Function at 0x403d20
Capabilities:
Contain obfuscated stackstrings
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42fc40
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43cc00]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
call fcn.0040c0d4
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x403d6a
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x7c], esi
mov ecx, dword [ebp + 0x11a50]
push ecx
lea edi, [esp + 0x88]
call fcn.00402e40
mov byte [esp + 0x7c], 1
mov edx, dword [eax]
push edx
lea eax, [esp + 0x20]
push str._sLog
push eax
call fcn.004028d0
mov byte [esp + 0x88], 0
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403dd6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x4349fc
jne 0x403e24
call fcn.00402520
push ecx
mov byte [esp + 0x84], 2
mov edx, esp
mov dword [esp + 0x5c], esp
push str._Fail__Create_Folder:
push edx
lea ecx, [esp + 0x2c]
call fcn.00409010
mov eax, dword [ebp + 0x11a50]
add esp, 8
push eax
jmp 0x403e51
call fcn.00402520
push ecx
mov byte [esp + 0x84], 3
mov ecx, esp
mov dword [esp + 0x5c], esp
push str._OK__Create_Folder:
push ecx
lea ecx, [esp + 0x2c]
call fcn.00409010
mov edx, dword [ebp + 0x11a50]
add esp, 8
push edx
mov byte [esp + 0x88], 0
call fcn.004029e0
mov dword [esp + 0x84], esi
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4349fc
call fcn.00402520
push ecx
mov byte [esp + 0x84], 4
mov ecx, esp
mov dword [esp + 0x58], esp
push str.Get_Disk_info
call fcn.00402520
mov eax, dword [ebp + 0x11a50]
push eax
mov byte [esp + 0x88], 0
call fcn.004029e0
lea eax, [ebp + 0x10]
push eax
call fcn.0040a4b0
mov esi, eax
test esi, esi
je 0x403fd8
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x403d60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x7c], 5
mov ecx, dword [esp + 0x84]
push esi
push ecx
lea edx, [esp + 0x38]
push str.__d_Error_Getting_System_Disk_Info._Return_Code:_d
push edx
call fcn.004028d0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4349fc
call fcn.00402520
mov byte [esp + 0x80], 6
mov esi, dword [esp + 0x34]
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x58], esp
mov ebx, esp
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x403f44
cmp eax, dword [esi]
jne 0x403f44
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x403f7f
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4047ef
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00417f28
add esp, 0x10
add edi, 0x10
mov dword [ebx], edi
mov edx, dword [ebp + 0x11a50]
push edx
mov byte [esp + 0x88], 5
call fcn.004029e0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x7c], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403fbe
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [esp + 0x84]
add eax, 1
cmp eax, 0x14
mov dword [esp + 0x84], eax
jl 0x403e65
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x4349fc
call fcn.00402520
push ecx
mov byte [esp + 0x84], 7
mov ecx, esp
mov dword [esp + 0x5c], esp
push str.m_DiskCount
call fcn.00402520
mov ecx, dword [ebp + 0x11a50]
push ecx
mov byte [esp + 0x88], 0
call fcn.004029e0
xor edx, edx
xor eax, eax
lea ecx, [ebp + 0x18]
cmp dword [ecx], 0x3e7
je 0x404036
add eax, 1
add edx, 1
add ecx, 0x18
cmp eax, 0x14
jl 0x404020
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x4349fc
mov dword [ebp + 4], edx
call fcn.00402520
push ecx
mov byte [esp + 0x84], 8
mov ecx, esp
mov dword [esp + 0x5c], esp
push str.AssignLetterToEFI
call fcn.00402520
mov edx, dword [ebp + 0x11a50]
push edx
mov byte [esp + 0x88], 0
call fcn.004029e0
cmp byte [ebp + 0xb], 0
jne 0x404086
push ebp
call fcn.00406010
mov esi, ebp
call fcn.00408dd0
test al, al
jne 0x40409f
mov ecx, ebp
call fcn.00408050
mov ecx, ebp
call fcn.00406cc0
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4349fc
call fcn.00402520
lea eax, [esp + 0x28]
push str.RecoveryLetter:
lea ecx, [ebp + 0x11a70]
push eax
mov byte [esp + 0x88], 9
call fcn.00409010
push str.___ESPLetter:
push eax
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0x94], 0xa
call fcn.00403080
add esp, 0x14
lea ebx, [ebp + 0x11a74]
push ebx
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x8c], 0xb
call fcn.00402280
add esp, 0xc
push 0x434d38
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x8c], 0xc
call fcn.00403080
add esp, 0xc
lea ecx, [ebp + 0x11a78]
push ecx
push eax
lea ecx, [esp + 0x90]
push ecx
mov byte [esp + 0x8c], 0xd
call fcn.00402280
add esp, 8
mov edx, esp
mov byte [esp + 0x84], 0xe
mov dword [esp + 0x58], esp
push 0x434d34
push eax
push edx
call fcn.00403080
add esp, 0xc
mov eax, dword [ebp + 0x11a50]
push eax
mov byte [esp + 0x88], 0x13
call fcn.004029e0
mov byte [esp + 0x7c], 0x12
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404199
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x11
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x10
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0xf
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404208
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40422d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404247
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x7c], 0x14
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404276
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x7c], 0x15
call fcn.0040c993
push str.C:OEMPreloadCommandPAPPXP
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 0x16
call fcn.00402520
push 0
push ecx
mov byte [esp + 0x84], 0x17
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.V:OEMPreloadCommandPAP
call fcn.00402520
call fcn.00401ba0
add esp, 8
test al, al
je 0x4042e4
push 0x1f
push str.V:OEMPreloadCommandPAPPXP
lea ecx, [esp + 0x34]
call fcn.004019b0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.W:OEMPreloadCommandPAP
call fcn.00402520
call fcn.00401ba0
add esp, 8
test al, al
je 0x404316
push 0x1f
push str.W:OEMPreloadCommandPAPPXP
lea ecx, [esp + 0x34]
call fcn.004019b0
mov ecx, dword [esp + 0x2c]
push 0
push ecx
lea ecx, [esp + 0x60]
call fcn.0040ca21
mov esi, eax
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404342
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x7c], 0x18
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404371
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0x7c], 0x19
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4043a0
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
test esi, esi
mov byte [esp + 0x7c], 0x1a
mov dword [esp + 0x20], 0
je 0x404788
lea ecx, [esp + 0x58]
call fcn.0040c68d
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x3c], eax
call fcn.0040cb55
mov byte [esp + 0x7c], 0x1b
mov eax, dword [eax]
mov edi, dword [esp + 0x14]
lea ecx, [edi - 0x10]
lea esi, [eax - 0x10]
cmp esi, ecx
mov dword [esp + 0x84], ecx
je 0x4044b4
mov edx, ecx
cmp dword [edx + 0xc], 0
jl 0x4044a2
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x4044a2
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x404437
cmp eax, dword [esi]
jne 0x404437
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x404472
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4047ef
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov eax, dword [esp + 0x84]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404499
mov eax, dword [esp + 0x84]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0x10
mov dword [esp + 0x14], edi
jmp 0x4044b4
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004019b0
mov edi, dword [esp + 0x14]
mov byte [esp + 0x7c], 0x1a
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4044d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi - 0xc]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x4044fb
push esi
lea ecx, [esp + 0x18]
call fcn.00401720
mov edi, dword [esp + 0x14]
lea ecx, [esi + 1]
push ecx
push edi
call fcn.00418c92
add esp, 8
test esi, esi
jl 0x4047d1
cmp esi, dword [edi - 8]
jg 0x4047d1
mov dword [edi - 0xc], esi
mov word [edi + esi*2], 0
lea esi, [edi - 0x10]
cmp esi, esi
je 0x4045c9
cmp dword [esi + 0xc], 0
jl 0x4045bb
mov ecx, dword [esi]
cmp ecx, ecx
jne 0x4045bb
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40455e
cmp eax, dword [esi]
jne 0x40455e
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x404599
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4047ef
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00417f28
add esp, 0x10
lea eax, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x4045b2
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add edi, 0x10
mov dword [esp + 0x14], edi
jmp 0x4045c9
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.004019b0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x5c]
call fcn.0040cc38
mov byte [esp + 0x7c], 0x1c
mov edx, dword [eax]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
cmp esi, eax
mov dword [esp + 0x84], eax
je 0x4046a5
cmp dword [eax + 0xc], 0
jl 0x404697
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x404697
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40462c
cmp eax, dword [esi]
jne 0x40462c
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x404667
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4047ef
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov eax, dword [esp + 0x84]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40468e
mov eax, dword [esp + 0x84]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0x10
mov dword [esp + 0x24], edi
jmp 0x4046a5
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.004019b0
mov byte [esp + 0x7c], 0x1a
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4046ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x24]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x58], esp
mov dword [esp + 0x88], esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x404701
cmp eax, dword [esi]
jne 0x404701
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40473c
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4047ef
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x88]
add edi, 0x10
mov dword [ecx], edi
push ecx
mov byte [esp + 0x84], 0x1d
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.Get_PXP.ini_Path
call fcn.00402520
mov edx, dword [ebp + 0x11a50]
push edx
mov byte [esp + 0x88], 0x1a
call fcn.004029e0
add dword [esp + 0x20], 1
cmp dword [esp + 0x38], 0
jne 0x4043c5
lea ecx, [esp + 0x58]
call fcn.0040c5bd
mov esi, dword [esp + 0x24]
push 0
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x8c], esp
mov dword [esp + 0x8c], esp
mov dword [esp + 0x54], esi
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x4047db
cmp eax, dword [esi]
jne 0x4047db
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x404817
push 0x80070057
call fcn.004016a0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x4047f4
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00417f28
add esp, 0x10
mov edx, dword [esp + 0x8c]
add edi, 0x10
mov dword [edx], edi
call fcn.00401ba0
add esp, 8
test al, al
je 0x404bc4
cmp dword [esp + 0x20], 1
jne 0x404bc4
push ecx
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x88], esp
mov dword [esp + 0x88], esp
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x404870
cmp eax, dword [esi]
jne 0x404870
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x4048ac
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x404889
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x88]
add edi, 0x10
mov dword [ecx], edi
lea edi, [esp + 0x3c]
call fcn.00405a50
mov byte [esp + 0x7c], 0x1e
mov ecx, dword [eax]
mov esi, dword [esp + 0x28]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x404929
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x40491b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40491b
push eax
call fcn.00401880
mov dword [esp + 0x88], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x40490b
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x84]
add ecx, 0x10
mov dword [esp + 0x28], ecx
jmp 0x404929
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.004019b0
mov byte [esp + 0x7c], 0x1a
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40494e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x28]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x58], esp
mov dword [esp + 0x88], esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x404985
cmp eax, dword [esi]
jne 0x404985
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4049c1
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x40499e
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00417f28
add esp, 0x10
mov edx, dword [esp + 0x88]
add edi, 0x10
mov dword [edx], edi
push ecx
mov byte [esp + 0x84], 0x1f
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.Get_LPCD.dat_Info__LangPN
call fcn.00402520
mov eax, dword [ebp + 0x11a50]
push eax
mov byte [esp + 0x88], 0x1a
call fcn.004029e0
push ecx
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x88], esp
mov dword [esp + 0x88], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x404a2f
cmp eax, dword [esi]
jne 0x404a2f
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x404a6b
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x404a48
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x88]
add edi, 0x10
lea edx, [esp + 0x3c]
mov dword [ecx], edi
push edx
mov ecx, ebp
call fcn.00405b90
mov byte [esp + 0x7c], 0x20
mov ecx, dword [eax]
mov esi, dword [esp + 0x18]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x404aeb
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x404add
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x404add
push eax
call fcn.00401880
mov dword [esp + 0x88], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x404acd
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x84]
add ecx, 0x10
mov dword [esp + 0x18], ecx
jmp 0x404aeb
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.004019b0
mov byte [esp + 0x7c], 0x1a
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404b10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x18]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x58], esp
mov dword [esp + 0x88], esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x404b47
cmp eax, dword [esi]
jne 0x404b47
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x404b83
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x404b60
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x88]
add edi, 0x10
mov dword [ecx], edi
push ecx
mov byte [esp + 0x84], 0x21
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.Parse_Lang.xml_Info__LangID
call fcn.00402520
mov edx, dword [ebp + 0x11a50]
push edx
mov byte [esp + 0x88], 0x1a
call fcn.004029e0
jmp 0x404cbc
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push str.PXP_file_not_exist
call fcn.00402520
mov byte [esp + 0x80], 0x22
push ecx
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x8c], esp
mov dword [esp + 0x8c], esp
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x404c0f
cmp eax, dword [esi]
jne 0x404c0f
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x404c4b
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x404c28
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x8c]
add edi, 0x10
mov dword [ecx], edi
mov edx, dword [ebp + 0x11a50]
push edx
mov byte [esp + 0x88], 0x1a
call fcn.004029e0
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x4349fc
call fcn.00402520
push ecx
mov byte [esp + 0x84], 0x23
mov ecx, esp
mov dword [esp + 0x5c], esp
push str.May_be_Multiple_Language._Default_bootlocale_is__en_US_.
call fcn.00402520
mov eax, dword [ebp + 0x11a50]
push eax
mov byte [esp + 0x88], 0x1a
call fcn.004029e0
push 5
push str.en_US
lea ecx, [esp + 0x20]
call fcn.004019b0
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404cd6
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x7c], 0x24
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404d05
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0x7c], 0x25
mov ecx, dword [ebp + 0x11a50]
push ecx
lea edi, [esp + 0x88]
call fcn.00402e40
mov byte [esp + 0x7c], 0x26
mov edx, dword [eax]
push edx
lea eax, [esp + 0x20]
push str._sLog
push eax
call fcn.004028d0
mov byte [esp + 0x88], 0x25
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404d8c
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov byte [esp + 0x7c], 0x27
call fcn.0040c0d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404dbb
push 0x80004005
call fcn.004016a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x7c], 0x28
mov ecx, dword [ebp + 0x11a50]
push ecx
lea edi, [esp + 0x88]
call fcn.00402e40
mov byte [esp + 0x7c], 0x29
mov edx, dword [eax]
push edx
lea eax, [esp + 0x34]
push str._sCopyEFI_byOEM.cmd
push eax
call fcn.004028d0
mov byte [esp + 0x88], 0x28
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404e28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
push 0x435024
push ecx
call fcn.004186e2
mov edi, dword [esp + 0x24]
add esp, 8
push 0
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
add edi, 0xfffffff0
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x8c], esp
mov dword [esp + 0x8c], esp
mov dword [esp + 0x5c], edi
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x404e7e
cmp eax, dword [edi]
jne 0x404e7e
mov esi, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x404eba
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x404e97
call fcn.004017f0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x8c]
add esi, 0x10
mov dword [ecx], esi
call fcn.00401ba0
add esp, 8
test al, al
jne 0x404ee9
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push edx
push 0x435028
push eax
call fcn.004186f5
add esp, 0xc
mov ecx, dword [ebx]
push ecx
lea edx, [esp + 0x38]
push str._sEFIOEM
push edx
call fcn.004028d0
mov edi, dword [esp + 0x40]
add esp, 0xc
push 0
push ecx
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x8c], esp
mov dword [esp + 0x8c], esp
mov dword [esp + 0x50], edi
call edx
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x404f3e
cmp eax, dword [edi]
jne 0x404f3e
mov esi, edi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x404f7a
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x404f57
call fcn.004017f0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [edi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.00417f28
add esp, 0x10
mov edx, dword [esp + 0x8c]
add esi, 0x10
mov dword [edx], esi
call fcn.00401ba0
add esp, 8
test al, al
je 0x405052
push ecx
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x40], esp
mov dword [esp + 0x88], esp
call edx
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x404fc5
cmp eax, dword [edi]
jne 0x404fc5
mov esi, edi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x405001
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x404fde
call fcn.004017f0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00417f28
add esp, 0x10
mov ecx, dword [esp + 0x88]
add esi, 0x10
mov dword [ecx], esi
push ecx
mov byte [esp + 0x84], 0x2a
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.Delete_folder
call fcn.00402520
mov edx, dword [ebp + 0x11a50]
push edx
mov byte [esp + 0x88], 0x28
call fcn.004029e0
mov eax, dword [ebx]
mov ecx, dword [esp + 0x20]
push eax
push str.rd__s__q__sEFIOEM__n
push ecx
call fcn.004186f5
add esp, 0xc
mov edx, dword [ebx]
mov edi, dword [esp + 0x20]
push edx
push str.mkdir__sEFIOEM__n
push edi
call fcn.004186f5
mov eax, dword [ebx]
add esp, 0xc
push eax
mov ecx, eax
push ecx
push str.XCOPY__c__e__f__y__h__sEFIMicrosoft__sEFIOEM_n
push edi
call fcn.004186f5
mov edx, dword [ebx]
push edx
push str.Del__Q__A:H__sEFIOEMBootBCD_n
push edi
call fcn.004186f5
add esp, 0x1c
push 0
push ecx
mov eax, esp
mov dword [esp + 0x8c], esp
push str.D2D_XP
lea esi, [ebp + 0x11a78]
push esi
push eax
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.D2D_VISTA
push esi
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push ecx
mov edx, esp
mov dword [esp + 0x8c], esp
push str.D2D_WIN7
push esi
push edx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push ecx
mov eax, esp
mov dword [esp + 0x8c], esp
push str.D2D2
push esi
push eax
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.D2D_WIN8
push esi
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push ecx
mov edx, esp
mov dword [esp + 0x8c], esp
push str.D2D_W10
push esi
push edx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push ecx
mov eax, esp
mov dword [esp + 0x8c], esp
push str.Sources_boot.wim
push esi
push eax
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x4053bf
push 0
push str.RecoveryWindowsRE_
lea esi, [ebp + 0x11a70]
lea ecx, [esp + 0x40]
push esi
push ecx
call fcn.00403080
add esp, 8
mov edx, esp
mov byte [esp + 0x84], 0x2c
mov dword [esp + 0x8c], esp
push str.winre.wim
push eax
push edx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
mov byte [esp + 0x8c], al
mov byte [esp + 0x84], 0x28
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40522e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x84], 0
je 0x40533e
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.RecoveryWindowsREReAgent.xml
push esi
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x405279
mov edx, dword [esi]
push str.RecoveryWindowsRE_
push edx
push str.XCOPY__f__y__h_C:WindowsSystem32RecoveryReAgent.xml__s_s_n
push edi
call fcn.004186f5
add esp, 0x10
push 0
push ecx
mov eax, esp
mov dword [esp + 0x8c], esp
push str.RecoveryWindowsRE_boot.sdi
push esi
push eax
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 8
test al, al
jne 0x40533e
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.C:WindowsBootDVDEFI_boot.sdi
call fcn.00402520
call fcn.00401ba0
add esp, 8
test al, al
je 0x4052d5
mov ecx, dword [esi]
push str.RecoveryWindowsRE_
push ecx
push str.XCOPY__f__y__h_C:WindowsBootDVDEFI_boot.sdi__s_s_n
jmp 0x405335
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.C:WindowsBootDVDPCAT_boot.sdi
call fcn.00402520
call fcn.00401ba0
add esp, 8
test al, al
je 0x405306
mov edx, dword [esi]
push str.RecoveryWindowsRE_
push edx
push str.XCOPY__f__y__h_C:WindowsBootDVDPCAT_boot.sdi__s_s_n
jmp 0x405335
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.C:WindowsSystem32_boot.sdi
call fcn.00402520
call fcn.00401ba0
add esp, 8
test al, al
je 0x40533e
mov eax, dword [esi]
push str.RecoveryWindowsRE_
push eax
push str.XCOPY__f__y__h_C:WindowsSystem32_boot.sdi__s_s_n
push edi
call fcn.004186f5
add esp, 0x10
mov ecx, dword [ebp + 0x11a50]
push ecx
lea edi, [esp + 0x40]
call fcn.00402e40
mov dword [esp + 0x84], eax
mov byte [esp + 0x7c], 0x2d
mov edx, dword [ebp + 0x11a50]
push edx
lea edi, [esp + 0x3c]
call fcn.00402e40
mov ecx, dword [esp + 0x84]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esi]
push ecx
mov ecx, dword [ebx]
push edx
mov edx, dword [eax]
mov eax, dword [esp + 0x2c]
push ecx
push edx
push str.call__smodifybcdtoWinRE.cmd__s__s__s_____sLogmodifybcdLog.log_n
push eax
call fcn.004186f5
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 0x1c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4053b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x28
mov eax, dword [esp + 0x3c]
jmp 0x40543e
mov ecx, dword [ebp + 0x11a50]
push ecx
lea edi, [esp + 0x3c]
call fcn.00402e40
mov dword [esp + 0x84], eax
mov byte [esp + 0x7c], 0x2b
mov edx, dword [ebp + 0x11a50]
push edx
lea edi, [esp + 0x40]
call fcn.00402e40
mov ecx, dword [esp + 0x84]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esi]
push ecx
mov ecx, dword [ebx]
push edx
mov edx, dword [eax]
mov eax, dword [esp + 0x2c]
push ecx
push edx
push str.call__smodifybcdtoPBR.cmd__s__s__s_____sLogmodifybcdLog.log
push eax
call fcn.004186f5
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
add esp, 0x1c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405435
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x28
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40545a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
push esi
call fcn.00418907
add esp, 4
push esi
call fcn.004189d5
mov esi, dword [esp + 0x34]
add esp, 4
push 0
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x8c], esp
mov dword [esp + 0x8c], esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x4054ac
cmp eax, dword [esi]
jne 0x4054ac
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4054e8
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x4054c5
call fcn.004017f0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00417f28
add esp, 0x10
mov edx, dword [esp + 0x8c]
add edi, 0x10
xor cl, cl
mov dword [edx], edi
call fcn.00401d20
add esp, 8
push eax
mov eax, dword [ebp + 0x11a50]
push eax
call fcn.00402d50
mov byte [esp + 0x7c], 0x27
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405529
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x7c], 0x25
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40554e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x2e
mov dword [esp + 0x48], esp
push str.EFIOEM
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM_bootBCD
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x2f
mov dword [esp + 0x48], esp
push str.EFIOEM_bootBCD
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM_boot_bootmgfw.efi
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x30
mov dword [esp + 0x48], esp
push str.EFIOEM_boot_bootmgfw.efi
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM_boot_bootmgr.efi
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x31
mov dword [esp + 0x48], esp
push str.EFIOEM_boot_bootmgr.efi
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM_bootmemtest.efi
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x32
mov dword [esp + 0x48], esp
push str.EFIOEM_bootmemtest.efi
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM_boot_fonts
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
mov byte [esp + 0x80], 0x33
push ecx
mov edx, esp
mov dword [esp + 0x48], esp
push str.EFIOEM_boot_fonts
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.EFIOEM_boot_resources
push ebx
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x34
mov dword [esp + 0x48], esp
push str.EFIOEM_boot_resources
push ebx
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.RecoveryWindowsRE_boot.sdi
lea edi, [ebp + 0x11a70]
push edi
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x35
mov dword [esp + 0x48], esp
push str.RecoveryWindowsRE_boot.sdi
push edi
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push str.RecoveryWindowsREReAgent.xml
push edi
push ecx
call fcn.00403080
add esp, 0xc
call fcn.00401ba0
add esp, 4
mov esi, esp
mov dword [esp + 0x88], esp
push eax
call fcn.004029a0
push ecx
mov edx, esp
mov byte [esp + 0x84], 0x36
mov dword [esp + 0x48], esp
push str.RecoveryWindowsREReAgent.xml
push edi
push edx
call fcn.00403080
mov eax, dword [ebp + 0x11a50]
add esp, 0xc
push eax
mov byte [esp + 0x88], 0x25
call fcn.004029e0
mov byte [esp + 0x7c], 0x24
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4058fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x48]
mov byte [esp + 0x7c], 0x1a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40591f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x7c], 0x19
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405941
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x18
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405966
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x17
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40598b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0x16
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4059b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x7c], 0x15
call fcn.0040c9b9
mov byte [esp + 0x7c], 0x14
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4059e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x7c], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x7c], 0xffffffff
mov eax, dword [esp + 0x54]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 4