Function at 0x1000b8c0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Create thread
Get disk information
Initialize winsock library
Link many functions at runtime
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ae0e
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x10091018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 2
push edi
mov dword [ebp - 0x1a8], edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp dword [0x10093870], 1
jne 0x1000b90f
lea eax, [edi + 1]
jmp 0x1000f546
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x428], edi
mov dword [ebp - 4], 0
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x424]
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShan_JiBen::rg_WenBenShuZuLei.0
call fcn.10004440
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 4
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], 0x10080cd8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 6
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z
mov byte [ebp - 4], 7
mov esi, 0x10080564
mov ecx, dword [ebp - 0x1f8]
test ecx, ecx
jne 0x1000b9d1
cmp dword [ebp - 0x1e0], 0
mov ecx, esi
cmovne ecx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1cc]
test eax, eax
jne 0x1000b9eb
cmp dword [ebp - 0x1b4], 0
mov eax, esi
cmovne eax, dword [ebp - 0x1bc]
sub esp, 8
lea edx, [ebp - 0x424]
push ecx
mov ecx, eax
call fcn.10040e90
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x204]
call fcn.100039d0
xor edx, edx
test dword [ebp - 0x40c], 0xfffffffc
mov dword [ebp - 0x1a4], edx
jbe 0x1000c202
jmp 0x1000ba45
mov esi, 0x10080564
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x220]
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
mov dword [ebp - 0x498], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov byte [ebp - 4], 0xb
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x208], 0x40
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x208], 0xfe
mov byte [ebp - 4], 0xd
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x24c]
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
mov dword [ebp - 0x49c], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov byte [ebp - 4], 0xf
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x234], 0x40
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x234], 0xfe
mov byte [ebp - 4], 0x11
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x488]
mov dword [ebp - method.CWString.virtual_0], vtable.rg_sdk_QuanJuBianLiang::rg_NtDosPath.0
call fcn.10002c10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x45c]
call fcn.10002c10
mov byte [ebp - 4], 0x15
xor ecx, ecx
cmp dword [ebp - 0x40c], ecx
mov eax, dword [ebp - 0x414]
cmove eax, ecx
lea ecx, [ebp - 0x204]
mov edx, dword [eax + edx*4]
call fcn.10002c10
mov byte [ebp - 4], 0x16
test edx, edx
mov eax, esi
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
cmovne eax, edx
push eax
lea ecx, [ebp - 0x204]
call fcn.10043f00
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x204]
push 0x10080d48
lea ecx, [ebp - 0x1d8]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x230]
mov eax, dword [ecx + 0x44]
cmp eax, fcn.10001980
je 0x1000bc8c
lea ecx, [ebp - 0x230]
call eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x22c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x220]
mov eax, dword [eax + 0x44]
cmp eax, fcn.10001980
je 0x1000bcbf
lea ecx, [ebp - 0x220]
call eax
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x220]
call fcn.10003f90
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x1bc]
test ecx, ecx
je 0x1000bd1b
mov eax, dword [ebp - 0x1c8]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000bd13
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000bd1b
lea ecx, [ebp - 0x1c8]
call eax
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b8], 0
mov byte [ebp - 4], 0x19
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x17
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x1e8]
test ecx, ecx
je 0x1000bda2
mov eax, dword [ebp - 0x1f4]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000bd9a
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000bda2
lea ecx, [ebp - 0x1f4]
call eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1e4], 0
mov byte [ebp - 4], 0x1c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x15
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x288]
call fcn.10002c10
or edi, 1
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x1a8], edi
call fcn.10043aa0
mov edx, eax
mov eax, dword [edx + 0x14]
cmp eax, 2
jb 0x1000be1c
mov ecx, dword [edx + 0xc]
movzx ecx, word [ecx + eax - 2]
test cx, cx
jne 0x1000be1c
add eax, 0xfffffffe
mov dword [edx + 0x14], eax
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x278]
lea eax, [esi + 0x802]
push eax
call fcn.10042be0
mov ecx, 0x200
lea edx, [esi + eax]
mov eax, 0x200020
mov edi, edx
rep stosd dword es:[edi], eax
xor eax, eax
mov word [edx + 0x800], ax
mov eax, dword [ebp - 0x25c]
mov eax, dword [eax + 0x44]
cmp eax, fcn.10001980
je 0x1000be66
lea ecx, [ebp - 0x25c]
call eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax + 0x44]
cmp eax, fcn.10001980
je 0x1000bea2
lea ecx, [ebp - 0x24c]
call eax
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x24c]
call fcn.10003f90
mov edi, dword [ebp - 0x1a8]
and edi, 0xfffffffe
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x278]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
je 0x1000bf10
mov eax, dword [ebp - 0x278]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000bf08
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000bf10
lea ecx, [ebp - 0x278]
call eax
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
mov byte [ebp - 4], 0x20
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x250]
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
test ecx, ecx
jne 0x1000bf67
cmp dword [ebp - 0x238], 0
mov ecx, 0x10080564
cmovne ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x224]
test eax, eax
jne 0x1000bf84
cmp dword [ebp - 0x20c], 0
mov eax, 0x10080564
cmovne eax, dword [ebp - 0x214]
push 0x400
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jle 0x1000c0aa
mov eax, dword [ebp - 0x488]
lea ecx, [ebp - 0x488]
call dword [eax + 0x44]
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x478]
call dword [eax + 0x44]
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x478]
call fcn.10003f90
mov eax, dword [ebp - 0x45c]
lea ecx, [ebp - 0x45c]
call dword [eax + 0x44]
mov eax, dword [ebp - 0x22c]
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x44c]
call dword [eax + 0x44]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x44c]
call fcn.10003f90
mov eax, dword [ebp - 0x494]
lea ecx, [ebp - 0x494]
mov eax, dword [eax + 0x20]
cmp eax, fcn.10007890
jne 0x1000c066
call fcn.10007890
mov ecx, eax
mov dword [ebp - 0x1ac], ecx
jmp 0x1000c070
call eax
mov ecx, eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [0x10093a5c]
mov esi, dword [0x10093a60]
sub eax, esi
cmp eax, 4
jl 0x1000c093
mov eax, dword [0x10093a58]
mov dword [eax + esi], ecx
add dword [0x10093a60], 4
jmp 0x1000c0aa
lea eax, [esi + 4]
mov ecx, 0x10093a4c
push eax
call fcn.10042be0
mov ecx, dword [ebp - 0x1ac]
mov dword [eax + esi], ecx
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x45c]
call fcn.100039d0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x488]
call fcn.100039d0
mov byte [ebp - 4], 0x11
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x1000c123
mov eax, dword [ebp - 0x24c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000c11b
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000c123
lea ecx, [ebp - 0x24c]
call eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 0
mov byte [ebp - 4], 0x26
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0xd
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x220]
mov dword [ebp - 0x4b0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x1000c1aa
mov eax, dword [ebp - 0x220]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000c1a2
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000c1aa
lea ecx, [ebp - 0x220]
call eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0
mov byte [ebp - 4], 0x29
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x40c]
inc edx
shr eax, 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x1a4], edx
cmp edx, eax
jl 0x1000ba40
lea ecx, [ebp - 0x1d8]
call fcn.100220e0
mov esi, eax
mov byte [ebp - 4], 0x2c
mov ecx, 0x10091b28
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x10091b2c], ecx
mov ecx, dword [esi + 8]
mov dword [0x10091b30], ecx
mov ecx, 0x10091b38
mov eax, dword [esi + 0xc]
mov dword [0x10091b34], eax
mov eax, dword [0x10091b38]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x10091b38
push eax
call fcn.10003f90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x3d0], 0
mov byte [ebp - 4], 0x2d
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x3c0], 0x40
mov byte [ebp - 4], 0x2e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], 0
mov byte [ebp - 4], 0x2f
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2a8], 0x40
mov byte [ebp - 4], 0x30
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0
mov byte [ebp - 4], 0x31
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x28c], 0x40
mov byte [ebp - 4], 0x32
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x3b4], 0
mov byte [ebp - 4], 0x33
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x3a4], 0x40
mov byte [ebp - 4], 0x34
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x328], 0
mov byte [ebp - 4], 0x35
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x318], 0x40
mov byte [ebp - 4], 0x36
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
mov byte [ebp - 4], 0x37
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x2fc], 0x40
mov byte [ebp - 4], 0x38
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x398], 0
mov byte [ebp - 4], 0x39
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x394], 0
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x388], 0x40
mov byte [ebp - 4], 0x3a
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 0
mov byte [ebp - 4], 0x3b
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e0], 0x40
mov byte [ebp - 4], 0x3c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 0
mov byte [ebp - 4], 0x3d
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c4], 0x40
mov byte [ebp - 4], 0x3e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x37c], 0
mov byte [ebp - 4], 0x3f
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x36c], 0x40
mov byte [ebp - 4], 0x40
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x360], 0
mov byte [ebp - 4], 0x41
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x350], 0x40
mov byte [ebp - 4], 0x42
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 0
mov byte [ebp - 4], 0x43
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x334], 0x40
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x3d8]
push eax
push 0x1fc
mov ecx, 0x10093930
call fcn.10040190
lea eax, [ebp - 0x2c0]
mov ecx, 0x10093930
push eax
push 0x1fd
call fcn.10040190
lea eax, [ebp - 0x2a4]
mov ecx, 0x10093930
push eax
push 0x1fe
call fcn.10040190
lea eax, [ebp - 0x3bc]
mov ecx, 0x10093930
push eax
push 0x1f4
call fcn.10040190
lea eax, [ebp - 0x3a0]
mov ecx, 0x10093930
push eax
push 0x1f7
call fcn.10040190
lea eax, [ebp - 0x384]
mov ecx, 0x10093930
push eax
push 0x1fa
call fcn.10040190
lea eax, [ebp - 0x368]
mov ecx, 0x10093930
push eax
push 0x1fb
call fcn.10040190
lea eax, [ebp - 0x330]
mov ecx, 0x10093930
push eax
push 0x1f5
call fcn.10040190
lea eax, [ebp - 0x314]
mov ecx, 0x10093930
push eax
push 0x1f6
call fcn.10040190
lea eax, [ebp - 0x2f8]
mov ecx, 0x10093930
push eax
push 0x1f8
call fcn.10040190
lea eax, [ebp - 0x2dc]
mov ecx, 0x10093930
push eax
push 0x1f9
call fcn.10040190
lea eax, [ebp - 0x34c]
mov ecx, 0x10093930
push eax
push 0x205
call fcn.10040190
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 2
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push 0x10080d4c
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x46
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1000c85b
cmp dword [eax + 0x24], ecx
mov ecx, 0x10080564
je 0x1000c85b
mov ecx, dword [eax + 0x1c]
call fcn.10041ac0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffffffd
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 4
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveLspProxy.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x48
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000c8e6
mov esi, dword [ebp - 0x3c4]
mov eax, esi
mov edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x1a4], edx
jmp 0x1000c907
cmp dword [eax + 0x24], 0
je 0x1000c946
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x3c4]
mov eax, esi
mov edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000c946
cmp word [ecx], 0
je 0x1000c946
test eax, eax
js 0x1000c946
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000c946
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffffffb
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 8
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivelsp32.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x4a
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000c9cc
mov esi, dword [ebp - 0x2ac]
mov eax, esi
mov edx, dword [ebp - 0x2b4]
mov dword [ebp - 0x1a4], edx
jmp 0x1000c9ed
cmp dword [eax + 0x24], 0
je 0x1000ca2c
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x2ac]
mov eax, esi
mov edx, dword [ebp - 0x2b4]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000ca2c
cmp word [ecx], 0
je 0x1000ca2c
test eax, eax
js 0x1000ca2c
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000ca2c
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffffff7
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x10
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivelsp64.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x4c
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000cab2
mov esi, dword [ebp - 0x290]
mov eax, esi
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x1a4], edx
jmp 0x1000cad3
cmp dword [eax + 0x24], 0
je 0x1000cb12
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x290]
mov eax, esi
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000cb12
cmp word [ecx], 0
je 0x1000cb12
test eax, eax
js 0x1000cb12
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000cb12
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xffffffef
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x20
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveProcess.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x4e
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000cb98
mov esi, dword [ebp - 0x3a8]
mov eax, esi
mov edx, dword [ebp - 0x3b0]
mov dword [ebp - 0x1a4], edx
jmp 0x1000cbb9
cmp dword [eax + 0x24], 0
je 0x1000cbf8
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x3a8]
mov eax, esi
mov edx, dword [ebp - 0x3b0]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000cbf8
cmp word [ecx], 0
je 0x1000cbf8
test eax, eax
js 0x1000cbf8
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000cbf8
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xffffffdf
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x40
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveprocess32.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x50
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000cc7e
mov esi, dword [ebp - 0x31c]
mov eax, esi
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1a4], edx
jmp 0x1000cc9f
cmp dword [eax + 0x24], 0
je 0x1000ccde
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x31c]
mov eax, esi
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000ccde
cmp word [ecx], 0
je 0x1000ccde
test eax, eax
js 0x1000ccde
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000ccde
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xffffffbf
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x80
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveprocess64.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x52
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000cd67
mov esi, dword [ebp - 0x300]
mov eax, esi
mov edx, dword [ebp - 0x308]
mov dword [ebp - 0x1a4], edx
jmp 0x1000cd88
cmp dword [eax + 0x24], 0
je 0x1000cdc7
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x300]
mov eax, esi
mov edx, dword [ebp - 0x308]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000cdc7
cmp word [ecx], 0
je 0x1000cdc7
test eax, eax
js 0x1000cdc7
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000cdc7
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xffffff7f
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x100
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivePidVirtualHW.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x54
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000ce53
mov esi, dword [ebp - 0x38c]
mov eax, esi
mov edx, dword [ebp - 0x394]
mov dword [ebp - 0x1a4], edx
jmp 0x1000ce74
cmp dword [eax + 0x24], 0
je 0x1000ceb3
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x38c]
mov eax, esi
mov edx, dword [ebp - 0x394]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000ceb3
cmp word [ecx], 0
je 0x1000ceb3
test eax, eax
js 0x1000ceb3
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000ceb3
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffffeff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x200
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drive_vhw32.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x56
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000cf3f
mov esi, dword [ebp - 0x2e4]
mov eax, esi
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x1a4], edx
jmp 0x1000cf60
cmp dword [eax + 0x24], 0
je 0x1000cf9f
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x2e4]
mov eax, esi
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000cf9f
cmp word [ecx], 0
je 0x1000cf9f
test eax, eax
js 0x1000cf9f
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000cf9f
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffffdff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x400
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drive_vhw64.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x58
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000d02b
mov esi, dword [ebp - 0x2c8]
mov eax, esi
mov edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x1a4], edx
jmp 0x1000d04c
cmp dword [eax + 0x24], 0
je 0x1000d08b
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x2c8]
mov eax, esi
mov edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000d08b
cmp word [ecx], 0
je 0x1000d08b
test eax, eax
js 0x1000d08b
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000d08b
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffffbff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x800
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveV5Proxy.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x5a
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000d117
mov esi, dword [ebp - 0x370]
mov eax, esi
mov edx, dword [ebp - 0x378]
mov dword [ebp - 0x1a4], edx
jmp 0x1000d138
cmp dword [eax + 0x24], 0
je 0x1000d177
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x370]
mov eax, esi
mov edx, dword [ebp - 0x378]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000d177
cmp word [ecx], 0
je 0x1000d177
test eax, eax
js 0x1000d177
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000d177
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xfffff7ff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x1000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveplugin.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x5c
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000d203
mov esi, dword [ebp - 0x354]
mov eax, esi
mov edx, dword [ebp - 0x35c]
mov dword [ebp - 0x1a4], edx
jmp 0x1000d224
cmp dword [eax + 0x24], 0
je 0x1000d263
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x354]
mov eax, esi
mov edx, dword [ebp - 0x35c]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000d263
cmp word [ecx], 0
je 0x1000d263
test eax, eax
js 0x1000d263
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000d263
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xffffefff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x2000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveNetFilteSDK.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x5e
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000d2ef
mov esi, dword [ebp - 0x338]
mov eax, esi
mov edx, dword [ebp - 0x340]
mov dword [ebp - 0x1a4], edx
jmp 0x1000d310
cmp dword [eax + 0x24], 0
je 0x1000d34f
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x338]
mov eax, esi
mov edx, dword [ebp - 0x340]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000d34f
cmp word [ecx], 0
je 0x1000d34f
test eax, eax
js 0x1000d34f
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000d34f
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x204]
call fcn.100039d0
and edi, 0xffffdfff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov eax, dword [0x10091bcc]
test eax, eax
je 0x1000d386
mov ecx, eax
jmp 0x1000d399
cmp dword [0x10091be4], 0
mov ecx, 0x10080564
cmovne ecx, dword [0x10091bdc]
mov edx, 0x10080af8
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000d3c6
test si, si
je 0x1000d3c2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000d3c6
add ecx, 4
add edx, 4
test si, si
jne 0x1000d3a0
xor ecx, ecx
jmp 0x1000d3cb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1000d4c8
test eax, eax
je 0x1000d3db
mov ecx, eax
jmp 0x1000d3ee
cmp dword [0x10091be4], 0
mov ecx, 0x10080564
cmovne ecx, dword [0x10091bdc]
mov edx, 0x100800fc
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000d419
test si, si
je 0x1000d415
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000d419
add ecx, 4
add edx, 4
test si, si
jne 0x1000d3f3
xor ecx, ecx
jmp 0x1000d41e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1000d4c8
test eax, eax
je 0x1000d42e
mov ecx, eax
jmp 0x1000d441
cmp dword [0x10091be4], 0
mov ecx, 0x10080564
cmovne ecx, dword [0x10091bdc]
mov edx, 0x10080af0
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000d46c
test si, si
je 0x1000d468
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000d46c
add ecx, 4
add edx, 4
test si, si
jne 0x1000d446
xor ecx, ecx
jmp 0x1000d471
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1000d4c8
mov eax, dword [0x10091bdc]
mov dword [0x10091bcc], 0
test eax, eax
je 0x1000d496
push eax
mov eax, dword [0x10091bd0]
mov ecx, 0x10091bd0
call dword [eax + 0xc]
push 0x100800fc
mov ecx, 0x10091bd0
mov dword [0x10091bdc], 0
mov dword [0x10091be4], 0
mov dword [0x10091be0], 0
call fcn.10042ca0
mov eax, dword [0x10091bcc]
test eax, eax
je 0x1000d4d0
mov ecx, eax
jmp 0x1000d4e3
cmp dword [0x10091be4], 0
mov ecx, 0x10080564
cmovne ecx, dword [0x10091bdc]
mov edx, 0x10080af8
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000d50e
test si, si
je 0x1000d50a
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000d50e
add ecx, 4
add edx, 4
test si, si
jne 0x1000d4e8
xor ecx, ecx
jmp 0x1000d513
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1000e4ca
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x288]
call fcn.10002c10
or edi, 0x4000
lea edx, [ebp - 0x288]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivelsp64.sys
lea edx, [ebp - 0x288]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x204]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x8000
lea edx, [ebp - 0x204]
xor ecx, ecx
call fcn.10041720
push str.drivelsp32.sys
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x230]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x10000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
call fcn.10041720
push str.driveLspProxy.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x25c]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x64
mov edx, esi
push edi
mov ecx, eax
call fcn.100051c0
mov esi, eax
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x25c]
call fcn.100039d0
mov edi, dword [ebp - 0x1a8]
and edi, 0xfffeffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x230]
call fcn.100039d0
and edi, 0xffff7fff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x204]
call fcn.100039d0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x404]
call fcn.100039d0
and edi, 0xffffbfff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
cmp esi, 1
je 0x1000d9f1
lea eax, [ebp - 0x2c0]
mov ecx, 0x10093930
push eax
push 0x203
call fcn.10040190
lea eax, [ebp - 0x2a4]
mov ecx, 0x10093930
push eax
push 0x204
call fcn.10040190
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x20000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivewin7_lsp32.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x66
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000d71b
mov esi, dword [ebp - 0x2ac]
mov eax, esi
mov edx, dword [ebp - 0x2b4]
mov dword [ebp - 0x1a4], edx
jmp 0x1000d73c
cmp dword [eax + 0x24], 0
je 0x1000d77b
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x2ac]
mov eax, esi
mov edx, dword [ebp - 0x2b4]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000d77b
cmp word [ecx], 0
je 0x1000d77b
test eax, eax
js 0x1000d77b
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000d77b
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x404]
call fcn.100039d0
and edi, 0xfffdffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x40000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivewin7_lsp64.sys
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x68
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1000d807
mov esi, dword [ebp - 0x290]
mov eax, esi
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x1a4], edx
jmp 0x1000d828
cmp dword [eax + 0x24], 0
je 0x1000d867
mov ecx, dword [eax + 0x1c]
mov esi, dword [ebp - 0x290]
mov eax, esi
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x1a4], edx
test ecx, ecx
je 0x1000d867
cmp word [ecx], 0
je 0x1000d867
test eax, eax
js 0x1000d867
push 0x10083000
push ecx
call fcn.10053d86
add esp, 8
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x1000d867
push eax
push esi
push 1
push dword [ebp - 0x1a4]
call fcn.10053c6d
push dword [ebp - 0x1ac]
call fcn.100534d5
add esp, 0x14
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x404]
call fcn.100039d0
and edi, 0xfffbffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x288]
call fcn.10002c10
or edi, 0x80000
lea edx, [ebp - 0x288]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drivewin7_lsp64.sys
lea edx, [ebp - 0x288]
lea ecx, [ebp - 0x230]
call fcn.10044bd0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x204]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x100000
lea edx, [ebp - 0x204]
xor ecx, ecx
call fcn.10041720
push str.drivewin7_lsp32.sys
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x25c]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x200000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
call fcn.10041720
push str.driveLspProxy.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0x6e
mov edx, esi
push edi
mov ecx, eax
call fcn.100051c0
mov esi, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov edi, dword [ebp - 0x1a8]
and edi, 0xffdfffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x25c]
call fcn.100039d0
and edi, 0xffefffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x204]
call fcn.100039d0
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x230]
call fcn.100039d0
and edi, 0xfff7ffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
cmp esi, 1
jne 0x1000f005
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 0x7b
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], str.127.0.0.1
mov byte [ebp - 4], 0x7c
lea edx, [ebp - 0x204]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0x7e
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.127.0.0.1
mov byte [ebp - 4], 0x7f
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0x80
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000da85
xor ecx, ecx
jmp 0x1000da88
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000da9f
xor ecx, ecx
jmp 0x1000daa2
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
jne 0x1000dab6
xor esi, esi
jmp 0x1000dadb
push 0
push 0
push 0
push 0xf8d6
push dword [ebp - 0x1a4]
push 0xf8d5
push eax
push 0
push 0
push 0
call dword [0x100938bc]
mov esi, eax
mov byte [ebp - 4], 0x7f
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x81
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x1000db1c
mov eax, dword [ebp - 0x220]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000db14
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000db1c
lea ecx, [ebp - 0x220]
call eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0
mov byte [ebp - 4], 0x7f
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x7c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x83
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x1000db98
mov eax, dword [ebp - 0x24c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000db90
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000db98
lea ecx, [ebp - 0x24c]
call eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 0
mov byte [ebp - 4], 0x7c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
cmp esi, 1
jne 0x1000f005
cmp dword [0x100938a0], 0
je 0x1000dbfd
push 0
push 0
push 0
push 0x35
push 0x35
push esi
push 2
push 0x3e9
call dword [0x100938c8]
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 0x88
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], str.127.255.255.255
mov byte [ebp - 4], 0x89
lea edx, [ebp - 0x204]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0x8b
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.127.0.0.0
mov byte [ebp - 4], 0x8c
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0x8d
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000dc91
xor ecx, ecx
jmp 0x1000dc94
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000dcab
xor ecx, ecx
jmp 0x1000dcae
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000dcda
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3ea
call dword [0x100938d4]
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 0x90
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], str.192.168.255.255
mov byte [ebp - 4], 0x91
lea edx, [ebp - 0x204]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0x93
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.192.168.0.0
mov byte [ebp - 4], 0x94
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0x95
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000ddaa
xor ecx, ecx
jmp 0x1000ddad
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000ddc4
xor ecx, ecx
jmp 0x1000ddc7
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000ddf3
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3eb
call dword [0x100938d4]
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x91
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 0x98
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], str.10.255.255.255
mov byte [ebp - 4], 0x99
lea edx, [ebp - 0x204]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0x9b
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.10.0.0.0
mov byte [ebp - 4], 0x9c
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0x9d
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000dec3
xor ecx, ecx
jmp 0x1000dec6
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000dedd
xor ecx, ecx
jmp 0x1000dee0
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000df0c
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3ec
call dword [0x100938d4]
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x288]
call fcn.10002c10
mov byte [ebp - 4], 0xa0
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x27c], str.172.31.255.255
mov byte [ebp - 4], 0xa1
lea edx, [ebp - 0x288]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0xa3
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.172.16.0.0
mov byte [ebp - 4], 0xa4
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0xa5
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000dfdc
xor ecx, ecx
jmp 0x1000dfdf
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000dff6
xor ecx, ecx
jmp 0x1000dff9
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000e025
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3ed
call dword [0x100938d4]
mov byte [ebp - 4], 0xa4
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xa1
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 0xa8
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], str.127.255.255.255
mov byte [ebp - 4], 0xa9
lea edx, [ebp - 0x204]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0xab
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.127.0.0.0
mov byte [ebp - 4], 0xac
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0xad
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000e0f5
xor ecx, ecx
jmp 0x1000e0f8
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000e10f
xor ecx, ecx
jmp 0x1000e112
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000e13e
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3ee
call dword [0x100938c8]
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x288]
call fcn.10002c10
mov byte [ebp - 4], 0xb0
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x27c], str.192.168.255.255
mov byte [ebp - 4], 0xb1
lea edx, [ebp - 0x288]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0xb2
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0xb3
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.192.168.0.0
mov byte [ebp - 4], 0xb4
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0xb5
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000e20e
xor ecx, ecx
jmp 0x1000e211
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000e228
xor ecx, ecx
jmp 0x1000e22b
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000e257
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3ef
call dword [0x100938c8]
mov byte [ebp - 4], 0xb4
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0xb2
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
lea ecx, [ebp - 0x204]
call fcn.10002c10
mov byte [ebp - 4], 0xb8
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f8], str.10.255.255.255
mov byte [ebp - 4], 0xb9
lea edx, [ebp - 0x204]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0xbb
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.10.0.0.0
mov byte [ebp - 4], 0xbc
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0xbd
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000e327
xor ecx, ecx
jmp 0x1000e32a
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000e341
xor ecx, ecx
jmp 0x1000e344
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000e370
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3f0
call dword [0x100938c8]
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xb9
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x288]
call fcn.10002c10
mov byte [ebp - 4], 0xc0
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x27c], str.172.31.255.255
mov byte [ebp - 4], 0xc1
lea edx, [ebp - 0x288]
push 1
lea ecx, [ebp - 0x220]
call fcn.100244d0
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
mov byte [ebp - 4], 0xc3
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1cc], str.172.16.0.0
mov byte [ebp - 4], 0xc4
lea edx, [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x24c]
call fcn.100244d0
mov esi, eax
mov byte [ebp - 4], 0xc5
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + 0x14], 0
jne 0x1000e440
xor ecx, ecx
jmp 0x1000e443
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x1a4], eax
jne 0x1000e45a
xor ecx, ecx
jmp 0x1000e45d
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x10091a98]
cmp dword [0x100938a0], 0
je 0x1000e489
push dword [ebp - 0x1a4]
push eax
push 1
push 0
push 0
push 0
push 2
push 0x3f1
call dword [0x100938c8]
mov byte [ebp - 4], 0xc4
lea ecx, [ebp - 0x24c]
call fcn.100043b0
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xc1
lea ecx, [ebp - 0x220]
call fcn.100043b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
mov eax, dword [0x10091bcc]
test eax, eax
je 0x1000e4d2
mov ecx, eax
jmp 0x1000e4e5
cmp dword [0x10091be4], 0
mov ecx, 0x10080564
cmovne ecx, dword [0x10091bdc]
mov edx, 0x100800fc
nop word [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000e516
test si, si
je 0x1000e512
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000e516
add ecx, 4
add edx, 4
test si, si
jne 0x1000e4f0
xor ecx, ecx
jmp 0x1000e51b
sbb ecx, ecx
or ecx, 1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ecx, ecx
jne 0x1000e744
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov dword [0x10093ac8], 1
call fcn.1005344c
add esp, 4
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x400000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveV5Proxy.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xc9
cmp dword [0x10093ac8], 0
jne 0x1000e5ab
mov dword [0x10093ac8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1005344c
add esp, 4
call fcn.1005342b
cdq
mov ecx, 0xb1bd
idiv ecx
add edx, 0x4e20
cmp dword [0x100938e8], 0
mov dword [ebp - 0x1a4], edx
je 0x1000e5d7
mov esi, 1
jmp 0x1000e706
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x1000e5eb
cmp dword [esi + 0x24], eax
mov eax, 0x10080564
je 0x1000e5eb
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.FixNet
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitData
push esi
mov dword [0x1009390c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProxyTcpUdp
push esi
mov dword [0x10093908], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProxy
push esi
mov dword [0x10093904], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetProcessFlow
push esi
mov dword [0x10093900], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StopProxy
push esi
mov dword [0x100938fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EmptyData
push esi
mov dword [0x100938f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CheckSocks5
push esi
mov dword [0x100938f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddFilterExeName
push esi
mov dword [0x100938f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x10093904], 0
mov dword [0x100938ec], eax
je 0x1000e701
cmp dword [0x10093900], 0
je 0x1000e701
test eax, eax
je 0x1000e701
cmp dword [0x100938f8], 0
je 0x1000e701
cmp dword [0x100938f4], 0
je 0x1000e701
mov eax, dword [0x10093908]
test eax, eax
je 0x1000e701
cmp dword [0x1009390c], 0
je 0x1000e701
cmp dword [0x100938f0], 0
je 0x1000e701
cmp dword [0x100938fc], 0
je 0x1000e701
push 0
push 0
push dword [ebp - 0x1a4]
call eax
test eax, eax
je 0x1000e6fa
mov dword [0x100938e8], 1
mov esi, 1
jmp 0x1000e706
mov esi, 0xffffff36
jmp 0x1000e706
mov esi, 0xffffff9a
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0x404]
call fcn.100039d0
and edi, 0xffbfffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
cmp esi, 1
jne 0x1000f005
mov eax, dword [0x10091bcc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000e75a
cmp dword [0x10091be4], eax
mov eax, 0x10080564
cmovne eax, dword [0x10091bdc]
mov ecx, 0x10080af0
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000e786
test dx, dx
je 0x1000e782
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000e786
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000e760
xor eax, eax
jmp 0x1000e78b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000e93d
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or edi, 0x800000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.driveNetFilteSDK.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xcb
cmp dword [0x10093910], 0
je 0x1000e7ed
mov esi, 1
jmp 0x1000e8e3
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x1000e801
cmp dword [ecx + 0x24], eax
mov eax, 0x10080564
je 0x1000e801
mov eax, dword [ecx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1ac], eax
test eax, eax
jne 0x1000e81a
or esi, 0xffffffff
jmp 0x1000e8e3
push 0x100803a0
push eax
call esi
push 0x100803a8
push dword [ebp - 0x1ac]
mov dword [0x1009392c], eax
call esi
push str.SetPorxy
push dword [ebp - 0x1ac]
mov dword [0x10093928], eax
call esi
push str.DelPorxy
push dword [ebp - 0x1ac]
mov dword [0x10093924], eax
call esi
push str.SetFilter
push dword [ebp - 0x1ac]
mov dword [0x10093920], eax
call esi
push 0x100803d8
push dword [ebp - 0x1ac]
mov dword [0x1009391c], eax
call esi
push str.GetPidFlow
push dword [ebp - 0x1ac]
mov dword [0x10093918], eax
call esi
cmp dword [0x1009392c], 0
mov dword [0x10093914], eax
je 0x1000e8de
cmp dword [0x10093928], 0
je 0x1000e8de
cmp dword [0x10093924], 0
je 0x1000e8de
test eax, eax
je 0x1000e8de
cmp dword [0x1009391c], 0
je 0x1000e8de
cmp dword [0x10093918], 0
je 0x1000e8de
cmp dword [0x10093920], 0
je 0x1000e8de
mov dword [0x10093910], 1
mov esi, 1
jmp 0x1000e8e3
mov esi, 0xfffffffe
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x404]
call fcn.100039d0
and edi, 0xff7fffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
cmp esi, 1
je 0x1000e91c
mov esi, 0xb
jmp 0x1000f005
cmp dword [0x10093910], 0
jne 0x1000e92c
xor esi, esi
jmp 0x1000f005
call dword [0x1009392c]
mov esi, eax
cmp esi, 1
jne 0x1000f005
mov byte [ebp - 4], 0xcc
lea ecx, [ebp - 0x288]
call fcn.10002c10
or edi, 0x1000000
lea edx, [ebp - 0x288]
xor ecx, ecx
mov dword [ebp - 0x1a8], edi
call fcn.10041720
push str.drive_vhw64.sys
lea edx, [ebp - 0x288]
lea ecx, [ebp - 0x230]
call fcn.10044bd0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xce
lea ecx, [ebp - 0x204]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x2000000
lea edx, [ebp - 0x204]
xor ecx, ecx
call fcn.10041720
push str.drive_vhw32.sys
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x25c]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x4000000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
call fcn.10041720
push str.drivePidVirtualHW.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0xd1
mov edx, esi
push edi
mov ecx, eax
call fcn.10005520
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov esi, dword [ebp - 0x1a8]
and esi, 0xfbffffff
mov dword [ebp - 0x1a8], esi
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xce
lea ecx, [ebp - 0x25c]
call fcn.100039d0
and esi, 0xfdffffff
mov dword [ebp - 0x1a8], esi
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0x204]
call fcn.100039d0
mov byte [ebp - 4], 0xcc
lea ecx, [ebp - 0x230]
call fcn.100039d0
and esi, 0xfeffffff
mov dword [ebp - 0x1a8], esi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x288]
call fcn.10002c10
or esi, 0x8000000
lea edx, [ebp - 0x288]
mov dword [ebp - 0x1a8], esi
xor ecx, ecx
call fcn.10041720
push str.driveprocess64.sys
lea edx, [ebp - 0x288]
lea ecx, [ebp - 0x230]
call fcn.10044bd0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xd4
lea ecx, [ebp - 0x204]
call fcn.10002c10
or esi, 0x10000000
lea edx, [ebp - 0x204]
xor ecx, ecx
mov dword [ebp - 0x1a8], esi
call fcn.10041720
push str.driveprocess32.sys
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x25c]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xd6
lea ecx, [ebp - 0x1d8]
call fcn.10002c10
or dword [ebp - 0x1a8], 0x20000000
lea edx, [ebp - 0x1d8]
xor ecx, ecx
call fcn.10041720
push str.driveProcess.dll
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x404]
call fcn.10044bd0
mov byte [ebp - 4], 0xd7
mov edx, esi
push edi
mov ecx, eax
call fcn.100053d0
mov esi, eax
mov byte [ebp - 4], 0xd6
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov edi, dword [ebp - 0x1a8]
and edi, 0xdfffffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0xd5
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xd4
lea ecx, [ebp - 0x25c]
call fcn.100039d0
and edi, 0xefffffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0xd3
lea ecx, [ebp - 0x204]
call fcn.100039d0
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x230]
call fcn.100039d0
and edi, 0xf7ffffff
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x288]
call fcn.100039d0
cmp esi, 1
je 0x1000edd9
lea eax, [ebp - 0x330]
mov ecx, 0x10093930
push eax
push 0x1ff
call fcn.10040190
lea eax, [ebp - 0x314]
mov ecx, 0x10093930
push eax
push 0x200
call fcn.10040190
lea ecx, [ebp - 0x1d8]
call fcn.100223e0
mov byte [ebp - 4], 0xd8
mov edx, eax
push str.drivewin7_process32.sys
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0xd9
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1000ec5f
cmp dword [eax + 0x24], ecx
mov ecx, 0x10080564
je 0x1000ec5f
mov ecx, dword [eax + 0x1c]
push ecx
push ecx
lea ecx, [ebp - 0x330]
call fcn.100431b0
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
lea ecx, [ebp - 0x204]
call fcn.100223e0
mov byte [ebp - 4], 0xda
mov edx, eax
push str.drivewin7_process64.sys
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0xdb
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1000ecc6
cmp dword [eax + 0x24], ecx
mov ecx, 0x10080564
je 0x1000ecc6
mov ecx, dword [eax + 0x1c]
push ecx
push ecx
lea ecx, [ebp - 0x314]
call fcn.100431b0
mov byte [ebp - 4], 0xda
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x230]
call fcn.100223e0
mov byte [ebp - 4], 0xdc
mov edx, eax
push str.drivewin7_process64.sys
lea ecx, [ebp - 0x25c]
call fcn.10044bd0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xdd
lea ecx, [ebp - 0x288]
call fcn.100223e0
mov byte [ebp - 4], 0xde
mov edx, eax
push str.drivewin7_process32.sys
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xdf
lea ecx, [ebp - 0x1d8]
call fcn.100223e0
mov byte [ebp - 4], 0xe0
mov edx, eax
push str.driveProcess.dll
lea ecx, [ebp - 0x404]
call fcn.10044bd0
mov byte [ebp - 4], 0xe1
mov edx, esi
push edi
mov ecx, eax
call fcn.100053d0
mov esi, eax
mov byte [ebp - 4], 0xe0
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov byte [ebp - 4], 0xdf
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xde
lea ecx, [ebp - 0x204]
call fcn.100039d0
mov byte [ebp - 4], 0xdd
lea ecx, [ebp - 0x288]
call fcn.100039d0
mov byte [ebp - 4], 0xdc
lea ecx, [ebp - 0x25c]
call fcn.100039d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x230]
call fcn.100039d0
cmp esi, 1
jne 0x1000f005
cmp dword [ebp - 0x1a4], 1
je 0x1000efc7
lea eax, [ebp - 0x2f8]
mov ecx, 0x10093930
push eax
push 0x201
call fcn.10040190
lea eax, [ebp - 0x2dc]
mov ecx, 0x10093930
push eax
push 0x202
call fcn.10040190
lea ecx, [ebp - 0x1d8]
call fcn.100223e0
mov byte [ebp - 4], 0xe2
mov edx, eax
push str.drivewin7_vhw32.sys
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0xe3
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1000ee4e
cmp dword [eax + 0x24], ecx
mov ecx, 0x10080564
je 0x1000ee4e
mov ecx, dword [eax + 0x1c]
push ecx
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.100431b0
mov byte [ebp - 4], 0xe2
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
lea ecx, [ebp - 0x204]
call fcn.100223e0
mov byte [ebp - 4], 0xe4
mov edx, eax
push str.drivewin7_vhw64.sys
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0xe5
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1000eeb5
cmp dword [eax + 0x24], ecx
mov ecx, 0x10080564
je 0x1000eeb5
mov ecx, dword [eax + 0x1c]
push ecx
push ecx
lea ecx, [ebp - 0x2dc]
call fcn.100431b0
mov byte [ebp - 4], 0xe4
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x204]
call fcn.100039d0
lea ecx, [ebp - 0x230]
call fcn.100223e0
mov byte [ebp - 4], 0xe6
mov edx, eax
push str.drivewin7_vhw64.sys
lea ecx, [ebp - 0x25c]
call fcn.10044bd0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xe7
lea ecx, [ebp - 0x288]
call fcn.100223e0
mov byte [ebp - 4], 0xe8
mov edx, eax
push str.drivewin7_vhw32.sys
lea ecx, [ebp - 0x204]
call fcn.10044bd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xe9
lea ecx, [ebp - 0x1d8]
call fcn.100223e0
mov byte [ebp - 4], 0xea
mov edx, eax
push str.drivePidVirtualHW.dll
lea ecx, [ebp - 0x404]
call fcn.10044bd0
add esp, 4
mov byte [ebp - 4], 0xeb
mov edx, esi
push edi
mov ecx, eax
call fcn.10005520
mov esi, eax
mov byte [ebp - 4], 0xea
lea ecx, [ebp - 0x404]
call fcn.100039d0
mov byte [ebp - 4], 0xe9
lea ecx, [ebp - 0x1d8]
call fcn.100039d0
mov byte [ebp - 4], 0xe8
lea ecx, [ebp - 0x204]
call fcn.100039d0
mov byte [ebp - 4], 0xe7
lea ecx, [ebp - 0x288]
call fcn.100039d0
mov byte [ebp - 4], 0xe6
lea ecx, [ebp - 0x25c]
call fcn.100039d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x230]
call fcn.100039d0
cmp esi, 1
jne 0x1000f005
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], 0
push eax
push 0
push 0
push 0x1000f570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10093878], eax
mov dword [0x10093870], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 1
mov byte [ebp - 4], 0x42
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xec
mov ecx, dword [ebp - 0x340]
test ecx, ecx
je 0x1000f046
mov eax, dword [ebp - 0x34c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f03e
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f046
lea ecx, [ebp - 0x34c]
call eax
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0
mov byte [ebp - 4], 0x42
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x40
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xed
mov ecx, dword [ebp - 0x35c]
test ecx, ecx
je 0x1000f0b3
mov eax, dword [ebp - 0x368]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f0ab
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f0b3
lea ecx, [ebp - 0x368]
call eax
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x358], 0
mov byte [ebp - 4], 0x40
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x3e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xee
mov ecx, dword [ebp - 0x378]
test ecx, ecx
je 0x1000f120
mov eax, dword [ebp - 0x384]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f118
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f120
lea ecx, [ebp - 0x384]
call eax
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x374], 0
mov byte [ebp - 4], 0x3e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x3c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xef
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x1000f18d
mov eax, dword [ebp - 0x2dc]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f185
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f18d
lea ecx, [ebp - 0x2dc]
call eax
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2cc], 0
mov byte [ebp - 4], 0x3c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x3a
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf0
mov ecx, dword [ebp - 0x2ec]
test ecx, ecx
je 0x1000f1fa
mov eax, dword [ebp - 0x2f8]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f1f2
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f1fa
lea ecx, [ebp - 0x2f8]
call eax
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], 0
mov byte [ebp - 4], 0x3a
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x38
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf1
mov ecx, dword [ebp - 0x394]
test ecx, ecx
je 0x1000f267
mov eax, dword [ebp - 0x3a0]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f25f
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f267
lea ecx, [ebp - 0x3a0]
call eax
mov dword [ebp - 0x394], 0
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x390], 0
mov byte [ebp - 4], 0x38
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x36
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf2
mov ecx, dword [ebp - 0x308]
test ecx, ecx
je 0x1000f2d4
mov eax, dword [ebp - 0x314]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f2cc
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f2d4
lea ecx, [ebp - 0x314]
call eax
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x304], 0
mov byte [ebp - 4], 0x36
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x34
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf3
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x1000f341
mov eax, dword [ebp - 0x330]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f339
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f341
lea ecx, [ebp - 0x330]
call eax
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x320], 0
mov byte [ebp - 4], 0x34
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x32
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf4
mov ecx, dword [ebp - 0x3b0]
test ecx, ecx
je 0x1000f3ae
mov eax, dword [ebp - 0x3bc]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f3a6
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f3ae
lea ecx, [ebp - 0x3bc]
call eax
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x3ac], 0
mov byte [ebp - 4], 0x32
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x30
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf5
mov ecx, dword [ebp - 0x298]
test ecx, ecx
je 0x1000f41b
mov eax, dword [ebp - 0x2a4]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f413
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f41b
lea ecx, [ebp - 0x2a4]
call eax
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x294], 0
mov byte [ebp - 4], 0x30
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x2e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf6
mov ecx, dword [ebp - 0x2b4]
test ecx, ecx
je 0x1000f488
mov eax, dword [ebp - 0x2c0]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f480
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f488
lea ecx, [ebp - 0x2c0]
call eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b0], 0
mov byte [ebp - 4], 0x2e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 3
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf7
mov edx, dword [ebp - 0x3cc]
test edx, edx
je 0x1000f4f5
mov eax, dword [ebp - 0x3d8]
push edx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1000f4ed
mov ecx, 0x10093938
call fcn.10043590
jmp 0x1000f4f5
lea ecx, [ebp - 0x3d8]
call eax
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x3c8], 0
mov byte [ebp - 4], 3
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 4], 0xf8
lea ecx, [ebp - 0x424]
call fcn.10003a80
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10046e38
mov esp, ebp
pop ebp
ret