Function at 0x4667d2
Capabilities:
Check for time delay via gettickcount
Encode data using base64
Get disk information
Inspect section memory permissions
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3d0
push ebx
push esi
lea eax, [ebp + 0x78]
push edi
push eax
mov dword [ebp - 0xc4], ecx
call fcn.0043fe57
pop ecx
push 5
lea ecx, [ebp + 0x1c]
call fcn.004465ac
push 0x14
lea ecx, [ebp - 0x1e0]
call fcn.004465ac
lea ecx, [ebp - 0xf0]
call fcn.0044658e
lea ecx, [ebp - 0xd0]
call fcn.0044658e
lea ecx, [ebp - 0xdc]
call fcn.0044658e
mov eax, dword [ebp + 0x78]
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 0x30], eax
push 0x2c
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xc], 0xfffc0000
mov dword [ebp + 0x60], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x64], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], esi
mov byte [ebp - 0x5d], bl
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x95], bl
mov byte [ebp - 0x9d], bl
mov byte [ebp + 0x51], bl
mov byte [ebp + 0x50], bl
mov byte [ebp - 0x3e], bl
mov byte [ebp - 0x9e], bl
mov byte [ebp + 7], bl
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x120], 0x1f4
call fcn.004494ac
mov eax, dword [ebp - 0xd0]
mov word [eax], bx
mov eax, dword [ebp - 0x30]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x466924
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x30], eax
push 0x2c
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004494ac
add esp, 0xc
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
mov byte [ebp + 0x13], 0
mov byte [ebp + 0x5b], 0
mov byte [ebp - 0x8e], 0xff
mov byte [ebp + 0x10], 0
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x8d], 0
mov byte [ebp + 0x23], 0
mov byte [ebp + 0x6a], 0
mov byte [ebp + 0x47], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x6b], 0
mov byte [ebp + 0x52], 0
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x29], 0xff
mov byte [ebp - 0x11], 0xff
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp + 8], ebx
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x21], 0
mov dword [ebp - 0x68], 0xfffff000
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0xc0], esi
je 0x467424
push 6
lea eax, [ebp + 0x78]
push eax
push str._admin
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4669d5
or byte [ebp + 0x13], 1
jmp 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4d0bbc
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4669f5
or byte [ebp + 0x13], 2
jmp 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push str._devid
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466a15
or byte [ebp - 0x7a], 1
jmp 0x467397
push 7
lea eax, [ebp + 0x78]
push eax
push str._devidx
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466a35
or byte [ebp - 0x7a], 2
jmp 0x467397
push 7
lea eax, [ebp + 0x78]
push eax
push str._devidn
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466a55
or byte [ebp - 0x7a], 8
jmp 0x467397
push 7
lea eax, [ebp + 0x78]
push eax
push str._devida
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466a75
or byte [ebp - 0x7a], 4
jmp 0x467397
push 4
lea eax, [ebp + 0x78]
push eax
push str._gui
call fcn.004485c7
add esp, 0xc
test al, al
jne 0x4673cf
push 4
lea eax, [ebp + 0x78]
push eax
push str._usb
call fcn.004485c7
add esp, 0xc
test al, al
jne 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push str._hextp
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466acb
or dword [ebp + 8], 1
jmp 0x467397
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._phy
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466aed
or dword [ebp + 8], 2
jmp 0x467397
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4d0b7c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466b0d
or dword [ebp + 8], 0x10
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._drv
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466b2c
or dword [ebp + 8], 8
jmp 0x467397
push 5
lea eax, [ebp + 0x78]
push eax
push str._fill
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466b4b
or dword [ebp + 8], edi
jmp 0x467397
push 5
lea eax, [ebp + 0x78]
push eax
push str._dvol
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466b6b
or byte [ebp + 9], 1
jmp 0x467397
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d0b60
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466b8b
mov byte [ebp + 0x47], 1
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._xup
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466baa
mov byte [ebp + 0x65], 1
jmp 0x467397
push 5
lea eax, [ebp + 0x78]
push eax
push str._axup
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466bca
mov byte [ebp + 0x65], 0x21
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._hup
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466be9
mov byte [ebp + 0x6b], 1
jmp 0x467397
push 5
lea eax, [ebp + 0x78]
push eax
push str._ahup
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466c09
mov byte [ebp + 0x6b], 0x21
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpt
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466c28
mov byte [ebp + 0x52], 1
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._gptmini
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466c47
mov byte [ebp + 0x52], 2
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpth
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466c66
mov byte [ebp + 0x52], 4
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._mbr
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466c88
mov byte [ebp - 0x9d], 1
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._cmp
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466ca7
mov byte [ebp - 0x52], 1
jmp 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4cbc7c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466cca
mov byte [ebp - 0x95], 1
jmp 0x467397
push 5
lea eax, [ebp + 0x78]
push eax
push str._fs0:
call fcn.004486ba
add esp, 0xc
test al, al
je 0x466cfc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 7], 0x10
call fcn.004429d6
pop ecx
pop ecx
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._fs0
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466d1b
mov byte [ebp + 7], 0x10
jmp 0x467397
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d0b08
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466d3e
mov byte [ebp - 0x9e], 1
jmp 0x467397
push 2
lea eax, [ebp + 0x78]
push eax
push 0x4d01cc
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466d64
add dword [ebp - 0x9c], 0x100
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4d0b00
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466d83
mov byte [ebp - 0x41], 1
jmp 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push str._lskip
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466da3
or byte [ebp - 0x3e], 0x40
jmp 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push str._locku
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466dc3
mov byte [ebp + 0x50], 3
jmp 0x467397
mov edi, dword [ebp + 0x78]
push 7
push edi
push str._locku:
call fcn.00441277
add esp, 0xc
test al, al
je 0x466de2
inc edi
mov byte [ebp + 0x50], 3
inc edi
jmp 0x466dfa
push 6
push edi
push 0x4d0ae0
call fcn.00441277
add esp, 0xc
test al, al
je 0x466e58
mov byte [ebp + 0x50], 1
add edi, 0xc
xor ecx, ecx
mov dword [ebp + 0x78], edi
mov cx, word [edi]
cmp cx, bx
je 0x466e33
mov eax, ecx
call fcn.004b1b03
test al, al
jne 0x466e33
push ecx
call fcn.00414d24
add esp, 4
test al, al
jne 0x466e33
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x34], edi
call fcn.00405c44
jmp 0x466f88
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0047f1ca
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0047f1ca
add esp, 0x10
jmp 0x466f98
push 5
lea eax, [ebp + 0x78]
push eax
push str._lock
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466e78
mov byte [ebp + 0x50], 1
jmp 0x467397
push 6
lea eax, [ebp + 0x78]
push eax
push str._lockx
call fcn.004485c7
add esp, 0xc
test al, al
jne 0x466dba
push 6
lea eax, [ebp + 0x78]
push eax
push str._lock_
call fcn.004485c7
add esp, 0xc
test al, al
je 0x466eb9
mov byte [ebp + 0x50], 0xf0
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
jmp 0x467397
mov edi, dword [ebp + 0x78]
push 4
push edi
push 0x4d0ac0
call fcn.00441277
add esp, 0xc
test al, al
je 0x466f1b
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x466eec
cmp ax, 0x3d
je 0x466eec
call fcn.004b1b03
test al, al
je 0x466f1b
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
mov dword [ebp - 0xd8], ebx
je 0x466f07
mov dword [ebp - 0x78], 0x4d0ab8
jmp 0x466f98
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
jmp 0x466f7e
push 4
push edi
push str._pbr
call fcn.00441277
add esp, 0xc
test al, al
je 0x466fa6
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x466f4b
cmp ax, 0x3d
je 0x466f4b
call fcn.004b1b03
test al, al
je 0x466fa6
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
lea eax, [ebp + 0x78]
mov dword [ebp - 0x78], ebx
push eax
je 0x466f6d
mov dword [ebp - 0xd8], 0x4c78c2
call fcn.00405c44
pop ecx
jmp 0x466f98
add dword [ebp + 0x78], 2
call fcn.0043fe57
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405c44
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x466f98
mov word [eax], bx
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
jmp 0x466cf6
push 9
push edi
push str._alignend
call fcn.00441277
add esp, 0xc
test al, al
je 0x467036
lea ecx, [edi + 0x12]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x466fd6
cmp ax, 0x3d
je 0x466fd6
call fcn.004b1b03
test al, al
je 0x467036
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
jne 0x467024
xor eax, eax
add ecx, 2
mov ax, word [ecx]
push eax
call fcn.00414d24
add esp, 4
test al, al
je 0x46737c
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ecx
call fcn.0044c029
cmp dword [ebp - 0x80], ebx
pop ecx
pop ecx
jg 0x46737c
jl 0x467024
cmp dword [ebp - 0x84], ebx
ja 0x46737c
mov dword [ebp - 0x84], 0xfffffffe
mov dword [ebp - 0x80], esi
jmp 0x46737c
push 6
push edi
push str._align
call fcn.00441277
add esp, 0xc
test al, al
je 0x4670e4
lea ecx, [edi + 0xc]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x46706a
cmp ax, 0x3d
je 0x46706a
call fcn.004b1b03
test al, al
je 0x4670e4
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], ecx
mov edi, ecx
call fcn.00405c44
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
cmp word [edi], 0x3d
pop ecx
pop ecx
je 0x46709a
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
jmp 0x467397
xor eax, eax
lea ecx, [edi + 2]
mov ax, word [ecx]
push eax
call fcn.00414d24
add esp, 4
test al, al
je 0x467397
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ecx
call fcn.0044c029
cmp dword [ebp - 0xac], ebx
pop ecx
pop ecx
jg 0x467397
jl 0x467089
cmp dword [ebp - 0xb0], ebx
ja 0x467397
jmp 0x467089
push 6
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._clear
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467109
mov byte [ebp - 0x8e], 1
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._clean
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467128
mov byte [ebp - 0x11], 1
jmp 0x467397
push 7
lea eax, [ebp + 0x78]
push eax
push str._clean_
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467148
mov byte [ebp - 0x11], 0
jmp 0x467397
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca4c0
call fcn.004485c7
add esp, 0xc
test al, al
jne 0x467393
push 4
lea eax, [ebp + 0x78]
push eax
push str._del
call fcn.004485c7
add esp, 0xc
test al, al
jne 0x467393
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4d0244
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4671a2
or dword [ebp + 8], 0x20
mov byte [ebp - 0x51], 1
jmp 0x467397
push edi
push dword [ebp + 0x78]
push str._swap:
call fcn.00441277
add esp, 0xc
test al, al
je 0x4671db
add dword [ebp + 0x78], 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453e89
test eax, eax
pop ecx
pop ecx
jl 0x469468
mov byte [ebp - 0x21], 1
jmp 0x467397
push 5
push dword [ebp + 0x78]
push str._CHS
call fcn.00441277
add esp, 0xc
test al, al
je 0x46727a
add dword [ebp + 0x78], 0xa
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x34], edi
call fcn.00408f31
xor eax, eax
mov ax, word [edi]
push eax
call fcn.00414d24
add esp, 0xc
test al, al
je 0x467235
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0044c029
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x3a
jne 0x467254
add dword [ebp - 0x34], 2
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0044c029
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x3a
jne 0x467397
add dword [ebp - 0x34], 2
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0044c029
jmp 0x466cf5
push 5
push dword [ebp + 0x78]
push str._IMG
call fcn.00441277
add esp, 0xc
test al, al
jne 0x4673a3
push edi
push dword [ebp + 0x78]
push str._SKIP
call fcn.00441277
add esp, 0xc
test al, al
je 0x4672d8
add dword [ebp + 0x78], 0xc
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x48], 0x42
call fcn.00453e89
mov al, byte [ebp - 0x48]
add esp, 0xc
mov byte [ebp - 0x6c], al
jmp 0x467397
push 4
push dword [ebp + 0x78]
push str._iv
call fcn.00441277
add esp, 0xc
test al, al
je 0x46730d
add dword [ebp + 0x78], 8
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453e89
or byte [ebp + 9], 8
pop ecx
pop ecx
jmp 0x467397
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d0a58
call fcn.004485c7
add esp, 0xc
test al, al
je 0x46732e
or byte [ebp + 9], 8
or byte [ebp - 0x7a], 0x10
jmp 0x467397
push edi
lea eax, [ebp + 0x78]
push eax
push str._cdrom
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467350
mov dword [ebp - 0x8c], 8
jmp 0x467397
push 7
lea eax, [ebp + 0x78]
push eax
push str._floppy
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467373
mov dword [ebp - 0x8c], 0x10
jmp 0x467397
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2d
jne 0x4673a3
lea eax, [ebp + 0x78]
push eax
call fcn.00405c44
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
jmp 0x466cf5
mov byte [ebp + 0x10], 1
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
jne 0x4669b5
cmp dword [ebp - 0x84], 0xfffffffe
jne 0x467413
cmp dword [ebp - 0x80], esi
jne 0x467413
mov eax, dword [ebp - 0xb0]
cmp eax, 0xfffffff7
jne 0x467404
cmp dword [ebp - 0xac], esi
jne 0x467404
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
jmp 0x467424
push str.21:INDATA
lea ecx, [ebp - 0x6c]
call fcn.004505eb
push dword [ebp + 0x78]
lea ecx, [ebp - 0x6c]
call fcn.004465fa
push dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc4]
call fcn.004236b4
lea ecx, [ebp - 0x6c]
mov edi, eax
call fcn.0043fe25
jmp 0x46b82e
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0xb0], 0xfffffff7
jne 0x467434
cmp dword [ebp - 0xac], esi
jne 0x467434
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xac], ebx
cmp dword [ebp - 0x84], 0xfffffff7
jne 0x467457
cmp dword [ebp - 0x80], esi
jne 0x467457
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4d0a28
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467575
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4d0a20
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467493
mov byte [ebp + 0x5b], 1
jmp 0x467575
push edi
lea eax, [ebp + 0x78]
push eax
push str.part
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4674b2
mov byte [ebp + 0x5b], 2
jmp 0x467575
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d0a1c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4674d2
mov byte [ebp + 0x5b], 3
jmp 0x467575
push 5
lea eax, [ebp + 0x78]
push eax
push str.cdrom
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4674f9
mov byte [ebp + 0x5b], 4
mov dword [ebp - 0x8c], 8
jmp 0x467575
push 6
lea eax, [ebp + 0x78]
push eax
push str.floppy
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467520
mov byte [ebp + 0x5b], 5
mov dword [ebp - 0x8c], 0x10
jmp 0x467575
push 6
lea eax, [ebp + 0x78]
push eax
push str.parent
call fcn.004485c7
add esp, 0xc
test al, al
je 0x46753d
mov byte [ebp + 0x5b], 6
jmp 0x467575
push 6
lea eax, [ebp + 0x78]
push eax
push str.volume
call fcn.004485c7
add esp, 0xc
test al, al
je 0x46755a
mov byte [ebp + 0x5b], 7
jmp 0x467575
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d09f8
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467575
mov byte [ebp + 0x5b], 8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4d0548
mov byte [ebp + 0x64], 0
call fcn.004485c7
xor edi, edi
add esp, 0xc
inc edi
test al, al
je 0x467599
mov byte [ebp + 0x51], 1
mov dword [ebp + 0x60], edi
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d09f4
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4675b4
mov byte [ebp + 0x51], 0x10
push 6
lea eax, [ebp + 0x78]
push eax
push str.update
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4675d1
mov byte [ebp + 0x64], 1
jmp 0x467626
push 7
lea eax, [ebp + 0x78]
push eax
push str.xupdate
call fcn.004485c7
add esp, 0xc
test al, al
je 0x4675ee
mov byte [ebp + 0x64], 0x20
jmp 0x467626
push 7
lea eax, [ebp + 0x78]
push eax
push str.hupdate
call fcn.004485c7
add esp, 0xc
test al, al
je 0x46760b
mov byte [ebp + 0x64], 0x10
jmp 0x467626
push 8
lea eax, [ebp + 0x78]
push eax
push str.hupdatef
call fcn.004485c7
add esp, 0xc
test al, al
je 0x467629
mov byte [ebp + 0x64], 0x18
mov dword [ebp + 0x60], edi
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
call fcn.00405c44
mov eax, dword [ebp + 0x78]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xf0]
call fcn.004466b2
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2a
pop ecx
mov dword [ebp - 0xd4], ebx
jne 0x467672
inc eax
inc eax
mov dword [ebp - 0xd4], 0x40000000
mov dword [ebp + 0x78], eax
xor ecx, ecx
mov cx, word [eax]
mov edx, ecx
or edx, 0x20
cmp dx, 0x61
jne 0x467698
mov dword [ebp - 0x88], 0x80
lea eax, [ebp + 0x78]
push eax
call fcn.00405c44
pop ecx
jmp 0x4676ba
cmp cx, 0x2d
jne 0x4676b4
mov ax, word [eax + 2]
or ax, 0x20
cmp ax, 0x61
jne 0x4676b4
mov dword [ebp - 0x88], ebx
jmp 0x46768c
mov dword [ebp - 0xd4], ebx
xor eax, eax
mov dword [ebp - 0x230], ebx
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4e3934
push edi
mov dword [ebp - 0x1d4], 0xebd0a0a2
mov word [ebp - 0x1d0], 0xb9e5
mov word [ebp - 0x1ce], 0x4433
mov byte [ebp - 0x1cc], 0x87
mov byte [ebp - 0x1cb], 0xc0
mov byte [ebp - 0x1ca], 0x68
mov byte [ebp - 0x1c9], 0xb6
mov byte [ebp - 0x1c8], 0xb7
mov byte [ebp - 0x1c7], 0x26
mov byte [ebp - 0x1c6], 0x99
mov byte [ebp - 0x1c5], 0xc7
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x48], str.MS_Basic_Data
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x194], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp + 0x52], 0
jne 0x4677a3
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453e89
pop ecx
pop ecx
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2d
jne 0x4677d2
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.00414d24
add esp, 4
test al, al
jne 0x4677d2
mov ecx, edx
mov byte [ebp - 0x8d], 1
mov dword [ebp + 0x78], ecx
jmp 0x4677d2
push ebx
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004567b5
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x1a0], eax
jne 0x4677cf
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x46b82e
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2b
jne 0x4677e2
mov al, byte [ecx]
inc ecx
inc ecx
mov byte [ebp - 0x5d], al
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2d
jne 0x4677f3
lea eax, [ebp + 0x78]
push eax
call fcn.00408f31
jmp 0x467807
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044c0d9
pop ecx
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x40
pop ecx
mov byte [ebp - 0x40], 1
jne 0x46781e
inc eax
inc eax
mov dword [ebp + 0x78], eax
mov byte [ebp - 0x40], 0
cmp word [eax], 0x2d
jne 0x46782f
lea eax, [ebp + 0x78]
push eax
call fcn.00408f31
jmp 0x467843
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044c0d9
pop ecx
mov dword [ebp - 0x194], eax
cmp byte [ebp + 0x52], 0
pop ecx
je 0x4678a9
push ebx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004567b5
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044c029
add esp, 0x14
cmp byte [ebp + 7], 0
mov dword [ebp - 0x19c], eax
je 0x4678a9
mov ecx, dword [ebp - 0x174]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
jne 0x4678a9
mov eax, dword [ebp - 0x178]
or dword [ebp - 0x174], edx
or byte [ebp + 7], 0x20
mov dword [ebp - 0x178], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x1dc], ebx
mov cx, word [eax]
cmp cx, 0x2d
je 0x467900
cmp byte [ebp + 0x52], 0
je 0x467900
cmp cx, bx
je 0x467900
mov dword [ebp - 0x1d8], eax
push ebx
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.0041a9b6
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x1dc]
add esp, 0xc
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x48], eax
mov word [eax + ecx*2], bx
cmp byte [ebp + 0x5b], 1
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x59], 0
je 0x46791b
cmp byte [ebp + 0x5b], 4
jge 0x46791b
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xf0]
push 5
push ebx
mov edi, ebx
push 0x4d09ac
mov dword [ebp + 0x78], edi
call fcn.00441277
add esp, 0xc
test al, al
je 0x4679fc
lea ecx, [ebx + 0xa]
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2a
mov edi, ecx
jne 0x46799c
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x10]
add ecx, 2
push eax
mov dword [ebp - 0x10], ecx
call fcn.0044c0d9
mov edi, dword [ebp - 0x10]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x59], 1
jne 0x467997
lea eax, [ebp - 0x114]
push eax
inc edi
lea eax, [ebp - 0x10]
inc edi
push eax
mov dword [ebp - 0x10], edi
call fcn.0044c0d9
mov edi, dword [ebp - 0x10]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x59], 0x11
jne 0x467997
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x78], ecx
xor edx, edx
mov dx, word [ecx]
cmp dx, 0x5c
je 0x4679cc
cmp dx, 0x2f
je 0x4679cc
mov byte [ebp - 0x29], 1
jmp 0x4679cc
mov eax, edx
call fcn.004b1b03
test al, al
jne 0x4679d1
cmp dx, 0x23
je 0x4679d1
inc ecx
inc ecx
mov dword [ebp + 0x78], ecx
mov dx, word [ecx]
test dx, dx
jne 0x4679b3
sub ecx, edi
sar ecx, 1
test ecx, ecx
jle 0x4679ed
push ecx
push edi
lea ecx, [ebp - 0xdc]
call fcn.004466b2
mov dword [ebp - 0xc], 0xfffc0000
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
mov edi, dword [ebp + 0x78]
pop ecx
jmp 0x467a3c
push 2
push ebx
push 0x4d09a8
call fcn.00441277
add esp, 0xc
test al, al
je 0x467a16
lea edi, [ebx + 4]
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.00414dee
test al, al
je 0x467a34
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004429d6
mov edi, dword [ebp + 0x78]
pop ecx
pop ecx
cmp word [ebx], 0
setne byte [ebp - 0x3f]
push 0
push 0x200
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call fcn.004b4630
mov dword [ebp - 0x3c], eax
mov ax, word [edi]
cmp ax, 0x23
mov dword [ebp - 0x38], edx
je 0x467a73
cmp ax, 0x3a
jne 0x467b17
cmp ax, 0x23
jne 0x467a77
or byte [ebp + 9], 4
inc edi
inc edi
push 2
push edi
push 0x4d09a4
mov dword [ebp + 0x78], edi
call fcn.00441277
push 2
push edi
push 0x4d09a0
mov byte [ebp + 0x6a], al
call fcn.00441277
mov byte [ebp + 0x23], al
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
add esp, 0x18
neg al
sbb al, al
inc al
cmp byte [ebp + 0x6a], 0
mov byte [ebp - 0x44], al
jne 0x467ac3
cmp word [edi], 0x2b
jne 0x467ac3
inc edi
inc edi
mov byte [ebp - 0x3d], 1
mov dword [ebp + 0x78], edi
cmp byte [ebp + 0x23], 0
jne 0x467ae7
mov ax, word [edi]
cmp ax, 0x40
je 0x467ade
cmp ax, 0x2d
je 0x467ade
cmp ax, 0x3d
jne 0x467ae7
or dword [ebp + 8], 2
inc edi
inc edi
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.00414dee
test al, al
je 0x467b17
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453e89
test eax, eax
pop ecx
pop ecx
jle 0x467b17
xor eax, eax
cmp dword [ebp + 0x60], eax
mov byte [ebp - 0x43], 1
jne 0x467b17
mov byte [ebp + 0x6a], 1
jmp 0x467b1e
xor eax, eax
cmp dword [ebp + 0x60], eax
jg 0x467b34
cmp byte [ebp + 0x5b], 0
jg 0x467b34
cmp dword [ebp - 0x78], eax
jne 0x467b34
cmp dword [ebp - 0xd8], eax
mov dword [ebp + 0x5c], eax
je 0x467b3b
mov dword [ebp + 0x5c], 1
cmp byte [ebp + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
je 0x467b5c
cmp dword [ebp + 0x5c], eax
jne 0x467b5c
cmp word [ebx], ax
jne 0x467b5c
mov eax, 0xfffc0000
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xdc]
xor ebx, ebx
lea edi, [ebp - 0x2e0]
mov word [ebp - 0x2e0], bx
cmp word [eax], bx
mov dword [ebp - 0x34], edi
je 0x467b7e
mov edi, eax
mov dword [ebp - 0x34], edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x2e0]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp byte [ebp - 0x41], 0
jg 0x467bd1
mov eax, dword [ebp - 0xcc]
or eax, dword [ebp - 0xc8]
jne 0x467bd1
push 0x11
push edi
push str..PhysicalDrive
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x467bd1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
add edi, 0x22
push eax
mov dword [ebp - 0x20], edi
call fcn.00449a66
pop ecx
pop ecx
cmp byte [ebp + 0x64], 0
jne 0x467be3
cmp byte [ebp + 0x65], 0
jne 0x467be3
cmp byte [ebp + 0x6b], 0
je 0x467bf7
cmp dword [ebp - 0xc], ebx
jge 0x467bf7
cmp dword [ebp - 8], ebx
jge 0x467bf7
push 0x4e3934
jmp 0x469462
cmp byte [ebp + 0x50], 0
mov edi, 0x80070057
mov dword [ebp + 0x6c], ebx
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
mov byte [ebp + 0x66], 0
je 0x467cc7
cmp dword [ebp - 8], ebx
jge 0x467c30
cmp dword [ebp - 0x70], esi
jl 0x467c30
jg 0x467c27
cmp dword [ebp - 0x74], esi
jbe 0x467c30
cmp dword [ebp + 0x34], ebx
je 0x467cc7
mov eax, dword [ebp + 0x34]
cmp eax, ebx
je 0x467c65
cmp word [eax], 0x2a
jne 0x467c65
xor eax, eax
mov al, byte [ebp + 0x50]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 8]
call fcn.0045698b
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
or byte [0x4e3480], 0x20
pop ecx
mov byte [ebp + 0x66], 0x20
cmp dword [ebp - 8], ebx
jge 0x467c7a
cmp dword [ebp - 0x70], esi
jl 0x467c7a
jg 0x467c76
cmp dword [ebp - 0x74], esi
jbe 0x467c7a
cmp eax, ebx
je 0x467cc7
push eax
xor eax, eax
mov al, byte [ebp + 0x50]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 8]
call fcn.00405800
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x70]
add esp, 0x1c
cmp eax, esi
je 0x467cc0
or byte [ebp + 0x66], 0x10
or byte [0x4e3480], 0x10
jmp 0x467cc7
mov byte [0x4e3480], 0
cmp byte [ebp - 0x21], 0
jbe 0x467efe
cmp byte [ebp + 0x52], 0
jne 0x467efe
cmp dword [ebp - 0xc], ebx
jge 0x467cef
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
je 0x467dac
mov eax, dword [ebp - 0x68]
cmp eax, ebx
jle 0x467cff
cmp eax, dword [ebp + 0x60]
je 0x467dac
cmp dword [ebp + 0x60], 4
jg 0x467dac
cmp byte [ebp + 0x13], 2
jl 0x467dac
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.00405c6d
mov ebx, dword [ebp + 0x6c]
cmp ebx, esi
je 0x467e51
push 0x800
push 1
push esi
push ebx
call fcn.0044b51c
mov esi, 0x200
push esi
push ebx
mov dword [ebp - 0x50], eax
call fcn.004438ac
add esp, 0x18
cmp eax, esi
mov edi, eax
jge 0x467d63
mov edi, esi
lea eax, [edi + edi*2]
push eax
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x34], edi
call fcn.00446437
mov eax, dword [ebp + 0x14]
lea esi, [eax + edi]
lea eax, [edi - 1]
not eax
and esi, eax
push 0
lea eax, [ebp - 0x58]
push eax
push edi
mov dword [ebp - 0x30], esi
add esi, edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x467dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x467da4
inc edi
lea ecx, [ebp + 0x14]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
push 0x4e3934
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x46b82e
push 0x200
push esi
push dword [ebp - 0x30]
call fcn.00414839
dec dword [ebp - 0x68]
mov edi, dword [ebp - 0x68]
dec dword [ebp + 0x60]
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp + 0x60]
or byte [ebp - 0x21], 2
shl edi, 4
lea eax, [eax + edi + 0x1be]
push 0x10
push eax
shl ebx, 4
lea eax, [esi + ebx + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
call fcn.00414839
mov eax, dword [ebp - 0x30]
lea eax, [eax + ebx + 0x1be]
push 0x10
push eax
lea eax, [esi + edi + 0x1be]
push eax
call fcn.00414839
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x34
test eax, eax
je 0x467e74
lea ecx, [ebp + 0x14]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
push 0x4e3934
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
jmp 0x46b82e
push dword [ebp + 0x34]
xor edi, edi
push esi
push dword [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x467ebb
push edi
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x34]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x467eb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x467eaf
xor eax, eax
inc eax
mov dword [ebp - 4], eax
push dword [ebp + 0x6c]
call fcn.00443eca
pop ecx
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x47]
lea ecx, [ebp + 0x14]
or byte [ebp + 0x65], al
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x65]
or al, byte [ebp + 0x47]
je 0x467edf
mov dword [ebp + 0x5c], edi
call fcn.0043fe25
jmp 0x46a6cd
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
push 0x4e3934
jmp 0x46b825
cmp byte [ebp + 0x64], 0x10
mov dword [ebp - 0x1c], ebx
jne 0x467f14
test byte [ebp + 0x6b], 0x20
jne 0x46a6cd
or esi, 0xffffffff
mov edi, dword [ebp - 0xf0]
xor ebx, ebx
cmp byte [ebp + 0x50], bl
je 0x467f69
cmp dword [ebp + 0x5c], ebx
jne 0x467f69
cmp byte [ebp + 0x47], bl
jne 0x46a6cd
cmp byte [ebp + 0x65], bl
jne 0x46a6cd
cmp byte [ebp + 0x6b], bl
jne 0x46a6cd
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
test eax, eax
je 0x467f61
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x10]
jmp 0x46b82e
cmp dword [ebp - 0x78], ebx
jne 0x46a7c8
cmp dword [ebp - 0xd8], ebx
jne 0x46ab53
mov al, byte [ebp + 0x5b]
cmp al, 6
mov dword [ebp - 4], 0x80070057
je 0x46af78
cmp al, 1
je 0x46b081
cmp al, 2
jne 0x467fa6
cmp byte [ebp - 0x41], 0
je 0x46b0c1
cmp al, 8
jne 0x467fb4
cmp byte [ebp - 0x41], 0
je 0x46b121
cmp al, 3
mov dword [ebp + 0x54], ebx
je 0x46b1b9
cmp al, 4
je 0x46bca9
cmp al, 5
je 0x46bca9
cmp al, 7
je 0x46b28a
cmp byte [ebp + 0x23], 0
je 0x467ff9
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x6a], 0
mov dword [ebp - 4], ebx
je 0x468009
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x10], 0
je 0x468024
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
cmp byte [ebp - 0x3f], 0
je 0x468033
cmp dword [ebp - 8], ebx
jl 0x46b480
cmp byte [ebp - 0x44], 0
je 0x468042
cmp dword [ebp + 0x60], ebx
jl 0x46b480
test byte [ebp - 0x21], 2
jne 0x46804b
dec dword [ebp + 0x60]
cmp byte [ebp + 0x52], 0
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], esi
mov byte [ebp + 0x12], 0
mov byte [ebp - 0x42], 0
mov dword [ebp - 0x14c], ebx
mov byte [ebp - 0x5a], 0
mov byte [ebp - 0x5b], 0
mov dword [ebp - 0x94], ebx
jne 0x46809e
cmp dword [ebp - 0x64], ebx
jne 0x46809e
mov eax, dword [ebp + 0x48]
or eax, dword [ebp + 0x4c]
jne 0x46809e
mov eax, dword [ebp + 0x28]
or eax, dword [ebp + 0x2c]
jne 0x46809e
mov byte [ebp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [ebp - 0x9e], 1
je 0x4680d0
cmp dword [ebp + 0x4c], ebx
jl 0x4680d0
jg 0x4680ba
cmp dword [ebp + 0x48], ebx
jb 0x4680d0
cmp dword [ebp + 0x2c], ebx
jl 0x4680d0
jg 0x4680c7
cmp dword [ebp + 0x28], 1
jb 0x4680d0
mov dword [ebp + 0x34], 1
jmp 0x4680d3
mov dword [ebp + 0x34], ebx
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.00405c6d
cmp dword [ebp + 0x6c], ebx
je 0x46b390
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.004438ac
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp + 0x40], eax
jge 0x468111
mov dword [ebp + 0x40], edi
cmp dword [ebp + 0x34], ebx
je 0x468182
cmp dword [ebp + 0x4c], ebx
jl 0x468149
jg 0x468122
cmp dword [ebp + 0x48], ebx
jb 0x468149
mov eax, dword [ebp + 0x40]
push ebx
push ebx
push ebx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push ebx
push edi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004b4630
push edx
push eax
push dword [ebp - 8]
lea ecx, [ebp + 0x66]
call fcn.00443f4b
cmp byte [ebp + 0x6a], 0
jne 0x468182
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xcc]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc8]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043efae
add esp, 0x18
lea ecx, [ebp + 0x66]
call fcn.00443f89
mov dword [ebp - 0x10], ebx
push 0x800
push 1
push ebx
push dword [ebp + 0x6c]
call fcn.0044b51c
add esp, 0x10
cmp dword [ebp - 8], ebx
mov dword [ebp - 0x50], eax
jl 0x4681d4
cmp byte [ebp + 0x64], 0x20
je 0x4681a9
cmp byte [ebp + 0x64], 0x10
jne 0x4681ae
cmp eax, 0xb
je 0x4681d0
test byte [ebp + 0x65], 0x20
jne 0x4681d0
cmp byte [ebp + 0x65], 0
je 0x4681bf
cmp eax, 0xb
je 0x4681d0
test byte [ebp + 0x6b], 0x20
jne 0x4681d0
cmp byte [ebp + 0x6b], 0
je 0x4681d4
cmp eax, 0xb
jne 0x4681d4
or dword [ebp - 0x1c], 1
cmp byte [ebp - 0x29], 0
jg 0x4681f6
cmp byte [ebp + 0x47], 0
jne 0x4681f2
cmp byte [ebp + 0x64], 1
je 0x4681f2
cmp byte [ebp + 0x64], 0x20
je 0x4681f2
cmp byte [ebp + 0x65], 0
je 0x4681f6
or dword [ebp - 0x1c], 2
cmp byte [ebp + 0x64], 1
je 0x468202
cmp byte [ebp + 0x64], 0x20
jne 0x468206
or dword [ebp - 0x1c], 4
mov cl, byte [ebp + 0x6b]
and cl, 0x20
jne 0x468224
cmp byte [ebp + 0x6b], 0
je 0x468219
cmp eax, 0xb
je 0x468224
test byte [ebp + 0x64], 0x10
je 0x468228
cmp eax, 0xc
je 0x468228
or dword [ebp - 0x1c], 8
cmp byte [ebp - 0x29], 0
jg 0x468232
or dword [ebp - 0x1c], 0x10
cmp byte [ebp + 0x64], 0x10
jne 0x46823c
or dword [ebp - 0x1c], 0x20
cmp byte [ebp + 0x50], 0
je 0x468247
cmp dword [ebp + 0x5c], ebx
jne 0x46824b
or dword [ebp - 0x1c], 0x40
cmp byte [ebp + 0x64], 0x18
jne 0x468255
or byte [ebp - 0x1c], 0x80
cmp eax, 0xc
jne 0x46826a
cmp byte [ebp + 0x65], 0
jne 0x468266
cmp byte [ebp + 0x47], 0
je 0x46826a
or byte [ebp - 0x1b], 1
cmp byte [ebp + 0x50], 0
je 0x468275
cmp dword [ebp + 0x5c], ebx
je 0x468285
cmp byte [ebp + 0x64], 0x10
jne 0x46827f
test cl, cl
jne 0x468285
cmp byte [ebp + 0x64], 0
je 0x46828d
mov dword [ebp + 0x5c], ebx
jmp 0x46a6c5
cmp dword [ebp - 0x64], 0xff
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
jg 0x46b39d
cmp byte [ebp + 0x6a], 0
jne 0x4682f1
cmp dword [ebp + 0x60], ebx
jge 0x4682f1
cmp dword [ebp + 0x4c], ebx
jg 0x46b39d
jl 0x4682c5
cmp dword [ebp + 0x48], ebx
jae 0x46b39d
cmp dword [ebp + 0x2c], ebx
jg 0x46b39d
jl 0x4682d9
cmp dword [ebp + 0x28], ebx
jae 0x46b39d
cmp dword [ebp - 0x64], ebx
jge 0x46b39d
mov dword [ebp - 0x64], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
cmp byte [ebp + 0x6a], 0
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x1b4], esi
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp + 0x14], eax
jne 0x468336
cmp byte [ebp + 0x23], 0
jne 0x468336
cmp eax, 4
jl 0x468927
cmp byte [ebp + 0x52], 0
jne 0x468927
cmp byte [ebp + 0x51], 0
jne 0x468927
cmp byte [ebp + 0x6a], 0
je 0x468357
mov dword [ebp + 0x60], 4
cmp dword [ebp - 0x64], 5
je 0x46b480
cmp dword [ebp - 0x64], 0xf
je 0x46b480
push 0x100000
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0x5c], ebx
call fcn.00402d92
lea eax, [ebp + 0x5c]
push eax
push dword [ebp - 0x4c]
push dword [ebp + 0x6c]
call fcn.00443c2d
mov edx, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov edi, eax
jne 0x4683d1
cmp edx, ecx
jge 0x4683a4
cmp ecx, 4
jge 0x4683c9
cmp byte [ebp + 0x6a], 0
jne 0x4683d1
cmp byte [ebp + 0x23], 0
jne 0x4683d1
lea eax, [ecx + 1]
mov byte [ebp + 0x3b], 0
call fcn.00443c0e
cmp eax, ebx
jle 0x4683c9
cmp eax, edx
jl 0x468408
cmp ecx, 4
jle 0x468408
lea ecx, [ebp - 0x4c]
jmp 0x46b47b
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x3b], 1
jne 0x468403
cmp byte [ebp + 0x6a], 0
je 0x468408
cmp dword [ebp - 0x64], ebx
jl 0x4683c9
cmp word [ebp - 0x88], bx
jle 0x4683fb
mov dword [ebp - 0x88], 0x80
jmp 0x468408
mov dword [ebp - 0x88], ebx
jmp 0x468408
cmp edx, 4
jle 0x4683c9
cmp edx, 4
jle 0x468418
lea eax, [edx - 4]
and eax, 0xfffffffc
mov dword [ebp + 0x30], eax
jmp 0x46841b
mov dword [ebp + 0x30], ebx
cmp byte [ebp + 0x3b], 0
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x14], esi
jne 0x46843b
cmp ecx, 4
jl 0x468438
lea eax, [ecx*4 - 0x10]
mov dword [ebp + 0x30], eax
jmp 0x46843b
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x24], esi
xor edx, edx
lea eax, [edi + 0x50]
mov cl, byte [eax]
cmp cl, 5
je 0x46844f
cmp cl, 0xf
jne 0x468452
mov dword [ebp + 0x24], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x468443
cmp byte [ebp + 0x3b], 0
je 0x46846c
cmp dword [ebp + 0x24], ebx
jl 0x4683c9
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
push 0
shl eax, 4
lea esi, [eax + edi + 0x30]
mov ebx, 0x200
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x20], esi
push dword [esi + 8]
call fcn.004b4580
push 0
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0x100], eax
push dword [esi + 0x10]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], edx
call fcn.004b4580
mov ebx, eax
mov eax, dword [ebp + 0x30]
lea eax, [eax + eax*8]
shl eax, 4
cmp byte [ebp + 0x23], 0
mov dword [ebp - 0x1fc], edx
lea esi, [eax + edi + 0x30]
je 0x468598
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp eax, 8
jne 0x4684ec
mov ecx, dword [ebp - 0x100]
mov edx, dword [ebp - 0xfc]
jmp 0x46853f
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + edi + 0x30]
lea eax, [edi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x46851e
cmp cl, 0xf
je 0x46851e
inc esi
add eax, 0x90
cmp esi, 4
jl 0x4684ff
lea ecx, [ebp - 0x4c]
jmp 0x46943b
push 0
push 0x200
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.004b4580
mov ecx, eax
mov eax, dword [edi + 0x24]
xor edi, edi
sub ecx, eax
sbb edx, edi
test esi, esi
jl 0x468516
and dword [ebp - 0x258], 0
xor eax, eax
add ecx, dword [ebp - 0xcc]
lea edi, [ebp - 0x254]
adc edx, dword [ebp - 0xc8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x258]
push eax
push edx
push ecx
push dword [ebp + 0x6c]
call fcn.0045668b
and dword [ebp - 4], 0
add esp, 0x14
cmp byte [ebp + 0x6b], 0
jne 0x46858c
cmp byte [ebp + 0x65], 0
jne 0x46858c
cmp byte [ebp + 0x47], 0
je 0x46b3c1
and dword [ebp + 0x5c], 0
lea ecx, [ebp - 0x4c]
jmp 0x46a6c0
cmp dword [ebp + 0x5c], 4
jg 0x4685a6
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x3c], eax
jmp 0x4685d1
xor edx, edx
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x4685b7
cmp cl, 0xf
jne 0x4685ba
mov dword [ebp + 0x3c], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x4685ab
cmp byte [ebp + 0x3b], 0
jne 0x4685d1
mov eax, dword [ebp + 0x30]
add dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], 0
jge 0x4685e1
cmp byte [ebp + 0x6a], 0
je 0x468516
cmp byte [ebp + 0x3b], 0
je 0x4685ed
and dword [ebp + 0x14], 0
jmp 0x468617
xor edx, edx
lea eax, [esi + 0x260]
mov cl, byte [eax]
test cl, cl
jne 0x4685ff
test edx, edx
jne 0x46860c
cmp cl, 5
je 0x46860c
cmp cl, 0xf
je 0x46860c
mov dword [ebp + 0x14], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x4685f5
cmp byte [ebp + 0x3b], 0
jne 0x468627
cmp dword [ebp + 0x14], 0
jl 0x468516
cmp byte [ebp + 0x6a], 0
je 0x468858
mov eax, dword [ebp + 0x30]
test eax, eax
jg 0x46863b
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
shl eax, 4
lea eax, [eax + edi + 0x30]
mov ecx, dword [eax + 8]
push 0
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 0xc]
push 0x200
push eax
push ecx
mov dword [ebp - 0x1a4], eax
call fcn.004b4580
cmp dword [ebp + 0x5c], 4
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], edx
jle 0x468766
cmp dword [ebp + 0x3c], 0
jge 0x468766
cmp byte [esi + 0x20], 0
je 0x46871d
mov eax, dword [ebp + 0x5c]
cmp eax, 8
jle 0x46869d
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x4686a0
mov eax, dword [ebp + 0x24]
push 0
lea eax, [eax + eax*8]
push 0x200
shl eax, 4
push dword [eax + edi + 0x3c]
push dword [eax + edi + 0x38]
call fcn.004b4580
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x168], eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 8]
push 0
adc ecx, dword [esi + 0xc]
push 0x200
push ecx
push eax
mov dword [ebp - 0x164], edx
call fcn.004b4580
mov ecx, eax
sub ecx, dword [ebp - 0x188]
mov dword [ebp - 0x1b4], ecx
mov ecx, edx
sbb ecx, dword [ebp - 0x184]
sub ebx, eax
mov dword [ebp - 0x1b0], ecx
mov ecx, dword [ebp - 0x1fc]
sbb ecx, edx
add ebx, dword [ebp - 0x188]
adc ecx, dword [ebp - 0x184]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ecx
jmp 0x4687aa
cmp dword [ebp + 0x30], 4
jne 0x46b3c9
mov eax, dword [ebp + 0x24]
test eax, eax
jl 0x46b3c9
mov ecx, dword [ebp - 0x20]
cmp byte [ecx + 0x20], 0
je 0x46b3c9
mov edx, dword [ebp - 0xfc]
or dword [ebp + 0x30], 0xffffffff
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], edx
jmp 0x4687a2
cmp dword [ebp + 0x30], 0
jle 0x46878c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
mov eax, dword [eax + 0x14]
adc eax, dword [ebp - 0x1a4]
push 0
push 0x200
push eax
push ecx
call fcn.004b4580
mov ecx, dword [ebp - 0x1fc]
sub ebx, eax
sbb ecx, edx
add ebx, dword [ebp - 0x188]
adc ecx, dword [ebp - 0x184]
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
test ecx, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edx
jl 0x468516
jg 0x4687c8
test ebx, ebx
jbe 0x468516
cmp byte [ebp - 0x5d], 0
je 0x4687d4
add dword [ebp + 0x48], eax
adc dword [ebp + 0x4c], edx
mov edi, eax
add edi, 1
mov esi, edx
adc esi, 0
cmp dword [ebp + 0x4c], esi
jg 0x4687f0
jl 0x4687ea
cmp dword [ebp + 0x48], edi
ja 0x4687f0
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], esi
sub ebx, dword [ebp + 0x48]
sbb ecx, dword [ebp + 0x4c]
add ebx, eax
adc ecx, edx
cmp dword [ebp + 0x2c], ecx
jl 0x46880c
jg 0x468806
cmp dword [ebp + 0x28], ebx
jbe 0x46880c
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ecx
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x468516
jg 0x468822
cmp dword [ebp + 0x28], eax
jb 0x468516
cmp dword [ebp + 0x30], eax
mov eax, dword [ebp + 0x5c]
jle 0x468836
dec eax
and eax, 0xfffffffc
call fcn.00443c1d
inc eax
jmp 0x46883e
and eax, 0xfffffffc
call fcn.00443c1d
mov dword [ebp + 0x60], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0xe0]
jmp 0x468912
mov eax, dword [ebp + 0x3c]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + edi + 0x30]
push 0
mov edi, 0x200
push edi
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004b4580
push 0
push edi
push dword [esi + 0x14]
mov ebx, eax
push dword [esi + 0x10]
mov eax, edx
mov dword [ebp - 0x204], eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], eax
call fcn.004b4580
cmp byte [ebp - 0x5d], 0
je 0x4688ae
add dword [ebp + 0x48], ebx
mov ecx, dword [ebp - 0x204]
adc dword [ebp + 0x4c], ecx
xor esi, esi
cmp dword [ebp + 0x4c], esi
jl 0x4688d4
jg 0x4688bc
cmp dword [ebp + 0x48], esi
jbe 0x4688d4
mov ecx, dword [ebp - 0x204]
cmp dword [ebp + 0x4c], ecx
jg 0x4688d4
jl 0x4688ce
cmp dword [ebp + 0x48], ebx
ja 0x4688d4
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ecx
cmp dword [ebp + 0x2c], esi
jl 0x468906
jg 0x4688e0
cmp dword [ebp + 0x28], esi
jbe 0x468906
cmp dword [ebp + 0x2c], edx
jl 0x4688f2
jg 0x4688ec
cmp dword [ebp + 0x28], eax
jbe 0x4688f2
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], esi
jl 0x46b3de
jg 0x468906
cmp dword [ebp + 0x28], esi
jb 0x46b3de
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x170], ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x16c], eax
call fcn.0043fe25
xor ebx, ebx
mov edi, 0x200
cmp dword [ebp + 0x60], 4
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x16c]
setge byte [ebp - 0x5c]
add eax, dword [ebp - 0xcc]
push ebx
adc ecx, dword [ebp - 0xc8]
push edi
push ecx
push eax
call fcn.004b4630
cmp dword [ebp + 0x34], ebx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edx
je 0x46899a
cmp byte [ebp + 0x6a], 0
je 0x46899a
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xcc]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc8]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043efae
add esp, 0x18
lea ecx, [ebp + 0x66]
call fcn.00443f89
mov dword [ebp - 0x10], ebx
push ebx
push dword [ebp - 0x144]
push dword [ebp - 0x148]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x10
cmp eax, dword [ebp - 0x148]
jne 0x46b45b
cmp edx, dword [ebp - 0x144]
jne 0x46b45b
mov esi, dword [ebp + 0x40]
lea eax, [esi + esi*2]
push eax
lea ecx, [ebp]
call fcn.00402d92
mov eax, dword [ebp]
push dword [ebp + 0x40]
lea edi, [eax + esi]
lea eax, [esi - 1]
not eax
and edi, eax
add esi, edi
push ebx
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp + 0x24], esi
call fcn.004b4520
add esp, 0xc
push ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46b453
push dword [ebp + 0x40]
push esi
push edi
call fcn.00414839
add esp, 0xc
cmp byte [ebp + 0x51], 0
je 0x468b0e
cmp byte [ebp + 0x52], 0
jne 0x468b0e
push esi
call fcn.00443f1d
cmp byte [ebp - 0x11], 0
pop ecx
jg 0x468a5f
jge 0x468a5b
cmp dword [ebp - 0x38], ebx
mov eax, dword [ebp + 0x40]
lea eax, [eax + eax + 0x4000]
jg 0x468a5f
jl 0x468a5b
cmp dword [ebp - 0x3c], eax
ja 0x468a5f
xor al, al
jmp 0x468a61
mov al, 1
cmp byte [ebp + 0x51], 1
jne 0x468a9f
test al, al
je 0x468a8d
cmp dword [ebp + 0x40], 0x200
jbe 0x468a8d
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
lea eax, [esi + 0x200]
push ebx
push eax
call fcn.004b4520
add esp, 0xc
push 0x40
lea eax, [esi + 0x1be]
push ebx
push eax
call fcn.004b4520
add esp, 0xc
push dword [ebp + 0x40]
mov word [esi + 0x1fe], 0xaa55
push esi
push edi
call fcn.0043ff15
add esp, 0xc
test eax, eax
je 0x468aee
push ebx
push dword [ebp - 0x144]
push dword [ebp - 0x148]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x10
push ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
mov dword [ebp - 0x58], ebx
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x65]
or al, byte [ebp + 0x47]
je 0x46b40a
cmp dword [ebp - 0xc], ebx
jl 0x46b40a
mov dword [ebp + 0x5c], ebx
jmp 0x46a6bd
cmp byte [ebp + 0x5b], 2
je 0x468b2a
cmp byte [ebp + 0x13], 0
jne 0x468b2a
cmp byte [ebp - 0x43], 0
je 0x468b39
cmp dword [ebp + 0x60], 1
jle 0x46b478
cmp byte [ebp - 0x43], 0
je 0x468b39
cmp dword [ebp + 0x60], ebx
jl 0x46b478
push 0x200010
lea ecx, [ebp + 0x18]
call fcn.00402d92
xor esi, esi
cmp word [ebp - 0x88], bx
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x58], ebx
mov byte [ebp + 0x53], 0xff
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x17c], ebx
jl 0x468b79
mov esi, dword [ebp + 0x60]
inc esi
cmp word [ebp - 0x88], bx
jne 0x468b79
neg esi
movzx esi, si
mov eax, esi
or eax, dword [ebp - 0xd4]
push eax
lea eax, [ebp + 0x53]
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x6c]
call fcn.0044c4bd
mov al, byte [ebp + 0x53]
add esp, 0x14
cmp esi, ebx
je 0x468ba8
test al, al
jge 0x46b436
cmp al, 0x10
jl 0x468bae
and al, 0xf
test al, al
jl 0x468bc1
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
or al, byte [ebp + 0x10]
jne 0x46b470
cmp dword [ebp - 8], ebx
jl 0x468be5
push dword [ebp + 0x6c]
mov esi, dword [ebp + 0x18]
call fcn.00443a3f
pop ecx
push ebx
push dword [ebp + 0x40]
push edx
push eax
call fcn.004b4580
mov esi, dword [ebp - 0x110]
jmp 0x468c4c
mov esi, dword [ebp - 0x110]
cmp esi, ebx
jl 0x468c0b
jg 0x468bf9
cmp dword [ebp - 0x114], ebx
jb 0x468c0b
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], esi
lea eax, [ebp - 0x27c]
push eax
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x468c92
test byte [ebp - 0x27c], 0x10
jne 0x468c92
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x25c]
and eax, 0xfffffe00
xor edx, edx
shld edx, eax, 0x17
shl eax, 0x17
shr ecx, 9
xor edi, edi
or eax, ecx
or edx, edi
sub eax, dword [ebp - 0xcc]
sbb edx, dword [ebp - 0xc8]
cmp esi, ebx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], edx
jl 0x468c92
jg 0x468c72
cmp dword [ebp - 0x114], ebx
jbe 0x468c92
cmp edx, esi
ja 0x468c92
jb 0x468c80
cmp eax, dword [ebp - 0x114]
jae 0x468c92
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], esi
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x6c]
call fcn.00443c2d
mov esi, eax
mov eax, dword [ebp - 0xdc]
mov cx, word [eax]
add esp, 0xc
cmp cx, bx
jne 0x468cc2
cmp esi, ebx
jne 0x468cc6
test byte [ebp + 0x51], 0x10
je 0x46b470
cmp esi, ebx
je 0x468cca
mov eax, dword [esi]
jmp 0x468ccc
xor eax, eax
cmp eax, 1
sete byte [ebp + 0x53]
cmp byte [ebp + 0x53], 0
je 0x468ce6
cmp byte [ebp - 0x9d], 0
mov byte [ebp + 0x11], 1
je 0x468cea
mov byte [ebp + 0x11], 0
cmp byte [ebp - 0x95], 0
jne 0x468d15
cmp byte [ebp + 0x51], 0
jne 0x468d15
cmp byte [ebp + 0x11], 0
je 0x468d0b
cmp byte [ebp + 0x52], 0
je 0x46b470
jmp 0x468d15
cmp byte [ebp + 0x52], 0
jne 0x46b470
cmp cx, bx
mov eax, dword [ebp - 0x140]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp + 0x30], eax
jne 0x468de2
xor eax, eax
mov dword [ebp - 0x248], ebx
lea edi, [ebp - 0x244]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
push 0x18
lea eax, [ebp - 0x248]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x13c], ebx
jg 0x468d92
jl 0x468d7c
cmp dword [ebp - 0x140], ebx
ja 0x468d92
mov eax, dword [ebp - 0x23c]
mov dword [ebp + 0x5c], eax
cdq
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x12c], ebx
jg 0x468dba
jl 0x468da4
cmp dword [ebp - 0x130], ebx
ja 0x468dba
mov eax, dword [ebp - 0x238]
mov dword [ebp + 0x3c], eax
cdq
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x150], ebx
jg 0x468de2
jl 0x468dcc
cmp dword [ebp - 0x154], ebx
ja 0x468de2
mov eax, dword [ebp - 0x234]
mov dword [ebp + 0x30], eax
cdq
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x13c], ebx
jg 0x468e08
jl 0x468df4
cmp dword [ebp - 0x140], ebx
ja 0x468e08
mov eax, 0xff
mov dword [ebp + 0x5c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], ebx
cmp dword [ebp - 0x12c], ebx
jg 0x468e2c
jl 0x468e1a
cmp dword [ebp - 0x130], ebx
ja 0x468e2c
push 0x3f
pop eax
mov dword [ebp + 0x3c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x150], ebx
jg 0x468e5f
jl 0x468e3e
cmp dword [ebp - 0x154], ebx
ja 0x468e5f
mov eax, dword [ebp + 0x40]
cmp eax, ebx
mov dword [ebp + 0x30], eax
ja 0x468e4f
mov dword [ebp + 0x30], 0x200
mov eax, dword [ebp + 0x30]
cdq
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
mov eax, dword [ebp + 0x30]
cdq
mov edi, 0x200
mov ecx, edi
idiv ecx
cmp byte [ebp + 0x11], 0
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x40]
lea ebx, [ecx + eax]
lea ecx, [ebx + eax]
mov dword [ebp - 0x18], ecx
jne 0x46986a
cmp byte [ebp + 0x52], 0
jne 0x46986a
cmp byte [ebp + 0x10], 0
mov byte [ebp + 0x53], 0
jne 0x46933e
xor ebx, ebx
cmp dword [ebp + 0x4c], ebx
jg 0x468ec2
jl 0x468eae
cmp dword [ebp + 0x48], ebx
jae 0x468ec2
cmp dword [ebp + 0x2c], ebx
jl 0x46933e
jg 0x468ec2
cmp dword [ebp + 0x28], ebx
jb 0x46933e
mov esi, dword [ebp + 0x60]
cmp esi, ebx
jl 0x46933e
push 0x100000
lea ecx, [ebp - 0x30]
call fcn.00402d92
mov eax, dword [ebp + 0x30]
imul eax, dword [ebp + 0x3c]
cdq
idiv edi
mov edi, eax
mov eax, dword [ebp + 0x5c]
imul eax, edi
cmp dword [ebp + 0x30], ebx
cdq
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jle 0x46b468
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
jne 0x468f3e
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 4], ebx
push dword [ebp + 0x6c]
call fcn.00443c2d
add esp, 0xc
test eax, eax
je 0x46b443
cmp esi, 4
jl 0x468f3e
cmp byte [ebp + 0x6a], 0
jne 0x468f3e
cmp esi, dword [ebp - 4]
jge 0x46b468
xor eax, eax
xor edx, edx
cmp dword [ebp + 0x4c], ebx
jl 0x468ff3
jg 0x468f56
cmp dword [ebp + 0x48], ebx
jbe 0x468ff3
mov ecx, dword [ebp - 0xb0]
and ecx, dword [ebp - 0xac]
cmp ecx, 0xffffffff
jne 0x468f98
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + 0x4c], eax
jl 0x468f93
jg 0x468f7f
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + 0x48], eax
jb 0x468f93
cmp byte [ebp - 0x5c], 0
jne 0x468f93
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
jmp 0x468fdf
mov eax, edi
cdq
jmp 0x468fdd
cmp byte [ebp - 0x51], 0
jne 0x468ff3
mov eax, dword [ebp + 0x30]
cdq
mov ecx, eax
add ecx, dword [ebp - 0xb0]
mov esi, edx
adc esi, dword [ebp - 0xac]
push edx
sub ecx, 1
push eax
sbb esi, ebx
push esi
push ecx
call fcn.004b4580
mov ecx, eax
mov eax, dword [ebp + 0x34]
mov esi, edx
cdq
push edx
push eax
push esi
push ecx
call fcn.004b4630
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
push edx
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.00443e26
add esp, 0x10
add dword [ebp + 0x48], eax
adc dword [ebp + 0x4c], edx
cmp dword [ebp + 0x2c], ebx
jl 0x469020
jg 0x468fff
cmp dword [ebp + 0x28], ebx
jbe 0x469020
cmp byte [ebp - 0x8d], 0
jne 0x469020
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], ebx
jg 0x469020
jl 0x46901a
cmp dword [ebp + 0x28], ebx
jae 0x469020
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
cmp dword [ebp + 0x4c], ebx
jl 0x46903a
jg 0x46902c
cmp dword [ebp + 0x48], ebx
jbe 0x46903a
mov eax, dword [ebp + 0x4c]
mov esi, dword [ebp + 0x48]
mov dword [ebp - 0x1e4], eax
jmp 0x469042
xor esi, esi
mov dword [ebp - 0x1e4], esi
xor ebx, ebx
cmp dword [ebp + 0x2c], ebx
jl 0x4690f6
jg 0x469058
cmp dword [ebp + 0x28], ebx
jbe 0x4690f6
mov eax, dword [ebp - 0x84]
and eax, dword [ebp - 0x80]
cmp eax, 0xffffffff
jne 0x46908f
push dword [ebp - 0xa4]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x2c]
push dword [ebp - 0xa8]
add eax, esi
adc ecx, dword [ebp - 0x1e4]
push ecx
push eax
call fcn.004b6920
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
jmp 0x4690f6
cmp byte [ebp - 0x51], 0
jne 0x4690f6
mov eax, dword [ebp + 0x30]
cdq
mov edi, eax
add eax, dword [ebp - 0x84]
mov ebx, edx
mov ecx, edx
adc ecx, dword [ebp - 0x80]
push ebx
sub eax, 1
push edi
sbb ecx, 0
push ecx
push eax
call fcn.004b4580
push ebx
push edi
push edx
push eax
call fcn.004b4630
push 0
push 0x200
push edx
push eax
call fcn.004b4580
mov ecx, dword [ebp + 0x28]
add ecx, esi
mov esi, dword [ebp + 0x2c]
adc esi, dword [ebp - 0x1e4]
push edx
push eax
push esi
push ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], edx
call fcn.004b6920
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
xor ebx, ebx
cmp dword [ebp - 0x70], ebx
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x3b], 0
mov byte [ebp + 0x11], 0
jl 0x46921d
jg 0x469116
cmp dword [ebp - 0x74], ebx
jbe 0x46921d
mov ecx, dword [ebp + 0x28]
sub ecx, dword [ebp - 0xe4]
mov esi, dword [ebp + 0x2c]
sbb esi, dword [ebp - 0xe0]
mov eax, dword [ebp + 0x34]
add ecx, dword [ebp + 0x48]
cdq
adc esi, dword [ebp + 0x4c]
push edx
push eax
push esi
push ecx
call fcn.004b4580
mov esi, eax
xor eax, eax
mov dword [ebp - 0x1c4], ebx
push 1
push dword [ebp + 0x5c]
lea edi, [ebp - 0x1c0]
push dword [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1b4]
lea eax, [ebp + 0x11]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x53]
push eax
push dword [ebp - 0x1b0]
mov dword [ebp - 0x74], esi
push edi
mov dword [ebp - 0x70], edx
call fcn.00443e50
mov al, byte [ebp + 0x3b]
add esp, 0x20
push 1
push dword [ebp + 0x5c]
mov byte [ebp - 0x1c3], al
mov al, byte [ebp + 0x11]
push dword [ebp + 0x3c]
mov byte [ebp - 0x1c2], al
mov al, byte [ebp + 0x53]
mov byte [ebp - 0x1c1], al
lea eax, [ebp + 0x11]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x53]
push eax
push ebx
push 2
push dword [ebp - 0x1b0]
mov byte [ebp - 0x1c4], 0
push edi
call fcn.004b4630
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.00443e50
mov al, byte [ebp + 0x3b]
mov byte [ebp - 0x1bf], al
mov al, byte [ebp + 0x11]
mov byte [ebp - 0x1be], al
mov al, byte [ebp + 0x53]
push 1
mov byte [ebp - 0x1bd], al
lea eax, [ebp - 0x1c4]
push eax
push dword [ebp - 0x164]
mov byte [ebp - 0x1c0], 5
push dword [ebp - 0x168]
mov dword [ebp - 0x1bc], edi
push dword [ebp + 0x6c]
mov dword [ebp - 0x1b8], esi
call fcn.0045668b
add esp, 0x34
mov eax, dword [ebp + 0x34]
cdq
mov ebx, edx
push ebx
mov edi, eax
push edi
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
call fcn.004b4580
cmp dword [ebp + 0x4c], 0
mov esi, eax
mov dword [ebp - 0x158], edx
jl 0x46926b
jg 0x46924e
cmp dword [ebp + 0x48], 0
jb 0x46926b
push ebx
push edi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004b4580
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edx
xor eax, eax
jmp 0x469279
xor eax, eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp + 0x2c], eax
jl 0x46929a
jg 0x469285
cmp dword [ebp + 0x28], eax
jb 0x46929a
push ebx
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
call fcn.004b4580
mov dword [ebp - 0x124], edx
jmp 0x4692a0
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
xor eax, eax
cmp dword [ebp + 0x60], 4
mov edi, dword [ebp - 0xf4]
setge al
push eax
push dword [ebp + 0x5c]
lea eax, [ebp + 0x12]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x42]
push eax
lea eax, [ebp - 0x14c]
push eax
push edi
push dword [ebp - 0xf8]
call fcn.00443e50
xor ecx, ecx
add esp, 0x20
cmp dword [ebp + 0x4c], ecx
jl 0x4692fa
jg 0x4692e8
cmp dword [ebp + 0x48], ecx
jbe 0x4692fa
sub dword [ebp - 0xf8], esi
sbb edi, dword [ebp - 0x158]
mov dword [ebp - 0xf4], edi
mov al, byte [ebp - 0x5c]
mov edx, dword [ebp - 0x128]
mov byte [ebp + 0x53], al
movsx eax, al
push eax
push dword [ebp + 0x5c]
lea eax, [ebp - 0x5a]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x5b]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0xf8]
lea eax, [eax + edx - 1]
push ecx
push eax
call fcn.00443e50
add esp, 0x20
lea ecx, [ebp - 0x30]
call fcn.0043fe25
mov eax, dword [ebp + 0x40]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x24]
shl edi, 4
cmp byte [ebp + 0x5b], 2
lea ebx, [edi + esi]
je 0x46b48d
push eax
push esi
push dword [ebp - 0x28]
call fcn.00414839
add esp, 0xc
cmp dword [ebp - 0x70], 0
jl 0x46939e
jg 0x46936f
cmp dword [ebp - 0x74], 0
jb 0x46939e
cmp dword [ebp + 0x14], 0
jle 0x469387
push edi
push 0
add esi, 0x1be
push esi
call fcn.004b4520
add esp, 0xc
push 0x30
pop eax
sub eax, edi
push eax
lea eax, [ebx + 0x1ce]
push 0
push eax
call fcn.004b4520
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov al, byte [ebx + 0x1c2]
jne 0x4693b8
cmp byte [ebp + 0x13], 2
jge 0x4693b8
cmp al, 5
je 0x469430
cmp al, 0xf
je 0x469430
cmp byte [ebp + 0x6a], 0
mov esi, dword [ebx + 0x1c6]
mov edi, dword [ebx + 0x1ca]
jne 0x469472
test al, al
je 0x469472
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x469474
cmp byte [ebp + 0x13], 2
jge 0x469474
cmp byte [ebp - 0x5c], al
jne 0x469474
cmp dword [ebp + 0x4c], eax
jl 0x469410
jg 0x469400
cmp dword [ebp + 0x48], eax
jb 0x469410
cmp dword [ebp - 0xf8], esi
jne 0x469430
cmp dword [ebp - 0xf4], eax
jne 0x469430
cmp dword [ebp + 0x2c], eax
jl 0x469474
jg 0x46941c
cmp dword [ebp + 0x28], eax
jb 0x469474
cmp dword [ebp - 0x128], edi
jne 0x46942c
cmp dword [ebp - 0x124], eax
je 0x469474
cmp edi, eax
je 0x469474
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
test eax, eax
je 0x469468
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0x80070057
jmp 0x46b82e
xor eax, eax
cmp byte [ebp + 0x10], 0
je 0x469496
xor edi, edi
xor esi, esi
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x64]
cmp ecx, eax
jl 0x4694a3
mov byte [ebx + 0x1c2], cl
mov ecx, dword [ebp - 0x88]
cmp cx, ax
jle 0x4694d0
cmp dword [ebp - 0xd4], eax
je 0x4694d0
mov edx, dword [ebp + 0x24]
lea eax, [edx + 0x1be]
mov byte [eax + 0x30], 0
mov byte [eax + 0x20], 0
mov byte [eax + 0x10], 0
mov byte [eax], 0
jmp 0x4694d3
mov edx, dword [ebp + 0x24]
test cx, cx
jl 0x4694de
mov byte [ebx + 0x1be], cl
cmp dword [ebp + 0x4c], 0
jg 0x46950e
jl 0x4694ec
cmp dword [ebp + 0x48], 0
jae 0x46950e
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x46959a
jg 0x469502
cmp dword [ebp + 0x28], eax
jb 0x46959a
mov eax, dword [ebp - 0x128]
lea eax, [eax + esi - 1]
jmp 0x469526
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x469556
jl 0x46951c
cmp dword [ebp + 0x28], eax
jae 0x469556
mov eax, dword [ebp - 0xf8]
lea eax, [eax + edi - 1]
movsx ecx, byte [ebp + 0x53]
push ecx
push dword [ebp + 0x5c]
lea ecx, [ebp - 0x5a]
push dword [ebp + 0x3c]
push ecx
lea ecx, [ebp - 0x5b]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push 0
push eax
call fcn.00443e50
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp + 0x24]
add esp, 0x20
xor eax, eax
cmp dword [ebp + 0x4c], eax
jl 0x46958e
jg 0x469562
cmp dword [ebp + 0x48], eax
jb 0x46958e
mov al, byte [ebp - 0x42]
mov byte [ebx + 0x1bf], al
mov al, byte [ebp + 0x12]
mov byte [ebx + 0x1c0], al
mov al, byte [ebp - 0x14c]
mov byte [ebx + 0x1c1], al
mov eax, dword [ebp - 0xf8]
mov dword [ebx + 0x1c6], eax
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x4695a6
jl 0x46959a
cmp dword [ebp + 0x28], eax
jae 0x4695a6
cmp dword [ebp + 0x4c], eax
jl 0x4695c6
jg 0x4695a6
cmp dword [ebp + 0x48], eax
jb 0x4695c6
mov al, byte [ebp - 0x5b]
mov byte [ebx + 0x1c3], al
mov al, byte [ebp - 0x5a]
mov byte [ebx + 0x1c4], al
mov al, byte [ebp - 0x94]
mov byte [ebx + 0x1c5], al
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x4695de
jg 0x4695d2
cmp dword [ebp + 0x28], eax
jb 0x4695de
mov esi, dword [ebp - 0x128]
mov dword [ebx + 0x1ca], esi
cmp dword [ebp - 0x64], eax
jge 0x469600
cmp cx, ax
jge 0x469600
cmp dword [ebp + 0x4c], eax
jg 0x469600
jl 0x4695f4
cmp dword [ebp + 0x48], eax
jae 0x469600
cmp dword [ebp + 0x2c], eax
jl 0x46960e
jg 0x469600
cmp dword [ebp + 0x28], eax
jb 0x46960e
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
cmp cx, ax
jge 0x46963e
cmp dword [ebp - 0x64], eax
jge 0x46963e
cmp dword [ebp + 0x4c], eax
jg 0x46963e
jl 0x469624
cmp dword [ebp + 0x48], eax
jae 0x46963e
cmp dword [ebp + 0x2c], eax
jg 0x46963e
jl 0x469630
cmp dword [ebp + 0x28], eax
jae 0x46963e
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
xor esi, esi
push esi
push dword [ebp - 0x144]
push dword [ebp - 0x148]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x10
cmp eax, dword [ebp - 0x148]
jne 0x46b63d
cmp edx, dword [ebp - 0x144]
jne 0x46b63d
mov eax, dword [ebp - 0x170]
or eax, dword [ebp - 0x16c]
mov dword [ebp + 0x5c], 1
jne 0x46968e
push dword [ebp + 0x24]
call fcn.00443f1d
pop ecx
push dword [ebp + 0x40]
mov edi, dword [ebp + 0x24]
push edi
push dword [ebp - 0x28]
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x4696c2
push esi
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x5c], eax
call fcn.00443eca
pop ecx
cmp dword [ebp + 0x4c], esi
mov eax, dword [edi + 0x1b8]
mov dword [ebp - 0x20], eax
jl 0x4697c7
jg 0x4696e3
cmp dword [ebp + 0x48], 0x200
jb 0x4697c7
cmp dword [ebp + 0x2c], 0
jl 0x4697c7
jg 0x4696fc
cmp dword [ebp + 0x28], 0x200
jbe 0x4697c7
cmp byte [ebp - 0x8e], 0
jle 0x4697c7
push dword [ebp + 0x40]
push 0
push dword [ebp + 0x24]
call fcn.004b4520
add esp, 0xc
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004b4630
mov ebx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov esi, eax
add ebx, esi
push 0
adc edi, edx
push edi
push ebx
push dword [ebp + 0x6c]
mov dword [ebp - 0x21c], edx
call fcn.00441183
add esp, 0x10
cmp eax, esi
jne 0x4697c3
cmp edx, dword [ebp - 0x21c]
jne 0x4697c3
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x40]
push dword [ebp - 0x28]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [ebp + 0x5c], eax
je 0x4697c3
mov eax, dword [ebp + 0x40]
cmp dword [ebp - 0x58], eax
jne 0x4697c3
and dword [ebp + 0x5c], 0
xor eax, eax
cmp dword [ebp + 0x5c], eax
sete al
cmp byte [ebp + 7], 0
mov dword [ebp - 4], eax
je 0x46984b
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004b4630
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
push eax
push edx
push ecx
add esi, 0x1b8
push str._04X_04X_04X
push dword [ebp + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0xc
push esi
push 3
push dword [ebp + 0x24]
mov edi, 0x80000002
push str.SYSTEMMountedDevices
push edi
call dword [0x4e327c]
cmp byte [ebp + 0x65], 0
jne 0x469841
cmp byte [ebp + 0x6b], 0
jne 0x469841
cmp byte [ebp + 0x47], 0
je 0x46b7f3
cmp dword [ebp - 8], 0
jge 0x46b678
cmp byte [ebp + 0x65], 0
jne 0x469861
cmp byte [ebp + 0x6b], 0
jne 0x469861
cmp byte [ebp + 0x47], 0
je 0x46b7f3
and dword [ebp + 0x5c], 0
jmp 0x46a6b5
cmp byte [ebp + 0x10], 0
je 0x469874
mov byte [ebp - 0x3d], 0
cmp byte [ebp + 0x53], 0
je 0x469888
cmp byte [ebp + 0x51], 0
jne 0x469888
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x24], eax
jmp 0x46988f
mov dword [ebp + 0x24], 0x80
mov eax, dword [ebp + 0x34]
cdq
mov edi, edx
push edi
mov esi, eax
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004b4580
push edi
push esi
push dword [ebp - 0x110]
mov dword [ebp + 0x48], eax
push dword [ebp - 0x114]
mov dword [ebp + 0x4c], edx
call fcn.004b4580
push edi
push esi
push dword [ebp + 0x2c]
mov dword [ebp - 0x114], eax
push dword [ebp + 0x28]
mov dword [ebp - 0x110], edx
call fcn.004b4580
mov esi, eax
sub esi, 1
mov edi, edx
sbb edi, 0
cmp byte [ebp - 0x40], 0
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], edi
je 0x469914
mov esi, eax
add esi, dword [ebp + 0x48]
mov edi, edx
adc edi, dword [ebp + 0x4c]
sub esi, 1
sbb edi, 0
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], edi
and dword [ebp - 0xec], 0
and dword [ebp - 0xe8], 0
cmp byte [ebp + 0x51], 1
jne 0x4699a0
test byte [ebp - 0x59], 0x10
je 0x469952
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x110]
mov esi, eax
sub esi, 1
mov edi, ecx
sbb edi, 0
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], edi
jmp 0x46995e
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x17c]
cmp dword [ebp + 0x4c], 0
jg 0x469977
jl 0x46996c
cmp dword [ebp + 0x48], 1
jae 0x469977
and dword [ebp + 0x4c], 0
mov dword [ebp + 0x48], 1
test edi, edi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], edi
jg 0x4699a6
jl 0x46998e
cmp esi, 1
jae 0x4699a6
sub eax, 1
sbb ecx, 0
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], ecx
cmp byte [ebp + 0x51], 0
je 0x4699ae
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x4c]
jmp 0x4699b2
xor eax, eax
xor ecx, ecx
push dword [ebp - 0x38]
lea edx, [ebp - 0xec]
push dword [ebp - 0x3c]
push edx
push ecx
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x6c]
push dword [ebp + 0x24]
push dword [ebp + 0x18]
push eax
call fcn.0044b37e
add esp, 0x24
cmp byte [ebp + 0x53], 0
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
jne 0x4699fd
or eax, edx
jne 0x4699fd
and dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 1
cmp dword [ebp - 0xe8], 0
jl 0x469430
jg 0x469a19
cmp dword [ebp - 0xec], 0x20
jb 0x469430
cmp byte [ebp + 0x5b], 2
mov eax, dword [ebp + 0x24]
je 0x46b869
cmp dword [ebp + 0x60], eax
mov dword [ebp + 0x34], 1
jae 0x469a5a
cmp dword [ebp - 0x68], eax
jge 0x469a5a
cmp dword [ebp + 0x60], 0
jl 0x469a5e
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x18]
push 0x10
push 0x4cd450
push eax
call fcn.004468ae
add esp, 0xc
test eax, eax
je 0x469a5e
and dword [ebp + 0x34], 0
mov ecx, dword [ebp + 0x40]
xor edx, edx
lea eax, [ecx + 0x3fff]
div ecx
cmp byte [ebp + 0x51], 1
mov dword [ebp + 0x30], eax
jne 0x469d9d
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x60], eax
jae 0x469430
mov edx, dword [ebp - 0x18]
mov dword [ebp + 0x14], edx
mov edx, dword [ebp - 0x138]
shl eax, 7
inc edx
imul edx, ecx
mov ecx, 0x4800
sub ecx, edx
cmp byte [ebp - 0x11], 0
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x20], ecx
jg 0x469ad7
jge 0x469ac4
xor edx, edx
cmp dword [ebp - 0x38], edx
jg 0x469ad7
jl 0x469ac4
mov edx, dword [ebp + 0x40]
lea edx, [edx + edx + 0x4000]
cmp dword [ebp - 0x3c], edx
ja 0x469ad7
xor edx, edx
test eax, eax
mov byte [ebp + 0x12], 0
mov dword [ebp - 0x28], edx
jle 0x469b7a
jmp 0x469b29
cmp dword [ebp + 0x40], 0x200
mov byte [ebp + 0x12], 1
jbe 0x469b00
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
mov eax, dword [ebp + 0x18]
add eax, 0x200
push 0
push eax
call fcn.004b4520
add esp, 0xc
mov eax, dword [ebp + 0x40]
add eax, 0xffffffa4
push eax
lea eax, [ebx + 0x5c]
push 0
push eax
call fcn.004b4520
push 0x4000
push 0
push dword [ebp - 0x18]
call fcn.004b4520
add esp, 0x18
jmp 0x469b7a
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
jl 0x469b43
push 0x10
push 0
push dword [ebp + 0x14]
call fcn.004b4520
add esp, 0xc
mov eax, 0x80
jmp 0x469b6c
push 0x1b0
push 0
push dword [ebp + 0x14]
call fcn.004b4520
mov eax, dword [ebp + 0x14]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.004b4520
add esp, 0x18
mov eax, 0x200
add dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
add dword [ebp + 0x14], eax
cmp edx, dword [ebp + 0xc]
jl 0x469b26
push 0x38
push 0
push ebx
call fcn.004b4520
push 0x14
lea eax, [ebx + 0x48]
push 0
push eax
call fcn.004b4520
mov eax, dword [ebp + 0x18]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.004b4520
mov eax, dword [ebp + 0x18]
add esp, 0x24
cmp byte [ebp + 0x12], 0
mov word [eax + 0x1fe], 0xaa55
jne 0x469bc7
cmp dword [ebp + 0x40], 0x200
jbe 0x469bc7
mov word [ebx - 2], 0xaa55
push 8
push str.EFI_PART
push ebx
call fcn.00414839
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp - 0xec]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x4c]
push dword [ebp + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x30]
cdq
mov dword [ebp - 0x11c], eax
add eax, dword [ebp + 0x48]
mov dword [ebp - 0x118], edx
adc edx, dword [ebp + 0x4c]
add eax, 1
adc edx, 0
mov dword [ebx + 0x20], ecx
sub ecx, dword [ebp - 0x11c]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xe8]
sbb eax, dword [ebp - 0x118]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], eax
call fcn.00443f1d
lea eax, [ebx + 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0x10
cmp ecx, 0x20323354
jne 0x469c63
cmp edx, 0x2020
je 0x469c9d
cmp ecx, 0x20363154
jne 0x469c73
cmp edx, 0x2020
je 0x469c9d
mov esi, ecx
or esi, edx
je 0x469c97
cmp ecx, 0xffffffff
jne 0x469c82
cmp edx, ecx
je 0x469c97
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
mov esi, ecx
or esi, edx
je 0x469c97
cmp ecx, 0xffffffff
jne 0x469cbb
cmp edx, ecx
jne 0x469cbb
mov esi, dword [ebp - 0x108]
push 0xc
push 0x4d0968
push eax
call fcn.00414839
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x1b8]
add esp, 0xc
mov dword [ebx + 0x44], eax
jmp 0x469cc1
mov esi, dword [ebp - 0x108]
lea eax, [ebx - 0x174]
push eax
call fcn.00443f1d
mov eax, dword [ebp + 0x48]
add eax, 1
pop ecx
mov ecx, dword [ebp + 0x4c]
adc ecx, 0
test edi, edi
mov dword [ebx + 0x48], eax
mov eax, 0x80
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
jg 0x469d04
jl 0x469cf6
cmp esi, 1
jae 0x469d04
or dword [ebp - 0x108], 0xffffffff
or dword [ebp - 0x104], 0xffffffff
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x18]
push 1
push dword [ebp + 0x5c]
shl eax, 4
push dword [ebp + 0x3c]
lea edi, [eax + ecx]
lea eax, [edi + 0x1bf]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push dword [ebp + 0x4c]
mov dword [edi + 0x1c2], 0xee
push dword [ebp + 0x48]
call fcn.00443e50
lea eax, [edi + 0x1c3]
add esp, 0x20
cmp byte [ebp + 0x52], 2
lea ecx, [eax + 1]
lea edx, [eax + 2]
mov byte [eax], 0xfe
mov byte [ecx], 0xff
mov byte [edx], 0xfe
jne 0x469d79
push 1
push dword [ebp + 0x5c]
push dword [ebp + 0x3c]
push ecx
push eax
push edx
push dword [ebp - 0x104]
push dword [ebp - 0x108]
call fcn.00443e50
add esp, 0x20
mov eax, dword [ebp + 0x48]
mov dword [edi + 0x1c6], eax
add edi, 0x1ca
or dword [edi], 0xffffffff
cmp byte [ebp + 0x52], 2
jne 0x46a0b1
mov eax, dword [ebp - 0x108]
mov dword [edi], eax
cmp byte [ebp + 0x51], 0
jg 0x46a0b1
cmp byte [ebp - 0x52], 0
jle 0x469db7
cmp dword [ebp + 0x60], 0
jl 0x46a0b1
cmp byte [ebp + 0x6a], 0
je 0x469e16
or dword [ebp + 0x60], 0xffffffff
xor esi, esi
cmp dword [ebp + 0x24], esi
mov byte [ebp - 0x3d], 0
jbe 0x469e16
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x94], eax
mov edi, 0x80
push 0x10
push 0x4cd450
push dword [ebp - 0x94]
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x469e01
add dword [ebp - 0x94], edi
inc esi
cmp esi, dword [ebp + 0x24]
jb 0x469dda
jmp 0x469e16
mov dword [ebp + 0x60], esi
push edi
shl esi, 7
add esi, dword [ebp - 0x18]
push 0
push esi
call fcn.004b4520
add esp, 0xc
mov eax, dword [ebp + 0x24]
dec dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
jae 0x469430
cmp dword [ebp - 0x68], eax
jge 0x469430
cmp byte [ebp - 0x3d], 0
je 0x469f2e
xor ecx, ecx
cmp byte [ebp + 0x53], cl
je 0x469e8b
mov eax, dword [ebp - 0x18]
add eax, 0x20
cmp ecx, dword [ebp + 0x24]
jae 0x469e8b
mov edx, dword [eax]
cmp edx, dword [ebp + 0x48]
jne 0x469e59
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x4c]
je 0x469e61
inc ecx
add eax, 0x80
jmp 0x469e45
mov edx, dword [ebp - 0x18]
mov eax, ecx
shl eax, 7
add eax, edx
cmp ecx, dword [ebp + 0x60]
mov esi, 0x4cd450
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x469e8b
push 0x80
push 0
push eax
call fcn.004b4520
add esp, 0xc
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x18]
shl eax, 7
push 0x10
add eax, ecx
push 0x4cd450
push eax
mov dword [ebp - 0x20], eax
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x469f18
mov edi, dword [ebp + 0x60]
inc edi
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jae 0x469430
mov esi, edi
shl esi, 7
add esi, dword [ebp - 0x18]
push 0x10
push 0x4cd450
push esi
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x469eea
inc edi
add esi, 0x80
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jb 0x469ec5
jmp 0x469f0c
cmp edi, dword [ebp + 0x60]
jle 0x469f0c
mov eax, dword [ebp + 0x3c]
mov edi, eax
shl edi, 7
add edi, dword [ebp - 0x18]
sub eax, dword [ebp + 0x60]
dec eax
lea edx, [edi - 0x80]
push 0x20
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, edx
jne 0x469efd
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x3c], eax
jae 0x469430
push 0x80
push 0
push dword [ebp - 0x20]
call fcn.004b4520
add esp, 0xc
and dword [ebp + 0x34], 0
cmp byte [ebp + 0x51], 1
je 0x46a092
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp eax, ecx
jge 0x46a04b
cmp dword [ebp + 0x34], ecx
jne 0x469f71
xor eax, eax
inc eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x1a0], ecx
jle 0x469f8e
mov edi, dword [ebp + 0x60]
shl edi, 7
add edi, dword [ebp - 0x18]
lea esi, [ebp - 0x1d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x198], ecx
jle 0x469faf
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x18]
shl eax, 7
lea edi, [eax + ecx + 0x10]
lea esi, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x18]
jle 0x469fce
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x48]
shl edx, 7
mov dword [edx + eax + 0x20], esi
mov esi, dword [ebp + 0x4c]
mov dword [edx + eax + 0x24], esi
cmp dword [ebp - 0x194], ecx
jle 0x469ff0
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x108]
shl edx, 7
mov dword [edx + eax + 0x28], esi
mov esi, dword [ebp - 0x104]
mov dword [edx + eax + 0x2c], esi
cmp dword [ebp - 0x19c], ecx
jle 0x46a012
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x178]
shl edx, 7
mov dword [edx + eax + 0x30], esi
mov esi, dword [ebp - 0x174]
mov dword [edx + eax + 0x34], esi
cmp dword [ebp - 0x190], ecx
jle 0x46a092
mov eax, dword [ebp - 0x48]
cmp word [eax], 0
je 0x46a092
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x18]
shl eax, 7
push 0x48
lea esi, [eax + ecx + 0x38]
push 0
push esi
call fcn.004b4520
add esp, 0xc
push 0x24
push dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x46a092
cmp eax, dword [ebp + 0x60]
je 0x46a092
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp - 0x18]
shl ecx, 7
lea edx, [ecx + eax]
push 0x20
pop ecx
mov esi, edx
lea edi, [ebp - 0x360]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x68]
shl ecx, 7
add eax, ecx
push 0x20
pop ecx
mov esi, eax
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
push 0x20
pop ecx
lea esi, [ebp - 0x360]
rep movsd dword es:[edi], dword [esi]
jge 0x46a092
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x10], 0
je 0x46a0b1
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x18]
push 0x80
push 0
push eax
call fcn.004b4520
add esp, 0xc
mov al, byte [ebp + 7]
and dword [ebp + 0x34], 0
and al, 0x20
mov byte [ebp - 0x42], al
je 0x46a0ca
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x14c], eax
jmp 0x46a0d4
mov dword [ebp - 0x14c], 0xfffffff8
cmp byte [ebp - 0x52], 1
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x20], eax
jne 0x46a20e
cmp byte [ebp + 0x51], 1
je 0x46a20e
mov eax, dword [ebp + 0x24]
xor esi, esi
dec eax
cmp eax, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x94], esi
jl 0x46a20e
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x5c], eax
xor edi, edi
push 0x10
push 0x4cd450
push dword [ebp + 0x14]
call fcn.004468ae
add esp, 0xc
test al, al
mov byte [ebp + 0x12], al
jne 0x46a137
cmp esi, dword [ebp - 0x28]
mov dword [ebp + 0xc], edi
je 0x46a13e
mov dword [ebp + 0xc], 1
cmp esi, dword [ebp - 0x14c]
mov dword [ebp + 0x3c], edi
jne 0x46a156
mov eax, dword [ebp - 0x28]
mov dword [ebp + 0x3c], 2
mov dword [ebp - 0x20], eax
cmp byte [ebp + 0x12], 0
jne 0x46a1c3
cmp esi, dword [ebp - 0x28]
je 0x46a1b7
push 0x38
push dword [ebp + 0x14]
push dword [ebp + 0x5c]
call fcn.004b6ab0
add esp, 0xc
test eax, eax
je 0x46a18c
push 0x38
push dword [ebp + 0x14]
mov dword [ebp + 0x3c], 1
push dword [ebp + 0x5c]
call fcn.004b4bd0
add esp, 0xc
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x5c]
push 0x24
add esi, 0x38
push esi
add edi, 0x38
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
je 0x46a1b7
push 0x24
push esi
push edi
mov dword [ebp + 0x3c], 1
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
inc dword [ebp - 0x28]
add dword [ebp + 0x5c], 0x80
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x46a1e3
cmp byte [ebp + 0x12], 0
jne 0x46a1e3
push 0x10
push edi
push dword [ebp + 0x14]
mov dword [ebp + 0x3c], 1
call fcn.004b4520
add esp, 0xc
cmp dword [ebp + 0x3c], edi
mov esi, dword [ebp - 0x94]
je 0x46a1f4
lea eax, [esi + 1]
mov dword [ebp + 0x34], eax
add dword [ebp + 0x14], 0x80
inc esi
cmp esi, dword [ebp - 0x10c]
mov dword [ebp - 0x94], esi
jle 0x46a116
push 8
push str.EFI_PART
push ebx
call fcn.00414839
push dword [ebp + 0x18]
call fcn.00443f1d
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, eax
add esp, 0x10
or edx, ecx
je 0x46a23b
cmp eax, 0xffffffff
jne 0x46a248
cmp ecx, eax
jne 0x46a248
lea eax, [ebx - 0x174]
push eax
call fcn.00443f1d
pop ecx
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x34], eax
jg 0x46a254
inc eax
mov dword [ebp + 0x34], eax
cmp byte [ebp + 0x51], 1
jne 0x46a260
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x24]
xor edi, edi
push edi
shl eax, 7
push edi
push eax
push dword [ebp - 0x18]
call fcn.0049f9e1
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0xc]
add esp, 0x10
cmp eax, 0x20000
mov dword [ebp - 0x28], eax
ja 0x46ba71
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.0049f9e1
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x18]
push ebx
add esi, 0x10000
push esi
mov dword [ebx + 0x10], eax
call fcn.00414839
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x24], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [esi + 0x10], edi
push esi
call fcn.0049f9e1
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x30]
mov esi, dword [ebp + 0x40]
add esp, 0x2c
inc eax
imul eax, esi
push eax
lea ecx, [ebp - 0xb4]
call fcn.00402d92
mov eax, dword [ebp - 0xb4]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x34]
shl eax, 7
lea eax, [eax + esi - 1]
xor edx, edx
div esi
push edi
push dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x3c]
imul eax, esi
mov dword [ebp - 0x10c], eax
call fcn.0040fa04
push esi
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.00402d45
push esi
push dword [ebp + 0x18]
push dword [ebp - 0xb4]
call fcn.004b6ab0
add esp, 0xc
test eax, eax
je 0x46a363
push edi
push dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x3c]
call fcn.0040fa04
push esi
push dword [ebp + 0x18]
lea ecx, [ebp + 0x6c]
call fcn.0043fcd3
mov eax, dword [ebp - 0x10c]
xor edx, edx
div esi
mov ecx, dword [ebp - 0x134]
push edi
xor edx, edx
push edx
push esi
push ecx
mov dword [ebp + 0x40], ebx
mov dword [ebp - 0xb8], ecx
inc eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x138]
push eax
mov dword [ebp - 0xbc], eax
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
mov eax, dword [ebp + 0x14]
imul eax, esi
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.00402d45
cmp dword [ebp + 0x14], edi
mov dword [ebp + 0x3c], edi
jle 0x46a4a3
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x14]
jge 0x46a405
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.004b6ab0
add esp, 0xc
test eax, eax
jne 0x46a402
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x14]
jl 0x46a3d1
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x30]
jge 0x46a4a3
mov ecx, dword [ebp + 0x40]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x214], ecx
jmp 0x46a45a
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.004b6ab0
add esp, 0xc
test eax, eax
je 0x46a45f
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x14]
jl 0x46a42e
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.0043fcd3
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x3c], eax
jl 0x46a3c9
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp - 0xec]
cdq
sub ecx, eax
mov eax, dword [ebp - 0xe8]
sbb eax, edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp + 0x5c], edx
mov edx, dword [ebp - 0x18]
push edi
mov dword [ebp + 0x40], edx
xor edx, edx
push edx
push esi
push eax
push ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], eax
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
mov eax, dword [ebp + 0x30]
imul eax, esi
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.00402d45
cmp dword [ebp + 0x30], edi
mov dword [ebp + 0x3c], edi
jle 0x46a5f7
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jge 0x46a5f7
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.004b6ab0
add esp, 0xc
test eax, eax
jne 0x46a558
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x30]
jl 0x46a527
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jge 0x46a5f7
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1ec], eax
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x5c]
call fcn.004b6ab0
add esp, 0xc
test eax, eax
je 0x46a5b3
inc dword [ebp + 0x3c]
add dword [ebp - 0xbc], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0xb8], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x5c], esi
cmp eax, dword [ebp + 0x30]
jl 0x46a582
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x1ec]
push dword [ebp - 0x1f0]
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.0043fcd3
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jl 0x46a51b
xor eax, eax
push eax
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call fcn.004b4630
add eax, dword [ebp - 0x3c]
push edi
adc edx, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push edx
push eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], edx
call fcn.0040fa04
push esi
push dword [ebp - 0xb4]
lea ecx, [ebp + 0x6c]
call fcn.00402d45
mov eax, dword [ebp - 0x18]
add eax, 0x10000
push esi
push eax
push dword [ebp - 0xb4]
mov dword [ebp + 0x34], eax
call fcn.004b6ab0
add esp, 0xc
test eax, eax
je 0x46a678
push edi
push dword [ebp - 0x1f4]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x1f8]
call fcn.0040fa04
push esi
push dword [ebp + 0x34]
lea ecx, [ebp + 0x6c]
call fcn.0043fcd3
movsx ecx, byte [ebp + 0x65]
movsx eax, byte [ebp + 0x6b]
or eax, ecx
movsx ecx, byte [ebp + 0x47]
or eax, ecx
cmp byte [ebp - 0x42], 0
je 0x46a69f
cmp eax, edi
je 0x46bc99
cmp dword [ebp - 8], edi
jge 0x46baa5
cmp eax, edi
je 0x46bc99
lea ecx, [ebp - 0xb4]
mov dword [ebp + 0x5c], edi
call fcn.0043fe25
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
xor cl, cl
cmp byte [ebp + 0x50], cl
je 0x46a6da
cmp dword [ebp + 0x5c], 0
jne 0x46a6e8
mov al, byte [ebp + 0x64]
cmp al, 0x10
mov cl, 0x40
jne 0x46a6eb
add cl, 0x20
jmp 0x46a6eb
mov al, byte [ebp + 0x64]
cmp dword [ebp - 8], 0
jl 0x46a72c
cmp al, 0x20
je 0x46a6f9
cmp al, 0x10
jne 0x46a6ff
cmp dword [ebp - 0x50], 0xb
je 0x46a723
test byte [ebp + 0x65], 0x20
jne 0x46a723
cmp byte [ebp - 0x29], 0
jg 0x46a755
cmp byte [ebp - 0x29], 0
jg 0x46a755
cmp byte [ebp + 0x47], 0
jne 0x46a746
cmp al, 1
je 0x46a746
or cl, 2
cmp al, 1
je 0x46a751
test byte [ebp + 0x6b], 0x20
jne 0x46a771
cmp byte [ebp + 0x6b], 0
je 0x46a767
or cl, 8
push dword [ebp - 0x34]
movsx eax, cl
or dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x66]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x6c]
push dword [ebp - 8]
push eax
call fcn.00456a1e
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x467f11
je 0x46a7c1
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
jmp 0x46b82e
cmp dword [ebp - 0xc], ebx
jge 0x46a7f4
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
jne 0x46a7f4
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
jmp 0x46945f
mov eax, dword [ebp - 0x78]
mov edi, 0x1b8
mov dword [ebp + 0x5c], edi
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a4], ebx
cmp word [eax], bx
je 0x46a951
push eax
push 0x4d0964
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x46a951
push dword [ebp - 0x78]
push 0x4cc590
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x46a951
mov edi, dword [ebp - 0x78]
push edi
push 0x4d0960
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x46a86d
mov dword [ebp - 0x10], 0x4e1378
mov dword [ebp + 0x5c], 0x190
jmp 0x46a96d
push edi
push 0x4d095c
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x46a891
mov dword [ebp - 0x10], 0x4e1508
mov dword [ebp + 0x5c], 0x180
jmp 0x46a96d
mov dword [ebp + 0x5c], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
jne 0x46a8c8
lea eax, [ebp - 0xa8]
push eax
inc edi
lea eax, [ebp - 0x78]
inc edi
push eax
mov dword [ebp - 0x78], edi
call fcn.0044c029
mov edi, dword [ebp - 0x78]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x46a8c8
inc edi
inc edi
cmp word [edi], 0x23
jne 0x46a906
push edi
lea ecx, [ebp + 0xc]
call fcn.004505eb
push ebx
lea eax, [ebp - 0x1ac]
push eax
push 0x4c7cf8
push dword [ebp + 0xc]
push ebx
call fcn.0041593f
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.0043fe25
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + 0x5c], eax
jmp 0x46a91d
lea eax, [ebp + 0x5c]
push eax
push ebx
push edi
call fcn.0041031f
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0xa4], ebx
jl 0x46a95b
jg 0x46a92f
cmp dword [ebp - 0xa8], ebx
jb 0x46a95b
xor eax, eax
cmp eax, dword [ebp - 0xa4]
jl 0x46a95b
jg 0x46a946
mov eax, dword [ebp + 0x5c]
cmp eax, dword [ebp - 0xa8]
jbe 0x46a95b
mov eax, dword [ebp - 0xa8]
mov dword [ebp + 0x5c], eax
jmp 0x46a95b
mov dword [ebp - 0x10], 0x4e1688
mov dword [ebp + 0x5c], edi
cmp dword [ebp + 0x5c], ebx
jbe 0x46ab2c
cmp dword [ebp - 0x10], ebx
je 0x46ab2c
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.00405c6d
cmp dword [ebp + 0x6c], ebx
je 0x46ab2c
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.004438ac
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x46a9a9
mov edi, esi
mov ecx, dword [ebp + 0x5c]
lea eax, [edi - 1]
add ecx, eax
not eax
and ecx, eax
cmp ecx, edi
mov dword [ebp + 0x34], ecx
mov ebx, ecx
jge 0x46a9c0
mov ebx, edi
lea eax, [edi + ebx*2]
push eax
lea ecx, [ebp - 0x48]
call fcn.00446437
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xcc]
lea esi, [edi - 1]
add eax, edi
not esi
and esi, eax
xor eax, eax
xor edx, edx
or ecx, dword [ebp - 0xc8]
lea edi, [esi + ebx]
je 0x46a9ff
push edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x10
cmp eax, dword [ebp - 0x3c]
jne 0x46aaf0
cmp edx, dword [ebp - 0x38]
jne 0x46aaf0
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x34]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46aaf0
push dword [ebp + 0x34]
push edi
push esi
call fcn.00414839
mov ecx, dword [ebp + 0x5c]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x46aa47
mov ecx, eax
mov ebx, dword [ebp - 0x10]
push ecx
push ebx
push edi
call fcn.00414839
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp eax, 0x200
jbe 0x46aa89
add eax, 0xfffffe00
push eax
add ebx, 0x200
lea eax, [edi + 0x200]
push ebx
push eax
call fcn.00414839
add esp, 0xc
push dword [ebp + 0x34]
push edi
push esi
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x46aad8
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x10
cmp eax, dword [ebp - 0x3c]
jne 0x46aaf0
cmp edx, dword [ebp - 0x38]
jne 0x46aaf0
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x34]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.00443eca
test esi, esi
pop ecx
je 0x46aaf0
lea ecx, [ebp - 0x48]
call fcn.0043fe25
lea ecx, [ebp - 0x1ac]
call fcn.0043fe25
jmp 0x46b61a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x46aafd
inc edi
lea ecx, [ebp - 0x48]
call fcn.0043fe25
lea ecx, [ebp - 0x1ac]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
test eax, eax
jmp 0x46b7eb
lea ecx, [ebp - 0x1ac]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
jmp 0x46b66c
cmp dword [ebp + 0x60], ebx
jle 0x46a7d8
cmp dword [ebp - 0xc], ebx
jge 0x46ab70
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
je 0x46a7d8
xor eax, eax
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp + 0xc], esi
jge 0x46ab8f
xor al, al
jne 0x46abb7
jmp 0x46a7d8
push dword [ebp - 0x6c]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x60]
push dword [ebp - 0xc]
push eax
call fcn.004659e4
add esp, 0x1c
cmp dword [ebp + 0xc], ebx
jle 0x46ab37
mov edi, dword [ebp - 0xd8]
mov dword [ebp + 0x30], 0x200
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
cmp word [edi], bx
je 0x46ad4e
push edi
push 0x4d0964
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x46ad4e
push edi
push 0x4cc590
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x46ad4e
push edi
push 0x4d095c
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x46ac21
push 8
jmp 0x46ad50
push edi
push str.nt6fat
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x46ad4a
push edi
push str.winfat
call fcn.004412b6
test al, al
pop ecx
pop ecx
jne 0x46ad4a
push edi
push 0x4d0960
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x46ac63
push 6
jmp 0x46ad50
push edi
push str.nt5fat
call fcn.004412b6
test al, al
pop ecx
pop ecx
je 0x46ac7b
push 5
jmp 0x46ad50
mov dword [ebp + 0x30], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
jne 0x46acbb
lea eax, [ebp - 0xa8]
push eax
inc edi
lea eax, [ebp - 0xd8]
inc edi
push eax
mov dword [ebp - 0xd8], edi
call fcn.0044c029
mov edi, dword [ebp - 0xd8]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x46acbb
inc edi
inc edi
cmp word [edi], 0x23
jne 0x46acf9
push edi
lea ecx, [ebp + 0xc]
call fcn.004505eb
push ebx
lea eax, [ebp - 0x160]
push eax
push 0x4c7cf8
push dword [ebp + 0xc]
push ebx
call fcn.0041593f
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x50], eax
call fcn.0043fe25
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x30], eax
jmp 0x46ad10
lea eax, [ebp + 0x30]
push eax
push ebx
push edi
call fcn.0041031f
add esp, 0xc
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0xa4], ebx
jl 0x46ad40
jg 0x46ad22
cmp dword [ebp - 0xa8], ebx
jb 0x46ad40
cmp ebx, dword [ebp - 0xa4]
jl 0x46ad40
jg 0x46ad37
mov eax, dword [ebp + 0x30]
cmp eax, dword [ebp - 0xa8]
jbe 0x46ad40
mov eax, dword [ebp - 0xa8]
mov dword [ebp + 0x30], eax
cmp dword [ebp - 0x50], ebx
jne 0x46ad79
jmp 0x46adec
push 7
jmp 0x46ad50
push 9
pop eax
push ebx
lea ecx, [ebp - 0x160]
push ecx
push str.INDATA
push eax
push ebx
call fcn.0041593f
add esp, 0x14
cmp dword [ebp + 0x30], ebx
mov dword [ebp - 0x50], eax
je 0x46adec
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x30], ebx
jbe 0x46adec
cmp dword [ebp - 0x50], ebx
je 0x46adec
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
call fcn.00405c6d
cmp dword [ebp + 0x6c], ebx
je 0x46adec
push ebx
push 0x200
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call fcn.004b4630
mov esi, eax
add esi, dword [ebp - 0x11c]
mov edi, edx
adc edi, dword [ebp - 0x118]
push ebx
push edi
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], edi
call fcn.00441183
add esp, 0x10
cmp eax, esi
jne 0x46adec
cmp edx, edi
je 0x46adf7
lea ecx, [ebp - 0x160]
jmp 0x46ab32
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.004438ac
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x46ae0f
mov edi, esi
mov ecx, dword [ebp + 0x30]
lea eax, [edi - 1]
lea esi, [eax + ecx]
not eax
and esi, eax
lea eax, [edi + esi*2]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00446437
mov eax, dword [ebp - 0xd4]
lea ebx, [edi - 1]
add eax, edi
push 0
not ebx
and ebx, eax
lea eax, [ebp - 0x58]
push eax
push esi
lea edi, [ebx + esi]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46ae84
lea ecx, [ebp - 0xd4]
call fcn.0043fe25
lea ecx, [ebp - 0x160]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
test eax, eax
jmp 0x46b66c
push esi
push edi
push ebx
call fcn.00414839
push 0
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
push dword [ebp + 0x6c]
call fcn.00441183
add esp, 0x1c
cmp eax, dword [ebp - 0x100]
jne 0x46ae52
cmp edx, dword [ebp - 0xfc]
jne 0x46ae52
mov eax, dword [ebp + 0x30]
push 3
push dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
push edi
call fcn.00414839
mov eax, 0x1fe
add esp, 0xc
cmp dword [ebp - 0x48], eax
jle 0x46aed6
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0xffffffe2
push eax
mov eax, dword [ebp - 0x50]
add eax, 0x1e
push eax
lea eax, [edi + 0x1e]
push eax
call fcn.00414839
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x30]
add esp, 0xc
cmp eax, 0x200
jbe 0x46af26
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x50]
add eax, 0x200
push eax
lea eax, [edi + 0x200]
push eax
call fcn.00414839
add esp, 0xc
push esi
push edi
push ebx
mov dword [ebp + 0x5c], 1
call fcn.004468ae
add esp, 0xc
test eax, eax
jne 0x46af58
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x5c], eax
call fcn.00443eca
pop ecx
xor eax, eax
cmp dword [ebp + 0x5c], eax
lea ecx, [ebp - 0xd4]
sete al
mov edi, eax
call fcn.0043fe25
lea ecx, [ebp - 0x160]
jmp 0x46ab0b
push 0x103c
lea ecx, [ebp + 0x1c]
call fcn.004465d3
mov esi, dword [ebp + 0x1c]
mov ax, word [edi]
add esi, 0x2000
cmp ax, bx
mov dword [ebp + 0x34], 0x4c8078
je 0x46afe4
cmp word [edi + 2], 0x3a
jne 0x46afe4
movzx eax, ax
push eax
push 0x4d0934
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x46afd6
cmp dword [ebp - 0x8c], 0x10
jne 0x46b037
mov dword [ebp + 0x34], 0x4c8048
cmp eax, 5
jne 0x46b037
mov dword [ebp + 0x34], 0x4c8068
jmp 0x46b037
cmp dword [ebp - 0xc], ebx
jl 0x46b037
cmp dword [ebp - 0x8c], 8
jne 0x46b00a
push dword [ebp - 0xc]
push str..CDROM_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp + 0x34], 0x4c8068
jmp 0x46b034
cmp dword [ebp - 0x8c], 0x10
jne 0x46b025
mov esi, dword [ebp - 0xc]
and esi, 0xfff
mov dword [ebp + 0x34], 0x4c8048
jmp 0x46b037
push dword [ebp - 0xc]
push str..PhysicalDrive_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
movzx eax, word [ebp - 0x9c]
push dword [ebp + 0x34]
or eax, 0x20
push eax
push dword [ebp + 0x1c]
push esi
call fcn.004553e7
mov ecx, dword [ebp - 0xc4]
add esp, 0x10
push dword [ebp + 0x1c]
push dword [ebp - 0xd0]
call fcn.00445c44
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
jmp 0x46b631
cmp byte [ebp - 0x3f], 0
je 0x46b090
cmp dword [ebp - 8], ebx
jl 0x46bd70
mov al, byte [ebp - 0x3e]
neg al
sbb eax, eax
and eax, 0x200000
or eax, dword [ebp - 8]
or eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00464e2e
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
xor eax, eax
cmp word [ecx], bx
sete al
mov dword [ebp - 4], eax
jmp 0x46bd70
cmp dword [ebp - 8], ebx
jl 0x46b0fa
cmp byte [ebp - 0x44], 0
je 0x46b0d1
cmp dword [ebp + 0x60], ebx
jl 0x46b0fa
push dword [ebp - 0x6c]
movsx eax, byte [ebp - 0x3e]
or eax, dword [ebp + 8]
push ebx
push ebx
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 8]
push eax
call fcn.004659e4
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc0], ebx
jle 0x46bd8e
mov eax, dword [ebp - 0xc0]
and eax, 0x9fffffff
or eax, 0x10000000
mov dword [ebp - 0xc0], eax
jmp 0x46bd70
cmp dword [ebp - 0xc], ebx
jge 0x46b181
cmp word [edi], bx
je 0x46b181
cmp word [edi + 2], 0x3a
mov eax, edi
jne 0x46b17e
cmp word [edi + 4], bx
jne 0x46b17e
mov word [ebp - 0x2e0], 0x5c
mov word [ebp - 0x2de], 0x5c
mov word [ebp - 0x2dc], 0x2e
mov word [ebp - 0x2da], 0x5c
mov ax, word [edi]
mov word [ebp - 0x2d8], ax
mov word [ebp - 0x2d6], 0x3a
mov word [ebp - 0x2d4], bx
lea eax, [ebp - 0x2e0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jl 0x46bd70
cmp byte [ebp - 0x44], 0
je 0x46b199
cmp dword [ebp + 0x60], ebx
jl 0x46bd70
push dword [ebp - 0x8c]
lea eax, [ebp + 0x1c]
push dword [ebp - 8]
push eax
push dword [ebp - 0xc4]
call fcn.0045647f
add esp, 0x10
jmp 0x46b0b9
mov eax, dword [ebp - 0xf0]
movzx edi, word [eax]
and edi, 0xffffffdf
cmp dword [ebp - 0x8c], ebx
lea esi, [edi - 0x41]
jle 0x46b23c
push 0x3b60
lea ecx, [ebp + 0xc]
call fcn.00446437
mov eax, dword [ebp + 0xc]
mov ecx, edi
shl ecx, 0x10
or ecx, dword [ebp - 0x8c]
lea ebx, [eax + 0x200]
push ecx
push eax
push ebx
call fcn.00455860
imul esi, esi, 0x220
add esi, ebx
add esp, 0xc
cmp dword [esi + 8], 0
jle 0x46b22d
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.004465d3
push edi
push dword [esi + 4]
push str._d__c:
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
and dword [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043fe25
xor ebx, ebx
jmp 0x46bd68
mov cx, word [eax]
mov edx, dword [ebp + 0x1c]
mov word [edx], cx
cmp word [eax], 0x5c
jne 0x46b24e
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
je 0x46bd68
push dword [ebp - 0x6c]
mov eax, dword [ebp + 8]
push ebx
and eax, 0xfffffffd
push ebx
or eax, 0xc
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 8]
push eax
call fcn.004659e4
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp - 4], ecx
jmp 0x46bd68
cmp dword [ebp - 0xc], ebx
jge 0x46b30a
cmp word [edi], bx
je 0x46b307
cmp word [edi + 2], 0x3a
jne 0x46b2fe
cmp word [edi + 4], 0x5c
jne 0x46b2ac
cmp word [edi + 6], bx
jne 0x46b2ac
mov word [edi + 4], bx
cmp word [edi + 4], bx
jne 0x46b2f9
push 9
lea ecx, [ebp + 0x54]
call fcn.004465d3
mov eax, dword [ebp + 0x54]
mov word [eax], 0x5c
mov eax, dword [ebp + 0x54]
mov word [eax + 2], 0x5c
mov eax, dword [ebp + 0x54]
mov word [eax + 4], 0x2e
mov eax, dword [ebp + 0x54]
mov word [eax + 6], 0x5c
mov ax, word [edi]
mov ecx, dword [ebp + 0x54]
mov word [ecx + 8], ax
mov eax, dword [ebp + 0x54]
mov word [eax + 0xa], 0x3a
mov eax, dword [ebp + 0x54]
mov word [eax + 0xc], bx
cmp dword [ebp + 0x54], ebx
jne 0x46b307
push edi
lea ecx, [ebp + 0x54]
call fcn.004506c8
mov dword [ebp + 0x60], esi
cmp dword [ebp + 0x60], ebx
jg 0x46b312
mov dword [ebp + 0x60], esi
test byte [ebp - 0x7a], 1
mov eax, dword [ebp + 0x60]
je 0x46b31f
or dword [ebp + 8], 0x20
test word [ebp + 8], 0x402
je 0x46b351
cmp dword [ebp - 0xc], ebx
jl 0x46b351
cmp dword [ebp + 0x60], ebx
jle 0x46b351
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
push dword [ebp + 0x60]
mov word [eax], bx
push dword [ebp - 0xc]
lea eax, [ebp + 0x1c]
push eax
call fcn.004659e4
add esp, 0x1c
push dword [ebp + 0x54]
mov ecx, dword [ebp + 8]
and eax, 0xf000ffff
shl ecx, 0x10
or eax, ecx
push eax
push dword [ebp - 0xc]
lea eax, [ebp + 0x1c]
push eax
call fcn.00404f66
add esp, 0x10
cmp eax, ebx
je 0x46b384
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
mov dword [ebp - 4], ebx
jne 0x46bd68
mov dword [ebp - 4], 0x80070057
jmp 0x46bd68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x46b7cc
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
jmp 0x467f58
lea ecx, [ebp - 0x4c]
jmp 0x46b60d
lea ecx, [ebp - 0x4c]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
jmp 0x46ae68
lea ecx, [ebp - 0x4c]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, esi
jmp 0x46945f
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
jmp 0x46b822
and eax, 0x10
shr eax, 4
mov edi, eax
jmp 0x46b7bc
lea ecx, [ebp - 0x30]
call fcn.0043fe25
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
jmp 0x46ab37
lea ecx, [ebp - 0x30]
call fcn.0043fe25
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
jmp 0x46a7d8
push 0x28
lea ecx, [ebp + 0x1c]
call fcn.004465d3
mov esi, dword [ebp + 0x60]
mov ebx, dword [ebp + 0x1c]
xor ecx, ecx
test esi, esi
push 4
mov dword [ebp - 0x9c], 0x4c6a64
pop eax
jl 0x46b4c3
lea edx, [esi + 1]
cmp edx, eax
mov ecx, esi
jge 0x46b4bb
mov eax, edx
cmp esi, eax
jge 0x46b5cf
mov esi, dword [ebp + 0x24]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], edx
mov edx, ecx
shl edx, 4
sub eax, ecx
lea esi, [edx + esi + 0x1c6]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x60], 0
mov al, byte [esi - 4]
mov byte [ebp - 0x40], al
jge 0x46b535
cmp al, 5
je 0x46b4fc
cmp al, 0xf
mov ecx, 0x4c6a64
jne 0x46b501
mov ecx, 0x4d0930
xor edx, edx
test al, al
setne dl
lea edx, [edx + edx - 1]
imul edx, dword [ebp - 0x6c]
push edx
push ecx
push dword [ebp - 0x9c]
push str._s_s_d
push ebx
call edi
add esp, 0x14
lea ebx, [ebx + eax*2]
mov dword [ebp - 0x9c], 0x4c7598
jmp 0x46b5c0
test al, al
je 0x46b5c0
push dword [ebp - 0x6c]
push dword [ebp - 0x9c]
push str._s_d
push ebx
call edi
add esp, 0x10
test byte [ebp + 8], 1
lea ebx, [ebx + eax*2]
mov eax, str._0x_X
jne 0x46b564
mov eax, 0x4d07d4
movzx ecx, byte [ebp - 0x40]
push ecx
push eax
push ebx
call edi
lea ebx, [ebx + eax*2]
movzx eax, byte [esi - 8]
shr eax, 7
push eax
push 0x4d07d4
push ebx
call edi
lea ebx, [ebx + eax*2]
mov eax, dword [esi]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.004a1252
add esp, 0x28
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2]
mov eax, dword [esi + 4]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.004a1252
add esp, 0x10
inc dword [ebp - 0x6c]
add esi, 0x10
dec dword [ebp + 0xc]
jne 0x46b4e3
cmp dword [ebp - 0xc0], 0
jle 0x46b5ee
push dword [ebp - 0xc0]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xc4]
call fcn.0044b612
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0xd0]
call fcn.00445c44
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
test eax, eax
je 0x4677c8
push eax
jmp 0x4677c2
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, esi
je 0x467e6c
push eax
jmp 0x467e66
push dword [ebp - 0x34]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x66]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x6c]
push dword [ebp - 8]
push eax
call fcn.00456a1e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x60]
xor ebx, ebx
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x10], ebx
jl 0x46b776
mov ecx, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
inc eax
push eax
push dword [ebp - 8]
lea eax, [ebp + 0x1c]
push eax
mov word [ecx], bx
call fcn.004659e4
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jle 0x46b776
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x120], ebx
mov dword [ebp - 0x20], eax
jle 0x46b6ec
mov dword [ebp - 0x120], ebx
mov ebx, dword [ebp - 0x10c]
push 0
or ebx, 0x100000
push ebx
push dword [ebp - 0xc]
lea eax, [ebp + 0x1c]
push eax
call fcn.00404f66
add esp, 0x10
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x46b740
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
cmp eax, 0x1388
ja 0x46b73a
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x10]
lea ebx, [eax + 0x78]
add eax, 0x7a
push eax
mov word [ebx], 0x23
call fcn.0043fdc2
mov eax, dword [ebp + 0x24]
pop ecx
pop ecx
push 0xc
push esi
push 3
push ebx
push str.SYSTEMMountedDevices
push edi
mov word [eax + 0x7c], 0x3f
call dword [0x4e327c]
xor ebx, ebx
cmp dword [ebp - 0x120], ebx
jge 0x46b789
cmp dword [ebp - 0x10], ebx
je 0x46b7b2
cmp dword [ebp - 0x120], ebx
jle 0x46b7a3
cmp dword [ebp - 0x10], ebx
jne 0x46b7a3
mov ecx, dword [ebp - 0xc4]
push ebx
push ebx
push dword [ebp - 0x120]
call fcn.0041195d
push dword [ebp + 0x24]
push str.SYSTEMMountedDevices
push edi
call dword [0x4e3280]
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jge 0x46b7bc
mov edi, dword [ebp - 4]
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
je 0x46b82e
push eax
jmp 0x467dc1
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
test eax, eax
je 0x46b82b
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0xdc]
call fcn.0043fe25
lea ecx, [ebp - 0xd0]
call fcn.0043fe25
lea ecx, [ebp - 0xf0]
call fcn.0043fe25
lea ecx, [ebp - 0x1e0]
call fcn.0043fe25
lea ecx, [ebp + 0x1c]
call fcn.0043fe25
mov eax, edi
jmp 0x46bdf9
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea ecx, [ebp + 0x1c]
call fcn.004465d3
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x24]
xor ecx, ecx
test edx, edx
mov dword [ebp - 0x9c], 0x4c6a64
jl 0x46b899
mov ecx, edx
inc edx
cmp eax, edx
jle 0x46b899
mov eax, edx
cmp ecx, eax
jge 0x46ba09
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [ecx + 1]
mov dword [ebp - 0x30], edx
mov edx, ecx
shl edx, 7
add edx, dword [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 0x48], edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
jne 0x46b8d3
mov ecx, dword [eax + 8]
or ecx, dword [eax + 0xc]
je 0x46b9f6
cmp dword [ebp + 0x60], 0
push dword [ebp - 0x30]
push dword [ebp - 0x9c]
jge 0x46b900
push str._s_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x9c], 0x4c7598
jmp 0x46b9f3
push 0x4d08ec
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x18]
lea esi, [esi + eax*2]
mov eax, dword [ebp + 0x60]
shl eax, 7
lea edi, [eax + ecx]
push 0
push edi
push esi
call fcn.00443abf
add esp, 0x1c
push esi
call ebx
lea esi, [esi + eax*2]
push str._GPT
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x200
push dword [edi + 0x24]
add esi, 0xa
push dword [edi + 0x20]
call fcn.004b4630
push edx
push eax
push esi
call fcn.004a129d
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
inc esi
inc esi
sub eax, dword [edi + 0x20]
push 0
sbb ecx, dword [edi + 0x24]
add eax, 1
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.004b4630
push edx
push eax
push esi
call fcn.004a129d
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push str._016I64X
push dword [edi + 0x34]
inc esi
push dword [edi + 0x30]
inc esi
push esi
call fcn.004a1252
add esp, 0x10
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push 0
inc esi
add edi, 0x10
inc esi
push edi
push esi
call fcn.00443abf
add esp, 0xc
test byte [ebp + 8], 0x10
je 0x46b9f6
push esi
call ebx
push dword [ebp - 0x30]
lea esi, [esi + eax*2]
mov word [esi], 0x20
inc esi
inc esi
push 0x4c72f0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
add dword [ebp - 0x48], 0x80
inc dword [ebp - 0x30]
dec dword [ebp + 0xc]
jne 0x46b8bd
xor edi, edi
cmp dword [ebp - 0xc0], edi
jle 0x46ba29
push dword [ebp - 0xc0]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xc4]
call fcn.0044b612
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0xd0]
call fcn.00445c44
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, edi
jmp 0x46b7eb
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, edi
jmp 0x46945f
mov eax, dword [ebp - 0x20]
shl eax, 7
mov dword [ebp - 0x10c], eax
xor edx, edx
div esi
push dword [ebp - 0x34]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x66]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp + 0x6c]
push dword [ebp - 8]
push eax
call fcn.00456a1e
add esp, 0x18
push edi
push 0x20000000
push 3
push edi
push 3
push 0xc0000000
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
mov dword [ebp - 0x20], eax
call fcn.00405c6d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
lea eax, [ecx + eax + 0x30]
mov edx, dword [eax]
and byte [eax + 7], 0x7f
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
push edi
shl eax, 7
push edi
push eax
push ecx
mov dword [ebx + 0x58], edi
call fcn.0049f9e1
mov dword [ebx + 0x58], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.0049f9e1
push edi
xor ecx, ecx
push ecx
push dword [ebp - 0x28]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x34]
push eax
mov dword [eax + 0x10], edi
call fcn.0049f9e1
mov ecx, dword [ebp + 0x34]
add esp, 0x30
push edi
mov dword [ecx + 0x10], eax
xor eax, eax
push eax
push esi
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043fcd3
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x11c]
push edi
adc ecx, edx
add eax, 1
adc ecx, edi
mov dword [ebp - 0x118], edx
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
imul ebx, esi
mov eax, dword [ebp - 0x18]
add ebx, eax
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043fcd3
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x20c]
adc ecx, dword [ebp - 0x118]
push edi
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043fcd3
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call fcn.004b4630
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040fa04
push esi
push dword [ebp + 0x34]
lea ecx, [ebp + 0x6c]
call fcn.0043fcd3
push dword [ebp + 0x6c]
call fcn.00443ee2
cmp dword [ebp - 0x20], edi
pop ecx
jl 0x46bc58
mov esi, dword [ebp - 0x20]
jmp 0x46bc5a
xor esi, esi
lea ecx, [ebp - 0xb4]
call fcn.0043fe25
lea ecx, [ebp + 0x18]
call fcn.0043fe25
lea ecx, [ebp]
call fcn.0043fe25
lea ecx, [ebp + 0x54]
call fcn.0043fe25
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, edi
jmp 0x46a7b8
lea ecx, [ebp - 0xb4]
call fcn.0043fe25
jmp 0x46ba3d
push 0x1000
lea ecx, [ebp + 0x1c]
call fcn.004465d3
cmp dword [ebp - 0xc], ebx
jl 0x46bd3f
push 0x3b60
lea ecx, [ebp - 0x20]
call fcn.00446437
mov edi, dword [ebp - 0x20]
push 0x3960
lea esi, [edi + 0x200]
push ebx
push esi
call fcn.004b4520
push dword [ebp - 0x8c]
push edi
push esi
call fcn.00455860
add esp, 0x18
xor edi, edi
lea eax, [esi + 4]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0xc]
je 0x46bd0a
inc edi
add eax, 0x220
cmp edi, 0x1a
jle 0x46bcf6
jmp 0x46bd35
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.004465d3
imul edi, edi, 0x220
add esi, edi
movzx eax, byte [esi + 0x10]
push eax
push dword [esi + 4]
push str._d___c_
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.0043fe25
jmp 0x46bd65
cmp byte [ebp - 0x3f], 0
jne 0x46bd65
cmp byte [ebp + 0x5b], 4
mov eax, 0x4c8068
je 0x46bd55
mov eax, 0x4c8048
push eax
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
call fcn.004553e7
add esp, 0x10
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0x54]
call fcn.0043fe25
cmp dword [ebp - 0xc0], ebx
jle 0x46bd8e
push dword [ebp - 0xc0]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xc4]
call fcn.0044b612
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0xd0]
call fcn.00445c44
lea ecx, [ebp + 0x66]
call fcn.00443f89
lea ecx, [ebp + 0x6c]
call fcn.00402d2b
mov eax, 0x4e3934
cmp eax, ebx
je 0x46bdc2
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0xdc]
call fcn.0043fe25
lea ecx, [ebp - 0xd0]
call fcn.0043fe25
lea ecx, [ebp - 0xf0]
call fcn.0043fe25
lea ecx, [ebp - 0x1e0]
call fcn.0043fe25
lea ecx, [ebp + 0x1c]
call fcn.0043fe25
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8