Function at 0x436968
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Check if file exists
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4da4c7
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
push ebx
push esi
mov eax, dword [0x57b750]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
push 0x527594
lea ecx, [esp + 0x20]
call fcn.004024df
and dword [esp + 0x110], 0
push 0x52fe4c
lea ecx, [esp + 0x4c]
call fcn.004024df
push str..dll
lea ecx, [esp + 0xb4]
mov byte [esp + 0x114], 1
call fcn.004024df
push str..dat
lea ecx, [esp + 0x24]
mov byte [esp + 0x114], 2
call fcn.004024df
push 0x527dfc
lea ecx, [esp + 0x30]
mov byte [esp + 0x114], 3
call fcn.004024df
push 0x52fe64
lea ecx, [esp + 0x1c]
mov byte [esp + 0x114], 4
call fcn.004024df
push str..evt
lea ecx, [esp + 0x50]
mov byte [esp + 0x114], 5
call fcn.004024df
push str..ini
lea ecx, [esp + 0x28]
mov byte [esp + 0x114], 6
call fcn.004024df
mov byte [esp + 0x110], 7
mov eax, dword [edi + 8]
push str.ntldr
push eax
mov ecx, edi
call fcn.004a49ab
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x18]
push str.ntdetect
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 8
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x18]
push str.ntdll
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 9
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push str.ntoskrnl
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0xa
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push str.svchost
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0xb
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push str.lsass
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0xc
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push str.services
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0xd
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push str.csrss
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0xe
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push str.smss
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0xf
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push str.boot
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x10
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
push str..dos
lea ecx, [esp + 0x14]
call fcn.00410881
push eax
lea eax, [esp + 0x18]
push str.bootsect
push eax
mov byte [esp + 0x11c], 0x11
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x12
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push 0x52ff38
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x13
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push str.msdos
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x14
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x14]
push str.command
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x15
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov eax, dword [edi + 8]
push str.config_software
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.config_system
push eax
mov ecx, edi
call fcn.004a49ab
lea eax, [esp + 0x20]
push eax
mov esi, str.ntuser
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x16
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x17
lea ecx, [esp + 0x18]
push ecx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004020b5
add esp, 0xc
mov byte [esp + 0x110], 0x18
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x19
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push str.explorer
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x1a
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
mov esi, str.system
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x1b
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
push str.user
lea eax, [esp + 0x18]
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x1c
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push str.classes
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x1d
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov ebx, 0x5231e4
push ebx
lea ecx, [esp + 0x10]
call fcn.004024df
push eax
lea eax, [esp + 0x18]
push str.drvspace
push eax
mov byte [esp + 0x11c], 0x1e
call fcn.0040f56d
add esp, 0xc
push 0x52ffd8
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x11c], 0x1f
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x20
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push str.protocol
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x21
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push 0x530008
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x22
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x23
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x10]
push 0x530008
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x24
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push str.program
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x25
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea ecx, [esp + 0x18]
call fcn.004024df
push eax
lea eax, [esp + 0x14]
push str.dosprmpt
push eax
mov byte [esp + 0x11c], 0x26
call fcn.0040f56d
add esp, 0xc
push 0x530010
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x11c], 0x27
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x28
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea ecx, [esp + 0x18]
call fcn.004024df
push eax
lea eax, [esp + 0x14]
push str.win386
push eax
mov byte [esp + 0x11c], 0x29
call fcn.0040f56d
add esp, 0xc
push 0x53002c
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x11c], 0x2a
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x2b
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push str.pagefile
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x2c
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push str.hiberfile
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x2d
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push str.config
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x2e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea ecx, [esp + 0x18]
call fcn.004024df
push eax
lea eax, [esp + 0x14]
push str.autoexec
push eax
mov byte [esp + 0x11c], 0x2f
call fcn.0040f56d
add esp, 0xc
push 0x53006c
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x11c], 0x30
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x31
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea ecx, [esp + 0x18]
call fcn.004024df
push eax
lea eax, [esp + 0x14]
push 0x530088
push eax
mov byte [esp + 0x11c], 0x32
call fcn.0040f56d
add esp, 0xc
push 0x530010
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x11c], 0x33
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x34
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push str.passwd
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x35
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push str.oakley
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x36
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push 0x5300b0
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x37
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
mov ebx, str.usrclass
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x38
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x11c], 0x39
call fcn.004020b5
add esp, 0xc
mov byte [esp + 0x110], 0x3a
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push str.cleanup
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x3b
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea ebx, [esp + 0x18]
call fcn.0043952d
push eax
push str.desktop
lea eax, [esp + 0x18]
mov byte [esp + 0x118], 0x3c
push eax
call fcn.0040f56d
add esp, 0xc
push 0x5300dc
push eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x11c], 0x3d
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x3e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
mov ebx, str.userdiff
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x3f
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x68]
add ecx, 0xfffffff0
call fcn.004027b0
mov eax, dword [edi + 8]
push ebx
push eax
mov ecx, edi
call fcn.004a49ab
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x94]
push str.tempkey
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x40
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x90]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0x7c]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x6c]
push esi
push eax
mov byte [esp + 0x11c], 0x41
call fcn.0040f56d
add esp, 0xc
mov ebx, 0x530118
push ebx
push eax
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x11c], 0x42
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x43
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x90]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x68]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x68]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x44
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0xbc]
push eax
call fcn.004159f9
push eax
mov esi, str.software
lea eax, [esp + 0x7c]
push esi
push eax
mov byte [esp + 0x11c], 0x45
call fcn.0040f56d
add esp, 0xc
push ebx
push eax
lea eax, [esp + 0x6c]
push eax
mov byte [esp + 0x11c], 0x46
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x47
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xb8]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc4]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x48
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc0]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x70]
push str.security
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x49
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x78]
push 0x530134
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x4a
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0xfc]
push eax
call fcn.004159f9
push eax
mov esi, str.default
lea eax, [esp + 0x70]
push esi
push eax
mov byte [esp + 0x11c], 0x4b
call fcn.0040f56d
add esp, 0xc
push ebx
push eax
lea eax, [esp + 0x7c]
push eax
mov byte [esp + 0x11c], 0x4c
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x4d
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xf8]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc0]
push esi
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x4e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xbc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xf8]
push str.sysevent
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x4f
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xf4]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xd8]
push str.appevent
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x50
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xd4]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xf0]
push str.secevent
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x51
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xec]
add ecx, 0xfffffff0
call fcn.004027b0
mov eax, dword [edi + 8]
push str._security
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..default
push eax
mov ecx, edi
call fcn.004a49ab
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xe0]
push str.winnt32
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x52
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xdc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x9c]
push str.passwd
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x53
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x98]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x44]
push str.oakley
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x54
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0x34]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x9c]
push str.h32log
push eax
mov byte [esp + 0x11c], 0x55
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x56
mov esi, 0x5301ac
push esi
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x57
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x98]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0x8c]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x44]
push str.objects
push eax
mov byte [esp + 0x11c], 0x58
call fcn.0040f56d
add esp, 0xc
push str.data
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x11c], 0x59
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x5a
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0xb8]
push eax
call fcn.004159f9
push eax
mov ebx, 0x5279d8
lea eax, [esp + 0x34]
push ebx
push eax
mov byte [esp + 0x11c], 0x5b
call fcn.0040f56d
add esp, 0xc
push 0x5301d4
push eax
lea eax, [esp + 0x90]
push eax
mov byte [esp + 0x11c], 0x5c
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x5d
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xb4]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xac]
push str.extend
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x5e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xa8]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x74]
push str.scan
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x5f
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0x54]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0xac]
push ebx
push eax
mov byte [esp + 0x11c], 0x60
call fcn.0040f56d
add esp, 0xc
push 0x5301f8
push eax
lea eax, [esp + 0x78]
push eax
mov byte [esp + 0x11c], 0x61
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x62
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0xa8]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push str.index
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x63
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea ebx, [esp + 0xa4]
call fcn.0043952d
push eax
lea eax, [esp + 0x54]
push str.normal
push eax
mov byte [esp + 0x11c], 0x64
call fcn.0040f56d
add esp, 0xc
push 0x527ee4
push eax
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x11c], 0x65
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x66
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xa0]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea ebx, [esp + 0xcc]
call fcn.0043952d
push eax
lea eax, [esp + 0x40]
push str.schedlog
push eax
mov byte [esp + 0x11c], 0x67
call fcn.0040f56d
add esp, 0xc
push esi
push eax
lea eax, [esp + 0xa8]
mov byte [esp + 0x118], 0x68
push eax
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x69
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xa0]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc8]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xd4]
push str.setup
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x6a
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xd0]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xdc]
push str.unwise
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x6b
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xd8]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xe4]
push str.install
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x6c
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xe0]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
mov ebx, str.uninstall
lea eax, [esp + 0xec]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x6d
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xe8]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xf4]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x6e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xf0]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
mov ebx, str.uninstal
lea eax, [esp + 0x84]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x6f
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x58]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x70
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
lea eax, [esp + 0x100]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x84]
push str.Uninst
push eax
mov byte [esp + 0x11c], 0x71
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x72
push 0x530274
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x73
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xfc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
mov ebx, str.unins000
lea eax, [esp + 0xc8]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x74
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xc4]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xe8]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x75
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xe4]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
mov ebx, str.unins001
lea eax, [esp + 0xd0]
push ebx
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x76
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xcc]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x20]
push eax
push ebx
lea eax, [esp + 0x60]
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x77
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.004027b0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x48]
push str.unwise32
push eax
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x78
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x2e
pop ebx
push ebx
lea eax, [esp + 0x3c]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x5c]
push str.setup
push eax
mov byte [esp + 0x11c], 0x79
call fcn.0040f56d
add esp, 0xc
push 0x5302c8
push eax
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x11c], 0x7a
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x7b
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea eax, [esp + 0x38]
push eax
call fcn.004159f9
push eax
mov byte [esp + 0x114], 0x7c
push str.schedlgu
lea eax, [esp + 0x4c]
push eax
call fcn.0040f56d
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x11c], 0x7d
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x7e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea eax, [esp + 0x80]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x3c]
push str.netlogon
push eax
mov byte [esp + 0x11c], 0x7f
call fcn.0040f56d
add esp, 0xc
push 0x5302e4
push eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x11c], 0x80
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x81
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.004027b0
push ebx
lea eax, [esp + 0x88]
push eax
call fcn.004159f9
push eax
lea eax, [esp + 0x38]
push str.userinit
push eax
mov byte [esp + 0x11c], 0x82
call fcn.0040f56d
add esp, 0xc
push 0x527ecc
mov byte [esp + 0x114], 0x83
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0040210c
add esp, 0xc
mov byte [esp + 0x110], 0x84
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
call fcn.004027b0
mov eax, dword [edi + 8]
mov esi, str.data.bak
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..NT
push eax
mov ecx, edi
call fcn.004a49ab
push str..prv
lea ecx, [esp + 0x90]
call fcn.004024df
push eax
lea eax, [esp + 0x88]
push str.bootlog
push eax
mov byte [esp + 0x11c], 0x85
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x86
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.004027b0
push str..dll
lea ecx, [esp + 0x98]
call fcn.004024df
push eax
mov ebx, str.chklist
lea eax, [esp + 0x90]
push ebx
push eax
mov byte [esp + 0x11c], 0x87
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x88
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x94]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x527594
lea ecx, [esp + 0xa0]
call fcn.004024df
push eax
lea eax, [esp + 0x98]
push ebx
push eax
mov byte [esp + 0x11c], 0x89
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x8a
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x94]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x9c]
add ecx, 0xfffffff0
call fcn.004027b0
push 0x52fe4c
lea ecx, [esp + 0xa8]
call fcn.004024df
push eax
lea eax, [esp + 0xa0]
push ebx
push eax
mov byte [esp + 0x11c], 0x8b
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x8c
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x9c]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xa4]
add ecx, 0xfffffff0
call fcn.004027b0
push str..bat
lea ecx, [esp + 0xb0]
call fcn.004024df
push eax
lea eax, [esp + 0xa8]
push ebx
push eax
mov byte [esp + 0x11c], 0x8d
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x8e
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xa4]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0xac]
add ecx, 0xfffffff0
call fcn.004027b0
push str..txt
lea ecx, [esp + 0x64]
call fcn.004024df
push eax
lea eax, [esp + 0xb0]
push ebx
push eax
mov byte [esp + 0x11c], 0x8f
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x90
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0xac]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.004027b0
push str..doc
lea ecx, [esp + 0x60]
call fcn.004024df
push eax
lea eax, [esp + 0x64]
push ebx
push eax
mov byte [esp + 0x11c], 0x91
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x92
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.004027b0
push str..chk
lea ecx, [esp + 0x104]
call fcn.004024df
push eax
lea eax, [esp + 0x60]
push 0x530390
push eax
mov byte [esp + 0x11c], 0x93
call fcn.0040f56d
add esp, 0xc
mov byte [esp + 0x110], 0x94
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.004027b0
mov byte [esp + 0x110], 7
mov ecx, dword [esp + 0x100]
add ecx, 0xfffffff0
call fcn.004027b0
mov eax, dword [edi + 8]
push str.data.sav
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.W95UNDO.ini
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.autoexec.bat
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..myd
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.config.sys
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.io.sys
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.control.ini
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..prn
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..met
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..slt
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str..sbd
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.assemblyinfo
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.unins
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.mplay32.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.misc.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.pkmres.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.nwiz.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.mobsync.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.OneCare_Live
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.OneCare_Protection
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Protection_Service
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.microsoft_money
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.vpngui.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ABBYY_FineReader
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.MOH.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.netwaiting
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.BVRP_Software
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.SDNT
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.SDHP
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.IMFPrint
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.IMF32
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.usbmon
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.usbprint
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x53063c
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ibm
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.dell
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str._acer
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.lenovo
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str._toshiba
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
mov esi, str.canon
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.panasonic
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.rundll32.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.encarta
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.msworld6.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.explorer.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.msenvmui.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Windows_Mail
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Typing_Pal
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ulead_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.corel_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530778
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.CyberLink
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Webroot
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Symantec_Shared
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.SEVINST.EXE
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Image_Line_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Corel_Painter
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.progeCAD
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530844
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Yahoo__
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.YINSTH1.DLL
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AshampooAshampoo
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Microsoft_Shared_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.dynacom
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Zone_Labs_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.F_Secure_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Grisoft_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Kaspersky_Lab_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Trend_Micro_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Panda_Security_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Panda_Software_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.McAfee_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.McAfee.com_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.BulletProofSoft_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Softwin_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.CA_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Norman_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Agnitum_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.BullGuard_Software_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.CafeCupPlatinum_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.intuit
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.quickbook
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.turbotax
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Trillianplugins_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530b0c
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530b28
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ResumeGrabber.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.citrix
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AVG_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.iPod_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Microsoft_Small_Business_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Office_Accounting
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Business_Contact_Manager_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.HPDigital_Imaging_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.GOOGLE_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Microsoft.AnalysisServices
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.RIA
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Thomson_Reuters
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.RIA_Group
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.RIAGroup
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.axdb.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AdDwfPdkCommon.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
mov esi, str.AdDwfPdkEPlotRenderer.dll
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
mov ebx, 0x530d20
push ebx
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530d44
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530d58
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AcSceneCOM.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AcProject18.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530dac
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
mov esi, str.AcSmComponents.dll
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530df8
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530e14
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530e34
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530e4c
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530e64
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530e80
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AdComFolderWatch.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AdDwfPdkEPlotCommon.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530efc
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AcEditSpinAtl.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x530f34
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AutoCAD
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.FeatureEntityCOM.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push ebx
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push esi
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.AdDwfPdkCommon.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.DiagEngine.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.GWSeTransmit.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.MgpSdfExportImport.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.PPMapControls.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.DiagEnginePS.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push 0x53104c
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Windows6.0_KB952627_x86_1_.MSU
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Windows6.0_KB970203_x86.msu
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.x86fre_GRMRSAT_MSU.msu
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Content.Outlook
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ntbackup.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Layout.ini
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.IXP657.TMP
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.google
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Start_MenuProgramsAdministrative_Tools
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Start_MenuProgramsAcces
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Start_MenuProgramsgames
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.mscoree.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.VCBRequestor.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ole2disp.dll
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.ContentPackagesActivationHandler.exe
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.VMware_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.4433F8FE_A2C6_4987_9C46_0D27BBD50921
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.D9D26565_B430_46CE_84FD_0545FEBC8EF9
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Datastore.edb
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Registry.pol
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.NTUser.pol
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.GroupPolicy_
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.SoftwareDistributionDatastore
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.SysvolSysvol
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.DHCP
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Dns
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.Wins
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.SysvolStaging
push eax
mov ecx, edi
call fcn.004a49ab
mov eax, dword [edi + 8]
push str.WATCHTOWER
push eax
mov ecx, edi
call fcn.004a49ab
call fcn.00499991
push eax
lea ecx, [esp + 0x2c]
call fcn.004727f7
push 0x12
lea esi, [esp + 0x2c]
mov byte [esp + 0x114], 0x95
call fcn.0040673d
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x4392bb
push eax
call ebx
test eax, eax
je 0x4392bb
mov eax, esi
push eax
push dword [edi + 8]
mov ecx, edi
call fcn.004a4959
push 0x13
lea esi, [esp + 0x2c]
call fcn.0040673d
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x4392e4
push eax
call ebx
test eax, eax
je 0x4392e4
mov eax, esi
push eax
push dword [edi + 8]
mov ecx, edi
call fcn.004a4959
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0xb0]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret