Function at 0x406670
Capabilities:
Check os version
Get disk information
Get disk size
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x46bb84]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
mov ebx, 0x200
jne 0x4066e1
push 0x160
call fcn.004353c7
mov edi, eax
mov dword [0x46bb84], edi
add esp, 4
xor eax, eax
mov ecx, 0x58
rep stosd dword es:[edi], eax
mov eax, dword [0x46bb84]
mov dword [eax + 0x28], ebx
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x148], esi
mov edx, dword [0x46bb84]
mov dword [edx + 0x14c], esi
mov eax, dword [0x46bb84]
mov dword [eax + 0x150], esi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x154], esi
mov edx, dword [0x46bb84]
mov dword [edx + 0x28], ebx
mov eax, dword [0x46bb84]
mov byte [eax + 0x140], 0
mov ecx, dword [0x46bb84]
mov byte [ecx + 0x141], 0
mov edx, dword [0x46bb84]
mov byte [edx + 0x142], 0
mov eax, dword [0x46bb84]
cmp dword [eax + 0x68], esi
jne 0x40674f
push 0x30
call fcn.004353c7
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x68], eax
mov edx, dword [0x46bb84]
mov edi, dword [edx + 0x68]
add esp, 4
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x68]
mov word [ecx], bx
mov eax, dword [0x46bb84]
cmp dword [eax + 0x144], esi
jne 0x40678a
push 0x1000c
call fcn.004353c7
mov edx, dword [0x46bb84]
mov dword [edx + 0x144], eax
mov edx, dword [0x46bb84]
mov edi, dword [edx + 0x144]
add esp, 4
xor eax, eax
mov ecx, 0x4003
rep stosd dword es:[edi], eax
mov eax, dword [0x46bb84]
cmp dword [eax + 0x158], esi
jne 0x4067b6
push 4
push 0x1000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x158], eax
mov eax, dword [0x46bb84]
cmp eax, esi
mov ebx, dword [eax + 0x68]
mov dword [ebp - 0x30], ebx
je 0x4079bc
cmp ebx, esi
je 0x4079bc
push 0x46b148
mov dword [0x46b148], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x46b14c], 4
mov byte [ebp - 1], 1
jae 0x4067f2
mov byte [ebp - 1], 0
cmp dword [0x46b158], 2
je 0x4067ff
mov byte [ebp - 1], 0
mov dl, byte [ebp + 8]
cmp dl, 0x61
jl 0x40680f
cmp dl, 0x7a
jg 0x40680f
add dl, 0xe0
or ecx, 0xffffffff
xor eax, eax
mov edi, str..C:
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x2c]
mov dword [ebp + 8], esi
mov esi, edi
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x46bb84]
lea esi, [ecx + 0x64]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x46314c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov dword [ebp + 8], esi
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
mov byte [ebp - 0x28], dl
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x46bb84]
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ecx + 0x64], dl
push 0x32
lea edx, [ebp - 0xc8]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [0x46bb84]
lea edx, [ebp - 0x1c]
push edx
push 0xc8
lea eax, [ebp - 0x198]
push eax
add ecx, 0x64
push ecx
call edi
test eax, eax
jne 0x406940
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x22
je 0x406973
cmp eax, 0x15
jne 0x406906
push 0x10001
push str.System_Error
push str.The_device_is_not_ready.__Make_sure_there_is_a_disk_in_the_drive_and_then_click_on_OK
push 0
call esi
cmp eax, 2
je 0x4069aa
cmp eax, 3
je 0x4069aa
cmp eax, 7
je 0x4069aa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40687f
call fcn.004028e0
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x463148
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [ebp - 0xc8]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x46bb84]
mov byte [ecx + 0x141], 1
mov edi, 0x463140
lea esi, [ebp - 0xc8]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x4069bd
test al, al
je 0x40696f
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x4069bd
add esi, 2
add edi, 2
test al, al
jne 0x40694b
xor eax, eax
jmp 0x4069c2
mov edx, dword [0x46bb84]
or ecx, 0xffffffff
mov byte [edx + 0x141], 1
xor eax, eax
mov edi, 0x463148
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
lea edx, [ebp - 0xc8]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x406940
mov ecx, dword [0x46bb84]
pop edi
or eax, 0xffffffff
pop esi
mov dword [ecx + 0x60], eax
pop ebx
mov esp, ebp
pop ebp
ret
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406a13
mov edi, 0x463134
lea esi, [ebp - 0xc8]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x4069f9
test al, al
je 0x4069f5
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x4069f9
add esi, 2
add edi, 2
test al, al
jne 0x4069d1
xor eax, eax
jmp 0x4069fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406ab0
mov edx, dword [0x46bb84]
mov byte [edx + 0x140], 1
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x46bb84]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
add ecx, 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x406a5a
mov edx, dword [0x46bb84]
mov al, byte [edx + 0x141]
test al, al
jne 0x406a5a
call fcn.004028e0
cmp dword [0x46b158], 2
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20000080
push 3
push 0
push 3
push 0xc0000000
je 0x406b5d
push str..VWIN32
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x18], esi
jne 0x406b6c
push 0x10000
push str.Fatal_Error
push str.Failure_when_trying_to_open_the_volume.
push 0
call edi
jmp 0x406b6c
mov edi, str.FAT32
lea esi, [ebp - 0xc8]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x406ae3
test al, al
je 0x406adf
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x406ae3
add esi, 2
add edi, 2
test al, al
jne 0x406abb
xor eax, eax
jmp 0x406ae8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406afd
mov eax, dword [0x46bb84]
mov byte [eax + 0x140], 1
jmp 0x406a13
mov edi, 0x463148
lea esi, [ebp - 0xc8]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x406b30
test al, al
je 0x406b2c
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x406b30
add esi, 2
add edi, 2
test al, al
jne 0x406b08
xor eax, eax
jmp 0x406b35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406a13
push 0x10000
push str.not_NTFS_or_FAT
push str.Not_an_NTFS_or_FAT_file_system_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x60], esi
je 0x407987
cmp esi, 0xffffffff
je 0x407987
xor eax, eax
mov ecx, 0x18
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
mov al, byte [ebp - 1]
xor edi, edi
test al, al
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x68], edi
je 0x406c26
cmp dword [0x46b158], 2
jne 0x406c26
push 0x60
lea edx, [ebp - 0x94]
push edx
push edi
push edi
push 0x90064
lea eax, [ebp - 0xd0]
push eax
push edi
push edi
push edi
push esi
call fcn.00402360
cmp eax, 0xc0000010
jne 0x406bf5
mov eax, dword [0x46bb84]
mov cl, byte [eax + 0x141]
test cl, cl
jne 0x406c26
mov byte [eax + 0x140], 1
jmp 0x406c26
cmp eax, edi
je 0x406bff
mov byte [ebp - 1], 0
jmp 0x406c26
cmp dword [ebp - 0x60], 0x80
mov eax, dword [ebp - 0x64]
mov byte [ebp - 1], 1
ja 0x406c18
cmp eax, 0x400
jae 0x406c26
jmp 0x406c1f
cmp eax, 0x400
jae 0x406c26
mov dword [ebp - 0x64], 0x400
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004061d0
mov esi, eax
xor eax, eax
mov ecx, 0xc
mov edi, ebx
rep stosd dword es:[edi], eax
mov dx, word [esi + 0xb]
mov word [ebx], dx
mov al, byte [esi + 0xd]
mov byte [ebx + 2], al
mov cx, word [esi + 0xe]
mov word [ebx + 4], cx
mov dl, byte [esi + 0x10]
mov byte [ebx + 6], dl
mov ax, word [esi + 0x11]
mov word [ebx + 8], ax
mov cx, word [esi + 0x13]
mov word [ebx + 0xa], cx
mov dl, byte [esi + 0x15]
mov byte [ebx + 0xc], dl
mov ax, word [esi + 0x16]
mov word [ebx + 0xe], ax
mov cx, word [esi + 0x18]
mov word [ebx + 0x10], cx
mov dx, word [esi + 0x1a]
mov word [ebx + 0x12], dx
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x14], eax
mov ecx, dword [esi + 0x20]
mov dword [ebx + 0x18], ecx
mov edx, dword [esi + 0x24]
mov dword [ebx + 0x1c], edx
mov ax, word [esi + 0x28]
mov word [ebx + 0x20], ax
mov cx, word [esi + 0x2a]
mov word [ebx + 0x24], cx
mov edx, dword [esi + 0x2c]
mov dword [ebx + 0x28], edx
mov ax, word [esi + 0x30]
mov word [ebx + 0x2c], ax
mov cx, word [esi + 0x32]
add esp, 4
cmp word [ebx + 0xa], 0
mov word [ebx + 0x2e], cx
je 0x406cce
xor edi, edi
mov dword [ebx + 0x18], edi
jmp 0x406cd0
xor edi, edi
push esi
call fcn.00406040
push esi
mov byte [ebp + 0xb], al
call fcn.00405e60
mov cl, byte [ebp + 0xb]
add esp, 8
test cl, cl
je 0x406d19
test al, al
je 0x406d6a
mov edx, dword [0x46bb84]
mov al, byte [edx + 0x141]
test al, al
je 0x406d13
push 0x10000
push 0x463148
push str.This_is_an_unknown_or_raw_file_system__trying_to_interpret_it_as_NTFS
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp + 0xb], 0
jmp 0x406d6a
test al, al
jne 0x406d6a
mov eax, dword [0x46bb84]
mov cl, byte [eax + 0x141]
test cl, cl
je 0x406d42
push 0x10000
push 0x463148
push str.This_is_an_unknown_or_raw_file_system_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x46bb84]
push 5
lea edx, [esi + 3]
push str.NTFS
push edx
mov byte [ecx + 0x141], 1
call fcn.0041caf0
add esp, 0xc
test eax, eax
je 0x406d6a
mov byte [ebp + 0xb], 1
cmp word [ebx], 0x1000
jbe 0x406d87
push 0x10000
push str.Invalid_Boot_Sector
push str.BytesPerSector___2048._The_boot_sector_is_invalid_or_corrupt__or_this_is_not_the_root_of_the_volume_set
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp byte [ebx + 6], 2
jbe 0x406dac
push 0x10000
push str.Invalid_Boot_Sector
push str.Number_of_Fats___2.__The_boot_sector_is_invalid_or_corrupt__or_this_is_not_the_root_of_the_volume_set
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 0xe9
je 0x406dd0
cmp al, 0xeb
je 0x406dd0
cmp al, 0x49
je 0x406dd0
push 0x10000
push str.Invalid_Boot_Sector
push str.Jump_block_bad.__The_boot_sector_may_be_invalid_or_corrupt__n_or_this_is_not_the_root_of_the_volume_set__or_this_is_a_non_bootable_device
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, byte [ebp + 0xb]
test al, al
je 0x406e0b
mov ecx, dword [ebx + 0x18]
mov eax, 0x64
cmp ecx, eax
ja 0x406e3a
cmp word [ebx + 0xa], ax
ja 0x406e3a
push str.pBpb__LargeSectors___100__pBpb__Sectors___100
push 0x6ef
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x406e3a
push eax
call fcn.0041c4fb
cmp dword [esi + 0x2c], edi
jg 0x406e3a
jl 0x406e18
cmp dword [esi + 0x28], 0x64
ja 0x406e3a
push str.BootSector__NumberSectors___100
push 0x6f1
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x406e3a
push eax
call fcn.0041c4fb
mov ax, word [ebx]
cmp ax, 0x80
jb 0x406e49
cmp ax, 0x1000
jbe 0x406e6b
push str.pBpb__BytesPerSector__128__pBpb__BytesPerSector___4096
push 0x6f3
push str.E:_srcundeleteRawIO.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x406e6b
push eax
call fcn.0041c4fb
mov al, byte [ebp + 0xb]
test al, al
je 0x406e80
mov eax, dword [0x46bb84]
mov byte [eax + 0x140], 1
jmp 0x406e8d
mov ecx, dword [0x46bb84]
mov byte [ecx + 0x140], 0
mov eax, dword [ebp - 0x10]
cmp eax, edi
jne 0x406e9c
xor eax, eax
mov ax, word [ebx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
jne 0x406eab
xor ecx, ecx
mov cl, byte [ebx + 2]
mov dword [ebp - 0xc], ecx
xor edx, edx
mov dx, word [ebx]
cmp edx, eax
je 0x406eda
cmp eax, edi
jbe 0x406eda
push 0x10000
push str.Error
push str.I_dont_understand_the_BytesPerSector_in_the_boot_sector_on_this_partition
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, byte [0x4634ec]
test al, al
je 0x406f09
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ebx + 2]
cmp edx, ecx
je 0x406f42
mov al, byte [ebp - 1]
test al, al
je 0x406f2c
push 0x10000
push str.Error
push str.I_dont_understand_the_SectorsPerCluster_in_the_boot_sector_on_this_partition
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, byte [0x4634ec]
test al, al
jne 0x406f29
push 0x8000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebx + 2]
test al, al
jbe 0x406f3f
and eax, 0xff
mov dword [ebp - 0xc], eax
jmp 0x406f42
mov byte [ebx + 2], cl
mov ecx, dword [0x46bb84]
mov dword [ecx], edi
mov edx, dword [0x46bb84]
mov dword [edx + 4], edi
mov eax, dword [0x46bb84]
mov dword [eax + 8], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0xc], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x10], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x14], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x18], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x1c], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x20], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x24], edi
mov eax, dword [0x46bb84]
xor edx, edx
mov dx, word [ebx]
xor ecx, ecx
mov dword [eax + 0x28], edx
mov cx, word [ebx]
mov eax, dword [0x46bb84]
xor edx, edx
mov dl, byte [ebx + 2]
imul ecx, edx
mov dword [eax + 0x2c], ecx
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x30], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x34], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x38], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x3c], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x40], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x44], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x48], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x4c], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x50], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x54], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x58], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x5c], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0xcc], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0xd0], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0xd4], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0xd8], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0xdc], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0xe0], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0xe4], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0xe8], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0xec], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x138], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x13c], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x6c], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x70], edi
mov edx, dword [0x46bb84]
mov dword [edx + 0x74], edi
mov eax, dword [0x46bb84]
mov dword [eax + 0x78], edi
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x7c], edi
mov edx, dword [0x46bb84]
mov byte [edx + 0x80], 0
mov eax, dword [0x46bb84]
mov byte [eax + 0x81], 0
mov ecx, dword [0x46bb84]
mov byte [ecx + 0x82], 0
mov edx, dword [ebp - 8]
mov eax, dword [0x46bb84]
mov dword [eax + 0x18], edx
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x1c], edi
mov edx, dword [0x46bb84]
mov eax, dword [ebp - 8]
mov dword [edx + 0x7c], eax
mov ecx, dword [0x46bb84]
push ecx
call fcn.00406400
mov eax, dword [0x46bb84]
xor edx, edx
mov dl, byte [eax + 0x82]
add esp, 4
mov dword [eax + 0xe0], edx
mov ecx, dword [0x46bb84]
mov al, byte [ecx + 0x140]
test al, al
je 0x40728e
mov ax, word [ebx + 0xa]
cmp ax, di
jbe 0x407166
and eax, 0xffff
cdq
mov dword [ecx + 8], eax
mov eax, dword [0x46bb84]
mov dword [eax + 0xc], edx
jmp 0x407174
mov edx, dword [ebx + 0x18]
mov dword [ecx + 8], edx
mov eax, dword [0x46bb84]
mov dword [eax + 0xc], edi
xor edx, edx
mov dx, word [ebx + 0xe]
xor ecx, ecx
mov cl, byte [ebx + 2]
mov edi, ecx
lea eax, [edx + edi - 1]
cdq
idiv edi
xor ecx, ecx
mov cl, byte [ebx + 6]
imul eax, ecx
cdq
mov ebx, eax
mov dword [ebp + 8], ebx
mov ebx, edx
mov eax, edi
cdq
push edx
push eax
mov eax, dword [0x46bb84]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
push eax
call fcn.0041c8a0
mov ecx, dword [ebp + 8]
sub eax, ecx
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x10], eax
mov eax, dword [0x46bb84]
sbb edx, ebx
mov ebx, dword [ebp - 0x30]
mov dword [eax + 0x14], edx
mov di, word [ebx + 0xe]
test di, di
jne 0x4071fc
xor eax, eax
mov ax, word [ebx + 0xa]
test ax, ax
je 0x4071ee
xor ecx, ecx
mov cl, byte [ebx + 6]
and eax, 0xffff
imul ecx, dword [ebx + 0x1c]
jmp 0x40723e
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov cl, byte [ebx + 6]
imul ecx, dword [ebx + 0x1c]
jmp 0x40723e
xor eax, eax
mov ax, word [ebx + 0xa]
test ax, ax
je 0x407211
and eax, 0xffff
mov dword [ebp + 8], eax
jmp 0x407217
mov edx, dword [ebx + 0x18]
mov dword [ebp + 8], edx
xor eax, eax
mov ax, word [ebx + 8]
xor ecx, ecx
mov cx, word [ebx]
xor edx, edx
and edi, 0xffff
shl eax, 5
div ecx
xor ecx, ecx
mov cl, byte [ebx + 6]
mov edx, eax
mov eax, dword [ebp + 8]
sub eax, edx
imul ecx, edi
sub eax, ecx
xor edx, edx
mov dx, word [ebx + 4]
xor ecx, ecx
mov cl, byte [ebx + 2]
sub eax, edx
xor edx, edx
div ecx
mov edx, dword [0x46bb84]
mov dword [edx + 0x10], eax
mov ecx, dword [0x46bb84]
xor eax, eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x18], edx
mov edx, dword [0x46bb84]
mov dword [edx + 0x1c], eax
mov ecx, dword [0x46bb84]
mov al, byte [ecx + 0x140]
test al, al
jne 0x40797d
mov eax, dword [esi + 0x28]
mov dword [ecx + 8], eax
mov ecx, dword [esi + 0x2c]
mov edx, dword [0x46bb84]
mov dword [edx + 0xc], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x40], eax
mov edx, dword [esi + 0x34]
mov eax, dword [0x46bb84]
mov dword [eax + 0x44], edx
mov ecx, dword [esi + 0x38]
mov edx, dword [0x46bb84]
mov dword [edx + 0x48], ecx
mov eax, dword [esi + 0x3c]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x4c], eax
movsx edx, byte [esi + 0x40]
mov eax, dword [0x46bb84]
mov dword [eax + 0x34], edx
mov ecx, dword [esi + 0x48]
mov edx, dword [0x46bb84]
mov dword [edx], ecx
mov eax, dword [esi + 0x4c]
mov ecx, dword [0x46bb84]
mov dword [ecx + 4], eax
mov eax, dword [0x46bb84]
xor edx, edx
mov dx, word [ebx]
xor ecx, ecx
mov dword [eax + 0x28], edx
mov cx, word [ebx]
mov eax, dword [0x46bb84]
xor edx, edx
mov dl, byte [ebx + 2]
imul ecx, edx
mov dword [eax + 0x2c], ecx
mov ecx, dword [esi + 0x28]
mov edx, dword [0x46bb84]
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x2c]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0xc], eax
mov edx, dword [esi + 0x30]
mov eax, dword [0x46bb84]
mov dword [eax + 0x40], edx
mov ecx, dword [esi + 0x34]
mov edx, dword [0x46bb84]
mov dword [edx + 0x44], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x48], eax
mov edx, dword [esi + 0x3c]
mov eax, dword [0x46bb84]
mov dword [eax + 0x4c], edx
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x2c]
dec ecx
mov dword [eax + 0xd8], ecx
mov eax, dword [0x46bb84]
mov edx, dword [eax + 0xd8]
not edx
mov dword [eax + 0xdc], edx
mov eax, dword [0x46bb84]
mov dword [eax + 0xe0], 0
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x2c]
cmp eax, 1
jle 0x4073af
inc dword [edx + 0xe0]
cdq
sub eax, edx
mov edx, dword [0x46bb84]
sar eax, 1
cmp eax, 1
jg 0x407399
mov ecx, dword [edx + 0xe0]
mov eax, 0x1000
sar eax, cl
mov dword [edx + 0xec], eax
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0xec]
test ecx, ecx
jne 0x4073e0
mov dword [eax + 0xec], 1
mov eax, dword [0x46bb84]
mov cl, byte [esi + 0x40]
test cl, cl
jge 0x407419
neg ecx
mov edx, 1
shl edx, cl
mov dword [eax + 0x30], edx
mov ecx, dword [0x46bb84]
mov edi, dword [ecx + 0x30]
mov ebx, dword [ecx + 0x2c]
cmp edi, ebx
jae 0x407411
mov eax, ebx
xor edx, edx
div edi
mov dword [ecx + 0xd4], eax
jmp 0x407434
mov eax, edi
xor edx, edx
div ebx
jmp 0x407431
movsx edx, cl
mov ecx, dword [eax + 0xe0]
shl edx, cl
mov dword [eax + 0x30], edx
movsx eax, byte [esi + 0x40]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x34], eax
mov edx, dword [0x46bb84]
mov dword [edx + 0xe4], 0
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0x30]
cmp eax, 1
jle 0x40746f
mov ebx, dword [ecx + 0xe4]
cdq
sub eax, edx
inc ebx
sar eax, 1
cmp eax, 1
mov dword [ecx + 0xe4], ebx
mov ecx, dword [0x46bb84]
jg 0x407452
mov eax, dword [ecx + 0xe4]
sub eax, dword [ecx + 0xe0]
mov dword [ecx + 0xe8], eax
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x34]
test ecx, ecx
jne 0x4074a4
mov ecx, dword [eax + 0xe0]
sub ecx, dword [eax + 0xe4]
mov dword [eax + 0xe8], ecx
mov eax, dword [0x46bb84]
mov cl, byte [esi + 0x44]
test cl, cl
jge 0x4074e4
neg ecx
mov edx, 1
shl edx, cl
mov dword [eax + 0xd0], edx
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0xd0]
mov edi, dword [ecx + 0x2c]
cmp eax, edi
jae 0x4074d8
shr eax, 9
mov dword [ecx + 0xcc], eax
jmp 0x407506
xor edx, edx
div edi
mov dword [ecx + 0xcc], eax
jmp 0x407506
movsx ecx, cl
mov dword [eax + 0xcc], ecx
mov eax, dword [0x46bb84]
mov edx, dword [eax + 0xcc]
mov ecx, dword [eax + 0xe0]
shl edx, cl
mov dword [eax + 0xd0], edx
mov eax, dword [0x46bb84]
movsx ecx, byte [eax + 0xe0]
mov edx, dword [eax + 0x28]
mov dword [ebp + 8], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push ecx
push eax
push 0
push edx
call fcn.0041c860
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
shrd eax, edx, cl
sar edx, cl
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x10], eax
mov eax, dword [0x46bb84]
mov dword [eax + 0x14], edx
mov eax, dword [0x46bb84]
lea ecx, [eax + 0x10]
mov edx, dword [ecx]
mov dword [eax + 0xa8], edx
mov eax, dword [ecx + 4]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0xac], eax
mov edx, dword [0x46bb84]
movsx eax, byte [edx + 0xe0]
mov dword [ebp + 8], eax
mov dword [ebp - 0x34], 0xffff0000
mov dword [ebp - 0x30], 0xfff
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
shrd eax, edx, cl
sar edx, cl
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x138], eax
mov eax, dword [0x46bb84]
mov dword [eax + 0x13c], edx
mov ecx, dword [0x46bb84]
mov word [ecx + 0xfc], 0xffff
mov eax, dword [0x46bb84]
cmp dword [eax + 0x2c], 0x1000
jbe 0x4075da
and word [eax + 0xfc], 0xff00
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x30]
lea edx, [ecx + ecx*4]
shr edx, 4
mov dword [eax + 0xc8], edx
mov eax, dword [esi + 0x48]
mov ecx, dword [0x46bb84]
mov dword [ecx], eax
mov edx, dword [esi + 0x4c]
mov eax, dword [0x46bb84]
mov dword [eax + 4], edx
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x12c], 0x10000
mov eax, dword [0x46bb84]
mov edx, dword [eax + 0x12c]
mov edi, dword [eax + 0xd8]
mov ecx, dword [eax + 0xe0]
add edx, edi
shr edx, cl
mov dword [eax + 0x130], edx
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x44]
and ecx, 0xffffffe0
mov dword [eax + 0x50], ecx
mov eax, dword [0x46bb84]
mov dword [eax + 0x54], edx
mov esi, dword [0x46bb84]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov ecx, 3
call fcn.0041c950
mov edi, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add eax, edi
adc edx, ecx
add eax, 0x1f
adc edx, 0
and eax, 0xffffffe0
mov dword [esi + 0x58], eax
mov al, byte [ebp - 1]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x5c], edx
test al, al
mov eax, dword [0x46bb84]
jne 0x4076b4
mov cl, byte [eax + 0x141]
test cl, cl
jne 0x40797d
mov edx, dword [ebp - 8]
mov dword [eax + 0x18], edx
mov eax, dword [0x46bb84]
pop edi
pop esi
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 0x18]
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [eax + 0x140]
test cl, cl
jne 0x40797d
mov cl, byte [eax + 0x141]
test cl, cl
jne 0x40797d
mov ecx, dword [ebp - 0x7c]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x78]
mov eax, dword [0x46bb84]
mov dword [eax + 0x1c], edx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [0x46bb84]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [0x46bb84]
mov dword [ecx + 0x3c], eax
mov edi, dword [0x46bb84]
mov edx, dword [edi + 0x5c]
mov ecx, dword [ebp - 0x38]
lea eax, [edi + 0x58]
cmp edx, ecx
mov edx, dword [ebp - 0x3c]
jl 0x40772f
jg 0x407717
mov esi, dword [eax]
cmp esi, edx
jbe 0x40772f
test ecx, ecx
jl 0x40772f
jg 0x407721
test edx, edx
jbe 0x40772f
mov dword [eax], edx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 4], ecx
mov edi, dword [0x46bb84]
mov edx, dword [ebp - 0x94]
cmp edx, dword [edi]
jne 0x407744
mov eax, dword [ebp - 0x90]
cmp eax, dword [edi + 4]
je 0x407765
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x10000
push str.Nonmatch
push str.The_Volume_Serial_Number_in_the_boot_sector_does_not_match_what_NT_says.
push 0
call esi
mov edi, dword [0x46bb84]
jmp 0x40776b
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [edi + 8]
jne 0x407781
mov edx, dword [ebp - 0x88]
cmp edx, dword [edi + 0xc]
je 0x40779a
push 0x10000
push str.Nonmatch
push str.The_number_of_sectors_in_the_boot_sector_does_not_match_what_NT_says.
push 0
call esi
mov edi, dword [0x46bb84]
mov eax, dword [edi + 0x68]
xor ecx, ecx
mov cl, byte [eax + 2]
mov eax, ecx
cdq
push edx
mov edx, dword [edi + 0xc]
push eax
mov eax, dword [edi + 8]
push edx
push eax
call fcn.0041c8a0
mov ecx, dword [ebp - 0x84]
cmp ecx, eax
jne 0x4077c5
mov eax, dword [ebp - 0x80]
cmp eax, edx
je 0x4077de
push 0x10000
push str.Nonmatch
push str.The_total_clusters_in_the_boot_sector_does_not_match_what_NT_says.
push 0
call esi
mov edi, dword [0x46bb84]
mov eax, dword [ebp - 8]
test eax, eax
jbe 0x407813
cmp eax, 0xffffffff
je 0x407813
mov edx, dword [ebp - 0x7c]
xor ecx, ecx
cmp edx, eax
jne 0x4077fa
mov eax, dword [ebp - 0x78]
cmp eax, ecx
je 0x407813
push 0x10000
push str.Nonmatch
push str.The_Free_Clusters_from_GetDiskFreeSpace_does_not_match_the_NTFS_Volumne_info..._r_n__probably_due_to_ongoing_activity..._no_problem_
push 0
call esi
mov edi, dword [0x46bb84]
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [edi + 0x28]
je 0x407834
push 0x10000
push str.Nonmatch
push str.The_bytes_per_sector_in_the_boot_sector_does_not_match_what_NT_says.
push 0
call esi
mov edi, dword [0x46bb84]
mov edx, dword [edi + 0x68]
mov ecx, dword [ebp - 0x68]
xor eax, eax
mov al, byte [edx + 2]
imul eax, dword [edi + 0x28]
cmp ecx, eax
je 0x407863
push 0x10000
push str.Nonmatch
push str.The_bytes_per_cluster_in_the_boot_sector_does_not_match_what_NT_says.
push 0
call esi
mov ecx, dword [ebp - 0x68]
mov edi, dword [0x46bb84]
mov eax, dword [edi + 0x34]
test eax, eax
jbe 0x4078a9
cmp eax, 0x80
jae 0x4078a9
cmp ecx, 0x400
jle 0x4078c3
cmp ecx, 0x10000
mov eax, ecx
jl 0x407888
mov eax, 0x10000
cmp dword [ebp - 0x64], eax
je 0x4078a9
push 0x10000
push str.Nonmatch
push str.The_bytes_per_file_record_segment_doesnt_match_what_we_expected.
push 0
call esi
mov ecx, dword [ebp - 0x68]
mov edi, dword [0x46bb84]
mov eax, dword [edi + 0x34]
test eax, eax
jbe 0x407900
cmp eax, 0x80
jae 0x407900
cmp ecx, 0x400
jle 0x4078ca
mov eax, ecx
jmp 0x4078d1
mov eax, 0x400
jmp 0x407888
mov eax, 0x400
jmp 0x4078de
cmp ecx, 0x10000
jl 0x4078de
mov eax, 0x10000
xor edx, edx
div ecx
cmp dword [ebp - 0x60], eax
je 0x407900
push 0x10000
push str.Nonmatch
push str.The_clusters_per_file_record_segment_doesnt_match_what_we_expected.
push 0
call esi
mov edi, dword [0x46bb84]
mov eax, dword [edi + 0x34]
test eax, eax
jbe 0x40792c
cmp eax, 0x80
jae 0x40792c
cmp dword [ebp - 0x60], eax
je 0x40792c
push 0x10000
push str.Nonmatch
push str.The_clusters_per_file_record_segment_doesnt_match_the_value_in_the_boot_sector.
push 0
call esi
mov edi, dword [0x46bb84]
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [edi + 0x40]
jne 0x40793c
mov edx, dword [ebp - 0x50]
cmp edx, dword [edi + 0x44]
je 0x407955
push 0x10000
push str.Nonmatch
push str.The_MFT_Start_LCN_doesnt_match_what_we_found_the_in_boot_sector.
push 0
call esi
mov edi, dword [0x46bb84]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [edi + 0x48]
cmp ecx, edx
lea eax, [edi + 0x48]
jne 0x40796a
mov edx, dword [ebp - 0x48]
cmp edx, dword [eax + 4]
je 0x40797d
push 0x10000
push str.Nonmatch
push str.The_MFT2_Start_LCN_doesnt_match_what_we_found_in_the_boot_sector.
push 0
call esi
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4079ae
push 0x10000
push str.Error
push str.Access_denied_when_trying_to_open_the_volume._r_nYou_either_lack_needed_Administrator_rights__r_nor_this_disk_cannot_be_opened_for_direct_access_r_n__for_example__virtual_drives_created_by_SUSBT_
push 0
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004028e0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
push str.Fatal_error
push str.Cannot_allocate_memory_to_open_volume_and_read_boot_sector
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0041c4fb
nop
nop
nop
nop
nop
nop
nop