Function at 0x525520
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60cd52
mov eax, dword fs:[0]
push eax
sub esp, 0x71c
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, ecx
mov dword [ebp - 0x628], edx
mov dword [ebp - 0x6f0], edx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x640], edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x650], eax
xor ecx, ecx
mov dword [ebp - 0x634], ecx
mov eax, dword [0x6b8fdc]
mov dword [ebp - 0x670], eax
cmp dword [edi + 0x24], ecx
jne 0x5255ea
push ecx
push ecx
push ecx
push ecx
push ecx
mov ecx, edx
call fcn.00523f60
cmp dword [ebp + 0x18], 0
jne 0x527a07
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x65c], esp
push 0x6b1598
call fcn.00420d90
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0x628]
mov ecx, dword [edx + 0x60]
call dword [sym.imp.ycomuiu.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
mov dword [ebp - 4], 0xffffffff
mov edx, 0x40
mov ecx, eax
call fcn.004e0d20
add esp, 0x1c
jmp 0x527a07
mov dword [ebp - 0x6c0], 0xffffffff
mov dword [ebp - 0x6bc], 0xffffffff
mov ecx, dword [edi + 0x70]
test ecx, ecx
jne 0x525624
xorps xmm0, xmm0
movlpd qword [ebp - 0x708], xmm0
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x630], eax
mov edi, dword [ebp - 0x708]
jmp 0x525649
mov eax, dword [ecx]
push 0
mov eax, dword [eax + 8]
call eax
push 0
push dword [edi + 0x10]
push edx
push eax
call fcn.005dd710
mov edi, eax
mov eax, edx
mov dword [ebp - 0x630], edx
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x654], edi
mov dword [ebp - 0x728], edi
mov dword [ebp - 0x724], eax
mov dword [edx + 0x18], edi
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
test esi, esi
je 0x5256af
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x525680
sub ecx, edx
sar ecx, 1
je 0x5256a9
push esi
push dword [ebp - 0x640]
call fcn.00524320
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6bc], edx
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x6f8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x6d8], 0
xor esi, esi
mov dword [ebp - 0x6d4], esi
mov dword [ebp - 0x6d0], esi
mov byte [ebp - 4], 2
mov dword [ebp - 0x6cc], esi
mov dword [ebp - 0x6c8], esi
mov dword [ebp - 0x6c4], esi
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6a4], eax
mov byte [ebp - 4], 5
cmp dword [0x6b8fd8], eax
jne 0x52575f
lea eax, [ebp - 0x700]
push eax
mov eax, dword [ebp - 0x640]
push dword [eax + 0x20]
mov ecx, edx
call fcn.0052fbd0
push dword [ebp - 0x630]
push edi
push str.MFT_Total_File__d_n
call fcn.004131f0
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x668], xmm0
cmp dword [ebp - 0x630], 0
jb 0x5257fd
ja 0x52578d
test edi, edi
je 0x5257fd
mov edi, dword [ebp - 0x668]
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x630]
nop
cmp dword [ebp - 0x6d0], esi
je 0x5257b8
mov dword [esi], edi
mov dword [esi + 4], eax
add esi, 8
mov dword [ebp - 0x6d4], esi
jmp 0x5257dd
lea eax, [ebp - 0x668]
push eax
push esi
lea ecx, [ebp - 0x6d8]
call fcn.00485390
mov esi, dword [ebp - 0x6d4]
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x630]
add edi, 1
mov dword [ebp - 0x668], edi
adc eax, 0
mov dword [ebp - 0x664], eax
cmp eax, ecx
jb 0x5257a0
ja 0x5257fd
cmp edi, dword [ebp - 0x654]
jb 0x5257a0
lea eax, [ebp - 0x6cc]
push eax
push dword [ebp - 0x6fc]
push dword [ebp - 0x700]
push esi
mov edi, dword [ebp - 0x6d8]
push edi
lea ecx, [ebp - 0x65c]
call fcn.00531190
add esp, 0x14
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
test eax, 0xfffffff8
jne 0x525858
cmp dword [ebp + 0x18], 0
jne 0x525858
push ecx
push dword [ebp - 0x6c8]
push dword [ebp - 0x6cc]
push esi
push edi
lea ecx, [ebp - 0x65c]
call fcn.00531190
add esp, 0x14
mov dword [ebp - method.CFileRecord.virtual_0], vtable.CFileRecord.0
push 0x47de20
push 0x47bd30
push 0x10
push 0x14
lea eax, [ebp - 0x578]
push eax
call fcn.005605a4
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5c8], 0
mov dword [ebp - 0x5c4], 0xffffffff
mov dword [ebp - 0x5c0], 0xffffffff
xorps xmm0, xmm0
movups xmmword [ebp - 0x5bc], xmm0
movups xmmword [ebp - 0x5ac], xmm0
movups xmmword [ebp - 0x59c], xmm0
movups xmmword [ebp - 0x58c], xmm0
mov dword [ebp - 0x57c], 0xffffffff
mov byte [ebp - 4], 8
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a25
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x690], eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x6c8]
sub eax, dword [ebp - 0x6cc]
sar eax, 3
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x65c], eax
mov esi, eax
mov dword [ebp - 0x708], esi
xor eax, eax
mov dword [ebp - 0x704], eax
push eax
push esi
push str.Ref_File__d_n
call fcn.004131f0
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x668], xmm0
mov edi, dword [ebp - 0x668]
mov eax, dword [ebp - 0x664]
nop word [eax + eax]
cmp eax, dword [ebp - 0x704]
ja 0x52677c
jb 0x525976
cmp edi, esi
jae 0x52677c
push 0
push 0x64
push eax
push edi
call fcn.005dd710
mov ecx, eax
mov esi, 0x64
mov eax, edx
mul esi
mov esi, eax
mov eax, ecx
mov ecx, 0x64
mul ecx
add esi, edx
mov ecx, edi
sub ecx, eax
mov eax, dword [ebp - 0x664]
sbb eax, esi
test ecx, ecx
jne 0x525a01
test eax, eax
jne 0x525a01
sub esp, 8
mov esi, dword [ebp - 0x628]
push dword [esi + 0x20]
lea eax, [ebp - 0x720]
push eax
call fcn.0052e910
mov byte [ebp - 4], 0xb
push 1
push 1
push dword [eax]
push dword [ebp - 0x688]
push edi
mov ecx, esi
call fcn.00523f60
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x720]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x525a01
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0xffffffffffffffff
mov esi, dword [ebp - 0x628]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 0x40], 0
jne 0x526782
mov dword [ebp - 0x57c], 0x887
mov eax, dword [ebp - 0x6cc]
push dword [eax + edi*8 + 4]
push dword [eax + edi*8]
lea ecx, [ebp - 0x5d4]
call fcn.0047a760
test eax, eax
je 0x526759
lea ecx, [ebp - 0x5d4]
call fcn.0047abe0
test eax, eax
je 0x526759
mov ecx, dword [ebp - 0x570]
mov dword [ebp - 0x568], ecx
test ecx, ecx
je 0x525a7d
mov eax, dword [ecx + 4]
test eax, eax
je 0x525a7d
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x20]
and eax, 0x800
jmp 0x525a7f
xor eax, eax
test eax, eax
setne byte [ebp - 0x635]
mov dword [ebp - 0x568], ecx
test ecx, ecx
je 0x525aa6
mov eax, dword [ecx + 4]
test eax, eax
je 0x525aa6
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x20]
and eax, 0x4000
jmp 0x525aa8
xor eax, eax
test eax, eax
setne byte [ebp - 0x689]
mov dword [ebp - 0x568], ecx
test ecx, ecx
je 0x525acf
mov eax, dword [ecx + 4]
test eax, eax
je 0x525acf
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x20]
and eax, 0x400
jmp 0x525ad1
xor eax, eax
test eax, eax
setne byte [ebp - 0x61d]
mov ecx, dword [ebp - 0x5c8]
cmp dword [0x6b8fd8], 0
jne 0x525af7
movzx eax, word [ecx + 0x16]
not eax
test al, 1
je 0x526759
test byte [ecx + 0x16], 2
jne 0x526759
cmp dword [ebp + 0x14], 0
jne 0x525b58
mov esi, dword [ebp - 0x6c0]
mov eax, esi
mov edx, dword [ebp - 0x6bc]
and eax, edx
cmp eax, 0xffffffff
je 0x525b58
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x540], eax
test eax, eax
je 0x525b42
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x525b42
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x525b42
mov eax, dword [ecx]
movzx ecx, word [ecx + 4]
jmp 0x525b48
or eax, 0xffffffff
or ecx, 0xffffffff
cmp esi, eax
jne 0x526759
cmp edx, ecx
jne 0x526759
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.0047ad70
test eax, eax
jg 0x525c8d
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a2f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x70c], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x698]
push ecx
inc ecx
mov dword [ebp - 0x698], ecx
push str.File_.7d
lea eax, [ebp - 0x70c]
push eax
call fcn.0040d300
add esp, 0xc
mov eax, dword [ebp - 0x70c]
lea esi, [eax - 0x10]
mov ecx, dword [ebp - 0x690]
lea edi, [ecx - 0x10]
cmp esi, edi
je 0x525c1e
cmp dword [edi + 0xc], 0
jl 0x525c0f
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x525c0f
mov ecx, esi
call fcn.0040c950
mov dword [ebp - 0x694], eax
or ecx, 0xffffffff
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x525c04
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [ebp - 0x694]
add eax, 0x10
mov dword [ebp - 0x690], eax
jmp 0x525c1e
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x690]
call fcn.0040c9d0
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x525c37
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov edi, dword [ebp - 0x668]
push ecx
lea ecx, [ebp - 0x5d4]
call fcn.0047b040
mov esi, eax
test esi, esi
je 0x526759
mov edx, dword [esi]
push 0
mov ecx, esi
mov edx, dword [edx + 8]
call edx
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x6e0], edx
push esi
push dword [ebp - 0x640]
call fcn.00477c60
mov dword [ebp - 0x6e8], eax
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a39
jmp 0x525cbd
lea ecx, [ebp - 0x424]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x525c96
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x690]
call fcn.0040c9d0
jmp 0x525c3d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x63c], eax
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x568], eax
test eax, eax
je 0x525cf9
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x525cf9
sub esp, 8
lea eax, [ebp - 0x718]
push eax
call fcn.00478ef0
jmp 0x525d0d
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x718], 0
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x718]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x525d2f
xorps xmm0, xmm0
movups xmmword [ebp - 0x434], xmm0
movzx eax, word [ebp - 0x42a]
push eax
movzx eax, word [ebp - 0x42c]
push eax
movzx eax, word [ebp - 0x42e]
push eax
movzx eax, word [ebp - 0x432]
push eax
movzx eax, word [ebp - 0x434]
push eax
push str._04d__02d__02d___02d:_02d
lea eax, [ebp - 0x63c]
push eax
call fcn.0040d300
add esp, 0x1c
xor esi, esi
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x67c], esi
mov dword [ebp - 0x678], esi
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x660], esi
mov dword [ebp - 0x694], esi
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a43
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x624], edi
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x57c], 7
mov edx, dword [ebp - 0x628]
cmp byte [edx + 0x40], 0
jne 0x52604f
nop dword [eax]
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x540], eax
test eax, eax
je 0x525df6
mov eax, dword [eax + 4]
test eax, eax
je 0x525df6
mov eax, dword [eax + 0x44]
test eax, eax
je 0x525df6
mov ecx, dword [eax]
movzx esi, word [eax + 4]
jmp 0x525dfc
or ecx, 0xffffffff
or esi, 0xffffffff
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x6a0], ecx
mov dword [ebp - 0x69c], esi
xor eax, eax
mov edx, dword [ebp - 0x67c]
test edx, edx
jle 0x525e4f
mov edx, dword [ebp - 0x680]
cmp dword [edx + eax*8], ecx
jne 0x525e2f
cmp dword [edx + eax*8 + 4], esi
jne 0x525e2f
mov cl, 1
jmp 0x525e31
xor cl, cl
test cl, cl
jne 0x525e46
inc eax
cmp eax, dword [ebp - 0x67c]
mov ecx, dword [ebp - 0x62c]
jl 0x525e20
jmp 0x525e4f
cmp eax, 0xffffffff
jne 0x526043
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x680]
call fcn.004f14a0
mov ecx, dword [ebp - 0x62c]
cmp ecx, dword [ebp - 0x6c0]
jne 0x525e81
cmp esi, dword [ebp - 0x6bc]
jne 0x525e81
mov dword [ebp - 0x694], 1
cmp ecx, 5
jne 0x525e9e
test esi, esi
jne 0x525e9e
lea ecx, [esi + 1]
mov esi, dword [ebp - 0x680]
mov edx, dword [ebp - 0x628]
jmp 0x526055
mov eax, ecx
and eax, esi
cmp eax, 0xffffffff
je 0x526043
cmp esi, dword [ebp - 0x630]
ja 0x526043
jb 0x525ec5
cmp ecx, dword [ebp - 0x654]
ja 0x526043
push esi
push ecx
lea ecx, [ebp - 0x5d4]
call fcn.0047a760
test eax, eax
je 0x526043
lea ecx, [ebp - 0x5d4]
call fcn.0047abe0
test eax, eax
je 0x526043
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.0047ad70
test eax, eax
jle 0x526043
mov eax, dword [ebp - 0x5c8]
test byte [eax + 0x16], 2
je 0x526043
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a25
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x66c], eax
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x66c]
call fcn.0040c5a0
test al, al
jne 0x525f82
lea ecx, [ebp - 0x424]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x525f60
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x66c]
call fcn.0040c9d0
mov byte [ebp - 4], 0x16
push 1
push 0x64f4f8
lea ecx, [ebp - 0x66c]
call fcn.0040ceb0
push dword [edi - 0xc]
push edi
lea ecx, [ebp - 0x66c]
call fcn.0040ceb0
mov eax, dword [ebp - 0x66c]
lea edx, [eax - 0x10]
mov dword [ebp - 0x62c], edx
lea esi, [edi - 0x10]
cmp edx, esi
je 0x526018
lea edi, [esi + 0xc]
cmp dword [edi], 0
jl 0x525ffd
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x525ffd
mov ecx, edx
call fcn.0040c950
mov dword [ebp - 0x674], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x525ff2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x674]
lea edi, [eax + 0x10]
mov dword [ebp - 0x624], edi
jmp 0x526012
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x624]
call fcn.0040c9d0
mov edi, dword [ebp - 0x624]
mov edx, dword [ebp - 0x62c]
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526031
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edx, dword [ebp - 0x628]
cmp byte [edx + 0x40], 0
je 0x525dd0
jmp 0x526049
mov edx, dword [ebp - 0x628]
mov esi, dword [ebp - 0x680]
mov ecx, dword [ebp - 0x660]
mov eax, dword [ebp - 0x6c0]
and eax, dword [ebp - 0x6bc]
cmp eax, 0xffffffff
je 0x526137
cmp dword [ebp - 0x694], 0
jne 0x5260e4
mov byte [ebp - 4], 0x12
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x52608f
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 0x11
test esi, esi
je 0x5260aa
push esi
call fcn.005a51fb
add esp, 4
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x63c]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526753
mov ecx, dword [edx]
push edx
jmp 0x52674e
cmp dword [ebp + 0x14], 0
jne 0x526137
mov byte [ebp - 4], 0x12
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x526106
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 0x11
test esi, esi
je 0x526121
push esi
call fcn.005a51fb
add esp, 4
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
jmp 0x5260be
cmp ecx, 1
jne 0x5261cd
lea eax, [ebp - 0x624]
push eax
mov edx, dword [edx + 0x64]
lea ecx, [ebp - 0x6ec]
call fcn.004359f0
add esp, 4
mov byte [ebp - 4], 0x1c
mov edx, dword [eax]
lea ecx, [edx - 0x10]
lea esi, [edi - 0x10]
cmp ecx, esi
je 0x5261bb
lea edi, [esi + 0xc]
cmp dword [edi], 0
jl 0x5261a6
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x5261a6
call fcn.0040c950
mov dword [ebp - 0x674], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x52619b
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x674]
lea edi, [eax + 0x10]
mov dword [ebp - 0x624], edi
jmp 0x5261bb
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x624]
call fcn.0040c9d0
mov edi, dword [ebp - 0x624]
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x6ec]
or esi, 0xffffffff
jmp 0x52633c
lea ecx, [ebp - 0x64c]
call fcn.0040c490
mov byte [ebp - 4], 0x1e
push 0x6b9334
mov edx, dword [ebp - 0x628]
mov edx, dword [edx + 0x64]
lea ecx, [ebp - 0x6f4]
call fcn.004359f0
add esp, 4
mov byte [ebp - 4], 0x1f
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x64c]
add esi, 0xfffffff0
cmp ecx, esi
je 0x52625c
cmp dword [esi + 0xc], 0
jl 0x52624d
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x52624d
call fcn.0040c950
mov dword [ebp - 0x674], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x526242
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x674]
add eax, 0x10
mov dword [ebp - 0x64c], eax
jmp 0x52625c
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x64c]
call fcn.0040c9d0
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0x6f4]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52627e
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 1
push 0x64f4f8
lea ecx, [ebp - 0x64c]
call fcn.0040ceb0
lea eax, [ebp - 0x624]
push eax
lea edx, [ebp - 0x64c]
lea ecx, [ebp - 0x6dc]
call fcn.004359f0
add esp, 4
mov byte [ebp - 4], 0x21
mov edx, dword [eax]
lea ecx, [edx - 0x10]
lea esi, [edi - 0x10]
cmp ecx, esi
je 0x52630e
lea edi, [esi + 0xc]
cmp dword [edi], 0
jl 0x5262f9
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x5262f9
call fcn.0040c950
mov dword [ebp - 0x674], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x5262ee
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x674]
lea edi, [eax + 0x10]
mov dword [ebp - 0x624], edi
jmp 0x52630e
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x624]
call fcn.0040c9d0
mov edi, dword [ebp - 0x624]
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0x6dc]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526332
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x64c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526353
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [0x6b9684]
cmp dword [eax - 0xc], 0
je 0x5263e3
cmp dword [edi - 0xc], 0
jl 0x52637f
push eax
push edi
call fcn.00587dd7
add esp, 8
test eax, eax
je 0x52637f
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x5263e3
mov byte [ebp - 4], 0x12
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x52639a
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x680]
test ecx, ecx
je 0x5263bb
push ecx
call fcn.005a51fb
add esp, 4
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x63c]
add edx, 0xfffffff0
mov eax, esi
jmp 0x5260ce
push 0x48
call fcn.00560437
add esp, 4
mov dword [ebp - 0x710], eax
mov byte [ebp - 4], 0x26
push dword [ebp - 0x650]
mov ecx, dword [ebp - 0x6cc]
mov edx, dword [ebp - 0x668]
push dword [ecx + edx*8 + 4]
push dword [ecx + edx*8]
push dword [ebp - 0x6e0]
push dword [ebp - 0x6e4]
mov esi, dword [ebp - 0x63c]
push esi
push edi
push dword [ebp - 0x690]
mov ecx, eax
call fcn.00494500
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x660], eax
test eax, eax
je 0x5266e6
mov ecx, dword [ebp - 0x6e8]
mov dword [eax + 0x20], ecx
mov cl, byte [ebp - 0x635]
mov byte [eax + 0x3d], cl
mov cl, byte [ebp - 0x689]
mov byte [eax + 0x3c], cl
mov cl, byte [ebp - 0x61d]
mov byte [eax + 0x3e], cl
cmp dword [ebp - 0x670], 0
je 0x5266c5
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x624]
call fcn.004c61f0
push 0
push str._recycle.bin
lea ecx, [ebp - 0x624]
call fcn.004a7f90
cmp eax, 0xffffffff
je 0x526502
push ecx
lea ecx, [ebp - 0x690]
call fcn.004909c0
cmp ax, 0x24
jne 0x52651a
mov ecx, dword [ebp - 0x6b4]
cmp dword [ebp - 0x6b0], ecx
je 0x5264e3
mov eax, dword [ebp - 0x62c]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x6b4], ecx
mov edi, dword [ebp - 0x624]
mov dword [ebp - 4], 0x14
jmp 0x5266c5
lea eax, [ebp - 0x660]
push eax
push ecx
lea ecx, [ebp - 0x6b8]
call fcn.00532180
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x644], eax
mov edi, dword [ebp - 0x624]
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 4], 0x14
jmp 0x5266c5
mov edi, dword [ebp - 0x624]
cmp dword [edi - 0xc], 4
jle 0x526508
push 4
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0x624]
call fcn.004c6190
mov byte [ebp - 4], 0x28
push 0
push 0x65eb64
mov ecx, eax
call fcn.004a7f90
cmp eax, 0xffffffff
setne byte [ebp - 0x61d]
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x658]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52657c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp byte [ebp - 0x61d], 0
je 0x526508
mov ecx, dword [ebp - 0x6a8]
cmp dword [ebp - 0x6a4], ecx
je 0x5265a6
mov eax, dword [ebp - 0x62c]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x6a8], ecx
jmp 0x5265c5
lea eax, [ebp - 0x660]
push eax
push ecx
lea ecx, [ebp - 0x6ac]
call fcn.00532180
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x648], eax
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x12
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x5265e5
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x680]
test ecx, ecx
je 0x526621
xor eax, eax
mov dword [ebp - 0x71c], eax
mov edx, dword [ebp - 0x67c]
cmp eax, edx
jge 0x52660e
inc eax
mov dword [ebp - 0x71c], eax
jmp 0x526601
push ecx
call fcn.005a51fb
add esp, 4
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x526655
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov byte [ebp - 4], 0xa
jmp 0x526753
push eax
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax + 0x60]
call fcn.004b4eb0
test al, al
je 0x5266e6
mov eax, dword [ebp - 0x628]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov byte [ebp - 4], 0x12
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x526702
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x680]
test ecx, ecx
je 0x526723
push ecx
call fcn.005a51fb
add esp, 4
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x526753
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x668]
add edi, 1
mov dword [ebp - 0x668], edi
mov eax, dword [ebp - 0x664]
adc eax, 0
mov dword [ebp - 0x664], eax
mov esi, dword [ebp - 0x708]
jmp 0x525960
mov esi, dword [ebp - 0x628]
cmp dword [ebp - 0x670], 0
je 0x52773c
mov dword [ebp - method.CRecoverFileFAT16.virtual_0], vtable.CRecoverFile.0
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x678], 0
mov byte [ebp - 4], 0x2f
mov dword [ebp - method.CRecoverFileFAT16.virtual_0], vtable.CRecoverFileNTFS.0
mov byte [ebp - 4], 0x30
xorps xmm0, xmm0
movlpd qword [ebp - 0x6a0], xmm0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x64c], 0
mov eax, dword [esi + 0x64]
push dword [eax]
mov ecx, dword [esi + 0x60]
add ecx, 0xa04
call fcn.004a7580
mov dword [ebp - 0x694], eax
mov eax, dword [ebp - 0x6b4]
mov ecx, eax
mov esi, dword [ebp - 0x644]
sub ecx, esi
sar ecx, 2
cmp ecx, 1
jbe 0x526d17
push 0x530140
push ecx
mov edx, eax
mov ecx, esi
call fcn.00532a30
add esp, 8
xor edi, edi
mov dword [ebp - 0x688], edi
mov ecx, dword [ebp - 0x6b4]
sub ecx, esi
sar ecx, 2
lea eax, [ecx - 1]
cmp edi, eax
jae 0x526d17
cmp ecx, edi
jbe 0x527a4d
mov esi, dword [esi + edi*4]
mov dword [ebp - 0x658], esi
lea eax, [edi + 1]
cmp ecx, eax
jbe 0x527a52
mov edx, dword [ebp - 0x644]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x650], eax
test esi, esi
je 0x526d0b
test eax, eax
je 0x526d0b
push 2
lea eax, [ebp - 0x630]
push eax
mov ecx, esi
call fcn.004c6190
mov byte [ebp - 4], 0x31
push 2
lea eax, [ebp - 0x62c]
push eax
mov ecx, dword [ebp - 0x650]
call fcn.004c6190
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x62c]
test eax, eax
je 0x527a57
mov ecx, dword [ebp - 0x630]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x5268ee
test dx, dx
je 0x5268ea
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x5268ee
add ecx, 4
add eax, 4
test dx, dx
jne 0x5268c8
xor eax, eax
jmp 0x5268f3
sbb eax, eax
or eax, 1
test eax, eax
je 0x526920
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x62c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52691b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x526cea
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
test ecx, ecx
ja 0x526933
jb 0x52693a
cmp eax, 0x200
jb 0x52693a
mov eax, 0x200
xor ecx, ecx
push 0
push ecx
push eax
push esi
push 0
push dword [ebp - 0x694]
lea ecx, [ebp - 0x684]
call fcn.0050ccb0
mov esi, eax
test esi, esi
jne 0x526981
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x62c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52697c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x526cea
mov eax, dword [esi]
push 0
lea ecx, [ebp - 0x61c]
push ecx
push esi
call dword [eax + 0x30]
test eax, eax
je 0x5269bd
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x62c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5269b8
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x526cea
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x698], eax
test eax, eax
jne 0x5269fc
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x62c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5269f7
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x526cea
push eax
call fcn.00560596
add esp, 4
mov dword [ebp - 0x654], eax
mov ecx, dword [esi]
push 0
push 0
push dword [ebp - 0x69c]
push dword [ebp - 0x6a0]
push esi
call dword [ecx + 0x14]
mov eax, dword [esi]
lea ecx, [ebp - 0x660]
push ecx
push dword [ebp - 0x64c]
mov ecx, dword [ebp - 0x654]
push ecx
push esi
call dword [eax + 0xc]
test eax, eax
jne 0x526cb7
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0x654]
mov dl, byte [eax]
mov byte [ebp - 0x61d], dl
mov ecx, dword [ebp - 0x660]
cmp ecx, 0x1b
jbe 0x526c5e
cmp dl, 1
lea esi, [ecx - 0x18]
je 0x526a6f
mov esi, dword [eax + 0x18]
lea eax, [esi + 0x18]
cmp ecx, eax
jb 0x526c5e
cmp esi, 3
jbe 0x526c5e
mov ax, word [0x639ee0]
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00588800
xor eax, eax
cmp byte [ebp - 0x61d], 1
setne al
lea eax, [eax*4 + 0x18]
add eax, dword [ebp - 0x654]
push eax
mov eax, 0x104
cmp esi, eax
cmovb eax, esi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.005bb8c7
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x670]
call fcn.0040c380
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x670]
cmp dword [eax - 0xc], 0
je 0x526c38
cmp word [ebp - 0x21a], 0x3a
jne 0x526c38
push 0x48
call fcn.00560437
add esp, 4
mov dword [ebp - 0x710], eax
mov byte [ebp - 4], 0x3d
push dword [ebp - 0x650]
mov ecx, eax
call fcn.00494740
mov dword [ebp - 0x63c], eax
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x670]
lea ecx, [edx - 0x10]
mov esi, dword [eax]
sub esi, 0x10
cmp ecx, esi
je 0x526ba9
cmp dword [esi + 0xc], 0
jl 0x526b98
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x526b92
call fcn.0040c950
mov edx, eax
mov dword [ebp - 0x65c], edx
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x526b85
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov edx, dword [ebp - 0x65c]
lea eax, [edx + 0x10]
mov ecx, dword [ebp - 0x63c]
mov dword [ecx], eax
jmp 0x526ba3
mov eax, dword [ebp - 0x63c]
push dword [edx - 0xc]
push edx
mov ecx, eax
call fcn.0040c9d0
mov eax, dword [ebp - 0x63c]
lea esi, [eax + 4]
mov dword [ebp - 0x650], esi
mov edx, dword [ebp - 0x658]
mov edx, dword [edx + 4]
lea ecx, [edx - 0x10]
mov esi, dword [esi]
sub esi, 0x10
cmp ecx, esi
je 0x526c1d
cmp dword [esi + 0xc], 0
jl 0x526c08
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x526c08
call fcn.0040c950
mov dword [ebp - 0x65c], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x526bfb
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x65c]
add eax, 0x10
mov ecx, dword [ebp - 0x650]
mov dword [ecx], eax
jmp 0x526c17
push dword [edx - 0xc]
push edx
mov ecx, dword [ebp - 0x650]
call fcn.0040c9d0
mov eax, dword [ebp - 0x63c]
push eax
mov esi, dword [ebp - 0x628]
mov ecx, dword [esi + 0x60]
call fcn.004b4eb0
test al, al
je 0x526c38
add dword [esi + 0x20], 1
adc dword [esi + 0x24], 0
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0x670]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526c5e
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0x32
jmp 0x526cb7
or esi, 0xffffffff
inc edi
push dword [ebp - 0x654]
call fcn.00560591
add esp, 4
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x62c]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526cea
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x630]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526d0b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
inc edi
mov esi, dword [ebp - 0x644]
jmp 0x526831
mov esi, dword [ebp - 0x6a8]
sub esi, dword [ebp - 0x648]
sar esi, 2
test esi, esi
je 0x52772e
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a61
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x66c], edi
mov byte [ebp - 4], 0x43
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x527a6b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x63c], eax
mov byte [ebp - 4], 0x45
push 0x530270
push esi
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [ebp - 0x648]
call fcn.00532a30
add esp, 8
xor esi, esi
mov ecx, dword [ebp - 0x648]
mov dword [ebp - 0x688], esi
mov eax, dword [ebp - 0x6a8]
sub eax, ecx
sar eax, 2
cmp esi, eax
jae 0x5276ef
mov esi, dword [ecx + esi*4]
mov dword [ebp - 0x630], esi
test esi, esi
je 0x527639
lea eax, [ebp - 0x65c]
push eax
mov ecx, esi
call fcn.00494b70
mov byte [ebp - 4], 0x46
mov ecx, dword [ebp - 0x634]
or ecx, 1
mov dword [ebp - 0x634], ecx
mov eax, dword [eax]
test eax, eax
je 0x527a75
mov ecx, dword [ebp - 0x63c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x526e17
test dx, dx
je 0x526e13
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x526e17
add ecx, 4
add eax, 4
test dx, dx
jne 0x526df1
xor eax, eax
jmp 0x526e1c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x526e2c
cmp dword [edi - 0xc], eax
mov byte [ebp - 0x635], 1
jne 0x526e33
mov byte [ebp - 0x635], 0
mov dword [ebp - 4], 0x45
and dword [ebp - 0x634], 0xfffffffe
mov byte [ebp - 4], 0x45
mov edx, dword [ebp - 0x65c]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x526e63
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp byte [ebp - 0x635], 0
je 0x526ed2
test edi, edi
jne 0x526e74
xor ecx, ecx
jmp 0x526e8f
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x526e80
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x44]
call fcn.0040c9d0
mov esi, dword [ebp - 0x630]
push esi
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax + 0x60]
call fcn.004b4eb0
test al, al
je 0x526ed2
mov ecx, dword [ebp - 0x628]
add dword [ecx + 0x20], 1
adc dword [ecx + 0x24], 0
mov ecx, dword [ebp - 0x648]
mov esi, dword [ebp - 0x688]
inc esi
jmp 0x526d96
mov byte [ebp - 4], 0x48
mov ecx, dword [esi + 0x44]
sub ecx, 0x10
call fcn.0040c950
add eax, 0x10
mov dword [ebp - 0x710], eax
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0x634]
or ecx, 0x10
mov dword [ebp - 0x634], ecx
lea esi, [eax - 0x10]
mov edx, dword [ebp - 0x63c]
add edx, 0xfffffff0
mov dword [ebp - 0x6e8], edx
cmp esi, edx
je 0x526f74
lea ecx, [edx + 0xc]
mov dword [ebp - 0x658], ecx
cmp dword [ecx], 0
jl 0x526f65
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x526f65
mov ecx, esi
call fcn.0040c950
mov dword [ebp - 0x6e4], eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x658]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x526f5a
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x6e4]
add eax, 0x10
mov dword [ebp - 0x63c], eax
jmp 0x526f74
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x63c]
call fcn.0040c9d0
and dword [ebp - 0x634], 0xffffffef
mov byte [ebp - 4], 0x45
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x526f94
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp - 0x630]
mov ecx, dword [ecx + 0x44]
sub ecx, 0x10
call fcn.0040c950
lea esi, [eax + 0x10]
mov dword [ebp - 0x6e0], esi
mov byte [ebp - 4], 0x4b
or dword [ebp - 0x634], 0x20
mov byte [ebp - 4], 0x4d
mov eax, dword [esi - 0xc]
add eax, 0xfffffffc
push eax
push 4
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x6e0]
call fcn.004c6ec0
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x634]
or ecx, 0x40
mov dword [ebp - 0x634], ecx
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
jge 0x527005
mov dword [ebp - 0x640], 0xffffffff
jmp 0x527034
push 0x65eb88
push ecx
call fcn.00587dd7
add esp, 8
mov ecx, eax
test ecx, ecx
jne 0x527024
or eax, 0xffffffff
mov dword [ebp - 0x640], eax
jmp 0x527034
mov eax, dword [ebp - 0x658]
sub ecx, dword [eax]
sar ecx, 1
mov dword [ebp - 0x640], ecx
mov ecx, dword [ebp - 0x634]
and ecx, 0xffffffbf
mov dword [ebp - 0x634], ecx
mov byte [ebp - 4], 0x4b
mov edx, dword [ebp - 0x6dc]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52706b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x634]
and ecx, 0xffffffdf
mov dword [ebp - 0x634], ecx
mov byte [ebp - 4], 0x45
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x527090
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov esi, dword [ebp - 0x640]
cmp esi, 0xffffffff
jne 0x5270d3
push dword [ebp - 0x630]
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax + 0x60]
call fcn.004b4eb0
test al, al
je 0x5270d3
mov ecx, dword [ebp - 0x628]
add dword [ecx + 0x20], 1
adc dword [ecx + 0x24], 0
mov ecx, dword [ebp - 0x648]
mov esi, dword [ebp - 0x688]
inc esi
jmp 0x526d96
add esi, 4
mov dword [ebp - 0x640], esi
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0x630]
mov ecx, dword [eax + 0x44]
sub ecx, 0x10
call fcn.0040c950
lea esi, [eax + 0x10]
mov dword [ebp - 0x6f4], esi
mov byte [ebp - 4], 0x50
or dword [ebp - 0x634], 0x80
mov eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x6f4]
call fcn.004c6190
mov byte [ebp - 4], 0x52
and dword [ebp - 0x634], 0xffffff7f
mov byte [ebp - 4], 0x53
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x52714b
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov eax, dword [ebp - 0x624]
cmp dword [eax - 0xc], 0
jge 0x52715c
or esi, 0xffffffff
jmp 0x527182
push 0x64f4f8
push eax
call fcn.00587dd7
add esp, 8
mov esi, eax
test esi, esi
jne 0x527175
or esi, 0xffffffff
jmp 0x527182
sub esi, dword [ebp - 0x624]
sar esi, 1
cmp esi, 0xffffffff
jne 0x5271ad
push dword [ebp - 0x630]
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax + 0x60]
call fcn.004b4eb0
test al, al
je 0x5271ad
mov eax, dword [ebp - 0x628]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
jmp 0x527611
push esi
lea eax, [ebp - 0x6ec]
push eax
lea ecx, [ebp - 0x624]
call fcn.0046c6c0
mov byte [ebp - 4], 0x56
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x624]
add esi, 0xfffffff0
cmp ecx, esi
je 0x527224
cmp dword [esi + 0xc], 0
jl 0x527215
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x527215
call fcn.0040c950
mov dword [ebp - 0x658], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x52720a
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x658]
add eax, 0x10
mov dword [ebp - 0x624], eax
jmp 0x527224
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x624]
call fcn.0040c9d0
mov byte [ebp - 4], 0x53
mov edx, dword [ebp - 0x6ec]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x527246
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x624]
lea ecx, [ecx - 0x10]
call fcn.0040c950
add eax, 0x10
mov dword [ebp - 0x670], eax
mov byte [ebp - 4], 0x59
push 0x65e964
push 0x65eb88
lea ecx, [ebp - 0x670]
call fcn.00414310
xor ecx, ecx
mov dword [ebp - 0x62c], ecx
mov esi, dword [ebp - 0x670]
mov edx, dword [ebp - 0x644]
nop word [eax + eax]
mov eax, dword [ebp - 0x6b4]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x5275cf
mov eax, dword [edx + ecx*4]
test eax, eax
je 0x5276de
mov eax, dword [eax]
test eax, eax
je 0x527a7f
mov ecx, esi
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x5272e6
test dx, dx
je 0x5272e2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x5272e6
add ecx, 4
add eax, 4
test dx, dx
jne 0x5272c0
xor eax, eax
jmp 0x5272eb
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x644]
test eax, eax
jne 0x5276de
mov ecx, dword [ebp - 0x62c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
test edx, edx
ja 0x527316
jb 0x52731d
cmp ecx, 0x200
jb 0x52731d
mov ecx, 0x200
xor edx, edx
push 0
push edx
push ecx
push eax
push 0
push dword [ebp - 0x694]
lea ecx, [ebp - 0x684]
call fcn.0050ccb0
mov dword [ebp - 0x650], eax
test eax, eax
je 0x5276d8
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x61c]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x5276d8
cmp dword [ebp - 0x64c], eax
je 0x5276d8
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x698], eax
push eax
call fcn.00560596
add esp, 4
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x650]
mov ecx, dword [eax]
push 0
push 0
push dword [ebp - 0x69c]
push dword [ebp - 0x6a0]
push eax
call dword [ecx + 0x14]
mov ecx, dword [ebp - 0x650]
mov eax, dword [ecx]
lea edx, [ebp - 0x660]
push edx
push dword [ebp - 0x64c]
mov edx, dword [ebp - 0x640]
push edx
push ecx
call dword [eax + 0xc]
test eax, eax
jne 0x5276ca
mov byte [ebp - 4], 0x5a
mov eax, dword [ebp - 0x640]
mov cl, byte [eax]
mov byte [ebp - 0x61d], cl
mov edx, dword [ebp - 0x660]
cmp edx, 0x1b
jbe 0x52766b
cmp cl, 1
lea ecx, [edx - 0x18]
je 0x5273f7
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x650], ecx
lea eax, [ecx + 0x18]
cmp edx, eax
jb 0x52766b
cmp ecx, 3
jbe 0x52766b
mov ax, word [0x639ee0]
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00588800
xor eax, eax
cmp byte [ebp - 0x61d], 1
setne al
lea eax, [eax*4 + 0x18]
add eax, dword [ebp - 0x640]
push eax
mov eax, 0x104
cmp dword [ebp - 0x650], eax
cmovb eax, dword [ebp - 0x650]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.005bb8c7
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x654]
call fcn.0040c380
mov byte [ebp - 4], 0x5b
mov eax, dword [ebp - 0x654]
cmp dword [eax - 0xc], 0
je 0x527645
cmp word [ebp - 0x21a], 0x3a
jne 0x527645
lea eax, [ebp - 0x674]
push eax
mov ecx, dword [ebp - 0x630]
call fcn.00494b70
mov byte [ebp - 4], 0x5c
mov edx, dword [eax]
lea ecx, [edx - 0x10]
add edi, 0xfffffff0
cmp ecx, edi
je 0x527518
cmp dword [edi + 0xc], 0
jl 0x527509
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x527509
call fcn.0040c950
mov dword [ebp - 0x658], eax
or ecx, 0xffffffff
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5274fe
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [ebp - 0x658]
add eax, 0x10
mov dword [ebp - 0x66c], eax
jmp 0x527518
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x66c]
call fcn.0040c9d0
mov byte [ebp - 4], 0x5d
mov byte [ebp - 4], 0x5b
mov edx, dword [ebp - 0x674]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52753e
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push dword [ebp - 0x654]
push dword [ebp - 0x624]
lea ecx, [ebp - 0x66c]
call fcn.00414310
mov eax, dword [ebp - 0x630]
add eax, 0x44
mov dword [ebp - 0x658], eax
mov edi, dword [ebp - 0x66c]
test edi, edi
jne 0x527572
xor ecx, ecx
jmp 0x52758c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x527577
sub ecx, edx
sar ecx, 1
mov eax, dword [ebp - 0x658]
push ecx
push edi
mov ecx, eax
call fcn.0040c9d0
push 1
push dword [ebp - 0x640]
call fcn.005603ff
add esp, 8
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x5a
mov edx, dword [ebp - 0x654]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5275cb
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x59
push dword [ebp - 0x630]
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax + 0x60]
call fcn.004b4eb0
test al, al
je 0x5275f5
mov eax, dword [ebp - 0x628]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov byte [ebp - 4], 0x53
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x527611
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov byte [ebp - 4], 0x45
mov edx, dword [ebp - 0x624]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x527633
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x648]
mov esi, dword [ebp - 0x688]
inc esi
jmp 0x526d96
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x5a
mov edx, dword [ebp - 0x654]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52766b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0x59
jmp 0x5276ca
push dword [ebp - 0x640]
call fcn.00560591
add esp, 4
mov edx, dword [ebp - 0x644]
inc dword [ebp - 0x62c]
mov ecx, dword [ebp - 0x62c]
jmp 0x527290
mov byte [ebp - 4], 0x43
mov edx, dword [ebp - 0x63c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x527713
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x30
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x52772e
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 0xa
mov dword [ebp - method.CRecoverFileFAT16.virtual_0], vtable.CRecoverFile.0
sub esp, 8
mov esi, dword [ebp - 0x628]
push dword [esi + 0x20]
lea eax, [ebp - 0x65c]
push eax
call fcn.0052e910
mov byte [ebp - 4], 0x66
push 1
push 0
push dword [eax]
push 0
push 0
mov ecx, esi
call fcn.00523f60
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x65c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x52778d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x690]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x5277ac
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 5
mov dword [ebp - method.CFileRecord.virtual_0], vtable.CFileRecord.0
mov byte [ebp - 4], 0x69
lea esi, [ebp - 0x578]
mov edi, 0x10
nop dword [eax]
mov ecx, esi
call fcn.0047ddc0
add esi, 0x14
sub edi, 1
jne 0x5277d0
mov eax, dword [ebp - 0x5c8]
test eax, eax
je 0x5277f4
push 0x30
push eax
call fcn.005603ff
add esp, 8
mov byte [ebp - 4], 5
push 0x47de20
push 0x10
push 0x14
lea eax, [ebp - 0x578]
push eax
call fcn.0056047a
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x648]
test edx, edx
je 0x527873
mov eax, dword [ebp - 0x6a4]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x52784b
add ecx, 0x23
mov edx, dword [edx - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x527a89
push ecx
push edx
call fcn.005603ff
add esp, 8
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a4], 0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x644]
test edx, edx
je 0x5278d9
mov eax, dword [ebp - 0x6b0]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x5278b1
add ecx, 0x23
mov edx, dword [edx - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x527a8e
push ecx
push edx
call fcn.005603ff
add esp, 8
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x6b0], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x6cc]
test ecx, ecx
je 0x52793f
mov eax, dword [ebp - 0x6c4]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
mov eax, ecx
cmp edx, 0x1000
jb 0x527917
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x527a93
push edx
push ecx
call fcn.005603ff
add esp, 8
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c4], 0
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x6d8]
test edi, edi
je 0x5279a5
mov eax, dword [ebp - 0x6d0]
sub eax, edi
sar eax, 3
lea ecx, [eax*8]
mov eax, edi
cmp ecx, 0x1000
jb 0x52797d
add ecx, 0x23
mov edi, dword [edi - 4]
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x527a98
push ecx
push edi
call fcn.005603ff
add esp, 8
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x700]
test edx, edx
je 0x527a07
mov ecx, dword [ebp - 0x6f8]
sub ecx, edx
and ecx, 0xfffffff8
mov eax, edx
cmp ecx, 0x1000
jb 0x5279df
add ecx, 0x23
mov edx, dword [edx - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x527a9d
push ecx
push edx
call fcn.005603ff
add esp, 8
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x6f8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 0x18
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
call fcn.00531020
call fcn.00531020
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
call fcn.005a5046
call fcn.005a5046
call fcn.005a5046
call fcn.005a5046
call fcn.005a5046
int3