Function at 0x463560
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48755b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xab0
mov eax, dword [0x4ce19c]
mov dword [esp + 0xaa8], eax
xor eax, eax
push ebx
push esi
push edi
mov ecx, 0xb
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
xor ecx, ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x54], ecx
call fcn.00457af0
test eax, eax
jne 0x463b59
cmp dword [ebp + 8], 1
jne 0x463b59
xor ebx, ebx
push ebx
push ebx
push 1
lea ecx, [esp + 0x114]
call fcn.00460980
lea ecx, [esp + 0x108]
mov dword [esp + 0xac4], ebx
call fcn.0045e600
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], ebx
push eax
push 1
call fcn.00462ae0
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, ebx
jne 0x46365f
push str.SetFilter_____Nothing_to_do
push 0x48ae58
call fcn.004572b0
add esp, 8
lea ecx, [esp + 0x108]
mov dword [esp + 0xac4], 0xffffffff
call fcn.0045d490
mov eax, 0xfffffffe
jmp 0x463b5b
push ebx
push 0x208
lea eax, [esp + 0x4a8]
push eax
lea ecx, [esp + 0x114]
call fcn.0045feb0
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push 0x80
lea edx, [esp + 0x94]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x4b4]
push eax
push ebx
push ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp + 0xc], bl
jne 0x4636de
push 0x48b000
push 0x104
lea ecx, [esp + 0x4a8]
push ecx
call fcn.0040120a
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x10]
push eax
push str.TVTFilter
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], ebx
call fcn.00474450
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp eax, ebx
je 0x463755
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x46374e
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_load_driver
mov byte [esp + 0xad0], 1
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ebx
mov byte [esp + 0xad0], bl
call fcn.00458010
add esp, 0xc
call esi
jmp 0x463b25
cmp byte [ebp + 0x10], bl
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [esp + 0x10], ebx
je 0x46380c
lea ecx, [esp + 0x58]
push ecx
call fcn.00401e2f
mov ecx, dword [esp + 0x10]
add esp, 4
push ebx
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push 0x2f
lea eax, [esp + 0x6c]
push eax
push 0x83000004
push ecx
call esi
cmp eax, ebx
jne 0x4637bf
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov byte [esp + 0xacc], 2
push str.Unable_to_send_STARTFILTER_IOCTL
jmp 0x463b09
push ebx
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x28]
push eax
push 4
mov ecx, eax
push ecx
push 0x83000000
push edx
call esi
cmp eax, ebx
jne 0x46380c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov byte [esp + 0xacc], 3
push str.Unable_to_send_SETDRIVES_IOCTL
jmp 0x463b09
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004560e0
lea ecx, [esp + 0x8b8]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004561a0
mov eax, dword [esp + 0x20]
add esp, 0x14
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x200
lea edx, [esp + 0x8c4]
push edx
push 0x83000038
push eax
call esi
cmp eax, ebx
jne 0x4638b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Unable_to_send_IOCTL_FFDRIVER_ENCRYPT_OFF
push str.ENGINE
mov esi, eax
call fcn.004572b0
add esp, 4
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Unable_to_send_ENCRYPT_OFF_IOCTL
mov byte [esp + 0xad0], 4
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push esi
mov byte [esp + 0xad0], bl
call fcn.00458010
add esp, 0xc
jmp 0x463b27
mov eax, dword [esp + 0xc]
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x80
lea edx, [esp + 0x9c]
push edx
push 0x830000c0
push eax
call esi
cmp eax, ebx
jne 0x463900
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov byte [esp + 0xacc], 5
push str.Unable_to_send_SENDBACKUPFILE_IOCTL
jmp 0x463b09
cmp byte [ebp + 0xc], bl
je 0x46392d
push str.SystemDrive
call dword [sym.imp.MSVCR71.dll_getenv]
push eax
push str._spreboot
lea ecx, [esp + 0x3ac]
push 0x80
push ecx
call fcn.00402973
add esp, 0x14
jmp 0x46393d
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x3a0]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push 0x80
lea eax, [esp + 0x3b4]
push eax
push 0x830000c4
push ecx
call esi
cmp eax, ebx
jne 0x46398d
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov byte [esp + 0xacc], 6
push str.Unable_to_send_SENDPREBOOTFILE_IOCTL
jmp 0x463b09
cmp byte [ebp + 0xc], bl
je 0x4639d1
call fcn.00457b70
test al, al
mov eax, str.tvtos
jne 0x4639a5
mov eax, str.minint
push eax
push str.SystemDrive
call dword [sym.imp.MSVCR71.dll_getenv]
add esp, 4
push eax
push str._s_s
lea edx, [esp + 0x32c]
push 0x80
push edx
call fcn.00402973
add esp, 0x14
jmp 0x4639e1
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x320]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0xc]
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push 0x80
lea ecx, [esp + 0x334]
push ecx
push 0x830000c8
push edx
call esi
cmp eax, ebx
jne 0x463a31
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov byte [esp + 0xacc], 7
push str.Unable_to_send_SENDDATAFILE_IOCTL
jmp 0x463b09
mov eax, dword [0x4e3148]
xor ecx, ecx
mov cx, word [eax]
push ecx
call fcn.004598f0
mov edx, dword [0x4e3148]
push eax
push edx
push 0x48be08
lea eax, [esp + 0x6b8]
push 0x208
push eax
call fcn.00403fa3
lea ecx, [esp + 0x4b8]
push ecx
lea edx, [esp + 0x6c4]
push edx
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 0x20
test eax, eax
je 0x463b42
cmp byte [ebp + 0xc], bl
je 0x463aae
push str.SystemDrive
call dword [sym.imp.MSVCR71.dll_getenv]
push eax
push str._sRRbackups
lea eax, [esp + 0x42c]
push 0x80
push eax
call fcn.00402973
add esp, 0x14
jmp 0x463abe
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x420]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x80
lea edx, [esp + 0x434]
push edx
push 0x830000cc
push eax
call esi
cmp eax, ebx
jne 0x463b42
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SetFilter
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov byte [esp + 0xacc], 8
push str.Unable_to_send_IOCTL_FFDRIVER_SENDSECONDBACKUPFILE_IOCTL
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_6]
push ebx
mov byte [esp + 0xad0], bl
call fcn.00458010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0x108]
mov dword [esp + 0xac4], 0xffffffff
call fcn.0045d490
mov eax, esi
jmp 0x463b5b
lea ecx, [esp + 0x108]
mov dword [esp + 0xac4], 0xffffffff
call fcn.0045d490
xor eax, eax
mov ecx, dword [esp + 0xabc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xab4]
call fcn.00475533
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret