Function at 0x426caa
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], esi
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x104]
push eax
call fcn.004151f2
test eax, eax
jne 0x426d03
mov esi, str.unknown_OS____
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
call fcn.0040c6c7
test eax, eax
je 0x426d22
lea edi, [ebp - 0x104]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x426d13
mov esi, str._BartPE
jmp 0x426d40
call fcn.0040c699
test eax, eax
je 0x426d44
lea edi, [ebp - 0x104]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x426d32
mov esi, str._generic_PE
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
lea eax, [ebp - 0x104]
push eax
call fcn.00412880
push 0x100
lea eax, [ebp - 0x40c]
push eax
call fcn.00415942
test eax, eax
mov eax, str.unknown_memory____
je 0x426d70
lea eax, [ebp - 0x40c]
push eax
call fcn.0041289c
push ebx
push dword [ebp - 0x450]
mov dword [0x4cd630], esi
call fcn.00420d9d
push str.SeBackupPrivilege
call fcn.0040a59c
call fcn.0040ced5
push 0x469fcc
push str.Jan__4_2013
push 0x472394
push 0x469ec0
push str._s_V_s____s_s
push 0x4bcb88
mov dword [0x4d617c], eax
call fcn.00450c76
xor edi, edi
add esp, 0x18
dec dword [ebp - 0x450]
add ebx, 4
inc edi
mov dword [ebp - 0x454], ebx
mov dword [0x4cd614], esi
cmp dword [ebp - 0x450], edi
jne 0x426e00
push str.__loaddriver
push dword [ebx]
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x426e00
mov dword [0x4cd614], edi
mov dword [0x4a300c], esi
push ebx
push dword [ebp - 0x450]
call fcn.0042440e
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x478]
push eax
push str._2d_2d_d
push 0x4bcc33
call fcn.00451ad6
add esp, 0x14
cmp dword [ebp - 0x484], 2
jl 0x426e45
cmp dword [ebp - 0x484], 0xf
jle 0x426e53
mov byte [0x4d4f1a], 0
mov byte [0x4d4f19], 0
cmp dword [ebp - 0x478], edi
jl 0x426e64
cmp dword [ebp - 0x478], 0xc
jle 0x426e72
mov byte [0x4d4f1a], 0
mov byte [0x4d4f19], 0
call fcn.00420eb8
cmp dword [0x4cd658], edi
jne 0x426e8e
push 0x4cddb8
call fcn.0044e58c
mov dword [0x4cce90], eax
mov ecx, 0x4a301c
call fcn.0040d24d
push esi
call fcn.0040cf88
push esi
push 0x4bcdd8
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x480], esi
call fcn.00455b10
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x426ee8
lea eax, [edi + 0x8c000]
push eax
push str.Internal_error__x_occurred
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x8f0
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
push edi
call fcn.00451974
cmp byte [0x4d4f19], 0
jne 0x426f1f
push 0x4bcbf0
push esi
call fcn.004418f5
cmp byte [0x4d4f19], 0
jne 0x426f1f
cmp dword [0x4cd630], esi
jne 0x426f1f
call fcn.00420713
push eax
push str.Timelimited_TrialWare___use_possible_up_to__s
call fcn.0041c7ee
pop ecx
pop ecx
mov edi, dword [ebp - 0x454]
push edi
lea eax, [ebp - 0x450]
push eax
call fcn.00420c6b
push 2
push edi
lea eax, [ebp - 0x450]
push eax
call fcn.0040e3c6
mov esi, dword [ebp - 0x450]
lea eax, [esi + 1]
push 4
push eax
call fcn.00450903
mov ecx, esi
shl ecx, 2
push ecx
push edi
push eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x468], esi
call fcn.00451390
add esp, 0x14
push 0x472318
push edi
lea eax, [ebp - 0x450]
push eax
call fcn.00415196
xor ebx, ebx
inc ebx
mov esi, eax
test esi, esi
je 0x42760b
push 8
push str._IGNORE
push esi
mov edi, 0x472308
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x4270b9
add esi, 8
push str.McAfee42
push esi
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x426fc4
mov dword [0x4cd2b8], ebx
push str.Diskperf
push esi
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x4275b7
mov dword [0x4cd2bc], ebx
jmp 0x42759b
movsx eax, al
push eax
call fcn.00453103
pop ecx
cmp eax, 0x4d
jg 0x427050
je 0x427485
cmp eax, 0x44
jg 0x42702a
je 0x42735d
sub eax, 0x21
je 0x42759b
sub eax, 0xc
je 0x42759b
sub eax, 0x14
jne 0x4270c9
and dword [0x4cd2a0], eax
jmp 0x4270b9
sub eax, 0x46
je 0x42747e
dec eax
je 0x4273f2
dec eax
je 0x42738f
dec eax
jne 0x427103
mov dword [ebp - 0x464], ebx
jmp 0x4270b9
sub eax, 0x4f
cmp eax, 0xb
ja case.0x42705c.81
jmp dword [eax*4 + 0x4281fa]
and dword [0x48244c], 0
mov dword [0x4cddd0], ebx
jmp 0x4270b9
mov dword [0x4cdddc], ebx
jmp 0x4270b9
and dword [0x4a300c], 0
jmp 0x4270b9
push 3
push 0x4722ec
push esi
call fcn.00450f08
add esp, 0xc
test eax, eax
je 0x4274ec
mov dword [ebp - 0x480], ebx
jmp 0x4270b9
mov dword [0x4cd300], ebx
jmp 0x4270b9
mov dword [0x4cd304], ebx
jmp 0x4270b9
mov dword [0x4cd31c], ebx
inc esi
mov al, byte [esi]
test al, al
jne 0x426fe4
jmp 0x42759b
dec eax
je 0x427178
dec eax
jne case.0x42705c.81
push 2
push 0x4722e8
push esi
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x427116
push 0x400
add esi, 2
push esi
push 0x4cd988
call fcn.00451260
jmp 0x4274e4
sub eax, 3
jne case.0x42705c.81
push 0x4cd2c0
jmp 0x4274dc
push 2
push 0x4722e4
push esi
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x427135
mov dword [0x4cd2f0], ebx
jmp 0x42759b
push 0x4cd29c
lea eax, [esi + 1]
push 0x471b6c
push eax
mov dword [0x48244c], ebx
call fcn.00442e4a
add esp, 0xc
test dword [0x4cd29c], 0xffff3ff8
je 0x42759b
push 0xc007
push str.legal_modes_for_compression_are__x_n
call fcn.00450f5c
pop ecx
pop ecx
push esi
call fcn.0041f339
lea edi, [esi + 1]
movsx eax, byte [edi]
push eax
call fcn.00453103
pop ecx
cmp eax, 0x44
jne 0x427207
push 0x4cd28c
lea eax, [esi + 2]
push 0x4722bc
push eax
call fcn.00442e4a
add esp, 0xc
test eax, eax
je 0x4275c8
mov eax, dword [0x4cd28c]
add eax, 0x3f
cdq
and edx, 0x3f
add eax, edx
and eax, 0xffffffc0
mov esi, 0x80
mov dword [0x4cd28c], eax
cmp eax, esi
jge 0x4271dd
push esi
push eax
push str.too_few_KB_for_Input___d___using__d_n
call fcn.00450f5c
mov eax, esi
add esp, 0xc
mov dword [0x4cd28c], eax
cmp eax, 0x8000
jle 0x42759b
mov esi, 0x8000
push esi
push eax
push str.too_many_KB_for_Input_specified___d___using__d_n
call fcn.00450f5c
add esp, 0xc
mov dword [0x4cd28c], esi
jmp 0x42759b
movsx eax, byte [edi]
push eax
call fcn.00453103
pop ecx
cmp eax, 0x4f
jne 0x427281
push 0x4cd290
lea eax, [esi + 2]
push 0x4722bc
push eax
call fcn.00442e4a
add esp, 0xc
test eax, eax
je 0x4275e4
mov eax, dword [0x4cd290]
mov esi, 0x80
cmp eax, esi
jge 0x427258
push esi
push eax
push str.too_few_KB_for_Output___d___using__d_n
call fcn.00450f5c
mov eax, esi
add esp, 0xc
mov dword [0x4cd290], eax
mov esi, 0x8000
cmp eax, esi
jle 0x427276
push esi
push eax
push str.too_many_KB_for_Output_specified___d___using__d_n
call fcn.00450f5c
add esp, 0xc
mov dword [0x4cd290], esi
mov dword [0x4cd298], ebx
jmp 0x42759b
movsx eax, byte [edi]
push eax
call fcn.00453103
pop ecx
cmp eax, 0x49
jne 0x4272fc
push 0x4cd294
lea eax, [esi + 2]
push 0x4722bc
push eax
call fcn.00442e4a
add esp, 0xc
test eax, eax
je 0x4275c8
mov eax, dword [0x4cd294]
mov esi, 0x80
cmp eax, esi
jge 0x4272d2
push esi
push eax
push str.too_few_KB_for_Output___d___using__d_n
call fcn.00450f5c
mov eax, esi
add esp, 0xc
mov dword [0x4cd294], eax
cmp eax, 0x8000
jle 0x42759b
mov esi, 0x8000
push esi
push eax
push str.too_many_KB_for_Input_specified___d___using__d_n
call fcn.00450f5c
add esp, 0xc
mov dword [0x4cd294], esi
jmp 0x42759b
push 0x4cd288
push 0x4722bc
push edi
call fcn.00442e4a
add esp, 0xc
test eax, eax
je 0x4275f5
mov eax, dword [0x4cd288]
cmp eax, 0x10
jge 0x427336
push eax
push str.too_few_IOBuffers_specified___d___using_16_n
call fcn.00450f5c
pop ecx
pop ecx
push 0x10
pop eax
mov dword [0x4cd288], eax
cmp eax, 0x100
jle 0x42759b
push eax
push str.too_many_IOBuffers_specified___d___using_256_n
call fcn.00450f5c
pop ecx
pop ecx
mov dword [0x4cd288], 0x100
jmp 0x42759b
inc esi
cmp byte [esi], 0
je 0x42759b
push 0x4cdde0
push 0x4721a8
push esi
call fcn.00442e4a
push dword [0x4cdde0]
push str._nVerbose_debugging_set_to_0x_x_n
call fcn.00450f5c
add esp, 0x14
jmp 0x42759b
lea eax, [esi + 1]
mov dword [0x4cd314], ebx
cmp byte [eax], 0
je 0x4273e2
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42739f
mov edi, 0x4cd33c
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4273ae
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x104
rep movsb byte es:[edi], byte [esi]
push str..hsh
mov esi, 0x4cd33c
push esi
call fcn.00442cad
push eax
push esi
jmp 0x4270f9
push str.missing_argument_for_option__h_n
call fcn.0043c16a
pop ecx
jmp 0x42759b
call fcn.0040cdd9
and eax, ebx
and dword [0x4a300c], 0
mov dword [0x4cd2d4], eax
jmp 0x427472
movsx eax, al
push eax
call fcn.00453103
sub eax, 0x4d
pop ecx
je 0x42746c
dec eax
je 0x427464
dec eax
je 0x42745c
sub eax, 4
je 0x427454
dec eax
je 0x427440
sub eax, 4
je 0x427438
dec eax
jne 0x427172
mov dword [0x4cdddc], ebx
jmp 0x427472
mov dword [0x4cd2d8], ebx
jmp 0x427472
mov dword [0x4cd2e4], ebx
mov dword [0x4cd2f8], ebx
mov dword [0x4cddcc], ebx
jmp 0x427472
mov dword [0x4cd2e0], ebx
jmp 0x427472
mov dword [0x4cd2dc], ebx
jmp 0x427472
mov dword [0x4cd2ec], ebx
jmp 0x427472
mov dword [0x4cd2e8], ebx
inc esi
mov al, byte [esi]
test al, al
jne 0x427407
jmp 0x42759b
push 0x4cd2b4
jmp 0x4274dc
push 0x4cd2ac
jmp 0x4274dc
mov dword [0x4cddd4], ebx
mov dword [0x4cd2e4], ebx
mov dword [0x4cd2f8], ebx
inc esi
mov al, byte [esi]
test al, al
je 0x42759b
movsx eax, al
push eax
call fcn.00453103
pop ecx
cmp eax, 0x45
je 0x427498
cmp eax, 0x4d
je 0x4274ce
cmp eax, 0x51
jne 0x427172
mov dword [0x4cddd8], ebx
jmp 0x42749e
and dword [0x482450], 0
jmp 0x42749e
push 0x4cd2b0
inc esi
push edi
push esi
call fcn.00442e4a
add esp, 0xc
jmp 0x42759b
add esi, 3
mov edi, 0x4a301c
push esi
mov ecx, edi
call fcn.0040d0d5
push esi
mov ecx, edi
call fcn.0040d0fd
jmp 0x42759b
lea eax, [esi + 1]
cmp byte [eax], 0
je 0x42758e
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427513
mov edi, 0x4cd33c
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x427522
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x448]
push eax
and ecx, 3
push 0x4cd33c
rep movsb byte es:[edi], byte [esi]
call fcn.0045496b
pop ecx
pop ecx
test eax, eax
jne 0x42759b
test dword [ebp - 0x442], 0x4000
je 0x42759b
mov eax, 0x4cd33c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427565
sub eax, edx
cmp byte [eax + 0x4cd33b], 0x5c
je 0x42759b
mov edi, 0x4cd33c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42757d
mov esi, 0x469ef8
movsw word es:[edi], word [esi]
jmp 0x42759b
mov byte [0x4cd33c], 0
mov dword [0x4cd310], ebx
push 0x472318
push dword [ebp - 0x454]
lea eax, [ebp - 0x450]
push eax
call fcn.00415196
jmp 0x426f83
push str.possible_drivers_to_exclude_are_McAfee42_or_Diskperf_n
call fcn.00450f5c
pop ecx
push ebx
jmp 0x426ee3
push 0x8000
push 0x80
push str.missing_number_of_KB_for_Input___d.._d__n
call fcn.00450f5c
add esp, 0xc
jmp 0x427172
push 0x8000
push 0x80
push str.missing_number_of_KB_for_Output___d.._d__n
jmp 0x4275d7
push str.missing_number_of_IOBuffers_to_use__16..128__n
call fcn.00450f5c
jmp 0x427171
push 0
jmp 0x427173
mov eax, dword [0x482444]
mov dword [ebp - 0x474], eax
mov eax, dword [0x482440]
mov dword [ebp - 0x470], eax
mov eax, dword [0x482448]
mov dword [ebp - 0x46c], eax
mov edi, 0x472318
jmp 0x427663
mov al, byte [esi + 1]
test al, al
je 0x427663
movsx eax, al
push eax
call fcn.00453103
pop ecx
cmp eax, 0x21
je 0x42764e
cmp eax, 0x2d
jne 0x427663
push dword [ebp - 0x458]
add esi, 2
push dword [ebp - 0x468]
push esi
call fcn.004252ce
push edi
push dword [ebp - 0x458]
lea eax, [ebp - 0x468]
push eax
call fcn.00415196
mov esi, eax
test esi, esi
jne 0x427633
cmp dword [0x4cddbc], eax
je 0x4276d8
push dword [0x4cd97c]
mov ebx, 0x4cd878
push ebx
mov edi, 0x4cd774
push edi
mov esi, 0x4cd670
push esi
call fcn.0043cd29
test eax, eax
je 0x4276c6
cmp byte [0x4cd878], 0
je 0x4276b0
mov edi, ebx
push esi
push edi
push str.restore_from__s_____s_scheduled_for_next_reboot
call fcn.0041c7ee
add esp, 0xc
push 0
jmp 0x426ee3
push str.scheduling_the_restore_for_the_boot_failed
call fcn.0041c7ee
pop ecx
push 1
jmp 0x426ee3
call fcn.00420af9
cmp eax, 2
jne 0x4276e8
mov dword [0x4cd308], ebx
cmp dword [0x4cd2f4], ebx
jne 0x427720
call fcn.00442b1c
mov esi, eax
push str.WSCRIPT.EXE
push esi
call fcn.004501a0
pop ecx
pop ecx
test eax, eax
jne 0x427719
push str.CSCRIPT.EXE
push esi
call fcn.004501a0
pop ecx
pop ecx
test eax, eax
je 0x427720
and dword [0x4cd2f4], 0
xor esi, esi
xor eax, eax
mov dword [ebp - 0x418], esi
lea edi, [ebp - 0x414]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [0x4cd318], esi
jne 0x427fcb
cmp dword [0x4cd31c], esi
jne 0x427fcb
mov ecx, dword [0x4cdfa8]
call fcn.004451e3
test eax, eax
jne 0x42777b
cmp dword [0x4cd308], ebx
jne 0x427771
push str.VSS_is_not_available_on_this_machine.
call fcn.0041c7ee
pop ecx
jmp 0x427f5d
mov dword [0x4cd308], 2
cmp dword [ebp - 0x450], esi
jne 0x4277c8
cmp dword [0x4cd314], ebx
jne 0x4277ad
push 0x4cd33c
call fcn.004188af
mov dword [ebp - 0x44c], eax
mov eax, dword [0x4cddc8]
cmp eax, esi
je 0x42807e
jmp 0x428078
call fcn.0040cdd9
neg eax
sbb eax, eax
neg eax
mov dword [0x4cddcc], eax
call fcn.0044d65c
push eax
jmp 0x426ee3
cmp dword [0x4cd650], esi
je 0x427821
mov eax, dword [ebp - 0x454]
cmp dword [eax], esi
je 0x4277f6
push 0x46c02c
push dword [eax]
call fcn.00442cad
mov edx, dword [0x482444]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4277ec
push dword [0x482444]
call fcn.004140fc
test eax, eax
jne 0x427821
push dword [0x482444]
push str.Unable_top_open_a_communication_channel_to_Frontrange_DLL_for_file__s
call fcn.0041c7ee
pop ecx
pop ecx
push 0x80
jmp 0x426ee3
xor edi, edi
mov ecx, dword [ebp - 0x450]
cmp ecx, 3
jge 0x427832
mov eax, ecx
jmp 0x427835
push 3
pop eax
cmp edi, eax
jge 0x427a7d
mov dword [ebp - 0x458], esi
cmp edi, esi
jne 0x427887
cmp ecx, ebx
je 0x427887
cmp dword [0x4cddd4], esi
jne 0x427887
mov eax, dword [ebp - 0x454]
push esi
push dword [eax]
call fcn.00445be5
mov dword [ebp - 0x458], eax
cmp eax, esi
jle 0x4279b1
mov eax, dword [ebp - 0x454]
push dword [eax]
mov ecx, dword [0x4cdfa8]
call fcn.00445fbd
jmp 0x4279b1
cmp dword [ebp - 0x418], 3
jne 0x4279b1
mov eax, dword [ebp - 0x454]
push dword [eax + edi*4]
call fcn.004503c5
pop ecx
mov esi, eax
xor ebx, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4278aa
sub eax, ecx
je 0x4278d6
movsx eax, byte [ebx + esi]
push eax
call fcn.00453103
mov byte [ebx + esi], al
mov eax, esi
pop ecx
inc ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4278c9
sub eax, ecx
cmp ebx, eax
jb 0x4278b5
push str.AUTO
push esi
call fcn.004501a0
pop ecx
pop ecx
test eax, eax
je 0x4279a5
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x474]
call fcn.0042453e
test eax, eax
js 0x427a3f
inc dword [ebp - 0x45c]
inc dword [ebp - 0x460]
push 0xb
push str.HDAUTO:AUTO
push esi
call fcn.00452f2d
add esp, 0xc
test eax, eax
je 0x427965
lea eax, [ebp - 0x45c]
push eax
push str.HD_u:AUTO
push esi
call fcn.00451ad6
xor ebx, ebx
inc ebx
add esp, 0xc
cmp eax, ebx
je 0x427965
lea eax, [ebp - 0x460]
push eax
push str.HDAUTO:_u
push esi
call fcn.00451ad6
add esp, 0xc
cmp eax, ebx
jne 0x427a4b
push dword [ebp - 0x460]
mov dword [ebp + edi*4 - 0x418], 2
push dword [ebp - 0x45c]
push str.HD_u:_u
call fcn.0042f614
add esp, 0xc
push eax
push dword [ebp + edi*4 - 0x474]
call fcn.0041f685
push esi
call fcn.0045038b
xor ebx, ebx
pop ecx
inc ebx
jmp 0x427a37
push esi
call fcn.0045038b
xor ebx, ebx
inc ebx
pop ecx
xor esi, esi
cmp dword [ebp - 0x458], 0xfffffffe
je 0x427a6e
cmp dword [ebp - 0x458], esi
lea esi, [ebp + edi*4 - 0x418]
jg 0x4279ed
mov eax, dword [ebp - 0x454]
push dword [eax + edi*4]
push dword [ebp + edi*4 - 0x474]
call fcn.0041f685
neg eax
sbb eax, eax
add eax, 3
mov dword [esi], eax
jmp 0x427a14
cmp dword [ebp - 0x458], ebx
jne 0x427a12
mov eax, dword [ebp - 0x454]
push dword [eax + edi*4]
mov dword [esi], 2
push dword [ebp + edi*4 - 0x474]
call fcn.0041f685
jmp 0x427a14
mov dword [esi], ebx
cmp dword [esi], 3
jne 0x427a37
mov esi, dword [ebp + edi*4 - 0x474]
push 0x46c02c
push esi
call fcn.00442cad
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x427a2d
inc edi
xor esi, esi
jmp 0x427823
mov dword [ebp - 0x44c], 1
jmp 0x427a66
mov eax, dword [ebp - 0x454]
push dword [eax + edi*4]
push str.Invalid_destination_name:__s
call fcn.0041c7ee
pop ecx
pop ecx
mov dword [ebp - 0x44c], ebx
xor ebx, ebx
inc ebx
jmp 0x42807e
mov dword [ebp - 0x44c], 0xa
jmp 0x42807e
mov edi, dword [ebp - 0x418]
cmp ecx, ebx
jne 0x427d6a
push 0x50
lea eax, [ebp - 0x53c]
push esi
push eax
mov dword [ebp - 0x540], esi
call fcn.00450230
lea eax, [edi - 1]
add esp, 0xc
dec eax
je 0x427d3a
dec eax
jne 0x427d52
cmp byte [0x4cd33c], al
je 0x427b0d
cmp dword [0x4cd608], esi
jne 0x427b0d
push str..hsh
mov edi, 0x4cd33c
push edi
call fcn.00442cad
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x427ad8
push edi
push dword [0x482444]
call fcn.00418d15
mov dword [ebp - 0x44c], eax
cmp eax, esi
je 0x42807e
call fcn.00417370
push edi
call dword [sym.imp.___total_physical_size__lu_MB_DeleteFileA]
jmp 0x42807e
mov eax, dword [0x4cd610]
cmp eax, esi
je 0x427b4a
push eax
push dword [0x482444]
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x427b33
push str.The_image_names_for_the_source_and_destination_are_identical_nPlease_use_different_filenames_n
call fcn.00450f5c
pop ecx
push dword [0x4cd610]
push dword [0x482444]
call fcn.0043d462
push esi
jmp 0x426ee3
cmp dword [ebp - 0x464], esi
je 0x427b5f
push dword [0x482444]
call fcn.00421abc
jmp 0x427b44
cmp dword [ebp - 0x480], esi
je 0x427b74
push dword [0x482444]
call fcn.00421ebb
jmp 0x427b44
cmp dword [0x4cd300], esi
je 0x427c3a
cmp dword [0x4cd2d4], esi
je 0x427c29
push 0x50
lea eax, [ebp - 0x4e8]
push esi
push eax
mov dword [ebp - 0x4ec], esi
call fcn.00450230
add esp, 0xc
push 0x30564e53
push ebx
lea eax, [ebp - 0x4ec]
push eax
push dword [0x482444]
mov dword [0x4cddcc], ebx
call fcn.004216f7
test eax, eax
jne 0x427bfa
cmp dword [ebp - 0x4ec], esi
jbe 0x427bfa
mov eax, dword [ebp - 0x4e8]
cmp byte [eax + 0xaf], 0x44
push esi
jne 0x427bf0
push dword [0x482444]
push esi
push esi
call fcn.0044b64f
jmp 0x428078
push esi
push esi
push dword [0x482444]
jmp 0x427be6
push dword [0x482444]
mov dword [ebp - 0x44c], ebx
push str._s_is_not_a_valid_volume_image
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xb48
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
jmp 0x42807e
push esi
push dword [0x482444]
call fcn.004212d6
jmp 0x428078
mov edi, dword [0x482440]
mov dword [0x4cddcc], ebx
mov esi, str..z:
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x482444]
push 0
push eax
push 0x104
push eax
mov dword [0x4cddd4], ebx
mov dword [0x4cd2f8], ebx
mov dword [0x4cd2e4], ebx
call dword [sym.imp.___total_physical_size__lu_MB_GetFullPathNameA]
push 0x30494e53
push ebx
lea eax, [ebp - 0x540]
push eax
push dword [0x482444]
call fcn.004216f7
test eax, eax
jne 0x427cf5
mov eax, dword [ebp - 0x53c]
lea ecx, [eax + 0x104]
push ecx
push eax
lea eax, [ebp - 0x208]
push 0x46aaa0
push eax
call fcn.00450c76
add esp, 0x10
lea eax, [ebp - 0x208]
cmp dword [0x4cd608], ebx
jne 0x427cd5
push dword [0x4cd604]
push dword [0x482444]
push eax
call fcn.0041de73
jmp 0x427d1e
push 0
push 0
push dword [0x4cddd8]
push dword [0x4cd2cc]
push ebx
push dword [0x482450]
push dword [0x482444]
push eax
jmp 0x427d13
xor eax, eax
push eax
push eax
push dword [0x4cddd8]
push dword [0x4cd2cc]
push ebx
push dword [0x482450]
push eax
push dword [0x482444]
push dword [0x482440]
call fcn.004336d2
mov dword [ebp - 0x44c], eax
cmp eax, 0x519
jne 0x42807e
mov dword [0x4cddcc], ebx
jmp 0x4277bd
cmp dword [ebp - 0x464], esi
je 0x427d52
push dword [0x482444]
call fcn.0042c740
jmp 0x427b44
push edi
mov esi, str.invalid_command_line_syntax__single_volume_or_volume_list_not_allowed___d_
push esi
call fcn.0041c7ee
push edi
push esi
call fcn.0043c16a
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x450], 2
jne 0x427edb
mov eax, dword [ebp - 0x414]
dec eax
dec eax
je 0x427e06
dec eax
je 0x427d92
push str.invalid_command_line_syntax
jmp 0x427173
push dword [0x482440]
mov ecx, 0x4cde18
call fcn.0041483a
test eax, eax
je 0x427dce
mov dword [0x4cd334], ebx
cmp dword [0x4cd310], ebx
je 0x427dce
cmp byte [0x4cd33c], 0
jne 0x427dce
push str.Hash_file_generation_is_disabled_on_FTP_server._nPlease_use_option__oC:FILENAME.HSH_to_create_a_local_hash_file
mov dword [0x4cd310], ebx
call fcn.0041c7ee
pop ecx
cmp edi, 2
je 0x427df6
cmp edi, ebx
je 0x427df6
cmp edi, 3
jne 0x427edb
push dword [0x482444]
push dword [0x482440]
call fcn.00424741
jmp 0x428078
push dword [0x482440]
call fcn.00426b84
jmp 0x428078
push dword [0x482440]
mov ecx, 0x4cde18
call fcn.0041483a
test eax, eax
je 0x427e36
mov dword [0x4cd334], ebx
push dword [0x482440]
push dword [0x482444]
call fcn.004245e8
jmp 0x428078
cmp edi, 3
jne 0x427edb
cmp dword [0x4cddd4], esi
je 0x427e20
push 0x50
lea eax, [ebp - 0x590]
push esi
push eax
mov dword [ebp - 0x594], esi
call fcn.00450230
mov eax, dword [0x4cd2d4]
add esp, 0xc
push 0x30494e53
mov dword [0x4cddcc], eax
push ebx
lea eax, [ebp - 0x594]
push eax
push dword [0x482444]
mov dword [0x4cd2f8], ebx
mov dword [0x4cd2e4], ebx
call fcn.004216f7
test eax, eax
jne 0x427ec0
mov eax, dword [ebp - 0x590]
lea ecx, [eax + 0x104]
push ecx
push eax
lea eax, [ebp - 0x30c]
push 0x46aaa0
push eax
call fcn.00450c76
add esp, 0x10
push esi
push esi
lea eax, [ebp - 0x30c]
jmp 0x427cd9
push esi
push esi
push dword [0x4cddd8]
push dword [0x4cd2cc]
push ebx
push dword [0x482450]
push esi
jmp 0x427d0d
push 3
pop eax
cmp dword [ebp - 0x450], eax
jne 0x427fbb
cmp edi, eax
jne 0x427d88
cmp dword [ebp - 0x414], eax
jne 0x427d88
cmp dword [ebp - 0x410], 2
jne 0x427d88
mov eax, dword [ebp - 0x46c]
push 0x3e8
mov dword [0x482440], eax
mov eax, dword [ebp - 0x470]
push 0x46c02c
push eax
mov dword [0x482448], eax
call fcn.00442cad
push eax
push dword [0x482448]
call fcn.00451260
add esp, 0xc
cmp dword [0x4cd2f0], esi
jne 0x427f68
push dword [0x482448]
push dword [0x482444]
call fcn.00418a47
test eax, eax
jne 0x427f68
mov dword [ebp - 0x44c], ebx
jmp 0x42807e
push str.restoring_the_original_image_first_n
call fcn.00450f5c
pop ecx
push esi
push ebx
push dword [0x482444]
push dword [0x482440]
call fcn.00440625
mov dword [ebp - 0x44c], eax
cmp dword [0x4d659c], esi
jne 0x42807e
push str.and_now_the_differential_image_n
call fcn.00450f5c
pop ecx
push ebx
push esi
push dword [0x482448]
push dword [0x482440]
call fcn.00440625
jmp 0x428078
jle 0x42807e
push str.Too_many_arguments_in_command_line
jmp 0x427173
mov edi, dword [ebp - 0x454]
cmp dword [edi], esi
jne 0x427fe6
push 0x469ec0
push str.The_command_needs_additional_arguments._Please_use__s_____for_help._n
call fcn.0043c16a
pop ecx
pop ecx
push str.HDAUTO
push dword [edi]
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x428027
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x48c]
push eax
push dword [edi + 4]
call fcn.0042453e
test eax, eax
js 0x427f5d
push dword [0x4cd318]
push dword [ebp - 0x48c]
push dword [edi + 4]
jmp 0x428073
lea eax, [ebp - 0x47c]
push eax
push str.HD_u
push dword [edi]
call fcn.00451ad6
add esp, 0xc
cmp eax, ebx
je 0x428062
lea eax, [ebp - 0x47c]
push eax
push str.hd_u
push dword [edi]
call fcn.00451ad6
add esp, 0xc
cmp eax, ebx
je 0x428062
call fcn.00422b8e
jmp 0x42807e
push dword [0x4cd318]
mov eax, dword [ebp - 0x47c]
dec eax
push eax
push dword [edi + 4]
call fcn.0042267c
mov dword [ebp - 0x44c], eax
mov eax, dword [0x4cce9c]
mov esi, dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
or edi, 0xffffffff
cmp eax, edi
je 0x428099
push eax
call esi
mov dword [0x4cce9c], edi
mov eax, dword [0x4cce98]
cmp eax, edi
je 0x4280ab
push eax
call esi
mov dword [0x4cce98], edi
call fcn.00417370
mov eax, dword [0x4cddc8]
test eax, eax
je 0x4280bf
mov dword [ebp - 0x44c], eax
mov esi, dword [ebp - 0x44c]
test esi, esi
jne 0x4281c6
cmp dword [0x4cd330], ebx
jne 0x42814d
mov eax, dword [0x4cddf8]
mov ecx, dword [0x4cddfc]
shrd eax, ecx, 0x14
push 0xc
shr ecx, 0x14
push ecx
push eax
call fcn.0040c6f5
push eax
push str.Total_size_of_all_disks:_______sMB
call fcn.0041c7ee
mov eax, dword [0x4cde00]
pop ecx
pop ecx
mov ecx, dword [0x4cde04]
shrd eax, ecx, 0x14
push 0xc
shr ecx, 0x14
push ecx
push eax
call fcn.0040c6f5
push eax
push str.Total_used_size_of_all_disks:__sMB
call fcn.0041c7ee
mov eax, dword [0x4cde08]
pop ecx
pop ecx
mov ecx, dword [0x4cde0c]
shrd eax, ecx, 0x14
push 0xc
shr ecx, 0x14
push ecx
push eax
call fcn.0040c6f5
push eax
push str.Total_size_of_all_images:______sMB
call fcn.0041c7ee
pop ecx
pop ecx
cmp dword [0x4cd630], 0
jne 0x428167
push 0x469ec0
push str._n_s_finished_successfully_n
call fcn.00450f5c
pop ecx
pop ecx
test byte [0x4cdde0], 0x20
je 0x4281e8
push 0xc
push dword [0x4bcb7c]
push dword [0x4bcb78]
call fcn.0040c6f5
push eax
push 0xc
push dword [0x4cddb4]
push dword [0x4cddb0]
call fcn.0040c6f5
push eax
push str._total_in_out_____s_____s_n
call fcn.00450f5c
add esp, 0xc
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
sub eax, dword [ebp - 0x488]
push eax
push 0x4bcb88
push str._s_total_time____d_n
call fcn.00450f5c
add esp, 0xc
jmp 0x4281e8
cmp dword [0x4cd630], 0
jne 0x4281e8
push esi
push str._n_aSome_error_occurred___exitcode__u_n
call fcn.00450f5c
push esi
push str.Error_occurred___exitcode__u
call fcn.0041c7ee
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret