Function at 0x4028a2
Capabilities:
Copy file
Create process on windows
Get common file path
Get disk information
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15ec
push ebx
push esi
push edi
push 0x214
call fcn.00401399
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x4028d2
mov ecx, dword [ebp + 0xc]
push dword [ecx]
mov ecx, eax
call fcn.00401310
mov dword [0x407ac0], eax
jmp 0x4028d8
mov dword [0x407ac0], ebx
call fcn.004027f8
push 0x407684
call fcn.004042d5
mov eax, dword [0x407ac0]
push 0x104
mov esi, 0x407580
push esi
add eax, 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push 0x34
push 0x40754c
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
cmp dword [0x407684], ebx
jne 0x402929
push str.EjectMedia___works_under_Windows_NT4__2000__XP__Server_2003__Vista_and_higher_only___abort_n_n
call fcn.00401779
pop ecx
jmp 0x4036bf
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp eax, 5
ja 0x4036ba
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x402958
push str.User_is_not_an_admin_n
call fcn.00401779
pop ecx
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push 2
pop edi
cmp dword [ebp + 8], edi
mov byte [ebp - 0x3d0], bl
mov byte [ebp - 0x134], bl
mov byte [ebp - 0xce4], bl
mov byte [ebp - 0xeec], bl
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
jle 0x402aab
mov eax, dword [ebp + 0xc]
push 0x104
push dword [eax + edi*4]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x24c]
push eax
call esi
push 0x2d
push 0x2f
lea eax, [ebp - 0x24c]
push eax
call fcn.004043c3
cmp byte [ebp - 0x24c], 0x2d
jne 0x4036ba
movsx eax, byte [ebp - 0x24b]
sub eax, 0x3f
je 0x402b49
sub eax, 5
je 0x402a74
dec eax
dec eax
je 0x402a6b
dec eax
dec eax
je 0x402a62
sub eax, 4
je 0x402a59
sub eax, 7
je 0x402a50
sub eax, 4
jne 0x402aa1
cmp byte [ebp - 0x24a], 0x3a
jne 0x402aa1
lea eax, [ebp - 0x249]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
cmp eax, ebx
mov dword [ebp - 8], eax
jge 0x402a40
xor eax, eax
mov dword [ebp - 8], eax
cmp eax, 0x2710
jle 0x402aa1
mov dword [ebp - 8], 0x2710
jmp 0x402aa1
mov dword [ebp - 0x2c], 1
jmp 0x402aa1
mov dword [ebp - 0x28], 1
jmp 0x402aa1
mov dword [ebp - 0x14], 1
jmp 0x402aa1
mov dword [ebp - 0x1c], 1
jmp 0x402aa1
cmp byte [ebp - 0x24a], bl
jne 0x402a85
mov dword [ebp - 0x18], 1
jmp 0x402aa1
cmp byte [ebp - 0x24a], 0x45
je 0x402a97
cmp byte [ebp - 0x24a], 0x42
jne 0x402aa1
mov dword [0x407ac4], 1
inc edi
cmp edi, dword [ebp + 8]
jl 0x402994
cmp dword [ebp + 8], 1
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
jle 0x402cca
mov eax, dword [ebp + 0xc]
push 0x104
push dword [eax + 4]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x24c]
push eax
call esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, str._Volume
push esi
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
jne 0x402b63
cmp byte [ebp - 0x21d], 0x7d
jne 0x402b63
mov eax, ecx
push eax
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call edi
push eax
lea eax, [ebp - 0x134]
push esi
push eax
call fcn.00401477
add esp, 0xc
lea eax, [ebp - 0x129]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
mov byte [ebp - 0x104], bl
jmp 0x402cca
call fcn.00402821
push 2
pop esi
mov ecx, dword [0x407ac0]
call fcn.004011e8
mov eax, esi
jmp 0x4036cd
mov al, byte [ebp - 0x24c]
sub al, 0x41
cmp al, 0x19
ja 0x402c25
cmp byte [ebp - 0x24b], 0x3a
jne 0x402c25
push 0x102
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x3d0]
push eax
call edi
cmp byte [ebp + eax - 0x3d1], 0x5c
je 0x402bbb
mov byte [ebp + eax - 0x3d0], 0x5c
mov byte [ebp + eax - 0x3cf], bl
push 0x104
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x402cca
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea eax, [ebp - 0x134]
push eax
call esi
cmp dword [0x407ac4], ebx
je 0x402caf
lea eax, [ebp - 0x134]
push eax
push str.volume_s_n
call fcn.00401779
pop ecx
pop ecx
lea eax, [ebp - 0x134]
push eax
call esi
push eax
push str.drivetype_i_n
call fcn.00401779
pop ecx
pop ecx
jmp 0x402caf
cmp byte [ebp - 0x24c], 0x5c
jne 0x402c4e
cmp byte [ebp - 0x24b], bl
jne 0x402cca
push 0x40754c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402cb7
cmp byte [ebp - 0x24c], 0x2e
jne 0x402cca
cmp byte [ebp - 0x24b], bl
jne 0x402cca
lea eax, [ebp - 0x6dc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x402cca
push 0x104
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
test eax, eax
je 0x402cca
push 0x104
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x5d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x402cca
cmp byte [ebp - 0x134], bl
je 0x402cd2
lea eax, [ebp - 0x134]
push eax
call edi
lea ecx, [ebp - 0x134]
dec ecx
mov byte [eax + ecx], bl
cmp byte [ebp - 0x134], bl
jne 0x402d1b
mov ecx, dword [0x407ac0]
push 0xe
call fcn.004012c4
lea eax, [ebp - 0x3d0]
push eax
push str.invalid_drive__s___abort_n_n
call fcn.00401779
pop ecx
pop ecx
mov ecx, dword [0x407ac0]
push ebx
call fcn.004012c4
cmp dword [ebp - 8], ebx
je 0x402d08
push dword [ebp - 8]
jmp 0x402d0d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
jmp 0x4036cd
mov eax, dword [0x407ac0]
add eax, 0x104
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.00403f62
test eax, eax
je 0x402f55
lea eax, [ebp - 0x5d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0x11ec]
push eax
lea eax, [ebp - 0x10ec]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x407ac0]
add eax, 0x104
push eax
call fcn.004014fe
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x10ec]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xde8]
push str._s_s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0xde8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402dc1
push str.abort_n
call fcn.00401779
pop ecx
push 5
jmp 0x4036cc
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.00403f62
test eax, eax
je 0x402ddf
push str.drive_to_eject_is_the_TEMP_drive____abort_n
jmp 0x402db4
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0x11ec]
push eax
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x6dc]
push str._s_s_s
push eax
call esi
add esp, 0x14
push ebx
lea eax, [ebp - 0x6dc]
push eax
mov eax, dword [0x407ac0]
add eax, 0x104
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
cmp dword [0x407ac4], ebx
je 0x402e64
push esi
lea eax, [ebp - 0x6dc]
push eax
mov eax, dword [0x407ac0]
add eax, 0x104
push eax
push str.CopyFile__s___s___res_i_n
call fcn.00401779
add esp, 0x10
cmp esi, ebx
jne 0x402e64
mov esi, 0x4076c0
push esi
call fcn.004046fa
push esi
push str._n_s_n
call fcn.00401779
pop ecx
pop ecx
push str.EjectDrive.exe_is_on_the_drive_to_remove____execute_temporary_copy_and_exit_n_n
call fcn.00401779
mov dword [esp], 0x103
lea eax, [ebp - 0x4d3]
push ebx
push eax
mov byte [ebp - 0x4d4], bl
call fcn.00401447
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
inc ebx
add esp, 0xc
cmp dword [ebp + 8], ebx
mov edi, 0x4059d4
jle 0x402ecb
push 0x4059d0
lea eax, [ebp - 0x4d4]
push eax
call esi
mov eax, dword [ebp + 0xc]
push dword [eax + ebx*4]
lea eax, [ebp - 0x4d4]
push eax
call esi
push edi
lea eax, [ebp - 0x4d4]
push eax
call esi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x402e9e
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x134]
push eax
push 0x4059cc
lea eax, [ebp - 0x4d4]
push eax
call fcn.0040454b
push ebx
lea eax, [ebp - 0x134]
push eax
push 0x4059c8
lea eax, [ebp - 0x4d4]
push eax
call fcn.0040454b
push 0x4059c4
lea eax, [ebp - 0x4d4]
push eax
call esi
push edi
lea eax, [ebp - 0x4d4]
push eax
call esi
push 1
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x6dc]
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
jmp 0x4036cc
push 0x4b7d8
call fcn.00401399
pop ecx
cmp eax, ebx
je 0x402f6d
mov ecx, eax
call fcn.00401afd
jmp 0x402f6f
xor eax, eax
push 0x4059b8
mov ecx, eax
mov dword [0x407548], eax
call fcn.00402264
mov ecx, dword [0x407548]
lea eax, [ebp - 0x134]
push eax
call fcn.00401ff7
cmp eax, 0xffffffff
jne 0x402fcf
push str.Invalid_drive___abort_n_n
call fcn.00401779
push dword [0x407ac0]
call fcn.004013c1
pop ecx
pop ecx
mov ecx, dword [0x407548]
mov esi, ecx
cmp ecx, ebx
je 0x402d13
call fcn.00401b00
push esi
call fcn.004013c1
pop ecx
jmp 0x402d13
imul eax, eax, 0x1828
add eax, dword [0x407548]
mov esi, eax
lea eax, [ebp - 0xeec]
push eax
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.00404040
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0x3d0]
push eax
push str.Ejecting_media_from__s___s_
call fcn.00401779
add esp, 0xc
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x28c], bl
cmp byte [ebp - 0x3d0], bl
je 0x403064
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x2cc]
push eax
call edi
lea ecx, [ebp - 0x2cc]
dec ecx
mov byte [eax + ecx], bl
push 0x40
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0xbe0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xbe0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0xbe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x20], eax
cmp eax, 5
je 0x4030e7
lea eax, [ebp - 0x134]
push eax
call fcn.00404437
cmp eax, 0xffffffff
jne 0x4030e7
cmp dword [ebp - 0x1c], ebx
jne 0x4030e7
push 0x4055fc
call fcn.00401779
pop ecx
mov ecx, dword [0x407ac0]
push 0xe
call fcn.004012c4
push str.No_media_present___abort_n
call fcn.00401779
pop ecx
mov ecx, dword [0x407ac0]
push ebx
call fcn.004012c4
xor esi, esi
inc esi
jmp 0x402b51
cmp dword [ebp - 0x14], ebx
je 0x403110
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x403110
push str._nchecking_for_open_handles...
call fcn.00401779
mov dword [esp], 0xbb8
push esi
call fcn.0040114e
mov dword [ebp - 0x24], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x134]
push eax
call edi
mov esi, eax
cmp dword [0x407ac4], ebx
je 0x40313e
push esi
push str._nhVolInfo0x_p
call fcn.00401779
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x40318c
push 0x4055fc
call fcn.00401779
pop ecx
mov ecx, dword [0x407ac0]
push 0xe
call fcn.004012c4
push str.cannot_open_the_drive___abort_n
call fcn.00401779
pop ecx
mov ecx, dword [0x407ac0]
push ebx
call fcn.004012c4
cmp dword [ebp - 8], ebx
je 0x403185
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4030df
push 0x1f4
jmp 0x40317a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x3ff
push esi
lea eax, [ebp - 0xadb]
push ebx
push eax
mov byte [ebp - 0xadc], bl
call fcn.00401447
push esi
lea eax, [ebp - 0x15eb]
push ebx
push eax
mov byte [ebp - 0x15ec], bl
call fcn.00401447
add esp, 0x18
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
lea eax, [ebp - 0x134]
push eax
call edi
mov dword [ebp - 4], eax
cmp dword [0x407ac4], ebx
je 0x4031f0
push eax
push str._nhVolReadRead0x_p
call fcn.00401779
pop ecx
pop ecx
cmp dword [ebp - 4], 0xffffffff
jne 0x403247
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0x15ec]
push eax
lea eax, [ebp - 0xadc]
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
cmp dword [0x407ac4], ebx
je 0x403143
push 0xffffffffffffffff
push str._nhVolRead0x_p
call fcn.00401779
lea eax, [ebp - 0x15ec]
push eax
push 0x4058f0
call fcn.00401779
add esp, 0x10
jmp 0x403143
push 0x4055fc
call fcn.00401779
cmp dword [ebp - 0x20], 5
pop ecx
je 0x4032bc
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
lea eax, [ebp - 0x134]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4032bc
push str.Flushing_cache...
call fcn.00401779
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x403296
push str._OK_n
call fcn.00401779
jmp 0x4032b4
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x18], ebx
jne 0x40331b
push str.Allowing_eject...
call fcn.00401779
pop ecx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 1
lea eax, [ebp - 0xd]
push eax
push 0x2d4804
push dword [ebp - 4]
mov byte [ebp - 0xd], bl
call esi
test eax, eax
je 0x4032fc
push str._OK_n
call fcn.00401779
jmp 0x40331a
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
push str.Locking_volume...
xor edi, edi
call fcn.00401779
pop ecx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90018
push dword [ebp - 4]
call esi
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40334e
push str._OK_n
call fcn.00401779
jmp 0x403391
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90018
push dword [ebp - 4]
call esi
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x403342
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x403446
push str.Dismounting_volume...
call fcn.00401779
pop ecx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90020
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x4033cb
push str._OK_n
call fcn.00401779
jmp 0x4033e9
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
cmp dword [ebp - 0x18], ebx
jne 0x40343e
push str.Ejecting_media...
call fcn.00401779
pop ecx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x2d4808
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x40341f
push str._OK_n
call fcn.00401779
jmp 0x40343d
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
cmp edi, ebx
jne 0x403611
cmp dword [ebp - 0x1c], ebx
je 0x40350c
cmp dword [ebp - 0x14], ebx
jne 0x4034b0
cmp dword [ebp - 0x20], 5
je 0x403461
push str.Forcing_dismount__good_luck_...
jmp 0x403466
push str.Forcing_dismount...
call fcn.00401779
pop ecx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90020
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x403491
push str._OK____open_handles_are_invaild_now_n
call fcn.00401779
jmp 0x4034af
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
cmp dword [ebp - 0x18], ebx
jne 0x403504
push str.Eject_media...
call fcn.00401779
pop ecx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x2d4808
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x4034e5
push str._OK_n
call fcn.00401779
jmp 0x403503
lea eax, [ebp - 0xadc]
push eax
call fcn.004046fa
lea eax, [ebp - 0xadc]
push eax
push str._failed__err_s_n
call fcn.00401779
pop ecx
pop ecx
cmp edi, ebx
jne 0x403611
cmp dword [ebp - 0x28], ebx
je 0x403611
push str.failed_n
call fcn.00401779
pop ecx
cmp dword [ebp - 0x24], ebx
jne 0x40355e
cmp byte [ebp - 0x28c], bl
je 0x40355e
lea eax, [ebp - 0x28c]
push eax
cmp byte [ebp - 0x3d0], bl
je 0x403552
lea eax, [ebp - 0x3d0]
push eax
push str.check_for_open_handles_on__s_or__s_n
call fcn.00401779
add esp, 0xc
jmp 0x40355e
push str.check_for_open_handles_on__s_n
call fcn.00401779
pop ecx
pop ecx
push str.Press_CtrlC_to_cancel._Trying..
call fcn.00401779
pop ecx
mov ecx, dword [0x407ac0]
call fcn.004011e2
test eax, eax
jne 0x403602
push 0x4051cc
call fcn.00401779
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x134]
push eax
call fcn.00404437
cmp eax, 0xffffffff
je 0x4035ff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90018
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x403569
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x90020
push dword [ebp - 4]
call esi
mov edi, eax
cmp dword [ebp - 0x18], ebx
jne 0x4035f5
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x2d4808
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x403569
jmp 0x403602
push 2
pop edi
cmp edi, ebx
jne 0x403611
push 0x4055fc
call fcn.00401779
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x403629
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x9001c
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x407ac0]
mov eax, edi
dec eax
je 0x40365c
dec eax
je 0x40364e
push 0xc
call fcn.004012c4
push str.failed
jmp 0x403668
push 0xe
call fcn.004012c4
push str.Media_removed
jmp 0x403668
push 0xa
call fcn.004012c4
push str.success
call fcn.00401779
pop ecx
mov ecx, dword [0x407ac0]
push ebx
call fcn.004012c4
push 0x405768
call fcn.00401779
mov eax, dword [ebp - 8]
pop ecx
cmp eax, ebx
je 0x40369c
mov ecx, dword [0x407ac0]
cdq
push edx
push eax
call fcn.00401268
jmp 0x4036a7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x2c], ebx
je 0x4036b1
call fcn.00404754
xor eax, eax
cmp edi, ebx
sete al
jmp 0x4036cd
call fcn.00402821
mov ecx, dword [0x407ac0]
call fcn.004011e8
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret