Function at 0x464a29
Capabilities:
Check for time delay via gettickcount
Encode data using base64
Get disk information
Inspect section memory permissions
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3c4
push ebx
push esi
lea eax, [ebp + 0x78]
push edi
push eax
mov dword [ebp - 0xb4], ecx
call fcn.0043e7bd
pop ecx
push 5
lea ecx, [ebp + 0x1c]
call fcn.00444f8a
push 0x14
lea ecx, [ebp - 0x1d4]
call fcn.00444f8a
lea ecx, [ebp - 0xbc]
call fcn.00444f6c
lea ecx, [ebp - 0xc8]
call fcn.00444f6c
lea ecx, [ebp - 0xd4]
call fcn.00444f6c
mov eax, dword [ebp + 0x78]
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 0x2c], eax
push 0x2c
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp + 0x30], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0x18], 0xfffc0000
mov dword [ebp + 0x60], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x60], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
mov byte [ebp - 0x59], bl
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x8b], bl
mov byte [ebp - 0x8c], bl
mov byte [ebp + 0x57], bl
mov byte [ebp + 0x54], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x8a], bl
mov byte [ebp + 0xb], bl
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x114], 0x1f4
call fcn.00447e0d
mov eax, dword [ebp - 0xc8]
mov word [eax], bx
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x464b7b
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x2c], eax
push 0x2c
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00447e0d
add esp, 0xc
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
mov byte [ebp + 0x11], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp - 0x91], 0xff
mov byte [ebp + 0x10], 0
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x89], 0
mov byte [ebp + 0x23], 0
mov byte [ebp + 0x6a], 0
mov byte [ebp + 0x47], 0
mov byte [ebp + 0x69], 0
mov byte [ebp + 0x6b], 0
mov byte [ebp + 0x55], 0
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x21], 0xff
mov byte [ebp - 9], 0xff
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x22], 0
mov dword [ebp - 0x68], 0xfffff000
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0xb8], esi
je 0x4655ff
push 6
lea eax, [ebp + 0x78]
push eax
push str._admin
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464c29
or byte [ebp + 0x11], 1
jmp 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push str._super
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464c49
or byte [ebp + 0x11], 2
jmp 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push str._devid
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464c69
or byte [ebp - 0x6a], 1
jmp 0x46557b
push 7
lea eax, [ebp + 0x78]
push eax
push str._devidx
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464c89
or byte [ebp - 0x6a], 2
jmp 0x46557b
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4c6bec
call fcn.00446fac
add esp, 0xc
test al, al
jne 0x4655ad
push 4
lea eax, [ebp + 0x78]
push eax
push str._usb
call fcn.00446fac
add esp, 0xc
test al, al
jne 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push str._hextp
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464cdf
or dword [ebp - 8], 1
jmp 0x46557b
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._phy
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464d01
or dword [ebp - 8], 2
jmp 0x46557b
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4cb86c
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464d21
or dword [ebp - 8], 0x10
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._drv
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464d40
or dword [ebp - 8], 8
jmp 0x46557b
push 5
lea eax, [ebp + 0x78]
push eax
push str._fill
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464d5f
or dword [ebp - 8], edi
jmp 0x46557b
push 5
lea eax, [ebp + 0x78]
push eax
push str._dvol
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464d7f
or byte [ebp - 7], 1
jmp 0x46557b
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4cb850
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464d9f
mov byte [ebp + 0x47], 1
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._xup
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464dbe
mov byte [ebp + 0x69], 1
jmp 0x46557b
push 5
lea eax, [ebp + 0x78]
push eax
push str._axup
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464dde
mov byte [ebp + 0x69], 0x21
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._hup
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464dfd
mov byte [ebp + 0x6b], 1
jmp 0x46557b
push 5
lea eax, [ebp + 0x78]
push eax
push str._ahup
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464e1d
mov byte [ebp + 0x6b], 0x21
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpt
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464e3c
mov byte [ebp + 0x55], 1
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._gptmini
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464e5b
mov byte [ebp + 0x55], 2
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._gpth
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464e7a
mov byte [ebp + 0x55], 4
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._mbr
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464e9c
mov byte [ebp - 0x8c], 1
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._cmp
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464ebb
mov byte [ebp - 0x5b], 1
jmp 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c6b94
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464ede
mov byte [ebp - 0x8b], 1
jmp 0x46557b
push 5
lea eax, [ebp + 0x78]
push eax
push str._fs0:
call fcn.0044709f
add esp, 0xc
test al, al
je 0x464f10
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0xb], 0x10
call fcn.004412d1
pop ecx
pop ecx
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._fs0
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464f2f
mov byte [ebp + 0xb], 0x10
jmp 0x46557b
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4cb7f8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464f52
mov byte [ebp - 0x8a], 1
jmp 0x46557b
push 2
lea eax, [ebp + 0x78]
push eax
push 0x4caf2c
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464f78
add dword [ebp - 0xa8], 0x100
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4cb7f0
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464f97
mov byte [ebp - 0x41], 1
jmp 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push str._lskip
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464fb7
or byte [ebp - 0x40], 0x40
jmp 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push str._locku
call fcn.00446fac
add esp, 0xc
test al, al
je 0x464fd7
mov byte [ebp + 0x54], 3
jmp 0x46557b
mov edi, dword [ebp + 0x78]
push 7
push edi
push str._locku:
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x464ff6
inc edi
mov byte [ebp + 0x54], 3
inc edi
jmp 0x46500e
push 6
push edi
push 0x4cb7d0
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x46506c
mov byte [ebp + 0x54], 1
add edi, 0xc
xor ecx, ecx
mov dword [ebp + 0x78], edi
mov cx, word [edi]
cmp cx, bx
je 0x465047
mov eax, ecx
call fcn.0043e785
test al, al
jne 0x465047
push ecx
call fcn.00414a48
add esp, 4
test al, al
jne 0x465047
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x30], edi
call fcn.00405b76
jmp 0x46519c
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405bdb
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405bdb
add esp, 0x10
jmp 0x4651ac
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4cb7c8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46508c
mov byte [ebp + 0x54], 1
jmp 0x46557b
push 6
lea eax, [ebp + 0x78]
push eax
push str._lockx
call fcn.00446fac
add esp, 0xc
test al, al
jne 0x464fce
push 6
lea eax, [ebp + 0x78]
push eax
push str._lock_
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4650cd
mov byte [ebp + 0x54], 0xf0
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
jmp 0x46557b
mov edi, dword [ebp + 0x78]
push 4
push edi
push 0x4cb7b0
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x46512f
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x465100
cmp ax, 0x3d
je 0x465100
call fcn.0043e785
test al, al
je 0x46512f
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
mov dword [ebp - 0xcc], ebx
je 0x46511b
mov dword [ebp - 0x20], 0x4cb7a8
jmp 0x4651ac
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
jmp 0x465192
push 4
push edi
push str._pbr
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x4651ba
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x46515f
cmp ax, 0x3d
je 0x46515f
call fcn.0043e785
test al, al
je 0x4651ba
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
lea eax, [ebp + 0x78]
mov dword [ebp - 0x20], ebx
push eax
je 0x465181
mov dword [ebp - 0xcc], 0x4c2892
call fcn.00405b76
pop ecx
jmp 0x4651ac
add dword [ebp + 0x78], 2
call fcn.0043e7bd
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405b76
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x4651ac
mov word [eax], bx
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
jmp 0x464f0a
push 9
push edi
push str._alignend
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x465241
lea ecx, [edi + 0x12]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x4651ea
cmp ax, 0x3d
je 0x4651ea
call fcn.0043e785
test al, al
je 0x465241
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
jne 0x465232
xor eax, eax
add ecx, 2
mov ax, word [ecx]
push eax
call fcn.00414a48
add esp, 4
test al, al
je 0x465560
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0044a93d
cmp dword [ebp - 0x78], ebx
pop ecx
pop ecx
jg 0x465560
jl 0x465232
cmp dword [ebp - 0x7c], ebx
ja 0x465560
mov dword [ebp - 0x7c], 0xfffffffe
mov dword [ebp - 0x78], esi
jmp 0x465560
push 6
push edi
push str._align
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x4652ef
lea ecx, [edi + 0xc]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x465275
cmp ax, 0x3d
je 0x465275
call fcn.0043e785
test al, al
je 0x4652ef
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], ecx
mov edi, ecx
call fcn.00405b76
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
cmp word [edi], 0x3d
pop ecx
pop ecx
je 0x4652a5
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
jmp 0x46557b
xor eax, eax
lea ecx, [edi + 2]
mov ax, word [ecx]
push eax
call fcn.00414a48
add esp, 4
test al, al
je 0x46557b
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0044a93d
cmp dword [ebp - 0xac], ebx
pop ecx
pop ecx
jg 0x46557b
jl 0x465294
cmp dword [ebp - 0xb0], ebx
ja 0x46557b
jmp 0x465294
push 6
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push str._clear
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465314
mov byte [ebp - 0x91], 1
jmp 0x46557b
push edi
lea eax, [ebp + 0x78]
push eax
push str._clean
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465333
mov byte [ebp - 9], 1
jmp 0x46557b
push 7
lea eax, [ebp + 0x78]
push eax
push str._clean_
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465353
mov byte [ebp - 9], 0
jmp 0x46557b
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c5408
call fcn.00446fac
add esp, 0xc
test al, al
jne 0x465577
push 4
lea eax, [ebp + 0x78]
push eax
push str._del
call fcn.00446fac
add esp, 0xc
test al, al
jne 0x465577
push 4
lea eax, [ebp + 0x78]
push eax
push str._raw
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4653ad
or dword [ebp - 8], 0x20
mov byte [ebp - 0x52], 1
jmp 0x46557b
push edi
push dword [ebp + 0x78]
push str._swap:
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x4653e6
add dword [ebp + 0x78], 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451e7f
test eax, eax
pop ecx
pop ecx
jl 0x467641
mov byte [ebp - 0x22], 1
jmp 0x46557b
push 5
push dword [ebp + 0x78]
push str._CHS
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x465485
add dword [ebp + 0x78], 0xa
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x30], edi
call fcn.00409344
xor eax, eax
mov ax, word [edi]
push eax
call fcn.00414a48
add esp, 0xc
test al, al
je 0x465440
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a93d
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x3a
jne 0x46545f
add dword [ebp - 0x30], 2
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a93d
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x3a
jne 0x46557b
add dword [ebp - 0x30], 2
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a93d
jmp 0x464f09
push 5
push dword [ebp + 0x78]
push str._IMG
call fcn.0043fc19
add esp, 0xc
test al, al
jne 0x465587
push edi
push dword [ebp + 0x78]
push str._SKIP
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x4654e3
add dword [ebp + 0x78], 0xc
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x48], 0x42
call fcn.00451e7f
mov al, byte [ebp - 0x48]
add esp, 0xc
mov byte [ebp - 0x64], al
jmp 0x46557b
push 4
push dword [ebp + 0x78]
push str._iv
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x465512
add dword [ebp + 0x78], 8
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451e7f
jmp 0x464f09
push edi
lea eax, [ebp + 0x78]
push eax
push str._cdrom
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465534
mov dword [ebp - 0x84], 8
jmp 0x46557b
push 7
lea eax, [ebp + 0x78]
push eax
push str._floppy
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465557
mov dword [ebp - 0x84], 0x10
jmp 0x46557b
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2d
jne 0x465587
lea eax, [ebp + 0x78]
push eax
call fcn.00405b76
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
jmp 0x464f09
mov byte [ebp + 0x10], 1
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
jne 0x464c09
cmp dword [ebp - 0x7c], 0xfffffffe
jne 0x4655ee
cmp dword [ebp - 0x78], esi
jne 0x4655ee
mov eax, dword [ebp - 0xb0]
cmp eax, 0xfffffff7
jne 0x4655e2
cmp dword [ebp - 0xac], esi
jne 0x4655e2
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
jmp 0x4655ff
push str.21:INDATA
lea ecx, [ebp - 0x64]
call fcn.0044e827
push dword [ebp + 0x78]
lea ecx, [ebp - 0x64]
call fcn.00444fd8
push dword [ebp - 0x64]
mov ecx, dword [ebp - 0xb4]
call fcn.004223de
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.0043e825
jmp 0x4699a6
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0xb0], 0xfffffff7
jne 0x46560f
cmp dword [ebp - 0xac], esi
jne 0x46560f
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xac], ebx
cmp dword [ebp - 0x7c], 0xfffffff7
jne 0x46562c
cmp dword [ebp - 0x78], esi
jne 0x46562c
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x78], eax
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4cb71c
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46574a
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4cb714
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465668
mov byte [ebp + 0x5f], 1
jmp 0x46574a
push edi
lea eax, [ebp + 0x78]
push eax
push str.part
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465687
mov byte [ebp + 0x5f], 2
jmp 0x46574a
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4cb710
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4656a7
mov byte [ebp + 0x5f], 3
jmp 0x46574a
push 5
lea eax, [ebp + 0x78]
push eax
push str.cdrom
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4656ce
mov byte [ebp + 0x5f], 4
mov dword [ebp - 0x84], 8
jmp 0x46574a
push 6
lea eax, [ebp + 0x78]
push eax
push str.floppy
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4656f5
mov byte [ebp + 0x5f], 5
mov dword [ebp - 0x84], 0x10
jmp 0x46574a
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4cb6f8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465712
mov byte [ebp + 0x5f], 6
jmp 0x46574a
push 6
lea eax, [ebp + 0x78]
push eax
push str.volume
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46572f
mov byte [ebp + 0x5f], 7
jmp 0x46574a
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4cb6ec
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46574a
mov byte [ebp + 0x5f], 8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2a4
mov byte [ebp + 0x68], 0
call fcn.00446fac
xor edi, edi
add esp, 0xc
inc edi
test al, al
je 0x46576e
mov byte [ebp + 0x57], 1
mov dword [ebp + 0x60], edi
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4cb6e8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x465789
mov byte [ebp + 0x57], 0x10
push 6
lea eax, [ebp + 0x78]
push eax
push str.update
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4657a6
mov byte [ebp + 0x68], 1
jmp 0x4657fb
push 7
lea eax, [ebp + 0x78]
push eax
push str.xupdate
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4657c3
mov byte [ebp + 0x68], 0x20
jmp 0x4657fb
push 7
lea eax, [ebp + 0x78]
push eax
push str.hupdate
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4657e0
mov byte [ebp + 0x68], 0x10
jmp 0x4657fb
push 8
lea eax, [ebp + 0x78]
push eax
push str.hupdatef
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4657fe
mov byte [ebp + 0x68], 0x18
mov dword [ebp + 0x60], edi
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
call fcn.00405b76
mov eax, dword [ebp + 0x78]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xbc]
call fcn.00445090
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2a
pop ecx
mov dword [ebp - 0xd0], ebx
jne 0x465847
inc eax
inc eax
mov dword [ebp - 0xd0], 0x40000000
mov dword [ebp + 0x78], eax
xor ecx, ecx
mov cx, word [eax]
mov edx, ecx
or edx, 0x20
cmp dx, 0x61
jne 0x46586d
mov dword [ebp - 0x88], 0x80
lea eax, [ebp + 0x78]
push eax
call fcn.00405b76
pop ecx
jmp 0x46588f
cmp cx, 0x2d
jne 0x465889
mov ax, word [eax + 2]
or ax, 0x20
cmp ax, 0x61
jne 0x465889
mov dword [ebp - 0x88], ebx
jmp 0x465861
mov dword [ebp - 0xd0], ebx
xor eax, eax
mov dword [ebp - 0x224], ebx
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4dd8d8
push edi
mov dword [ebp - 0x1b8], 0xebd0a0a2
mov word [ebp - 0x1b4], 0xb9e5
mov word [ebp - 0x1b2], 0x4433
mov byte [ebp - 0x1b0], 0x87
mov byte [ebp - 0x1af], 0xc0
mov byte [ebp - 0x1ae], 0x68
mov byte [ebp - 0x1ad], 0xb6
mov byte [ebp - 0x1ac], 0xb7
mov byte [ebp - 0x1ab], 0x26
mov byte [ebp - 0x1aa], 0x99
mov byte [ebp - 0x1a9], 0xc7
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x48], str.MS_Basic_Data
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x184], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp + 0x55], 0
jne 0x465978
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451e7f
pop ecx
pop ecx
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2d
jne 0x4659a7
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.00414a48
add esp, 4
test al, al
jne 0x4659a7
mov ecx, edx
mov byte [ebp - 0x89], 1
mov dword [ebp + 0x78], ecx
jmp 0x4659a7
push ebx
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453fac
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x18c], eax
jne 0x4659a4
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x4699a6
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2b
jne 0x4659b7
mov al, byte [ecx]
inc ecx
inc ecx
mov byte [ebp - 0x59], al
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2d
jne 0x4659c8
lea eax, [ebp + 0x78]
push eax
call fcn.00409344
jmp 0x4659dc
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044a9ed
pop ecx
mov dword [ebp - 0x194], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x40
pop ecx
mov byte [ebp - 0x43], 1
jne 0x4659f3
inc eax
inc eax
mov dword [ebp + 0x78], eax
mov byte [ebp - 0x43], 0
cmp word [eax], 0x2d
jne 0x465a04
lea eax, [ebp + 0x78]
push eax
call fcn.00409344
jmp 0x465a18
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044a9ed
pop ecx
mov dword [ebp - 0x184], eax
cmp byte [ebp + 0x55], 0
pop ecx
je 0x465a7e
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00453fac
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0044a93d
add esp, 0x14
cmp byte [ebp + 0xb], 0
mov dword [ebp - 0x190], eax
je 0x465a7e
mov ecx, dword [ebp - 0x168]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
jne 0x465a7e
mov eax, dword [ebp - 0x16c]
or dword [ebp - 0x168], edx
or byte [ebp + 0xb], 0x20
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x1cc], ebx
mov cx, word [eax]
cmp cx, 0x2d
je 0x465ad5
cmp byte [ebp + 0x55], 0
je 0x465ad5
cmp cx, bx
je 0x465ad5
mov dword [ebp - 0x1d0], eax
push ebx
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041a4ff
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x1cc]
add esp, 0xc
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x48], eax
mov word [eax + ecx*2], bx
cmp byte [ebp + 0x5f], 1
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x51], 0
je 0x465af0
cmp byte [ebp + 0x5f], 4
jge 0x465af0
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xbc]
push 5
push ebx
mov edi, ebx
push 0x4cb6a0
mov dword [ebp + 0x78], edi
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x465bd1
lea ecx, [ebx + 0xa]
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2a
mov edi, ecx
jne 0x465b71
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x3c]
add ecx, 2
push eax
mov dword [ebp - 0x3c], ecx
call fcn.0044a9ed
mov edi, dword [ebp - 0x3c]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x51], 1
jne 0x465b6c
lea eax, [ebp - 0xfc]
push eax
inc edi
lea eax, [ebp - 0x3c]
inc edi
push eax
mov dword [ebp - 0x3c], edi
call fcn.0044a9ed
mov edi, dword [ebp - 0x3c]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x51], 0x11
jne 0x465b6c
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x78], ecx
xor edx, edx
mov dx, word [ecx]
cmp dx, 0x5c
je 0x465ba1
cmp dx, 0x2f
je 0x465ba1
mov byte [ebp - 0x21], 1
jmp 0x465ba1
mov eax, edx
call fcn.0043e785
test al, al
jne 0x465ba6
cmp dx, 0x23
je 0x465ba6
inc ecx
inc ecx
mov dword [ebp + 0x78], ecx
mov dx, word [ecx]
test dx, dx
jne 0x465b88
sub ecx, edi
sar ecx, 1
test ecx, ecx
jle 0x465bc2
push ecx
push edi
lea ecx, [ebp - 0xd4]
call fcn.00445090
mov dword [ebp - 0x18], 0xfffc0000
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
mov edi, dword [ebp + 0x78]
pop ecx
jmp 0x465c11
push 2
push ebx
push 0x4cb69c
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x465beb
lea edi, [ebx + 4]
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.00414b24
test al, al
je 0x465c09
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004412d1
mov edi, dword [ebp + 0x78]
pop ecx
pop ecx
cmp word [ebx], 0
setne byte [ebp - 0x3f]
push 0
push 0x200
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
call fcn.004ae930
mov dword [ebp - 0x38], eax
mov ax, word [edi]
cmp ax, 0x23
mov dword [ebp - 0x34], edx
je 0x465c48
cmp ax, 0x3a
jne 0x465cec
cmp ax, 0x23
jne 0x465c4c
or byte [ebp - 7], 4
inc edi
inc edi
push 2
push edi
push 0x4cb698
mov dword [ebp + 0x78], edi
call fcn.0043fc19
push 2
push edi
push 0x4cb694
mov byte [ebp + 0x6a], al
call fcn.0043fc19
mov byte [ebp + 0x23], al
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
add esp, 0x18
neg al
sbb al, al
inc al
cmp byte [ebp + 0x6a], 0
mov byte [ebp - 0x44], al
jne 0x465c98
cmp word [edi], 0x2b
jne 0x465c98
inc edi
inc edi
mov byte [ebp - 0x3e], 1
mov dword [ebp + 0x78], edi
cmp byte [ebp + 0x23], 0
jne 0x465cbc
mov ax, word [edi]
cmp ax, 0x40
je 0x465cb3
cmp ax, 0x2d
je 0x465cb3
cmp ax, 0x3d
jne 0x465cbc
or dword [ebp - 8], 2
inc edi
inc edi
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.00414b24
test al, al
je 0x465cec
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00451e7f
test eax, eax
pop ecx
pop ecx
jle 0x465cec
xor eax, eax
cmp dword [ebp + 0x60], eax
mov byte [ebp - 0x42], 1
jne 0x465cec
mov byte [ebp + 0x6a], 1
jmp 0x465cf3
xor eax, eax
cmp dword [ebp + 0x60], eax
jg 0x465d09
cmp byte [ebp + 0x5f], 0
jg 0x465d09
cmp dword [ebp - 0x20], eax
jne 0x465d09
cmp dword [ebp - 0xcc], eax
mov dword [ebp + 0x58], eax
je 0x465d10
mov dword [ebp + 0x58], 1
cmp byte [ebp + 0x54], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
je 0x465d31
cmp dword [ebp + 0x58], eax
jne 0x465d31
cmp word [ebx], ax
jne 0x465d31
mov eax, 0xfffc0000
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 0xd4]
and word [ebp - 0x2d4], 0
cmp word [ebx], 0
lea edi, [ebp - 0x2d4]
mov dword [ebp - 0x30], edi
je 0x465d53
mov edi, ebx
mov dword [ebp - 0x30], edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x2d4]
push 0x4caa90
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp byte [ebp - 0x41], 0
jg 0x465da6
mov eax, dword [ebp - 0xc4]
or eax, dword [ebp - 0xc0]
jne 0x465da6
push 0x11
push edi
push str..PhysicalDrive
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x465da6
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
add edi, 0x22
push eax
mov dword [ebp - 0x1c], edi
call fcn.004483d5
pop ecx
pop ecx
cmp byte [ebp + 0x68], 0
jne 0x465db8
cmp byte [ebp + 0x69], 0
jne 0x465db8
cmp byte [ebp + 0x6b], 0
je 0x465dce
cmp dword [ebp - 0x18], 0
jge 0x465dce
cmp dword [ebp - 4], 0
jge 0x465dce
push 0x4dd8d8
jmp 0x46763b
and dword [ebp + 0x6c], 0
and dword [ebp], 0
cmp byte [ebp + 0x54], 0
mov edi, 0x80070057
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x3c], edi
mov byte [ebp + 0x64], 0
je 0x465ea9
cmp dword [ebp - 4], 0
jge 0x465e0b
cmp dword [ebp - 0x70], esi
jl 0x465e0b
jg 0x465e01
cmp dword [ebp - 0x74], esi
jbe 0x465e0b
cmp dword [ebp + 0x30], 0
je 0x465ea9
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x465e42
cmp word [eax], 0x2a
jne 0x465e42
xor eax, eax
mov al, byte [ebp + 0x54]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 4]
call fcn.00454182
and dword [ebp + 0x30], 0
or byte [0x4dd460], 0x20
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp], eax
mov byte [ebp + 0x64], 0x20
cmp dword [ebp - 4], 0
jge 0x465e5a
cmp dword [ebp - 0x70], esi
jl 0x465e5a
jg 0x465e54
cmp dword [ebp - 0x74], esi
jbe 0x465e5a
cmp dword [ebp + 0x30], 0
je 0x465ea9
push dword [ebp + 0x30]
xor eax, eax
mov al, byte [ebp + 0x54]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 4]
call fcn.00405754
mov dword [ebp], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x70]
add esp, 0x1c
cmp eax, esi
je 0x465ea2
or byte [ebp + 0x64], 0x10
or byte [0x4dd460], 0x10
jmp 0x465ea9
mov byte [0x4dd460], 0
cmp byte [ebp - 0x22], 0
jbe 0x4660d6
cmp byte [ebp + 0x55], 0
jne 0x4660d6
cmp dword [ebp - 0x18], 0
jge 0x465ecd
cmp word [ebx], 0
je 0x465f8a
mov eax, dword [ebp - 0x68]
test eax, eax
jle 0x465edd
cmp eax, dword [ebp + 0x60]
je 0x465f8a
cmp dword [ebp + 0x60], 4
jg 0x465f8a
cmp byte [ebp + 0x11], 2
jl 0x465f8a
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405c00
mov ebx, dword [ebp + 0x6c]
cmp ebx, esi
je 0x466029
push 0x800
push 1
push esi
push ebx
call fcn.00449e3e
mov esi, 0x200
push esi
push ebx
mov dword [ebp - 0x58], eax
call fcn.00442116
add esp, 0x18
cmp eax, esi
mov edi, eax
jge 0x465f41
mov edi, esi
lea eax, [edi + edi*2]
push eax
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x14], edi
call fcn.00444e15
mov eax, dword [ebp + 0x30]
lea esi, [eax + edi]
lea eax, [edi - 1]
not eax
and esi, eax
push 0
lea eax, [ebp - 0x50]
push eax
push edi
mov dword [ebp - 0x2c], esi
add esi, edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x465fa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x465f82
inc edi
lea ecx, [ebp + 0x30]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
push 0x4dd8d8
jmp 0x46897a
push 0x200
push esi
push dword [ebp - 0x2c]
call fcn.004145c5
dec dword [ebp - 0x68]
mov edi, dword [ebp - 0x68]
dec dword [ebp + 0x60]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp + 0x60]
or byte [ebp - 0x22], 2
shl edi, 4
lea eax, [eax + edi + 0x1be]
push 0x10
push eax
shl ebx, 4
lea eax, [esi + ebx + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
call fcn.004145c5
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x1be]
push 0x10
push eax
lea eax, [esi + edi + 0x1be]
push eax
call fcn.004145c5
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x34
test eax, eax
je 0x46604c
lea ecx, [ebp + 0x30]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
push 0x4dd8d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
jmp 0x4699a6
push dword [ebp + 0x14]
xor edi, edi
push esi
push dword [ebp - 0x2c]
mov dword [ebp], edi
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x466093
push edi
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46608a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x466087
xor eax, eax
inc eax
mov dword [ebp], eax
push dword [ebp + 0x6c]
call fcn.004427b0
pop ecx
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x47]
lea ecx, [ebp + 0x30]
or byte [ebp + 0x69], al
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x69]
or al, byte [ebp + 0x47]
je 0x4660b7
mov dword [ebp + 0x58], edi
call fcn.0043e825
jmp 0x468888
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
push 0x4dd8d8
jmp 0x46999d
and dword [ebp - 0x14], 0
cmp byte [ebp + 0x68], 0x10
jne 0x4660ed
test byte [ebp + 0x6b], 0x20
jne 0x468888
or esi, 0xffffffff
mov eax, dword [ebp - 0xbc]
xor ebx, ebx
cmp byte [ebp + 0x54], bl
je 0x466142
cmp dword [ebp + 0x58], ebx
jne 0x466142
cmp byte [ebp + 0x47], bl
jne 0x468888
cmp byte [ebp + 0x69], bl
jne 0x468888
cmp byte [ebp + 0x6b], bl
jne 0x468888
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
test eax, eax
je 0x46613a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x3c]
jmp 0x4699a6
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x468985
cmp dword [ebp - 0xcc], ebx
jne 0x468cf8
mov cl, byte [ebp + 0x5f]
cmp cl, 6
mov dword [ebp], 0x80070057
je 0x46911d
cmp cl, 1
je 0x46921c
cmp cl, 2
jne 0x466184
cmp byte [ebp - 0x41], 0
je 0x46925c
cmp cl, 8
jne 0x466193
cmp byte [ebp - 0x41], 0
je 0x4692bc
xor edi, edi
cmp cl, 3
mov dword [ebp + 0x50], edi
je 0x469352
cmp cl, 4
je 0x469e26
cmp cl, 5
je 0x469e26
cmp cl, 7
je 0x46941d
cmp byte [ebp + 0x23], 0
je 0x4661de
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x6a], 0
mov dword [ebp], ebx
je 0x4661ee
mov dword [ebp + 0x60], 5
cmp byte [ebp + 0x10], 0
je 0x466209
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
cmp byte [ebp - 0x3f], 0
je 0x466218
cmp dword [ebp - 4], ebx
jl 0x466ef8
cmp byte [ebp - 0x44], 0
je 0x466227
cmp dword [ebp + 0x60], ebx
jl 0x466ef8
test byte [ebp - 0x22], 2
jne 0x466230
dec dword [ebp + 0x60]
cmp byte [ebp + 0x55], 0
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], esi
mov byte [ebp + 0x13], 0
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x5a], 0
mov dword [ebp - 0x90], ebx
jne 0x466283
cmp dword [ebp - 0x60], ebx
jne 0x466283
mov eax, dword [ebp + 0x48]
or eax, dword [ebp + 0x4c]
jne 0x466283
mov eax, dword [ebp + 0x28]
or eax, dword [ebp + 0x2c]
jne 0x466283
mov byte [ebp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [ebp - 0x8a], 1
je 0x4662b5
cmp dword [ebp + 0x4c], ebx
jl 0x4662b5
jg 0x46629f
cmp dword [ebp + 0x48], ebx
jb 0x4662b5
cmp dword [ebp + 0x2c], ebx
jl 0x4662b5
jg 0x4662ac
cmp dword [ebp + 0x28], 1
jb 0x4662b5
mov dword [ebp + 0x14], 1
jmp 0x4662b8
mov dword [ebp + 0x14], ebx
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405c00
cmp dword [ebp + 0x6c], ebx
je 0x46951b
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.00442116
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp + 0x40], eax
jge 0x4662f6
mov dword [ebp + 0x40], edi
cmp dword [ebp + 0x14], ebx
je 0x466367
cmp dword [ebp + 0x4c], ebx
jl 0x46632e
jg 0x466307
cmp dword [ebp + 0x48], ebx
jb 0x46632e
mov eax, dword [ebp + 0x40]
push ebx
push ebx
push ebx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push ebx
push edi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004ae930
push edx
push eax
push dword [ebp - 4]
lea ecx, [ebp + 0x64]
call fcn.00442831
cmp byte [ebp + 0x6a], 0
jne 0x466367
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xc4]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc0]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043d922
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.0044286f
mov dword [ebp - 0x3c], ebx
push 0x800
push 1
push ebx
push dword [ebp + 0x6c]
call fcn.00449e3e
add esp, 0x10
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x58], eax
jl 0x4663b9
cmp byte [ebp + 0x68], 0x20
je 0x46638e
cmp byte [ebp + 0x68], 0x10
jne 0x466393
cmp eax, 0xb
je 0x4663b5
test byte [ebp + 0x69], 0x20
jne 0x4663b5
cmp byte [ebp + 0x69], 0
je 0x4663a4
cmp eax, 0xb
je 0x4663b5
test byte [ebp + 0x6b], 0x20
jne 0x4663b5
cmp byte [ebp + 0x6b], 0
je 0x4663b9
cmp eax, 0xb
jne 0x4663b9
or dword [ebp - 0x14], 1
cmp byte [ebp - 0x21], 0
jg 0x4663db
cmp byte [ebp + 0x47], 0
jne 0x4663d7
cmp byte [ebp + 0x68], 1
je 0x4663d7
cmp byte [ebp + 0x68], 0x20
je 0x4663d7
cmp byte [ebp + 0x69], 0
je 0x4663db
or dword [ebp - 0x14], 2
cmp byte [ebp + 0x68], 1
je 0x4663e7
cmp byte [ebp + 0x68], 0x20
jne 0x4663eb
or dword [ebp - 0x14], 4
mov cl, byte [ebp + 0x6b]
and cl, 0x20
jne 0x466409
cmp byte [ebp + 0x6b], 0
je 0x4663fe
cmp eax, 0xb
je 0x466409
test byte [ebp + 0x68], 0x10
je 0x46640d
cmp eax, 0xc
je 0x46640d
or dword [ebp - 0x14], 8
cmp byte [ebp - 0x21], 0
jg 0x466417
or dword [ebp - 0x14], 0x10
cmp byte [ebp + 0x68], 0x10
jne 0x466421
or dword [ebp - 0x14], 0x20
cmp byte [ebp + 0x54], 0
je 0x46642c
cmp dword [ebp + 0x58], ebx
jne 0x466430
or dword [ebp - 0x14], 0x40
cmp byte [ebp + 0x68], 0x18
jne 0x46643a
or byte [ebp - 0x14], 0x80
cmp eax, 0xc
jne 0x46644f
cmp byte [ebp + 0x69], 0
jne 0x46644b
cmp byte [ebp + 0x47], 0
je 0x46644f
or byte [ebp - 0x13], 1
cmp byte [ebp + 0x54], 0
je 0x46645a
cmp dword [ebp + 0x58], ebx
je 0x46646a
cmp byte [ebp + 0x68], 0x10
jne 0x466464
test cl, cl
jne 0x46646a
cmp byte [ebp + 0x68], 0
je 0x466472
mov dword [ebp + 0x58], ebx
jmp 0x468880
cmp dword [ebp - 0x60], 0xff
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], ebx
jg 0x469528
cmp byte [ebp + 0x6a], 0
jne 0x4664d6
cmp dword [ebp + 0x60], ebx
jge 0x4664d6
cmp dword [ebp + 0x4c], ebx
jg 0x469528
jl 0x4664aa
cmp dword [ebp + 0x48], ebx
jae 0x469528
cmp dword [ebp + 0x2c], ebx
jg 0x469528
jl 0x4664be
cmp dword [ebp + 0x28], ebx
jae 0x469528
cmp dword [ebp - 0x60], ebx
jge 0x469528
mov dword [ebp - 0x60], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
cmp byte [ebp + 0x6a], 0
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp + 0x30], eax
jne 0x46651b
cmp byte [ebp + 0x23], 0
jne 0x46651b
cmp eax, 4
jl 0x466b0c
cmp byte [ebp + 0x55], 0
jne 0x466b0c
cmp byte [ebp + 0x57], 0
jne 0x466b0c
cmp byte [ebp + 0x6a], 0
je 0x46653c
mov dword [ebp + 0x60], 4
cmp dword [ebp - 0x60], 5
je 0x466ef8
cmp dword [ebp - 0x60], 0xf
je 0x466ef8
push 0x100000
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0x58], ebx
call fcn.00402d14
lea eax, [ebp + 0x58]
push eax
push dword [ebp - 0x4c]
push dword [ebp + 0x6c]
call fcn.00442513
mov edx, dword [ebp + 0x58]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov edi, eax
jne 0x4665b6
cmp edx, ecx
jge 0x466589
cmp ecx, 4
jge 0x4665ae
cmp byte [ebp + 0x6a], 0
jne 0x4665b6
cmp byte [ebp + 0x23], 0
jne 0x4665b6
lea eax, [ecx + 1]
mov byte [ebp + 0x3b], 0
call fcn.004424f4
cmp eax, ebx
jle 0x4665ae
cmp eax, edx
jl 0x4665ed
cmp ecx, 4
jle 0x4665ed
lea ecx, [ebp - 0x4c]
jmp 0x466ef3
cmp byte [ebp + 0x23], 0
mov byte [ebp + 0x3b], 1
jne 0x4665e8
cmp byte [ebp + 0x6a], 0
je 0x4665ed
cmp dword [ebp - 0x60], ebx
jl 0x4665ae
cmp word [ebp - 0x88], bx
jle 0x4665e0
mov dword [ebp - 0x88], 0x80
jmp 0x4665ed
mov dword [ebp - 0x88], ebx
jmp 0x4665ed
cmp edx, 4
jle 0x4665ae
cmp edx, 4
jle 0x4665fd
lea eax, [edx - 4]
and eax, 0xfffffffc
mov dword [ebp + 0x34], eax
jmp 0x466600
mov dword [ebp + 0x34], ebx
cmp byte [ebp + 0x3b], 0
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x30], esi
jne 0x466620
cmp ecx, 4
jl 0x46661d
lea eax, [ecx*4 - 0x10]
mov dword [ebp + 0x34], eax
jmp 0x466620
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x24], esi
xor edx, edx
lea eax, [edi + 0x50]
mov cl, byte [eax]
cmp cl, 5
je 0x466634
cmp cl, 0xf
jne 0x466637
mov dword [ebp + 0x24], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x466628
cmp byte [ebp + 0x3b], 0
je 0x466651
cmp dword [ebp + 0x24], ebx
jl 0x4665ae
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
push 0
shl eax, 4
lea esi, [eax + edi + 0x30]
mov ebx, 0x200
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x1c], esi
push dword [esi + 8]
call fcn.004ae880
push 0
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0xec], eax
push dword [esi + 0x10]
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], edx
call fcn.004ae880
mov ebx, eax
mov eax, dword [ebp + 0x34]
lea eax, [eax + eax*8]
shl eax, 4
cmp byte [ebp + 0x23], 0
mov dword [ebp - 0x1f0], edx
lea esi, [eax + edi + 0x30]
je 0x46677d
mov eax, dword [ebp + 0x58]
xor esi, esi
cmp eax, 8
jne 0x4666d1
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0xe8]
jmp 0x466724
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + edi + 0x30]
lea eax, [edi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x466703
cmp cl, 0xf
je 0x466703
inc esi
add eax, 0x90
cmp esi, 4
jl 0x4666e4
lea ecx, [ebp - 0x4c]
jmp 0x467614
push 0
push 0x200
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.004ae880
mov ecx, eax
mov eax, dword [edi + 0x24]
xor edi, edi
sub ecx, eax
sbb edx, edi
test esi, esi
jl 0x4666fb
and dword [ebp - 0x24c], 0
xor eax, eax
add ecx, dword [ebp - 0xc4]
lea edi, [ebp - 0x248]
adc edx, dword [ebp - 0xc0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x24c]
push eax
push edx
push ecx
push dword [ebp + 0x6c]
call fcn.00453e82
and dword [ebp], 0
add esp, 0x14
cmp byte [ebp + 0x6b], 0
jne 0x466771
cmp byte [ebp + 0x69], 0
jne 0x466771
cmp byte [ebp + 0x47], 0
je 0x46954c
and dword [ebp + 0x58], 0
lea ecx, [ebp - 0x4c]
jmp 0x46887b
cmp dword [ebp + 0x58], 4
jg 0x46678b
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x3c], eax
jmp 0x4667b6
xor edx, edx
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x46679c
cmp cl, 0xf
jne 0x46679f
mov dword [ebp + 0x3c], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x466790
cmp byte [ebp + 0x3b], 0
jne 0x4667b6
mov eax, dword [ebp + 0x34]
add dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], 0
jge 0x4667c6
cmp byte [ebp + 0x6a], 0
je 0x4666fb
cmp byte [ebp + 0x3b], 0
je 0x4667d2
and dword [ebp + 0x30], 0
jmp 0x4667fc
xor edx, edx
lea eax, [esi + 0x260]
mov cl, byte [eax]
test cl, cl
jne 0x4667e4
test edx, edx
jne 0x4667f1
cmp cl, 5
je 0x4667f1
cmp cl, 0xf
je 0x4667f1
mov dword [ebp + 0x30], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x4667da
cmp byte [ebp + 0x3b], 0
jne 0x46680c
cmp dword [ebp + 0x30], 0
jl 0x4666fb
cmp byte [ebp + 0x6a], 0
je 0x466a3d
mov eax, dword [ebp + 0x34]
test eax, eax
jg 0x466820
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*8]
shl eax, 4
lea eax, [eax + edi + 0x30]
mov ecx, dword [eax + 8]
push 0
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 0xc]
push 0x200
push eax
push ecx
mov dword [ebp - 0x198], eax
call fcn.004ae880
cmp dword [ebp + 0x58], 4
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], edx
jle 0x46694b
cmp dword [ebp + 0x3c], 0
jge 0x46694b
cmp byte [esi + 0x20], 0
je 0x466902
mov eax, dword [ebp + 0x58]
cmp eax, 8
jle 0x466882
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x466885
mov eax, dword [ebp + 0x24]
push 0
lea eax, [eax + eax*8]
push 0x200
shl eax, 4
push dword [eax + edi + 0x3c]
push dword [eax + edi + 0x38]
call fcn.004ae880
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x164], eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 8]
push 0
adc ecx, dword [esi + 0xc]
push 0x200
push ecx
push eax
mov dword [ebp - 0x160], edx
call fcn.004ae880
mov ecx, eax
sub ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x1a8], ecx
mov ecx, edx
sbb ecx, dword [ebp - 0x178]
sub ebx, eax
mov dword [ebp - 0x1a4], ecx
mov ecx, dword [ebp - 0x1f0]
sbb ecx, edx
add ebx, dword [ebp - 0x17c]
adc ecx, dword [ebp - 0x178]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ecx
jmp 0x46698f
cmp dword [ebp + 0x34], 4
jne 0x469554
mov eax, dword [ebp + 0x24]
test eax, eax
jl 0x469554
mov ecx, dword [ebp - 0x1c]
cmp byte [ecx + 0x20], 0
je 0x469554
mov edx, dword [ebp - 0xe8]
or dword [ebp + 0x34], 0xffffffff
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], edx
jmp 0x466987
cmp dword [ebp + 0x34], 0
jle 0x466971
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
mov eax, dword [eax + 0x14]
adc eax, dword [ebp - 0x198]
push 0
push 0x200
push eax
push ecx
call fcn.004ae880
mov ecx, dword [ebp - 0x1f0]
sub ebx, eax
sbb ecx, edx
add ebx, dword [ebp - 0x17c]
adc ecx, dword [ebp - 0x178]
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
test ecx, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edx
jl 0x4666fb
jg 0x4669ad
test ebx, ebx
jbe 0x4666fb
cmp byte [ebp - 0x59], 0
je 0x4669b9
add dword [ebp + 0x48], eax
adc dword [ebp + 0x4c], edx
mov edi, eax
add edi, 1
mov esi, edx
adc esi, 0
cmp dword [ebp + 0x4c], esi
jg 0x4669d5
jl 0x4669cf
cmp dword [ebp + 0x48], edi
ja 0x4669d5
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], esi
sub ebx, dword [ebp + 0x48]
sbb ecx, dword [ebp + 0x4c]
add ebx, eax
adc ecx, edx
cmp dword [ebp + 0x2c], ecx
jl 0x4669f1
jg 0x4669eb
cmp dword [ebp + 0x28], ebx
jbe 0x4669f1
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ecx
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x4666fb
jg 0x466a07
cmp dword [ebp + 0x28], eax
jb 0x4666fb
cmp dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x58]
jle 0x466a1b
dec eax
and eax, 0xfffffffc
call fcn.00442503
inc eax
jmp 0x466a23
and eax, 0xfffffffc
call fcn.00442503
mov dword [ebp + 0x60], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0xe0]
jmp 0x466af7
mov eax, dword [ebp + 0x3c]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + edi + 0x30]
push 0
mov edi, 0x200
push edi
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004ae880
push 0
push edi
push dword [esi + 0x14]
mov ebx, eax
push dword [esi + 0x10]
mov eax, edx
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], eax
call fcn.004ae880
cmp byte [ebp - 0x59], 0
je 0x466a93
add dword [ebp + 0x48], ebx
mov ecx, dword [ebp - 0x1f8]
adc dword [ebp + 0x4c], ecx
xor esi, esi
cmp dword [ebp + 0x4c], esi
jl 0x466ab9
jg 0x466aa1
cmp dword [ebp + 0x48], esi
jbe 0x466ab9
mov ecx, dword [ebp - 0x1f8]
cmp dword [ebp + 0x4c], ecx
jg 0x466ab9
jl 0x466ab3
cmp dword [ebp + 0x48], ebx
ja 0x466ab9
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ecx
cmp dword [ebp + 0x2c], esi
jl 0x466aeb
jg 0x466ac5
cmp dword [ebp + 0x28], esi
jbe 0x466aeb
cmp dword [ebp + 0x2c], edx
jl 0x466ad7
jg 0x466ad1
cmp dword [ebp + 0x28], eax
jbe 0x466ad7
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], esi
jl 0x46955c
jg 0x466aeb
cmp dword [ebp + 0x28], esi
jb 0x46955c
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x174], ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x170], eax
call fcn.0043e825
xor ebx, ebx
mov edi, 0x200
cmp dword [ebp + 0x60], 4
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x170]
setge byte [ebp - 0x5c]
add eax, dword [ebp - 0xc4]
push ebx
adc ecx, dword [ebp - 0xc0]
push edi
push ecx
push eax
call fcn.004ae930
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edx
je 0x466b7f
cmp byte [ebp + 0x6a], 0
je 0x466b7f
push dword [ebp + 0x40]
mov eax, dword [ebp - 0xc4]
push dword [ebp + 0x2c]
add eax, dword [ebp + 0x48]
push dword [ebp + 0x28]
mov ecx, dword [ebp - 0xc0]
adc ecx, dword [ebp + 0x4c]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043d922
add esp, 0x18
lea ecx, [ebp + 0x64]
call fcn.0044286f
mov dword [ebp - 0x3c], ebx
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x10
cmp eax, dword [ebp - 0x128]
jne 0x469590
cmp edx, dword [ebp - 0x124]
jne 0x469590
mov esi, dword [ebp + 0x40]
lea eax, [esi + esi*2]
push eax
lea ecx, [ebp + 4]
call fcn.00402d14
mov eax, dword [ebp + 4]
push dword [ebp + 0x40]
lea edi, [eax + esi]
lea eax, [esi - 1]
not eax
and edi, eax
add esi, edi
push ebx
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp + 0x24], esi
call fcn.004ae820
add esp, 0xc
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x469588
push dword [ebp + 0x40]
push esi
push edi
call fcn.004145c5
add esp, 0xc
cmp byte [ebp + 0x57], 0
je 0x466cf5
cmp byte [ebp + 0x55], 0
jne 0x466cf5
push esi
call fcn.00442803
cmp byte [ebp - 9], 0
pop ecx
jg 0x466c46
jge 0x466c42
mov eax, dword [ebp + 0x40]
xor ecx, ecx
cmp dword [ebp - 0x34], ecx
lea eax, [eax + eax + 0x4000]
jg 0x466c46
jl 0x466c42
cmp dword [ebp - 0x38], eax
ja 0x466c46
xor al, al
jmp 0x466c48
mov al, 1
cmp byte [ebp + 0x57], 1
jne 0x466c86
test al, al
je 0x466c74
cmp dword [ebp + 0x40], 0x200
jbe 0x466c74
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
lea eax, [esi + 0x200]
push ebx
push eax
call fcn.004ae820
add esp, 0xc
push 0x40
lea eax, [esi + 0x1be]
push ebx
push eax
call fcn.004ae820
add esp, 0xc
push dword [ebp + 0x40]
mov word [esi + 0x1fe], 0xaa55
push esi
push edi
call fcn.0043e88e
add esp, 0xc
test eax, eax
je 0x466cd5
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x10
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
mov dword [ebp - 0x50], ebx
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
inc eax
mov dword [ebp], eax
mov al, byte [ebp + 0x6b]
or al, byte [ebp + 0x69]
or al, byte [ebp + 0x47]
je 0x46959d
cmp dword [ebp - 0x18], ebx
jl 0x46959d
mov dword [ebp + 0x58], ebx
jmp 0x468878
cmp byte [ebp + 0x5f], 2
je 0x466d11
cmp byte [ebp + 0x11], 0
jne 0x466d11
cmp byte [ebp - 0x42], 0
je 0x466d20
cmp dword [ebp + 0x60], 1
jle 0x466ef0
cmp byte [ebp - 0x42], 0
je 0x466d20
cmp dword [ebp + 0x60], ebx
jl 0x466ef0
push 0x200010
lea ecx, [ebp + 0x18]
call fcn.00402d14
xor esi, esi
cmp word [ebp - 0x88], bx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x50], ebx
mov byte [ebp + 0x56], 0xff
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
jl 0x466d60
mov esi, dword [ebp + 0x60]
inc esi
cmp word [ebp - 0x88], bx
jne 0x466d60
neg esi
movzx esi, si
mov eax, esi
or eax, dword [ebp - 0xd0]
push eax
lea eax, [ebp + 0x56]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x6c]
call fcn.0044add1
mov al, byte [ebp + 0x56]
add esp, 0x14
cmp esi, ebx
je 0x466d8f
test al, al
jge 0x4695c9
cmp al, 0x10
jl 0x466d95
and al, 0xf
test al, al
jl 0x466da8
mov al, byte [ebp + 0x6a]
or al, byte [ebp + 0x23]
or al, byte [ebp + 0x10]
jne 0x466ee8
cmp dword [ebp - 4], ebx
jl 0x466dcc
push dword [ebp + 0x6c]
mov esi, dword [ebp + 0x18]
call fcn.004422a0
pop ecx
push ebx
push dword [ebp + 0x40]
push edx
push eax
call fcn.004ae880
mov esi, dword [ebp - 0xf8]
jmp 0x466e33
mov esi, dword [ebp - 0xf8]
cmp esi, ebx
jl 0x466df2
jg 0x466de0
cmp dword [ebp - 0xfc], ebx
jb 0x466df2
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], esi
lea eax, [ebp - 0x270]
push eax
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x466e79
test byte [ebp - 0x270], 0x10
jne 0x466e79
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x250]
and eax, 0xfffffe00
xor edx, edx
shld edx, eax, 0x17
shl eax, 0x17
shr ecx, 9
xor edi, edi
or eax, ecx
or edx, edi
sub eax, dword [ebp - 0xc4]
sbb edx, dword [ebp - 0xc0]
cmp esi, ebx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], edx
jl 0x466e79
jg 0x466e59
cmp dword [ebp - 0xfc], ebx
jbe 0x466e79
cmp edx, esi
ja 0x466e79
jb 0x466e67
cmp eax, dword [ebp - 0xfc]
jae 0x466e79
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x6c]
call fcn.00442513
mov esi, eax
mov eax, dword [ebp - 0xd4]
mov cx, word [eax]
add esp, 0xc
cmp cx, bx
jne 0x466ea5
cmp esi, ebx
jne 0x466ea9
test byte [ebp + 0x57], 0x10
je 0x466ee8
cmp esi, ebx
je 0x466ead
mov eax, dword [esi]
jmp 0x466eaf
xor eax, eax
cmp eax, 1
sete byte [ebp + 0x56]
cmp byte [ebp + 0x56], 0
je 0x466ec9
cmp byte [ebp - 0x8c], 0
mov byte [ebp + 0x12], 1
je 0x466ecd
mov byte [ebp + 0x12], 0
cmp byte [ebp - 0x8b], 0
jne 0x466f0b
cmp byte [ebp + 0x57], 0
jne 0x466f0b
cmp byte [ebp + 0x12], 0
je 0x466f05
cmp byte [ebp + 0x55], 0
jne 0x466f0b
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
jmp 0x468995
cmp byte [ebp + 0x55], 0
jne 0x466ee8
cmp cx, bx
mov eax, dword [ebp - 0x140]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp + 0x34], eax
jne 0x466fd8
xor eax, eax
mov dword [ebp - 0x23c], ebx
lea edi, [ebp - 0x238]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
push 0x18
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x13c], ebx
jg 0x466f88
jl 0x466f72
cmp dword [ebp - 0x140], ebx
ja 0x466f88
mov eax, dword [ebp - 0x230]
mov dword [ebp + 0x58], eax
cdq
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
cmp dword [ebp - 0x144], ebx
jg 0x466fb0
jl 0x466f9a
cmp dword [ebp - 0x148], ebx
ja 0x466fb0
mov eax, dword [ebp - 0x22c]
mov dword [ebp + 0x3c], eax
cdq
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x134], ebx
jg 0x466fd8
jl 0x466fc2
cmp dword [ebp - 0x138], ebx
ja 0x466fd8
mov eax, dword [ebp - 0x228]
mov dword [ebp + 0x34], eax
cdq
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
cmp dword [ebp - 0x13c], ebx
jg 0x466ffe
jl 0x466fea
cmp dword [ebp - 0x140], ebx
ja 0x466ffe
mov eax, 0xff
mov dword [ebp + 0x58], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], ebx
cmp dword [ebp - 0x144], ebx
jg 0x467022
jl 0x467010
cmp dword [ebp - 0x148], ebx
ja 0x467022
push 0x3f
pop eax
mov dword [ebp + 0x3c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], ebx
cmp dword [ebp - 0x134], ebx
jg 0x467055
jl 0x467034
cmp dword [ebp - 0x138], ebx
ja 0x467055
mov eax, dword [ebp + 0x40]
cmp eax, ebx
mov dword [ebp + 0x34], eax
ja 0x467045
mov dword [ebp + 0x34], 0x200
mov eax, dword [ebp + 0x34]
cdq
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
mov eax, dword [ebp + 0x34]
cdq
mov edi, 0x200
mov ecx, edi
idiv ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x40]
lea ebx, [ecx + eax]
add eax, ebx
cmp byte [ebp + 0x12], 0
mov dword [ebp - 0x10], eax
jne 0x467a43
cmp byte [ebp + 0x55], 0
jne 0x467a43
cmp byte [ebp + 0x10], 0
mov byte [ebp + 0x56], 0
jne 0x467515
mov esi, dword [ebp + 0x4c]
xor eax, eax
cmp esi, eax
jg 0x4670b9
jl 0x4670a5
cmp dword [ebp + 0x48], eax
jae 0x4670b9
cmp dword [ebp + 0x2c], eax
jl 0x467515
jg 0x4670b9
cmp dword [ebp + 0x28], eax
jb 0x467515
mov ebx, dword [ebp + 0x60]
cmp ebx, eax
jl 0x467515
push 0x100000
lea ecx, [ebp - 0x2c]
call fcn.00402d14
mov eax, dword [ebp + 0x34]
imul eax, dword [ebp + 0x3c]
cdq
idiv edi
mov edi, eax
imul eax, dword [ebp + 0x58]
cmp dword [ebp + 0x34], 0
cdq
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], edx
jle 0x4695d6
mov eax, dword [ebp - 0xd4]
cmp word [eax], 0
jne 0x467136
and dword [ebp], 0
lea eax, [ebp]
push eax
push dword [ebp - 0x2c]
push dword [ebp + 0x6c]
call fcn.00442513
add esp, 0xc
test eax, eax
je 0x4695e3
cmp ebx, 4
jl 0x467136
cmp byte [ebp + 0x6a], 0
jne 0x467136
cmp ebx, dword [ebp]
jge 0x4695d6
xor edx, edx
xor eax, eax
cmp esi, edx
jl 0x4671e8
jg 0x46714d
cmp dword [ebp + 0x48], edx
jbe 0x4671e8
mov ecx, dword [ebp - 0xb0]
and ecx, dword [ebp - 0xac]
cmp ecx, 0xffffffff
jne 0x46718c
cmp esi, dword [ebp - 0xa0]
jl 0x467187
jg 0x467173
mov eax, dword [ebp + 0x48]
cmp eax, dword [ebp - 0xa4]
jb 0x467187
cmp byte [ebp - 0x5c], 0
jne 0x467187
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
jmp 0x4671d4
mov eax, edi
cdq
jmp 0x4671d2
cmp byte [ebp - 0x52], 0
jne 0x4671e8
mov eax, dword [ebp + 0x34]
cdq
mov ecx, eax
add ecx, dword [ebp - 0xb0]
mov edi, edx
adc edi, dword [ebp - 0xac]
push edx
sub ecx, 1
push eax
sbb edi, 0
push edi
push ecx
call fcn.004ae880
mov ecx, eax
mov eax, dword [ebp + 0x14]
mov edi, edx
cdq
push edx
push eax
push edi
push ecx
call fcn.004ae930
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
push edx
push eax
push esi
push dword [ebp + 0x48]
call fcn.0044270c
add esp, 0x10
add dword [ebp + 0x48], eax
adc esi, edx
mov dword [ebp + 0x4c], esi
xor ecx, ecx
cmp dword [ebp + 0x2c], ecx
jl 0x467217
jg 0x4671f6
cmp dword [ebp + 0x28], ecx
jbe 0x467217
cmp byte [ebp - 0x89], 0
jne 0x467217
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], ecx
jg 0x467217
jl 0x467211
cmp dword [ebp + 0x28], ecx
jae 0x467217
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
cmp esi, ecx
jl 0x467229
jg 0x467222
cmp dword [ebp + 0x48], ecx
jbe 0x467229
mov edi, dword [ebp + 0x48]
mov ebx, esi
jmp 0x46722d
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0x2c], 0
jl 0x4672cc
jg 0x467243
cmp dword [ebp + 0x28], 0
jbe 0x4672cc
mov eax, dword [ebp - 0x7c]
and eax, dword [ebp - 0x78]
cmp eax, 0xffffffff
jne 0x467269
push dword [ebp - 0xa0]
add edi, dword [ebp + 0x28]
push dword [ebp - 0xa4]
adc ebx, dword [ebp + 0x2c]
push ebx
push edi
call fcn.004b0c20
jmp 0x4672c6
cmp byte [ebp - 0x52], 0
jne 0x4672cc
mov eax, dword [ebp + 0x34]
cdq
mov esi, eax
add eax, dword [ebp - 0x7c]
mov ecx, edx
adc ecx, dword [ebp - 0x78]
push edx
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
mov dword [ebp - 0x14c], edx
call fcn.004ae880
push dword [ebp - 0x14c]
push esi
push edx
push eax
call fcn.004ae930
push 0
push 0x200
push edx
push eax
call fcn.004ae880
add edi, dword [ebp + 0x28]
push edx
adc ebx, dword [ebp + 0x2c]
push eax
push ebx
push edi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], edx
call fcn.004b0c20
mov esi, dword [ebp + 0x4c]
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp - 0x70], 0
mov byte [ebp + 0x56], 0
mov byte [ebp + 0x3b], 0
mov byte [ebp + 0x12], 0
jl 0x4673f6
jg 0x4672ee
cmp dword [ebp - 0x74], 0
jbe 0x4673f6
mov ecx, dword [ebp + 0x28]
sub ecx, dword [ebp - 0xe4]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x2c]
sbb edi, dword [ebp - 0xe0]
add ecx, dword [ebp + 0x48]
cdq
push edx
push eax
adc edi, esi
push edi
push ecx
call fcn.004ae880
and dword [ebp - 0x1c8], 0
mov ebx, eax
xor eax, eax
push 1
push dword [ebp + 0x58]
lea edi, [ebp - 0x1c4]
push dword [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1a8]
lea eax, [ebp + 0x12]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x56]
push eax
push dword [ebp - 0x1a4]
mov dword [ebp - 0x74], ebx
push edi
mov dword [ebp - 0x70], edx
call fcn.00442736
mov al, byte [ebp + 0x3b]
add esp, 0x20
push 1
push dword [ebp + 0x58]
mov byte [ebp - 0x1c7], al
mov al, byte [ebp + 0x12]
push dword [ebp + 0x3c]
mov byte [ebp - 0x1c6], al
mov al, byte [ebp + 0x56]
mov byte [ebp - 0x1c5], al
lea eax, [ebp + 0x12]
push eax
lea eax, [ebp + 0x3b]
push eax
lea eax, [ebp + 0x56]
push eax
push 0
push 2
push dword [ebp - 0x1a4]
mov byte [ebp - 0x1c8], 0
push edi
call fcn.004ae930
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.00442736
mov al, byte [ebp + 0x3b]
mov byte [ebp - 0x1c3], al
mov al, byte [ebp + 0x12]
mov byte [ebp - 0x1c2], al
mov al, byte [ebp + 0x56]
push 1
mov byte [ebp - 0x1c1], al
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp - 0x160]
mov byte [ebp - 0x1c4], 5
push dword [ebp - 0x164]
mov dword [ebp - 0x1c0], edi
push dword [ebp + 0x6c]
mov dword [ebp - 0x1bc], ebx
call fcn.00453e82
add esp, 0x34
mov eax, dword [ebp + 0x14]
cdq
mov ebx, edx
push ebx
mov edi, eax
push edi
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
call fcn.004ae880
test esi, esi
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], edx
jl 0x467445
jg 0x46742a
xor eax, eax
cmp dword [ebp + 0x48], eax
jb 0x467447
push ebx
push edi
push esi
push dword [ebp + 0x48]
call fcn.004ae880
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], edx
xor eax, eax
jmp 0x467453
xor eax, eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp + 0x2c], eax
jl 0x467474
jg 0x46745f
cmp dword [ebp + 0x28], eax
jb 0x467474
push ebx
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
call fcn.004ae880
mov dword [ebp - 0x118], edx
jmp 0x46747a
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
xor eax, eax
cmp dword [ebp + 0x60], 4
mov ebx, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xf4]
setge al
push eax
push dword [ebp + 0x58]
lea eax, [ebp + 0x13]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x120]
push eax
push ebx
push edi
call fcn.00442736
add esp, 0x20
test esi, esi
jl 0x4674d9
jg 0x4674c1
cmp dword [ebp + 0x48], 0
jbe 0x4674d9
sub edi, dword [ebp - 0x1dc]
sbb ebx, dword [ebp - 0x1d8]
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0xf0], ebx
mov al, byte [ebp - 0x5c]
mov byte [ebp + 0x56], al
movsx eax, al
push eax
push dword [ebp + 0x58]
lea eax, [ebp - 0x53]
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x5a]
push eax
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x11c]
lea eax, [edi + eax - 1]
push 0
push eax
call fcn.00442736
add esp, 0x20
lea ecx, [ebp - 0x2c]
call fcn.0043e825
mov edi, dword [ebp + 0x30]
mov esi, dword [ebp + 0x24]
shl edi, 4
cmp byte [ebp + 0x5f], 2
lea ebx, [edi + esi]
je 0x469608
push dword [ebp + 0x40]
push esi
push dword [ebp - 0x28]
call fcn.004145c5
add esp, 0xc
cmp dword [ebp - 0x70], 0
jl 0x467577
jg 0x467548
cmp dword [ebp - 0x74], 0
jb 0x467577
cmp dword [ebp + 0x30], 0
jle 0x467560
push edi
push 0
add esi, 0x1be
push esi
call fcn.004ae820
add esp, 0xc
push 0x30
pop eax
sub eax, edi
push eax
lea eax, [ebx + 0x1ce]
push 0
push eax
call fcn.004ae820
add esp, 0xc
cmp byte [ebp + 0x6a], 0
mov al, byte [ebx + 0x1c2]
jne 0x467591
cmp byte [ebp + 0x11], 2
jge 0x467591
cmp al, 5
je 0x467609
cmp al, 0xf
je 0x467609
cmp byte [ebp + 0x6a], 0
mov esi, dword [ebx + 0x1c6]
mov edi, dword [ebx + 0x1ca]
jne 0x46764b
test al, al
je 0x46764b
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x46764d
cmp byte [ebp + 0x11], 2
jge 0x46764d
cmp byte [ebp - 0x5c], al
jne 0x46764d
cmp dword [ebp + 0x4c], eax
jl 0x4675e9
jg 0x4675d9
cmp dword [ebp + 0x48], eax
jb 0x4675e9
cmp dword [ebp - 0xf4], esi
jne 0x467609
cmp dword [ebp - 0xf0], eax
jne 0x467609
cmp dword [ebp + 0x2c], eax
jl 0x46764d
jg 0x4675f5
cmp dword [ebp + 0x28], eax
jb 0x46764d
cmp dword [ebp - 0x11c], edi
jne 0x467605
cmp dword [ebp - 0x118], eax
je 0x46764d
cmp edi, eax
je 0x46764d
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
test eax, eax
je 0x467641
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0x80070057
jmp 0x4699a6
xor eax, eax
cmp byte [ebp + 0x10], 0
je 0x46766f
xor edi, edi
xor esi, esi
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, eax
jl 0x46767c
mov byte [ebx + 0x1c2], cl
mov ecx, dword [ebp - 0x88]
cmp cx, ax
jle 0x4676a9
cmp dword [ebp - 0xd0], eax
je 0x4676a9
mov edx, dword [ebp + 0x24]
lea eax, [edx + 0x1be]
mov byte [eax + 0x30], 0
mov byte [eax + 0x20], 0
mov byte [eax + 0x10], 0
mov byte [eax], 0
jmp 0x4676ac
mov edx, dword [ebp + 0x24]
test cx, cx
jl 0x4676b7
mov byte [ebx + 0x1be], cl
cmp dword [ebp + 0x4c], 0
jg 0x4676e7
jl 0x4676c5
cmp dword [ebp + 0x48], 0
jae 0x4676e7
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x467773
jg 0x4676db
cmp dword [ebp + 0x28], eax
jb 0x467773
mov eax, dword [ebp - 0x11c]
lea eax, [eax + esi - 1]
jmp 0x4676ff
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x46772f
jl 0x4676f5
cmp dword [ebp + 0x28], eax
jae 0x46772f
mov eax, dword [ebp - 0xf4]
lea eax, [eax + edi - 1]
movsx ecx, byte [ebp + 0x56]
push ecx
push dword [ebp + 0x58]
lea ecx, [ebp - 0x53]
push dword [ebp + 0x3c]
push ecx
lea ecx, [ebp - 0x5a]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push 0
push eax
call fcn.00442736
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp + 0x24]
add esp, 0x20
xor eax, eax
cmp dword [ebp + 0x4c], eax
jl 0x467767
jg 0x46773b
cmp dword [ebp + 0x48], eax
jb 0x467767
mov al, byte [ebp - 0x3d]
mov byte [ebx + 0x1bf], al
mov al, byte [ebp + 0x13]
mov byte [ebx + 0x1c0], al
mov al, byte [ebp - 0x120]
mov byte [ebx + 0x1c1], al
mov eax, dword [ebp - 0xf4]
mov dword [ebx + 0x1c6], eax
xor eax, eax
cmp dword [ebp + 0x2c], eax
jg 0x46777f
jl 0x467773
cmp dword [ebp + 0x28], eax
jae 0x46777f
cmp dword [ebp + 0x4c], eax
jl 0x46779f
jg 0x46777f
cmp dword [ebp + 0x48], eax
jb 0x46779f
mov al, byte [ebp - 0x5a]
mov byte [ebx + 0x1c3], al
mov al, byte [ebp - 0x53]
mov byte [ebx + 0x1c4], al
mov al, byte [ebp - 0x90]
mov byte [ebx + 0x1c5], al
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x4677b7
jg 0x4677ab
cmp dword [ebp + 0x28], eax
jb 0x4677b7
mov esi, dword [ebp - 0x11c]
mov dword [ebx + 0x1ca], esi
cmp dword [ebp - 0x60], eax
jge 0x4677d9
cmp cx, ax
jge 0x4677d9
cmp dword [ebp + 0x4c], eax
jg 0x4677d9
jl 0x4677cd
cmp dword [ebp + 0x48], eax
jae 0x4677d9
cmp dword [ebp + 0x2c], eax
jl 0x4677e7
jg 0x4677d9
cmp dword [ebp + 0x28], eax
jb 0x4677e7
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
cmp cx, ax
jge 0x467817
cmp dword [ebp - 0x60], eax
jge 0x467817
cmp dword [ebp + 0x4c], eax
jg 0x467817
jl 0x4677fd
cmp dword [ebp + 0x48], eax
jae 0x467817
cmp dword [ebp + 0x2c], eax
jg 0x467817
jl 0x467809
cmp dword [ebp + 0x28], eax
jae 0x467817
mov byte [edx + 0x1fe], 0x55
mov byte [edx + 0x1ff], 0xaa
xor esi, esi
push esi
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x10
cmp eax, dword [ebp - 0x128]
jne 0x4697b8
cmp edx, dword [ebp - 0x124]
jne 0x4697b8
mov eax, dword [ebp - 0x174]
or eax, dword [ebp - 0x170]
mov dword [ebp + 0x34], 1
jne 0x467867
push dword [ebp + 0x24]
call fcn.00442803
pop ecx
push dword [ebp + 0x40]
mov edi, dword [ebp + 0x24]
push edi
push dword [ebp - 0x28]
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x46789b
push esi
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x34], eax
call fcn.004427b0
pop ecx
cmp dword [ebp + 0x4c], esi
mov eax, dword [edi + 0x1b8]
mov dword [ebp - 0x1c], eax
jl 0x4679a0
jg 0x4678bc
cmp dword [ebp + 0x48], 0x200
jb 0x4679a0
cmp dword [ebp + 0x2c], 0
jl 0x4679a0
jg 0x4678d5
cmp dword [ebp + 0x28], 0x200
jbe 0x4679a0
cmp byte [ebp - 0x91], 0
jle 0x4679a0
push dword [ebp + 0x40]
push 0
push dword [ebp + 0x24]
call fcn.004ae820
add esp, 0xc
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004ae930
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov esi, eax
add ebx, esi
push 0
adc edi, edx
push edi
push ebx
push dword [ebp + 0x6c]
mov dword [ebp - 0x210], edx
call fcn.0043fb25
add esp, 0x10
cmp eax, esi
jne 0x46799c
cmp edx, dword [ebp - 0x210]
jne 0x46799c
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x40]
push dword [ebp - 0x28]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [ebp + 0x34], eax
je 0x46799c
mov eax, dword [ebp + 0x40]
cmp dword [ebp - 0x50], eax
jne 0x46799c
and dword [ebp + 0x34], 0
xor eax, eax
cmp dword [ebp + 0x34], eax
sete al
cmp byte [ebp + 0xb], 0
mov dword [ebp], eax
je 0x467a24
push 0
push 0x200
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004ae930
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
push eax
push edx
push ecx
add esi, 0x1b8
push str._04X_04X_04X
push dword [ebp + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0xc
push esi
push 3
push dword [ebp + 0x24]
mov edi, 0x80000002
push str.SYSTEMMountedDevices
push edi
call dword [0x4dd25c]
cmp byte [ebp + 0x69], 0
jne 0x467a1a
cmp byte [ebp + 0x6b], 0
jne 0x467a1a
cmp byte [ebp + 0x47], 0
je 0x46996b
cmp dword [ebp - 4], 0
jge 0x4697f3
cmp byte [ebp + 0x69], 0
jne 0x467a3a
cmp byte [ebp + 0x6b], 0
jne 0x467a3a
cmp byte [ebp + 0x47], 0
je 0x46996b
and dword [ebp + 0x58], 0
jmp 0x468870
cmp byte [ebp + 0x10], 0
je 0x467a4d
mov byte [ebp - 0x3e], 0
cmp byte [ebp + 0x56], 0
je 0x467a61
cmp byte [ebp + 0x57], 0
jne 0x467a61
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x24], eax
jmp 0x467a68
mov dword [ebp + 0x24], 0x80
mov eax, dword [ebp + 0x14]
cdq
mov edi, edx
push edi
mov esi, eax
push esi
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
call fcn.004ae880
push edi
push esi
push dword [ebp - 0xf8]
mov dword [ebp + 0x48], eax
push dword [ebp - 0xfc]
mov dword [ebp + 0x4c], edx
call fcn.004ae880
push edi
push esi
push dword [ebp + 0x2c]
mov dword [ebp - 0xfc], eax
push dword [ebp + 0x28]
mov dword [ebp - 0xf8], edx
call fcn.004ae880
mov esi, eax
sub esi, 1
mov edi, edx
sbb edi, 0
cmp byte [ebp - 0x43], 0
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], edi
je 0x467aed
mov esi, eax
add esi, dword [ebp + 0x48]
mov edi, edx
adc edi, dword [ebp + 0x4c]
sub esi, 1
sbb edi, 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], edi
and dword [ebp - 0xdc], 0
and dword [ebp - 0xd8], 0
cmp byte [ebp + 0x57], 1
jne 0x467b79
test byte [ebp - 0x51], 0x10
je 0x467b2b
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xf8]
mov esi, eax
sub esi, 1
mov edi, ecx
sbb edi, 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], edi
jmp 0x467b37
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x15c]
cmp dword [ebp + 0x4c], 0
jg 0x467b50
jl 0x467b45
cmp dword [ebp + 0x48], 1
jae 0x467b50
and dword [ebp + 0x4c], 0
mov dword [ebp + 0x48], 1
test edi, edi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], edi
jg 0x467b7f
jl 0x467b67
cmp esi, 1
jae 0x467b7f
sub eax, 1
sbb ecx, 0
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], ecx
cmp byte [ebp + 0x57], 0
je 0x467b87
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x4c]
jmp 0x467b8b
xor eax, eax
xor ecx, ecx
push dword [ebp - 0x34]
lea edx, [ebp - 0xdc]
push dword [ebp - 0x38]
push edx
push ecx
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x6c]
push dword [ebp + 0x24]
push dword [ebp + 0x18]
push eax
call fcn.00449ca0
add esp, 0x24
cmp byte [ebp + 0x56], 0
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
jne 0x467bd6
or eax, edx
jne 0x467bd6
and dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], 1
cmp dword [ebp - 0xd8], 0
jl 0x467609
jg 0x467bf2
cmp dword [ebp - 0xdc], 0x20
jb 0x467609
cmp byte [ebp + 0x5f], 2
mov eax, dword [ebp + 0x24]
je 0x4699e1
cmp dword [ebp + 0x60], eax
mov dword [ebp + 0x14], 1
jae 0x467c33
cmp dword [ebp - 0x68], eax
jge 0x467c33
cmp dword [ebp + 0x60], 0
jl 0x467c37
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x10]
push 0x10
push 0x4c8368
push eax
call fcn.0044523e
add esp, 0xc
test eax, eax
je 0x467c37
and dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x40]
xor edx, edx
lea eax, [ecx + 0x3fff]
div ecx
cmp byte [ebp + 0x57], 1
mov dword [ebp + 0x34], eax
jne 0x467f76
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x60], eax
jae 0x467609
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x30], edx
mov edx, dword [ebp - 0x130]
shl eax, 7
inc edx
imul edx, ecx
mov ecx, 0x4800
sub ecx, edx
cmp byte [ebp - 9], 0
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x1c], ecx
jg 0x467cb0
jge 0x467c9d
xor edx, edx
cmp dword [ebp - 0x34], edx
jg 0x467cb0
jl 0x467c9d
mov edx, dword [ebp + 0x40]
lea edx, [edx + edx + 0x4000]
cmp dword [ebp - 0x38], edx
ja 0x467cb0
xor edx, edx
test eax, eax
mov byte [ebp + 0x13], 0
mov dword [ebp - 0x28], edx
jle 0x467d53
jmp 0x467d02
cmp dword [ebp + 0x40], 0x200
mov byte [ebp + 0x13], 1
jbe 0x467cd9
mov eax, dword [ebp + 0x40]
add eax, 0xfffffe00
push eax
mov eax, dword [ebp + 0x18]
add eax, 0x200
push 0
push eax
call fcn.004ae820
add esp, 0xc
mov eax, dword [ebp + 0x40]
add eax, 0xffffffa4
push eax
lea eax, [ebx + 0x5c]
push 0
push eax
call fcn.004ae820
push 0x4000
push 0
push dword [ebp - 0x10]
call fcn.004ae820
add esp, 0x18
jmp 0x467d53
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jl 0x467d1c
push 0x10
push 0
push dword [ebp + 0x30]
call fcn.004ae820
add esp, 0xc
mov eax, 0x80
jmp 0x467d45
push 0x1b0
push 0
push dword [ebp + 0x30]
call fcn.004ae820
mov eax, dword [ebp + 0x30]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.004ae820
add esp, 0x18
mov eax, 0x200
add dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
add dword [ebp + 0x30], eax
cmp edx, dword [ebp + 0xc]
jl 0x467cff
push 0x38
push 0
push ebx
call fcn.004ae820
push 0x14
lea eax, [ebx + 0x48]
push 0
push eax
call fcn.004ae820
mov eax, dword [ebp + 0x18]
push 0x40
add eax, 0x1be
push 0
push eax
call fcn.004ae820
mov eax, dword [ebp + 0x18]
add esp, 0x24
cmp byte [ebp + 0x13], 0
mov word [eax + 0x1fe], 0xaa55
jne 0x467da0
cmp dword [ebp + 0x40], 0x200
jbe 0x467da0
mov word [ebx - 2], 0xaa55
push 8
push str.EFI_PART
push ebx
call fcn.004145c5
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp - 0xdc]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x4c]
push dword [ebp + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x34]
cdq
mov dword [ebp - 0x110], eax
add eax, dword [ebp + 0x48]
mov dword [ebp - 0x10c], edx
adc edx, dword [ebp + 0x4c]
add eax, 1
adc edx, 0
mov dword [ebx + 0x20], ecx
sub ecx, dword [ebp - 0x110]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xd8]
sbb eax, dword [ebp - 0x10c]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], eax
call fcn.00442803
lea eax, [ebx + 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0x10
cmp ecx, 0x20323354
jne 0x467e3c
cmp edx, 0x2020
je 0x467e76
cmp ecx, 0x20363154
jne 0x467e4c
cmp edx, 0x2020
je 0x467e76
mov esi, ecx
or esi, edx
je 0x467e70
cmp ecx, 0xffffffff
jne 0x467e5b
cmp edx, ecx
je 0x467e70
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
mov esi, ecx
or esi, edx
je 0x467e70
cmp ecx, 0xffffffff
jne 0x467e94
cmp edx, ecx
jne 0x467e94
mov esi, dword [ebp - 0x104]
push 0xc
push 0x4cb65c
push eax
call fcn.004145c5
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x1b8]
add esp, 0xc
mov dword [ebx + 0x44], eax
jmp 0x467e9a
mov esi, dword [ebp - 0x104]
lea eax, [ebx - 0x174]
push eax
call fcn.00442803
mov eax, dword [ebp + 0x48]
add eax, 1
pop ecx
mov ecx, dword [ebp + 0x4c]
adc ecx, 0
test edi, edi
mov dword [ebx + 0x48], eax
mov eax, 0x80
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
jg 0x467edd
jl 0x467ecf
cmp esi, 1
jae 0x467edd
or dword [ebp - 0x104], 0xffffffff
or dword [ebp - 0x100], 0xffffffff
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x18]
push 1
push dword [ebp + 0x58]
shl eax, 4
push dword [ebp + 0x3c]
lea edi, [eax + ecx]
lea eax, [edi + 0x1bf]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push dword [ebp + 0x4c]
mov dword [edi + 0x1c2], 0xee
push dword [ebp + 0x48]
call fcn.00442736
lea eax, [edi + 0x1c3]
add esp, 0x20
cmp byte [ebp + 0x55], 2
lea ecx, [eax + 1]
lea edx, [eax + 2]
mov byte [eax], 0xfe
mov byte [ecx], 0xff
mov byte [edx], 0xfe
jne 0x467f52
push 1
push dword [ebp + 0x58]
push dword [ebp + 0x3c]
push ecx
push eax
push edx
push dword [ebp - 0x100]
push dword [ebp - 0x104]
call fcn.00442736
add esp, 0x20
mov eax, dword [ebp + 0x48]
mov dword [edi + 0x1c6], eax
add edi, 0x1ca
or dword [edi], 0xffffffff
cmp byte [ebp + 0x55], 2
jne 0x46828a
mov eax, dword [ebp - 0x104]
mov dword [edi], eax
cmp byte [ebp + 0x57], 0
jg 0x46828a
cmp byte [ebp - 0x5b], 0
jle 0x467f90
cmp dword [ebp + 0x60], 0
jl 0x46828a
cmp byte [ebp + 0x6a], 0
je 0x467fef
or dword [ebp + 0x60], 0xffffffff
xor esi, esi
cmp dword [ebp + 0x24], esi
mov byte [ebp - 0x3e], 0
jbe 0x467fef
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x90], eax
mov edi, 0x80
push 0x10
push 0x4c8368
push dword [ebp - 0x90]
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x467fda
add dword [ebp - 0x90], edi
inc esi
cmp esi, dword [ebp + 0x24]
jb 0x467fb3
jmp 0x467fef
mov dword [ebp + 0x60], esi
push edi
shl esi, 7
add esi, dword [ebp - 0x10]
push 0
push esi
call fcn.004ae820
add esp, 0xc
mov eax, dword [ebp + 0x24]
dec dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
jae 0x467609
cmp dword [ebp - 0x68], eax
jge 0x467609
cmp byte [ebp - 0x3e], 0
je 0x468107
xor ecx, ecx
cmp byte [ebp + 0x56], cl
je 0x468064
mov eax, dword [ebp - 0x10]
add eax, 0x20
cmp ecx, dword [ebp + 0x24]
jae 0x468064
mov edx, dword [eax]
cmp edx, dword [ebp + 0x48]
jne 0x468032
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x4c]
je 0x46803a
inc ecx
add eax, 0x80
jmp 0x46801e
mov edx, dword [ebp - 0x10]
mov eax, ecx
shl eax, 7
add eax, edx
cmp ecx, dword [ebp + 0x60]
mov esi, 0x4c8368
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x468064
push 0x80
push 0
push eax
call fcn.004ae820
add esp, 0xc
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x10]
shl eax, 7
push 0x10
add eax, ecx
push 0x4c8368
push eax
mov dword [ebp - 0x1c], eax
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x4680f1
mov edi, dword [ebp + 0x60]
inc edi
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jae 0x467609
mov esi, edi
shl esi, 7
add esi, dword [ebp - 0x10]
push 0x10
push 0x4c8368
push esi
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x4680c3
inc edi
add esi, 0x80
cmp edi, dword [ebp + 0x24]
mov dword [ebp + 0x3c], edi
jb 0x46809e
jmp 0x4680e5
cmp edi, dword [ebp + 0x60]
jle 0x4680e5
mov eax, dword [ebp + 0x3c]
mov edi, eax
shl edi, 7
add edi, dword [ebp - 0x10]
sub eax, dword [ebp + 0x60]
dec eax
lea edx, [edi - 0x80]
push 0x20
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, edx
jne 0x4680d6
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x3c], eax
jae 0x467609
push 0x80
push 0
push dword [ebp - 0x1c]
call fcn.004ae820
add esp, 0xc
and dword [ebp + 0x14], 0
cmp byte [ebp + 0x57], 1
je 0x46826b
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp eax, ecx
jge 0x468224
cmp dword [ebp + 0x14], ecx
jne 0x46814a
xor eax, eax
inc eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x18c], ecx
jle 0x468167
mov edi, dword [ebp + 0x60]
shl edi, 7
add edi, dword [ebp - 0x10]
lea esi, [ebp - 0x1b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x180], ecx
jle 0x468188
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x10]
shl eax, 7
lea edi, [eax + ecx + 0x10]
lea esi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x194], ecx
mov eax, dword [ebp - 0x10]
jle 0x4681a7
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x48]
shl edx, 7
mov dword [edx + eax + 0x20], esi
mov esi, dword [ebp + 0x4c]
mov dword [edx + eax + 0x24], esi
cmp dword [ebp - 0x184], ecx
jle 0x4681c9
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x104]
shl edx, 7
mov dword [edx + eax + 0x28], esi
mov esi, dword [ebp - 0x100]
mov dword [edx + eax + 0x2c], esi
cmp dword [ebp - 0x190], ecx
jle 0x4681eb
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x16c]
shl edx, 7
mov dword [edx + eax + 0x30], esi
mov esi, dword [ebp - 0x168]
mov dword [edx + eax + 0x34], esi
cmp dword [ebp - 0x188], ecx
jle 0x46826b
mov eax, dword [ebp - 0x48]
cmp word [eax], 0
je 0x46826b
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0x10]
shl eax, 7
push 0x48
lea esi, [eax + ecx + 0x38]
push 0
push esi
call fcn.004ae820
add esp, 0xc
push 0x24
push dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x46826b
cmp eax, dword [ebp + 0x60]
je 0x46826b
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp - 0x10]
shl ecx, 7
lea edx, [ecx + eax]
push 0x20
pop ecx
mov esi, edx
lea edi, [ebp - 0x354]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x68]
shl ecx, 7
add eax, ecx
push 0x20
pop ecx
mov esi, eax
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp + 0x60], eax
push 0x20
pop ecx
lea esi, [ebp - 0x354]
rep movsd dword es:[edi], dword [esi]
jge 0x46826b
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x10], 0
je 0x46828a
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0x10]
push 0x80
push 0
push eax
call fcn.004ae820
add esp, 0xc
mov al, byte [ebp + 0xb]
and dword [ebp + 0x14], 0
and al, 0x20
mov byte [ebp - 0x3d], al
je 0x4682a3
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x120], eax
jmp 0x4682ad
mov dword [ebp - 0x120], 0xfffffff8
cmp byte [ebp - 0x5b], 1
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x1c], eax
jne 0x4683e7
cmp byte [ebp + 0x57], 1
je 0x4683e7
mov eax, dword [ebp + 0x24]
xor esi, esi
dec eax
cmp eax, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x90], esi
jl 0x4683e7
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x58], eax
xor edi, edi
push 0x10
push 0x4c8368
push dword [ebp + 0x30]
call fcn.0044523e
add esp, 0xc
test al, al
mov byte [ebp + 0x13], al
jne 0x468310
cmp esi, dword [ebp - 0x28]
mov dword [ebp + 0xc], edi
je 0x468317
mov dword [ebp + 0xc], 1
cmp esi, dword [ebp - 0x120]
mov dword [ebp + 0x3c], edi
jne 0x46832f
mov eax, dword [ebp - 0x28]
mov dword [ebp + 0x3c], 2
mov dword [ebp - 0x1c], eax
cmp byte [ebp + 0x13], 0
jne 0x46839c
cmp esi, dword [ebp - 0x28]
je 0x468390
push 0x38
push dword [ebp + 0x30]
push dword [ebp + 0x58]
call fcn.004b0db0
add esp, 0xc
test eax, eax
je 0x468365
push 0x38
push dword [ebp + 0x30]
mov dword [ebp + 0x3c], 1
push dword [ebp + 0x58]
call fcn.004aeed0
add esp, 0xc
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x58]
push 0x24
add esi, 0x38
push esi
add edi, 0x38
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
je 0x468390
push 0x24
push esi
push edi
mov dword [ebp + 0x3c], 1
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
inc dword [ebp - 0x28]
add dword [ebp + 0x58], 0x80
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x4683bc
cmp byte [ebp + 0x13], 0
jne 0x4683bc
push 0x10
push edi
push dword [ebp + 0x30]
mov dword [ebp + 0x3c], 1
call fcn.004ae820
add esp, 0xc
cmp dword [ebp + 0x3c], edi
mov esi, dword [ebp - 0x90]
je 0x4683cd
lea eax, [esi + 1]
mov dword [ebp + 0x14], eax
add dword [ebp + 0x30], 0x80
inc esi
cmp esi, dword [ebp - 0x108]
mov dword [ebp - 0x90], esi
jle 0x4682ef
push 8
push str.EFI_PART
push ebx
call fcn.004145c5
push dword [ebp + 0x18]
call fcn.00442803
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, eax
add esp, 0x10
or edx, ecx
je 0x468414
cmp eax, 0xffffffff
jne 0x468421
cmp ecx, eax
jne 0x468421
lea eax, [ebx - 0x174]
push eax
call fcn.00442803
pop ecx
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x14], eax
jg 0x46842d
inc eax
mov dword [ebp + 0x14], eax
cmp byte [ebp + 0x57], 1
jne 0x468439
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x24]
xor edi, edi
push edi
shl eax, 7
push edi
push eax
push dword [ebp - 0x10]
call fcn.0049ab96
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0xc]
add esp, 0x10
cmp eax, 0x20000
mov dword [ebp - 0x28], eax
ja 0x469bba
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.0049ab96
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x10]
push ebx
add esi, 0x10000
push esi
mov dword [ebx + 0x10], eax
call fcn.004145c5
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x24], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [esi + 0x10], edi
push esi
call fcn.0049ab96
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x34]
mov esi, dword [ebp + 0x40]
add esp, 0x2c
inc eax
imul eax, esi
push eax
lea ecx, [ebp - 0x80]
call fcn.00402d14
mov eax, dword [ebp - 0x80]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x14]
shl eax, 7
lea eax, [eax + esi - 1]
xor edx, edx
div esi
push edi
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x38]
imul eax, esi
mov dword [ebp - 0x108], eax
call fcn.0040f8cc
push esi
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cdf
push esi
push dword [ebp + 0x18]
push dword [ebp - 0x80]
call fcn.004b0db0
add esp, 0xc
test eax, eax
je 0x468530
push edi
push dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x38]
call fcn.0040f8cc
push esi
push dword [ebp + 0x18]
lea ecx, [ebp + 0x6c]
call fcn.0043e647
mov eax, dword [ebp - 0x108]
xor edx, edx
div esi
mov ecx, dword [ebp - 0x12c]
push edi
xor edx, edx
push edx
push esi
push ecx
mov dword [ebp + 0x40], ebx
mov dword [ebp - 0x98], ecx
inc eax
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0x130]
push eax
mov dword [ebp - 0x9c], eax
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
mov eax, dword [ebp + 0x30]
imul eax, esi
push eax
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cdf
cmp dword [ebp + 0x30], edi
mov dword [ebp + 0x3c], edi
jle 0x46866d
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x30]
jge 0x4685cf
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0db0
add esp, 0xc
test eax, eax
jne 0x4685cc
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x30]
jl 0x46859b
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebp + 0x34]
jge 0x46866d
mov ecx, dword [ebp + 0x40]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x20c], ecx
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x208], ecx
jmp 0x468624
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0db0
add esp, 0xc
test eax, eax
je 0x468629
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x30]
jl 0x4685f8
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x208]
push dword [ebp - 0x20c]
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.0043e647
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x3c], eax
jl 0x468593
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp - 0xdc]
cdq
sub ecx, eax
mov eax, dword [ebp - 0xd8]
sbb eax, edx
mov edx, dword [ebp - 0x80]
mov dword [ebp + 0x58], edx
mov edx, dword [ebp - 0x10]
push edi
mov dword [ebp + 0x40], edx
xor edx, edx
push edx
push esi
push eax
push ecx
mov dword [ebp - 0x204], ecx
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], eax
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
mov eax, dword [ebp + 0x34]
imul eax, esi
push eax
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cdf
cmp dword [ebp + 0x34], edi
mov dword [ebp + 0x3c], edi
jle 0x4687bb
mov eax, dword [ebp + 0x34]
cmp dword [ebp + 0x3c], eax
jge 0x4687bb
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0db0
add esp, 0xc
test eax, eax
jne 0x46871c
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x34]
jl 0x4686eb
mov eax, dword [ebp + 0x34]
cmp dword [ebp + 0x3c], eax
jge 0x4687bb
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1e0], eax
push esi
push dword [ebp + 0x40]
push dword [ebp + 0x58]
call fcn.004b0db0
add esp, 0xc
test eax, eax
je 0x468777
inc dword [ebp + 0x3c]
add dword [ebp - 0x9c], 1
mov eax, dword [ebp + 0x3c]
adc dword [ebp - 0x98], edi
add dword [ebp + 0x40], esi
add dword [ebp + 0x58], esi
cmp eax, dword [ebp + 0x34]
jl 0x468746
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0x1e0]
push dword [ebp - 0x1e4]
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0xc]
call fcn.0043e647
mov eax, dword [ebp + 0x34]
cmp dword [ebp + 0x3c], eax
jl 0x4686df
xor eax, eax
push eax
push esi
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
call fcn.004ae930
add eax, dword [ebp - 0x38]
push edi
adc edx, dword [ebp - 0x34]
lea ecx, [ebp + 0x6c]
push edx
push eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], edx
call fcn.0040f8cc
push esi
push dword [ebp - 0x80]
lea ecx, [ebp + 0x6c]
call fcn.00402cdf
mov eax, dword [ebp - 0x10]
add eax, 0x10000
push esi
push eax
push dword [ebp - 0x80]
mov dword [ebp + 0x14], eax
call fcn.004b0db0
add esp, 0xc
test eax, eax
je 0x468836
push edi
push dword [ebp - 0x1e8]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x1ec]
call fcn.0040f8cc
push esi
push dword [ebp + 0x14]
lea ecx, [ebp + 0x6c]
call fcn.0043e647
movsx ecx, byte [ebp + 0x69]
movsx eax, byte [ebp + 0x6b]
or eax, ecx
movsx ecx, byte [ebp + 0x47]
or eax, ecx
cmp byte [ebp - 0x3d], 0
je 0x46885d
cmp eax, edi
je 0x469dea
cmp dword [ebp - 4], edi
jge 0x469bee
cmp eax, edi
je 0x469dea
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x58], edi
call fcn.0043e825
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
xor cl, cl
cmp byte [ebp + 0x54], cl
je 0x468895
cmp dword [ebp + 0x58], 0
jne 0x4688a3
mov al, byte [ebp + 0x68]
cmp al, 0x10
mov cl, 0x40
jne 0x4688a6
add cl, 0x20
jmp 0x4688a6
mov al, byte [ebp + 0x68]
cmp dword [ebp - 4], 0
jl 0x4688e7
cmp al, 0x20
je 0x4688b4
cmp al, 0x10
jne 0x4688ba
cmp dword [ebp - 0x58], 0xb
je 0x4688de
test byte [ebp + 0x69], 0x20
jne 0x4688de
cmp byte [ebp - 0x21], 0
jg 0x468910
cmp byte [ebp - 0x21], 0
jg 0x468910
cmp byte [ebp + 0x47], 0
jne 0x468901
cmp al, 1
je 0x468901
or cl, 2
cmp al, 1
je 0x46890c
test byte [ebp + 0x6b], 0x20
jne 0x46892c
cmp byte [ebp + 0x6b], 0
je 0x468922
or cl, 8
push dword [ebp - 0x30]
movsx eax, cl
or dword [ebp - 0x14], eax
lea eax, [ebp]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x6c]
push dword [ebp - 4]
push eax
call fcn.00454215
mov edi, eax
add esp, 0x18
test edi, edi
jl 0x4660ea
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
test eax, eax
je 0x4699a6
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4699a6
cmp dword [ebp - 0x18], ebx
jge 0x4689b1
mov eax, dword [ebp - 0xd4]
cmp word [eax], bx
jne 0x4689b1
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
jmp 0x467638
mov edi, 0x1b8
mov dword [ebp + 0x58], edi
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
cmp word [ecx], bx
je 0x468b0d
push dword [ebp - 0x20]
push 0x4cb658
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x468b0d
push dword [ebp - 0x20]
push 0x4c7450
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x468b0d
mov edi, dword [ebp - 0x20]
push edi
push 0x4cb654
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x468a29
mov dword [ebp - 0x3c], 0x4db368
mov dword [ebp + 0x58], 0x190
jmp 0x468b29
push edi
push 0x4cb650
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x468a4d
mov dword [ebp - 0x3c], 0x4db4f8
mov dword [ebp + 0x58], 0x180
jmp 0x468b29
mov dword [ebp + 0x58], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
jne 0x468a84
lea eax, [ebp - 0xa4]
push eax
inc edi
lea eax, [ebp - 0x20]
inc edi
push eax
mov dword [ebp - 0x20], edi
call fcn.0044a93d
mov edi, dword [ebp - 0x20]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x468a84
inc edi
inc edi
cmp word [edi], 0x23
jne 0x468ac2
push edi
lea ecx, [ebp + 0xc]
call fcn.0044e827
push ebx
lea eax, [ebp - 0x1a0]
push eax
push str.EXEDATA
push dword [ebp + 0xc]
push ebx
call fcn.004155b1
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
call fcn.0043e825
mov eax, dword [ebp - 0x19c]
mov dword [ebp + 0x58], eax
jmp 0x468ad9
lea eax, [ebp + 0x58]
push eax
push ebx
push edi
call fcn.00410198
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0xa0], ebx
jl 0x468b17
jg 0x468aeb
cmp dword [ebp - 0xa4], ebx
jb 0x468b17
xor eax, eax
cmp eax, dword [ebp - 0xa0]
jl 0x468b17
jg 0x468b02
mov eax, dword [ebp + 0x58]
cmp eax, dword [ebp - 0xa4]
jbe 0x468b17
mov eax, dword [ebp - 0xa4]
mov dword [ebp + 0x58], eax
jmp 0x468b17
mov dword [ebp - 0x3c], 0x4db678
mov dword [ebp + 0x58], edi
cmp dword [ebp + 0x58], ebx
jbe 0x468cd1
cmp dword [ebp - 0x3c], ebx
je 0x468cd1
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405c00
cmp dword [ebp + 0x6c], ebx
je 0x468cd1
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.00442116
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x468b65
mov edi, esi
mov ecx, dword [ebp + 0x58]
lea eax, [edi - 1]
add ecx, eax
not eax
and ecx, eax
cmp ecx, edi
mov dword [ebp + 0x14], ecx
mov ebx, ecx
jge 0x468b7c
mov ebx, edi
lea eax, [edi + ebx*2]
push eax
lea ecx, [ebp - 0x48]
call fcn.00444e15
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc4]
lea esi, [edi - 1]
add eax, edi
not esi
and esi, eax
xor eax, eax
xor edx, edx
or ecx, dword [ebp - 0xc0]
lea edi, [esi + ebx]
je 0x468bbb
push edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x10
cmp eax, dword [ebp - 0x38]
jne 0x468cac
cmp edx, dword [ebp - 0x34]
jne 0x468cac
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x468cac
push dword [ebp + 0x14]
push edi
push esi
call fcn.004145c5
mov ecx, dword [ebp + 0x58]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x468c03
mov ecx, eax
mov ebx, dword [ebp - 0x3c]
push ecx
push ebx
push edi
call fcn.004145c5
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x58]
add esp, 0xc
cmp eax, 0x200
jbe 0x468c45
add eax, 0xfffffe00
push eax
add ebx, 0x200
lea eax, [edi + 0x200]
push ebx
push eax
call fcn.004145c5
add esp, 0xc
push dword [ebp + 0x14]
push edi
push esi
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x468c94
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x10
cmp eax, dword [ebp - 0x38]
jne 0x468cac
cmp edx, dword [ebp - 0x34]
jne 0x468cac
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.004427b0
test esi, esi
pop ecx
je 0x468cac
lea ecx, [ebp - 0x48]
call fcn.0043e825
lea ecx, [ebp - 0x1a0]
call fcn.0043e825
jmp 0x469795
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x468cb9
inc edi
lea ecx, [ebp - 0x48]
call fcn.0043e825
lea ecx, [ebp - 0x1a0]
call fcn.0043e825
jmp 0x46895c
lea ecx, [ebp - 0x1a0]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
jmp 0x4697e7
cmp dword [ebp + 0x60], ebx
jle 0x468995
cmp dword [ebp - 0x18], ebx
jge 0x468d15
mov eax, dword [ebp - 0xd4]
cmp word [eax], bx
je 0x468995
xor eax, eax
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp + 0xc], esi
jge 0x468d34
xor al, al
jne 0x468d5c
jmp 0x468995
push dword [ebp - 0x64]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x60]
push dword [ebp - 0x18]
push eax
call fcn.00463d79
add esp, 0x1c
cmp dword [ebp + 0xc], ebx
jle 0x468cdc
mov edi, dword [ebp - 0xcc]
mov dword [ebp - 0x20], 0x200
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
cmp word [edi], bx
je 0x468ef5
push edi
push 0x4cb658
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x468ef5
push edi
push 0x4c7450
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x468ef5
push edi
push 0x4cb650
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x468dc6
push 8
jmp 0x468ef7
push edi
push str.nt6fat
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x468ef1
push edi
push str.winfat
call fcn.0043fc58
test al, al
pop ecx
pop ecx
jne 0x468ef1
push edi
push 0x4cb654
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x468e08
push 6
jmp 0x468ef7
push edi
push str.nt5fat
call fcn.0043fc58
test al, al
pop ecx
pop ecx
je 0x468e20
push 5
jmp 0x468ef7
mov dword [ebp - 0x20], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
jne 0x468e60
lea eax, [ebp - 0xa4]
push eax
inc edi
lea eax, [ebp - 0xcc]
inc edi
push eax
mov dword [ebp - 0xcc], edi
call fcn.0044a93d
mov edi, dword [ebp - 0xcc]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x468e60
inc edi
inc edi
cmp word [edi], 0x23
jne 0x468e9e
push edi
lea ecx, [ebp + 0xc]
call fcn.0044e827
push ebx
lea eax, [ebp - 0x154]
push eax
push str.EXEDATA
push dword [ebp + 0xc]
push ebx
call fcn.004155b1
add esp, 0x14
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x58], eax
call fcn.0043e825
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x20], eax
jmp 0x468eb5
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
call fcn.00410198
add esp, 0xc
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0xa0], ebx
jl 0x468ee7
jg 0x468ec7
cmp dword [ebp - 0xa4], ebx
jb 0x468ee7
xor eax, eax
cmp eax, dword [ebp - 0xa0]
jl 0x468ee7
jg 0x468ede
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xa4]
jbe 0x468ee7
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x58], ebx
jne 0x468f20
jmp 0x468f93
push 7
jmp 0x468ef7
push 9
pop eax
push ebx
lea ecx, [ebp - 0x154]
push ecx
push 0x4c2578
push eax
push ebx
call fcn.004155b1
add esp, 0x14
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x58], eax
je 0x468f93
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jbe 0x468f93
cmp dword [ebp - 0x58], ebx
je 0x468f93
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
call fcn.00405c00
cmp dword [ebp + 0x6c], ebx
je 0x468f93
push ebx
push 0x200
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
call fcn.004ae930
mov esi, eax
add esi, dword [ebp - 0x110]
mov edi, edx
adc edi, dword [ebp - 0x10c]
push ebx
push edi
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], edi
call fcn.0043fb25
add esp, 0x10
cmp eax, esi
jne 0x468f93
cmp edx, edi
je 0x468f9e
lea ecx, [ebp - 0x154]
jmp 0x468cd7
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.00442116
cmp eax, edi
pop ecx
pop ecx
jl 0x468fb4
mov edi, eax
mov ecx, dword [ebp - 0x20]
lea eax, [edi - 1]
lea esi, [eax + ecx]
not eax
and esi, eax
lea eax, [edi + esi*2]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00444e15
mov eax, dword [ebp - 0xd0]
lea ebx, [edi - 1]
add eax, edi
push 0
not ebx
and ebx, eax
lea eax, [ebp - 0x50]
push eax
push esi
lea edi, [ebx + esi]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x469029
lea ecx, [ebp - 0xd0]
call fcn.0043e825
lea ecx, [ebp - 0x154]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
test eax, eax
jmp 0x4697e7
push esi
push edi
push ebx
call fcn.004145c5
push 0
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
push dword [ebp + 0x6c]
call fcn.0043fb25
add esp, 0x1c
cmp eax, dword [ebp - 0xec]
jne 0x468ff7
cmp edx, dword [ebp - 0xe8]
jne 0x468ff7
mov eax, dword [ebp - 0x20]
push 3
push dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
push edi
call fcn.004145c5
mov eax, 0x1fe
add esp, 0xc
cmp dword [ebp - 0x48], eax
jle 0x46907b
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0xffffffe2
push eax
mov eax, dword [ebp - 0x58]
add eax, 0x1e
push eax
lea eax, [edi + 0x1e]
push eax
call fcn.004145c5
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x200
jbe 0x4690cb
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x58]
add eax, 0x200
push eax
lea eax, [edi + 0x200]
push eax
call fcn.004145c5
add esp, 0xc
push esi
push edi
push ebx
mov dword [ebp + 0x34], 1
call fcn.0044523e
add esp, 0xc
test eax, eax
jne 0x4690fd
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x34], eax
call fcn.004427b0
pop ecx
xor eax, eax
cmp dword [ebp + 0x34], eax
lea ecx, [ebp - 0xd0]
sete al
mov edi, eax
call fcn.0043e825
lea ecx, [ebp - 0x154]
jmp 0x468cc7
push 0x103c
lea ecx, [ebp + 0x1c]
call fcn.00444fb1
mov ecx, dword [ebp - 0xbc]
mov esi, dword [ebp + 0x1c]
mov ax, word [ecx]
add esi, 0x2000
cmp ax, bx
mov edi, 0x4c3048
je 0x469189
cmp word [ecx + 2], 0x3a
jne 0x469189
movzx eax, ax
push eax
push 0x4cb628
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x46917d
cmp dword [ebp - 0x84], 0x10
jne 0x4691d4
mov edi, 0x4c3018
cmp eax, 5
jne 0x4691d4
mov edi, 0x4c3038
jmp 0x4691d4
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jl 0x4691d4
cmp dword [ebp - 0x84], 8
jne 0x4691ad
push eax
push str..CDROM_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x4c3038
jmp 0x4691d1
cmp dword [ebp - 0x84], 0x10
jne 0x4691c4
and eax, 0xfff
mov esi, eax
mov edi, 0x4c3018
jmp 0x4691d4
push eax
push 0x4caa90
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
movzx eax, word [ebp - 0xa8]
push edi
or eax, 0x20
push eax
push dword [ebp + 0x1c]
push esi
call fcn.0045324f
mov ecx, dword [ebp - 0xb4]
add esp, 0x10
push dword [ebp + 0x1c]
push dword [ebp - 0xc8]
call fcn.00444692
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
jmp 0x4697ac
cmp byte [ebp - 0x3f], 0
je 0x46922b
cmp dword [ebp - 4], ebx
jl 0x469eed
mov al, byte [ebp - 0x40]
neg al
sbb eax, eax
and eax, 0x200000
or eax, dword [ebp - 4]
or eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00463273
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
xor eax, eax
cmp word [ecx], bx
sete al
mov dword [ebp], eax
jmp 0x469eed
cmp dword [ebp - 4], ebx
jl 0x469295
cmp byte [ebp - 0x44], 0
je 0x46926c
cmp dword [ebp + 0x60], ebx
jl 0x469295
push dword [ebp - 0x64]
movsx eax, byte [ebp - 0x40]
or eax, dword [ebp - 8]
push ebx
push ebx
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 4]
push eax
call fcn.00463d79
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp], ecx
cmp dword [ebp - 0xb8], ebx
jle 0x469f0b
mov eax, dword [ebp - 0xb8]
and eax, 0x9fffffff
or eax, 0x10000000
mov dword [ebp - 0xb8], eax
jmp 0x469eed
cmp dword [ebp - 0x18], ebx
jge 0x46931a
cmp word [eax], bx
je 0x46931a
cmp word [eax + 2], 0x3a
jne 0x469317
cmp word [eax + 4], bx
jne 0x469317
mov word [ebp - 0x2d4], 0x5c
mov word [ebp - 0x2d2], 0x5c
mov word [ebp - 0x2d0], 0x2e
mov word [ebp - 0x2ce], 0x5c
mov ax, word [eax]
mov word [ebp - 0x2cc], ax
mov word [ebp - 0x2ca], 0x3a
mov word [ebp - 0x2c8], bx
lea eax, [ebp - 0x2d4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jl 0x469eed
cmp byte [ebp - 0x44], 0
je 0x469332
cmp dword [ebp + 0x60], ebx
jl 0x469eed
push dword [ebp - 0x84]
lea eax, [ebp + 0x1c]
push dword [ebp - 4]
push eax
push dword [ebp - 0xb4]
call fcn.00453c76
add esp, 0x10
jmp 0x469254
movzx edi, word [eax]
and edi, 0xffffffdf
cmp dword [ebp - 0x84], ebx
lea esi, [edi - 0x41]
jle 0x4693cf
push 0x3b60
lea ecx, [ebp + 0xc]
call fcn.00444e15
mov eax, dword [ebp + 0xc]
mov ecx, edi
shl ecx, 0x10
or ecx, dword [ebp - 0x84]
lea ebx, [eax + 0x200]
push ecx
push eax
push ebx
call fcn.0045366e
imul esi, esi, 0x220
add esi, ebx
add esp, 0xc
cmp dword [esi + 8], 0
jle 0x4693c0
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.00444fb1
push edi
push dword [esi + 4]
push str._d__c:
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
and dword [ebp], 0
lea ecx, [ebp + 0xc]
call fcn.0043e825
xor ebx, ebx
jmp 0x469ee5
mov cx, word [eax]
mov edx, dword [ebp + 0x1c]
mov word [edx], cx
cmp word [eax], 0x5c
jne 0x4693e1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
je 0x469ee5
push dword [ebp - 0x64]
mov eax, dword [ebp - 8]
push ebx
and eax, 0xfffffffd
push ebx
or eax, 0xc
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push dword [ebp - 4]
push eax
call fcn.00463d79
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp], ecx
jmp 0x469ee5
cmp dword [ebp - 0x18], ebx
jge 0x469497
cmp word [eax], bx
je 0x469494
cmp word [eax + 2], 0x3a
jne 0x469482
cmp word [eax + 4], 0x5c
jne 0x46943f
cmp word [eax + 6], bx
jne 0x46943f
mov word [eax + 4], bx
cmp word [eax + 4], bx
jne 0x469482
push 9
lea ecx, [ebp + 0x50]
call fcn.00444fb1
mov edi, dword [ebp + 0x50]
mov eax, dword [ebp - 0xbc]
mov word [edi], 0x5c
mov word [edi + 2], 0x5c
mov word [edi + 4], 0x2e
mov word [edi + 6], 0x5c
mov ax, word [eax]
mov word [edi + 8], ax
mov word [edi + 0xa], 0x3a
mov word [edi + 0xc], bx
jmp 0x469494
push esi
push dword [ebp - 0xbc]
lea ecx, [ebp + 0x50]
call fcn.00445090
mov edi, dword [ebp + 0x50]
mov dword [ebp + 0x60], esi
cmp dword [ebp + 0x60], ebx
jg 0x46949f
mov dword [ebp + 0x60], esi
test byte [ebp - 0x6a], 1
mov eax, dword [ebp + 0x60]
je 0x4694ac
or dword [ebp - 8], 0x20
test word [ebp - 8], 0x402
je 0x4694de
cmp dword [ebp - 0x18], ebx
jl 0x4694de
cmp dword [ebp + 0x60], ebx
jle 0x4694de
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
push dword [ebp + 0x60]
mov word [eax], bx
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00463d79
add esp, 0x1c
mov ecx, dword [ebp - 8]
and eax, 0xf000ffff
shl ecx, 0x10
push edi
or eax, ecx
push eax
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00404eed
add esp, 0x10
cmp eax, ebx
je 0x46950f
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
mov dword [ebp], ebx
jne 0x469ee5
mov dword [ebp], 0x80070057
jmp 0x469ee5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x469947
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
jmp 0x466131
lea ecx, [ebp - 0x4c]
jmp 0x469788
lea ecx, [ebp - 0x4c]
jmp 0x4695f6
lea ecx, [ebp - 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, esi
jmp 0x467638
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
jmp 0x468cdc
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
jmp 0x46999a
and eax, 0x10
shr eax, 4
mov edi, eax
jmp 0x469937
lea ecx, [ebp - 0x2c]
call fcn.0043e825
jmp 0x467609
lea ecx, [ebp - 0x2c]
call fcn.0043e825
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
jmp 0x46900d
push 0x28
lea ecx, [ebp + 0x1c]
call fcn.00444fb1
mov esi, dword [ebp + 0x60]
mov ebx, dword [ebp + 0x1c]
xor ecx, ecx
test esi, esi
push 4
mov dword [ebp - 0xa8], 0x4c1a3c
pop eax
jl 0x46963e
lea edx, [esi + 1]
cmp edx, eax
mov ecx, esi
jge 0x469636
mov eax, edx
cmp esi, eax
jge 0x46974a
mov esi, dword [ebp + 0x24]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ecx + 1]
mov dword [ebp - 0x64], edx
mov edx, ecx
shl edx, 4
sub eax, ecx
lea esi, [edx + esi + 0x1c6]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x60], 0
mov al, byte [esi - 4]
mov byte [ebp - 0x43], al
jge 0x4696b0
cmp al, 5
je 0x469677
cmp al, 0xf
mov ecx, 0x4c1a3c
jne 0x46967c
mov ecx, 0x4cb624
xor edx, edx
test al, al
setne dl
lea edx, [edx + edx - 1]
imul edx, dword [ebp - 0x64]
push edx
push ecx
push dword [ebp - 0xa8]
push str._s_s_d
push ebx
call edi
add esp, 0x14
lea ebx, [ebx + eax*2]
mov dword [ebp - 0xa8], 0x4c2568
jmp 0x46973b
test al, al
je 0x46973b
push dword [ebp - 0x64]
push dword [ebp - 0xa8]
push str._s_d
push ebx
call edi
add esp, 0x10
test byte [ebp - 8], 1
lea ebx, [ebx + eax*2]
mov eax, str._0x_X
jne 0x4696df
mov eax, 0x4cb5f4
movzx ecx, byte [ebp - 0x43]
push ecx
push eax
push ebx
call edi
lea ebx, [ebx + eax*2]
movzx eax, byte [esi - 8]
shr eax, 7
push eax
push 0x4cb5f4
push ebx
call edi
lea ebx, [ebx + eax*2]
mov eax, dword [esi]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.0049c16d
add esp, 0x28
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2]
mov eax, dword [esi + 4]
mov ecx, 0x200
mul ecx
push str.__I64u
push edx
push eax
push ebx
call fcn.0049c16d
add esp, 0x10
inc dword [ebp - 0x64]
add esi, 0x10
dec dword [ebp + 0xc]
jne 0x46965e
cmp dword [ebp - 0xb8], 0
jle 0x469769
push dword [ebp - 0xb8]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xb4]
call fcn.00449f34
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xb4]
push dword [ebp - 0xc8]
call fcn.00444692
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
test eax, eax
je 0x46599d
push eax
jmp 0x465997
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, esi
je 0x466044
push eax
jmp 0x46603e
push dword [ebp - 0x30]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x6c]
push dword [ebp - 4]
push eax
call fcn.00454215
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x60]
xor ebx, ebx
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x6c], ebx
jl 0x4698f1
mov ecx, dword [ebp + 0x1c]
push ebx
push ebx
push ebx
push 0x202
inc eax
push eax
push dword [ebp - 4]
lea eax, [ebp + 0x1c]
push eax
mov word [ecx], bx
call fcn.00463d79
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x108], eax
jle 0x4698f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x114], ebx
mov dword [ebp - 0x1c], eax
jle 0x469867
mov dword [ebp - 0x114], ebx
mov ebx, dword [ebp - 0x108]
push 0
or ebx, 0x100000
push ebx
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call fcn.00404eed
add esp, 0x10
test eax, eax
mov dword [ebp - 0x6c], eax
jne 0x4698bb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x1388
ja 0x4698b5
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x6c]
lea ebx, [eax + 0x78]
add eax, 0x7a
push eax
mov word [ebx], 0x23
call fcn.0043e722
mov eax, dword [ebp + 0x24]
pop ecx
pop ecx
push 0xc
push esi
push 3
push ebx
push str.SYSTEMMountedDevices
push edi
mov word [eax + 0x7c], 0x3f
call dword [0x4dd25c]
xor ebx, ebx
cmp dword [ebp - 0x114], ebx
jge 0x469904
cmp dword [ebp - 0x6c], ebx
je 0x46992d
cmp dword [ebp - 0x114], ebx
jle 0x46991e
cmp dword [ebp - 0x6c], ebx
jne 0x46991e
mov ecx, dword [ebp - 0xb4]
push ebx
push ebx
push dword [ebp - 0x114]
call fcn.004161d8
push dword [ebp + 0x24]
push str.SYSTEMMountedDevices
push edi
call dword [0x4dd260]
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jge 0x469937
mov edi, dword [ebp]
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
jmp 0x468973
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
test eax, eax
je 0x4699a3
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp]
lea ecx, [ebp - 0xd4]
call fcn.0043e825
lea ecx, [ebp - 0xc8]
call fcn.0043e825
lea ecx, [ebp - 0xbc]
call fcn.0043e825
lea ecx, [ebp - 0x1d4]
call fcn.0043e825
lea ecx, [ebp + 0x1c]
call fcn.0043e825
mov eax, edi
jmp 0x469f76
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea ecx, [ebp + 0x1c]
call fcn.00444fb1
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x24]
xor ecx, ecx
test edx, edx
mov dword [ebp - 0xa8], 0x4c1a3c
jl 0x469a11
mov ecx, edx
inc edx
cmp eax, edx
jle 0x469a11
mov eax, edx
cmp ecx, eax
jge 0x469b81
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], edx
mov edx, ecx
shl edx, 7
add edx, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 0x48], edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
jne 0x469a4b
mov ecx, dword [eax + 8]
or ecx, dword [eax + 0xc]
je 0x469b6e
cmp dword [ebp + 0x60], 0
push dword [ebp - 0x2c]
push dword [ebp - 0xa8]
jge 0x469a78
push str._s_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0xa8], 0x4c2568
jmp 0x469b6b
push 0x4cb5d8
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x10]
lea esi, [esi + eax*2]
mov eax, dword [ebp + 0x60]
shl eax, 7
lea edi, [eax + ecx]
push 0
push edi
push esi
call fcn.00442320
add esp, 0x1c
push esi
call ebx
lea esi, [esi + eax*2]
push str._GPT
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x200
push dword [edi + 0x24]
add esi, 0xa
push dword [edi + 0x20]
call fcn.004ae930
push edx
push eax
push esi
call fcn.0049c1b8
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
inc esi
inc esi
sub eax, dword [edi + 0x20]
push 0
sbb ecx, dword [edi + 0x24]
add eax, 1
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.004ae930
push edx
push eax
push esi
call fcn.0049c1b8
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push str._016I64X
push dword [edi + 0x34]
inc esi
push dword [edi + 0x30]
inc esi
push esi
call fcn.0049c16d
add esp, 0x10
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push 0
inc esi
add edi, 0x10
inc esi
push edi
push esi
call fcn.00442320
add esp, 0xc
test byte [ebp - 8], 0x10
je 0x469b6e
push esi
call ebx
push dword [ebp - 0x2c]
lea esi, [esi + eax*2]
mov word [esi], 0x20
inc esi
inc esi
push 0x4c22c0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
add dword [ebp - 0x48], 0x80
inc dword [ebp - 0x2c]
dec dword [ebp + 0xc]
jne 0x469a35
xor edi, edi
cmp dword [ebp - 0xb8], edi
jle 0x469ba1
push dword [ebp - 0xb8]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xb4]
call fcn.00449f34
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xb4]
push dword [ebp - 0xc8]
call fcn.00444692
jmp 0x469df2
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, edi
jmp 0x467638
mov eax, dword [ebp - 0x1c]
shl eax, 7
mov dword [ebp - 0x108], eax
xor edx, edx
div esi
push dword [ebp - 0x30]
mov dword [ebp + 0xc], eax
lea eax, [ebp]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x6c]
push dword [ebp - 4]
push eax
call fcn.00454215
add esp, 0x18
push edi
push 0x20000000
push 3
push edi
push 3
push 0xc0000000
push dword [ebp - 0x30]
lea ecx, [ebp + 0x6c]
mov dword [ebp - 0x1c], eax
call fcn.00405c00
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x108]
lea eax, [ecx + eax + 0x30]
mov edx, dword [eax]
and byte [eax + 7], 0x7f
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
push edi
shl eax, 7
push edi
push eax
push ecx
mov dword [ebx + 0x58], edi
call fcn.0049ab96
mov dword [ebx + 0x58], eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x28]
mov dword [ebx + 0x10], edi
push ebx
call fcn.0049ab96
push edi
xor ecx, ecx
push ecx
push dword [ebp - 0x28]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x14]
push eax
mov dword [eax + 0x10], edi
call fcn.0049ab96
mov ecx, dword [ebp + 0x14]
add esp, 0x30
push edi
mov dword [ecx + 0x10], eax
xor eax, eax
push eax
push esi
push dword [ebp - 0x12c]
push dword [ebp - 0x130]
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043e647
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x110]
push edi
adc ecx, edx
add eax, 1
adc ecx, edi
mov dword [ebp - 0x10c], edx
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
imul ebx, esi
mov eax, dword [ebp - 0x10]
add ebx, eax
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043e647
mov eax, dword [ebp - 0x204]
add eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x200]
adc ecx, dword [ebp - 0x10c]
push edi
xor edx, edx
push edx
push esi
push ecx
push eax
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
push esi
push ebx
lea ecx, [ebp + 0x6c]
call fcn.0043e647
push edi
xor eax, eax
push eax
push esi
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
call fcn.004ae930
add eax, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x34]
push edx
push eax
call fcn.0040f8cc
push esi
push dword [ebp + 0x14]
lea ecx, [ebp + 0x6c]
call fcn.0043e647
push dword [ebp + 0x6c]
call fcn.004427c8
cmp dword [ebp - 0x1c], edi
pop ecx
jl 0x469da1
mov esi, dword [ebp - 0x1c]
jmp 0x469da3
xor esi, esi
lea ecx, [ebp - 0x80]
call fcn.0043e825
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, edi
je 0x469de3
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
jmp 0x4699a6
lea ecx, [ebp - 0x80]
call fcn.0043e825
lea ecx, [ebp + 0x18]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x50]
call fcn.0043e825
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, edi
jmp 0x468973
push 0x1000
lea ecx, [ebp + 0x1c]
call fcn.00444fb1
cmp dword [ebp - 0x18], ebx
jl 0x469ebc
push 0x3b60
lea ecx, [ebp - 0x1c]
call fcn.00444e15
mov edi, dword [ebp - 0x1c]
push 0x3960
lea esi, [edi + 0x200]
push ebx
push esi
call fcn.004ae820
push dword [ebp - 0x84]
push edi
push esi
call fcn.0045366e
add esp, 0x18
xor edi, edi
lea eax, [esi + 4]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x18]
je 0x469e87
inc edi
add eax, 0x220
cmp edi, 0x1a
jle 0x469e73
jmp 0x469eb2
push 0x64
lea ecx, [ebp + 0x1c]
call fcn.00444fb1
imul edi, edi, 0x220
add esi, edi
movzx eax, byte [esi + 0x10]
push eax
push dword [esi + 4]
push str._d___c_
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.0043e825
jmp 0x469ee2
cmp byte [ebp - 0x3f], 0
jne 0x469ee2
cmp byte [ebp + 0x5f], 4
mov eax, 0x4c3038
je 0x469ed2
mov eax, 0x4c3018
push eax
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0x18]
call fcn.0045324f
add esp, 0x10
mov dword [ebp], ebx
lea ecx, [ebp + 0x50]
call fcn.0043e825
cmp dword [ebp - 0xb8], ebx
jle 0x469f0b
push dword [ebp - 0xb8]
lea edx, [ebp + 0x1c]
push dword [ebp - 0xb4]
call fcn.00449f34
pop ecx
pop ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xb4]
push dword [ebp - 0xc8]
call fcn.00444692
lea ecx, [ebp + 0x64]
call fcn.0044286f
lea ecx, [ebp + 0x6c]
call fcn.00402cc5
mov eax, 0x4dd8d8
cmp eax, ebx
je 0x469f3f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0xd4]
call fcn.0043e825
lea ecx, [ebp - 0xc8]
call fcn.0043e825
lea ecx, [ebp - 0xbc]
call fcn.0043e825
lea ecx, [ebp - 0x1d4]
call fcn.0043e825
lea ecx, [ebp + 0x1c]
call fcn.0043e825
mov eax, dword [ebp]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8