Function at 0x40a770
Capabilities:
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1f30
call fcn.00415460
push ebx
push ebp
push esi
push edi
call fcn.0040a740
test eax, eax
je 0x40ada4
mov ebx, dword [esp + 0x1f48]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x184]
push str..Scsi_d:
push eax
call fcn.00415d3d
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x40a985
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x284]
push 8
rep stosd dword es:[edi], eax
lea edx, [esp + 0x28c]
push str.SCSIDISK
stosb byte es:[edi], al
push edx
mov dword [esp + 0x290], 0x1c
mov dword [esp + 0x29c], 0x2710
mov dword [esp + 0x2a8], 0x211
mov dword [esp + 0x2a0], 0x1b0501
call fcn.00416920
mov eax, ebx
add esp, 0xc
and eax, 0x80000001
mov byte [esp + 0x2aa], 0xec
jns 0x40a843
dec eax
or eax, 0xfffffffe
inc eax
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28c]
mov byte [esp + 0x2b4], al
push 0x22d
push edx
lea eax, [esp + 0x294]
push 0x3c
push eax
push 0x4d008
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40a97e
mov al, byte [esp + 0x2e6]
test al, al
je 0x40a97e
push 0x400
call fcn.00422856
mov ebx, eax
add esp, 4
mov ecx, ebx
lea eax, [esp + 0x2b0]
mov edx, 0x100
xor edi, edi
add ecx, 4
mov di, word [eax]
add eax, 2
mov dword [ecx - 4], edi
dec edx
jne 0x40a8a8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov edx, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.00422881
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.00415d3d
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x40ab46
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push ecx
push 0x18
push edx
push eax
push eax
push 0x74080
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov al, byte [esp + 0x27]
test al, al
jbe 0x40ab3f
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
lea edx, [esp + 0x50]
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x14], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x84
xor eax, eax
mov edi, 0x448a00
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push 0x448a00
push edx
push esi
call fcn.0040a6e0
add esp, 0x18
test eax, eax
je 0x40ab3f
push 0x400
call fcn.00422856
mov ebx, eax
add esp, 4
mov ecx, ebx
mov eax, 0x448a10
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x448c10
jl 0x40aa65
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.00422881
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.00415d3d
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ad8e
mov ecx, 0x43
xor eax, eax
lea edi, [esp + 0x74]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 0xc0
push 0
mov dword [esp + 0x84], eax
mov byte [esp + 0x98], al
push edx
lea eax, [esp + 0x7c]
mov ecx, 0x2c
push 0x10c
push eax
mov word [esp + 0x84], cx
mov dword [esp + 0x9c], ecx
push ecx
lea ecx, [esp + 0x88]
mov byte [esp + 0x8e], 6
push ecx
push 0x4d004
push ebx
mov byte [esp + 0x9b], 0x18
mov byte [esp + 0x9c], 1
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 0x4c
mov byte [esp + 0xb0], 0x12
mov byte [esp + 0xb1], 1
mov byte [esp + 0xb2], 0x80
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40ad8e
cmp byte [esp + 0xc1], 0x80
jne 0x40ad8e
lea ecx, [esp + 0x284]
lea eax, [esp + 0xc1]
mov esi, 0x60
xor edx, edx
add ecx, 4
mov dh, byte [eax - 1]
mov dl, byte [eax]
add eax, 2
mov dword [ecx - 4], edx
dec esi
jne 0x40ac49
push 0x14
lea eax, [esp + 0x288]
push 2
push eax
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x1f4c]
lea eax, [esp + 0x14]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea ecx, [esp + 0x734]
push esi
push eax
push 0x800
push ecx
push esi
push esi
push 0x4100c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40ad69
mov eax, dword [esp + 0x73c]
cmp eax, esi
je 0x40ad69
lea eax, [esp + eax + 0x748]
lea ecx, [esp + 0x4b4]
mov esi, 0xf
xor edx, edx
add ecx, 4
mov dh, byte [eax]
inc eax
mov dword [ecx - 4], edx
mov edi, dword [ecx - 4]
xor edx, edx
mov dl, byte [eax]
or edi, edx
inc eax
mov dword [ecx - 4], edi
dec esi
jne 0x40ace3
push 0xa
lea eax, [esp + 0x4b8]
push 0
push eax
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf
mov eax, ecx
mov esi, edi
mov edi, edx
push 0xb
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c8]
push ecx
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x64], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x6c], esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1f30
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
lea ecx, [esp + 0x180]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x630]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x284]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x630]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x17f], 0x5c
je 0x40ae67
mov edi, str.IOSUBSYSSMARTVSD.VXD
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SMARTVSD.VXD
jmp 0x40ae9d
mov edi, 0x4431e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4431d0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x630]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0040a5b0
add esp, 4
test eax, eax
jne 0x40aeed
lea ecx, [esp + 0x630]
push eax
lea edx, [esp + 0x288]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0
push 1
push 0
push 0
push 0
push str..SMARTVSD
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x40b040
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push 0x18
push ecx
push 0
push 0
push 0x74080
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40b040
mov al, byte [esp + 0x27]
xor bl, bl
mov byte [esp + 0x14], bl
mov dl, al
mov cl, bl
shr dl, cl
test dl, 1
je 0x40b02a
mov esi, dword [esp + 0x14]
test dl, 0x10
jne 0x40afc1
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
stosb byte es:[edi], al
mov dword [esp + 0x48], edx
lea eax, [esp + 0x18]
mov byte [esp + 0x4c], dl
push eax
push esi
lea edx, [esp + 0x58]
push ecx
push edx
push ebp
call fcn.0040a680
add esp, 0x14
test eax, eax
je 0x40afbd
mov ecx, esi
mov al, 1
and ecx, 0xff
shl al, cl
or byte [esp + 0x13], al
mov al, byte [esp + 0x27]
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x20], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [esp + 0x20]
mov ecx, 0x84
xor eax, eax
mov edi, 0x448a00
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x50]
push ecx
push esi
push edx
push 0x448a00
push eax
push ebp
call fcn.0040a6e0
add esp, 0x18
test eax, eax
je 0x40b026
mov eax, dword [esp + 0x1f48]
and esi, 0xff
cmp esi, eax
je 0x40b240
mov al, byte [esp + 0x27]
inc bl
cmp bl, 4
mov byte [esp + 0x14], bl
jb 0x40af54
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 0x403
xor eax, eax
lea edi, [esp + 0xf34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x52c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x52c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.DiskSerial.VXD
cmp byte [esp + ecx + 0x73], 0x5c
jne 0x40b0c8
mov edi, 0x4431a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x8000000
mov ecx, ebx
push 2
push eax
and ecx, 3
push 3
lea eax, [esp + 0x540]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ad95
mov edi, dword [esp + 0x1f44]
push str.DISKSERIAL
push str.DiskSerial
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x20]
push 0
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push str..DiskSerial.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x52c]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x40ad95
lea eax, [esp + 0x1c]
push 0
push eax
lea ecx, [esp + 0xf3c]
push 4
push ecx
push 0
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call edi
xor esi, esi
mov al, byte [esp + esi + 0xf38]
test al, al
je 0x40b22b
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov cl, byte [esp + eax + 0xf34]
test cl, cl
je 0x40b22b
push 0x400
call fcn.00422856
mov edi, dword [esp + 0x1f4c]
add esp, 4
mov edx, edi
mov ebp, eax
shl edx, 9
mov ecx, ebp
lea eax, [esp + edx + 0xf40]
mov edx, 0x100
xor ebx, ebx
add ecx, 4
mov bx, word [eax]
add eax, 2
mov dword [ecx - 4], ebx
dec edx
jne 0x40b205
test ebp, ebp
je 0x40b222
cmp esi, edi
je 0x40b337
push ebp
call fcn.00422881
add esp, 4
inc esi
cmp esi, 8
jl 0x40b1bf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
push 0x400
call fcn.00422856
mov ebp, eax
add esp, 4
mov ecx, ebp
mov eax, 0x448a10
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x448c10
jl 0x40b256
push 0x13
push 0xa
push ebp
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
push edx
mov dword [ebx + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.00422881
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push 0x13
push 0xa
push ebp
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a600
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebx + 0x6c], ecx
call fcn.00422881
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc