Function at 0x406e00
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Initialize winsock library
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bb9c
mov eax, dword fs:[0]
push eax
sub esp, 0x854
mov eax, dword [0x43b1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, 1
mov dword [ebp - 0x7e4], ebx
mov dword [ebp - 0x804], eax
mov dword [ebp - 0x7dc], esi
mov dword [ebp - 0x81c], edi
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x828], edi
mov dword [ebp - 0x7d4], edi
mov dword [ebp - 0x800], edi
mov dword [ebp - 0x7d8], edi
mov dword [ebp - 0x850], edi
mov dword [ebp - 0x82c], edi
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x840], edi
mov dword [ebp - 0x810], edi
mov dword [ebp - 0x860], edi
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x854], edi
mov dword [ebp - 0x85c], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x7f4], edi
mov dword [ebp - 0x84c], edi
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x844], edi
mov dword [ebp - 0x830], edi
mov dword [ebp - 0x824], edi
mov dword [ebp - 0x7e8], edi
mov dword [ebp - 0x858], edi
mov dword [ebp - 0x7cc], edi
mov dword [ebp - 0x7c4], edi
mov dword [ebp - 0x5a0], 0xf
mov dword [ebp - 0x5a4], edi
mov byte [ebp - 0x5b4], 0
push esi
push 0x43216c
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 4], edi
call fcn.00404770
push 0x2e
push esi
lea ecx, [ebp - 0x5b4]
call fcn.00404510
push 5
push str.3.4.7
lea ecx, [ebp - 0x5b4]
call fcn.00404770
cmp dword [ebp - 0x5a0], 0x10
mov eax, dword [ebp - 0x5b4]
jae 0x406f5b
lea eax, [ebp - 0x5b4]
push eax
push str.Improved_RegisterLSP_x32__v_s_2010_2015_c__n_n
call fcn.004131d0
push str.System_and_software_information_n
call fcn.004131d0
push str.________________________________n_n
call fcn.004131d0
add esp, 0x10
call fcn.00409830
mov ecx, eax
call fcn.00409840
push eax
push str.Licensed_to:__s_n
call fcn.004131d0
lea ecx, [ebp - 0x524]
push ecx
call fcn.00405cb0
lea edx, [ebp - 0x524]
push edx
push str.Current_date_and_time:__s_n
call fcn.004131d0
add esp, 0x14
mov byte [ebp - 0x218], 0
cmp ebx, esi
jle 0x40700a
mov eax, dword [ebp - 0x804]
mov ecx, dword [eax + esi*4]
push ecx
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.004041e0
inc esi
cmp esi, dword [ebp - 0x7e4]
je 0x407001
push 0x4320b8
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.004041e0
cmp esi, dword [ebp - 0x7e4]
jl 0x406fbf
cmp byte [ebp - 0x218], 0
jne 0x407020
push str.no_parameters
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call fcn.004041e0
lea edx, [ebp - 0x218]
push edx
push str.Parameters_to_parse_are:__s_n
call fcn.004131d0
add esp, 8
push 0x104
lea eax, [ebp - 0x420]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x420]
push ecx
push str.Process_full_path:__s_n
call fcn.004131d0
add esp, 8
lea edx, [ebp - 0x31c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x31c]
push eax
push str.Current_directory_is:__s_n
call fcn.004131d0
call fcn.00413f80
mov esi, eax
mov dword [ebp - 0x80c], esi
call fcn.00414240
mov byte [0x43c448], al
mov dword [0x43c444], esi
call fcn.00414340
push eax
push str.OS:__s
call fcn.004131d0
add esp, 0x10
cmp byte [0x43c448], 0
je 0x4070be
push str._64bit
jmp 0x4070c3
push str._32bit
call fcn.004131d0
add esp, 4
call fcn.004140e0
test al, al
je 0x4070db
push str._inside_Virtual_PC_tm_
jmp 0x4070e9
call fcn.00414190
test al, al
je 0x4070f1
push str._inside_VMWare_tm_
call fcn.004131d0
add esp, 4
push esi
mov byte [ebp - 0x7c5], 0
call fcn.00403d90
add esp, 4
mov byte [ebp - 0x7cd], al
test al, al
je 0x407147
lea ecx, [ebp - 0x7ce]
push ecx
call fcn.004142c0
add esp, 4
cmp byte [ebp - 0x7ce], 0
mov byte [ebp - 0x7c5], al
je 0x407135
push str._nError_while_trying_to_determine_elevated_status__n
call fcn.00413260
jmp 0x407151
test al, al
je 0x407140
push str._with_UAC_elevated_n
jmp 0x40714c
push str._with_UAC_not_elevated_n
jmp 0x40714c
push 0x430b54
call fcn.004131d0
lea edx, [ebp - 0x5d0]
add esp, 4
push edx
call fcn.00415a70
mov ecx, eax
call fcn.00418430
mov byte [ebp - 4], 1
cmp dword [ebp - 0x5c0], edi
je 0x407196
cmp dword [ebp - 0x5bc], 0x10
mov eax, dword [ebp - 0x5d0]
jae 0x407188
lea eax, [ebp - 0x5d0]
push eax
push 0x431fac
call fcn.004131d0
add esp, 8
push str._n________________________________n_n
call fcn.004131d0
add esp, 4
xor bl, bl
cmp dword [ebp - 0x7e4], 1
jle 0x4071e0
mov esi, dword [ebp - 0x804]
mov eax, dword [esi + 4]
push 0x431f84
push eax
call fcn.0041aa22
add esp, 8
test eax, eax
je 0x4071de
mov ecx, dword [esi + 4]
push 0x431f80
push ecx
call fcn.0041aa22
add esp, 8
test eax, eax
jne 0x4071e0
mov bl, 1
lea edx, [ebp - 0x7b4]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x7ec], eax
test eax, eax
je 0x40721d
push eax
push str.Unable_to_load_Winsock:__d_n
call fcn.00413260
add esp, 8
test bl, bl
jne 0x40721d
mov dword [ebp - 0x7dc], 1
jmp case.0x40737b.107
lea eax, [ebp - 0x7ec]
push eax
call fcn.004154e0
add esp, 4
push 0x43cef4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [ebp - 0x7e4]
mov esi, 1
cmp ebx, esi
jle 0x407296
jmp 0x407250
mov ecx, dword [ebp - 0x804]
mov edx, dword [ecx + esi*4]
push 2
push 0x431f7c
push edx
call fcn.0041a869
add esp, 0xc
test eax, eax
jne 0x40726e
inc edi
inc esi
cmp esi, ebx
jl 0x407250
test edi, edi
je 0x407296
lea eax, [ebp - 0x7ec]
push eax
push 0x28
call fcn.00415490
add esp, 8
mov dword [ebp - 0x7d4], eax
test eax, eax
je case.0x40737b.107
xor edi, edi
mov dword [ebp - 0x7f8], edi
mov byte [ebp - 0x7b5], 0
mov dword [ebp - 0x7bc], 1
cmp ebx, 1
jle 0x40787a
jmp 0x4072c0
cmp byte [ebp - 0x7b5], 0
jne 0x40784a
mov ebx, dword [ebp - 0x804]
mov edi, dword [ebp - 0x7bc]
mov ecx, dword [ebx + edi*4]
movsx edx, byte [ecx + 1]
push edx
call fcn.0041a83d
add esp, 4
cmp eax, 0x67
jne 0x4072f6
mov esi, dword [ebx + edi*4]
cmp byte [esi], 0
jne 0x40732f
mov esi, dword [ebx + edi*4]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407300
sub eax, edx
cmp eax, 2
je 0x40732f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407313
sub eax, edx
cmp eax, 3
je 0x40732f
mov al, byte [esi]
cmp al, 0x2d
je 0x40732f
cmp al, 0x2f
jne case.0x40737b.107
mov eax, esi
xor bl, bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407336
sub eax, edx
cmp eax, 3
jne 0x407353
movsx eax, byte [esi + 2]
push eax
call fcn.0041a83d
add esp, 4
mov bl, al
mov edi, dword [ebp - 0x804]
mov esi, dword [ebp - 0x7bc]
mov ecx, dword [edi + esi*4]
movsx edx, byte [ecx + 1]
push edx
call fcn.0041a83d
add eax, 0xffffff9f
add esp, 4
cmp eax, 0x19
ja case.0x40737b.107
jmp dword [eax*4 + 0x409760]
mov dword [ebp - 0x7e8], 1
jmp 0x407831
mov dword [ebp - 0x84c], 1
jmp 0x407831
mov dword [ebp - 0x850], 1
jmp 0x407831
mov eax, dword [ebp - 0x7bc]
lea esi, [eax + 1]
cmp esi, dword [ebp - 0x7e4]
jge case.0x40737b.107
mov eax, dword [edi + eax*4 + 4]
movsx ecx, byte [eax]
push ecx
call fcn.0041a83d
add esp, 4
cmp eax, 0x33
je 0x407411
cmp eax, 0x36
je 0x4073fc
cmp eax, 0x62
jne case.0x40737b.107
mov dword [0x43b054], 0
mov dword [ebp - 0x7bc], esi
jmp 0x407831
mov dword [0x43b054], 2
mov dword [ebp - 0x7bc], esi
jmp 0x407831
mov dword [0x43b054], 1
mov dword [ebp - 0x7bc], esi
jmp 0x407831
mov ecx, dword [ebp - 0x7e4]
lea eax, [esi + 1]
cmp eax, ecx
jge case.0x40737b.107
lea edx, [ebp - 0x7bc]
push edx
push ecx
push edi
mov dword [ebp - 0x7bc], eax
call fcn.00405880
add esp, 0xc
mov dword [ebp - 0x7cc], eax
jmp 0x407831
call fcn.004048e0
mov dword [ebp - 0x7cc], eax
jmp 0x407831
test bl, bl
jne 0x40799e
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x820], 0
jmp 0x407831
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x820], 1
jmp 0x407831
mov dword [ebp - 0x848], 1
jmp 0x407831
test bl, bl
je 0x407508
cmp bl, 0x69
je 0x407508
cmp bl, 0x72
jne case.0x40737b.107
mov ecx, dword [ebp - 0x7e4]
lea eax, [esi + 1]
cmp eax, ecx
jge case.0x40737b.107
mov dword [ebp - 0x7bc], eax
lea eax, [ebp - 0x7bc]
push eax
push ecx
push edi
call fcn.00405880
add esp, 0xc
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x834], 1
mov byte [ebp - 0x7b5], 1
jmp 0x407831
mov eax, 1
mov dword [ebp - 0x854], eax
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x7f4], eax
cmp bl, 0x69
jne 0x407831
mov dword [ebp - 0x814], eax
jmp 0x407831
mov dword [ebp - 0x85c], 1
jmp 0x407831
xor eax, eax
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x7f4], eax
jmp 0x407831
mov dword [ebp - 0x814], 1
jmp 0x407831
mov dword [ebp - 0x7d8], 1
jmp 0x407831
mov eax, 1
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x840], eax
cmp bl, 0x72
jne 0x407831
mov dword [ebp - 0x858], eax
jmp 0x407831
mov dword [ebp - 0x860], 1
mov dword [ebp - 0x7d8], 0
jmp 0x407831
lea eax, [esi + 1]
cmp eax, dword [ebp - 0x7e4]
jge case.0x40737b.107
mov ecx, dword [edi + eax*4]
push ecx
mov dword [ebp - 0x7bc], eax
call fcn.0041a3db
mov ecx, dword [ebp - 0x7f8]
mov edx, dword [ebp - 0x7d4]
add esp, 4
mov dword [edx + ecx*4], eax
inc ecx
mov dword [ebp - 0x7f8], ecx
jmp 0x407831
mov esi, dword [ebp - 0x7e4]
lea eax, [ebp - 0x7bc]
push eax
push esi
push edi
call fcn.00406660
mov ecx, dword [ebp - 0x7bc]
inc ecx
add esp, 0xc
cmp ecx, esi
jge case.0x40737b.107
test eax, eax
je 0x4079eb
mov ecx, dword [ebp - 0x7f8]
mov edx, dword [ebp - 0x7d4]
mov dword [edx + ecx*4], eax
inc ecx
mov dword [ebp - 0x7f8], ecx
jmp 0x407831
test bl, bl
jne 0x40765d
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x840], 0
jmp 0x407831
cmp bl, 0x74
jne 0x407678
mov eax, 1
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x844], eax
jmp 0x407831
cmp bl, 0x75
jne case.0x40737b.114
mov eax, 1
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x830], eax
jmp 0x407831
test bl, bl
jne 0x4076d7
lea eax, [esi + 1]
mov dword [ebp - 0x7d8], 0
cmp eax, dword [ebp - 0x7e4]
jge case.0x40737b.107
mov dword [ebp - 0x7bc], eax
mov eax, dword [edi + eax*4]
push eax
call fcn.0041a3c5
add esp, 4
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7f4], 1
jmp 0x407831
cmp bl, 0x72
jne case.0x40737b.107
mov ecx, dword [ebp - 0x7e4]
lea eax, [esi + 1]
cmp eax, ecx
jge case.0x40737b.107
lea edx, [ebp - 0x7bc]
push edx
push ecx
push edi
mov dword [ebp - 0x7bc], eax
call fcn.00405880
add esp, 0xc
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x83c], 1
mov byte [ebp - 0x7b5], 1
jmp 0x407831
mov eax, dword [ebp - 0x7e4]
xor ebx, ebx
inc esi
mov dword [ebp - 0x7d8], ebx
cmp esi, eax
jge case.0x40737b.107
lea ecx, [ebp - 0x7bc]
push ecx
push eax
push edi
call fcn.00406660
add esp, 0xc
mov dword [ebp - 0x7f4], ebx
cmp eax, ebx
je 0x4079eb
mov dword [ebp - 0x800], eax
jmp 0x407831
mov dword [ebp - 0x810], 1
jmp 0x407831
mov edx, dword [ebp - 0x7bc]
mov ecx, dword [edi + edx*4]
mov eax, ecx
mov ebx, 2
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407787
sub eax, esi
cmp eax, 2
jbe 0x407831
lea esp, [esp]
movsx eax, byte [ecx + ebx]
push eax
call fcn.0041a83d
add eax, 0xffffff9d
add esp, 4
cmp eax, 0x10
ja case.0x4077bc.100
movzx ecx, byte [eax + 0x4097ec]
jmp dword [ecx*4 + 0x4097c8]
or dword [ebp - 0x7c4], 0x40
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 8
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 0x80
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 0x10
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 1
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 4
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 2
jmp case.0x4077bc.100
or dword [ebp - 0x7c4], 0x80000000
mov edx, dword [ebp - 0x7bc]
mov ecx, dword [edi + edx*4]
mov eax, ecx
inc ebx
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407820
sub eax, esi
cmp ebx, eax
jb 0x4077a0
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp eax, dword [ebp - 0x7e4]
jl 0x4072c0
cmp dword [ebp - 0x820], 0
jne 0x40785c
cmp dword [ebp - 0x838], 0
je 0x407866
mov dword [ebp - 0x814], 0
cmp dword [ebp - 0x85c], 0
je 0x407874
call fcn.00411a50
mov edi, dword [ebp - 0x7f8]
cmp byte [ebp - 0x7cd], 0
mov esi, 1
je 0x4079fa
cmp dword [ebp - 0x7f4], 0
je 0x4079fa
cmp byte [ebp - 0x7c5], 0
jne 0x4079fa
mov ebx, dword [ebp - 0x854]
test ebx, ebx
jne 0x407a00
push str.Operation_requires_elevation_and_will_probably_fail__exiting_n
call fcn.00413260
add esp, 4
cmp dword [ebp - 0x84c], 0
mov edx, dword [ebp - 0x804]
setne al
movzx ecx, al
mov eax, dword [edx]
push ecx
push eax
call fcn.004040b0
mov esi, dword [ebp - 0x7dc]
add esp, 8
mov eax, dword [ebp - 0x7d4]
test eax, eax
je 0x4078f9
push eax
call fcn.004154c0
add esp, 4
mov eax, dword [ebp - 0x81c]
test eax, eax
je 0x40790c
push eax
call fcn.00415690
add esp, 4
mov eax, dword [0x43c454]
test eax, eax
je 0x40791c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00415510
push 0x43cef4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edi, 0x10
cmp dword [ebp - 0x5bc], edi
jb 0x40794e
mov ecx, dword [ebp - 0x5d0]
push ecx
call fcn.00418f39
add esp, 4
mov dword [ebp - 0x5bc], 0xf
mov dword [ebp - 0x5c0], 0
mov byte [ebp - 0x5d0], 0
cmp dword [ebp - 0x5a0], edi
jb 0x407980
mov edx, dword [ebp - 0x5b4]
push edx
call fcn.00418f39
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419ad1
mov esp, ebp
pop ebp
ret
cmp bl, 0x77
jne 0x4079bf
push str.Winsock_integrity_OK_n
mov dword [ebp - 0x7dc], 0
call fcn.004131d0
add esp, 4
jmp 0x409727
cmp bl, 0x63
jne case.0x40737b.107
push str.Testing_winsock_chain_n
call fcn.004131d0
mov eax, dword [0x43b054]
push eax
call fcn.00403eb0
add esp, 8
mov dword [ebp - 0x7dc], eax
jmp 0x409727
mov dword [ebp - 0x7dc], 2
jmp case.0x40737b.107
mov ebx, dword [ebp - 0x854]
cmp dword [0x43b054], 2
jne 0x407a13
push str.Unable_to_manipulate_64_bit_Winsock_catalog_from_32_bit_process__n_n
jmp 0x4078b9
call fcn.00413b90
mov dword [0x43c454], eax
cmp dword [ebp - 0x818], esi
jne 0x407b5d
mov eax, dword [0x43b054]
mov dword [ebp - 0x800], 0
test eax, eax
je 0x407a40
cmp eax, esi
jne 0x407a77
push str.Winsock_32_bit_Catalog:_n
call fcn.004131d0
push str._n
call fcn.004131d0
mov edx, dword [ebp - 0x810]
mov eax, dword [ebp - 0x840]
lea ecx, [ebp - 0x800]
push ecx
push edx
push eax
push esi
call fcn.0040e430
mov eax, dword [0x43b054]
add esp, 0x18
test eax, eax
je 0x407a80
cmp eax, 2
jne 0x407ab3
push str.Winsock_64_bit_Catalog:_n
call fcn.004131d0
push str._n
call fcn.004131d0
mov edx, dword [ebp - 0x810]
mov eax, dword [ebp - 0x840]
lea ecx, [ebp - 0x800]
push ecx
push edx
push eax
push 2
call fcn.0040e430
add esp, 0x18
cmp dword [ebp - 0x858], 0
je 0x40971d
push 0x430b54
call fcn.004131d0
mov eax, dword [ebp - 0x800]
add esp, 4
test eax, eax
jne 0x407af5
push str.No_LSPs_detected_n
call fcn.004131d0
mov ecx, dword [ebp - 0x800]
add esp, 4
mov dword [ebp - 0x7dc], ecx
jmp 0x409727
cmp eax, esi
jne 0x407b17
push str.Only_our_LSP_detected_n
call fcn.004131d0
mov ecx, dword [ebp - 0x800]
add esp, 4
mov dword [ebp - 0x7dc], ecx
jmp 0x409727
cmp eax, 2
jne 0x407b3a
push str.Only_3rd_party_LSP_detected_n
call fcn.004131d0
mov ecx, dword [ebp - 0x800]
add esp, 4
mov dword [ebp - 0x7dc], ecx
jmp 0x409727
cmp eax, 3
jne 0x407b4c
push str.Both_our_LSP_and_3rd_party_LSP_detected_n
call fcn.004131d0
add esp, 4
mov ecx, dword [ebp - 0x800]
mov dword [ebp - 0x7dc], ecx
jmp 0x409727
cmp dword [ebp - 0x834], esi
jne 0x407baf
mov esi, dword [ebp - 0x7cc]
push esi
push str.SYSTEMCurrentControlSetServicesWinSock2
push str.HKLM
call fcn.00405a10
add esp, 0xc
test eax, eax
jne 0x407b9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_backup_registry_to_file__s_with_error_code:__i_n
call fcn.00413260
add esp, 0xc
jmp 0x40971d
push esi
push str.Backuped_registry_to_file__s_successfuly_n
call fcn.004131d0
add esp, 8
jmp 0x40971d
cmp dword [ebp - 0x83c], esi
jne 0x407c23
mov esi, dword [ebp - 0x7cc]
push esi
call fcn.004157f0
add esp, 4
test eax, eax
jne 0x407bdd
push esi
push str.File__s_doesnt_exists__registry_will_not_be_restored__n
call fcn.00413260
add esp, 8
jmp 0x40971d
push 1
push esi
push str.SYSTEMCurrentControlSetServicesWinSock2
push str.HKLM
call fcn.00405b60
add esp, 0x10
test eax, eax
jne 0x407c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_restore_registry_to_file__s_with_error_code:__i_n
call fcn.00413260
add esp, 0xc
jmp 0x40971d
push esi
push str.Restored_registry_from_file__s_successfuly_n
call fcn.004131d0
add esp, 8
jmp 0x40971d
cmp dword [ebp - 0x7d8], esi
jne 0x4092a1
mov esi, dword [ebp - 0x7cc]
test esi, esi
jne 0x407c43
push str.Please_specify_path_and_filename_of_LSP__n_n
jmp 0x4078b9
push esi
push str.Checking_if_LSP:__s_exists_n
call fcn.004131d0
push esi
call fcn.00409a00
add esp, 0xc
test eax, eax
jne 0x407c6d
push str.LSP_file_not_found_or_couldnt_be_loaded__n_n
call fcn.00413260
add esp, 4
jmp 0x409727
push str.Checking_if_LSP_is_installed_n
call fcn.004131d0
mov edx, dword [0x43b054]
push esi
push edx
call fcn.00409a30
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x82c], esi
test esi, esi
je 0x407cb0
test ebx, ebx
jne 0x407ca9
push str.LSP_already_installed__n_n
call fcn.00413260
add esp, 4
jmp 0x409727
push str.LSP_is_already_installed__will_try_to_update_n
jmp 0x407cb5
push str.LSP_not_found__will_resume_normal_installation_n
call fcn.004131d0
add esp, 4
cmp dword [ebp - 0x850], 1
jne 0x407eb2
test ebx, ebx
jne 0x407eba
test edi, edi
je 0x407ce8
push str.Cannot_specify_both__a_and__o_flags__n_n
call fcn.00413260
add esp, 4
jmp 0x409727
mov ecx, dword [0x43b054]
lea eax, [ebp - 0x808]
push eax
push ecx
call fcn.004155e0
mov esi, eax
add esp, 8
mov dword [ebp - 0x81c], esi
test esi, esi
jne 0x407d25
mov edx, dword [ebp - 0x804]
mov eax, dword [edx]
push eax
push str._s:_EnumerateProviders:_Unable_to_enumerate_Winsock_catalog_n
call fcn.00413260
add esp, 8
jmp 0x409727
mov ecx, dword [ebp - 0x808]
test ecx, ecx
jle 0x407d40
lea eax, [esi + 0x28]
cmp dword [eax], 0
je 0x407d38
inc edi
add eax, 0x274
dec ecx
jne 0x407d32
lea ecx, [ebp - 0x7ec]
push ecx
lea edx, [edi*4]
push edx
call fcn.00415490
add esp, 8
mov dword [ebp - 0x7d4], eax
test eax, eax
jne 0x407d83
mov eax, dword [ebp - 0x7ec]
mov ecx, dword [ebp - 0x804]
mov edx, dword [ecx]
push eax
push edx
push str._s:_LspAlloc_failed:__d_n
call fcn.00413260
add esp, 0xc
jmp 0x409727
xor edx, edx
xor edi, edi
cmp dword [ebp - 0x808], edx
jle 0x407db3
lea ecx, [esi + 0x24]
cmp dword [ecx + 4], 0
je 0x407da4
mov ebx, dword [ecx]
mov dword [eax + edi*4], ebx
mov eax, dword [ebp - 0x7d4]
inc edi
inc edx
add ecx, 0x274
cmp edx, dword [ebp - 0x808]
jl 0x407d92
push esi
call fcn.00415690
add esp, 4
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x838], 0
je 0x407e25
xor esi, esi
test edi, edi
je 0x407e25
jmp 0x407de0
mov eax, dword [ebp - 0x7d4]
mov ecx, dword [eax + esi*4]
mov edx, dword [0x43b054]
push ecx
push edx
call fcn.0040e510
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x407e20
mov eax, dword [ebp - 0x7d4]
mov ecx, dword [eax + esi*4]
push ebx
push ecx
push str.Replacing_provider:__i_with_provider:__i_n
call fcn.004131d0
mov edx, dword [ebp - 0x7d4]
add esp, 0xc
mov dword [edx + esi*4], ebx
inc esi
cmp esi, edi
jb 0x407de0
mov edx, dword [ebp - 0x850]
lea eax, [ebp - 0x834]
push eax
mov eax, dword [ebp - 0x814]
lea ecx, [ebp - 0x618]
push ecx
mov ecx, dword [ebp - 0x7d4]
push edx
mov edx, dword [ebp - 0x7cc]
push eax
mov eax, dword [0x43b054]
push ecx
push edi
push edx
xor esi, esi
push esi
push eax
mov dword [ebp - 0x834], esi
call fcn.0040aea0
add esp, 0x24
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x820], esi
je 0x40925a
cmp eax, 0xffffffff
je 0x40928f
mov edx, dword [0x43b054]
lea ecx, [ebp - 0x618]
push ecx
push edx
call fcn.00410e60
add esp, 8
cmp eax, esi
jne 0x4091fe
push str.Failed_to_get_LSP_ID_after_installation__n
call fcn.00413260
add esp, 4
jmp 0x409727
test ebx, ebx
je 0x407dc6
call fcn.00413310
mov eax, dword [0x43b054]
push eax
call fcn.00412cf0
add esp, 4
mov dword [ebp - 0x7d8], eax
test eax, eax
je 0x407ef3
test esi, esi
je 0x407ef3
mov ecx, dword [0x43b054]
push esi
push ecx
call fcn.00413620
add esp, 8
mov dword [ebp - 0x818], eax
jmp 0x407efd
mov dword [ebp - 0x818], 0
mov edi, dword [ebp - 0x7cc]
push edi
call fcn.004049d0
push edi
mov ebx, eax
mov byte [ebp - 0x7ce], 0
call fcn.004138e0
add esp, 8
test al, al
jne 0x407f31
push str.LSP_not_licensed_n
call fcn.00413260
add esp, 4
jmp 0x409727
push str.Trying_to_get_LSP_extended_info_n
call fcn.004131d0
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x7b5]
push eax
push edi
mov byte [ebp - 0x7dd], 0
call fcn.004137e0
add esp, 0x10
test al, al
je 0x407f80
mov ecx, dword [ebp - 0x810]
movzx edx, byte [ebp - 0x7b5]
push ecx
push edx
push str.Info_received__IP6:__i__Categories:__i_n
call fcn.004131d0
add esp, 0xc
mov byte [ebp - 0x7dd], 1
mov eax, dword [ebp - 0x810]
test eax, eax
je 0x407f99
cmp dword [ebp - 0x7c4], 0
jne 0x407f99
mov dword [ebp - 0x7c4], eax
test esi, esi
je 0x40821a
mov eax, dword [ebp - 0x7cc]
push eax
call fcn.00411be0
push ebx
mov esi, eax
call fcn.00411be0
mov edi, eax
add esp, 8
mov byte [ebp - 0x7bd], 0
cmp esi, edi
jne 0x407fd1
mov byte [ebp - 0x7ce], 1
jmp 0x40805e
cmp byte [ebp - 0x7dd], 0
je 0x40805e
push str.Trying_to_get_LSP_extended_info_from_copied_LSP_n
call fcn.004131d0
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x7ed]
push edx
push ebx
mov byte [ebp - 0x7f9], 0
call fcn.004137e0
add esp, 0x10
test al, al
je 0x40802d
mov eax, dword [ebp - 0x83c]
movzx ecx, byte [ebp - 0x7ed]
push eax
push ecx
push str.Info_received_from_copied_LSP__IP6:__i__Categories:__i_n
call fcn.004131d0
add esp, 0xc
mov byte [ebp - 0x7f9], 1
mov dl, byte [ebp - 0x7dd]
cmp byte [ebp - 0x7f9], dl
jne 0x408057
mov al, byte [ebp - 0x7ed]
cmp al, byte [ebp - 0x7b5]
jne 0x408057
mov ecx, dword [ebp - 0x83c]
cmp ecx, dword [ebp - 0x810]
je 0x40805e
mov byte [ebp - 0x7bd], 1
mov edx, dword [ebp - 0x7cc]
push edx
call fcn.00405250
add esp, 4
test eax, eax
je 0x4080d6
mov eax, dword [ebp - 0x818]
cmp dword [ebp - 0x7d8], eax
jne 0x4080d6
cmp esi, edi
je 0x4080d6
cmp byte [ebp - 0x7bd], 0
jne 0x4080fa
cmp byte [ebp - 0x7cd], 0
je 0x4080b0
cmp byte [ebp - 0x7c5], 0
jne 0x4080b0
push str.Operation_requires_elevation_and_will_probably_fail__exiting_n
call fcn.00413260
add esp, 4
jmp 0x409727
push str.LSP_is_already_installed_at_system32__will_check_if_it_need_any_kind_of_updates_n
call fcn.004131d0
mov ecx, dword [ebp - 0x7cc]
push ecx
call fcn.0040bc90
add esp, 8
test eax, eax
je 0x409727
jmp 0x40971d
cmp byte [ebp - 0x7bd], 0
jne 0x4080fa
mov edx, dword [ebp - 0x818]
cmp dword [ebp - 0x7d8], edx
je 0x40811e
push str.Change_between_scripted_install_and_current_status__will_reinstall__n
call fcn.004131d0
add esp, 4
cmp byte [ebp - 0x7cd], 0
je 0x40814a
cmp byte [ebp - 0x7c5], 0
jne 0x40814a
push str.Operation_requires_elevation_and_will_probably_fail__exiting_n
call fcn.00413260
add esp, 4
jmp 0x409727
mov eax, dword [ebp - 0x7cc]
push eax
call fcn.00405250
add esp, 4
test eax, eax
jne 0x408138
push str.LSP_is_already_installed__but_not_at_system32__will_delete_and_reinstall__n
jmp 0x4080f2
push str.Nothing_to_update__will_exit_now__n
call fcn.004131d0
add esp, 4
jmp 0x40971d
mov ecx, dword [ebp - 0x82c]
mov edx, dword [0x43b054]
push ecx
push edx
call fcn.0040d6b0
add esp, 8
cmp eax, 0xffffffff
jne 0x408177
push str.Failed_to_get_delete_LSP__n_n
call fcn.00413260
add esp, 4
jmp 0x409727
push str.LSP_delete_successfuly__resuming_normal_install__n
call fcn.004131d0
add esp, 4
cmp byte [ebp - 0x7ce], 0
jne 0x40826a
push ebx
push str.Trying_to_copy_LSP_to:__s_n
call fcn.004131d0
mov eax, dword [ebp - 0x7cc]
add esp, 8
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x408258
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ecx, dword [ebp - 0x7cc]
mov esi, eax
push esi
push ebx
push ecx
push str.Failed_to_copy_LSP:__s_to:__s_with_error_code:__i__install_will_try_update_mechanism__n
call fcn.00413260
add esp, 0x10
cmp esi, 2
jne 0x4081e9
push str.This_error_usualy_means_that_the_current_directory_and_LSP_directory_doesnt_match__and_that_only_LSP_name_was_provided_without_a_path_n
call fcn.00413260
add esp, 4
push str.Will_try_to_update_LSP_dll_although_LSP_is_not_installed__n
call fcn.004131d0
mov esi, dword [ebp - 0x7cc]
push esi
call fcn.0040bc90
add esp, 8
test eax, eax
jne 0x408246
call edi
push eax
push ebx
push esi
push str.Failed_to_update_LSP_as_well__will_continue_from_local_location__n
call fcn.00413260
add esp, 0x10
jmp 0x40827d
cmp byte [ebp - 0x7cd], 0
je 0x408191
cmp byte [ebp - 0x7c5], 0
jne 0x408191
push str.Operation_requires_elevation_and_will_probably_fail__exiting_n
call fcn.00413260
add esp, 4
jmp 0x409727
push str.Update_success__n
mov dword [ebp - 0x7cc], ebx
call fcn.004131d0
jmp 0x40827a
push str.Copy_success__n
mov dword [ebp - 0x7cc], ebx
call fcn.004131d0
jmp 0x40827a
push str.LSP_binary_hasnt_change__no_need_to_update_the_binary__n
call fcn.004131d0
mov dword [ebp - 0x7cc], ebx
add esp, 4
mov eax, dword [ebp - 0x7d8]
cmp eax, 3
ja case.default.0x40828c
jmp dword [eax*4 + 0x409800]
lea eax, [ebp - 0x114]
mov esi, str.none
mov ecx, eax
mov edx, 0x104
sub esi, ecx
jmp 0x4082b0
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x408369
mov cl, byte [esi + eax]
test cl, cl
je 0x408369
mov byte [eax], cl
inc eax
dec edx
jne 0x4082b0
jmp 0x40836d
lea eax, [ebp - 0x114]
mov esi, str.bypass_existing_LSP
mov ecx, eax
mov edx, 0x104
sub esi, ecx
jmp 0x4082f0
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x408369
mov cl, byte [esi + eax]
test cl, cl
je 0x408369
mov byte [eax], cl
inc eax
dec edx
jne 0x4082f0
jmp 0x40836d
lea eax, [ebp - 0x114]
mov esi, str.use__t_flag__will_layer_to_be_first_in_chain
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x408369
mov cl, byte [eax + esi]
test cl, cl
je 0x408369
mov byte [eax], cl
inc eax
dec edx
jne 0x408320
jmp 0x40836d
lea eax, [ebp - 0x114]
mov esi, str.use__j_flag__will_layer_after_base_provider
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x408369
mov cl, byte [esi + eax]
test cl, cl
je 0x408369
mov byte [eax], cl
inc eax
dec edx
jne 0x408350
jmp 0x40836d
test edx, edx
jne 0x40836e
dec eax
mov byte [eax], 0
lea edx, [ebp - 0x114]
push edx
push str.Scenario_file_instruction_is:__s_n
call fcn.004131d0
add esp, 8
cmp byte [ebp - 0x7b5], 0
mov ebx, 7
je 0x4083a0
cmp dword [ebp - 0x80c], ebx
jl 0x4083a0
lea edi, [ebx - 3]
jmp 0x4083ac
mov edi, 2
mov byte [ebp - 0x7b5], 0
mov dword [ebp - 0x7bc], edi
mov dword [ebp - 0x54c], 0xf
mov dword [ebp - 0x550], 0
mov byte [ebp - 0x560], 0
cmp dword [ebp - 0x80c], 3
mov byte [ebp - 4], 2
jl 0x4088f3
push str.Microsoft_Firewall_Client_Service_Provider__TCP_IP_
mov byte [ebp - 0x7bd], 0
call fcn.00406980
push str.Microsoft_Firewall_Client_Service_Provider__UDP_IP_
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
push 0x29
push str.Looked_for_firewall_client_with_results:
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x540], eax
call fcn.00402640
mov eax, dword [ebp - 0x540]
push eax
lea ecx, [ebp - 0x598]
push ecx
call fcn.004185e0
mov esi, eax
mov edx, dword [ebp - 0x544]
push edx
lea eax, [ebp - 0x5ec]
push eax
mov byte [ebp - 4], 3
call fcn.004185e0
push 0x4320b8
push eax
lea ecx, [ebp - 0x608]
push ecx
mov byte [ebp - 4], 4
call fcn.00405e40
push esi
push eax
lea edx, [ebp - 0x57c]
push edx
mov byte [ebp - 4], 5
call fcn.00405e90
add esp, 0x28
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 6
call fcn.00404680
lea ecx, [ebp - 0x57c]
call fcn.00402170
lea ecx, [ebp - 0x608]
call fcn.00402170
lea ecx, [ebp - 0x5ec]
call fcn.00402170
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 2
call fcn.00402170
cmp dword [ebp - 0x544], 0
je 0x4084d4
mov eax, dword [ebp - 0x540]
test eax, eax
je 0x4084d4
mov byte [ebp - 0x7bd], 1
jmp 0x408699
push str.MSAFD_Tcpip__TCP_IP_
call fcn.00406980
push str.MSAFD_Tcpip__UDP_IP_
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
cmp dword [ebp - 0x544], 0
mov dword [ebp - 0x540], eax
je 0x408504
test eax, eax
jne 0x408527
push 0x43154c
call fcn.00406980
push 0x431534
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x544], 0
je 0x408534
test eax, eax
jne 0x408557
push str.MSAFD_TCP_IP__TCP_IP_
call fcn.00406980
push str.MSAFD_TCP_IP__UDP_IP_
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x544], 0
je 0x408564
test eax, eax
jne 0x408587
push str.TCPIP_MSAFD__TCP_IP_
call fcn.00406980
push str.TCPIP_MSAFD__UDP_IP_
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x544], 0
je 0x408594
test eax, eax
jne 0x4085b7
push str.Tcpip_MSAFD__TCP_IP_
call fcn.00406980
push str.Tcpip_MSAFD__UDP_IP_
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x544], 0
je 0x4085c4
test eax, eax
jne 0x4085e7
push str.TCP_IP_MSAFD__TCP_IP_
call fcn.00406980
push str.TCP_IP_MSAFD__UDP_IP_
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
mov dword [ebp - 0x540], eax
push 0x29
push str._Looked_for_regular_TCP_IP_with_results:
lea ecx, [ebp - 0x560]
call fcn.00404770
mov eax, dword [ebp - 0x540]
push eax
lea ecx, [ebp - 0x57c]
push ecx
call fcn.004185e0
mov esi, eax
mov edx, dword [ebp - 0x544]
push edx
lea eax, [ebp - 0x608]
push eax
mov byte [ebp - 4], bl
call fcn.004185e0
push 0x4320b8
push eax
lea ecx, [ebp - 0x5ec]
push ecx
mov byte [ebp - 4], 8
call fcn.00405e40
push esi
push eax
lea edx, [ebp - 0x598]
push edx
mov byte [ebp - 4], 9
call fcn.00405e90
add esp, 0x28
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0xa
call fcn.00404680
lea ecx, [ebp - 0x598]
call fcn.00402170
lea ecx, [ebp - 0x5ec]
call fcn.00402170
lea ecx, [ebp - 0x608]
call fcn.00402170
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 2
call fcn.00402170
mov eax, dword [ebp - 0x540]
mov edx, dword [ebp - 0x544]
mov cl, byte [ebp - 0x7b5]
xor ebx, ebx
test edx, edx
je 0x4086b4
test cl, cl
je 0x4086b4
mov ebx, 2
cmp dword [ebp + ebx*4 - 0x544], 0
lea esi, [ebp + ebx*4 - 0x544]
je 0x4086e9
cmp dword [ebp + ebx*4 - 0x540], 0
je 0x4086e9
test cl, cl
jne 0x4086e9
cmp edx, 0x3f2
ja 0x408860
cmp eax, 0x3f2
jmp 0x40885a
push str.MSAFD_Tcpip__TCP_IPv6_
call fcn.00406980
push str.MSAFD_Tcpip__UDP_IPv6_
mov dword [esi], eax
call fcn.00406980
add esp, 8
cmp dword [esi], 0
lea ebx, [ebp + ebx*4 - 0x540]
mov dword [ebx], eax
je 0x408714
test eax, eax
jne 0x40872f
push 0x431400
call fcn.00406980
push 0x4313e8
mov dword [esi], eax
call fcn.00406980
add esp, 8
mov dword [ebx], eax
cmp dword [esi], 0
je 0x408739
cmp dword [ebx], 0
jne 0x408754
push str.MSAFD_TCP_IP__TCP_IPv6_
call fcn.00406980
push str.MSAFD_TCP_IP__UDP_IPv6_
mov dword [esi], eax
call fcn.00406980
add esp, 8
mov dword [ebx], eax
cmp dword [esi], 0
je 0x40875e
cmp dword [ebx], 0
jne 0x408779
push str.TCPIP_MSAFD__TCP_IPv6_
call fcn.00406980
push str.TCPIP_MSAFD__UDP_IPv6_
mov dword [esi], eax
call fcn.00406980
add esp, 8
mov dword [ebx], eax
cmp dword [esi], 0
je 0x408783
cmp dword [ebx], 0
jne 0x40879e
push str.TCP_IP_MSAFD__TCP_IPv6_
call fcn.00406980
push str.TCP_IP_MSAFD__UDP_IPv6_
mov dword [esi], eax
call fcn.00406980
add esp, 8
mov dword [ebx], eax
push 0x24
push str._Looked_for_V6_TCP_IP_with_results:
lea ecx, [ebp - 0x560]
call fcn.00404770
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x57c]
push ecx
call fcn.004185e0
mov ebx, eax
mov edx, dword [esi]
push edx
lea eax, [ebp - 0x608]
push eax
mov byte [ebp - 4], 0xb
call fcn.004185e0
push 0x4320b8
push eax
lea ecx, [ebp - 0x5ec]
push ecx
mov byte [ebp - 4], 0xc
call fcn.00405e40
push ebx
push eax
lea edx, [ebp - 0x598]
push edx
mov byte [ebp - 4], 0xd
call fcn.00405e90
add esp, 0x28
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0xe
call fcn.00404680
lea ecx, [ebp - 0x598]
call fcn.00402170
lea ecx, [ebp - 0x5ec]
call fcn.00402170
lea ecx, [ebp - 0x608]
call fcn.00402170
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 2
call fcn.00402170
cmp dword [ebp - 0x544], 0x3f4
mov eax, dword [ebp - 0x540]
ja 0x408860
cmp eax, 0x3f4
jbe 0x40891e
cmp byte [ebp - 0x7bd], 0
jne 0x40891e
mov edx, dword [0x43b054]
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x544]
push ecx
push edx
call fcn.0040eeb0
add esp, 0xc
test al, al
jne 0x408918
lea eax, [ebp - 0x598]
push eax
call fcn.00406bd0
add esp, 4
mov ecx, 0x10
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], ecx
jb 0x4088b1
mov eax, dword [eax]
cmp dword [ebp - 0x54c], ecx
mov ecx, dword [ebp - 0x560]
jae 0x4088c5
lea ecx, [ebp - 0x560]
push eax
push ecx
push str.Failed_to_get_base_TCP_or_UDP_providers__this_is_the_decision_tree__s_nLSP_Map:_n
call fcn.00413260
add esp, 0xc
lea ecx, [ebp - 0x598]
call fcn.00402170
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
push str.MS.w95.spi.tcp
call fcn.00406980
push str.MS.w95.spi.udp
mov dword [ebp - 0x544], eax
call fcn.00406980
add esp, 8
mov dword [ebp - 0x540], eax
jmp 0x40891e
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0x544], 0
je 0x40919d
test eax, eax
je 0x40919d
cmp dword [ebp - 0x824], 0
mov ecx, dword [ebp - 0x538]
je 0x40898f
cmp edi, 2
jne 0x408962
cmp dword [ebp - 0x830], 0
mov dword [ebp - 0x7bc], 1
je 0x40898f
mov dword [ebp - 0x544], eax
jmp 0x40898f
cmp dword [ebp - 0x830], 0
mov dword [ebp - 0x7bc], 2
je 0x408983
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], ecx
jmp 0x40898f
mov edx, dword [ebp - 0x53c]
mov dword [ebp - 0x540], edx
mov edi, dword [ebp - 0x814]
xor esi, esi
cmp edi, esi
je 0x4089bb
push str.IFS_LSP_install__will_assume__j_flag_and_override_any_scenario_settings__n
call fcn.004131d0
mov ecx, dword [ebp - 0x538]
mov eax, 3
add esp, 4
mov dword [ebp - 0x7d8], eax
jmp 0x4089c1
mov eax, dword [ebp - 0x7d8]
xor bl, bl
cmp eax, 3
je 0x408ff6
cmp dword [ebp - 0x7bc], 2
ja 0x408a2b
cmp eax, esi
je 0x4089f3
cmp eax, 2
je 0x4089f3
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x53c], edx
mov dword [ebp - 0x538], ecx
jmp 0x408a93
mov eax, dword [ebp - 0x544]
mov ecx, dword [0x43b054]
push eax
push ecx
call fcn.0040e510
mov edx, dword [ebp - 0x540]
mov dword [ebp - 0x53c], eax
mov eax, dword [0x43b054]
push edx
push eax
call fcn.0040e510
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x538], ecx
jmp 0x408a85
cmp eax, esi
je 0x408a4e
cmp eax, 2
je 0x408a4e
mov dword [ebp - 0x534], esi
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x52c], esi
mov dword [ebp - 0x528], esi
jmp 0x408a85
xor esi, esi
mov ecx, dword [ebp + esi*4 - 0x544]
mov edx, dword [0x43b054]
push ecx
push edx
call fcn.0040e510
add esp, 8
mov dword [ebp + esi*4 - 0x534], eax
cmp eax, dword [ebp + esi*4 - 0x544]
je 0x408a79
mov bl, 1
inc esi
cmp esi, 4
jl 0x408a50
mov ecx, dword [ebp - 0x538]
mov edx, dword [ebp - 0x53c]
test edx, edx
jne 0x408aa5
test ecx, ecx
jne 0x408a9c
cmp dword [ebp - 0x824], 0
je 0x408ab1
cmp dword [ebp - 0x844], 0
jne 0x408ab1
test ecx, ecx
jne 0x408adf
cmp dword [ebp - 0x830], ecx
je 0x408adf
mov esi, dword [ebp - 0x7bc]
cmp esi, 2
je 0x408f80
cmp esi, 1
jne 0x408adf
cmp dword [ebp - 0x844], 0
jne 0x408f80
cmp dword [ebp - 0x830], 0
jne 0x408f80
mov esi, dword [ebp - 0x7bc]
test bl, bl
jne 0x408afb
cmp dword [ebp - 0x824], 0
jne 0x408afb
cmp esi, 4
je 0x408f80
cmp esi, 2
je 0x408f80
cmp esi, 1
jne 0x408b23
cmp dword [ebp - 0x844], 0
jne 0x408f80
cmp dword [ebp - 0x830], 0
jne 0x408f80
mov eax, dword [ebp - 0x7d8]
cmp eax, 1
je 0x408f89
xor ebx, ebx
cmp eax, ebx
jne 0x408ec5
push str.Checking_initial_connection_with_either_a_proxy_server_or_google.com_n
call fcn.004131d0
mov edi, dword [ebp - 0x7e8]
add esp, 4
test edi, edi
jne 0x408bc1
call fcn.00405150
test eax, eax
jne 0x408bc1
push str.Connection_failed_will_try_to_install_regularly__and_assuming__j_flag_n
call fcn.004131d0
mov eax, dword [ebp - 0x7bc]
lea esi, [eax*4]
mov dword [ebp - 0x7f8], eax
lea eax, [ebp - 0x7ec]
push eax
push esi
mov dword [ebp - 0x820], 1
call fcn.00415490
push esi
lea ecx, [ebp - 0x544]
push ecx
push eax
mov dword [ebp - 0x7d4], eax
call fcn.00418f50
add esp, 0x18
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
mov edi, dword [ebp - 0x7f8]
jmp 0x407dc6
push str.Connection_established_nTrying_to_install_LSP_over_existing_layers___t_parameter__over_layers:
call fcn.004131d0
add esp, 4
cmp dword [ebp - 0x7bc], ebx
jbe 0x408bf9
mov ebx, dword [ebp - 0x7bc]
lea esi, [ebp + ebx*4 - 0x544]
mov edx, dword [esi]
push edx
push 0x431178
call fcn.004131d0
add esp, 8
add esi, 4
dec ebx
jne 0x408be3
push 0x430b54
call fcn.004131d0
mov edx, dword [ebp - 0x814]
mov esi, dword [ebp - 0x7bc]
mov ebx, dword [ebp - 0x7cc]
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0x570]
push ecx
mov ecx, dword [0x43b054]
push 0
push edx
lea eax, [ebp + esi*4 - 0x544]
push eax
push esi
push ebx
push 0
push ecx
mov dword [ebp - 0x7e8], 0
call fcn.0040aea0
add esp, 0x28
mov dword [ebp - 0x7ec], eax
cmp eax, 0xffffffff
jne 0x408c88
push str.Failed_to_install_LSP_with_error__n_n
call fcn.00413260
mov edx, dword [ebp - 0x7e8]
push edx
push str.Log_ErrorCode:__i_n
call fcn.00413260
add esp, 0xc
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
push str.Checking_connection_again_to_verify_install_n
call fcn.004131d0
add esp, 4
test edi, edi
jne 0x408e5f
call fcn.00405150
test eax, eax
jne 0x408e5f
push str.Failed_to_establish_connection_after_install__will_try_to_install_again__using__j_parameter__n
call fcn.004131d0
mov ecx, dword [0x43b054]
lea eax, [ebp - 0x570]
push eax
push ecx
call fcn.00410e60
add esp, 0xc
cmp eax, edi
jne 0x408cef
push str.Failed_to_get_LSP_GUID_for_delete__n_n
call fcn.00413260
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
mov edx, dword [0x43b054]
push eax
push edx
call fcn.0040d6b0
add esp, 8
cmp eax, 0xffffffff
jne 0x408d25
push str.Failed_to_get_delete_LSP__n_n
call fcn.00413260
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
mov edx, dword [ebp - 0x814]
lea eax, [ebp - 0x7f4]
push eax
lea ecx, [ebp - 0x570]
push ecx
mov ecx, dword [0x43b054]
push edi
push edx
lea eax, [ebp - 0x544]
push eax
push esi
push ebx
push edi
push ecx
mov dword [ebp - 0x7f4], edi
call fcn.0040aea0
add esp, 0x24
mov dword [ebp - 0x7ec], eax
cmp eax, 0xffffffff
jne 0x408d9e
push str.Failed_to_install_LSP__second_round_after_failure__with_error__n_n
call fcn.00413260
mov eax, dword [ebp - 0x7f4]
add esp, 4
cmp eax, edi
je 0x408d8a
push eax
push str.Log_ErrorCode:__i_n
call fcn.00413260
add esp, 8
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
mov eax, dword [0x43b054]
lea edx, [ebp - 0x570]
push edx
push eax
call fcn.00410e60
add esp, 8
cmp eax, edi
jne 0x408dd8
push str.Failed_to_get_LSP_ID_after_second_installation__n
call fcn.00413260
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
lea ecx, [ebp - 0x7f4]
push ecx
push esi
lea edx, [ebp - 0x544]
push edx
push eax
mov eax, dword [0x43b054]
push eax
mov dword [ebp - 0x7f4], edi
call fcn.0040c8e0
add esp, 0x14
test eax, eax
jne 0x408e0a
push str.Failed_to_get_rebuild_LSP_order_after_installation__n
jmp 0x408d6a
mov ecx, dword [ebp - 0x7c4]
mov edx, dword [ebp - 0x80c]
push ecx
push edx
call fcn.004065b0
add esp, 8
test eax, eax
je 0x408e45
push str.Failed_to_set_category_n
call fcn.00413260
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x7dc], edi
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [ebp - 0x80c]
push eax
push ecx
call fcn.004065b0
add esp, 8
test eax, eax
je 0x408e9a
push str.Failed_to_set_category_n
call fcn.00413260
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
push str.Connection_established_after_install__installation_completed__n
call fcn.004131d0
add esp, 4
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x7dc], 0
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
push ecx
push edx
push str.Will_install_LSP_over_existing_layers___t_parameter__over_layers:__i_and__i_n
call fcn.004131d0
lea edx, [ebp - 0x7e8]
push edx
mov edx, dword [ebp - 0x7cc]
lea eax, [ebp - 0x570]
push eax
mov eax, dword [0x43b054]
push ebx
push edi
lea ecx, [ebp + esi*4 - 0x544]
push ecx
push esi
push edx
push ebx
push eax
mov dword [ebp - 0x7e8], ebx
call fcn.0040aea0
add esp, 0x30
mov dword [ebp - 0x7ec], eax
cmp eax, 0xffffffff
jne 0x408f2b
push str.Failed_to_install_LSP_with_error__n_n
call fcn.00413260
add esp, 4
mov eax, dword [ebp - 0x7e8]
cmp eax, ebx
jmp 0x408d7a
mov ecx, dword [ebp - 0x7c4]
mov edx, dword [ebp - 0x80c]
push ecx
push edx
call fcn.004065b0
add esp, 8
test eax, eax
je 0x408f66
push str.Failed_to_set_category_n
call fcn.00413260
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x7dc], ebx
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
cmp dword [ebp - 0x7d8], 1
jne 0x408f90
push str.Bypassing_installed_LSP_n
jmp 0x408f95
push str.No_LSP_installed_over_TCP_or_UDP__install_will_continue_regularly_n
call fcn.004131d0
add esp, 4
lea eax, [ebp - 0x7e8]
push eax
mov eax, dword [ebp - 0x7cc]
lea ecx, [ebp - 0x570]
push ecx
mov ecx, dword [0x43b054]
xor ebx, ebx
push ebx
push edi
lea edx, [ebp - 0x544]
push edx
push esi
push eax
push ebx
push ecx
mov dword [ebp - 0x7e8], ebx
call fcn.0040aea0
add esp, 0x24
mov dword [ebp - 0x7ec], eax
cmp eax, 0xffffffff
je 0x408f1e
mov edx, dword [ebp - 0x7c4]
mov eax, dword [ebp - 0x80c]
push edx
push eax
jmp 0x408f39
push str.Going_to_try_to_inject___j__into_LSP_chain_n
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x820], 1
call fcn.004131d0
add esp, 4
cmp dword [ebp - 0x824], esi
jne 0x40913a
mov eax, dword [ebp - 0x7bc]
lea ecx, [ebp - 0x7d4]
push ecx
mov ecx, dword [0x43b054]
lea edx, [ebp - 0x544]
push edx
push eax
push ecx
call fcn.00410fe0
add esp, 0x10
mov dword [ebp - 0x7f8], eax
cmp eax, esi
jne 0x409057
push str.Error_inside_GetNewBaseProviders__n
jmp 0x408f4a
cmp eax, 2
jbe 0x409183
push str.Will_layer_over_extra_base_providers__n_nOriginal_providers:_n_n
call fcn.004131d0
mov edi, dword [ebp - 0x7bc]
add esp, 4
xor esi, esi
test edi, edi
je 0x4090a6
lea esp, [esp]
mov edx, dword [ebp + esi*4 - 0x544]
mov eax, dword [0x43b054]
push edx
push eax
call fcn.0040ee10
push eax
push 0x430e30
call fcn.004131d0
inc esi
add esp, 0x10
cmp esi, edi
jb 0x409080
push str._nAdded_providers:_n_n
call fcn.004131d0
mov ebx, dword [ebp - 0x7f8]
add esp, 4
xor esi, esi
test ebx, ebx
je 0x409113
nop
mov ecx, dword [ebp - 0x7d4]
mov eax, dword [ecx + esi*4]
cmp eax, dword [ebp - 0x544]
je 0x40910e
cmp eax, dword [ebp - 0x540]
je 0x40910e
cmp eax, dword [ebp - 0x53c]
jne 0x4090e6
cmp edi, 2
jne 0x40910e
cmp eax, dword [ebp - 0x538]
jne 0x4090f3
cmp edi, 2
jne 0x40910e
mov edx, dword [0x43b054]
push eax
push edx
call fcn.0040ee10
push eax
push 0x430e30
call fcn.004131d0
add esp, 0x10
inc esi
cmp esi, ebx
jb 0x4090c0
push 0x430b54
call fcn.004131d0
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
mov edi, dword [ebp - 0x7f8]
jmp 0x407dc6
mov esi, dword [ebp - 0x7bc]
mov eax, esi
shr eax, 1
mov dword [ebp - 0x7f8], eax
lea eax, [ebp - 0x7ec]
push eax
lea ecx, [esi*4]
push ecx
call fcn.00415490
mov edx, dword [ebp - 0x544]
add esp, 8
mov dword [ebp - 0x7d4], eax
mov dword [eax], edx
cmp esi, 4
jne 0x409183
mov eax, dword [ebp - 0x7d4]
mov ecx, dword [ebp - 0x540]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
mov edi, dword [ebp - 0x7f8]
jmp 0x407dc6
lea edx, [ebp - 0x598]
push edx
call fcn.00406bd0
add esp, 4
mov ecx, 0x10
mov byte [ebp - 4], 0x10
cmp dword [eax + 0x14], ecx
jb 0x4091bc
mov eax, dword [eax]
cmp dword [ebp - 0x54c], ecx
mov ecx, dword [ebp - 0x560]
jae 0x4091d0
lea ecx, [ebp - 0x560]
push eax
push ecx
push str.Failed_to_find_TCP_or_UDP_catalogs__this_is_the_decision_tree__s_nLSP_Map:_n
call fcn.00413260
add esp, 0xc
lea ecx, [ebp - 0x598]
call fcn.00402170
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.00402170
jmp 0x409727
mov edx, dword [ebp - 0x7d4]
lea ecx, [ebp - 0x7e8]
push ecx
push edi
push edx
push eax
mov eax, dword [0x43b054]
push eax
mov dword [ebp - 0x7e8], esi
call fcn.0040c8e0
add esp, 0x14
test eax, eax
jne 0x409254
push str.Failed_to_get_rebuild_LSP_order_after_installation__n
call fcn.00413260
mov eax, dword [ebp - 0x7e8]
add esp, 4
cmp eax, esi
je 0x409727
push eax
push str.Log_ErrorCode:__i_n
call fcn.00413260
add esp, 8
jmp 0x409727
mov eax, dword [ebp - 0x7ec]
cmp eax, 0xffffffff
je 0x40928f
mov ecx, dword [ebp - 0x7c4]
mov edx, dword [ebp - 0x80c]
push ecx
push edx
call fcn.004065b0
add esp, 8
test eax, eax
je 0x40971d
push str.Failed_to_set_category_n
call fcn.00413260
add esp, 4
jmp 0x40971d
push str.Failed_to_install_LSP_with_error__n_n
call fcn.00413260
mov eax, dword [ebp - 0x834]
jmp 0x409236
cmp dword [ebp - 0x860], esi
jne 0x4093fa
mov eax, dword [0x43b054]
test eax, eax
je 0x4092be
cmp eax, esi
jne 0x409361
push str.32_bit_Winsock_LSP_Map:_n_n
call fcn.004131d0
lea eax, [ebp - 0x808]
push eax
push 1
call fcn.004155e0
mov ebx, eax
add esp, 0xc
mov dword [ebp - 0x81c], ebx
test ebx, ebx
jne 0x409300
mov ecx, dword [ebp - 0x804]
mov edx, dword [ecx]
push edx
push str._s:_EnumerateProviders:_Unable_to_enumerate_Winsock_catalog_n
call fcn.00413260
add esp, 8
jmp 0x409727
mov ecx, dword [ebp - 0x808]
lea eax, [ebp - 0x828]
push eax
push ecx
push ebx
call fcn.0040f1f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40932c
push str.No_LSPs_are_installed_n_n
call fcn.004131d0
add esp, 4
jmp 0x409349
mov edx, dword [ebp - 0x828]
push edx
push esi
call fcn.0040e5d0
mov eax, dword [ebp - 0x828]
push eax
push esi
call fcn.0040e820
add esp, 0x10
push ebx
call fcn.00415690
mov eax, dword [0x43b054]
add esp, 4
mov dword [ebp - 0x81c], 0
test eax, eax
je 0x40936e
cmp eax, 2
jne 0x40971d
push str.64_bit_Winsock_LSP_Map:_n_n
call fcn.004131d0
lea ecx, [ebp - 0x808]
push ecx
push 2
call fcn.004155e0
mov ebx, eax
add esp, 0xc
mov dword [ebp - 0x81c], ebx
test ebx, ebx
je 0x407d0a
mov edx, dword [ebp - 0x808]
lea ecx, [ebp - 0x828]
push ecx
push edx
push ebx
call fcn.0040f1f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4093c5
push str.No_LSPs_are_installed_n_n
call fcn.004131d0
add esp, 4
jmp 0x4093e2
mov eax, dword [ebp - 0x828]
push eax
push esi
call fcn.0040e5d0
mov ecx, dword [ebp - 0x828]
push ecx
push esi
call fcn.0040e820
add esp, 0x10
push ebx
call fcn.00415690
add esp, 4
mov dword [ebp - 0x81c], 0
jmp 0x40971d
cmp dword [ebp - 0x82c], esi
jne 0x409439
mov eax, dword [0x43b054]
test eax, eax
je 0x40940f
cmp eax, esi
jne 0x40941d
push esi
call fcn.0040dee0
mov eax, dword [0x43b054]
add esp, 4
test eax, eax
je 0x40942a
cmp eax, 2
jne 0x40971d
push 2
call fcn.0040dee0
add esp, 4
jmp 0x40971d
cmp dword [ebp - 0x800], 0
je case.0x40737b.107
mov edi, dword [ebp - 0x800]
xor ebx, ebx
cmp dword [ebp - 0x848], ebx
jne 0x4094a4
mov edx, dword [0x43b054]
push edi
push edx
call fcn.0040ef70
mov esi, eax
add esp, 8
test esi, esi
jne 0x40947b
push str.Failed_to_get_deleted_LSP_filename__n
call fcn.00413260
add esp, 4
jmp 0x4094aa
push esi
push str.LSP_to_be_deleted_filename:__S_n
call fcn.004131d0
push esi
call fcn.00405530
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4094aa
push str.LSP_file_is_located_at_system32_n
call fcn.004131d0
add esp, 4
jmp 0x4094aa
mov esi, dword [ebp - 0x82c]
mov ecx, dword [0x43b054]
test ecx, ecx
je 0x4094b9
cmp ecx, 1
jne 0x4094cc
push edi
push 1
call fcn.0040d6b0
mov ecx, dword [0x43b054]
add esp, 8
jmp 0x4094d2
mov eax, dword [ebp - 0x82c]
test ecx, ecx
je 0x4094db
cmp ecx, 2
jne 0x4094e6
push edi
push 2
call fcn.0040d6b0
add esp, 8
test eax, eax
jne 0x40971d
cmp dword [ebp - 0x848], eax
jne 0x40971d
test ebx, ebx
je 0x40971d
mov dword [ebp - 0x54c], 7
mov dword [ebp - 0x550], eax
mov word [ebp - 0x560], ax
mov byte [ebp - 4], 0x11
mov bl, 0x12
nop
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409525
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x560]
call fcn.00401720
push 0x2e
push 1
lea ecx, [ebp - 0x560]
call fcn.004045c0
lea ecx, [ebp - 0x624]
push ecx
call fcn.0040bbc0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], bl
call fcn.004014f0
cmp dword [ebp - 0x610], 8
mov byte [ebp - 4], 0x11
jb 0x40958e
mov edx, dword [ebp - 0x624]
push edx
call fcn.00418f39
add esp, 4
lea eax, [ebp - 0x560]
push eax
call fcn.0040a2b0
add esp, 4
test eax, eax
jne 0x409520
mov eax, dword [ebp - 0x560]
mov edi, 8
cmp dword [ebp - 0x54c], edi
jae 0x4095be
lea eax, [ebp - 0x560]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x409676
mov ebx, dword [ebp - 0x560]
cmp dword [ebp - 0x54c], edi
jae 0x4095e2
lea ebx, [ebp - 0x560]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push ebx
push esi
push str.Failed_to_rename_file_to_delete_from:__S_to:__S_with_error_code:__i__this_can_be_an_error___n
call fcn.00413260
mov eax, dword [ebp - 0x560]
mov ebx, 8
add esp, 0x10
cmp dword [ebp - 0x54c], ebx
jae 0x409613
lea eax, [ebp - 0x560]
push 4
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call esi
test eax, eax
jne 0x409638
call edi
push eax
push str.Also_failed_to_queue_with_error_code:__i_n
call fcn.00413260
add esp, 8
jmp 0x40970e
mov eax, dword [ebp - 0x560]
cmp dword [ebp - 0x54c], ebx
jae 0x40964c
lea eax, [ebp - 0x560]
push 4
push 0
push eax
call esi
test eax, eax
jne 0x40966c
call edi
push eax
push str.Failed_to_queue_deletion_of_queue__with_error_code:__i_n
call fcn.00413260
add esp, 8
jmp 0x40970e
push str.Queueing_went_OK_n
jmp 0x409706
push 0x430c28
lea ecx, [ebp - 0x5ec]
call fcn.00401810
lea ecx, [ebp - 0x560]
push ecx
push eax
lea edx, [ebp - 0x598]
push edx
mov byte [ebp - 4], 0x13
call fcn.004061e0
add esp, 0xc
cmp dword [eax + 0x14], edi
jb 0x4096a8
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
lea ecx, [ebp - 0x598]
sete bl
call fcn.004013c0
lea ecx, [ebp - 0x5ec]
mov byte [ebp - 4], 0x11
call fcn.004013c0
test bl, bl
je 0x409701
mov esi, dword [ebp - 0x560]
cmp dword [ebp - 0x54c], edi
jae 0x4096ea
lea esi, [ebp - 0x560]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_queue_file__S_for_deletion_with_error_code:__i__n
call fcn.00413260
add esp, 0xc
jmp 0x40970e
push str.LSP_file_was_queued_for_deletion_after_reboot__n
call fcn.004131d0
add esp, 4
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 1
call fcn.004013c0
mov dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x84c], 0
jne 0x4078c8
mov esi, dword [ebp - 0x7dc]
test esi, esi
jne 0x409750
push str._n_nExiting_with_error_code:_0_which_means_everything_went_OK_n
call fcn.004131d0
add esp, 4
jmp 0x4078e6
push esi
push str._n_nExiting_with_error_code:__i_n
call fcn.004131d0
jmp 0x4078e3