Function at 0x79ed00
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Get disk information
Get disk information via ioctl
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x470
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x7a1682
mov dword [esp + 0xcc], 5
mov ebx, 0x10
mov al, 0x3f
mov dword [esp + 0x110], eax
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x80795c
call dword [0x818c28]
sub esp, 0x10
mov dword [esp + 0xb0], eax
cmp eax, 0xffffffff
mov byte [esp + 0xa7], al
mov byte [esp + 0x72], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x3f], cl
mov byte [esp + 0x47], al
mov byte [esp + 0xaf], al
mov byte [esp + 0x10f], al
mov byte [esp + 0x177], al
mov byte [esp + 0xe3], al
mov byte [esp + 0x11e], al
mov byte [esp + 0x12f], cl
mov byte [esp + 0x14f], cl
mov byte [esp + 0x13f], cl
mov byte [esp + 0x137], cl
mov dword [esp + 0x94], edx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xec], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x194], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x190], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x130], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x164], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x1e8], edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x8c], esi
mov dword [esp + 0x84], eax
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x184], eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x1ec], esi
mov dword [esp + 0x160], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x140], eax
mov byte [esp + 0x157], al
mov byte [esp + 0x147], al
mov byte [esp + 0x11d], al
mov byte [esp + 0xdb], al
mov byte [esp + 0x11f], al
mov byte [esp + 0x83], al
mov byte [esp + 0xeb], al
mov byte [esp + 0xbb], al
mov byte [esp + 0x1d2], al
mov byte [esp + 0x1d3], al
mov byte [esp + 0x1c7], al
mov byte [esp + 0x183], al
mov byte [esp + 0x73], al
mov byte [esp + 0xd3], al
mov dword [esp + 0x168], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x1cc], eax
jne 0x79fd01
mov dword [esp + 0x148], edi
mov dword [esp + 0x90], edx
mov dword [esp + 0x24], ecx
cmp ebx, 0x10
mov esi, dword [esp + 0x184]
je 0x7a1682
mov dword [esp + 0x138], 0
mov ebx, dword [esp + 0x148]
jmp 0x7a278a
mov edx, dword [esp + 0x194]
xor dl, 3
mov dword [esp + 0x110], edx
mov al, dl
add al, 0xfe
mov dword [esp + 0x18c], eax
mov cl, al
xor cl, dl
xor cl, 0x3a
mov byte [esp + 0x11d], cl
mov dl, cl
add dl, al
xor dl, 0x41
mov byte [esp + 0x147], dl
mov dh, dl
add dh, 0x92
mov byte [esp + 0x157], dh
add dl, 0xd2
mov byte [esp + 0x137], dl
mov cl, dl
xor cl, dh
mov al, cl
add al, 0x1f
mov byte [esp + 0x13f], al
add cl, 2
mov byte [esp + 0x11f], cl
add cl, al
xor cl, 0xc4
mov byte [esp + 0x14f], cl
mov dh, cl
add dh, 0xaa
mov byte [esp + 0x12f], dh
add cl, 0xf9
mov dword [esp + 0x1d8], ecx
mov al, cl
xor al, 0x39
mov byte [esp + 0x11e], al
mov cl, al
add cl, 0xb5
mov dword [esp + 0x158], ecx
mov cl, al
add cl, 0xde
mov byte [esp + 0xe3], cl
xor cl, 0x73
mov al, cl
add al, 0x10
mov byte [esp + 0x10f], al
mov al, cl
add al, 0xf7
mov dword [esp + 0x100], eax
add cl, 0x2b
mov dl, cl
xor dl, 0x49
mov dword [esp + 0x108], edx
mov bl, dl
add bl, 0xea
mov dword [esp + 0x104], ebx
mov al, bl
add al, dl
xor al, 0x63
mov dword [esp + 0x15c], eax
mov dl, al
xor dl, bl
add dl, 0x32
mov dword [esp + 0x16c], edx
add dl, al
add dl, 0x7d
mov ah, dl
xor ah, 2
mov al, dl
xor al, 0x7b
mov dh, al
add dh, 0x1f
xor ebx, ebx
lea edi, [esp + 0x400]
mov dword [esp + 0xf4], edi
lea edi, [esp + 0x3b8]
mov dword [esp + 0xfc], edi
lea edi, [esp + 0x2f0]
mov dword [esp + 0x128], edi
lea edi, [esp + 0x228]
mov dword [esp + 0xe4], edi
lea edi, [esp + 0x410]
mov dword [esp + 0x114], edi
lea edi, [esp + 0x3e0]
mov dword [esp + 0x118], edi
lea edi, [esp + 0x3c0]
mov dword [esp + 0xf8], edi
lea edi, [esp + 0x3f4]
mov dword [esp + 0xf0], edi
lea edi, [esp + 0x42c]
mov dword [esp + 0x150], edi
lea edi, [esp + 0x404]
mov dword [esp + 0x124], edi
lea edi, [esp + 0x3d0]
mov dword [esp + 0x120], edi
mov ch, 0x73
add esi, 1
jb 0x79f060
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xdb], dh
mov byte [esp + 0xd3], ah
mov byte [esp + 0x73], al
mov byte [esp + 0x183], dl
mov byte [esp + 0x177], ch
mov byte [esp + 0xaf], cl
mov ebx, dword [esp + 0x1e4]
mov dword [esp + 0x1e4], ebx
cmp dword [esp + 0x194], 0xa
mov eax, dword [esp + 0x160]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
je 0x7a1918
jmp 0x7a2115
mov byte [esp + 0x73], 0x41
mov eax, dword [esp + 0x6c]
lea ebx, [eax + 1]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x40c], 0
lea eax, [esp + 0x40c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x410]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
call dword [0x818c30]
sub esp, 0x18
mov eax, dword [esp + 0x40c]
mov dword [esp + 0x68], eax
mov dword [esp], eax
call fcn.00492770
mov dword [esp + 0x1ec], eax
mov dword [esp + 0x138], 0
test eax, eax
je 0x7a278a
mov al, byte [esp + 0xd3]
movzx ecx, al
cmp ecx, 0x12
je 0x79f3d3
mov eax, 0xa
cmp ecx, 0x51
je 0x79f3eb
mov dword [esp + 0x184], esi
mov dword [esp + 0x1e4], ebx
cmp ecx, 0x5a
jne 0x79f3fe
mov byte [esp + 0xd3], 0x55
mov esi, dword [esp + 0x68]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x1ec]
mov dword [esp], edi
mov dword [esp + 4], 0
call fcn.007ce3c0
mov dword [edi], 5
mov eax, dword [esp + 0x118]
mov dword [eax], 0x1c
lea eax, [esp + 0x3e0]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea eax, [esp + 0x410]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call dword [0x818c30]
sub esp, 0x18
mov edx, 0x11
test eax, eax
mov ebx, dword [esp + 0x1d8]
jne 0x7a049c
jmp 0x7a1f8c
mov dword [esp + 0x184], esi
mov dword [esp + 0x1e4], ebx
mov byte [esp + 0xd3], 0x12
jmp 0x79f406
mov dword [esp + 0x1e4], ebx
mov dl, byte [esp + 0xbb]
jmp 0x7a2c1d
mov byte [esp + 0xd3], 0x5a
mov esi, dword [esp + 0x68]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x1ec]
mov dword [esp], edi
mov dword [esp + 4], 0
call fcn.007ce3c0
mov dword [edi], 5
mov eax, dword [esp + 0x118]
mov dword [eax], 0x1c
lea eax, [esp + 0x3e0]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea eax, [esp + 0x410]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call dword [0x818c30]
sub esp, 0x18
test eax, eax
mov ebx, dword [esp + 0x1d8]
jne 0x7a1bb1
jmp 0x7a1f8c
mov byte [esp + 0x183], 0x53
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
add esi, 1
jb 0x79f490
mov edi, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x90]
jmp 0x79f022
mov eax, 0xc
xor al, 0x55
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
xor eax, eax
mov ecx, ebx
add esi, 1
jb 0x79f4d0
mov dword [esp + 0x148], ecx
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1e0], eax
mov esi, edi
jmp 0x7a278a
mov edi, 7
mov eax, ebx
mov dword [esp + 0x1e8], eax
lea ebx, [esp + 0x3fc]
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x10], ecx
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x28
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x700a0
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
test eax, eax
je 0x79f657
mov eax, dword [esp + 0xf8]
cmp dword [eax], 0xb
jne 0x79f671
mov esi, 0xb
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d1080
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
test eax, eax
je 0x7a1cb8
mov edi, 0xe
mov eax, dword [esp + 0xf0]
mov eax, dword [eax]
mov dword [esp + 0x224], eax
mov dword [esp + 4], eax
lea eax, [esp + 0x224]
mov dword [esp], eax
mov dword [esp + 8], 0
call dword [0x818c3c]
sub esp, 0xc
mov dword [esp + 0x3fc], eax
test eax, eax
mov esi, dword [esp + 0x184]
je 0x79f745
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
jmp 0x7a21c0
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov dl, byte [esp + 0xe3]
jmp 0x79f898
mov edi, 9
mov ebx, dword [esp + 0x108]
movzx eax, bl
cmp eax, 0x28
mov ecx, dword [esp + 0x164]
mov esi, dword [esp + 0x184]
je 0x79f6d2
cmp eax, 0x50
jne 0x79f6f3
mov al, 0x28
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x138], 0
jmp 0x79fabc
mov dword [esp + 0x140], ecx
mov dword [esp + 0x160], esi
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
jmp 0x79fd6b
mov edi, esi
mov esi, 0xffffffff
jmp 0x79f729
mov ebx, 0x83
add bl, 0xba
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esi, 1
jb 0x79f700
mov dword [esp + 0x108], ebx
mov dword [esp + 0x138], 0
jmp 0x79fa0e
mov esi, 3
mov ebx, 0x13
mov edi, 0xd
cmp esi, 3
jne 0x79f7bc
movzx eax, byte [esp + 0x10f]
cmp eax, 0x7f
jne 0x79f7f2
mov esi, 0xb
mov byte [esp + 0x10f], 0x7f
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x104
call dword [0x818c38]
sub esp, 0x10
mov dword [esp + 0x3fc], eax
test eax, eax
jne 0x79f754
mov ebx, dword [esp + 0x1d8]
jmp 0x7a22b5
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov ebx, dword [esp + 0x1e4]
jmp 0x7a1303
cmp eax, 0x52
jne 0x79f83b
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov dl, byte [esp + 0x13f]
mov cl, byte [esp + 0x14f]
mov dh, byte [esp + 0x11e]
jmp 0x79fde5
mov edi, 5
mov byte [esp + 0x10f], 0x46
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x104
call dword [0x818c38]
sub esp, 0x10
mov dword [esp + 0x3fc], eax
test eax, eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
jne 0x7a12c9
jmp 0x7a2115
mov ebx, dword [esp + 0x104]
cmp edi, 7
mov esi, dword [esp + 0xe4]
jne 0x79f913
movzx eax, bl
cmp eax, 0x12
mov esi, dword [esp + 0x184]
je 0x79f98c
cmp eax, 0x2c
je 0x79f997
mov edi, esi
mov esi, 0xffffffff
cmp eax, 0x76
jne 0x79f9a9
mov byte [esp + 0xe3], dl
jmp 0x79f909
mov ebx, 0x8a
xor bl, 0xfc
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esi, 1
jb 0x79f8e0
jmp 0x79f9ee
mov dword [esp + 0x104], ebx
mov edi, 0xa
mov byte [esp + 0xe3], 0x1e
mov dword [esp], 0x7ecca6
call fcn.007c3e70
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0x7ecca6
call fcn.007c5e90
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x224]
mov dword [esp + 4], eax
lea eax, [esp + 0x224]
mov dword [esp], eax
mov dword [esp + 8], 0
call dword [0x818c3c]
sub esp, 0xc
mov dword [esp + 0x3fc], eax
test eax, eax
mov esi, dword [esp + 0x184]
jne 0x7a2477
jmp 0x7a19fc
mov byte [esp + 0xe3], dl
mov al, 0x2c
jmp 0x79f9a0
mov byte [esp + 0xe3], dl
mov al, 0x12
mov dword [esp + 0x104], eax
jmp 0x79fa1a
mov byte [esp + 0xe3], dl
jmp 0x79f9e9
mov ebx, 0x8f
add bl, 0xe4
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esi, 1
jb 0x79f9c0
mov dword [esp + 0x104], ebx
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov ebx, dword [esp + 0x1e4]
jmp 0x79fb7d
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
jmp 0x79fabc
mov ebx, 0xf1
add bl, 0x5f
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esi, 1
jb 0x79fa60
mov dword [esp + 0x108], ebx
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov esi, dword [esp + 0x160]
mov dword [esp + 0x194], edi
mov ebx, dword [esp + 0x1e4]
mov dword [esp + 0x148], ebx
jmp 0x7a278a
mov ebx, 0xb3
xor bl, 0x9e
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1e4]
add edi, 1
jb 0x79fad0
mov dword [esp + 0x148], ecx
mov dword [esp + 0x138], eax
mov dword [esp + 0x100], ebx
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
jmp 0x7a2e35
mov eax, 0x79
add al, 0xfb
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esi, 1
jb 0x79fb30
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov dword [esp + 0x148], ebx
mov esi, edi
jmp 0x7a278a
mov byte [esp + 0xe3], 0x45
mov dword [esp], 0x7ecca6
call fcn.007c3e70
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0x7ecca6
call fcn.007c5e90
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x224]
mov dword [esp + 4], eax
lea eax, [esp + 0x224]
mov dword [esp], eax
mov dword [esp + 8], 0
call dword [0x818c3c]
sub esp, 0xc
mov dword [esp + 0x3fc], eax
test eax, eax
mov esi, dword [esp + 0x184]
jne 0x7a2477
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x128]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x104
call dword [0x818c38]
sub esp, 0x10
mov dword [esp + 0x3fc], eax
test eax, eax
mov edi, dword [esp + 0x1e8]
mov ebx, dword [esp + 0x1e4]
je 0x79fc79
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov dword [esp + 0x148], ebx
jmp 0x7a278a
mov al, byte [esp + 0x11e]
movzx eax, al
cmp eax, 0x6e
jne 0x79fcc6
mov ebx, 0xe
mov edi, 0x17
mov byte [esp + 0x11e], 0x6e
mov ecx, dword [esp + 0x128]
call fcn.007a30a0
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0x9c], eax
test eax, eax
jne 0x7a07f3
jmp 0x7a0233
mov dword [esp + 0x160], esi
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov dword [esp + 0xcc], 3
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x90]
mov esi, ebx
mov eax, dword [esp + 0x138]
mov edi, dword [esp + 0x148]
mov dword [esp + 0x148], edi
mov dword [esp + 0x138], eax
mov dword [esp + 0x1e4], esi
mov dword [esp + 0x90], edx
mov dword [esp + 0x24], ecx
cmp dword [esp + 0xcc], 3
mov dh, byte [esp + 0x11e]
jne 0x79fdb1
mov ebx, 0xf
mov edi, 4
mov byte [esp + 0x11e], 0x67
mov ecx, dword [esp + 0x128]
call fcn.007a30a0
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0x9c], eax
test eax, eax
jne 0x7a0b11
cmp edi, 4
jne 0x79ffe4
mov dword [esp + 0x138], eax
mov dword [esp + 0x148], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
jmp 0x7a0d63
mov eax, dword [esp + 0x110]
movzx ecx, al
cmp ecx, 9
je 0x79ff9d
mov eax, 0xf
mov ebx, 0xe
cmp ecx, 0x3f
mov dl, byte [esp + 0x13f]
mov cl, byte [esp + 0x14f]
je 0x7a2096
mov byte [esp + 0x11e], dh
cmp ebx, 0xe
jne 0x79fffc
mov byte [esp + 0x11d], 0x34
mov byte [esp + 0x147], 0x7a
mov byte [esp + 0x157], 0xc
mov byte [esp + 0x137], 0x4c
mov byte [esp + 0x13f], 0x5f
mov byte [esp + 0x11f], 0x42
mov byte [esp + 0x14f], 0x65
mov byte [esp + 0x12f], 0xf
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov byte [esp + 0x11e], 0x67
mov byte [esp + 0xe3], 0x45
mov byte [esp + 0x177], 0x73
mov byte [esp + 0x10f], 0x46
mov byte [esp + 0xaf], 0x61
mov byte [esp + 0x73], 0x28
mov esi, 9
lea eax, [esp + 0x400]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x3b8]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x2f0]
mov dword [esp + 0x128], eax
lea eax, [esp + 0x228]
mov dword [esp + 0xe4], eax
lea eax, [esp + 0x410]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x3e0]
mov dword [esp + 0x118], eax
lea eax, [esp + 0x3c0]
mov dword [esp + 0xf8], eax
lea eax, [esp + 0x3f4]
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x42c]
mov dword [esp + 0x150], eax
lea eax, [esp + 0x404]
mov dword [esp + 0x124], eax
mov dword [esp + 0xdc], 0
lea eax, [esp + 0x3d0]
mov dword [esp + 0x120], eax
mov byte [esp + 0x183], 0x53
mov byte [esp + 0xd3], 0x51
mov byte [esp + 0xdb], 0x47
mov cl, 0x3f
mov dword [esp + 0x110], ecx
mov al, 7
mov dword [esp + 0x18c], eax
mov bl, 0x5e
mov al, 0x1c
mov dword [esp + 0x158], eax
mov al, 0x2d
mov dword [esp + 0x100], eax
mov al, 0x12
mov dword [esp + 0x104], eax
mov al, 0x59
mov dword [esp + 0x15c], eax
mov al, 0x7d
mov dword [esp + 0x16c], eax
mov al, 0x28
mov dword [esp + 0x108], eax
jmp 0x7a04b6
mov esi, 0xffffffff
mov eax, 0x53
add eax, 0xffffffb7
mov dword [esp + 0x194], eax
mov cl, byte [esp + 0xaf]
mov ch, byte [esp + 0x177]
mov dl, byte [esp + 0x183]
mov al, byte [esp + 0x73]
mov ah, byte [esp + 0xd3]
mov dh, byte [esp + 0xdb]
mov ebx, dword [esp + 0xdc]
jmp 0x79f20c
mov esi, 0xffffffff
mov ebx, dword [esp + 0x108]
mov edi, dword [esp + 0x188]
jmp 0x79fa89
mov byte [esp + 0x14f], cl
mov byte [esp + 0x13f], dl
mov dword [esp + 0x194], 0x16
mov byte [esp + 0x10f], 0x52
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x104
call dword [0x818c38]
sub esp, 0x10
mov dword [esp + 0x3fc], eax
test eax, eax
mov ebx, dword [esp + 0x1e4]
jne 0x7a1303
jmp 0x79f24a
mov cl, bl
xor cl, 0x7e
mov dword [esp + 0x1d8], ecx
test edx, edx
sete cl
xor edi, edi
mov dword [esp + 0x1dc], 0
mov dword [esp + 0x1e0], esi
add eax, 1
jb 0x7a0070
mov byte [esp + 0xa7], cl
mov ecx, dword [esp + 0x1dc]
mov eax, dword [esp + 0x1e0]
mov edx, dword [esp + 0x188]
mov esi, dword [esp + 0x194]
mov dword [esp + 0x188], edx
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x198], eax
mov dword [esp + 0xec], edi
cmp ebx, 0xe
mov ebx, dword [esp + 0x164]
mov dword [esp + 0x140], ebx
mov dword [esp + 0x130], esi
mov esi, dword [esp + 0x184]
mov dword [esp + 0x160], esi
mov dword [esp + 0x190], edi
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x194], edx
jne 0x7a02aa
mov edi, 0x10
mov eax, dword [esp + 0x15c]
movzx eax, al
cmp eax, 0x21
jne 0x7a0156
mov edi, esi
mov esi, 0xffffffff
mov ebx, dword [esp + 0x1e4]
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x148]
jmp 0x79f4f1
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1e0], eax
cmp edi, 6
mov ebx, dword [esp + 0x1e4]
je 0x7a2c4c
mov al, 0x21
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov dword [esp + 0x138], 0
mov dword [esp + 0x148], ebx
jmp 0x7a278a
mov dword [esp + 0x150], eax
mov byte [esp + 0x147], 0x60
mov dword [esp + 0xa0], 0
mov ecx, dword [esp + 0x1e0]
test ecx, ecx
mov dword [esp + 0x88], esi
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xa8], eax
mov edx, edi
mov dword [esp + 0x160], edi
mov edi, dword [esp + 0x140]
mov dword [esp + 0x164], edi
mov edi, 7
mov dword [esp + 0xec], esi
mov dword [esp + 0x190], esi
mov esi, edx
mov dword [esp + 0x19c], eax
mov dword [esp + 0x198], ecx
jne 0x7a02aa
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
cmp edi, 7
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov dword [esp + 0x160], esi
mov eax, dword [esp + 0xec]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x198]
mov dword [esp + 0x1e0], eax
je 0x7a06f1
jmp 0x7a0d63
mov edx, dword [esp + 0x1e0]
mov edi, dword [edx + 4]
mov ecx, dword [edx + 8]
lea eax, [ecx + 0x404]
cmp dword [ecx + 0x404], 0
je 0x7a038f
cmp dword [ecx + 0x81c], 0
je 0x7a038f
mov ebx, edx
mov dword [esp + 0x5c], eax
mov eax, dword [ecx + 0x84c]
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x150]
mov dword [esp], esi
mov dword [esp + 8], 0x7eccde
mov dword [esp + 4], 0x40
call fcn.0064a2d0
mov edx, dword [esp + 0x40]
mov al, byte [edx]
test al, al
je 0x7a03ee
movsx ecx, byte [esi]
mov dword [esp + 0x28], ecx
test ecx, ecx
sete byte [esp + 0x2f]
mov esi, 1
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x164], ecx
mov ecx, dword [esp + 0x160]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x198], ebx
mov byte [esp + 0x72], al
mov dword [esp + 0x1e0], edi
mov eax, dword [esp + 0x190]
mov dword [esp + 0xec], eax
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x17c], eax
mov dword [esp + 0x178], ecx
jmp 0x7a22df
mov dword [esp + 0x5c], eax
mov dword [esp + 0xbc], ecx
mov eax, dword [esp + 0x190]
mov dword [esp + 0xec], eax
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x198], edx
mov dword [esp + 0x1e0], edi
mov esi, eax
mov dword [esp + 0x17c], esi
mov dword [esp + 0x178], ecx
mov dl, byte [esp + 0x147]
mov eax, dword [esp + 0x150]
mov edi, dword [esp + 0x160]
jmp 0x7a0a5f
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x184], eax
mov esi, dword [esp + 0x130]
mov eax, dword [esp + 0x190]
mov dword [esp + 0xec], eax
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x1e0], edi
mov dword [esp + 0x17c], eax
mov dword [esp + 0x178], ecx
jmp 0x7a0952
mov edi, esi
mov dword [esp + 0x194], edi
mov esi, 0x12
mov byte [esp + 0x12f], 0xf
mov al, dl
movzx edx, al
mov cx, 0x107
and cx, word [edx + edx + str.________________________________H]
sete dl
movzx edx, dl
mov dword [esp + 0x130], edx
test edi, edi
je 0x7a04aa
mov edx, 5
test cx, cx
mov byte [esp + 0x47], al
mov eax, dword [esp + 0x74]
mov dword [esp + 0x7c], eax
je 0x7a04b6
cmp edx, 5
je 0x7a2269
jmp 0x7a1bb1
mov byte [esp + 0x47], al
mov eax, dword [esp + 0x74]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x1d8], ebx
cmp esi, 9
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov esi, dword [esp + 0x130]
je 0x7a1918
jmp 0x7a2711
mov byte [esp + 0x11f], 0x42
test byte [esp + 0x2f], 1
mov eax, dword [esp + 0x170]
mov dword [esp + 0xb4], eax
jne 0x7a2858
mov eax, 0x16
mov edx, dword [esp + 0x168]
movzx ecx, dl
movsx edx, dl
lea esi, [edx + 0x20]
test byte [ecx + ecx + str.________________________________H], 1
cmove esi, edx
cmp esi, dword [esp + 0x28]
mov edx, dword [esp + 0x170]
mov ecx, edx
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x150]
mov dword [esp + 0x60], ecx
mov dword [esp + 0xb4], edx
mov ecx, dword [esp + 0x188]
jne 0x7a1af1
mov eax, 0x13
mov cl, byte [esp + 0x13f]
movzx ecx, cl
cmp ecx, 8
jne 0x7a05a3
mov eax, 0xf
mov byte [esp + 0x13f], 0x5f
mov ecx, dword [esp + 0x64]
lea esi, [ecx + 1]
mov dword [esp + 0xb4], esi
mov edx, dword [esp + 0x60]
lea ecx, [edx + 1]
mov dword [esp + 0x38], ecx
mov cl, byte [edx + 1]
mov byte [esp + 0x3f], cl
test cl, cl
mov dword [esp + 0x34], esi
jne 0x7a281b
jmp 0x7a1ee6
mov ebx, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x18c]
jmp 0x7a27ca
mov byte [esp + 0x137], 0x6f
mov eax, dword [esp + 0x48]
movzx eax, al
movzx eax, word [eax + eax + str.________________________________H]
test ax, 0x107
mov esi, dword [esp + 0x194]
jne 0x7a2711
mov dword [esp + 0x194], esi
mov eax, 0xffffffff
mov ebx, dword [esp + 0xbc]
mov esi, dword [esp + 0xec]
mov edi, dword [esp + 0x198]
mov ecx, dword [esp + 0x1dc]
mov edx, dword [esp + 0x1e0]
nop dword [eax]
add eax, 1
jb 0x7a0610
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xcc], edx
mov dword [esp + 0xc8], ecx
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0x124]
mov eax, dword [ecx]
mov dword [ebx + 0x818], eax
mov eax, dword [ecx]
lea ecx, [ebx + 0x618]
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [esp + 8], str..PhysicalDrive_u
mov dword [esp + 4], 0x200
call fcn.0064a2d0
mov eax, dword [esp + 0x120]
movsd xmm0, qword [eax]
movsd qword [ebx + 0x410], xmm0
inc dword [ebx + 0x408]
mov dword [esp + 0xa0], 1
mov eax, dword [esp + 0x194]
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov dword [esp + 0x190], esi
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], edi
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0xa8], eax
cmp dword [esp + 0xa8], 1
jne 0x7a0878
mov eax, dword [esp + 0x30]
or eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
or eax, ecx
jne 0x7a0878
movzx eax, byte [esp + 0x11d]
cmp eax, 0x34
jne 0x7a08a7
mov ebx, 2
mov byte [esp + 0x11d], 0x34
mov ecx, dword [esp + 0x124]
mov eax, dword [ecx]
mov esi, dword [esp + 0x88]
mov dword [esi + 0x818], eax
mov eax, dword [ecx]
lea ecx, [esi + 0x618]
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [esp + 8], str..PhysicalDrive_u
mov dword [esp + 4], 0x200
call fcn.0064a2d0
mov eax, dword [esp + 0x120]
movsd xmm0, qword [eax]
movsd qword [esi + 0x410], xmm0
inc dword [esi + 0x408]
mov esi, dword [esp + 0x160]
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0x19c], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1e0], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
cmp ebx, 2
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov dword [esp + 0x160], esi
mov eax, dword [esp + 0x130]
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0xec]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x198]
mov dword [esp + 0x1e0], eax
je 0x7a0d63
jmp 0x7a0b91
mov eax, dword [esp + 0x190]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0x19c], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x198], eax
jmp 0x7a0d63
mov edi, 0xb
mov bl, 0x3a
mov ecx, dword [esp + 0x124]
mov eax, dword [ecx]
mov esi, dword [esp + 0x88]
mov dword [esi + 0x818], eax
mov eax, dword [ecx]
lea ecx, [esi + 0x618]
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [esp + 8], str..PhysicalDrive_u
mov dword [esp + 4], 0x200
call fcn.0064a2d0
mov eax, dword [esp + 0x120]
movsd xmm0, qword [eax]
movsd qword [esi + 0x410], xmm0
inc dword [esi + 0x408]
mov eax, dword [esp + 0x190]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x1dc]
mov ecx, dword [esp + 0x1e0]
mov dword [esp + 0x198], ecx
jmp 0x7a2ad0
mov byte [esp + 0x157], 0xc
mov ecx, dword [esp + 0x7c]
lea eax, [ecx + 1]
mov dword [esp + 0x74], eax
mov al, byte [ecx + 1]
mov byte [esp + 0x72], al
test al, al
mov dword [esp + 0x188], esi
jne 0x7a22df
test byte [esp + 0xa7], 1
mov ebx, dword [esp + 0xbc]
jne 0x7a0984
lea eax, [ebx + 0x204]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x128]
mov dword [esp], eax
call fcn.007c58b0
test eax, eax
je 0x7a0d3b
mov eax, dword [esp + 0x5c]
cmp dword [eax], 2
jne 0x7a09d1
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov dword [esp + 0x130], esi
mov edi, dword [esp + 0x184]
mov esi, dword [esp + 0x17c]
mov eax, dword [esp + 0x178]
mov dword [esp + 0x1dc], eax
mov dl, byte [esp + 0x147]
mov eax, dword [esp + 0x150]
jmp 0x7a0a5f
mov dword [esp + 0x194], esi
mov esi, 0xffffffff
lea edi, [ebx + 0x204]
mov ecx, dword [esp + 0x17c]
mov eax, dword [esp + 0x178]
jmp 0x7a0a20
mov ecx, edi
call fcn.007a30a0
test eax, eax
sete al
mov ecx, dword [esp + 0x17c]
cmove ecx, ebx
movzx eax, al
add eax, dword [esp + 0x178]
add esi, 1
jb 0x7a0a00
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x130], eax
mov edi, dword [esp + 0x184]
mov dl, byte [esp + 0x147]
mov eax, dword [esp + 0x150]
mov esi, ecx
movzx ecx, dl
cmp ecx, 0x31
je 0x7a01bf
mov dword [esp + 0x150], eax
mov eax, 0x10
cmp ecx, 0x60
jne 0x7a0a9d
mov dword [esp + 0x190], esi
mov byte [esp + 0x147], dl
mov ebx, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x140]
jmp 0x7a2ce9
mov dword [esp + 0x160], edi
mov ebx, 0x14
mov byte [esp + 0x147], 0x7a
mov dword [esp + 0xa0], 0
mov ecx, dword [esp + 0x1e0]
test ecx, ecx
mov dword [esp + 0xc4], esi
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov dword [esp + 0x88], esi
mov dword [esp + 0xa8], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xec], esi
mov dword [esp + 0x190], esi
mov dword [esp + 0x19c], eax
mov dword [esp + 0x198], ecx
je 0x7a06f1
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
cmp ebx, 0xf
mov eax, dword [esp + 0xec]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x198]
mov dword [esp + 0x1e0], eax
mov eax, dword [esp + 0x130]
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov esi, dword [esp + 0x160]
jne 0x7a02aa
mov dword [esp + 0x184], esi
mov eax, 8
mov ebx, dword [esp + 0x1d8]
movzx ecx, bl
cmp ecx, 0x25
je 0x7a0c5a
mov eax, 0xffffffff
cmp ecx, 0x5e
mov esi, dword [esp + 0x9c]
mov edi, dword [esp + 0x190]
je 0x7a0cba
cmp ecx, 0x62
jne 0x7a0cd8
mov cl, byte [esp + 0xa7]
mov edx, dword [esp + 0x94]
jmp 0x7a0c11
mov ebx, 9
add bl, 0x1c
test edx, edx
sete cl
xor edi, edi
mov dword [esp + 0x1dc], 0
mov dword [esp + 0x1e0], esi
add eax, 1
jb 0x7a0bf0
mov dword [esp + 0x190], edi
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0xa7], cl
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
jmp 0x7a02aa
mov ecx, dword [esp + 0x194]
mov dword [esp + 0x130], ecx
mov edi, dword [esp + 0x190]
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x19c], ecx
mov ecx, dword [esp + 0x1e0]
mov dword [esp + 0x198], ecx
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x190], ecx
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0xcc]
mov dword [esp + 0x1e0], edx
mov esi, dword [esp + 0x9c]
jmp 0x7a152e
mov ebx, 0x9c
xor ebx, 0x80
mov cl, byte [esp + 0xa7]
mov edx, dword [esp + 0x94]
jmp 0x7a0095
mov ecx, 0x1b
mov bl, 0x5b
cmp dword [esp + 0x94], 0
sete byte [esp + 0xa7]
mov dword [esp + 0xec], 0
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x19c], 0
mov dword [esp + 0x198], esi
jmp 0x7a2672
mov dword [esp + 0x194], esi
mov esi, dword [esp + 0xec]
mov edi, dword [esp + 0x198]
mov ecx, dword [esp + 0x1dc]
mov edx, dword [esp + 0x1e0]
jmp 0x7a0615
mov esi, 0xffffffff
mov edi, 0xde
xor edi, 0xd3
mov ebx, dword [esp + 0x1e4]
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x148]
jmp 0x7a0db5
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor eax, eax
mov ecx, ebx
add esi, 1
jb 0x7a0d90
mov dword [esp + 0x148], ecx
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov esi, dword [esp + 0x160]
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1e0], eax
cmp edi, 0xd
je 0x7a278a
jmp 0x7a2bb8
mov dword [esp + 0x98], edi
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0x14f], dl
mov bl, 0x51
mov eax, dword [esp + 0x138]
test al, 1
mov eax, dword [esp + 0x148]
mov dword [esp + 0xdc], eax
mov al, 0x51
mov dword [esp + 0x18c], eax
je 0x7a1918
mov edi, 6
mov al, 0x4c
mov dword [esp + 0x1cc], eax
mov byte [esp + 0xbb], 0x3a
mov byte [esp + 0xeb], 0x45
mov byte [esp + 0x83], 0x1f
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call dword [0x818c34]
sub esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0x78], eax
test eax, eax
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0x148]
mov dword [esp + 0xdc], eax
mov al, bl
mov dword [esp + 0x18c], eax
mov esi, dword [esp + 0x184]
jne 0x7a0180
mov eax, 0xb
mov ecx, dword [esp + 0x1cc]
movzx ecx, cl
cmp ecx, 0x22
je 0x7a0f0e
mov edi, 6
cmp ecx, 0x4c
jne 0x7a0f28
mov ebx, dword [esp + 0x1e4]
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x148]
jmp 0x7a1d55
mov dword [esp + 0x184], esi
mov ecx, dword [esp + 0x194]
mov dword [esp + 0x188], ecx
jmp 0x7a24ca
mov al, 0xa
mov dword [esp + 0x1cc], eax
mov byte [esp + 0x1c7], 0x13
mov byte [esp + 0x1d3], 0x44
mov byte [esp + 0x1d2], 0x25
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [esp + 0x90], eax
lea eax, [esp + 0x221]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov edx, dword [esp + 0x190]
mov ecx, dword [esp + 0x1dc]
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x160], esi
lea esi, [esp + 0x21a]
mov dword [esp + 0x84], esi
lea esi, [esp + 0x1f0]
mov dword [esp + 0x1c8], esi
lea esi, [esp + 0x222]
mov dword [esp + 0x1c0], esi
lea esi, [esp + 0x223]
mov dword [esp + 0x1bc], esi
lea esi, [esp + 0x21b]
mov dword [esp + 0x1b8], esi
lea esi, [esp + 0x21c]
mov dword [esp + 0x1b4], esi
lea esi, [esp + 0x21d]
mov dword [esp + 0x1b0], esi
lea esi, [esp + 0x21e]
mov dword [esp + 0x1ac], esi
lea esi, [esp + 0x21f]
mov dword [esp + 0x1a8], esi
lea esi, [esp + 0x220]
mov dword [esp + 0x1a4], esi
mov dword [esp + 0x1d4], 2
lea esi, [esp + 0x1f8]
mov dword [esp + 0x1a0], esi
jmp 0x7a2dd5
mov eax, 0x97
add al, 0x8b
mov dword [esp + 0x1cc], eax
xor al, 0x31
mov byte [esp + 0x1c7], al
add al, 0x31
mov byte [esp + 0x1d3], al
xor al, 0x61
mov byte [esp + 0x1d2], al
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [esp + 0x1d4], 2
lea ecx, [esp + 0x221]
lea edx, [esp + 0x21a]
lea edi, [esp + 0x1f0]
mov dword [esp + 0x1c8], edi
lea edi, [esp + 0x222]
mov dword [esp + 0x1c0], edi
lea edi, [esp + 0x223]
mov dword [esp + 0x1bc], edi
lea edi, [esp + 0x21b]
mov dword [esp + 0x1b8], edi
lea edi, [esp + 0x21c]
mov dword [esp + 0x1b4], edi
lea edi, [esp + 0x21d]
mov dword [esp + 0x1b0], edi
lea edi, [esp + 0x21e]
mov dword [esp + 0x1ac], edi
lea edi, [esp + 0x21f]
mov dword [esp + 0x1a8], edi
lea edi, [esp + 0x220]
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a0], ebx
add esi, 1
jb 0x7a1040
mov dword [esp + 0x84], edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov edx, dword [esp + 0x190]
mov ecx, dword [esp + 0x1dc]
mov eax, dword [esp + 0x1e0]
mov esi, dword [esp + 0x184]
mov dword [esp + 0x160], esi
jmp 0x7a2dd5
mov byte [esp + 0x1d3], 0x37
lea ecx, [esi + 0x41]
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x8c]
mov byte [eax], cl
mov ecx, dword [esp + 0x1c0]
mov byte [ecx], 0x3a
mov ecx, dword [esp + 0x1bc]
mov byte [ecx], 0
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 2
jne 0x7a164c
mov ecx, dword [esp + 0x84]
mov byte [ecx], 0x5c
mov eax, dword [esp + 0x1b8]
mov byte [eax], 0x5c
mov eax, dword [esp + 0x1b4]
mov byte [eax], 0x2e
mov eax, dword [esp + 0x1b0]
mov byte [eax], 0x5c
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x1ac]
mov byte [edx], al
mov eax, dword [esp + 0x1a8]
mov byte [eax], 0x3a
mov eax, dword [esp + 0x1a4]
mov byte [eax], 0
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x7a126a
mov dword [esp + 0x184], esi
mov dword [esp + 0x1e4], ebx
mov esi, 0x16
mov edi, 6
test eax, eax
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0x130]
mov dword [esp + 0x194], eax
mov ebx, dword [esp + 0x1d8]
je 0x7a26bb
jmp 0x7a1447
mov dword [esp + 0xc0], eax
jmp 0x7a164c
mov eax, dword [esp + 0x1c8]
cmp dword [eax], 1
jne 0x7a135b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
mov esi, dword [esp + 0x1a0]
je 0x7a1495
mov ecx, 0xffffffff
mov edi, 0x75
add edi, 0xffffff8f
mov edx, dword [esp + 0x24]
jmp 0x7a12b9
mov edx, dword [esi]
mov dword [esp + 0xd4], eax
add ecx, 1
jb 0x7a12b0
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x164]
mov dword [esp + 0x140], ecx
cmp edi, 4
mov dword [esp + 0x188], eax
mov ecx, dword [esp + 0xd4]
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov ebx, dword [esp + 0x1e4]
je 0x7a16a5
mov dword [esp + 0x1e4], ebx
movzx eax, byte [esp + 0x177]
cmp eax, 0x73
mov ebx, dword [esp + 0x1d8]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x148]
mov esi, dword [esp + 0x1e8]
je 0x7a1372
mov edi, 0xe
cmp eax, 0x74
jne 0x7a13eb
mov esi, dword [esp + 0x160]
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
jmp 0x7a1a28
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x7a26d9
mov esi, 0xffffffff
mov ebx, 0xa9
add ebx, 0xffffff5e
mov edi, dword [esp + 0x190]
jmp 0x7a13c5
mov al, bl
add al, 0x6c
mov byte [esp + 0x177], al
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor ecx, ecx
mov edx, dword [esp + 0x1e4]
add esi, 1
jb 0x7a1390
mov dword [esp + 0x148], edx
mov dword [esp + 0x138], ecx
mov eax, dword [esp + 0x140]
mov esi, dword [esp + 0x1d4]
jmp 0x7a2e1b
mov edi, 0xa
mov byte [esp + 0x177], 0x6b
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x1e4]
mov dword [esp + 0x148], eax
cmp edi, 6
jne 0x7a147b
movzx ecx, byte [esp + 0x1c7]
cmp ecx, 0x13
je 0x7a14a8
mov eax, 1
cmp ecx, 0x15
jne 0x7a1519
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0x1c7], 0x32
jmp 0x7a1557
mov dword [esp + 0x1d8], ebx
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
jmp 0x7a1e99
mov eax, dword [esp + 0xc0]
mov ebx, dword [esp + 0x1e4]
jmp 0x7a1633
mov dword [esp + 0x1d8], ebx
mov edi, 9
mov byte [esp + 0x1c7], 0x13
lea eax, [esp + 0x214]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x560000
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
test eax, eax
jne 0x7a1276
jmp 0x7a2812
mov esi, dword [esp + 0x9c]
mov edi, dword [esp + 0xec]
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x1dc], ecx
cmp eax, 1
jne 0x7a15b4
mov dword [esp + 0xec], edi
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x9c], esi
mov byte [esp + 0x1c7], 0x15
lea eax, [esp + 0x214]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x560000
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
test eax, eax
jne 0x7a1276
jmp 0x7a289d
mov eax, 0xffffffff
mov cl, byte [esp + 0xa7]
mov edx, dword [esp + 0x94]
jmp 0x7a15f1
mov ebx, 0x42
add bl, 0x1c
test edx, edx
sete cl
xor edi, edi
mov dword [esp + 0x19c], 0
mov dword [esp + 0x198], esi
add eax, 1
jb 0x7a15d0
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x9c], esi
mov byte [esp + 0xa7], cl
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov dword [esp + 0x190], edi
jmp 0x7a2203
mov esi, dword [esp + 0x184]
mov dword [esp + 0xc0], eax
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x1e4], ebx
lea eax, [esi + 1]
mov dword [esp + 0x1d4], eax
cmp eax, 0x20
mov edx, dword [esp + 0x190]
mov ecx, dword [esp + 0x1dc]
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x160], esi
jne 0x7a2dd5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x184], esi
mov esi, 0x18
test ecx, ecx
mov dword [esp + 0xd4], ecx
je 0x7a234e
mov edi, 0xb
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, ecx
mov ecx, dword [esp + 0x24]
cmp dword [edx + 0x818], ecx
jne 0x7a16f7
mov edi, 8
mov ecx, dword [esp + 0x54]
mov byte [edx + 0x418], cl
mov word [edx + 0x419], 0x5c3a
mov byte [edx + 0x41b], 0
mov dword [esp + 0xd4], esi
mov dword [esp + 0x164], eax
mov ecx, dword [esp + 0x18c]
jmp 0x7a2881
mov dword [esp + 0xd4], esi
mov ecx, eax
mov esi, dword [esp + 0x184]
jmp 0x7a1a9c
mov ecx, 0xfe
add cl, 0x3a
mov dword [esp + 0x110], ecx
mov eax, 0xfe
add al, 9
mov dword [esp + 0x18c], eax
mov cl, al
xor cl, 0x33
mov byte [esp + 0x11d], cl
mov dl, cl
xor dl, al
add dl, 0x47
mov byte [esp + 0x147], dl
mov ch, dl
xor ch, cl
xor ch, 0x42
mov byte [esp + 0x157], ch
sub ch, dl
mov al, ch
add al, 0xba
mov byte [esp + 0x137], al
mov bl, 0x75
sub bl, ch
add ch, 0xcd
mov byte [esp + 0x13f], ch
mov ch, bl
xor ch, 0x86
mov byte [esp + 0x14f], ch
xor bl, 0xc4
mov al, bl
add al, 0xe8
mov byte [esp + 0x12f], al
mov dl, bl
add dl, 0x37
mov dword [esp + 0x1d8], edx
mov al, bl
add al, 0x40
mov byte [esp + 0x11e], al
add bl, 0xf5
mov dword [esp + 0x158], ebx
mov dl, bl
xor dl, 0x59
mov bl, dl
add bl, 0x2e
mov byte [esp + 0x177], bl
mov al, bl
xor al, dl
xor al, 0x70
mov byte [esp + 0x10f], al
mov cl, al
xor cl, bl
add cl, 0xf8
mov dword [esp + 0x100], ecx
xor cl, al
mov bl, cl
xor bl, 0xa
mov byte [esp + 0xaf], bl
xor cl, 0x43
mov dword [esp + 0x108], ecx
mov bl, cl
add bl, 0xea
mov dword [esp + 0x104], ebx
mov al, bl
add al, cl
mov bl, al
xor bl, 0x63
mov dword [esp + 0x15c], ebx
xor al, 0x47
mov dword [esp + 0x16c], eax
mov dh, al
add dh, 0xd6
mov byte [esp + 0x183], dh
mov cl, dh
xor cl, al
add cl, 0x23
mov byte [esp + 0xd3], cl
mov al, cl
xor al, 0x79
mov ah, al
xor ah, cl
add ah, dh
xor ah, 0x8b
mov byte [esp + 0xdb], ah
mov dword [esp + 0xdc], 0
lea ecx, [esp + 0x400]
mov dword [esp + 0xf4], ecx
lea ecx, [esp + 0x3b8]
mov dword [esp + 0xfc], ecx
lea ecx, [esp + 0x2f0]
mov dword [esp + 0x128], ecx
lea ebx, [esp + 0x228]
lea ecx, [esp + 0x410]
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x118], ecx
lea ecx, [esp + 0x3c0]
mov dword [esp + 0xf8], ecx
lea ecx, [esp + 0x3f4]
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 0x42c]
mov dword [esp + 0x150], ecx
lea ecx, [esp + 0x404]
mov dword [esp + 0x124], ecx
mov dword [esp + 0x120], esi
mov byte [esp + 0x11f], 0x42
add edi, 1
jb 0x7a1710
mov byte [esp + 0x73], al
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xe3], dl
mov eax, dword [esp + 0x160]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
movzx eax, byte [esp + 0xdb]
cmp eax, 0x75
jne 0x7a198f
mov ebx, 0xc
mov byte [esp + 0xdb], 0x75
mov eax, dword [esp + 0x114]
mov dword [eax], 0x1c
lea eax, [esp + 0x410]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0xdc]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
mov dword [esp + 8], 0x80795c
mov dword [esp + 4], 0
call dword [0x818c2c]
sub esp, 0x14
test eax, eax
mov eax, esi
mov dword [esp + 0x6c], eax
mov esi, dword [esp + 0x184]
jne 0x7a1e22
jmp 0x7a1a05
mov ebx, 0xf
mov edi, 7
mov byte [esp + 0xdb], 0x47
mov eax, dword [esp + 0x114]
mov dword [eax], 0x1c
lea eax, [esp + 0x410]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0xdc]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
mov dword [esp + 8], 0x80795c
mov dword [esp + 4], 0
call dword [0x818c2c]
sub esp, 0x14
test eax, eax
mov eax, esi
mov dword [esp + 0x6c], eax
mov esi, dword [esp + 0x184]
jne 0x7a2c79
cmp edi, 7
jne 0x79fbf3
mov edi, 2
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x103
sete cl
setne al
movzx edx, al
add edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x1d8]
cmp edi, 2
jne 0x7a1a47
mov dword [esp + 0x148], edx
mov dword [esp + 0x138], ecx
mov dword [esp + 0x1d8], ebx
jmp 0x7a2e3c
mov dword [esp + 0x1d8], ebx
mov edi, 5
mov byte [esp + 0x177], 0x74
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x138], 0
mov ebx, dword [esp + 0x1e4]
mov dword [esp + 0x148], ebx
mov ecx, dword [esp + 0x164]
cmp edi, 5
jne 0x7a168a
mov dword [esp + 0x164], ecx
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
jmp 0x7a278a
mov byte [esp + 0x73], 0x23
jmp 0x79f285
movzx ecx, al
cmp ecx, 0x28
je 0x79f280
mov byte [esp + 0x73], al
mov eax, 0xd
cmp ecx, 0x41
je 0x7a1abf
mov dword [esp + 0x184], esi
mov ecx, dword [esp + 0x194]
cmp eax, 0xd
jne 0x7a1b9e
mov dword [esp + 0x194], ecx
mov edi, 9
mov byte [esp + 0x73], 0x28
mov eax, dword [esp + 0x6c]
lea ebx, [eax + 1]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x40c], 0
lea eax, [esp + 0x40c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x410]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
call dword [0x818c30]
sub esp, 0x18
mov eax, dword [esp + 0x40c]
mov dword [esp + 0x68], eax
mov dword [esp], eax
call fcn.00492770
mov dword [esp + 0x1ec], eax
mov dword [esp + 0x138], 0
test eax, eax
mov esi, dword [esp + 0x184]
jne 0x7a2f22
jmp 0x7a278a
mov dword [esp + 0x188], ecx
mov esi, dword [esp + 0x130]
jmp 0x7a2711
mov eax, dword [esp + 0x1ec]
lea esi, [eax + 4]
mov dword [esp], esi
call fcn.007c3e70
cmp eax, 0x1ff
mov edi, dword [esp + 0xec]
jbe 0x7a1c55
mov dword [esp + 0x40], esi
mov eax, 0xc
mov ecx, dword [esp + 0x16c]
movzx ecx, cl
cmp ecx, 0x1c
je 0x7a1cfe
cmp ecx, 0x7d
jne 0x7a1d1f
mov esi, 0xffffffff
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x148]
jmp 0x7a1c36
mov eax, 0xd7
add al, 0xa6
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
xor eax, eax
mov ecx, dword [esp + 0x1e4]
add esi, 1
jb 0x7a1c10
mov dword [esp + 0x148], ecx
mov dword [esp + 0x138], eax
mov dword [esp + 0x1d8], ebx
jmp 0x7a1e99
mov dword [esp + 0x1d8], ebx
mov ebx, 0xe
mov dword [esp], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x7a1da0
mov esi, 8
test eax, eax
mov ebx, eax
jne 0x79f535
mov dword [esp + 0x1e8], ebx
cmp esi, 8
jne 0x7a1df2
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
mov esi, dword [esp + 0x184]
jmp 0x7a0121
mov dword [esp + 0x1d8], ebx
mov dl, byte [esp + 0x1d3]
mov ebx, dword [esp + 0x1e4]
mov esi, dword [esp + 0x184]
jmp 0x7a2f9e
mov dword [esp + 0x1d8], ebx
mov edi, 0xa
mov al, 0x1c
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
xor eax, eax
mov ebx, dword [esp + 0x1e4]
mov ecx, ebx
mov esi, dword [esp + 0x184]
mov dword [esp + 0x148], ecx
mov dword [esp + 0x138], eax
cmp edi, 6
jne 0x7a278a
mov dword [esp + 0x184], esi
mov dword [esp + 0x1e4], ebx
mov esi, 0xffffffff
lea ebx, [esp + 0x1f8]
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x84]
jmp 0x7a110c
mov dword [esp + 0x1e8], eax
mov edx, dword [esp + 0x194]
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
mov esi, dword [esp + 0x130]
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x19c]
jmp 0x7a00bd
mov ebx, 0x19
mov edi, 0x14
movzx eax, byte [esp + 0xaf]
cmp eax, 0x61
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov esi, dword [esp + 0x184]
je 0x7a3073
cmp ebx, 0xc
je 0x7a2c7e
mov byte [esp + 0xaf], 0x1a
jmp 0x79fa1a
mov al, bl
add al, 0x3b
mov byte [esp + 0x183], al
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
add esi, 1
jb 0x7a1e40
mov dword [esp + 0x138], 0
mov edx, dword [esp + 0x194]
mov eax, dword [esp + 0x1e4]
mov dword [esp + 0x148], eax
mov cl, byte [esp + 0x157]
cmp ebx, 9
jne 0x7a1eac
mov byte [esp + 0x157], cl
mov dword [esp + 0x194], edx
mov ebx, dword [esp + 0x1e4]
mov esi, dword [esp + 0x184]
jmp 0x7a278a
mov ecx, 0xd
mov eax, 9
mov byte [esp + 0x157], 0x3f
mov esi, dword [esp + 0x7c]
lea edx, [esi + 1]
mov dword [esp + 0x74], edx
mov dl, byte [esi + 1]
mov byte [esp + 0x72], dl
test dl, dl
mov edx, dword [esp + 0x130]
mov dword [esp + 0x188], edx
jne 0x7a23d2
cmp eax, 9
mov esi, dword [esp + 0x130]
je 0x7a0952
jmp 0x7a2858
mov dword [esp + 0x184], esi
mov byte [esp + 0xbb], dl
mov byte [esp + 0xd3], 0x51
mov esi, dword [esp + 0x68]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x1ec]
mov dword [esp], edi
mov dword [esp + 4], 0
call fcn.007ce3c0
mov dword [edi], 5
mov eax, dword [esp + 0x118]
mov dword [eax], 0x1c
lea eax, [esp + 0x3e0]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea eax, [esp + 0x410]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call dword [0x818c30]
sub esp, 0x18
mov ecx, 1
test eax, eax
jne 0x7a2b1e
movzx eax, byte [esp + 0x183]
mov esi, 0xffffffff
cmp eax, 0x53
jne 0x7a1fb5
mov dword [esp + 0x1d8], ebx
mov ebx, 0xd6
add ebx, 0xffffff40
jmp 0x79f4a7
mov dword [esp + 0x1d8], ebx
mov ebx, 0x47
add ebx, 0xffffffc2
jmp 0x7a1e5a
mov byte [esp + 0xaf], 0x61
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x7a01a8
mov bl, 0x39
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1e4]
add esi, 1
jb 0x7a2000
mov dword [esp + 0x148], ecx
mov dword [esp + 0x138], eax
mov dword [esp + 0x100], ebx
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov ebx, dword [esp + 0x1e4]
mov esi, edi
jmp 0x7a278a
mov eax, 0xd
mov ebx, dword [esp + 0x100]
movzx ecx, bl
cmp ecx, 0x39
jne 0x7a20fb
mov ecx, dword [esp + 0x164]
mov dword [esp + 0x140], ecx
mov dword [esp + 0x160], esi
mov cl, byte [esp + 0x14f]
mov byte [esp + 0x14f], cl
mov byte [esp + 0x13f], dl
mov edi, 0xffffffff
cmp eax, 0xd
mov ebx, dword [esp + 0xe4]
jne 0x7a20d6
mov byte [esp + 0x11e], dh
mov esi, dword [esp + 0x1e8]
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x148]
jmp 0x79fafb
mov byte [esp + 0x11e], dh
lea esi, [esp + 0x3d0]
mov dword [esp + 0x100], eax
mov dl, byte [esp + 0xe3]
mov al, byte [esp + 0x73]
jmp 0x7a18e1
mov edi, esi
mov esi, 0xffffffff
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x148]
jmp 0x7a202c
mov edi, 9
mov dl, byte [esp + 0xe3]
movzx ecx, dl
cmp ecx, 0x19
je 0x79f898
cmp ecx, 0x1e
je 0x7a214c
mov eax, 0xc
cmp ecx, 0x45
mov esi, dword [esp + 0xe4]
je 0x79fb8b
jmp 0x7a23fa
mov edi, 0x16
mov byte [esp + 0xe3], 0x19
mov dword [esp], 0x7ecca6
call fcn.007c3e70
mov dword [esp + 8], eax
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov dword [esp + 4], 0x7ecca6
call fcn.007c5e90
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x224]
mov dword [esp + 4], eax
lea eax, [esp + 0x224]
mov dword [esp], eax
mov dword [esp + 8], 0
call dword [0x818c3c]
sub esp, 0xc
mov dword [esp + 0x3fc], eax
test eax, eax
mov esi, dword [esp + 0x184]
jne 0x7a2477
cmp edi, 0xe
mov dl, byte [esp + 0x13f]
mov dh, byte [esp + 0x11e]
je 0x7a2062
jmp 0x79fbf3
mov al, 0x1c
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov eax, dword [esp + 0x1e8]
mov dword [esp], eax
jmp 0x79fc4c
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x198]
mov dword [esp + 0x1e0], eax
jmp 0x7a02aa
mov edi, 0x19
mov byte [esp + 0x12f], 0x64
movzx ecx, dl
mov ax, 0x107
and ax, word [ecx + ecx + str.________________________________H]
sete cl
movzx ecx, cl
mov dword [esp + 0x130], ecx
test esi, esi
mov dword [esp + 0x194], esi
je 0x7a22a9
test ax, ax
mov byte [esp + 0x47], dl
mov eax, dword [esp + 0x74]
mov dword [esp + 0x7c], eax
je 0x7a22b5
mov cl, byte [esp + 0x47]
movzx eax, cl
cmp eax, 0x30
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov edx, dword [esp + 0x7c]
mov edi, edx
mov al, cl
mov dword [esp + 0x168], eax
mov dword [esp + 0x170], edx
mov dl, byte [esp + 0x14f]
jne 0x7a2396
jmp 0x7a2911
mov byte [esp + 0x47], dl
mov eax, dword [esp + 0x74]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x1d8], ebx
cmp edi, 0xd
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov esi, dword [esp + 0x130]
je 0x7a2115
jmp 0x7a2711
movzx eax, byte [esp + 0x12f]
cmp eax, 0x64
mov dl, byte [esp + 0x72]
mov ebx, dword [esp + 0x1d8]
je 0x7a044e
jmp 0x7a2224
mov ecx, edi
mov al, dl
movzx edx, al
cmp edx, 0x72
jne 0x7a232a
mov dl, 0x65
movzx eax, byte [ecx]
mov dword [esp + 0x168], eax
lea edi, [ecx + 1]
cmp eax, 0x30
mov dword [esp + 0x170], ecx
je 0x7a2300
dec edi
jmp 0x7a2396
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0x14f], al
dec ecx
mov dword [esp + 0x98], ecx
mov ebx, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x164]
cmp esi, 0x10
jne 0x7a23e7
mov dword [esp + 0x164], ecx
mov dword [esp + 0x1e4], ebx
mov eax, 0xe
mov dl, 0x72
mov edi, dword [esp + 0x98]
movzx ecx, byte [edi + 1]
mov dword [esp + 0x168], ecx
inc edi
cmp ecx, 0x30
mov dword [esp + 0x170], edi
mov ebx, dword [esp + 0x1d8]
je 0x7a28ff
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0x14f], dl
movzx edx, byte [esp + 0x11f]
cmp edx, 0x30
je 0x7a249d
mov eax, 0x1a
mov ecx, 0x1c
cmp edx, 0x42
mov dword [esp + 0x170], edi
mov dword [esp + 0x98], edi
jne 0x7a23fa
cmp ecx, 0xd
jne 0x7a2624
mov esi, dword [esp + 0x188]
jmp 0x7a22df
mov dword [esp + 0x164], ecx
mov eax, dword [esp + 0xc0]
jmp 0x7a1633
cmp eax, 0xc
mov esi, dword [esp + 0xe4]
jne 0x7a04e0
mov edi, 0xd
mov byte [esp + 0xe3], 0x11
mov dword [esp], 0x7ecca6
call fcn.007c3e70
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0x7ecca6
call fcn.007c5e90
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x224]
mov dword [esp + 4], eax
lea eax, [esp + 0x224]
mov dword [esp], eax
mov dword [esp + 8], 0
call dword [0x818c3c]
sub esp, 0xc
mov dword [esp + 0x3fc], eax
test eax, eax
mov esi, dword [esp + 0x184]
je 0x7a2bfa
mov eax, dword [esp + 0x158]
movzx eax, al
cmp eax, 0x74
mov ebx, dword [esp + 0x1e4]
jne 0x7a21dc
mov edi, esi
mov esi, 0xffffffff
jmp 0x79fb5f
mov eax, 3
mov byte [esp + 0x11f], 0xa
test byte [esp + 0x2f], 1
mov dword [esp + 0x170], edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0x98], edi
je 0x7a0501
cmp eax, 3
je 0x7a2858
mov esi, 0xffffffff
mov eax, pe_nt_image_headers32
add eax, 0xffffff88
mov dword [esp + 0x194], eax
lea ebx, [esp + 0x1f8]
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x84]
jmp 0x7a25e5
mov ecx, dword [esp + 0x194]
mov al, cl
add al, 0x44
mov dword [esp + 0x1cc], eax
mov al, cl
add al, 0xb
mov byte [esp + 0x1c7], al
mov cl, al
xor cl, 0x57
mov byte [esp + 0x1d3], cl
xor al, 0x36
mov byte [esp + 0x1d2], al
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [esp + 0x1d4], 2
lea ecx, [esp + 0x221]
lea edx, [esp + 0x21a]
lea edi, [esp + 0x1f0]
mov dword [esp + 0x1c8], edi
lea edi, [esp + 0x222]
mov dword [esp + 0x1c0], edi
lea edi, [esp + 0x223]
mov dword [esp + 0x1bc], edi
lea edi, [esp + 0x21b]
mov dword [esp + 0x1b8], edi
lea edi, [esp + 0x21c]
mov dword [esp + 0x1b4], edi
lea edi, [esp + 0x21d]
mov dword [esp + 0x1b0], edi
lea edi, [esp + 0x21e]
mov dword [esp + 0x1ac], edi
lea edi, [esp + 0x21f]
mov dword [esp + 0x1a8], edi
lea edi, [esp + 0x220]
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a0], ebx
add esi, 1
jb 0x7a2510
mov dword [esp + 0x84], edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
jmp 0x7a2d7a
mov byte [esp + 0x11f], 0x30
jmp 0x7a04e8
mov byte [esp + 0x137], 0x4c
jmp 0x7a05be
movzx edx, al
cmp edx, 0x4c
je 0x7a26ec
mov dword [esp + 0x48], ecx
mov ecx, 0xe
mov esi, 0xb
cmp edx, 0x6f
mov eax, dword [esp + 0x130]
mov dword [esp + 0x194], eax
mov ebx, dword [esp + 0x1d8]
jne 0x7a26bb
mov dword [esp + 0x1d8], ebx
cmp ecx, 0xe
je 0x7a2631
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0xec]
mov dword [esp + 0x190], eax
jmp 0x7a2203
mov dword [esp + 0x1d8], ebx
cmp esi, 0xb
je 0x7a05b6
mov eax, dword [esp + 0x194]
mov dword [esp + 0x130], eax
mov ebx, dword [esp + 0x1e4]
mov esi, dword [esp + 0x184]
jmp 0x7a164c
mov byte [esp + 0x137], 0x5f
movzx eax, word [ecx + ecx + str.________________________________H]
mov dword [esp + 0x48], ecx
test ax, 0x107
mov esi, dword [esp + 0x130]
je 0x7a05de
mov ebx, 0xf
mov cl, byte [esp + 0x157]
movzx eax, cl
cmp eax, 0xc
jne 0x7a0929
mov dword [esp + 0x130], esi
mov edx, dword [esp + 0x188]
jmp 0x7a1e86
mov dword [esp + 0x1e4], ebx
mov bl, 7
mov eax, dword [esp + 0x138]
test al, 1
mov eax, dword [esp + 0x148]
mov dword [esp + 0xdc], eax
mov al, 7
jmp 0x7a0e53
mov dword [esp + 0x1e4], ebx
mov bl, 0x35
mov eax, dword [esp + 0x138]
test al, 1
mov eax, dword [esp + 0x148]
mov dword [esp + 0xdc], eax
mov al, 0x35
jmp 0x7a0e53
mov eax, 2
mov ecx, dword [esp + 0x18c]
movzx edx, cl
cmp edx, 7
je 0x7a28ce
mov dword [esp + 0x184], esi
mov eax, 7
mov edi, 0xe
cmp edx, 0x35
mov edx, dword [esp + 0x194]
mov dword [esp + 0x188], edx
jne 0x7a2881
cmp eax, 7
je 0x7a2763
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x1e4], ebx
mov edi, 2
mov byte [esp + 0x13f], 8
mov eax, dword [esp + 0x64]
lea ecx, [eax + 1]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x60]
lea eax, [edx + 1]
mov dword [esp + 0x38], eax
mov al, byte [edx + 1]
mov byte [esp + 0x3f], al
test al, al
mov dword [esp + 0xb4], ecx
je 0x7a2858
cmp edi, 2
jne 0x7a289d
mov esi, dword [esp + 0x34]
movsx eax, byte [esi]
movzx ecx, al
lea edx, [eax + 0x20]
test byte [ecx + ecx + str.________________________________H], 1
cmove edx, eax
movsx eax, byte [esp + 0x3f]
cmp edx, eax
mov dword [esp + 0x64], esi
mov eax, dword [esp + 0x38]
mov dword [esp + 0x60], eax
mov esi, dword [esp + 0x130]
je 0x7a0551
jmp 0x7a2711
mov eax, dword [esp + 0xb4]
movzx ecx, byte [eax]
test ecx, ecx
mov al, byte [esp + 0x137]
jne 0x7a263e
mov dword [esp + 0x48], ecx
mov esi, dword [esp + 0x130]
jmp 0x7a05de
cmp edi, 8
jne 0x7a273c
mov dword [esp + 0x18c], ecx
mov eax, dword [esp + 0xc0]
jmp 0x7a1633
mov ebx, 7
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov esi, dword [esp + 0x184]
jmp 0x7a3034
mov dword [esp + 0x184], esi
mov dword [esp + 0x1e4], ebx
mov ecx, dword [esp + 0x194]
mov dword [esp + 0x188], ecx
mov dl, byte [esp + 0x14f]
mov ebx, dword [esp + 0x1d8]
mov edi, dword [esp + 0x98]
cmp eax, 2
je 0x7a0e23
mov eax, dword [esp + 0x168]
mov cl, al
inc edi
mov esi, 0x10
mov al, cl
mov dword [esp + 0x168], eax
jmp 0x7a2300
mov bl, cl
add bl, 0x53
mov byte [esp + 0xeb], bl
mov dword [edx + 0x414], 0
mov dword [edx + 0x410], 0
mov byte [edx + 0x618], 0
mov byte [edx + 0x418], 0
mov dword [edx + 0x818], 0xffffffff
mov dword [esi], 0
add eax, 1
jb 0x7a2930
mov eax, dword [esp + 0x140]
mov dword [esp + 0x164], eax
mov esi, dword [esp + 0x160]
mov dword [esp + 0x194], edi
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1e0], eax
mov ebx, dword [esp + 0x1e4]
jmp 0x7a2bb8
mov edi, 3
mov byte [esp + 0x83], 0x31
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx + 4]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x50], eax
lea ecx, [eax + 0x408]
mov dword [esp + 0x4c], ecx
cmp dword [eax + 0x408], 1
mov ebx, dword [esp + 0x1e4]
jbe 0x7a2fd9
mov edi, 0x12
movzx eax, byte [esp + 0xeb]
cmp eax, 0xd
je 0x7a2a6e
mov ecx, 6
cmp eax, 0x15
jne 0x7a2b09
mov edi, 0x19
mov byte [esp + 0xeb], 0x15
mov eax, dword [esp + 0x50]
mov dword [eax + 0x414], 0
mov dword [eax + 0x410], 0
mov byte [eax + 0x618], 0
mov byte [eax + 0x418], 0
mov dword [eax + 0x818], 0xffffffff
mov eax, dword [esp + 0x4c]
mov dword [eax], 0
jmp 0x7a0e15
mov dword [esp + 0x1e4], ebx
mov eax, dword [esp + 0x164]
mov dword [esp + 0x140], eax
mov dword [esp + 0x160], esi
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0xcc], eax
mov bl, byte [esp + 0x11d]
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x19c], eax
mov byte [esp + 0x11d], bl
cmp edi, 0xb
je 0x7a0d63
mov eax, 0xffffffff
mov ecx, 0x62
lea ecx, [ecx + ecx - 0xa]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x188]
jmp 0x7a296e
mov dword [esp + 0x184], esi
mov dword [esp + 0x1e4], ebx
mov ebx, dword [esp + 0x1d8]
cmp ecx, 1
je 0x7a1bb1
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0xeb], 0x45
mov eax, dword [esp + 0x50]
mov dword [eax + 0x414], 0
mov dword [eax + 0x410], 0
mov byte [eax + 0x618], 0
mov byte [eax + 0x418], 0
mov dword [eax + 0x818], 0xffffffff
mov eax, dword [esp + 0x4c]
mov dword [eax], 0
mov ebx, dword [esp + 0x1e4]
mov esi, dword [esp + 0x184]
jmp 0x7a2bb8
mov byte [esp + 0x83], 0x2c
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx + 4]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x50], eax
lea ecx, [eax + 0x408]
mov dword [esp + 0x4c], ecx
cmp dword [eax + 0x408], 1
mov ebx, dword [esp + 0x1e4]
ja 0x7a2a02
mov eax, 0x11
mov dl, byte [esp + 0xbb]
movzx ecx, dl
cmp ecx, 0x3a
jne 0x7a2c16
mov dword [esp + 0x1e4], ebx
mov edi, 0xe
mov byte [esp + 0xbb], 0x2a
mov eax, dword [esp + 0x58]
test eax, eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
jne 0x7a2c4c
cmp edi, 0xd
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
je 0x79fbf3
jmp 0x7a0ed6
mov dword [esp + 0x1e4], ebx
mov ebx, dword [esp + 0x1d8]
cmp eax, 0xa
je 0x7a1efb
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0xbb], 0x3a
mov eax, dword [esp + 0x58]
test eax, eax
mov dword [esp + 0x78], eax
je 0x7a0ed6
movzx eax, byte [esp + 0x83]
cmp eax, 0x1f
je 0x7a2b80
mov ebx, 0x19
cmp eax, 0x31
jne 0x7a29c5
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
cmp ebx, 0xf
jne 0x7a2c95
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov al, byte [esp + 0x73]
jmp 0x7a1ac9
mov eax, 0x1a
mov byte [esp + 0x83], 0x1f
mov edx, dword [esp + 0x78]
mov ecx, dword [edx + 4]
mov dword [esp + 0x58], ecx
mov ecx, dword [edx + 8]
mov dword [esp + 0x50], ecx
lea edx, [ecx + 0x408]
mov dword [esp + 0x4c], edx
cmp dword [ecx + 0x408], 1
mov ecx, dword [esp + 0x188]
mov dword [esp + 0x194], ecx
mov edi, esi
mov ecx, dword [esp + 0x164]
mov ebx, dword [esp + 0x1e4]
ja 0x7a2a02
cmp eax, 0x10
jne 0x7a3057
mov dword [esp + 0x140], ecx
mov dword [esp + 0x160], edi
mov dword [esp + 0x1e4], ebx
mov dword [esp + 0x194], 0x12
mov byte [esp + 0x147], 0x31
mov dword [esp + 0xa0], 0
mov edx, dword [esp + 0x1e0]
test edx, edx
mov eax, dword [esp + 0x190]
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0xc8], ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xcc], edx
mov dword [esp + 0xec], eax
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x198], edx
je 0x7a06f1
mov eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1dc]
mov edx, dword [esp + 0x190]
cmp dword [esp + 0x194], 8
mov esi, dword [esp + 0xec]
mov dword [esp + 0x190], esi
mov esi, dword [esp + 0x19c]
mov dword [esp + 0x1dc], esi
mov esi, dword [esp + 0x198]
mov dword [esp + 0x1e0], esi
mov esi, dword [esp + 0x140]
mov dword [esp + 0x164], esi
jne 0x7a02aa
movzx esi, byte [esp + 0x1d2]
cmp esi, 0x11
je 0x7a2e7b
cmp esi, 0x25
je 0x7a2ed2
mov ebx, 0x10
cmp esi, 0x46
jne 0x7a2f3b
mov edi, edx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x1e0], eax
mov esi, dword [esp + 0x1d4]
mov eax, dword [esp + 0x164]
mov dword [esp + 0x164], eax
mov dword [esp + 0x190], edi
cmp ebx, 7
jne 0x7a2e56
mov dword [esp + 0x1d4], esi
mov esi, dword [esp + 0x160]
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov ebx, dword [esp + 0x1e4]
jmp 0x7a278a
mov edi, 0x10
mov byte [esp + 0x1d2], 0x46
mov eax, dword [esp + 0x90]
bt eax, esi
mov ebx, dword [esp + 0x1e4]
jb 0x7a2ebd
jmp 0x7a164c
mov edi, 0xb
mov byte [esp + 0x1d2], 0x23
mov esi, dword [esp + 0x90]
mov ebx, dword [esp + 0x1d4]
bt esi, ebx
mov dword [esp + 0x190], edx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x1e0], eax
mov esi, ebx
mov ebx, dword [esp + 0x1e4]
jb 0x7a2f78
cmp edi, 0xb
mov dword [esp + 0x1d4], esi
je 0x7a164c
jmp 0x7a2f78
mov edi, 0xb
mov byte [esp + 0x1d2], 0x25
mov esi, dword [esp + 0x90]
mov ebx, dword [esp + 0x1d4]
bt esi, ebx
mov dword [esp + 0x190], edx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x1e0], eax
mov esi, ebx
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
mov ebx, dword [esp + 0x1e4]
jae 0x7a164c
cmp edi, 9
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
je 0x79f30c
jmp 0x7a2f78
mov byte [esp + 0x1d2], 0x11
mov esi, dword [esp + 0x90]
mov edi, dword [esp + 0x1d4]
bt esi, edi
mov dword [esp + 0x190], edx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x1e0], eax
mov esi, edi
mov ebx, dword [esp + 0x1e4]
jae 0x7a164c
mov eax, 0x19
mov dl, byte [esp + 0x1d3]
movzx ecx, dl
cmp ecx, 0x44
je 0x7a1160
mov ecx, dword [esp + 0x188]
mov dword [esp + 0x194], ecx
mov byte [esp + 0x1d3], dl
cmp eax, 0xc
jne 0x7a2fe7
mov edi, 6
mov al, 0x29
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp], eax
call fcn.004936c0
mov dword [esp + 0x138], 0
mov dword [esp + 0x148], ebx
cmp edi, 3
jne 0x7a278a
jmp 0x7a2bb8
mov dword [esp + 0x1e4], ebx
mov ebx, 0x11
mov edi, 0xf
mov byte [esp + 0x1d3], 0x44
lea ecx, [esi + 0x41]
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x8c]
mov byte [eax], cl
mov ecx, dword [esp + 0x1c0]
mov byte [ecx], 0x3a
mov ecx, dword [esp + 0x1bc]
mov byte [ecx], 0
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 2
jne 0x7a3073
cmp ebx, 7
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
mov ebx, dword [esp + 0x1e4]
jne 0x7a11a0
jmp 0x7a164c
mov dword [esp + 0x164], ecx
mov esi, edi
mov eax, dword [esp + 0x188]
mov dword [esp + 0x194], eax
jmp 0x7a2bb8
cmp edi, 0xf
mov ebx, dword [esp + 0x1e4]
jne 0x7a1fc9
mov eax, dword [esp + 0x194]
mov dword [esp + 0x188], eax
jmp 0x7a164c