Function at 0x44f010
Capabilities:
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1f30
call fcn.004545d0
push ebx
push ebp
push esi
push edi
call fcn.0044efe0
test eax, eax
je 0x44f644
mov ebx, dword [esp + 0x1f48]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x184]
push str..Scsi_d:
push eax
call fcn.00453de0
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x44f225
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x284]
push 8
rep stosd dword es:[edi], eax
lea edx, [esp + 0x28c]
push str.SCSIDISK
stosb byte es:[edi], al
push edx
mov dword [esp + 0x290], 0x1c
mov dword [esp + 0x29c], 0x2710
mov dword [esp + 0x2a8], 0x211
mov dword [esp + 0x2a0], 0x1b0501
call fcn.004539a0
mov eax, ebx
add esp, 0xc
and eax, reloc.WS2_32.dll_accept
mov byte [esp + 0x2aa], 0xec
jns 0x44f0e3
dec eax
or eax, 0xfffffffe
inc eax
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28c]
mov byte [esp + 0x2b4], al
push 0x22d
push edx
lea eax, [esp + 0x294]
push 0x3c
push eax
push 0x4d008
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44f21e
mov al, byte [esp + 0x2e6]
test al, al
je 0x44f21e
push 0x400
call fcn.00453be2
mov ebx, eax
add esp, 4
mov ecx, ebx
lea eax, [esp + 0x2b0]
mov edx, 0x100
xor edi, edi
add ecx, 4
mov di, word [eax]
add eax, 2
mov dword [ecx - 4], edi
dec edx
jne 0x44f148
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov edx, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.0045398e
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.00453de0
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x44f3e6
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push ecx
push 0x18
push edx
push eax
push eax
push 0x74080
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov al, byte [esp + 0x27]
test al, al
jbe 0x44f3df
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
lea edx, [esp + 0x50]
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x14], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x84
xor eax, eax
mov edi, 0x4b8a30
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push 0x4b8a30
push edx
push esi
call fcn.0044ef80
add esp, 0x18
test eax, eax
je 0x44f3df
push 0x400
call fcn.00453be2
mov ebx, eax
add esp, 4
mov ecx, ebx
mov eax, 0x4b8a40
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x4b8c40
jl 0x44f305
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x13
push 0xa
push ebx
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x54]
shl ecx, 9
mov dword [ebp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x64], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x68], eax
mov ecx, dword [ebx + 0x18]
mov dword [ebp + 0x6c], ecx
call fcn.0045398e
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea edx, [esp + 0x184]
push str..PhysicalDrive_d
push edx
call fcn.00453de0
add esp, 0xc
lea eax, [esp + 0x180]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44f62e
mov ecx, 0x43
xor eax, eax
lea edi, [esp + 0x74]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 0xc0
push 0
mov dword [esp + 0x84], eax
mov byte [esp + 0x98], al
push edx
lea eax, [esp + 0x7c]
mov ecx, 0x2c
push 0x10c
push eax
mov word [esp + 0x84], cx
mov dword [esp + 0x9c], ecx
push ecx
lea ecx, [esp + 0x88]
mov byte [esp + 0x8e], 6
push ecx
push 0x4d004
push ebx
mov byte [esp + 0x9b], 0x18
mov byte [esp + 0x9c], 1
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 0x4c
mov byte [esp + 0xb0], 0x12
mov byte [esp + 0xb1], 1
mov byte [esp + 0xb2], 0x80
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44f62e
cmp byte [esp + 0xc1], 0x80
jne 0x44f62e
lea ecx, [esp + 0x284]
lea eax, [esp + 0xc1]
mov esi, 0x60
xor edx, edx
add ecx, 4
mov dh, byte [eax - 1]
mov dl, byte [eax]
add eax, 2
mov dword [ecx - 4], edx
dec esi
jne 0x44f4e9
push 0x14
lea eax, [esp + 0x288]
push 2
push eax
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x1f4c]
lea eax, [esp + 0x14]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea ecx, [esp + 0x734]
push esi
push eax
push 0x800
push ecx
push esi
push esi
push 0x4100c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44f609
mov eax, dword [esp + 0x73c]
cmp eax, esi
je 0x44f609
lea eax, [esp + eax + 0x748]
lea ecx, [esp + 0x4b4]
mov esi, 0xf
xor edx, edx
add ecx, 4
mov dh, byte [eax]
inc eax
mov dword [ecx - 4], edx
mov edi, dword [ecx - 4]
xor edx, edx
mov dl, byte [eax]
or edi, edx
inc eax
mov dword [ecx - 4], edi
dec esi
jne 0x44f583
push 0xa
lea eax, [esp + 0x4b8]
push 0
push eax
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf
mov eax, ecx
mov esi, edi
mov edi, edx
push 0xb
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c8]
push ecx
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x64], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x6c], esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1f30
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
lea ecx, [esp + 0x180]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x630]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x284]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x630]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x180]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x17f], 0x5c
je 0x44f707
mov edi, str.IOSUBSYSSMARTVSD.VXD
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SMARTVSD.VXD
jmp 0x44f73d
mov edi, 0x4a4450
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x284]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a4440
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x630]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0044ee50
add esp, 4
test eax, eax
jne 0x44f78d
lea ecx, [esp + 0x630]
push eax
lea edx, [esp + 0x288]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0
push 1
push 0
push 0
push 0
push str..SMARTVSD
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x44f8e0
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push 0x18
push ecx
push 0
push 0
push 0x74080
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44f8e0
mov al, byte [esp + 0x27]
xor bl, bl
mov byte [esp + 0x14], bl
mov dl, al
mov cl, bl
shr dl, cl
test dl, 1
je 0x44f8ca
mov esi, dword [esp + 0x14]
test dl, 0x10
jne 0x44f861
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
stosb byte es:[edi], al
mov dword [esp + 0x48], edx
lea eax, [esp + 0x18]
mov byte [esp + 0x4c], dl
push eax
push esi
lea edx, [esp + 0x58]
push ecx
push edx
push ebp
call fcn.0044ef20
add esp, 0x14
test eax, eax
je 0x44f85d
mov ecx, esi
mov al, 1
and ecx, 0xff
shl al, cl
or byte [esp + 0x13], al
mov al, byte [esp + 0x27]
mov cl, bl
lea edi, [esp + 0x50]
shr al, cl
mov ecx, 8
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x20], al
xor eax, eax
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [esp + 0x20]
mov ecx, 0x84
xor eax, eax
mov edi, 0x4b8a30
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x50]
push ecx
push esi
push edx
push 0x4b8a30
push eax
push ebp
call fcn.0044ef80
add esp, 0x18
test eax, eax
je 0x44f8c6
mov eax, dword [esp + 0x1f48]
and esi, 0xff
cmp esi, eax
je 0x44fae0
mov al, byte [esp + 0x27]
inc bl
cmp bl, 4
mov byte [esp + 0x14], bl
jb 0x44f7f4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 0x403
xor eax, eax
lea edi, [esp + 0xf34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x52c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x52c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.DiskSerial.VXD
cmp byte [esp + ecx + 0x73], 0x5c
jne 0x44f968
mov edi, 0x4a4410
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x8000000
mov ecx, ebx
push 2
push eax
and ecx, 3
push 3
lea eax, [esp + 0x540]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x44f635
mov edi, dword [esp + 0x1f44]
push str.DISKSERIAL
push str.DiskSerial
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x20]
push 0
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push str..DiskSerial.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x52c]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x44f635
lea eax, [esp + 0x1c]
push 0
push eax
lea ecx, [esp + 0xf3c]
push 4
push ecx
push 0
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call edi
xor esi, esi
mov al, byte [esp + esi + 0xf38]
test al, al
je 0x44facb
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov cl, byte [esp + eax + 0xf34]
test cl, cl
je 0x44facb
push 0x400
call fcn.00453be2
mov edi, dword [esp + 0x1f4c]
add esp, 4
mov edx, edi
mov ebp, eax
shl edx, 9
mov ecx, ebp
lea eax, [esp + edx + 0xf40]
mov edx, 0x100
xor ebx, ebx
add ecx, 4
mov bx, word [eax]
add eax, 2
mov dword [ecx - 4], ebx
dec edx
jne 0x44faa5
test ebp, ebp
je 0x44fac2
cmp esi, edi
je 0x44fbd7
push ebp
call fcn.0045398e
add esp, 4
inc esi
cmp esi, 8
jl 0x44fa5f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f30
ret 0xc
push 0x400
call fcn.00453be2
mov ebp, eax
add esp, 4
mov ecx, ebp
mov eax, 0x4b8a40
xor edx, edx
add ecx, 4
mov dx, word [eax]
add eax, 2
mov dword [ecx - 4], edx
cmp eax, 0x4b8c40
jl 0x44faf6
push 0x13
push 0xa
push ebp
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
push edx
mov dword [ebx + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.0045398e
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc
push 0x13
push 0xa
push ebp
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x1f58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x1b
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1a
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x17
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044eea0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x54]
shl ecx, 9
mov dword [ebx + 0x60], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 0x64], edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebx + 0x6c], ecx
call fcn.0045398e
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f30
ret 0xc