0xb8]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xb4]
call fcn.00449d48
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xb4]
push dword [ebp - 0xc8]
call fcn.0044451e
jmp 0x469c84
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, edi
jmp 0x4674ca
mov eax, dword [ebp - 0x1c]
shl eax, 7
mov dword [ebp - 0x108], eax
xor edx, edx
div esi
push dword [ebp - 0x30]
mov dword [ebp + 0xc], eax
lea eax, [ebp]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x6c]
push dword [ebp - 4]
push eax
call fcn.00454075
add esp, 0x18
push edi
push 0x20000000
push 3
push edi
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
mov dword [ebp - 0x1c], eax
call fcn.00405bea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x108]
lea eax, [ecx + eax + 0x30]
mov edx, dword [eax]
and byte [eax + 7], 0x7f
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
push edi
shl eax, 7
push edi
push eax
push ecx
mov dword [ebx + 0x58], edi
call fcn.0049a174
mov dword [ebx + 0x58], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.0049a174
push edi
xor ecx, ecx
push ecx
push dword [ebp - 0x28]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x14]
push eax
mov dword [eax + 0x10], edi
call fcn.0049a174
mov ecx, dword [ebp + 0x14]
add esp, 0x30
push edi
mov dword [ecx + 0x10], eax
xor eax, eax
push eax
push esi
push dword [ebp - 0x12c]
push dword [ebp - 0x130]
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043e4b5
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x110]
push edi
adc ecx, edx
add eax, 1
adc ecx, edi
mov dword [ebp - 0x10c], edx
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
imul ebx, esi
mov eax, dword [ebp - 0x10]
add ebx, eax
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043e4b5
mov eax, dword [ebp - 0x204]
add eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x200]
adc ecx, dword [ebp - 0x10c]
push edi
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043e4b5
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
call fcn.004adbb0
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f75d
push esi
push dword [ebp + 0x14]
lea ecx, [ebp + 0x6c]
call fcn.0043e4b5
push dword [ebp + 0x6c]
call fcn.00442654
cmp dword [ebp - 0x1c], edi
pop ecx
jl 0x469c33
mov esi, dword [ebp - 0x1c]
jmp 0x469c35
xor esi, esi
lea ecx, [ebp - 0x80]
call fcn.0043e679
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, edi
je 0x469c75
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
jmp 0x469838
lea ecx, [ebp - 0x80]
call fcn.0043e679
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, edi
jmp 0x468805
push 0x1000
lea ecx, [ebp + 0x1c]
call fcn.00444e77
cmp dword [ebp - 0x18], ebx
jl 0x469d4e
push 0x3b60
lea ecx, [ebp - 0x1c]
call fcn.00444cdb
mov edi, dword [ebp - 0x1c]
push 0x3960
lea esi, [edi + 0x200]
push ebx
push esi
call fcn.004adaa0
push dword [ebp - 0x84]
push edi
push esi
call fcn.004534ce
add esp, 0x18
xor edi, edi
lea eax, [esi + 4]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x18]
je 0x469d19
inc edi
add eax, 0x220
cmp edi, 0x1a
jle 0x469d05
jmp 0x469d44
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.00444e77
imul edi, edi, 0x220
add esi, edi
movzx eax, byte [esi + 0x10]
push eax
push dword [esi + 4]
push str._d___c_
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.0043e679
jmp 0x469d74
cmp byte [ebp - 0x3f], 0
jne 0x469d74
cmp byte [ebp + 0x5f], 4
mov eax, 0x4c2018
je 0x469d64
mov eax, 0x4c1ff8
push eax
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0x18]
call fcn.004530af
add esp, 0x10
mov dword [ebp], ebx
lea ecx, [ebp + 0x50]
call fcn.0043e679
cmp dword [ebp - 0xb8], ebx
jle 0x469d9d
push dword [ebp - 0xb8]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xb4]
call fcn.00449d48
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xb4]
push dword [ebp - 0xc8]
call fcn.0044451e
lea ecx, [ebp + 0x64]
call fcn.004426fb
lea ecx, [ebp + 0x6c]
call fcn.00402cb0
mov eax, 0x4dc8e0
cmp eax, ebx
je 0x469dd1
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0xd4]
call fcn.0043e679
lea ecx, [ebp - 0xc8]
call fcn.0043e679
lea ecx, [ebp - 0xbc]
call fcn.0043e679
lea ecx, [ebp - 0x1d4]
call fcn.0043e679
lea ecx, [ebp + 0x1c]
call fcn.0043e679
mov eax, dword [ebp]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8