Function at 0x4031f2
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get disk information
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x3e8]
mov esi, 0x48c080
push ebx
lea ebx, [ebp - 0x5a0]
push ecx
sub esp, 0x638
mov eax, dword [ecx]
mov ecx, 0x11
mov dword [ebp - 0x4d0], str.USBSTOR
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x490]
xor esi, esi
mov dword [ebp - 0x4cc], str.RTSUER
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x4c8], str.CMIUCR
mov dword [ebp - 0x4c4], str.EUCR
mov dword [ebp - 0x4c0], str.UASPSTOR
mov dword [ebp - 0x4bc], str.VUSBSTOR
mov dword [ebp - 0x4b8], str.ETRONSTOR
mov eax, ecx
mov ecx, 8
mov dword [ebp - 0x4b4], str.ASUSSTPT
mov dword [ebp - 0x4b0], str._SD_
mov dword [ebp - 0x4ac], str._SDHC_
mov dword [ebp - 0x4a8], str._SDXC_
mov dword [ebp - 0x4a4], str._MMC_
mov dword [ebp - 0x4a0], str._MS_
mov dword [ebp - 0x49c], str._MSPro_
mov dword [ebp - 0x498], str._xDPicture_
mov dword [ebp - 0x494], str._O2Media_
mov dword [ebp - 0x574], 0x4956f8
mov dword [ebp - 0x570], str.USB_1.0
mov dword [ebp - 0x56c], str.USB_1.1
mov dword [ebp - 0x568], str.USB_2.0
mov dword [ebp - 0x564], str.USB_3.0
movups xmm0, xmmword [0x496200]
rep stosd dword es:[edi], eax
movups xmm1, xmmword [0x496210]
lea edi, [ebp - 0x470]
mov ecx, 8
rep stosd dword es:[edi], eax
xor edi, edi
movups xmmword [ebp - 0x55a], xmm0
mov dword [ebp - 0x560], str.USB_3.1
movups xmmword [ebp - 0x550], xmm1
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x5a8], esi
mov dword [ebp - 0x5a4], esi
mov dword [ebp - 0x5b2], 0x3a3f2820
mov word [ebp - 0x5ae], 0x29
mov dword [ebp - 0x5b6], 0x5c3a3f
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x14b
mov eax, dword [0x526d20]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
call fcn.0040317f
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
call fcn.0043d61c
mov dword [esp + 8], 1
mov dword [esp + 4], 0x495638
mov dword [esp], ebx
call fcn.0043d662
mov dword [esp], 0x104
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x5dc], eax
test eax, eax
je 0x405724
xor ebx, ebx
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], 0x4961e0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
sub esp, 0x10
mov edi, eax
cmp eax, 0xffffffff
je 0x4036e4
lea eax, [ebp - 0x5ac]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call fcn.0043c6e4
test eax, eax
jne 0x40342e
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
push ecx
jmp 0x4036e4
mov dword [ebp - 0x508], 0x1c
xor edx, edx
mov dword [ebp - 0x5e4], edx
lea eax, [ebp - 0x508]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
test eax, eax
je 0x40341f
inc dword [ebp - 0x5e4]
cmp dword [0x526ca4], 0
je 0x403489
mov eax, dword [ebp - 0x5e4]
mov dword [esp], str.Processing_Hub__d:
mov dword [esp + 4], eax
call fcn.0043efa9
xor eax, eax
lea ebx, [ebp - 0x4ec]
mov dword [ebp - 0x4ec], 0x1c
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x4961e0
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
sub esp, 0x14
test eax, eax
je 0x403440
xor eax, eax
mov dword [esp + 4], ebx
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], edi
call esi
sub esp, 0x18
test eax, eax
jne 0x403440
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x403440
mov edx, dword [ebp - 0x5cc]
mov dword [esp + 4], edx
mov dword [ebp - 0x5e8], edx
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x5e0], eax
test eax, eax
je 0x403440
mov dword [eax], 5
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x5e8]
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x5e0]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], edi
call esi
sub esp, 0x18
test eax, eax
jne 0x403583
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x403440
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x4f4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Child]
sub esp, 0xc
test eax, eax
jne 0x403570
mov eax, dword [ebp - 0x5dc]
mov byte [eax], 0
mov eax, dword [ebp - 0x5e0]
mov dword [esp + 8], 1
lea esi, [eax + 4]
lea eax, [ebp - 0x5a0]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0043d662
cmp dword [0x526ca4], 0
mov ebx, eax
je 0x4035f4
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.__Hub__d____s
call fcn.0043efa9
test ebx, ebx
js 0x403570
xor esi, esi
mov dword [esp + 8], 0x104
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0x5dc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
sub esp, 0x10
test eax, eax
jne 0x403570
mov eax, dword [ebp - 0x5dc]
call fcn.004024ec
lea eax, [ebp - 0x5ac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5dc]
mov dword [esp], eax
call fcn.0043c7c7
test eax, eax
je 0x403661
imul edx, eax, 0xc
add edx, dword [ebp - 0x5ac]
mov dword [edx + 8], ebx
cmp dword [0x526ca4], 0
je 0x403684
mov ecx, dword [ebp - 0x5dc]
mov dword [esp + 4], eax
mov dword [esp], str.__Found_ID__03d_:__s
mov dword [esp + 8], ecx
call fcn.0043efa9
xor edx, edx
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x5d0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
sub esp, 0xc
test eax, eax
jne 0x403570
mov eax, dword [ebp - 0x5dc]
xor ecx, ecx
mov byte [eax], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
sub esp, 0x10
test eax, eax
jne 0x403684
jmp 0x40362e
mov eax, dword [ebp - 0x5dc]
lea esi, [ebp - 0x490]
xor ebx, ebx
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
mov dword [ebp - 0x5f0], 8
mov dword [ebp - 0x5e0], eax
mov edi, dword [ebp + ebx*4 - 0x4d0]
mov dword [esp + 4], str.UASPSTOR
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, dword [ebp - 0x5f0]
cmove eax, ebx
mov dword [ebp - 0x5f0], eax
mov dword [esp + 8], 0x102
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_List_SizeA]
sub esp, 0xc
test eax, eax
je 0x403754
xor eax, eax
mov dword [esi], eax
mov eax, dword [esi]
test eax, eax
je 0x40376a
mov ecx, dword [ebp - 0x5e0]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x5e0], eax
inc ebx
add esi, 4
cmp ebx, 8
jne 0x40370c
mov dword [ebp - 0x604], 0x11
xor ebx, ebx
mov dword [esp + 4], 0x49575d
mov eax, dword [ebp + ebx*4 - 0x3e8]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
mov eax, dword [ebp - 0x604]
cmove eax, ebx
inc ebx
mov dword [ebp - 0x604], eax
cmp ebx, 0x11
jne 0x40377f
xor eax, eax
mov dword [ebp - 0x5dc], eax
inc dword [ebp - 0x5dc]
mov eax, dword [ebp - 0x5dc]
lea edx, [ebp - 0x430]
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.IgnoreUsb_02d
mov dword [esp + 4], 0x20
call dword [sym.imp.msvcrt.dll__snprintf]
mov eax, dword [0x525a6c]
mov byte [ebp - 0x411], 0
lea edx, [ebp - 0x430]
test eax, eax
je 0x40383b
mov dword [esp + 8], 1
xor ebx, ebx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00427fbf
mov esi, eax
test eax, eax
je 0x4039fe
xor eax, eax
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call sub.msvcrt.dll_strtol
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_free
jmp 0x4039fe
lea edi, [ebp - 0x11c]
mov ecx, 0x41
mov dword [ebp - 0x324], 0xffffffff
rep stosd dword es:[edi], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x524], edi
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x540], eax
mov dword [esp], edx
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x430]
mov ecx, eax
mov ebx, eax
mov esi, edx
test ebx, ebx
je 0x4038fc
cmp byte [edx + ebx], 0x5c
je 0x403893
dec ebx
jmp 0x403886
inc ecx
lea edi, [ebp - 0x11c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], edx
xor esi, esi
call sub.msvcrt.dll_strlen
mov byte [ebp + eax - 0x11c], 0
lea eax, [ebp - 0x410]
mov byte [ebp + ebx - 0x11c], 0
inc ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40398f
xor ebx, ebx
mov dword [ebp - 0x410], ebx
jmp 0x4039d0
lea eax, [ebp - 0x524]
xor ecx, ecx
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x49576e
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40393d
xor edx, edx
mov dword [ebp - 0x524], edx
jmp 0x4039d0
lea eax, [ebp - 0x3a4]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x410]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x495777
mov eax, dword [ebp - 0x524]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x4038ef
lea eax, [ebp - 0x220]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x540]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x324]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp + ebx - 0x430]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x410]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x4039e4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x4039f8
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov ebx, dword [ebp - 0x540]
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x454], ebx
cmp eax, 8
jne 0x4037b5
mov eax, dword [ebp - 0x5f0]
dec eax
cmp eax, 6
jbe 0x403a39
mov dword [esp + 8], 0x24a
mov dword [esp + 4], str.dev.c
mov dword [esp], str._uasp_start___0____uasp_start___ARRAYSIZE_usbstor_name__
jmp 0x403a5c
mov eax, dword [ebp - 0x604]
dec eax
cmp eax, 0xf
jbe 0x403a62
mov dword [esp + 8], 0x24b
mov dword [esp + 4], str.dev.c
mov dword [esp], str._card_start___0____card_start___ARRAYSIZE_genstor_name__
call dword [0x494088]
cmp dword [ebp - 0x5e0], 0
je 0x403b6c
mov eax, dword [ebp - 0x5e0]
xor edi, edi
xor ebx, ebx
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x5dc], eax
test eax, eax
jne 0x403add
mov dword [esp], str.Could_not_allocate_Device_ID_list
call fcn.0043efa9
jmp 0x40572f
mov ecx, dword [ebp - 0x5dc]
mov edx, dword [ebp + edi*4 - 0x4d0]
mov dword [esp + 0xc], 0x102
mov dword [esp + 8], eax
lea esi, [ecx + ebx]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [ebp - 0x5e0], edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ListA]
sub esp, 0x10
test eax, eax
je 0x403af2
inc edi
cmp edi, 8
je 0x403b74
mov eax, dword [ebp + edi*4 - 0x490]
mov dword [ebp + edi*4 - 0x470], ebx
cmp eax, 1
jbe 0x403ad3
jmp 0x403a9d
cmp dword [0x526ca4], 0
mov edx, dword [ebp - 0x5e0]
jne 0x403b0a
add ebx, dword [ebp + edi*4 - 0x490]
jmp 0x403b4f
mov dword [esp + 4], edx
mov dword [esp], str.Processing_IDs_belonging_to__s:
call fcn.0043efa9
cmp byte [esi], 0
je 0x403b01
mov dword [esp + 4], esi
mov dword [esp], str.___s
call fcn.0043efa9
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea esi, [esi + eax + 1]
jmp 0x403b1a
mov ecx, dword [ebp - 0x5dc]
lea eax, [ebx - 1]
cmp byte [ecx + ebx - 2], 0
jne 0x403b59
mov ebx, eax
cmp ebx, 2
ja 0x403b3d
jmp 0x403ad3
cmp byte [ecx + ebx - 1], 0
jne 0x403b4d
cmp byte [ecx + eax + 1], 0
jne 0x403b4d
jmp 0x403ad3
xor edi, edi
mov dword [ebp - 0x5dc], edi
xor esi, esi
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp], 0x4c50fc
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0x5e4], eax
sub esp, 0x10
inc eax
jne 0x403bb9
call fcn.0043f53d
mov dword [esp], str.SetupDiGetClassDevs__Interface__failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x405724
mov dword [ebp - 0x508], 0x1c
xor ebx, ebx
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x60c], ebx
lea ebx, [ebp - 0x508]
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x60c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
sub esp, 0xc
test eax, eax
je 0x40545d
lea edx, [ebp - 0x324]
xor eax, eax
mov ecx, 0x41
mov edi, edx
lea esi, [ebp - 0x524]
rep stosd dword es:[edi], eax
mov ecx, 7
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 4], ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x16
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
jne 0x403c7e
call fcn.0043f53d
mov dword [esp], str.SetupDiGetDeviceRegistryProperty__Enumerator_Name__failed:__s
mov dword [esp + 4], eax
jmp 0x404b20
inc ebx
cmp ebx, 8
je 0x403cb5
lea eax, [ebp - 0x324]
mov dword [esp + 4], str.USBSTOR
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x403c78
mov byte [ebp - 0x510], 1
test ebx, ebx
je 0x403cb5
mov eax, dword [ebp - 0x5f0]
cmp ebx, eax
jae 0x403cb5
mov byte [ebp - 0x50e], 1
xor ebx, ebx
mov eax, dword [ebp + ebx*4 - 0x3e8]
test eax, eax
jne 0x403cc7
mov eax, 0x4953d7
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x403cf8
mov eax, dword [ebp - 0x604]
mov byte [ebp - 0x50f], 1
cmp ebx, eax
jb 0x403cfe
mov byte [ebp - 0x50e], 1
jmp 0x403cfe
inc ebx
cmp ebx, 0x11
jne 0x403cb7
cmp dword [0x526ca4], 0
je 0x403d1d
lea eax, [ebp - 0x324]
mov dword [esp], str.Processing__s_device:
mov dword [esp + 4], eax
call fcn.0043efa9
cmp word [ebp - 0x510], 0
jne 0x403d47
cmp dword [0x526ca4], 0
je 0x403d3c
mov dword [esp], str.__Unsupported_or_disabled_by_policy
call fcn.0043efa9
inc dword [ebp - 0x60c]
jmp 0x403bd1
lea ebx, [ebp - 0x324]
xor eax, eax
mov ecx, 0x41
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0x104
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
je 0x403e02
cmp dword [0x526cac], 1
mov dword [ebp - 0x410], str.Arsenal_________Virtual_
mov dword [ebp - 0x40c], str.KernSafeVirtual_________
sbb edi, edi
xor esi, esi
mov dword [ebp - 0x408], str.Msft____Virtual_Disk____
add edi, 4
mov dword [ebp - 0x404], str.VMware__VMware_Virtual_S
mov eax, dword [ebp + esi*4 - 0x410]
test eax, eax
jne 0x403de6
mov eax, 0x4953d7
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x403dfd
inc esi
cmp esi, edi
jne 0x403dd6
jmp 0x403e02
mov eax, 1
cmp byte [ebp - 0x50e], 0
mov byte [ebp - 0x50c], al
jne 0x403f1c
lea eax, [ebp - 0x324]
mov dword [esp + 8], 3
mov dword [esp + 4], str.SCSIDisk
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x403f1c
xor ecx, ecx
mov dword [ebp - 0x5e0], ecx
mov eax, dword [ebp - 0x5e0]
mov ecx, 1
mov ebx, dword [ebp + eax*4 - 0x4b0]
test ebx, ebx
je 0x403e6f
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea ecx, [eax + 1]
mov eax, 0x10
cmp ecx, eax
cmova ecx, eax
mov esi, ebx
lea edi, [ebp - 0x594]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], ebx
lea ebx, [ebp - 0x324]
call sub.msvcrt.dll_strlen
lea edx, [eax + 1]
cmp edx, 0x10
mov edx, 0xf
cmovae eax, edx
mov byte [ebp + eax - 0x594], 0
lea eax, [ebp - 0x594]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x403ebc
mov byte [ebp - 0x50e], 1
jmp 0x403f1c
lea eax, [ebp - 0x594]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 1
ja 0x403eeb
mov dword [esp + 8], 0x2a2
mov dword [esp + 4], str.dev.c
mov dword [esp], str.strlen_scsi_card_name_copy____1
jmp 0x403a5c
mov byte [ebp + eax - 0x595], 0x26
lea eax, [ebp - 0x594]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x403eb3
inc dword [ebp - 0x5e0]
cmp dword [ebp - 0x5e0], 8
jne 0x403e44
cmp dword [0x526ca4], 0
je 0x403f3b
lea eax, [ebp - 0x324]
mov dword [esp], str.__Hardware_ID:__s
mov dword [esp + 4], eax
call fcn.0043efa9
lea eax, [ebp - 0x5cc]
lea ebx, [ebp - 0x11c]
mov dword [esp + 0xc], 0x104
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x508]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
sub esp, 0x14
test eax, eax
jne 0x403f9c
call fcn.0043f53d
mov dword [esp], str.SetupDiGetDeviceInstanceId_failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [esp + 4], str._N_A_
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
lea edx, [ebp - 0x324]
xor eax, eax
mov ecx, 0x41
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x5c8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0x104
mov dword [esp + 8], 0x1f
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
sub esp, 0x1c
test eax, eax
je 0x404007
mov eax, dword [ebp - 0x324]
sub eax, 2
cmp eax, 1
setbe al
movzx eax, al
lea edx, [ebp - 0x324]
mov byte [ebp - 0x50b], al
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5cc]
mov dword [esp], edx
lea ecx, [ebp - 0x5c8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e4]
lea edx, [ebp - 0x508]
call fcn.00402631
test eax, eax
jne 0x404143
call fcn.0043f53d
mov dword [esp], str.SetupDiGetDeviceRegistryProperty__Friendly_Name__failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [esp], 0xbe5
call fcn.0042291e
test eax, eax
jne 0x40409d
mov dword [esp], 0xbe5
call fcn.0042291e
mov ecx, 1
test eax, eax
je 0x4040be
mov dword [esp], 0xbe5
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ecx, [eax + 1]
jmp 0x4040be
mov dword [esp], 0xbe5
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, 0x104
inc eax
cmp eax, 0x103
jbe 0x40406f
mov dword [ebp - 0x5e0], ecx
mov dword [esp], 0xbe5
call fcn.0042291e
lea edx, [ebp - 0x324]
mov ecx, dword [ebp - 0x5e0]
mov esi, eax
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0xbe5
call fcn.0042291e
test eax, eax
jne 0x404118
mov dword [esp], 0xbe5
call fcn.0042291e
test eax, eax
je 0x404139
mov dword [esp], 0xbe5
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
jmp 0x404139
mov dword [esp], 0xbe5
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, 0x103
jbe 0x4040f2
mov eax, 0x103
mov byte [ebp + eax - 0x324], 0
jmp 0x404159
cmp byte [ebp - 0x50c], 0
jne 0x404159
cmp dword [ebp - 0x5dc], 0
jne 0x40428f
xor edx, edx
mov dword [ebp - 0x5f4], edx
jmp 0x404280
cmp ebx, eax
jae 0x40419c
mov al, byte [esi + ebx]
inc ebx
cmp al, 0x5c
je 0x404450
cmp dword [ebp - 0x5e0], 0
jne 0x404406
mov dword [ebp - 0x5ec], edx
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x5ec]
cmp edx, 2
jne 0x404166
cmp dword [ebp - 0x524], 0
mov edx, str._ID_
mov eax, 0x495638
cmovne eax, edx
mov dword [ebp - 0x5ec], eax
imul eax, edi, 0xc
add eax, dword [ebp - 0x5ac]
cmp dword [eax + 8], 0
je 0x404469
imul eax, edi, 0xc
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x5ac]
mov edi, dword [ebp - 0x5f4]
mov eax, dword [eax + edi + 8]
test eax, eax
je 0x4047cd
cmp dword [0x526ca4], 0
je 0x404210
mov edx, dword [ebp - 0x5a0]
mov edx, dword [edx + eax*4]
mov dword [esp + 4], eax
mov dword [esp], str.__Matched_with_Hub__d_:__s
mov dword [esp + 8], edx
call fcn.0043efa9
mov eax, dword [ebp - 0x5ac]
mov edi, dword [ebp - 0x5f4]
mov edx, dword [eax + edi + 8]
mov eax, dword [ebp - 0x5a0]
mov edi, dword [eax + edx*4]
test edi, edi
jne 0x404512
mov dword [ebp - 0x5e0], 0xffffffff
xor ebx, ebx
mov eax, dword [ebp - 0x5e0]
dec eax
cmp eax, 0xfffffffd
ja 0x404259
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
test ebx, ebx
je 0x4047cd
mov eax, dword [ebp - 0x5ac]
mov edi, dword [ebp - 0x5f4]
mov edx, dword [eax + edi + 8]
mov eax, dword [ebp - 0x5a0]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5ec], 0x495638
jmp 0x4047d5
mov esi, dword [ebp - 0x5dc]
cmp byte [esi], 0
je 0x404159
xor eax, eax
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x5d8]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
sub esp, 0xc
test eax, eax
je 0x4042d8
cmp dword [0x526ca4], 0
je 0x4047bc
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_locate_device_node_for__s
jmp 0x404318
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Child]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x404322
cmp dword [0x526ca4], 0
je 0x4047bc
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_get_children_of__s
call fcn.0043efa9
jmp 0x4047bc
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x4f4], eax
jne 0x40439b
mov edi, dword [ebp - 0x5f0]
lea edx, [esi + 2]
mov eax, dword [ebp - 0x5dc]
add eax, dword [ebp + edi*4 - 0x470]
cmp edx, eax
mov eax, esi
setae byte [ebp - 0x50d]
call fcn.004024ec
lea eax, [ebp - 0x5ac]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0043c7c7
cmp dword [0x526ca4], 0
mov edi, eax
je 0x4043f7
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.__Matched_with_ID__03d_:__s
call fcn.0043efa9
jmp 0x4043f7
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x4f4], eax
je 0x4043c3
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5d0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d0]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Sibling]
sub esp, 0xc
test eax, eax
je 0x40438d
jmp 0x4043e0
cmp dword [0x526ca4], 0
je 0x404330
mov dword [esp + 4], esi
mov dword [esp], str.NOTE:_Matched_instance_from_sibling_for__s
call fcn.0043efa9
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x4f4], eax
jne 0x4047bc
jmp 0x404330
xor eax, eax
xor edx, edx
mov dword [ebp - 0x5e0], eax
jmp 0x404183
cmp al, 0x5f
jne 0x404183
xor eax, eax
mov dword [ebp - 0x5ec], edx
mov dword [esp + 4], eax
lea eax, [esi + ebx]
mov dword [esp + 8], 0x10
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov edx, dword [ebp - 0x5ec]
movzx eax, ax
mov dword [ebp - 0x520], eax
test edx, edx
jne 0x40445f
mov dword [ebp - 0x524], eax
mov edx, 1
jmp 0x404183
mov dword [ebp - 0x5e0], 1
jmp 0x404183
mov edx, 2
jmp 0x404183
xor ebx, ebx
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x5d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5d4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
sub esp, 0xc
test eax, eax
jne 0x4041c9
xor ecx, ecx
lea ebx, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 0xc], ecx
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x5d4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDA]
sub esp, 0x10
test eax, eax
jne 0x4041c9
mov eax, ebx
call fcn.004024ec
lea eax, [ebp - 0x5ac]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0043c7c7
cmp dword [0x526ca4], 0
mov edi, eax
je 0x4044fd
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], str.__Matched_with__GP__ID__03d_:__s
call fcn.0043efa9
mov dword [ebp - 0x5ec], str._GP_
lea esi, [ebp - 0x220]
jmp 0x4041c9
xor edx, edx
lea eax, [ebp - 0x5bc]
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
sub esp, 0xc
test eax, eax
je 0x40454b
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_get_device_instance_handle_for__s:_CR_error__d
call fcn.0043efa9
jmp 0x404231
xor eax, eax
lea ebx, [ebp - 0x5c0]
mov dword [ebp - 0x5c0], 4
mov dword [ebp - 0x514], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x514]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1d
mov eax, dword [ebp - 0x5bc]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Registry_PropertyA]
sub esp, 0x18
test eax, eax
je 0x4045ac
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_get_port_for__s:_CR_error__d
jmp 0x404541
xor eax, eax
mov dword [esp + 0x14], 0x40000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x5e0], eax
sub esp, 0x1c
inc eax
jne 0x404606
call fcn.0043f53d
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_open_hub__s:__s
jmp 0x404541
xor eax, eax
mov ecx, 0x1f
lea edi, [ebp - 0x40c]
mov dword [ebp - 0x5c0], 0x23
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x514]
lea edx, [ebp - 0x410]
xor edi, edi
mov dword [ebp - 0x410], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 0x23
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x23
mov dword [esp + 8], edx
mov dword [esp + 4], 0x220448
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x40468c
call fcn.0043f53d
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_node_connection_information_for__s:__s
jmp 0x40475c
mov edx, dword [ebp - 0x404]
mov ax, word [ebp - 0x402]
xor ebx, ebx
mov edi, edx
or di, ax
je 0x4046c7
movzx eax, ax
movzx edx, dx
mov ebx, 1
mov dword [ebp - 0x520], eax
movzx eax, byte [ebp - 0x3f9]
mov dword [ebp - 0x524], edx
inc eax
mov dword [ebp - 0x51c], eax
xor edx, edx
lea eax, [ebp - 0x584]
xor ecx, ecx
mov dword [ebp - 0x5c0], 0x10
mov dword [ebp - 0x57c], edx
mov dword [ebp - 0x578], edx
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x580], 0x10
mov dword [ebp - 0x584], edx
lea edx, [ebp - 0x5c0]
mov byte [ebp - 0x57c], 4
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], 0x22045c
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
jne 0x404766
call fcn.0043f53d
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.Could_not_get_node_connection_information__V2__for_device__s:__s
call fcn.0043efa9
jmp 0x40423d
mov al, byte [ebp - 0x578]
test al, 4
je 0x40477f
mov dword [ebp - 0x51c], 5
jmp 0x40423d
test al, 1
je 0x404792
mov dword [ebp - 0x51c], 4
jmp 0x40423d
test al, 8
je 0x4047a5
mov dword [ebp - 0x518], 2
jmp 0x40423d
test al, 2
je 0x40423d
mov dword [ebp - 0x518], 1
jmp 0x40423d
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea esi, [esi + eax + 1]
jmp 0x404295
xor eax, eax
mov dword [ebp - 0x5f4], eax
cmp byte [ebp - 0x50d], 0
je 0x40484b
movups xmm2, xmmword [str.SCSI_Disk_DeviceRufus]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x580], 0x69766544
mov byte [ebp - 0x400], 0
mov dword [ebp - 0x584], 0x20534155
mov dword [ebp - 0x57d], 0x656369
movups xmmword [ebp - 0x410], xmm2
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x40484b
cmp byte [eax + 0x11], 0
jne 0x40484b
mov ecx, dword [ebp - 0x584]
mov ebx, dword [ebp - 0x580]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 7], 0x656369
cmp byte [ebp - 0x50c], 0
je 0x40486a
lea eax, [ebp - 0x324]
mov dword [esp], str.Found_VHD_device__s
mov dword [esp + 4], eax
jmp 0x404a9c
cmp byte [ebp - 0x50e], 0
je 0x4048a0
cmp byte [ebp - 0x510], 0
je 0x40488a
mov eax, dword [ebp - 0x524]
or eax, dword [ebp - 0x520]
jne 0x4048a0
lea eax, [ebp - 0x324]
mov dword [esp], str.Found_card_reader_device__s
mov dword [esp + 4], eax
jmp 0x404a9c
test dword [ebp - 0x510], 0xff0000ff
jne 0x4048f9
cmp byte [ebp - 0x50b], 0
je 0x4048f9
cmp dword [0x526c8c], 0
lea eax, [ebp - 0x324]
mov dword [esp + 4], eax
jne 0x4048ed
mov dword [esp], str.Found_non_USB_removable_device__s___Eliminated
call fcn.0043efa9
cmp dword [0x526ca4], 0
je 0x403d3c
mov dword [esp], str.If_you_REALLY_need__you_can_enable_listing_of_this_device_with__Ctrl__Alt__F_
jmp 0x403d37
mov dword [esp], str.Found_non_USB_removable_device__s
jmp 0x404a9c
mov eax, dword [ebp - 0x524]
mov edx, dword [ebp - 0x520]
mov ecx, eax
or ecx, edx
jne 0x404959
cmp byte [ebp - 0x510], 0
jne 0x404937
cmp dword [0x526ca4], 0
je 0x403d3c
lea eax, [ebp - 0x324]
mov dword [esp], str.Found_non_USB_non_removable_device__s___Eliminated
mov dword [esp + 4], eax
jmp 0x404b20
mov dword [ebp - 0x220], 0x3f3f3f3f
mov dword [ebp - 0x21c], 0x3f3f3f3a
mov word [ebp - 0x218], 0x3f
jmp 0x404a14
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0x10], edx
mov dword [esp + 8], str._04X:_04X
mov dword [esp + 4], 0x104
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
cmp dword [0x526ccc], 0
mov byte [ebp - 0x11d], 0
mov edx, dword [ebp - 0x524]
mov ecx, dword [ebp - 0x520]
je 0x4049d0
cmp edx, 0x525
jne 0x4049ac
cmp ecx, 0x622b
jmp 0x4049ca
cmp edx, 0x781
jne 0x4049bc
cmp ecx, 0x75a0
jmp 0x4049ca
cmp edx, 0x10d6
jne 0x4049d0
cmp ecx, 0x1101
je 0x403d3c
xor eax, eax
mov ebx, dword [ebp + eax*4 - 0x450]
mov esi, ebx
shr esi, 0x10
cmp edx, esi
jne 0x404a0e
movzx ebx, bx
cmp ecx, ebx
jne 0x404a0e
lea eax, [ebp - 0x220]
mov dword [esp], str.Ignoring__s___s___per_user_settings
mov dword [esp + 8], eax
lea eax, [ebp - 0x324]
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x403d3c
inc eax
cmp eax, 8
jne 0x4049d2
cmp dword [ebp - 0x51c], 5
jbe 0x404a25
xor eax, eax
mov dword [ebp - 0x51c], eax
mov ecx, dword [ebp - 0x51c]
mov eax, 0x495638
mov ebx, str.UAS__
cmp byte [ebp - 0x50d], 0
mov edx, 0x495643
mov edi, dword [ebp - 0x5ec]
mov ecx, dword [ebp + ecx*4 - 0x574]
cmove edx, eax
cmovne eax, ebx
lea ebx, [ebp - 0x220]
mov dword [esp + 0x14], ebx
lea ebx, [ebp - 0x324]
mov dword [esp + 4], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], str.Found__s_s_s_device__s___s___s
call fcn.0043efa9
mov eax, dword [ebp - 0x518]
test eax, eax
je 0x404aa1
add eax, 0x2f
mov dword [esp], str.NOTE:_This_device_is_a_USB_3._c_device_operating_at_lower_speed...
mov dword [esp + 4], eax
call fcn.0043efa9
mov dword [ebp - 0x4ec], 0x1c
xor eax, eax
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e0]
lea ebx, [ebp - 0x4ec]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x608]
mov dword [esp + 8], 0x4c50fc
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x508]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
sub esp, 0x14
test eax, eax
jne 0x404b36
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x103
je 0x404b2a
call fcn.0043f53d
mov dword [esp], str.SetupDiEnumDeviceInterfaces_failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x403d3c
mov dword [esp], str.A_device_was_eliminated_because_it_didnt_report_itself_as_a_disk
jmp 0x403d37
xor eax, eax
xor esi, esi
lea edi, [ebp - 0x5cc]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], esi
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call esi
mov dword [ebp - 0x5ec], eax
sub esp, 0x18
test eax, eax
jne 0x404c2a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x404c08
mov edx, dword [ebp - 0x5cc]
mov dword [esp + 4], edx
mov dword [ebp - 0x5f8], edx
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov edx, dword [ebp - 0x5f8]
test eax, eax
mov dword [ebp - 0x5e0], eax
jne 0x404bba
mov dword [esp], str.Unable_to_allocate_data_for_SP_DEVICE_INTERFACE_DETAIL_DATA
jmp 0x404c31
mov eax, dword [ebp - 0x5e0]
xor ecx, ecx
mov dword [eax], 5
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x5e4]
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x404c38
call fcn.0043f53d
mov dword [esp], str.SetupDiGetDeviceInterfaceDetail__actual__failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x405452
call fcn.0043f53d
mov dword [esp], str.SetupDiGetDeviceInterfaceDetail__dummy__failed:__s
mov dword [esp + 4], eax
call fcn.0043efa9
xor eax, eax
mov dword [ebp - 0x5e0], eax
jmp 0x405452
mov dword [esp], str.SetupDiGetDeviceInterfaceDetail__dummy____no_data_was_allocated
call fcn.0043efa9
jmp 0x404c1d
mov eax, dword [ebp - 0x5e0]
xor edi, edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], edi
lea ebx, [eax + 4]
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
jne 0x404c9e
call fcn.0043f53d
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 0x495dd6
call fcn.0043efa9
jmp 0x405452
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00409fd4
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
test ebx, ebx
js 0x405452
lea eax, [ebx + 0x80]
mov dword [ebp - 0x5f8], eax
mov dword [esp], eax
call fcn.0040ad24
test eax, eax
jne 0x404ce2
mov dword [esp], str.Device_eliminated_because_it_appears_to_contain_no_media
jmp 0x404ef8
mov eax, dword [ebp - 0x5f8]
mov dword [esp], eax
call fcn.0040ac7b
mov dword [ebp - 0x5fc], eax
mov ecx, dword [ebp - 0x5fc]
mov eax, 0x7fffff
mov dword [ebp - 0x600], edx
cmp eax, ecx
mov eax, dword [ebp - 0x5ec]
sbb eax, edx
jb 0x404d2c
mov dword [esp + 4], 8
mov dword [esp], str.Device_eliminated_because_it_is_smaller_than__d_MB
call fcn.0043efa9
jmp 0x4052bd
lea eax, [ebp - 0x5c4]
xor ecx, ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0x540]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5f8]
mov dword [esp], eax
call fcn.0040a898
test eax, eax
je 0x405452
cmp byte [ebp - 0x50f], 0
mov al, byte [ebp - 0x50c]
je 0x404dc4
or al, byte [ebp - 0x50d]
jne 0x404dc4
cmp byte [ebp - 0x50b], 0
je 0x4052bd
cmp dword [0x526c8c], 0
jne 0x404dc4
lea esi, [ebp - 0x540]
mov al, byte [esi]
test al, al
je 0x404db0
mov byte [ebp - 0x5b6], al
lea eax, [ebp - 0x5b6]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
push edx
cmp eax, 2
je 0x404dc1
cmp byte [esi], 0
je 0x404dc4
mov dword [esp], str.Device_eliminated_because_it_contains_a_mounted_partition_that_is_set_as_non_removable
jmp 0x404ef8
inc esi
jmp 0x404d8f
cmp dword [0x526cc8], 0
mov al, byte [ebp - 0x50c]
jne 0x404e94
or al, byte [ebp - 0x50e]
je 0x404e27
cmp byte [ebp - 0x50e], 0
je 0x404e94
mov ecx, dword [ebp - 0x5fc]
xor eax, eax
cmp eax, ecx
mov eax, 0x32
sbb eax, dword [ebp - 0x600]
jae 0x404e94
mov dword [esp + 4], 0xc8
mov dword [esp], str.Device_eliminated_because_it_was_detected_as_a_card_larger_than__d_GB
call fcn.0043efa9
mov dword [esp], str.To_use_such_a_card__check_List_USB_Hard_Drives_under_advanced_drive_properties
jmp 0x404ef8
lea eax, [ebp - 0x324]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x520]
mov dword [esp + 8], eax
movzx eax, word [ebp - 0x524]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5f8]
mov dword [esp], eax
call fcn.0043baf8
test eax, eax
jle 0x404e87
mov dword [esp + 4], eax
mov dword [esp], str.Device_eliminated_because_it_was_detected_as_a_Hard_Drive__score__d___0_
call fcn.0043efa9
cmp dword [0x526c8c], 0
jne 0x404e7e
mov dword [esp], str.If_this_device_is_not_a_Hard_Drive__please_e_mail_the_author_of_this_application
call fcn.0043efa9
mov dword [esp], str.NOTE:_You_can_enable_the_listing_of_Hard_Drives_under_advanced_drive_properties
jmp 0x404ef8
cmp dword [0x526cc8], 0
je 0x404ddf
cmp byte [ebp - 0x50c], 0
je 0x404eb8
mov eax, dword [ebp - 0x5f8]
mov dword [esp], eax
call fcn.0040e198
test eax, eax
je 0x404eb8
mov dword [esp], str.Device_eliminated_because_it_was_detected_as_a_Microsoft_Dev_Drive
jmp 0x404ef8
mov eax, dword [ebp - 0x5c4]
test eax, eax
je 0x404edf
mov dword [esp + 4], str.PortableBaseLayer
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x404edf
mov dword [esp], str.Device_eliminated_because_it_is_a_Windows_Sandbox_VHD
jmp 0x404ef8
cmp byte [ebp - 0x50c], 0
je 0x404f02
cmp dword [0x492a10], 0
jne 0x404f02
mov dword [esp], str.Device_eliminated_because_listing_of_VHDs_is_disabled__Alt_G_
call fcn.0043efa9
jmp 0x4052bd
cmp byte [ebp - 0x540], 0
jne 0x404f57
mov eax, dword [0x526ca0]
xor edi, edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5fc]
mov dword [esp], eax
mov eax, dword [ebp - 0x600]
mov dword [esp + 4], eax
call fcn.0043f9fb
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5c4]
mov dword [esp], 0xbe6
mov dword [esp + 4], eax
call fcn.0042291e
mov ebx, eax
jmp 0x405348
xor ebx, ebx
mov al, byte [ebp + ebx - 0x540]
test al, al
je 0x404f97
mov byte [ebp - 0x55a], al
lea eax, [ebp - 0x55a]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
test eax, eax
je 0x404f94
lea eax, [ebp + ebx - 0x540]
inc eax
cmp byte [eax - 1], 0
je 0x404f93
mov dl, byte [eax]
mov byte [eax - 1], dl
jmp 0x404f85
dec ebx
inc ebx
jmp 0x404f59
cmp byte [ebp - 0x540], 0
je 0x404fb9
cmp byte [ebp - 0x53f], 0
je 0x404fb9
mov dword [esp], 0xbe7
call fcn.0042291e
test eax, eax
jmp 0x404fc0
cmp dword [ebp - 0x5c4], 0
sete al
mov dl, byte [ebp - 0x540]
test al, al
jne 0x405001
test dl, dl
je 0x404fe8
cmp byte [ebp - 0x53f], 0
je 0x404fe8
mov dword [esp], 0xbe7
call fcn.0042291e
jmp 0x404fee
mov eax, dword [ebp - 0x5c4]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, pe_nt_image_headers32
inc eax
cmp eax, 0x7f
ja 0x405067
cmp byte [ebp - 0x540], 0
je 0x405023
cmp byte [ebp - 0x53f], 0
je 0x405023
mov dword [esp], 0xbe7
call fcn.0042291e
test eax, eax
jmp 0x40502a
cmp dword [ebp - 0x5c4], 0
sete al
mov ecx, 1
test al, al
jne 0x405067
cmp byte [ebp - 0x540], 0
je 0x405056
cmp byte [ebp - 0x53f], 0
je 0x405056
mov dword [esp], 0xbe7
call fcn.0042291e
jmp 0x40505c
mov eax, dword [ebp - 0x5c4]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ecx, [eax + 1]
cmp byte [ebp - 0x540], 0
je 0x405095
cmp byte [ebp - 0x53f], 0
je 0x405095
mov dword [ebp - 0x608], ecx
mov dword [esp], 0xbe7
call fcn.0042291e
mov ecx, dword [ebp - 0x608]
mov esi, eax
jmp 0x40509b
mov esi, dword [ebp - 0x5c4]
lea edx, [ebp - 0x3a4]
cmp byte [ebp - 0x540], 0
mov edi, edx
rep movsb byte es:[edi], byte [esi]
je 0x4050c7
cmp byte [ebp - 0x53f], 0
je 0x4050c7
mov dword [esp], 0xbe7
call fcn.0042291e
test eax, eax
jmp 0x4050ce
cmp dword [ebp - 0x5c4], 0
sete al
mov dl, byte [ebp - 0x540]
test al, al
jne 0x405111
test dl, dl
je 0x4050f6
cmp byte [ebp - 0x53f], 0
je 0x4050f6
mov dword [esp], 0xbe7
call fcn.0042291e
jmp 0x4050fc
mov eax, dword [ebp - 0x5c4]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [eax + 1]
mov eax, 0x7f
cmp edx, 0x7f
ja 0x405173
cmp byte [ebp - 0x540], 0
je 0x405133
cmp byte [ebp - 0x53f], 0
je 0x405133
mov dword [esp], 0xbe7
call fcn.0042291e
test eax, eax
jmp 0x40513a
cmp dword [ebp - 0x5c4], 0
setne al
test al, al
je 0x405728
cmp byte [ebp - 0x540], 0
je 0x405165
cmp byte [ebp - 0x53f], 0
je 0x405165
mov dword [esp], 0xbe7
call fcn.0042291e
jmp 0x40516b
mov eax, dword [ebp - 0x5c4]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov byte [ebp + eax - 0x3a4], 0
xor esi, esi
mov al, byte [ebp + esi - 0x540]
cmp dword [ebp - 0x5ec], 0
mov byte [ebp - 0x608], al
jne 0x405284
test al, al
je 0x40527b
mov al, byte [ebp - 0x608]
cmp dword [0x526cd4], 0
mov byte [ebp - 0x5b0], al
je 0x4051e9
lea ebx, [ebp - 0x3a4]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x495678
mov edx, eax
mov eax, 0x7f
mov dword [esp], ebx
sub eax, edx
mov edx, 4
cmp eax, edx
cmova eax, edx
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncat
lea edx, [ebp - 0x5b2]
lea edi, [ebp - 0x3a4]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov dword [esp], edi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x5b2]
mov dword [esp], edi
mov ecx, eax
lea eax, [ebx + 1]
mov ebx, 0x7f
mov dword [esp + 4], edx
sub ebx, ecx
cmp eax, ebx
cmova eax, ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncat
mov eax, 0x526a20
call fcn.004025ed
movsx edi, byte [ebp + esi - 0x540]
mov ebx, eax
mov eax, 0x526900
call fcn.004025ed
mov dword [ebp - 0x5ec], 2
add eax, 0x41
cmp edi, eax
je 0x405275
movsx eax, byte [ebp - 0x608]
add ebx, 0x41
cmp ebx, eax
sete al
movzx eax, al
mov dword [ebp - 0x5ec], eax
inc esi
jmp 0x40517d
cmp dword [ebp - 0x5ec], 0
je 0x4052d0
cmp dword [ebp - 0x5ec], 1
mov eax, str.disk_from_which_Rufus_is_running
mov ebx, str.system_disk
cmove ebx, eax
movsx eax, byte [ebp + esi - 0x541]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], str.Removing__c:_from_the_list:_This_is_the__s_
call fcn.0043efa9
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x403d3c
mov eax, dword [0x526ca0]
xor ecx, ecx
lea ebx, [ebp - 0x3a4]
mov esi, 0x495638
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5fc]
mov dword [esp], eax
mov eax, dword [ebp - 0x600]
mov dword [esp + 4], eax
call fcn.0043f9fb
cmp dword [0x526cd4], 0
mov dword [esp], ebx
mov edi, eax
mov eax, 0x495678
cmovne esi, eax
call sub.msvcrt.dll_strlen
mov edx, pe_nt_image_headers32
mov dword [esp + 0x10], edi
sub edx, eax
add eax, ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x49612b
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [ebp - 0x325], 0
imul edx, dword [ebp - 0x5e8], 0x28
mov eax, dword [ebp - 0x5f8]
mov esi, dword [sym.imp.msvcrt.dll__strdup]
mov dword [edx + 0x524fd4], eax
lea eax, [ebp - 0x11c]
lea edi, [edx + 0x524fc0]
mov dword [ebp - 0x5ec], edx
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x5ec]
mov dword [edx + 0x524fc0], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call esi
mov dword [edi + 4], eax
test ebx, ebx
je 0x40539d
mov dword [esp], ebx
call esi
mov ebx, eax
imul eax, dword [ebp - 0x5e8], 0x28
mov dword [eax + 0x524fc8], ebx
mov eax, dword [ebp - 0x5c4]
test eax, eax
je 0x4053bd
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
imul ebx, dword [ebp - 0x5e8], 0x28
mov dword [ebx + 0x524fcc], eax
mov eax, dword [ebp - 0x5fc]
mov dword [ebx + 0x524fe0], eax
mov eax, dword [ebp - 0x600]
mov dword [ebx + 0x524fe4], eax
add ebx, 0x524fc0
cmp dword [ebp - 0x5f4], 0
je 0x40540c
mov eax, dword [ebp - 0x5f4]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x514]
mov dword [ebx + 0x18], eax
inc dword [ebp - 0x5e8]
cmp dword [ebp - 0x5e8], 0x40
jne 0x40542f
mov dword [esp + 4], 0x40
mov dword [esp], str.Warning:_Found_more_than__d_drives___ignoring_remaining_ones...
call fcn.0043efa9
mov eax, dword [ebp - 0x5e0]
mov dword [esp], eax
call sub.msvcrt.dll_free
inc dword [ebp - 0x60c]
cmp dword [ebp - 0x5e8], 0x40
jne 0x403bd1
jmp 0x40545d
inc dword [ebp - 0x608]
jmp 0x404ab9
mov eax, dword [ebp - 0x5e4]
mov ebx, 0x524fc0
mov dword [esp], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
push edx
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp - 0x5e0], ebx
lea edi, [ecx - 1]
mov dword [ebp - 0x5f8], edi
cmp dword [ebp - 0x5f8], eax
jle 0x40556c
mov edi, dword [ebp - 0x5e0]
lea ecx, [eax + 1]
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x5f4], ecx
mov esi, dword [edi + 0x20]
mov edi, dword [edi + 0x24]
mov dword [ebp - 0x5f0], edi
mov edi, ecx
mov ecx, dword [ebp - 0x5e8]
cmp edi, ecx
je 0x405513
imul ecx, edi, 0x28
mov edx, dword [ecx + 0x524fe0]
mov ecx, dword [ecx + 0x524fe4]
mov dword [ebp - 0x5ec], edx
cmp edx, esi
mov edx, ecx
sbb edx, dword [ebp - 0x5f0]
cmovb esi, dword [ebp - 0x5ec]
cmovae ecx, dword [ebp - 0x5f0]
mov dword [ebp - 0x5ec], esi
mov esi, dword [ebp - 0x5e4]
mov dword [ebp - 0x5f0], ecx
cmovb esi, edi
inc edi
mov dword [ebp - 0x5e4], esi
mov esi, dword [ebp - 0x5ec]
jmp 0x4054b8
mov edi, dword [ebp - 0x5e4]
cmp eax, edi
je 0x40555a
imul eax, dword [ebp - 0x5e4], 0x28
mov esi, dword [ebp - 0x5e0]
lea edi, [ebp - 0x410]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x5e0]
mov ecx, 0xa
add eax, 0x524fc0
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x410]
mov ecx, 0xa
mov edi, eax
rep movsd dword es:[edi], dword [esi]
add dword [ebp - 0x5e0], 0x28
mov eax, dword [ebp - 0x5f4]
jmp 0x405489
xor eax, eax
xor edi, edi
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e8]
mov esi, dword [0x526d20]
cmp edi, eax
jge 0x405657
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebx + 8]
call fcn.00402523
mov dword [esp + 0xc], eax
mov dword [ebp - 0x5ec], eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x143
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 0x5ec]
test edx, edx
je 0x4055e5
mov dword [ebp - 0x5ec], eax
mov dword [esp], edx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x5ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
mov eax, dword [ebp - 0x5e4]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x151
mov eax, dword [0x526d20]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 8]
sub esp, 0x10
mov dword [esp + 4], eax
mov eax, dword [0x526d20]
mov dword [esp], eax
call fcn.00442a3c
mov ecx, dword [ebp - 0x5e0]
cmp eax, ecx
jl 0x40564e
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [0x526d20]
mov dword [esp], eax
call fcn.00442a3c
mov dword [ebp - 0x5e0], eax
inc edi
add ebx, 0x28
jmp 0x405576
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x5e0]
mov dword [esp], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x160
call esi
sub esp, 0x10
cmp dword [ebp - 0x610], 0x7f
ja 0x40568a
xor ebx, ebx
jmp 0x4056db
xor ebx, ebx
xor edi, edi
mov dword [esp + 4], 0x146
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov eax, dword [0x526d20]
mov dword [esp], eax
call esi
sub esp, 0x10
cmp ebx, eax
jae 0x405686
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x150
mov eax, dword [0x526d20]
mov dword [esp], eax
call esi
mov edi, dword [ebp - 0x610]
sub esp, 0x10
cmp eax, edi
je 0x4056db
inc ebx
jmp 0x40568c
xor ecx, ecx
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x14e
mov eax, dword [0x526d20]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [esp + 0xc], ebx
mov ebx, 1
mov dword [esp + 8], 0x103e9
mov dword [esp + 4], 0x111
mov eax, dword [0x526d5c]
mov dword [esp], eax
call esi
sub esp, 0x10
jmp 0x40572f
xor ebx, ebx
jmp 0x40572f
xor eax, eax
jmp 0x405173
mov dword [esp + 4], 0x3eb
mov eax, dword [0x526d5c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push edx
push edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov eax, dword [0x526d5c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x5dc]
sub esp, 0x10
mov dword [esp], eax
call sub.msvcrt.dll_free
lea eax, [ebp - 0x5a0]
mov dword [esp], eax
call fcn.0043d77d
lea eax, [ebp - 0x5ac]
mov dword [esp], eax
call fcn.0043c768
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret