Function at 0x439b7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd2c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb34
push esi
push edi
xor eax, eax
mov al, byte [0x5d4514]
test eax, eax
je 0x439bac
jmp 0x43c13b
mov byte [0x5d4514], 1
mov byte [ebp - 0xa4], 0
xor ecx, ecx
mov cl, byte [0x62b750]
test ecx, ecx
je 0x439bd4
mov byte [ebp - 0xa4], 1
mov byte [0x62b750], 0
mov byte [ebp - 0x90], 0
mov byte [ebp - 0x9c], 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00439ab1
add esp, 0xc
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffff
jne 0x439c11
mov byte [0x5d4514], 0
jmp 0x43c13b
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 4
and ecx, 1
cmp ecx, 1
jne 0x439c38
mov byte [0x5d37c8], 1
jmp 0x439c3f
mov byte [0x5d37c8], 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.RtlLib.dll_RT_GetStatusLinkInfo]
add esp, 0x10
xor eax, eax
mov al, byte [0x5b836f]
test eax, eax
je 0x439e10
xor ecx, ecx
mov cl, byte [0x5d4005]
test ecx, ecx
jne 0x439e10
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x439e0e
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
cmp ecx, 1
jne 0x439e0e
mov dword [0x53c0dc], 0
mov byte [0x5d450c], 1
push 0x531304
call fcn.0040d6f5
add esp, 4
xor edx, edx
mov dl, byte [0x5d4379]
test edx, edx
je 0x439cf1
call dword [sym.imp.RtlLib.dll_RT_ACM_SoftAP_GetStatus]
cmp eax, 2
jne 0x439cf1
mov byte [ebp - 0x9c], 1
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x56]
push edx
call dword [sym.imp.RtlLib.dll_RT_Check_Switch_USB]
add esp, 4
and eax, 0xff
test eax, eax
jne 0x439daa
push str.RT_Check_Switch_USB_fail______
call fcn.0040d6f5
add esp, 4
call dword [sym.imp.RtlLib.dll_RT_IsUnplug]
and eax, 0xff
test eax, eax
je 0x439d76
push str.Check_HW_Reset__init_fail______
call fcn.0040d6f5
add esp, 4
mov byte [0x5d4514], 0
mov byte [0x5d450c], 0
mov byte [0x5d3fc5], 0
mov byte [0x5d4380], 0
mov byte [0x5d450a], 0
mov dword [0x53c0dc], 0x3c
jmp 0x43c13b
push str.RT_Check_Switch_USB______
call fcn.0040d6f5
add esp, 4
mov byte [0x5d3fc5], 1
push 0x53137c
push 0x531380
push 0x531388
call fcn.0042908d
add esp, 0xc
mov byte [0x5d450c], 0
jmp 0x439de3
push str.RT_Check_Switch_USB__Switch_USB_Mode_OK______
call fcn.0040d6f5
add esp, 4
mov byte [0x5d3fc5], 1
push 0x5313c8
push 0x5313cc
push 0x5313d4
call fcn.0042908d
add esp, 0xc
mov byte [0x5d450c], 0
mov byte [ebp - 0x90], 1
mov eax, dword [ebp - 0x9c]
and eax, 0xff
test eax, eax
je 0x439e0e
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlLib.dll_RT_ACM_SoftAP_GetStatus]
cmp eax, 2
je 0x439e0e
call dword [sym.imp.RtlLib.dll_RT_ACM_SoftAP_Start]
jmp 0x439e7d
cmp dword [0x5d3fc0], 0x6d
jge 0x439e44
call dword [sym.imp.RtlLib.dll_RT_Disassociate]
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 3
and eax, 1
push eax
call dword [sym.imp.RtlLib.dll_RT_SetNetworkType]
add esp, 4
jmp 0x439e67
cmp dword [0x5d400c], 2
je 0x439e56
cmp dword [0x5d400c], 3
jne 0x439e67
call dword [sym.imp.RtlLib.dll_RT_Disassociate]
push 1
call dword [sym.imp.RtlLib.dll_RT_SetNetworkType]
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
test edx, edx
jne 0x439e7d
call dword [sym.imp.RtlLib.dll_RT_ACM_Delete_AllProfiles]
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
test edx, edx
je 0x439ebb
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
cmp edx, 2
jbe 0x439f7d
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x439f7d
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x60]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetChannel]
add esp, 4
mov eax, dword [ebp - 0xa4]
and eax, 0xff
test eax, eax
je 0x439f46
xor ecx, ecx
mov cl, byte [0x5d37c8]
test ecx, ecx
je 0x439f46
mov edx, dword [ebp - 0x90]
and edx, 0xff
test edx, edx
jne 0x439f46
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov esi, dword [ebp + 8]
add esi, eax
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fdac
add esp, 0x440
jmp 0x439f71
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov esi, dword [ebp + 8]
add esi, ecx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fcb2
add esp, 0x440
mov byte [0x5d4514], 0
jmp 0x43c13b
cmp dword [0x5d400c], 2
je 0x439f93
cmp dword [0x5d400c], 3
jne 0x43a62e
push 0x440
mov edx, dword [ebp + 8]
push edx
push 0x5b7f08
call fcn.004930f0
add esp, 0xc
push 0x32
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x32]
push edx
push 0x5b7f08
call fcn.004930f0
add esp, 0xc
mov eax, dword [0x5b7f64]
and al, 0xf7
mov dword [0x5b7f64], eax
mov ecx, dword [0x5b7f64]
and ecx, 0xfffffff9
mov dword [0x5b7f64], ecx
mov edx, dword [0x5b7f64]
and edx, 0xfffffffe
mov dword [0x5b7f64], edx
mov eax, dword [0x5b7f64]
and ah, 0xf3
mov dword [0x5b7f64], eax
mov ecx, dword [0x5b7f64]
and ecx, 0xffffffef
mov dword [0x5b7f64], ecx
sub esp, 0x440
mov ecx, 0x110
mov esi, 0x5b7f08
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fd2f
add esp, 0x440
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xe0], 0
jmp 0x43a056
mov edx, dword [ebp - 0xe0]
add edx, 1
mov dword [ebp - 0xe0], edx
cmp dword [ebp - 0xe0], 0x1e
jge 0x43a104
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0xdc]
push edx
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.RtlLib.dll_RT_GetStatusLinkInfo]
add esp, 0x10
cmp dword [ebp - 0xe4], 2
jne 0x43a0a9
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43a104
cmp dword [ebp - 0xe0], 0x1e
jl 0x43a0ff
xor ecx, ecx
mov cl, byte [0x5d3fc5]
test ecx, ecx
je 0x43a0ff
cmp dword [ebp - 0xd0], 0
je 0x43a0ff
mov edx, dword [ebp - 0xd0]
sub edx, 1
mov dword [ebp - 0xd0], edx
sub esp, 0x440
mov ecx, 0x110
mov esi, 0x5b7f08
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fd2f
add esp, 0x440
mov dword [ebp - 0xe0], 0
jmp 0x43a047
push 0x5d4040
lea ecx, [ebp - 0xfc]
call fcn.004ad12e
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 0xb10]
push eax
lea ecx, [ebp - 0xfc]
call fcn.004a93ee
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp - 0xb30], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xb30]
push edx
lea ecx, [ebp - 0xfc]
call fcn.004ad1f9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb10]
call fcn.004ad0c0
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [0x5d3e24]
push ecx
push 0x5313e4
lea edx, [ebp - 0x20c]
push edx
call fcn.004936f0
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 6
push 0
lea edx, [ebp - 0x21c]
push edx
call fcn.00493430
add esp, 0xc
mov dword [ebp - 0x210], 6
mov dword [ebp - 0x100], 1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x100]
push edx
push 0
push 0x5313fc
mov eax, dword [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43a210
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004946da
add esp, 4
push eax
call dword [sym.imp.RtlLib.dll_RT_Set_Filter_Type]
add esp, 4
jmp 0x43a21b
push 0
call dword [sym.imp.RtlLib.dll_RT_Set_Filter_Type]
add esp, 4
mov edx, dword [ebp - 0x104]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
push eax
call fcn.00440335
add esp, 4
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x43a2ea
mov ecx, dword [ebp - 0x228]
imul ecx, ecx, 6
add ecx, 1
push ecx
call fcn.004ad692
add esp, 4
mov dword [ebp - 0xb14], eax
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x228]
imul eax, eax, 6
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.00493430
add esp, 0xc
mov edx, dword [ebp - 0x224]
push edx
call fcn.00440335
add esp, 4
mov dword [ebp - 0x228], eax
mov al, byte [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetFILTER_STA_ADDRESS]
add esp, 8
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0xb18], edx
mov eax, dword [ebp - 0xb18]
push eax
call fcn.004ad6bb
add esp, 4
mov dword [ebp - 0x224], 0
mov byte [ebp - 0x214], 0
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x214]
and edx, 0xff
add edx, 1
push edx
call fcn.00440017
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a329
mov al, byte [ebp - 0x214]
add al, 1
mov byte [ebp - 0x214], al
jmp 0x43a2f1
mov ecx, dword [ebp - 0x214]
and ecx, 0xff
test ecx, ecx
je 0x43a420
mov edx, dword [ebp - 0x214]
and edx, 0xff
imul edx, edx, 6
push edx
call fcn.004ad692
add esp, 4
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 1
jmp 0x43a38c
mov ecx, dword [ebp - 0x230]
add ecx, 1
mov dword [ebp - 0x230], ecx
mov edx, dword [ebp - 0x214]
and edx, 0xff
cmp dword [ebp - 0x230], edx
jg 0x43a3ee
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.00440017
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a3ec
push 6
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x234]
push eax
call fcn.004930f0
add esp, 0xc
mov ecx, dword [ebp - 0x234]
add ecx, 6
mov dword [ebp - 0x234], ecx
jmp 0x43a37d
mov dl, byte [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetLOCKED_STA_ADDRESS]
add esp, 8
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0xb20], ecx
mov edx, dword [ebp - 0xb20]
push edx
call fcn.004ad6bb
add esp, 4
mov dword [ebp - 0x220], 0xa
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xf8]
push ecx
push 1
push 0x53140c
push 0x531418
call fcn.00428f6d
add esp, 0x14
lea edx, [ebp - 0xf8]
push edx
call fcn.00493490
add esp, 4
test eax, eax
je 0x43a48d
lea eax, [ebp - 0xf8]
push eax
call fcn.004946da
add esp, 4
cmp eax, 1
jne 0x43a480
push 1
call dword [sym.imp.RtlLib.dll_RT_SetIsHidden_SSID]
add esp, 4
jmp 0x43a48b
push 0
call dword [sym.imp.RtlLib.dll_RT_SetIsHidden_SSID]
add esp, 4
jmp 0x43a498
push 0
call dword [sym.imp.RtlLib.dll_RT_SetIsHidden_SSID]
add esp, 4
mov byte [ebp - 0x214], 0
lea ecx, [ebp - 0xec]
push ecx
mov edx, dword [ebp - 0x214]
and edx, 0xff
add edx, 1
push edx
call fcn.00440155
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a4d7
mov al, byte [ebp - 0x214]
add al, 1
mov byte [ebp - 0x214], al
jmp 0x43a49f
mov ecx, dword [ebp - 0x214]
and ecx, 0xff
test ecx, ecx
je 0x43a5ce
mov edx, dword [ebp - 0x214]
and edx, 0xff
shl edx, 3
push edx
call fcn.004ad692
add esp, 4
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 1
jmp 0x43a53a
mov ecx, dword [ebp - 0x23c]
add ecx, 1
mov dword [ebp - 0x23c], ecx
mov edx, dword [ebp - 0x214]
and edx, 0xff
cmp dword [ebp - 0x23c], edx
jg 0x43a59c
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.00440155
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a59a
push 8
lea edx, [ebp - 0xec]
push edx
mov eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x240]
push eax
call fcn.004930f0
add esp, 0xc
mov ecx, dword [ebp - 0x240]
add ecx, 8
mov dword [ebp - 0x240], ecx
jmp 0x43a52b
mov dl, byte [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetDATA_RATE_STA]
add esp, 8
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0xb28], ecx
mov edx, dword [ebp - 0xb28]
push edx
call fcn.004ad6bb
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.004ad0c0
xor eax, eax
mov al, byte [0x5d4379]
test eax, eax
je 0x43a62e
xor ecx, ecx
mov cl, byte [0x5b8441]
test ecx, ecx
jne 0x43a62e
mov byte [0x5d37c8], 0
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov esi, dword [ebp + 8]
add esi, edx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043f6c6
add esp, 0x440
jmp 0x43c13b
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 4
and edx, 1
test edx, edx
je 0x43a66a
cmp dword [0x5d400c], 2
je 0x43a66a
cmp dword [0x5d400c], 3
je 0x43a66a
push 1
call dword [sym.imp.RtlLib.dll_RT_Set802_1xStatus]
add esp, 4
jmp 0x43a69e
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
and edx, 0xffffffef
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x5c], edx
push 0
call dword [sym.imp.RtlLib.dll_RT_Set802_1xStatus]
add esp, 4
mov edx, dword [0x530b6c]
mov dword [edx + 0x43c], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.RtlLib.dll_RT_GetStatusLinkInfo]
add esp, 0x10
cmp dword [0x5d400c], 2
je 0x43a70e
cmp dword [0x5d400c], 3
je 0x43a70e
mov dword [ebp - 0x244], 0x23c
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x480]
push edx
push 0x813bfe20
call dword [sym.imp.RtlLib.dll_RT_CustomRequest]
add esp, 0xc
call dword [sym.imp.RtlLib.dll_RT_REMOVE_PSK_CONX]
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x60]
cmp edx, 0x63
jne 0x43a748
cmp dword [0x5d400c], 2
je 0x43a73b
cmp dword [0x5d400c], 3
jne 0x43a746
push 1
call dword [sym.imp.RtlLib.dll_RT_SetAUTOChannel]
add esp, 4
jmp 0x43a785
cmp dword [0x5d400c], 2
je 0x43a75a
cmp dword [0x5d400c], 3
jne 0x43a765
push 0
call dword [sym.imp.RtlLib.dll_RT_SetAUTOChannel]
add esp, 4
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x60]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetChannel]
add esp, 4
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x56]
test edx, edx
jne 0x43a815
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x57]
test edx, edx
jne 0x43a815
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x58]
test edx, edx
jne 0x43a815
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x59]
test edx, edx
jne 0x43a815
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x5a]
test edx, edx
jne 0x43a815
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x5b]
test edx, edx
je 0x43a832
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x56]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetBSSID]
add esp, 4
call dword [sym.imp.RtlLib.dll_RT_GetPowerSaveMode]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetPowerSaveMode]
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_GetRates]
add esp, 0x14
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
xor eax, eax
cmp dword [ebp - 0xa0], 0
setne al
push eax
call dword [sym.imp.RtlLib.dll_RT_SetRates]
add esp, 0x14
call dword [sym.imp.RtlLib.dll_RT_GetPreambleMode]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetPreambleMode]
add esp, 4
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
and eax, 1
test eax, eax
jne 0x43a987
mov dword [0x530b68], 7
push 0x40
push 0
call dword [sym.imp.RtlLib.dll_RT_SetPrivacy]
add esp, 8
mov ecx, dword [0x530b6c]
mov dword [ecx + 4], 1
cmp dword [0x5d400c], 2
je 0x43a905
cmp dword [0x5d400c], 3
je 0x43a905
push 0
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x530b6c]
mov dword [edx], 0
jmp 0x43a946
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
push edx
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
mov eax, dword [0x530b6c]
mov dword [eax], edx
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43a95b
cmp dword [0x5d3fc0], 0x67
jne 0x43a982
push 0
push 0
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c02b
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 2
je 0x43ae01
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 3
je 0x43ae01
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 4
and ecx, 1
cmp ecx, 1
je 0x43ae01
mov edx, dword [0x530b6c]
mov dword [edx + 4], 0
mov dword [0x530b68], 0
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
test edx, edx
jne 0x43aa32
mov dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
add ecx, eax
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
xor esi, esi
mov si, word [eax + edx + 0x62]
xor edx, edx
mov dx, word [ecx + esi*2 + 0x64]
xor eax, eax
cmp edx, 0xa
setg al
dec eax
and al, 0xc0
add eax, 0x80
push eax
push 1
call dword [sym.imp.RtlLib.dll_RT_SetPrivacy]
add esp, 8
cmp dword [0x5d400c], 2
je 0x43aae8
cmp dword [0x5d400c], 3
je 0x43aae8
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 3
and eax, 1
neg eax
sbb eax, eax
and eax, dword [ebp - 0x48c]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 3
and eax, 1
neg eax
sbb eax, eax
and eax, dword [ebp - 0x48c]
mov ecx, dword [0x530b6c]
mov dword [ecx], eax
jmp 0x43ab2a
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
mov edx, dword [0x530b6c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x62]
mov eax, dword [0x530b6c]
mov dword [eax + 0x438], edx
mov ecx, dword [0x530b6c]
mov edx, dword [ecx + 0x438]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetDefaultKeyID]
add esp, 4
mov dword [ebp - 0x488], 0
jmp 0x43ab7c
mov eax, dword [ebp - 0x488]
add eax, 1
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 4
jge 0x43abf4
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
add edx, ecx
mov eax, dword [ebp - 0x488]
mov ecx, dword [0x530b6c]
mov esi, dword [ebp - 0x488]
mov dx, word [edx + esi*2 + 0x64]
mov word [ecx + eax*2 + 8], dx
push 0x10
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
add ecx, eax
mov edx, dword [ebp - 0x488]
shl edx, 4
lea eax, [ecx + edx + 0x6c]
push eax
mov ecx, dword [ebp - 0x488]
shl ecx, 4
mov edx, dword [0x530b6c]
lea eax, [edx + ecx + 0x10]
push eax
call fcn.004930f0
add esp, 0xc
jmp 0x43ab6d
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x6c]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x64]
push eax
push 0
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x7c]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x66]
push eax
push 1
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x8c]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x68]
push eax
push 2
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x9c]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x6a]
push eax
push 3
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [0x530b6c]
mov edx, dword [ecx + 0x438]
shl edx, 4
mov eax, dword [0x530b6c]
lea ecx, [eax + edx + 0x10]
push ecx
mov edx, dword [0x530b6c]
mov eax, dword [edx + 0x438]
mov ecx, dword [0x530b6c]
xor edx, edx
mov dx, word [ecx + eax*2 + 8]
push edx
mov eax, dword [0x530b6c]
mov ecx, dword [eax + 0x438]
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov edx, dword [0x530b6c]
mov eax, dword [edx + 0x438]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetDefaultKeyID]
add esp, 4
call dword [sym.imp.RtlLib.dll_RT_GetDefaultEncryptionAlgorithm]
add eax, 1
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0xb34], ecx
cmp dword [ebp - 0xb34], 3
ja case.default.0x43ad5a
mov edx, dword [ebp - 0xb34]
jmp dword [edx*4 + 0x43c14b]
mov eax, dword [0x530b6c]
mov dword [eax + 4], 1
jmp case.default.0x43ad5a
mov ecx, dword [0x530b6c]
mov dword [ecx + 4], 0
jmp case.default.0x43ad5a
mov edx, dword [0x530b6c]
mov dword [edx + 4], 4
jmp case.default.0x43ad5a
mov eax, dword [0x530b6c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43adae
cmp dword [0x5d3fc0], 0x67
jne 0x43adfc
mov edx, dword [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
neg edx
sbb edx, edx
and edx, dword [ebp - 0x48c]
push edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c02b
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 4
and edx, 1
cmp edx, 1
jne 0x43b9ce
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 5
and edx, 7
test edx, edx
jne 0x43b242
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43ae84
mov eax, dword [0x530b6c]
mov dword [eax], 8
push 8
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x530b68], 4
jmp 0x43aea5
mov ecx, dword [0x530b6c]
mov dword [ecx], 9
push 9
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x530b68], 6
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
mov dword [ebp - 0xb38], ecx
cmp dword [ebp - 0xb38], 3
ja case.default.0x43aed7
mov edx, dword [ebp - 0xb38]
jmp dword [edx*4 + 0x43c15b]
mov dword [ebp - 0x490], 1
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b16d
mov dword [ebp - 0x490], 2
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b16d
mov dword [ebp - 0x490], 3
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b16d
mov dword [ebp - 0x490], 4
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b16d
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 4
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x3e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
push edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
push edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_tunnle]
add esp, 0xc
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
cmp edx, 4
jne 0x43b14b
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
add edx, 5
mov dword [ebp - 0x490], edx
jmp 0x43b16d
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
add edx, 0xa
mov dword [ebp - 0x490], edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b1e5
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43b1b7
cmp dword [0x5d3fc0], 0x67
jne 0x43b1e3
mov edx, dword [ebp - 0x490]
push edx
push 6
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43b23d
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43b211
cmp dword [0x5d3fc0], 0x67
jne 0x43b23d
mov edx, dword [ebp - 0x490]
push edx
push 7
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43b9c9
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 1
jne 0x43b662
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b2a4
mov eax, dword [0x530b6c]
mov dword [eax], 0xa
push 0xa
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x530b68], 4
jmp 0x43b2c5
mov ecx, dword [0x530b6c]
mov dword [ecx], 0xb
push 0xb
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x530b68], 6
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
mov dword [ebp - 0xb3c], ecx
cmp dword [ebp - 0xb3c], 3
ja case.default.0x43b2f7
mov edx, dword [ebp - 0xb3c]
jmp dword [edx*4 + 0x43c16b]
mov dword [ebp - 0x494], 1
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b58d
mov dword [ebp - 0x494], 2
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b58d
mov dword [ebp - 0x494], 3
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b58d
mov dword [ebp - 0x494], 4
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b58d
push 2
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 4
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x3e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
push edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
push edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_tunnle]
add esp, 0xc
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
cmp edx, 4
jne 0x43b56b
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
add edx, 5
mov dword [ebp - 0x494], edx
jmp 0x43b58d
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
add edx, 0xa
mov dword [ebp - 0x494], edx
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b605
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43b5d7
cmp dword [0x5d3fc0], 0x67
jne 0x43b603
mov edx, dword [ebp - 0x494]
push edx
push 8
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43b65d
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43b631
cmp dword [0x5d3fc0], 0x67
jne 0x43b65d
mov edx, dword [ebp - 0x494]
push edx
push 9
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43b9c9
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 2
jne 0x43b9c9
mov dword [0x530b68], 0
mov eax, dword [0x530b6c]
mov dword [eax], 0xc
push 0xc
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0xb40], eax
cmp dword [ebp - 0xb40], 3
ja case.default.0x43b6d6
mov ecx, dword [ebp - 0xb40]
jmp dword [ecx*4 + 0x43c17b]
mov dword [ebp - 0x498], 1
push 2
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b96c
mov dword [ebp - 0x498], 2
push 2
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b96c
mov dword [ebp - 0x498], 3
push 2
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x276]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b96c
mov dword [ebp - 0x498], 4
push 2
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b96c
push 2
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x276]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 4
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x3e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x14
and ecx, 0xf
push ecx
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x10
and ecx, 0xf
push ecx
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_tunnle]
add esp, 0xc
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
cmp ecx, 4
jne 0x43b94a
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x10
and ecx, 0xf
add ecx, 5
mov dword [ebp - 0x498], ecx
jmp 0x43b96c
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x14
and ecx, 0xf
add ecx, 0xa
mov dword [ebp - 0x498], ecx
mov edx, dword [0x530b6c]
mov dword [edx + 4], 0
mov eax, dword [0x530b6c]
mov dword [eax + 0x43c], 1
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43b99d
cmp dword [0x5d3fc0], 0x67
jne 0x43b9c9
mov edx, dword [ebp - 0x498]
push edx
push 0xa
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c02b
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x32]
push edx
call fcn.00493490
add esp, 4
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x32]
push eax
lea ecx, [ebp - 0x6d4]
push ecx
call fcn.004930f0
add esp, 0xc
mov edx, dword [ebp - 0x4a0]
mov dword [ebp - 0x6d8], edx
push 6
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x56]
push edx
lea eax, [ebp - 0x6b0]
push eax
call fcn.004930f0
add esp, 0xc
push 0x20
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x1c0]
push eax
lea ecx, [ebp - 0x6a4]
push ecx
call fcn.004930f0
add esp, 0xc
mov dword [ebp - 0x6dc], 0
mov dword [ebp - 0x6a8], 0x20
mov dword [ebp - 0x49c], 0x23c
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
test ecx, ecx
je 0x43be38
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 2
jne 0x43bbe7
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 2
jne 0x43bb67
mov dword [0x530b68], 4
push 3
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x530b6c]
mov dword [edx], 3
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43bb3e
cmp dword [0x5d3fc0], 0x67
jne 0x43bb65
push 2
push 3
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43bbdb
mov dword [0x530b68], 6
push 6
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x530b6c]
mov dword [edx], 6
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43bbb4
cmp dword [0x5d3fc0], 0x67
jne 0x43bbdb
push 4
push 5
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
mov byte [ebp - 0x4a2], 0
jmp 0x43bcf6
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 3
jne 0x43bc7b
mov dword [0x530b68], 6
push 4
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x530b6c]
mov dword [edx], 4
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43bc52
cmp dword [0x5d3fc0], 0x67
jne 0x43bc79
push 3
push 4
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43bcef
mov dword [0x530b68], 4
push 7
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x530b6c]
mov dword [edx], 7
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43bcc8
cmp dword [0x5d3fc0], 0x67
jne 0x43bcef
push 5
push 5
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
mov byte [ebp - 0x4a2], 1
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x43bda3
lea edx, [ebp - 0x49c]
push edx
lea eax, [ebp - 0x6dc]
push eax
push 0x813bfe1c
call dword [sym.imp.RtlLib.dll_RT_CustomRequest]
add esp, 0xc
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43bd3a
cmp dword [0x5d3fc0], 0x67
jne 0x43bd9e
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
cmp dword [eax + edx + 0x1bc], 0x3f
ja 0x43bd8c
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x1bc]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0xbc]
push eax
call dword [sym.imp.RtlLib.dll_RT_ADD_PSK_CONX]
add esp, 8
jmp 0x43bd9e
push 0x20
lea ecx, [ebp - 0x6a4]
push ecx
call dword [sym.imp.RtlLib.dll_RT_ADD_PMK_CONX]
add esp, 8
jmp 0x43be33
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
cmp dword [eax + edx + 0x1bc], 0x40
je 0x43bdf5
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x1bc]
push eax
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0xbc]
push eax
call dword [sym.imp.RtlLib.dll_RT_AP_SetPassphrase]
add esp, 8
jmp 0x43be33
push 0
push 0x20
lea ecx, [ebp - 0x6fc]
push ecx
push 0x40
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0xbc]
push ecx
call fcn.0042f747
add esp, 0x14
push 0x40
lea edx, [ebp - 0x6fc]
push edx
call dword [sym.imp.RtlLib.dll_RT_AP_SetPassphrase]
add esp, 8
jmp 0x43c02b
mov byte [ebp - 0xb08], 0xff
mov byte [ebp - 0xb07], 0xff
mov byte [ebp - 0xb06], 0xff
mov byte [ebp - 0xb05], 0xff
mov byte [ebp - 0xb04], 0xff
mov byte [ebp - 0xb03], 0xff
mov eax, dword [0x530b6c]
add eax, 0x50
mov dword [ebp - 0xb00], eax
push 6
lea ecx, [ebp - 0xb08]
push ecx
mov edx, dword [ebp - 0xb00]
add edx, 0xc
push edx
call fcn.004930f0
add esp, 0xc
mov eax, dword [ebp - 0xb00]
mov dword [eax + 4], 0
mov dword [ebp - 0xb0c], 0x20
mov ecx, dword [ebp - 0xb0c]
push ecx
lea edx, [ebp - 0x6a4]
push edx
mov eax, dword [ebp - 0xb00]
add eax, 0x20
push eax
call fcn.004930f0
add esp, 0xc
mov ecx, dword [ebp - 0xb00]
mov edx, dword [ebp - 0xb0c]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xb00]
mov ecx, dword [eax + 8]
add ecx, 0x27
mov edx, dword [ebp - 0xb00]
mov dword [edx], ecx
push 5
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov eax, dword [0x530b6c]
mov dword [eax], 5
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 2
jne 0x43bf6e
mov dword [0x530b68], 4
mov ecx, dword [0x530b6c]
mov dword [ecx + 4], 4
xor edx, edx
mov dl, byte [0x53c0d5]
test edx, edx
jne 0x43bf45
cmp dword [0x5d3fc0], 0x67
jne 0x43bf6c
push 2
push 5
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43bfde
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 3
jne 0x43bfde
mov dword [0x530b68], 6
mov eax, dword [0x530b6c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x53c0d5]
test ecx, ecx
jne 0x43bfb7
cmp dword [0x5d3fc0], 0x67
jne 0x43bfde
push 3
push 5
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
push 0x400
push 0
lea edx, [ebp - 0xafc]
push edx
call fcn.00493430
add esp, 0xc
push 0x3e8
mov eax, dword [0x530b6c]
add eax, 0x50
push eax
lea ecx, [ebp - 0xaf4]
push ecx
call fcn.004930f0
add esp, 0xc
push 0x3e8
lea edx, [ebp - 0xafc]
push edx
push 0xd01011d
call dword [sym.imp.RtlLib.dll_RT_SetOID]
add esp, 0xc
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 4
and edx, 1
cmp edx, 1
jne 0x43c052
mov byte [0x5d37c8], 1
jmp 0x43c059
mov byte [0x5d37c8], 0
mov dword [ebp - 0x8c], 0x32
xor eax, eax
mov al, byte [0x5d3c38]
test eax, eax
je 0x43c090
cmp dword [ebp - 0x8c], 0
je 0x43c090
mov ecx, dword [ebp - 0x8c]
sub ecx, 1
mov dword [ebp - 0x8c], ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43c063
cmp dword [0x5d400c], 2
je 0x43c117
cmp dword [0x5d400c], 3
je 0x43c117
mov edx, dword [ebp - 0xa4]
and edx, 0xff
test edx, edx
je 0x43c0ea
xor eax, eax
mov al, byte [0x5d37c8]
test eax, eax
je 0x43c0ea
mov ecx, dword [ebp - 0x98]
imul ecx, ecx, 0x440
mov esi, dword [ebp + 8]
add esi, ecx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fdac
add esp, 0x440
jmp 0x43c115
mov edx, dword [ebp - 0x98]
imul edx, edx, 0x440
mov esi, dword [ebp + 8]
add esi, edx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fcb2
add esp, 0x440
jmp 0x43c134
mov eax, dword [ebp - 0x98]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x32]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetSSID]
add esp, 4
mov byte [0x5d4514], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret