Function at 0x407e49
Capabilities:
Copy file
Get common file path
Initialize winsock library
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4286b4
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x435280]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push esi
push edi
mov eax, dword [0x435280]
xor eax, esp
push eax
lea eax, [esp + 0x840]
mov dword fs:[0], eax
xor edx, edx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [esp + 0x72c]
xor eax, eax
mov dword [esp + 0x48], ebx
inc eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], eax
mov eax, edx
mov dword [esp + 0x54], edx
mov dword [esp + 0x90], edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x94], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0xb8], edx
mov dword [esp + 0x64], edx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0xa0], edx
mov dword [esp + 0x6c], edx
mov dword [esp + 0xa4], edx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x9c], edx
mov dword [esp + 0x78], edx
mov dword [esp + 0x74], edx
mov dword [esp + 0xc0], edx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc8], edx
mov dword [esp + 0x98], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0xb4], edx
mov dword [esp + 0xa8], edx
mov dword [esp + 0x70], edx
mov dword [esp + 0x88], edx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xc4], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x28], edx
call fcn.00407bad
lea eax, [esp + 0x72c]
push eax
push str.Current_date_and_time:__s_n
call fcn.00401d4f
add esp, 8
lea ecx, [esp + 0x2ec]
call fcn.00403f37
xor eax, eax
push ecx
lea ecx, [esp + 0x2f0]
mov dword [esp + 0x84c], eax
call fcn.00403e3f
or dword [esp + 0x848], 0xffffffff
lea ecx, [esp + 0x2ec]
call fcn.004044a1
xor eax, eax
mov byte [esp + 0x414], al
inc eax
mov esi, eax
cmp ebx, eax
jle 0x407fef
push dword [edi + esi*4]
lea ecx, [esp + 0x418]
call fcn.00406823
inc esi
cmp esi, ebx
je 0x407fe5
push 0x42f4a8
lea ecx, [esp + 0x418]
call fcn.00406823
cmp esi, ebx
jl 0x407fbc
cmp byte [esp + 0x414], 0
jne 0x408000
push str.no_parameters
lea ecx, [esp + 0x418]
call fcn.00406823
lea eax, [esp + 0x414]
push eax
push str.Parameters_to_parse_are:__s_n
call fcn.00401d4f
add esp, 8
lea eax, [esp + 0x51c]
mov esi, 0x104
push esi
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x51c]
push eax
push str.Process_full_path:__s_n
call fcn.00401d4f
add esp, 8
lea eax, [esp + 0x624]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x624]
push eax
push str.Current_directory_is:__s_n
call fcn.00401d4f
add esp, 8
call fcn.0040fd03
mov ebx, eax
push 0x430e58
mov dword [esp + 0x64], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4080b7
push str.GetSystemWow64DirectoryA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40809e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ecx, ecx
mov al, cl
jmp 0x4080b7
push esi
lea ecx, [esp + 0x310]
push ecx
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
setg al
mov byte [0x437440], al
mov dword [0x43743c], ebx
call fcn.0040fe19
push eax
push str.OS:__s
call fcn.00401d4f
add esp, 8
call fcn.0040ff3d
test al, al
jne 0x4080e3
call fcn.0040ffad
xor eax, eax
mov ecx, ebx
mov byte [esp + 0x26], al
call fcn.004069d5
xor ebx, ebx
mov byte [esp + 0x3b], al
test al, al
je 0x40815d
lea eax, [esp + 0x58]
mov dword [esp + 0x58], ebx
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40811c
mov byte [esp + 0x26], bl
jmp 0x40815d
lea eax, [esp + 0x84]
mov dword [esp + 0x84], ebx
push eax
push 4
lea eax, [esp + 0x38]
push eax
push 0x14
push dword [esp + 0x68]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [esp + 0x58]
test eax, eax
jne 0x40814e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408116
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebx
setne byte [esp + 0x26]
lea eax, [esp + 0xac]
mov ecx, 0x436324
push eax
call fcn.00402f8d
xor esi, esi
lea ecx, [esp + 0x12c]
inc esi
mov dword [esp + 0x848], esi
push dword [eax]
call fcn.004047b1
push 3
pop eax
mov byte [esp + 0x848], al
mov ecx, dword [esp + 0xac]
lea ecx, [ecx - 0x10]
call fcn.004014f8
cmp dword [esp + 0x13c], 0
je 0x4081cf
cmp dword [esp + 0x140], 0x10
lea eax, [esp + 0x12c]
cmovae eax, dword [esp + 0x12c]
push eax
push 0x42f9b4
call fcn.00401d4f
add esp, 8
cmp dword [esp + 0x48], esi
jle 0x408204
mov esi, dword [esp + 0x20]
push 0x42f9b8
push dword [esi + 4]
call fcn.00412591
pop ecx
pop ecx
test eax, eax
je 0x4081ff
push 0x42f9bc
push dword [esi + 4]
call fcn.00412591
pop ecx
pop ecx
test eax, eax
jne 0x408204
xor eax, eax
lea ebx, [eax + 1]
lea eax, [esp + 0x15c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x408307
test bl, bl
jne 0x408307
mov esi, str.RegisterLSP.exe
lea edi, [esp + 0xe4]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
lea ebx, [ecx + 1]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xe4]
push eax
push str.For_extended_help__type:__s__e_n
call fcn.00401d4f
push eax
push eax
push eax
push eax
push str._nMost_common_options_are:_n________p___________Print_all_layers_and_their_catalog_IDs_n________f___________Remove_all_layered_entries_n________r_CatId_____Remove_LSP_n________b___________Auto_install_over_TCP_UDP_providers_and_do_error_checking_n____________________will_copy_LSP_to_system32_directory_and_will_also_update_the_LSP_is_an_older_version_is_already_installed_n________bi__________Just_like__b__but_LSP_is_an_IFS_LSP_and_have_to_assume__j_flag_n________d___________Full_path_and_filename_of_LSP_DLL_to_install_n_n_nExamples:_n_nDisplay_all_LSPs_install_on_the_machine:__s__p_n_nRemove_all_layered_LSPs__leaving_only_base_OS_providers_:__s__f_n_nAuto_install_an_LSP_named_nonifslsp.dll_and_located_in_c:_:__s__b__d_c:_nonifslsp.dll_n_nAuto_install_an_IFS_LSP_named_ifslsp.dll_and_located_in_c:_:__s__bi__d_c:ifslsp.dll_n_n
call fcn.00401d4f
add esp, 0x1c
mov eax, dword [esp + 0x44]
test eax, eax
je 0x408270
mov ecx, eax
call fcn.0040124d
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40827f
mov ecx, eax
call fcn.0040124d
mov eax, dword [esp + 0x90]
test eax, eax
je 0x408298
mov edx, dword [esp + 0x94]
mov ecx, eax
call fcn.0040db30
mov eax, dword [0x437438]
test eax, eax
je 0x4082a8
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x437400]
test eax, eax
je 0x4082bf
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
mov dword [0x437400], eax
push 0x437404
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
lea ecx, [esp + 0x12c]
push eax
inc eax
push eax
call fcn.004048e6
mov eax, ebx
mov ecx, dword [esp + 0x840]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.00410875
mov esp, ebp
pop ebp
ret
xor eax, eax
push eax
push 0x1f400
push eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [0x437400], eax
mov ecx, 0x277a
cmove edi, ecx
push 0x437404
mov dword [esp + 0x88], edi
mov dword [esp + 0x5c], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [esp + 0x20]
xor ecx, ecx
inc ecx
mov esi, ecx
push 2
pop eax
cmp dword [esp + 0x48], ecx
jle 0x4083ad
mov edi, dword [esp + 0x40]
push eax
push 0x42f9c0
push dword [ebx + esi*4]
call fcn.00412670
add esp, 0xc
test eax, eax
jne 0x408367
inc edi
inc esi
push 2
pop eax
cmp esi, dword [esp + 0x48]
jl 0x408351
test edi, edi
mov edi, dword [esp + 0x84]
je 0x4083ad
push 0x28
push 8
push dword [0x437400]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov eax, 0x2747
test edx, edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x80], edx
cmove edi, eax
mov dword [esp + 0x58], edi
je case.0x40847e.107
xor edx, edx
xor esi, esi
xor eax, eax
inc esi
inc eax
mov edi, edx
mov cl, dl
mov dword [esp + 0x30], edi
mov byte [esp + 0x17], cl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x40], eax
cmp dword [esp + 0x48], esi
jle 0x40891b
test cl, cl
jne 0x4088ee
lea ebx, [ebx + eax*4]
mov eax, dword [ebx]
mov dword [esp + 0x84], ebx
movsx eax, byte [eax + 1]
push eax
call fcn.00412ab3
pop ecx
cmp eax, 0x67
jne 0x4083fe
mov esi, dword [ebx]
cmp byte [esi], 0
jne 0x408438
mov esi, dword [ebx]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408405
push 2
sub ecx, edx
pop eax
cmp ecx, eax
je 0x408438
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40841a
push 3
sub ecx, edx
pop eax
cmp ecx, eax
je 0x408438
mov al, byte [esi]
cmp al, 0x2d
je 0x408438
cmp al, 0x2f
jne case.0x40847e.107
mov ecx, esi
xor eax, eax
mov bl, al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408441
push 3
sub ecx, edx
pop eax
cmp ecx, eax
jne 0x40845e
movsx eax, byte [esi + 2]
push eax
call fcn.00412ab3
pop ecx
mov bl, al
mov esi, dword [esp + 0x84]
mov eax, dword [esi]
movsx eax, byte [eax + 1]
push eax
call fcn.00412ab3
add eax, 0xffffff9f
pop ecx
cmp eax, 0x19
ja case.0x40847e.107
jmp dword [eax*4 + 0x409f59]
xor eax, eax
inc eax
mov dword [esp + 0xb0], eax
jmp 0x4088cd
xor eax, eax
inc eax
mov dword [esp + 0x2c], eax
jmp 0x4088cd
xor eax, eax
inc eax
mov dword [esp + 0x4c], eax
jmp 0x4088cd
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x48]
jge case.0x40847e.107
mov eax, dword [esi + 4]
movsx eax, byte [eax]
push eax
call fcn.00412ab3
pop ecx
cmp eax, 0x33
je 0x4084e8
cmp eax, 0x36
je 0x4084e3
cmp eax, 0x62
jne case.0x40847e.107
xor eax, eax
jmp 0x4084eb
push 2
pop eax
jmp 0x4084eb
xor eax, eax
inc eax
mov dword [0x436310], eax
jmp 0x4088cd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
inc eax
cmp eax, ecx
jge case.0x40847e.107
mov ebx, dword [esp + 0x20]
mov edx, ecx
mov dword [esp + 0x40], eax
mov ecx, ebx
lea eax, [esp + 0x40]
push eax
call fcn.004078a1
pop ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x40]
jmp 0x4088d5
call fcn.00406ca8
mov dword [esp + 0x34], eax
jmp 0x4088cd
test bl, bl
jne 0x408998
xor eax, eax
inc eax
xor edx, edx
mov dword [esp + 0x9c], eax
mov dword [esp + 0x78], edx
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
jmp 0x4088d7
xor edx, edx
xor eax, eax
inc eax
mov dword [esp + 0x9c], edx
mov dword [esp + 0x78], eax
jmp 0x408550
xor eax, eax
inc eax
mov dword [esp + 0xb4], eax
jmp 0x4088cd
test bl, bl
je 0x4085ca
cmp bl, 0x69
je 0x4085ca
cmp bl, 0x72
jne case.0x40847e.107
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
inc eax
cmp eax, ecx
jge case.0x40847e.107
mov ebx, dword [esp + 0x20]
mov edx, ecx
mov dword [esp + 0x40], eax
mov ecx, ebx
lea eax, [esp + 0x40]
push eax
call fcn.004078a1
mov dword [esp + 0x38], eax
xor eax, eax
inc eax
mov dword [esp + 0xc0], eax
jmp 0x4087a9
mov cl, byte [esp + 0x17]
xor eax, eax
inc eax
xor edx, edx
cmp bl, 0x69
mov dword [esp + 0x74], eax
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x64], eax
mov dword [esp + 0x98], eax
jne 0x4085ef
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x1c]
jmp 0x4088db
xor eax, eax
inc eax
mov dword [esp + 0xc0], eax
jmp 0x4088cd
xor eax, eax
inc eax
xor edx, edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x98], edx
jmp 0x408550
xor eax, eax
inc eax
mov dword [esp + 0x5c], eax
jmp 0x4088cd
xor eax, eax
inc eax
mov dword [esp + 0x64], eax
jmp 0x4088cd
xor eax, eax
inc eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0xa0], eax
cmp bl, 0x72
jne 0x4088cd
mov dword [esp + 0xc4], eax
jmp 0x4088cd
xor eax, eax
inc eax
xor edx, edx
mov dword [esp + 0xa4], eax
mov dword [esp + 0x64], edx
jmp 0x408550
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x48]
jge case.0x40847e.107
mov ebx, dword [esp + 0x20]
push dword [ebx + eax*4]
call fcn.00412953
pop ecx
mov ecx, dword [esp + 0x44]
mov dword [ecx + edi*4], eax
inc edi
mov dword [esp + 0x30], edi
jmp 0x4088d1
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x40]
mov edx, dword [esp + 0x48]
mov ecx, ebx
push eax
call fcn.00406acb
pop ecx
mov ecx, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
inc eax
cmp eax, dword [esp + 0x48]
jge case.0x40847e.107
test ecx, ecx
je 0x4087ff
mov eax, dword [esp + 0x44]
mov dword [eax + edi*4], ecx
jmp 0x40869a
test bl, bl
jne 0x4086f8
xor eax, eax
inc eax
xor edx, edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0xa0], edx
jmp 0x408550
cmp bl, 0x74
jne 0x408713
xor eax, eax
inc eax
mov dword [esp + 0x88], eax
mov dword [esp + 0xa8], eax
jmp 0x4088cd
cmp bl, 0x75
jne case.0x40847e.114
xor eax, eax
inc eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x70], eax
jmp 0x4088cd
test bl, bl
jne 0x40876b
xor eax, eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x48]
jge case.0x40847e.107
mov ebx, dword [esp + 0x20]
push dword [ebx + eax*4]
call fcn.0041295c
mov dword [esp + 0xbc], eax
xor eax, eax
inc eax
pop ecx
mov dword [esp + 0x98], eax
jmp 0x4088d1
cmp bl, 0x72
jne case.0x40847e.107
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
inc eax
cmp eax, ecx
jge case.0x40847e.107
mov ebx, dword [esp + 0x20]
mov edx, ecx
mov dword [esp + 0x40], eax
mov ecx, ebx
lea eax, [esp + 0x40]
push eax
call fcn.004078a1
mov dword [esp + 0x38], eax
xor eax, eax
inc eax
mov dword [esp + 0xcc], eax
pop ecx
mov cl, al
xor edx, edx
mov eax, dword [esp + 0x40]
mov byte [esp + 0x17], cl
jmp 0x4088db
mov ecx, dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, ecx
jge case.0x40847e.107
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x40]
mov edx, ecx
mov ecx, ebx
push eax
call fcn.00406acb
mov edx, eax
xor eax, eax
mov dword [esp + 0xbc], edx
mov dword [esp + 0x9c], eax
pop ecx
test edx, edx
jne 0x408521
push 2
pop eax
mov ebx, eax
jmp 0x409f11
xor eax, eax
inc eax
mov dword [esp + 0x6c], eax
jmp 0x4088cd
mov esi, dword [esi]
mov ecx, esi
push 2
pop ebx
mov edi, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408821
sub ecx, edx
cmp ecx, ebx
jbe 0x4088c9
mov ebx, dword [esp + 0x84]
movsx eax, byte [esi + edi]
push eax
call fcn.00412ab3
pop ecx
cmp eax, 0x6c
jg 0x40887f
je 0x4088a8
sub eax, 0x63
je 0x408878
push 2
pop ecx
sub eax, ecx
je 0x40886f
dec eax
je 0x408868
push 3
pop ecx
sub eax, ecx
jne 0x4088b0
or dword [esp + 0x28], 0x10
jmp 0x4088b0
or dword [esp + 0x28], 8
jmp 0x4088b0
xor eax, eax
inc eax
or dword [esp + 0x28], eax
jmp 0x4088b0
or dword [esp + 0x28], 0x40
jmp 0x4088b0
sub eax, 0x6f
je 0x4088a8
dec eax
je 0x4088a1
push 2
pop ecx
sub eax, ecx
je 0x40889b
dec eax
jne 0x4088b0
or dword [esp + 0x28], 0x80000000
jmp 0x4088b0
or dword [esp + 0x28], ecx
jmp 0x4088b0
or dword [esp + 0x28], 4
jmp 0x4088b0
or dword [esp + 0x28], 0x80
mov esi, dword [ebx]
inc edi
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4088b8
sub ecx, edx
cmp edi, ecx
jb 0x408839
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov cl, byte [esp + 0x17]
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x48]
jl 0x4083d3
cmp dword [esp + 0x78], 0
jne 0x4088ff
cmp dword [esp + 0x9c], 0
je 0x408903
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0xc0]
xor edx, edx
mov eax, dword [0x437850]
test ecx, ecx
cmovne eax, edx
mov dword [0x437850], eax
cmp byte [esp + 0x3b], 0
je 0x40893e
cmp dword [esp + 0x98], 0
je 0x40893e
cmp byte [esp + 0x26], 0
jne 0x40893e
cmp dword [esp + 0x74], 0
je case.0x40847e.107
push 2
pop esi
cmp dword [0x436310], esi
je case.0x40847e.107
call fcn.0040fade
xor ecx, ecx
mov dword [0x437438], eax
inc ecx
cmp dword [esp + 0x3c], ecx
jne 0x408a02
xor eax, eax
mov dword [esp + 0x3c], eax
mov eax, dword [0x436310]
test eax, eax
je 0x408977
cmp eax, ecx
jne 0x4089c1
mov edi, dword [esp + 0x6c]
lea eax, [esp + 0x3c]
mov esi, dword [esp + 0xa0]
mov edx, esi
push eax
push edi
call fcn.0040d23d
mov eax, dword [0x436310]
pop ecx
pop ecx
jmp 0x4089cc
cmp bl, 0x77
jne 0x4089a6
xor eax, eax
mov ebx, eax
jmp 0x409eff
cmp bl, 0x63
jne case.0x40847e.107
call fcn.00407a85
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
jmp 0x409eff
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0x6c]
test eax, eax
je 0x4089d7
push 2
pop ecx
cmp eax, ecx
jne 0x4089eb
lea eax, [esp + 0x3c]
mov edx, esi
push eax
push edi
push 2
pop eax
mov ecx, eax
call fcn.0040d23d
pop ecx
pop ecx
cmp dword [esp + 0xc4], 0
je 0x409efb
mov ebx, dword [esp + 0x3c]
jmp 0x409eff
cmp dword [esp + 0xbc], ecx
jne 0x408ad4
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x114]
push ebx
call fcn.004047b1
push str.SYSTEMCurrentControlSetServicesWinSock2
lea ecx, [esp + 0xe8]
mov byte [esp + 0x84c], 4
call fcn.004047b1
push str.HKLM
lea ecx, [esp + 0xd0]
mov byte [esp + 0x84c], 5
call fcn.004047b1
lea eax, [esp + 0x114]
push eax
lea edx, [esp + 0xe8]
lea ecx, [esp + 0xd0]
call fcn.00410496
pop ecx
mov esi, eax
lea ecx, [esp + 0xcc]
xor eax, eax
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0xe4]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0x114]
push eax
inc eax
push eax
call fcn.004048e6
test esi, esi
jne 0x408ac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Failed_to_backup_registry_to_file__s_with_error_code:__i_n
call fcn.00401d4f
add esp, 0xc
jmp 0x409efb
push ebx
push str.Backuped_registry_to_file__s_successfuly_n
call fcn.00401d4f
add esp, 8
jmp 0x409efb
cmp dword [esp + 0xc8], ecx
jne 0x408b1d
mov ebx, dword [esp + 0x34]
mov ecx, ebx
call fcn.00410458
test eax, eax
jne 0x408af9
push ebx
push str.File__s_doesnt_exists__registry_will_not_be_restored__n
call fcn.00401d4f
jmp 0x408acc
push ecx
push ebx
call fcn.00407a0d
pop ecx
pop ecx
test eax, eax
jne 0x408b15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Failed_to_restore_registry_to_file__s_with_error_code:__i_n
jmp 0x408ab4
push ebx
push str.Restored_registry_from_file__s_successfuly_n
jmp 0x408ac7
cmp dword [esp + 0x64], ecx
jne 0x409aeb
mov ebx, dword [esp + 0x34]
test ebx, ebx
je case.0x40847e.107
push ebx
push str.Checking_if_LSP:__s_exists_n
call fcn.00401d4f
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4089b8
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x436310]
lea edx, [esp + 0xe4]
mov ecx, ebx
call fcn.0040fa51
test eax, eax
je 0x408b7d
mov eax, dword [esp + 0x74]
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x3c], ebx
jmp 0x408ba3
lea edx, [esp + 0xe4]
mov ecx, esi
call fcn.0040e10b
mov ebx, eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], ebx
test ebx, ebx
je 0x408ba1
test eax, eax
je 0x4089b8
xor ecx, ecx
xor edx, edx
inc edx
cmp dword [esp + 0x4c], edx
jne 0x408c7a
test eax, eax
jne 0x408c85
test edi, edi
jne 0x4089b8
mov ecx, dword [0x436310]
lea edx, [esp + 0x7c]
call fcn.004011a0
mov dword [esp + 0x54], eax
test eax, eax
jne 0x408bef
mov esi, dword [esp + 0x20]
push dword [esi]
push str._s:_EnumerateProviders:_Unable_to_enumerate_Winsock_catalog_n
call fcn.00401d4f
add esp, 8
jmp 0x4089b8
mov esi, dword [esp + 0x7c]
test esi, esi
jle 0x408c0b
add eax, 0x28
mov ecx, esi
xor edx, edx
cmp dword [eax], edx
je 0x408c03
inc edi
add eax, 0x274
dec ecx
jne 0x408bfe
mov ecx, edi
lea edx, [esp + 0x58]
shl ecx, 2
call fcn.0040122f
mov edx, eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x80], edx
test edx, edx
jne 0x408c46
mov esi, dword [esp + 0x20]
push dword [esp + 0x58]
push dword [esi]
push str._s:_LspAlloc_failed:__d_n
call fcn.00401d4f
add esp, 0xc
jmp 0x4089b8
xor eax, eax
mov edi, eax
test esi, esi
jle 0x408c6b
mov ecx, dword [esp + 0x54]
add ecx, 0x24
cmp dword [ecx + 4], eax
je 0x408c62
mov eax, dword [ecx]
mov dword [edx + edi*4], eax
inc edi
xor eax, eax
add ecx, 0x274
dec esi
jne 0x408c55
mov ecx, dword [esp + 0x54]
call fcn.0040124d
xor ecx, ecx
mov dword [esp + 0x54], ecx
cmp dword [esp + 0x74], 0
je 0x409a15
call fcn.0040f1fa
call fcn.0040f3b9
mov dword [esp + 0x30], eax
test eax, eax
je 0x408ca4
test ebx, ebx
je 0x408ca4
mov edx, ebx
call fcn.0040f55e
jmp 0x408ca6
xor eax, eax
mov ecx, dword [esp + 0x34]
mov edi, eax
call fcn.00406d77
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x17]
mov esi, eax
xor eax, eax
mov byte [esp + 0x53], al
lea eax, [esp + 0x6c]
push eax
call fcn.0040f70d
pop ecx
xor ecx, ecx
test al, al
push 1
movzx ebx, cl
pop eax
cmovne ebx, eax
cmp dword [esp + 0x6c], ecx
je 0x408cee
mov eax, dword [esp + 0x28]
test eax, eax
cmove eax, dword [esp + 0x6c]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x3c], ecx
je 0x408e09
mov ecx, dword [esp + 0x34]
call fcn.0040f7ba
mov ecx, esi
mov dword [esp + 0x4c], eax
call fcn.0040f7ba
xor ecx, ecx
mov dword [esp + 0xa4], eax
mov byte [esp + 0x27], cl
cmp dword [esp + 0x4c], eax
jne 0x408d2a
xor eax, eax
inc eax
mov byte [esp + 0x53], al
mov bl, cl
jmp 0x408d72
test bl, bl
je 0x408d26
lea eax, [esp + 0x8c]
mov ecx, esi
push eax
lea edx, [esp + 0x6f]
call fcn.0040f70d
pop ecx
xor ecx, ecx
test al, al
push 1
movzx ecx, cl
pop edx
cmovne ecx, edx
cmp cl, bl
jne 0x408d6a
mov al, byte [esp + 0x6b]
cmp al, byte [esp + 0x17]
jne 0x408d6a
mov eax, dword [esp + 0x8c]
cmp eax, dword [esp + 0x6c]
je 0x408d6e
mov bl, dl
jmp 0x408d72
mov bl, byte [esp + 0x27]
mov ecx, dword [esp + 0x34]
call fcn.004073c5
test eax, eax
mov eax, dword [esp + 0x30]
je 0x408dc2
cmp eax, edi
jne 0x408dc2
mov eax, dword [esp + 0xa4]
cmp dword [esp + 0x4c], eax
je 0x408dbe
test bl, bl
jne 0x408ddb
cmp byte [esp + 0x3b], bl
je 0x408da8
cmp byte [esp + 0x26], bl
je 0x4089b8
mov ecx, dword [esp + 0x34]
call fcn.0040b09c
test eax, eax
je 0x4089b8
jmp 0x40899d
mov eax, dword [esp + 0x30]
test bl, bl
jne 0x408ddb
cmp eax, edi
jne 0x408ddb
mov ecx, dword [esp + 0x34]
call fcn.004073c5
test eax, eax
jne 0x40899d
cmp byte [esp + 0x3b], 0
je 0x408ded
cmp byte [esp + 0x26], 0
je 0x4089b8
mov edx, dword [esp + 0x3c]
mov ecx, dword [0x436310]
call fcn.0040ca0a
cmp eax, 0xffffffff
je 0x4089b8
xor ecx, ecx
jmp 0x408e19
cmp byte [esp + 0x3b], cl
je 0x408e20
cmp byte [esp + 0x26], cl
je 0x4089b8
cmp byte [esp + 0x53], 0
jne 0x408e76
push esi
push str.Trying_to_copy_LSP_to:__s_n
call fcn.00401d4f
mov ebx, dword [esp + 0x3c]
add esp, 8
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x408e76
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push esi
push ebx
push str.Failed_to_copy_LSP:__s_to:__s_with_error_code:__i__install_will_try_update_mechanism__n
call fcn.00401d4f
add esp, 0x10
mov ecx, ebx
call fcn.0040b09c
test eax, eax
jne 0x408e76
call edi
push eax
push esi
push ebx
push str.Failed_to_update_LSP_as_well__will_continue_from_local_location__n
call fcn.00401d4f
add esp, 0x10
jmp 0x408e7a
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x30]
xor ecx, ecx
sub eax, ecx
je 0x408eb1
dec eax
je 0x408ea5
dec eax
je 0x408e99
dec eax
jne 0x408ecf
push SysReAllocString
push str.use__j_flag__will_layer_after_base_provider
jmp 0x408ebb
push SysReAllocString
push str.use__t_flag__will_layer_to_be_first_in_chain
jmp 0x408ebb
push SysReAllocString
push str.bypass_existing_LSP
jmp 0x408ebb
push SysReAllocString
push str.none
push ecx
mov edx, 0x104
lea ecx, [esp + 0x318]
call fcn.0040685c
xor ecx, ecx
lea eax, [esp + 0x30c]
push eax
push str.Scenario_file_instruction_is:__s_n
call fcn.00401d4f
mov eax, dword [esp + 0x68]
add esp, 8
cmp byte [esp + 0x17], 0
je 0x408efe
cmp eax, 7
jl 0x408efe
mov dword [esp + 0x3c], 4
jmp 0x408f09
push 2
pop edx
mov dword [esp + 0x3c], edx
mov byte [esp + 0x17], cl
mov dword [esp + 0xe0], 0xf
mov dword [esp + 0xdc], ecx
mov byte [esp + 0xcc], cl
push 3
pop edx
mov byte [esp + 0x848], 6
cmp eax, edx
jl 0x409508
mov byte [esp + 0x27], cl
mov ecx, str.Microsoft_Firewall_Client_Service_Provider__TCP_IP_
call fcn.00406c21
mov ebx, eax
mov ecx, str.Microsoft_Firewall_Client_Service_Provider__UDP_IP_
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov esi, str.Looked_for_firewall_client_with_results:
push esi
mov dword [esp + 0x2f4], edi
call fcn.00403cb8
pop ecx
push eax
push esi
lea ecx, [esp + 0xd4]
call fcn.00404980
mov edx, edi
lea ecx, [esp + 0xfc]
call fcn.00407cba
mov esi, eax
mov edx, ebx
mov byte [esp + 0x848], 7
lea ecx, [esp + 0x144]
call fcn.00407cba
push ecx
mov edx, eax
mov byte [esp + 0x84c], 8
lea ecx, [esp + 0xe8]
call fcn.0040a2e0
pop ecx
push esi
mov edx, eax
mov byte [esp + 0x84c], 9
lea ecx, [esp + 0x118]
call fcn.0040a310
pop ecx
push 0xffffffffffffffff
xor ecx, ecx
mov byte [esp + 0x84c], 0xa
push ecx
push eax
lea ecx, [esp + 0xd8]
call fcn.0040a13a
xor eax, eax
lea ecx, [esp + 0x114]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0xe4]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0x144]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
mov byte [esp + 0x848], 6
push eax
inc eax
lea ecx, [esp + 0x100]
push eax
call fcn.004048e6
test ebx, ebx
je 0x40904b
test edi, edi
je 0x40904b
xor eax, eax
lea edx, [eax + 1]
mov byte [esp + 0x27], dl
jmp 0x409231
mov ecx, 0x42fd74
call fcn.00406c21
mov ebx, eax
mov ecx, 0x42fd8c
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
test ebx, ebx
je 0x409079
test edi, edi
jne 0x40909f
mov ecx, str.MSAFD_Tcpip__TCP_IP_
call fcn.00406c21
mov ebx, eax
mov ecx, str.MSAFD_Tcpip__UDP_IP_
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
test ebx, ebx
je 0x4090a7
test edi, edi
jne 0x4090cd
mov ecx, str.MSAFD_TCP_IP__TCP_IP_
call fcn.00406c21
mov ebx, eax
mov ecx, str.MSAFD_TCP_IP__UDP_IP_
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
test ebx, ebx
je 0x4090d5
test edi, edi
jne 0x4090fb
mov ecx, str.TCPIP_MSAFD__TCP_IP_
call fcn.00406c21
mov ebx, eax
mov ecx, str.TCPIP_MSAFD__UDP_IP_
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
test ebx, ebx
je 0x409103
test edi, edi
jne 0x409129
mov ecx, str.Tcpip_MSAFD__TCP_IP_
call fcn.00406c21
mov ebx, eax
mov ecx, str.Tcpip_MSAFD__UDP_IP_
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
test ebx, ebx
je 0x409131
test edi, edi
jne 0x409157
mov ecx, str.TCP_IP_MSAFD__TCP_IP_
call fcn.00406c21
mov ebx, eax
mov ecx, str.TCP_IP_MSAFD__UDP_IP_
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
mov esi, str._Looked_for_regular_TCP_IP_with_results:
push esi
call fcn.00403cb8
pop ecx
push eax
push esi
lea ecx, [esp + 0xd4]
call fcn.0040a1da
mov edx, edi
lea ecx, [esp + 0xe4]
call fcn.00407cba
mov esi, eax
mov edx, ebx
mov byte [esp + 0x848], 0xb
lea ecx, [esp + 0x114]
call fcn.00407cba
push ecx
mov edx, eax
mov byte [esp + 0x84c], 0xc
lea ecx, [esp + 0x148]
call fcn.0040a2e0
pop ecx
push esi
mov edx, eax
mov byte [esp + 0x84c], 0xd
lea ecx, [esp + 0x100]
call fcn.0040a310
pop ecx
push 0xffffffffffffffff
xor ecx, ecx
mov byte [esp + 0x84c], 0xe
push ecx
push eax
lea ecx, [esp + 0xd8]
call fcn.0040a13a
xor eax, eax
lea ecx, [esp + 0xfc]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0x144]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0x114]
push eax
inc eax
push eax
call fcn.004048e6
xor eax, eax
mov byte [esp + 0x848], 6
push eax
inc eax
lea ecx, [esp + 0xe8]
push eax
call fcn.004048e6
mov dl, byte [esp + 0x27]
mov cl, byte [esp + 0x17]
xor eax, eax
mov dword [esp + 0x4c], eax
test ebx, ebx
je 0x40924b
push 2
test cl, cl
pop esi
cmovne eax, esi
mov dword [esp + 0x4c], eax
xor esi, esi
cmp dword [esp + eax*4 + 0x2ec], esi
je 0x40927b
cmp dword [esp + eax*4 + 0x2f0], esi
je 0x40927b
test cl, cl
jne 0x40927b
mov eax, 0x3f2
cmp ebx, eax
ja 0x409274
cmp edi, eax
jbe 0x40952e
test dl, dl
jmp 0x409474
mov ecx, 0x42fec0
call fcn.00406c21
mov ebx, dword [esp + 0x4c]
mov esi, eax
mov ecx, 0x42fed8
mov dword [esp + ebx*4 + 0x2ec], esi
call fcn.00406c21
mov dword [esp + ebx*4 + 0x2f0], eax
test esi, esi
je 0x4092ab
test eax, eax
jne 0x4092cd
mov ecx, str.MSAFD_Tcpip__TCP_IPv6_
call fcn.00406c21
mov ecx, str.MSAFD_Tcpip__UDP_IPv6_
mov dword [esp + ebx*4 + 0x2ec], eax
call fcn.00406c21
mov dword [esp + ebx*4 + 0x2f0], eax
xor eax, eax
cmp dword [esp + ebx*4 + 0x2ec], eax
je 0x4092e1
cmp dword [esp + ebx*4 + 0x2f0], eax
jne 0x409305
mov ecx, str.MSAFD_TCP_IP__TCP_IPv6_
call fcn.00406c21
mov ecx, str.MSAFD_TCP_IP__UDP_IPv6_
mov dword [esp + ebx*4 + 0x2ec], eax
call fcn.00406c21
mov dword [esp + ebx*4 + 0x2f0], eax
xor eax, eax
cmp dword [esp + ebx*4 + 0x2ec], eax
je 0x409317
cmp dword [esp + ebx*4 + 0x2f0], eax
jne 0x40933b
mov ecx, str.TCPIP_MSAFD__TCP_IPv6_
call fcn.00406c21
mov ecx, str.TCPIP_MSAFD__UDP_IPv6_
mov dword [esp + ebx*4 + 0x2ec], eax
call fcn.00406c21
mov dword [esp + ebx*4 + 0x2f0], eax
xor eax, eax
cmp dword [esp + ebx*4 + 0x2ec], eax
je 0x40934d
cmp dword [esp + ebx*4 + 0x2f0], eax
jne 0x40936f
mov ecx, str.TCP_IP_MSAFD__TCP_IPv6_
call fcn.00406c21
mov ecx, str.TCP_IP_MSAFD__UDP_IPv6_
mov dword [esp + ebx*4 + 0x2ec], eax
call fcn.00406c21
mov dword [esp + ebx*4 + 0x2f0], eax
mov esi, str._Looked_for_V6_TCP_IP_with_results:
push esi
call fcn.00403cb8
pop ecx
push eax
push esi
lea ecx, [esp + 0xd4]
call fcn.0040a1da
mov edx, dword [esp + ebx*4 + 0x2f0]
lea ecx, [esp + 0xe4]
call fcn.00407cba
mov esi, eax
mov byte [esp + 0x848], 0xf
lea ecx, [esp + 0x114]
mov edx, dword [esp + ebx*4 + 0x2ec]
call fcn.00407cba
push ecx
mov edx, eax
mov byte [esp + 0x84c], 0x10
lea ecx, [esp + 0x148]
call fcn.0040a2e0
pop ecx
push esi
mov edx, eax
mov byte [esp + 0x84c], 0x11
lea ecx, [esp + 0x100]
call fcn.0040a310
pop ecx
push 0xffffffffffffffff
xor ebx, ebx
mov byte [esp + 0x84c], 0x12
push ebx
push eax
lea ecx, [esp + 0xd8]
call fcn.0040a13a
xor eax, eax
lea ecx, [esp + 0xfc]
push ebx
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0x144]
push ebx
inc eax
push eax
call fcn.004048e6
xor eax, eax
lea ecx, [esp + 0x114]
push ebx
inc eax
push eax
call fcn.004048e6
xor eax, eax
mov byte [esp + 0x848], 6
push ebx
inc eax
lea ecx, [esp + 0xe8]
push eax
call fcn.004048e6
mov ebx, dword [esp + 0x2ec]
mov eax, 0x3f4
mov edi, dword [esp + 0x2f0]
cmp ebx, eax
ja 0x40946e
cmp edi, eax
jbe 0x40952e
mov al, byte [esp + 0x27]
test al, al
jne 0x40952e
lea eax, [esp + 0x2f0]
push eax
lea edx, [esp + 0x2f0]
call fcn.0040e507
pop ecx
test al, al
jne 0x4094f8
lea ecx, [esp + 0xfc]
call fcn.00407cfc
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x4094a9
mov ecx, dword [ecx]
cmp dword [esp + 0xe0], 0x10
lea eax, [esp + 0xcc]
push ecx
cmovae eax, dword [esp + 0xd0]
push eax
push str.Failed_to_get_base_TCP_or_UDP_providers__this_is_the_decision_tree__s_nLSP_Map:_n
call fcn.00401d4f
add esp, 0xc
lea ecx, [esp + 0xfc]
xor ebx, ebx
xor eax, eax
inc eax
push ebx
push eax
call fcn.004048e6
push ebx
xor eax, eax
lea ecx, [esp + 0xd0]
inc eax
push eax
call fcn.004048e6
jmp 0x4089b8
mov edi, dword [esp + 0x2f0]
mov ebx, dword [esp + 0x2ec]
jmp 0x40952e
mov ecx, str.MS.w95.spi.tcp
call fcn.00406c21
mov ebx, eax
mov ecx, str.MS.w95.spi.udp
mov dword [esp + 0x2ec], ebx
call fcn.00406c21
mov edi, eax
mov dword [esp + 0x2f0], edi
test ebx, ebx
je 0x409ab2
test edi, edi
je 0x409ab2
mov eax, dword [esp + 0x88]
test eax, eax
je 0x409593
push 2
pop ecx
cmp dword [esp + 0x3c], ecx
jne 0x409568
xor ecx, ecx
lea esi, [ecx + 1]
cmp dword [esp + 0x70], ecx
je 0x409597
mov ebx, edi
mov dword [esp + 0x2ec], ebx
jmp 0x409597
cmp dword [esp + 0x70], 0
mov esi, ecx
je 0x40958a
mov ebx, edi
mov edi, dword [esp + 0x2f8]
mov dword [esp + 0x2ec], ebx
mov dword [esp + 0x2f0], edi
jmp 0x409597
mov edi, dword [esp + 0x2f4]
jmp 0x409581
mov esi, dword [esp + 0x3c]
cmp dword [esp + 0x5c], 0
mov edx, dword [esp + 0x30]
push 3
pop ecx
cmovne edx, ecx
xor ecx, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ecx
cmp edx, 3
je 0x4098ca
push 2
pop eax
cmp esi, eax
ja 0x4095ff
test edx, edx
je 0x4095dd
cmp edx, eax
je 0x4095dd
xor eax, eax
mov dword [esp + 0x2f4], eax
mov dword [esp + 0x2f8], eax
jmp 0x409673
mov edx, ebx
call fcn.0040d2f8
mov edx, edi
mov dword [esp + 0x2f4], eax
call fcn.0040d2f8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x2f8], eax
jmp 0x409659
test edx, edx
je 0x40961d
cmp edx, eax
je 0x40961d
xor eax, eax
lea edi, [esp + 0x2fc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x2f8]
jmp 0x40965d
xor eax, eax
mov edi, eax
mov edx, dword [esp + edi*4 + 0x2ec]
call fcn.0040d2f8
cmp eax, dword [esp + edi*4 + 0x2ec]
mov ecx, dword [esp + 0x3c]
mov dword [esp + edi*4 + 0x2fc], eax
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
inc edi
mov dword [esp + 0x3c], ecx
cmp edi, 4
jl 0x409621
mov eax, dword [esp + 0x2f8]
mov edx, dword [esp + 0x30]
cmp dword [esp + 0x2f4], 0
jne 0x40974c
test eax, eax
jne 0x409734
mov edi, dword [esp + 0x88]
test edi, edi
jne 0x40973b
mov ebx, dword [esp + 0xa8]
mov eax, dword [esp + 0x70]
cmp esi, 2
je 0x4098a1
cmp esi, 1
jne 0x4096ab
test ebx, ebx
jne 0x4098a1
test eax, eax
jne 0x4098a1
test cl, cl
jne 0x4096bc
test edi, edi
jne 0x4096bc
cmp esi, 4
je 0x4098a1
push 2
pop eax
cmp esi, eax
je 0x4098a1
xor eax, eax
inc eax
cmp esi, eax
jne 0x4096e0
test ebx, ebx
jne 0x4098a1
cmp dword [esp + 0x70], ebx
jne 0x4098a1
cmp edx, eax
je 0x4098a1
test edx, edx
jne 0x409887
cmp dword [esp + 0xb0], edx
jne 0x409773
call fcn.00407319
test eax, eax
jne 0x409773
mov edi, esi
lea edx, [esp + 0x58]
inc eax
shl esi, 2
mov ecx, esi
mov dword [esp + 0x78], eax
call fcn.0040122f
mov ebx, eax
lea eax, [esp + 0x2ec]
push esi
push eax
push ebx
mov dword [esp + 0x50], ebx
call fcn.004155b0
add esp, 0xc
jmp 0x4099f8
mov edi, dword [esp + 0x88]
mov ebx, dword [esp + 0xa8]
test ebx, ebx
jne 0x409689
jmp 0x40975a
mov edi, dword [esp + 0x88]
mov ebx, dword [esp + 0xa8]
test eax, eax
jne 0x4096ab
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4096ab
jmp 0x40968d
mov edi, dword [esp + 0x5c]
lea eax, [esp + 0xe4]
mov ebx, dword [esp + 0x34]
push eax
push ecx
push edi
lea eax, [esp + 0x2f8]
lea eax, [eax + esi*4]
push eax
push esi
push ebx
call fcn.0040b59f
add esp, 0x18
cmp eax, 0xffffffff
jne 0x4097a7
xor eax, eax
push eax
jmp 0x4094e3
cmp dword [esp + 0xb0], 0
jne 0x409858
call fcn.00407319
test eax, eax
jne 0x409858
mov ecx, dword [0x436310]
lea edx, [esp + 0xe4]
call fcn.0040e10b
test eax, eax
je 0x40979f
mov ecx, dword [0x436310]
mov edx, eax
call fcn.0040ca0a
cmp eax, 0xffffffff
je 0x40979f
lea eax, [esp + 0xe4]
push eax
push ecx
push edi
lea eax, [esp + 0x2f8]
push eax
push esi
push ebx
call fcn.0040b59f
add esp, 0x18
cmp eax, 0xffffffff
je 0x40979f
mov ecx, dword [0x436310]
lea edx, [esp + 0xe4]
call fcn.0040e10b
test eax, eax
je 0x40979f
lea ecx, [esp + 0x2ec]
mov edx, eax
push esi
push ecx
call fcn.0040a60e
pop ecx
pop ecx
test eax, eax
je 0x40979f
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x60]
call fcn.00406a7f
test eax, eax
jne 0x40979f
mov ebx, eax
jmp 0x409871
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x60]
call fcn.00406a7f
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
mov ebx, eax
xor eax, eax
push eax
xor eax, eax
lea ecx, [esp + 0xd0]
inc eax
push eax
call fcn.004048e6
jmp 0x409eff
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x2f0]
lea eax, [eax + esi*4]
jmp 0x4098b0
mov ebx, dword [esp + 0x18]
jmp 0x40986f
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x2f0]
push ecx
push dword [esp + 0x64]
push eax
push esi
push dword [esp + 0x48]
call fcn.0040b59f
add esp, 0x18
cmp eax, 0xffffffff
je 0x40989b
jmp 0x409858
xor ecx, ecx
mov dword [esp + 0x9c], ecx
inc ecx
mov dword [esp + 0x78], ecx
test eax, eax
jne 0x4099d0
lea eax, [esp + 0x80]
mov edx, esi
push eax
lea eax, [esp + 0x2f0]
push eax
call fcn.0040e1b6
mov dword [esp + 0x38], eax
pop ecx
pop ecx
test eax, eax
jne 0x409920
push eax
inc eax
lea ecx, [esp + 0xd0]
push eax
call fcn.004048e6
mov eax, dword [esp + 0x80]
mov dword [esp + 0x44], eax
jmp 0x4089b8
push 2
pop ecx
cmp eax, ecx
jbe 0x4099c3
xor eax, eax
test esi, esi
je 0x40995b
mov edi, eax
mov edx, dword [esp + edi*4 + 0x2ec]
call fcn.0040e482
push eax
push 0x430094
call fcn.00401d4f
add esp, 8
inc edi
cmp edi, esi
jb 0x409933
mov edi, dword [esp + 0x2f0]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x4c], eax
test ecx, ecx
je 0x4099c3
mov edx, dword [esp + 0x80]
mov dword [esp + 0x44], edx
mov edx, dword [edx + eax*4]
cmp edx, ebx
je 0x4099b4
cmp edx, edi
je 0x4099b4
cmp edx, dword [esp + 0x2f4]
jne 0x40998b
cmp esi, 2
jne 0x4099b4
cmp edx, dword [esp + 0x2f8]
jne 0x409999
cmp esi, 2
jne 0x4099b4
call fcn.0040e482
push eax
push 0x430094
call fcn.00401d4f
mov eax, dword [esp + 0x54]
add esp, 8
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x44]
inc eax
mov dword [esp + 0x4c], eax
cmp eax, ecx
jb 0x409972
jmp 0x4099f4
mov eax, dword [esp + 0x80]
mov dword [esp + 0x44], eax
jmp 0x4099f4
mov eax, esi
lea edx, [esp + 0x58]
shr eax, 1
mov ecx, esi
shl ecx, 2
mov dword [esp + 0x30], eax
call fcn.0040122f
mov dword [esp + 0x44], eax
mov dword [eax], ebx
cmp esi, 4
jne 0x4099f4
mov dword [eax + 4], edi
mov edi, dword [esp + 0x30]
push 3
pop eax
mov byte [esp + 0x848], al
lea ecx, [esp + 0xcc]
xor eax, eax
push eax
inc eax
push eax
call fcn.004048e6
xor ecx, ecx
cmp dword [esp + 0x9c], 0
mov ebx, dword [esp + 0x44]
je 0x409a3d
mov esi, ecx
test edi, edi
je 0x409a3d
mov edx, dword [ebx + esi*4]
call fcn.0040d2f8
test eax, eax
je 0x409a38
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x409a29
lea eax, [esp + 0xe4]
push eax
push ecx
push dword [esp + 0x64]
push ebx
push edi
push dword [esp + 0x48]
call fcn.0040b59f
add esp, 0x18
mov esi, eax
cmp dword [esp + 0x78], 0
je 0x409a97
cmp esi, 0xffffffff
je 0x4089b8
mov ecx, dword [0x436310]
lea edx, [esp + 0xe4]
call fcn.0040e10b
test eax, eax
je 0x4089b8
push edi
push ebx
mov edx, eax
call fcn.0040a60e
pop ecx
pop ecx
test eax, eax
je 0x4089b8
cmp esi, 0xffffffff
je 0x4089b8
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x60]
call fcn.00406a7f
jmp 0x409efb
lea ecx, [esp + 0xfc]
call fcn.00407cfc
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x409ac8
mov ecx, dword [ecx]
cmp dword [esp + 0xe0], 0x10
lea eax, [esp + 0xcc]
push ecx
cmovae eax, dword [esp + 0xd0]
push eax
push str.Failed_to_find_TCP_or_UDP_catalogs__this_is_the_decision_tree__s_nLSP_Map:_n
jmp 0x4094c7
cmp dword [esp + 0xa4], ecx
jne 0x409bf7
mov eax, dword [0x436310]
test eax, eax
je 0x409b05
cmp eax, ecx
jne 0x409b7a
lea edx, [esp + 0x7c]
call fcn.004011a0
mov dword [esp + 0x54], eax
test eax, eax
jne 0x409b1d
push dword [ebx]
jmp 0x408bdd
mov edx, dword [esp + 0x7c]
lea ecx, [esp + 0x94]
push ecx
mov ecx, eax
call fcn.0040d3b5
mov esi, eax
mov dword [esp + 0x94], esi
pop ecx
test esi, esi
je 0x409b63
mov edx, dword [esp + 0x94]
mov ecx, esi
call fcn.0040d9d8
mov edx, dword [esp + 0x94]
mov ecx, esi
call fcn.0040db30
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x54]
call fcn.0040124d
xor eax, eax
push 2
mov dword [esp + 0x58], eax
mov eax, dword [0x436310]
pop esi
test eax, eax
je 0x409b86
cmp eax, esi
jne 0x409efb
lea edx, [esp + 0x7c]
mov ecx, esi
call fcn.004011a0
mov dword [esp + 0x54], eax
test eax, eax
je 0x409b16
mov edx, dword [esp + 0x7c]
lea ecx, [esp + 0x94]
push ecx
mov ecx, eax
call fcn.0040d3b5
mov ebx, eax
mov dword [esp + 0x94], ebx
pop ecx
test ebx, ebx
je 0x409be3
mov edx, dword [esp + 0x94]
mov ecx, ebx
call fcn.0040d9d8
mov edx, dword [esp + 0x94]
mov ecx, ebx
call fcn.0040db30
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x54]
call fcn.0040124d
xor edx, edx
mov dword [esp + 0x54], edx
jmp 0x409efd
cmp dword [esp + 0x8c], ecx
jne 0x409c2f
mov eax, dword [0x436310]
test eax, eax
je 0x409c0d
cmp eax, ecx
jne 0x409c17
call fcn.0040c687
mov eax, dword [0x436310]
test eax, eax
je 0x409c23
cmp eax, esi
jne 0x409efb
mov ecx, esi
call fcn.0040c687
jmp 0x409efb
mov ebx, dword [esp + 0xb8]
test ebx, ebx
je case.0x40847e.107
xor eax, eax
mov esi, eax
cmp dword [esp + 0xb4], eax
jne 0x409c74
mov edx, ebx
call fcn.0040e5a2
mov edi, eax
test edi, edi
je 0x409c6f
push edi
push str.LSP_to_be_deleted_filename:__S_n
call fcn.00401d4f
add esp, 8
mov ecx, edi
call fcn.004075cd
mov esi, eax
xor ecx, ecx
inc ecx
jmp 0x409c7b
mov edi, dword [esp + 0xac]
mov eax, dword [0x436310]
test eax, eax
je 0x409c91
cmp eax, ecx
je 0x409c91
mov ecx, dword [esp + 0xac]
jmp 0x409c9f
mov edx, ebx
call fcn.0040ca0a
mov ecx, eax
mov eax, dword [0x436310]
test eax, eax
je 0x409caa
push 2
pop edx
cmp eax, edx
jne 0x409cb8
push 2
pop eax
mov edx, ebx
mov ecx, eax
call fcn.0040ca0a
mov ecx, eax
test ecx, ecx
jne 0x409efb
cmp dword [esp + 0xb4], ecx
jne 0x409efb
test esi, esi
je 0x409efb
push 7
xor eax, eax
pop ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xdc], eax
mov word [esp + 0xcc], ax
mov byte [esp + 0x848], 0x13
push edi
lea ecx, [esp + 0xd0]
call fcn.00405820
push 0x2e
lea ecx, [esp + 0xd0]
call fcn.0040a01e
lea ecx, [esp + 0xfc]
call fcn.0040b021
push 0xffffffffffffffff
xor ecx, ecx
mov byte [esp + 0x84c], 0x14
push ecx
push eax
lea ecx, [esp + 0xd8]
call fcn.00405974
xor eax, eax
mov byte [esp + 0x848], 0x13
push eax
inc eax
lea ecx, [esp + 0x100]
push eax
call fcn.00405930
cmp dword [esp + 0xe0], 8
lea eax, [esp + 0xcc]
push 0x430790
cmovae eax, dword [esp + 0xd0]
push eax
call fcn.00412062
pop ecx
pop ecx
test eax, eax
je 0x409d86
push eax
call fcn.00411f9a
pop ecx
jmp 0x409cf8
cmp dword [esp + 0xe0], 8
lea eax, [esp + 0xcc]
cmovae eax, dword [esp + 0xcc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x409e31
cmp dword [esp + 0xe0], 8
lea esi, [esp + 0xcc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmovae esi, dword [esp + 0xcc]
call ebx
push eax
push esi
push edi
push str.Failed_to_rename_file_to_delete_from:__S_to:__S_with_error_code:__i__this_can_be_an_error___n
call fcn.00401d4f
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 0xdc]
add esp, 0x10
cmp dword [esp + 0xe0], 8
cmovae eax, dword [esp + 0xcc]
push 4
push eax
push edi
call esi
test eax, eax
je 0x409e2a
cmp dword [esp + 0xe0], 8
lea eax, [esp + 0xcc]
push 4
cmovae eax, dword [esp + 0xd0]
xor ecx, ecx
push ecx
push eax
call esi
test eax, eax
jne 0x409eea
call ebx
jmp 0x409eea
mov dword [esp + 0xf8], ebx
lea ecx, [esp + 0xe4]
xor eax, eax
xor ebx, ebx
push 0x430118
mov dword [esp + 0xf8], ebx
mov word [esp + 0xe8], ax
call fcn.00405820
lea eax, [esp + 0xcc]
mov byte [esp + 0x848], 0x15
push eax
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x100]
call fcn.0040a35c
pop ecx
cmp dword [eax + 0x14], 8
jb 0x409e88
mov eax, dword [eax]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
lea ecx, [esp + 0xfc]
neg ebx
sbb bl, bl
xor eax, eax
push eax
inc eax
push eax
call fcn.00405930
xor eax, eax
lea ecx, [esp + 0xe4]
push eax
inc eax
push eax
call fcn.00405930
inc bl
je 0x409eea
cmp dword [esp + 0xe0], 8
lea esi, [esp + 0xcc]
cmovae esi, dword [esp + 0xcc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_queue_file__S_for_deletion_with_error_code:__i__n
call fcn.00401d4f
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0xcc]
push eax
inc eax
push eax
call fcn.00405930
xor edx, edx
mov ebx, edx
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x408261
jmp 0x409f15
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0xe4]
mov esi, str.RegisterLSP.exe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test eax, eax
je 0x40823e
lea eax, [esp + 0xe4]
push eax
push eax
push eax
push eax
push str._n_nExamples:__most_common__n_nDisplay_all_LSPs_install_on_the_machine:__s__p_n_nRemove_all_layered_LSPs__leaving_only_base_OS_providers_:__s__f_n_nAuto_install_an_LSP_named_nonifslsp.dll_and_located_in_c:_:__s__b__d_c:_nonifslsp.dll_n_nAuto_install_an_IFS_LSP_named_ifslsp.dll_and_located_in_c:_:__s__bi__d_c:ifslsp.dll_n_n
call fcn.00401d4f
add esp, 0x14
push eax
push str._nExamples:__obsolete_functions__not_recommended_to_use__n_nInstall_an_LSP_named_nonifslsp.dll_and_located_in_c:_:__s__i__o_1001__o_1002__d_c:_nonifslsp.dll_n_n
call fcn.00401d4f
add esp, 8
jmp 0x408261