Function at 0x4076f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Delete file
Get file attributes
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473eaf
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x4bc00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], ecx
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
mov dword [ebp - 0x30], esi
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e31
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
push str.invoked
mov ecx, esi
call fcn.00402ee0
test al, al
jne 0x407766
push str.invoked
mov ecx, esi
call fcn.0045fc60
mov dword [ebp - 4], 1
push ecx
mov dword [ebp - 0x30], esp
mov esi, esp
mov dword [ebp - 0x50], esi
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e3b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
push str._Bitlocker_Recovery_solution_getting
mov ecx, esi
call fcn.00402ee0
test al, al
jne 0x4077af
push str._Bitlocker_Recovery_solution_getting
mov ecx, esi
call fcn.0045fc60
mov byte [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e45
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], 5
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e4f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 7
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e59
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 9
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e63
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 0xb
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e6d
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x40], edi
mov byte [ebp - 4], 0xd
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x408e77
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xe
push str.C:WinBDERecoveryKey
lea ecx, [ebp - 0x5c]
call fcn.00402ee0
test al, al
jne 0x40789d
push str.C:WinBDERecoveryKey
lea ecx, [ebp - 0x5c]
call fcn.0045fc60
mov byte [ebp - 4], 0xf
push dword [ebp - 0x5c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x5c]
call ebx
cmp eax, 0xffffffff
jne 0x4078cc
push 0
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or ebx, 0xffffffff
jmp 0x40793a
push str.BitLockerKeyExtracted.txt
lea ecx, [ebp - 0x18]
call fcn.0045fcf0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x28]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40791c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40793a
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0
push 0
push 0xffffffffffffffff
push 0x48d10a
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [eax - 1]
mov dword [ebp - 0x18], edx
test edx, edx
jle 0x4079a3
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
sub eax, edx
or eax, ecx
jge 0x407979
push edx
lea ecx, [ebp - 0x3c]
call fcn.004032e0
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
push edx
push esi
push 0xffffffffffffffff
push 0x48d10a
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x18]
cmp eax, dword [esi - 8]
jg 0x408e86
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4079ae
lea ecx, [ebp - 0x3c]
call fcn.00403280
mov esi, dword [ebp - 0x3c]
push 0
push 0
push 0xffffffffffffffff
push 0x48d10a
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [eax - 1]
mov dword [ebp - 0x18], edx
test edx, edx
jle 0x407a17
mov ecx, 1
sub ecx, dword [edi - 4]
mov eax, dword [edi - 8]
sub eax, edx
or eax, ecx
jge 0x4079ed
push edx
lea ecx, [ebp - 0x40]
call fcn.004032e0
mov edi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x18]
push edx
push edi
push 0xffffffffffffffff
push 0x48d10a
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi - 8]
jg 0x408e86
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x407a22
lea ecx, [ebp - 0x40]
call fcn.00403280
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x14
mov byte [ebp - 0x11], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.wmic_logicaldisk_get_name
call fcn.0045fcf0
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x14
mov dl, byte [ebp - 0x11]
lea ecx, [ebp - 0x74]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x16
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x64], ecx
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x407aba
lea eax, [ecx + 0xc]
mov dword [ebp - 0x38], eax
cmp dword [ecx + 0xc], 0
jl 0x407aae
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x407aae
mov ecx, dword [ebp - 0x28]
call fcn.00403090
mov dword [ebp - 0x28], eax
mov ecx, ebx
mov eax, dword [ebp - 0x38]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407aa3
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x407aba
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x34]
call fcn.004030f0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407adc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x38], esp
mov ebx, dword [ebp - 0x34]
add ebx, 0xfffffff0
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [ebx + 0xc]
cmp dword [eax], 0
jl 0x407b06
cmp ecx, dword [ebx]
jne 0x407b06
lock inc dword [eax]
jmp 0x407b39
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x408e81
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov edx, dword [ebx + 4]
inc edx
push edx
lea eax, [ebx + 0x10]
push eax
add ecx, 0x10
call fcn.004031f0
add esp, 8
mov ebx, dword [ebp - 0x28]
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x19
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._Bitlocker_Recovery_solution_is_now_inside_the_trial
call fcn.0045fcf0
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x14
or ecx, 0xffffffff
call fcn.00462c10
add esp, 4
push 0x48d740
lea ecx, [ebp - 0x34]
call fcn.0045f840
mov ebx, eax
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045f460
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax - 0xc]
sub ecx, ebx
push ecx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045f570
mov byte [ebp - 4], 0x1c
mov edx, dword [eax]
lea ebx, [edx - 0x10]
mov ecx, dword [ebp - 0x18]
cmp ebx, ecx
je 0x407bff
lea eax, [ecx + 0xc]
mov dword [ebp - 0x28], eax
cmp dword [eax], 0
jl 0x407bf3
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x407bf3
mov ecx, ebx
call fcn.00403090
mov dword [ebp - 0x38], eax
or ebx, 0xffffffff
mov ecx, ebx
mov edx, dword [ebp - 0x28]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407beb
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x38]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x407c02
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x34]
call fcn.004030f0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407c24
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
push 0x48d744
lea ecx, [ebp - 0x34]
call fcn.0045f840
mov dword [ebp - 0x28], eax
lea ecx, [eax + 1]
push ecx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045f460
mov byte [ebp - 4], 0x1e
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x18], ecx
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x407cb1
lea eax, [ecx + 0xc]
mov dword [ebp - 0x48], eax
cmp dword [eax], 0
jl 0x407ca5
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x407ca5
mov ecx, dword [ebp - 0x20]
call fcn.00403090
mov dword [ebp - 0x20], eax
mov ecx, ebx
mov edx, dword [ebp - 0x48]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407c9d
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x24], eax
jmp 0x407cb1
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x24]
call fcn.004030f0
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0xa4]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407cd6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov dword [ebp - 0x6c], eax
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x80], edx
movzx eax, word [eax]
test ax, ax
je 0x407d2f
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
add esp, 4
test eax, eax
je 0x407d19
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
test edx, edx
jne 0x407d24
mov edx, eax
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x18], edx
add eax, 2
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x24]
jmp 0x407ce6
xor edx, edx
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x18], edx
add eax, 2
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x24]
jmp 0x407ce6
test edx, edx
je 0x407d78
sub edx, ebx
sar edx, 1
mov dword [ebp - 0x18], edx
js 0x408e86
mov ecx, 1
sub ecx, dword [ebx - 4]
mov eax, dword [ebx - 8]
sub eax, edx
or eax, ecx
jge 0x407d60
push edx
lea ecx, [ebp - 0x24]
call fcn.004032e0
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebx - 8]
jg 0x408e86
mov dword [ebx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov word [eax + edx*2], cx
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x84], ebx
movzx eax, word [ebx]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
add esp, 4
test eax, eax
je 0x407d94
add ebx, 2
jmp 0x407d78
mov eax, dword [ebp - 0x24]
cmp ebx, eax
je 0x407e25
sub ebx, eax
sar ebx, 1
mov dword [ebp - 0x48], ebx
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x20], ecx
test ecx, ecx
js 0x408e90
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, dword [eax - 0xc]
or ecx, edx
jge 0x407dd4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
call fcn.004032e0
mov eax, dword [ebp - 0x24]
lea ebx, [eax + ebx*2]
mov dword [ebp - 0x84], ebx
mov edx, dword [eax - 0xc]
mov ecx, edx
sub ecx, dword [ebp - 0x48]
mov dword [ebp - 0x20], ecx
lea ecx, [ecx*2 + 2]
push ecx
push ebx
lea ecx, [edx*2 + 2]
push ecx
push eax
call fcn.00460b50
add esp, 0x10
mov ecx, dword [ebp - 0x20]
test ecx, ecx
js 0x408e86
mov eax, dword [ebp - 0x24]
cmp ecx, dword [eax - 8]
jg 0x408e86
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov word [eax + ecx*2], dx
mov edx, 0x48d10a
lea ecx, [ebp - 0x24]
call fcn.0045f100
test al, al
jne 0x4086e1
push str.manage_bde__status
lea ecx, [ebp - 0x88]
call fcn.0045fcf0
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x1c]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x88]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407e8b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.manage_bde__status
lea ecx, [ebp - 0x8c]
call fcn.0045fcf0
mov byte [ebp - 4], 0x24
mov byte [ebp - 0x11], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x8c]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x24
mov dl, byte [ebp - 0x11]
lea ecx, [ebp - 0x60]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x8c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407ef6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
push str.ERROR
lea ecx, [ebp - 0x60]
call fcn.0045f840
cmp eax, 0xffffffff
jne 0x4085f1
mov byte [ebp - 0x11], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.wmic_logicaldisk_get_caption_description_filesystem
call fcn.0045fcf0
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x27
mov dl, byte [ebp - 0x11]
lea ecx, [ebp - 0x50]
call fcn.004642f0
mov byte [ebp - 4], 0x2a
push str.__Conversion_Status:____Fully_Encrypted
lea ecx, [ebp - 0x60]
call fcn.0045f840
test eax, eax
jns 0x407f5f
push ecx
push str.__Conversion_Status:____Used_Space_Only_Encrypted
lea ecx, [ebp - 0x60]
call fcn.0045f840
test eax, eax
mov byte [ebp - 0x11], 0
js 0x407f63
mov byte [ebp - 0x11], 1
push ecx
push str._Conversion_Status:____Unknown
lea ecx, [ebp - 0x60]
call fcn.0045f840
test eax, eax
js 0x4082ad
push ecx
push str.Lock_Status:__________Locked
lea ecx, [ebp - 0x60]
call fcn.0045f840
test eax, eax
js 0x4082ad
push str.manage_bde__protectors__get
lea ecx, [ebp - 0x54]
call fcn.0045fcf0
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov ecx, edx
mov eax, dword [ebp - 0x54]
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x4c], ecx
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [edx - 0xc]
test eax, eax
js 0x408e9a
push eax
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edx, eax
mov dword [ebp - 0x20], edx
mov ecx, SysReAllocString
sub ecx, edx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
jl 0x408ea4
add eax, edx
mov dword [ebp - 0x18], eax
js 0x408eae
mov eax, dword [ebp - 0x54]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, dword [ebp - 0x18]
or ecx, edx
jge 0x408013
push dword [ebp - 0x18]
lea ecx, [ebp - 0x54]
call fcn.004032e0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x408023
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x20]
push ecx
lea ecx, [eax + edx*2]
mov edx, dword [ebp - 0x20]
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax - 8]
jg 0x408e86
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x54]
mov word [eax + ecx*2], dx
push ecx
mov dword [ebp - 0x4c], esp
mov dword [ebp - 0xa8], esp
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [eax], 0
jl 0x408088
cmp edx, dword [ecx]
jne 0x408088
mov eax, ecx
mov ecx, dword [ebp - 0x2c]
lock inc dword [ecx]
jmp 0x4080c3
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x48], edx
test edx, edx
je 0x408eb8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
inc edx
push edx
lea eax, [ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x10
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x48]
add eax, 0x10
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
mov byte [ebp - 4], 0x2c
mov byte [ebp - 4], 0x2d
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str._Bitlocker_Recovery_solution_in_working
call fcn.0045fcf0
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2b
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
push str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea ecx, [ebp - 0x7c]
call fcn.0045fcf0
mov byte [ebp - 4], 0x2f
mov byte [ebp - 0x41], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x54]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
mov dl, byte [ebp - 0x41]
lea ecx, [ebp - 0x94]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x7c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40815e
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0x48d94c
lea ecx, [ebp - 0x74]
call fcn.0045fcf0
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xb0]
call fcn.0045f3b0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x74]
push ecx
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.0045f3b0
add esp, 8
mov byte [ebp - 4], 0x36
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
lea edx, [eax - 0x10]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x2c], ecx
cmp edx, ecx
je 0x4081fa
lea edi, [ecx + 0xc]
cmp dword [edi], 0
jl 0x4081eb
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4081e8
mov ecx, edx
call fcn.00403090
mov dword [ebp - 0x4c], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4081e0
mov edi, dword [ebp - 0x2c]
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [ebp - 0x4c]
lea edi, [eax + 0x10]
mov dword [ebp - 0x40], edi
jmp 0x4081fa
mov eax, dword [ebp - 0x4c]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.004030f0
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x35
mov edx, dword [ebp - 0xac]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40821f
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0xb0]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408244
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408266
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40828b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4082ad
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp byte [ebp - 0x11], 1
jne 0x4085cf
push str.manage_bde__protectors__get
lea ecx, [ebp - 0x58]
call fcn.0045fcf0
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x4c], edx
mov ecx, edx
mov eax, dword [ebp - 0x58]
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 0xc]
test eax, eax
js 0x408ebd
push eax
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edx, eax
mov dword [ebp - 0x48], edx
mov ecx, SysReAllocString
sub ecx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
jl 0x408ec7
add eax, edx
mov dword [ebp - 0x18], eax
js 0x408ed1
mov eax, dword [ebp - 0x58]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, dword [ebp - 0x18]
or ecx, edx
jge 0x40833b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x58]
call fcn.004032e0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x40834b
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x48]
push ecx
lea ecx, [eax + edx*2]
mov edx, dword [ebp - 0x48]
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax - 8]
jg 0x408e86
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x58]
mov word [eax + ecx*2], dx
push ecx
mov dword [ebp - 0x4c], esp
mov dword [ebp - 0x98], esp
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [eax], 0
jl 0x4083b0
cmp edx, dword [ecx]
jne 0x4083b0
mov eax, ecx
mov ecx, dword [ebp - 0x2c]
lock inc dword [ecx]
jmp 0x4083eb
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x48], edx
test edx, edx
je 0x408edb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
inc edx
push edx
lea eax, [ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x10
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x48]
add eax, 0x10
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3e
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str._Bitlocker_Recovery_solution_in_working
call fcn.0045fcf0
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x3c
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
push str.____C:WinBDERecoveryKeyBitLockerKeyExtracted.txt
lea ecx, [ebp - 0x64]
call fcn.0045fcf0
mov byte [ebp - 4], 0x40
mov byte [ebp - 0x41], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x64]
push eax
lea edx, [ebp - 0x58]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x40
mov dl, byte [ebp - 0x41]
lea ecx, [ebp - 0x78]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x43
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408483
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push 0x48d94c
lea ecx, [ebp - 0x38]
call fcn.0045fcf0
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0xa0]
call fcn.0045f3b0
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x38]
push ecx
mov edx, eax
lea ecx, [ebp - 0x9c]
call fcn.0045f3b0
add esp, 8
mov byte [ebp - 4], 0x47
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
lea edx, [eax - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x2c], ecx
cmp edx, ecx
je 0x40851f
lea esi, [ecx + 0xc]
cmp dword [esi], 0
jl 0x408510
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x40850d
mov ecx, edx
call fcn.00403090
mov dword [ebp - 0x4c], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x408505
mov esi, dword [ebp - 0x2c]
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x4c]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
jmp 0x40851f
mov eax, dword [ebp - 0x4c]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004030f0
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x48
mov byte [ebp - 4], 0x46
mov edx, dword [ebp - 0x9c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408544
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 0x45
mov edx, dword [ebp - 0xa0]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408569
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4a
mov byte [ebp - 4], 0x43
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40858b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x78]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4085ad
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4085cf
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x4d
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4085f1
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp - 0x28]
dec eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045f570
mov byte [ebp - 4], 0x4e
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea edx, [eax - 0x10]
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x4c], ecx
cmp edx, ecx
je 0x40866f
lea eax, [ecx + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [eax], 0
jl 0x408660
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x408660
mov ecx, edx
call fcn.00403090
mov dword [ebp - 0x20], eax
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408658
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x40866f
mov eax, dword [ebp - 0x20]
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x34]
call fcn.004030f0
mov byte [ebp - 4], 0x4f
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408691
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4086b3
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4086d5
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [ebp - 0x28], 0
jg 0x407c24
jmp 0x4086e4
or ebx, 0xffffffff
mov edx, 0x48d10a
lea ecx, [ebp - 0x3c]
call fcn.0045eff0
test al, al
je 0x4088b2
mov eax, dword [esi - 0xc]
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0045f460
mov byte [ebp - 4], 0x52
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x1c], eax
lea ecx, [esi - 0x10]
mov dword [ebp - 0x30], ecx
cmp eax, ecx
je 0x40876b
lea esi, [ecx + 0xc]
cmp dword [esi], 0
jl 0x40875c
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x40875c
mov ecx, dword [ebp - 0x1c]
call fcn.00403090
mov dword [ebp - 0x1c], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x408754
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
jmp 0x40876b
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x3c]
call fcn.004030f0
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40878d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.working
call fcn.0045fcf0
mov byte [ebp - 4], 0x54
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._Bitlocker_Recovery_solution_finally
call fcn.0045fcf0
mov byte [ebp - 4], 0x55
mov byte [ebp - 4], 0x1b
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
push str._.The_recovery_and_password_key_has_been_saved_to__C:WinBDERecoveryKey_.Please_review_and__Click_on_NEXT_STEP
lea ecx, [ebp - 0x38]
call fcn.0045fcf0
mov byte [ebp - 4], 0x56
push str.The_drives_with_bitlocker_enabled_are
lea ecx, [ebp - 0x28]
call fcn.0045fcf0
mov byte [ebp - 4], 0x57
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.0045f3b0
mov byte [ebp - 4], 0x59
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp - 0x38]
push edx
mov edx, eax
call fcn.0045f3b0
mov byte [ebp - 4], 0x5a
mov ecx, esp
mov dword [ebp - 0x78], esp
push 0x48d168
call fcn.0045fcf0
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0x68]
call fcn.00463120
add esp, 0xc
mov byte [ebp - 4], 0x5d
mov byte [ebp - 4], 0x57
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408865
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x56
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408887
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408b7d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x408b7d
mov edx, 0x48d10a
lea ecx, [ebp - 0x40]
call fcn.0045eff0
test al, al
je 0x408a80
mov eax, dword [edi - 0xc]
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x40]
call fcn.0045f460
mov byte [ebp - 4], 0x60
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [ebp - 0x1c], eax
lea ecx, [edi - 0x10]
mov dword [ebp - 0x30], ecx
cmp eax, ecx
je 0x408939
lea edi, [ecx + 0xc]
cmp dword [edi], 0
jl 0x40892a
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x40892a
mov ecx, dword [ebp - 0x1c]
call fcn.00403090
mov dword [ebp - 0x1c], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x408922
mov edi, dword [ebp - 0x30]
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
lea edi, [eax + 0x10]
mov dword [ebp - 0x40], edi
jmp 0x408939
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x40]
call fcn.004030f0
mov edi, dword [ebp - 0x40]
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40895b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.working
call fcn.0045fcf0
mov byte [ebp - 4], 0x62
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._Bitlocker_Recovery_solution_finally
call fcn.0045fcf0
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x1b
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
push str._is_locked.Please_unlock_them_in_order_to_save_complete_extraction_keys._Click_on_NEXT_STEP
lea ecx, [ebp - 0x38]
call fcn.0045fcf0
mov byte [ebp - 4], 0x64
push str.The_drive
lea ecx, [ebp - 0x28]
call fcn.0045fcf0
mov byte [ebp - 4], 0x65
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x66
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.0045f3b0
mov byte [ebp - 4], 0x67
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp - 0x38]
push edx
mov edx, eax
call fcn.0045f3b0
mov byte [ebp - 4], 0x68
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.DLocked
call fcn.0045fcf0
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x6a
mov ecx, dword [ebp - 0x68]
call fcn.00463120
add esp, 0xc
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x65
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408a33
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x64
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408a55
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408b7d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x408b7d
push str.Please_contact_IT_Support_for_your_problem.
lea ecx, [ebp - 0x70]
call fcn.0045fc60
push ecx
mov dword [ebp - 0x50], esp
mov dword [ebp - 0x30], esp
mov ecx, dword [ebp - 0x90]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0
jl 0x408ac5
cmp edx, dword [ecx]
jne 0x408ac5
mov eax, ecx
mov ecx, dword [ebp - 0x1c]
lock inc dword [ecx]
jmp 0x408b00
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x38], edx
test edx, edx
je 0x408ee0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
inc edx
push edx
lea eax, [ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x38]
add eax, 0x10
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x6f
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._Bitlocker_Recovery_key_Extraction_Error
call fcn.0045fcf0
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x1b
or ecx, 0xffffffff
call fcn.00462c10
add esp, 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x71
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.Bitlocker_is_not_enabled_on_any_drive
call fcn.0045fcf0
mov byte [ebp - 4], 0x72
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push str.Failure
call fcn.0045fcf0
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x68]
call fcn.00463120
add esp, 0xc
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408b9f
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xf
jmp 0x408c95
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408cb3
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xb
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x408cce
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408ce9
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408d07
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408d25
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x90]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x408d47
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
push 0x80004005
call fcn.00403880
call fcn.004031e0
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
call fcn.004031e0
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
int3