Function at 0x438b6b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587c8d
mov eax, dword fs:[0]
push eax
sub esp, 0x898
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7b4], ecx
mov dword [ebp - 0x7b0], 0
call fcn.00402270
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
movzx edx, word [ebp + 0xc]
push edx
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043f230
test eax, eax
jne 0x437d6b
xor eax, eax
jmp 0x43969d
push str.TIP:_CNetCmdConfigMgr::NetTaskCallbackRoutine_in_...
push 0x5ef148
call fcn.0040c050
add esp, 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x5c], 1
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x58]
call fcn.004361c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x7b4]
add ecx, 4
call fcn.004364e0
movzx edx, al
test edx, edx
je 0x43943f
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043f560
lea ecx, [ebp - 0xbc]
call fcn.00405ec0
mov byte [ebp - 4], 1
push 0x10
mov ecx, dword [ebp - 0x51]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.004081d0
lea ecx, [ebp - 0x9c]
call fcn.00419260
mov byte [ebp - 4], 2
lea edx, [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0x41]
push eax
mov ecx, dword [ebp - 0x4d]
push ecx
call fcn.0048b270
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.00405ec0
mov byte [ebp - 4], 3
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xc0], 0
movzx edx, byte [ebp - 0x58]
cmp edx, 2
jne 0x438204
push str.TIP:_Begin_ConfQuery_...
push 0x5ef1ac
call fcn.0040c050
add esp, 8
mov byte [ebp - 0xe0], 0
xor eax, eax
mov dword [ebp - 0xdf], eax
mov dword [ebp - 0xdb], eax
mov dword [ebp - 0xd7], eax
mov word [ebp - 0xd3], ax
mov byte [ebp - 0xd1], al
call fcn.00402270
mov dword [ebp - 0xd0], eax
movzx ecx, word [ebp - 0x57]
mov dword [ebp - 0x7b8], ecx
mov edx, dword [ebp - 0x7b8]
sub edx, 1
mov dword [ebp - 0x7b8], edx
cmp dword [ebp - 0x7b8], 0xb
ja case.0x437eae.6
mov eax, dword [ebp - 0x7b8]
jmp dword [eax*4 + 0x4396c0]
push 0x5ef1d8
push 0x5ef218
call fcn.0040c050
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.0048aab0
push 0x5ef244
push 0x5ef280
call fcn.0040c050
add esp, 8
push str.TIP:_Begin_LoadCnntWhiteList_...
push 0x5ef2f8
call fcn.0040c050
add esp, 8
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.00439740
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadCnntWhiteList_...
push 0x5ef36c
call fcn.0040c050
add esp, 8
push 0x5ef398
push 0x5ef3d8
call fcn.0040c050
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.00437c70
push eax
call fcn.00402a70
mov ecx, eax
call fcn.0048aa50
push 0x5ef404
push 0x5ef440
call fcn.0040c050
add esp, 8
jmp 0x4381ff
push str.TIP:_Begin_StopSelfLearn_...
push 0x5ef4ac
call fcn.0040c050
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.0048aab0
push str.TIP:_End_StopSelfLearn_...
push 0x5ef514
call fcn.0040c050
add esp, 8
push str.TIP:_Begin_LoadLocalPortWhiteList_...
push 0x5ef590
call fcn.0040c050
add esp, 8
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp - 0x7b4]
call fcn.00439fa0
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadLocalPortWhiteList_...
push 0x5ef60c
call fcn.0040c050
add esp, 8
push str.TIP:_Begin_StartSelfLearn_...
push 0x5ef678
call fcn.0040c050
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.00437c70
push eax
call fcn.00402a70
mov ecx, eax
call fcn.0048aa50
push str.TIP:_End_StartSelfLearn_...
push 0x5ef6e0
call fcn.0040c050
add esp, 8
jmp 0x4381ff
push str.TIP:_Begin_LoadFileMonList_...
push 0x5ef754
call fcn.0040c050
add esp, 8
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043a5f0
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadFileMonList_...
push 0x5ef7c0
call fcn.0040c050
add esp, 8
jmp 0x4381ff
push 0xa
lea ecx, [ebp - 0xe0]
push ecx
mov edx, dword [0x63b414]
push edx
call fcn.0043e4a0
add esp, 0xc
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x80]
call fcn.00405fb0
jmp 0x4381ff
push 0xa
lea ecx, [ebp - 0xe0]
push ecx
mov edx, dword [0x63b418]
push edx
call fcn.0043e4a0
add esp, 0xc
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x80]
call fcn.00405fb0
jmp 0x4381ff
push str.TIP:_Begin_LoadUSBStatus_...
push 0x5ef82c
call fcn.0040c050
add esp, 8
mov ecx, dword [0x63a638]
and ecx, 0xf
cmp ecx, 2
jb 0x4380d5
lea edx, [ebp - 0x80]
push edx
call fcn.0048fe20
add esp, 4
mov dword [ebp - 0xa0], eax
jmp 0x4380e7
lea eax, [ebp - 0x80]
push eax
call fcn.0048ffe0
add esp, 4
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadUSBStatus_...
push str.CNetCmdConfigMgr::NetTaskCallbackRoutine
call fcn.0040c050
add esp, 8
jmp 0x4381ff
mov ecx, dword [0x63a638]
and ecx, 0xf
cmp ecx, 2
jb 0x438120
lea edx, [ebp - 0x80]
push edx
call fcn.0049a8b0
add esp, 4
mov dword [ebp - 0xa0], eax
jmp 0x438153
lea ecx, [ebp - 0xe5]
call fcn.00481ff0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xe5]
call fcn.00497560
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe5]
call fcn.0041f220
jmp 0x4381ff
mov dword [ebp - 0xec], 0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00497370
add esp, 4
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xec], 0
je 0x43818c
mov dword [ebp - 0x7bc], 0x5ef8c0
jmp 0x438196
mov dword [ebp - 0x7bc], 0x5ef8c4
mov edx, dword [ebp - 0x7bc]
push edx
lea ecx, [ebp - 0x80]
call fcn.00405fb0
jmp 0x4381ff
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043aa60
mov dword [ebp - 0xa0], eax
jmp 0x4381ff
push 0
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043af80
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x5c], 0
jmp 0x4381ff
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043b4c0
mov dword [ebp - 0xa0], eax
jmp 0x4381ff
mov dword [ebp - 0xa0], 2
jmp 0x43920d
movzx eax, byte [ebp - 0x58]
cmp eax, 3
jne 0x439203
mov byte [ebp - 0xf1], 1
lea ecx, [ebp - 0x110]
call fcn.00405ec0
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0xf0], eax
movzx ecx, word [ebp - 0x57]
mov dword [ebp - 0x7c0], ecx
mov edx, dword [ebp - 0x7c0]
sub edx, 1
mov dword [ebp - 0x7c0], edx
cmp dword [ebp - 0x7c0], 0x12
ja case.0x43825f.6
mov eax, dword [ebp - 0x7c0]
jmp dword [eax*4 + 0x4396f0]
call fcn.00402a70
mov ecx, eax
call fcn.0048aab0
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.00439d40
mov dword [ebp - 0xa0], eax
call fcn.00402a70
mov ecx, eax
call fcn.00437c70
push eax
call fcn.00402a70
mov ecx, eax
call fcn.0048aa50
cmp dword [ebp - 0xf0], 0x1b5
jne 0x4382c1
push str.network_whitelist_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x4382d1
push 0x5ef8e4
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
call fcn.00402a70
mov ecx, eax
call fcn.0048aab0
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043a320
mov dword [ebp - 0xa0], eax
call fcn.00402a70
mov ecx, eax
call fcn.00437c70
push eax
call fcn.00402a70
mov ecx, eax
call fcn.0048aa50
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438331
push str.port_whitelist_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438341
push 0x5ef90c
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043a770
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x43837c
push str.key_files_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x43838c
push 0x5ef930
lea ecx, [ebp - 0x110]
call fcn.00405fb0
cmp dword [ebp - 0xa0], 0
jne 0x4383ce
call fcn.00402d80
mov ecx, eax
call fcn.00455fb0
mov ecx, 0x63b204
call fcn.00406110
push eax
call fcn.004854f0
add esp, 4
test eax, eax
jne 0x4383c2
mov dword [ebp - 0xa0], 9
call fcn.00402d80
mov ecx, eax
call fcn.00455af0
jmp 0x438e76
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6bc], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x7c4], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.00439970
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x43842b
push str.optical_drive_check_cycle_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x43843b
push 0x5ef964
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c0], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x7cc], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.00439a90
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438498
push str.illegal_port_check_cycle_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x4384a8
push 0x5ef9a0
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
mov ecx, dword [0x63a638]
and ecx, 0xf
cmp ecx, 2
jb 0x4387ba
mov dword [ebp - 0xa0], 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c4], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x7d4], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.004163b0
add esp, 0x20
mov dword [ebp - 0x7d8], eax
mov byte [ebp - 4], 6
push 0x5ef9b8
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00407960
add esp, 8
movzx edx, al
test edx, edx
je 0x4385df
push 2
call fcn.0048f440
add esp, 4
mov dword [ebp - 0xa0], eax
push 2
call fcn.0048f6c0
add esp, 4
mov dword [ebp - 0xa0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c8], esp
lea eax, [ebp - 0x12c]
push eax
call fcn.00405f30
mov dword [ebp - 0x7dc], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043d200
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6cc], esp
push 0x5ef9bc
call fcn.00405ef0
mov dword [ebp - 0x7e0], eax
call fcn.004168f0
add esp, 0x20
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push 0x5ef9d0
call fcn.00405ef0
mov dword [ebp - 0x7e4], eax
call fcn.004168f0
add esp, 0x20
push 2
call fcn.00490180
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.00490180
add esp, 4
jmp 0x4387a6
push 0x5ef9e4
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00407960
add esp, 8
movzx edx, al
test edx, edx
je 0x4386bf
push 1
call fcn.0048f440
add esp, 4
mov dword [ebp - 0xa0], eax
push 1
call fcn.0048f6c0
add esp, 4
mov dword [ebp - 0xa0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d4], esp
lea eax, [ebp - 0x12c]
push eax
call fcn.00405f30
mov dword [ebp - 0x7e8], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043d200
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6d8], esp
push 0x5ef9e8
call fcn.00405ef0
mov dword [ebp - 0x7ec], eax
call fcn.004168f0
add esp, 0x20
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6dc], esp
push 0x5ef9fc
call fcn.00405ef0
mov dword [ebp - 0x7f0], eax
call fcn.004168f0
add esp, 0x20
push 2
call fcn.00490180
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.00490180
add esp, 4
jmp 0x4387a6
push 0x5efa10
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00407960
add esp, 8
movzx edx, al
test edx, edx
je 0x43879c
push 0
call fcn.0048f440
add esp, 4
mov dword [ebp - 0xa0], eax
push 0
call fcn.0048f6c0
add esp, 4
mov dword [ebp - 0xa0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6e0], esp
lea eax, [ebp - 0x12c]
push eax
call fcn.00405f30
mov dword [ebp - 0x7f4], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043d200
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6e4], esp
push str.sc_stop_WPDBusEnum
call fcn.00405ef0
mov dword [ebp - 0x7f8], eax
call fcn.004168f0
add esp, 0x20
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6e8], esp
push str.sc_start_WPDBusEnum
call fcn.00405ef0
mov dword [ebp - 0x7fc], eax
call fcn.004168f0
add esp, 0x20
push 2
call fcn.00490180
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.00490180
add esp, 4
jmp 0x4387a6
mov dword [ebp - 0xa0], 3
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x12c]
call fcn.00405f70
jmp 0x43885e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6ec], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x800], eax
call fcn.0048faf0
add esp, 0x1c
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0xa0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6f0], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x148]
push eax
call fcn.004163b0
add esp, 0x20
mov dword [ebp - 0x80c], eax
mov byte [ebp - 4], 7
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6f4], esp
lea edx, [ebp - 0x148]
push edx
call fcn.00405f30
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043d200
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x148]
call fcn.00405f70
cmp dword [ebp - 0xf0], 0x1b5
jne 0x43887c
push str.USB_status_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x43888c
push 0x5efa50
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
mov eax, dword [0x63a638]
and eax, 0xf
cmp eax, 2
jb 0x4388d9
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6f8], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x814], eax
call fcn.00490950
add esp, 0x20
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0xa0], eax
jmp 0x438912
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6fc], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x81c], eax
call fcn.00493770
add esp, 0x20
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438930
push str.add_firewall_rule
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438940
push 0x5efa74
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
mov ecx, dword [0x63a638]
and ecx, 0xf
cmp ecx, 2
jb 0x43898e
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x700], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x824], eax
call fcn.00490950
add esp, 0x20
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0xa0], eax
jmp 0x4389c7
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x704], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x82c], eax
call fcn.00493770
add esp, 0x20
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x4389e5
push str.delete_firewall_rules
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x4389f5
push 0x5efa9c
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
mov ecx, dword [ebp - 0x41]
push ecx
mov edx, dword [ebp - 0x4d]
push edx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043cce0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x438a23
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438a41
push 0x5efaac
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438a51
push 0x5efab4
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x708], esp
lea eax, [ebp - 0x9c]
push eax
call fcn.00407f00
mov dword [ebp - 0x834], eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043ce90
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp - 0x838]
mov dword [ebp - 0xa0], ecx
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438aae
push str.change_password
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438abe
push 0x5efacc
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x70c], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x164]
push eax
call fcn.004163b0
add esp, 0x20
mov dword [ebp - 0x840], eax
mov byte [ebp - 4], 8
push 0x5efad8
lea ecx, [ebp - 0x164]
push ecx
call fcn.00407960
add esp, 8
mov byte [ebp - 0x165], al
movzx edx, byte [ebp - 0x165]
push edx
call fcn.00497260
add esp, 4
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438b47
push str.firewall_status_change
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438b57
push 0x5efaf4
lea ecx, [ebp - 0x110]
call fcn.00405fb0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x164]
call fcn.00405f70
jmp 0x438e76
mov eax, dword [0x63a638]
and eax, 0xf
cmp eax, 2
jb 0x438bb3
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x710], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x844], eax
call fcn.00490950
add esp, 0x20
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0xa0], eax
jmp 0x438bec
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x714], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00407f00
mov dword [ebp - 0x84c], eax
call fcn.00493770
add esp, 0x20
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438c0a
push str.edit_firewall_rule
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438c1a
push 0x5efb1c
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043ae60
mov dword [ebp - 0xa0], eax
push 0x5efb2c
lea ecx, [ebp - 0x734]
call fcn.004060b0
mov dword [ebp - 0x854], eax
mov edx, dword [ebp - 0x854]
mov dword [ebp - 0x858], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x7b0]
or eax, 1
mov dword [ebp - 0x7b0], eax
mov ecx, dword [ebp - 0x858]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.0043e4c0
add esp, 8
movzx eax, al
test eax, eax
je 0x438c9e
cmp dword [ebp - 0xa0], 0
jne 0x438c9e
mov dword [ebp - 0x85c], 1
jmp 0x438ca8
mov dword [ebp - 0x85c], 0
mov cl, byte [ebp - 0x85c]
mov byte [ebp - 0x715], cl
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x7b0]
and edx, 1
je 0x438cd8
and dword [ebp - 0x7b0], 0xfffffffe
lea ecx, [ebp - 0x734]
call fcn.004060f0
movzx eax, byte [ebp - 0x715]
test eax, eax
je 0x438ce8
call fcn.0049b100
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438d06
push str.process_protect_mode_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438d16
push 0x5efb50
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
push 0
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043b390
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438d53
push str.add_process_whitelist
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438d63
push 0x5efb7c
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
push 1
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043b390
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438da0
push str.remove_process_whitelist
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438db0
push 0x5efba8
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x7b4]
call fcn.0043bbb0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438deb
push str.firewall_attribute_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438dfb
push 0x5efbd4
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043c650
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x438e22
mov byte [ebp - 0x15], 1
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438e40
push str.report_parameters_changed
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e50
push 0x5efc00
lea ecx, [ebp - 0x110]
call fcn.00405fb0
jmp 0x438e76
mov ecx, dword [ebp - 0x7b4]
call fcn.0043ca40
mov dword [ebp - 0xa0], eax
jmp 0x438e76
mov dword [ebp - 0xa0], 2
mov byte [ebp - 0xf1], 0
movzx edx, byte [ebp - 0xf1]
test edx, edx
je 0x439025
lea ecx, [ebp - 0x166]
call fcn.00481ff0
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x188], 0
lea ecx, [ebp - 0x184]
call fcn.00405ec0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x166]
call fcn.0041f230
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x738], esp
lea edx, [ebp - 0x184]
push edx
call fcn.00405f30
mov dword [ebp - 0x860], eax
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x166]
call fcn.0041f410
mov byte [ebp - 0x861], al
movzx ecx, byte [ebp - 0x861]
test ecx, ecx
je 0x439007
lea ecx, [ebp - 0x21c]
call fcn.0041f850
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0xf0], 0x1b5
jne 0x438f61
push 0x5efc10
lea ecx, [ebp - 0x200]
call fcn.00405fb0
cmp dword [ebp - 0xa0], 0
jne 0x438f43
mov dword [ebp - 0x868], 0x5efc24
jmp 0x438f4d
mov dword [ebp - 0x868], 0x5efc2c
mov edx, dword [ebp - 0x868]
push edx
lea ecx, [ebp - 0x1c8]
call fcn.00405fb0
jmp 0x438fa2
push 0x5efc34
lea ecx, [ebp - 0x200]
call fcn.00405fb0
cmp dword [ebp - 0xa0], 0
jne 0x438f86
mov dword [ebp - 0x86c], 0x5efc40
jmp 0x438f90
mov dword [ebp - 0x86c], 0x5efc48
mov eax, dword [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00405fb0
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.00405f90
push 0x594967
lea ecx, [ebp - 0x1ac]
call fcn.00405fb0
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x188]
push eax
lea ecx, [ebp - 0x166]
call fcn.0041f4f0
cmp dword [ebp - 0x188], 0
je 0x438ff8
mov ecx, dword [ebp - 0x188]
push ecx
lea ecx, [ebp - 0x166]
call fcn.0041f4c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x21c]
call fcn.0047d520
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x184]
call fcn.00405f70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x166]
call fcn.0041f220
movzx edx, word [ebp - 0x57]
cmp edx, 0xf
je 0x43903b
movzx eax, word [ebp - 0x57]
cmp eax, 0x10
jne 0x4391f2
lea ecx, [ebp - 0x240]
call fcn.00405ec0
mov byte [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0x240]
push ecx
mov ecx, dword [ebp - 0x7b4]
call fcn.0043af80
xor edx, edx
mov word [ebp - 0x44c], dx
push 0x206
push 0
lea eax, [ebp - 0x44a]
push eax
call fcn.00562540
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x44c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x224], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x224], 0
je 0x4391e3
cmp dword [ebp - 0x220], 0x7a
je 0x4391e3
lea edx, [ebp - 0x44c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.proc_list.txt
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00402270
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x454], 0
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x458], ecx
cmp dword [ebp - 0x458], 0
jne 0x439112
mov dword [ebp - 0x870], 0
jmp 0x439188
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0x3fffffff
jle 0x439140
mov dword [ebp - 0x874], 0
jmp 0x43917c
mov eax, dword [ebp - 0x450]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x878], esp
mov eax, dword [ebp - 0x45c]
push eax
mov ecx, dword [ebp - 0x450]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x458]
push edx
mov eax, dword [ebp - 0x878]
push eax
call fcn.004022d0
mov dword [ebp - 0x874], eax
mov ecx, dword [ebp - 0x874]
mov dword [ebp - 0x870], ecx
push 0x5efc6c
mov edx, dword [ebp - 0x870]
push edx
call fcn.0055ca2d
add esp, 8
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
je 0x4391e3
mov eax, dword [ebp - 0x454]
push eax
push 1
lea ecx, [ebp - 0x240]
call fcn.00459160
push eax
lea ecx, [ebp - 0x240]
call fcn.00406030
push eax
call fcn.0055cba6
add esp, 0x10
mov ecx, dword [ebp - 0x454]
push ecx
call fcn.0055cc9f
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x240]
call fcn.00405f70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x110]
call fcn.00405f70
jmp 0x43920d
mov dword [ebp - 0xa0], 2
lea ecx, [ebp - 0x80]
call fcn.00459160
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x4393ca
cmp dword [ebp - 0x5c], 0
je 0x4393ca
mov edx, dword [ebp - 0xc4]
push edx
lea ecx, [ebp - 0x80]
call fcn.00406030
push eax
call fcn.0042b520
add esp, 8
test eax, eax
jne 0x4393ad
lea ecx, [ebp - 0x464]
call fcn.0042e580
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xc4]
add eax, 1
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x464]
call fcn.00405e80
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0
je 0x4392d7
mov edx, dword [ebp - 0x470]
shl edx, 1
push edx
push 0
mov eax, dword [ebp - 0x468]
push eax
call fcn.00562540
add esp, 0xc
mov ecx, dword [ebp - 0x470]
push ecx
mov edx, dword [ebp - 0x468]
push edx
lea ecx, [ebp - 0x80]
call fcn.00406030
push eax
call fcn.0048b540
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x464]
call fcn.0042de80
lea ecx, [ebp - 0x46c]
call fcn.0042e580
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0xc4]
imul eax, eax, 3
add eax, 1
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
push ecx
lea ecx, [ebp - 0x46c]
call fcn.0042ded0
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
je 0x43935b
mov edx, dword [ebp - 0x474]
push edx
push 0
mov eax, dword [ebp - 0x478]
push eax
call fcn.00562540
add esp, 0xc
mov ecx, dword [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x478]
push edx
mov eax, dword [ebp - 0x468]
push eax
call fcn.0048b460
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x46c]
call fcn.0042def0
lea ecx, [ebp - 0x46c]
call fcn.00405ea0
test eax, eax
je 0x43938f
lea ecx, [ebp - 0x46c]
call fcn.004027c0
push eax
lea ecx, [ebp - 0x80]
call fcn.00405fb0
lea ecx, [ebp - 0x46c]
call fcn.00405ea0
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x46c]
call fcn.0042e5a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x464]
call fcn.0042e5a0
lea ecx, [ebp - 0x80]
call fcn.00459160
push eax
lea ecx, [ebp - 0x80]
call fcn.0042df40
push eax
lea ecx, [ebp - 0xbc]
call fcn.004081d0
cmp dword [ebp - 0xc4], 0
je 0x4393e8
cmp dword [ebp - 0x5c], 0
jne 0x4393e8
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.00407fb0
lea ecx, [ebp - 0xbc]
call fcn.0042df40
push eax
lea ecx, [ebp - 0xbc]
call fcn.00459160
push eax
movzx edx, word [ebp - 0xa0]
push edx
movzx eax, byte [ebp - 0x58]
push eax
call fcn.00431510
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.00405f70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c]
call fcn.004060f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.00405f70
cmp dword [ebp - 0x14], 0
jne 0x439451
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43967e
xor edx, edx
mov word [ebp - 0x684], dx
push 0x206
push 0
lea eax, [ebp - 0x682]
push eax
call fcn.00562540
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x684]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x68c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x68c], 0
je 0x43967e
cmp dword [ebp - 0x688], 0x7a
je 0x43967e
lea edx, [ebp - 0x684]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.00402270
mov dword [ebp - 0x6b4], eax
lea eax, [ebp - 0x684]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0
jne 0x4394e9
mov dword [ebp - 0x87c], 0
jmp 0x43955f
mov ecx, dword [ebp - 0x6b0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0x3fffffff
jle 0x439517
mov dword [ebp - 0x880], 0
jmp 0x439553
mov eax, dword [ebp - 0x690]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x884], esp
mov edx, dword [ebp - 0x6b4]
push edx
mov eax, dword [ebp - 0x690]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x6b0]
push ecx
mov edx, dword [ebp - 0x884]
push edx
call fcn.004022d0
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x87c], eax
push str.___AD_ESS.exe_restart
lea ecx, [ebp - 0x754]
call fcn.00405ef0
mov dword [ebp - 0x888], eax
mov ecx, dword [ebp - 0x888]
mov dword [ebp - 0x88c], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x87c]
push edx
lea ecx, [ebp - 0x770]
call fcn.00405ef0
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x894], eax
mov byte [ebp - 4], 0x11
push str.cd__d__
lea ecx, [ebp - 0x78c]
call fcn.00405ef0
mov dword [ebp - 0x898], eax
mov ecx, dword [ebp - 0x898]
mov dword [ebp - 0x89c], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x894]
push edx
mov eax, dword [ebp - 0x89c]
push eax
lea ecx, [ebp - 0x7a8]
push ecx
call fcn.0041e300
add esp, 0xc
mov dword [ebp - 0x8a0], eax
mov edx, dword [ebp - 0x8a0]
mov dword [ebp - 0x8a4], edx
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x88c]
push eax
mov ecx, dword [ebp - 0x8a4]
push ecx
lea edx, [ebp - 0x6ac]
push edx
call fcn.0041e300
add esp, 0xc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7a8]
call fcn.00405f70
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x78c]
call fcn.00405f70
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x770]
call fcn.00405f70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x754]
call fcn.00405f70
lea ecx, [ebp - 0x6ac]
call fcn.00406030
push eax
call fcn.0055ac4a
add esp, 4
lea ecx, [ebp - 0x6ac]
call fcn.00405f70
mov dword [ebp - 0x7ac], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004361e0
mov eax, dword [ebp - 0x7ac]
lea esp, [ebp - 0x8a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret 0x10