Function at 0x4b540d
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0x204
mov eax, 0x6119ba
call fcn.004f0658
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebx + 8]
push esi
call fcn.0040c350
push esi
push str.SOFTWAREMicrosoftOneDriveTenants_
lea eax, [ebp - 0x44]
push eax
call fcn.0044a805
and dword [ebp - 4], 0
mov ecx, ebx
call fcn.004b425f
mov ecx, ebx
call fcn.004b4b3d
mov ecx, ebx
call fcn.004b408e
mov ecx, ebx
call fcn.004b45ed
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.DisablePersonalSync
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push 7
pop esi
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x60]
mov edi, reloc.WS2_32.dll_accept
push eax
push edi
push 1
mov ecx, ebx
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b54f8
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x4b54ef
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], esi
cmp eax, 8
jb 0x4b5543
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b553a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.DisablePersonalSync
mov dword [ebp - 0x64], esi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwareMicrosoftOneDrive
mov byte [ebp - 4], 3
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push edi
push 1
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
push 8
pop edi
cmp eax, edi
jb 0x4b55d8
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b55cf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], esi
cmp eax, edi
jb 0x4b5622
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5619
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.GPOSetUpdateRing
mov dword [ebp - 0x64], esi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 5
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 2
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, edi
jb 0x4b56b8
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b56af
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
cmp eax, edi
mov dword [ebp - 0x4c], esi
mov edi, 0x1000
jb 0x4b5704
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, edi
jb 0x4b56fb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.EnableEnterpriseUpdate
mov dword [ebp - 0x64], esi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 7
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 3
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b579c
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, edi
jb 0x4b5793
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], 7
cmp eax, 8
jb 0x4b57e8
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, edi
jb 0x4b57df
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
call fcn.004acb76
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1ec]
mov ecx, esi
call dword [0x62275c]
mov ecx, edi
call esi
test al, al
jne 0x4b59d1
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push 7
pop esi
push str.EnableEnterpriseUpdate
mov dword [ebp - 0x64], esi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 9
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.WS2_32.dll_accept
push 3
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
push 8
pop edi
cmp eax, edi
jb 0x4b58a7
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b589e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], esi
cmp eax, edi
jb 0x4b58f1
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b58e8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.EnableEnterpriseUpdate
mov dword [ebp - 0x64], esi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwareMicrosoftOneDrive
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.WS2_32.dll_accept
push 3
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, edi
jb 0x4b5987
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b597e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], esi
cmp eax, edi
jb 0x4b59d1
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b59c8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
mov edi, str.DefaultRootDir
lea eax, [ebp - 0x90]
push edi
push str.SoftwarePoliciesMicrosoftOneDrive
push eax
call fcn.004ae02d
push 0
lea esi, [ebx + 8]
mov byte [ebp - 4], 0xd
push esi
push eax
push reloc.WS2_32.dll_accept
push 4
mov ecx, ebx
call fcn.004b3b8c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0
call fcn.00405795
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push edi
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
push reloc.WS2_32.dll_accept
push 4
call fcn.004b3b8c
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4b5a89
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5a80
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
mov edi, str.DisableCustomRoot
lea eax, [ebp - 0x90]
push edi
push str.SoftwarePoliciesMicrosoftOneDrive
push eax
call fcn.004ae02d
push 0
push esi
push eax
push reloc.WS2_32.dll_accept
push 5
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.004b3b8c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0
call fcn.00405795
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push edi
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
push reloc.WS2_32.dll_accept
push 5
call fcn.004b3b8c
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4b5b3e
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5b35
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push 7
pop edi
push str.AutomaticUploadBandwidthPercentage
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 8
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b5bd8
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5bcf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b5c23
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5c1a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.AutomaticUploadBandwidthPercentage
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwareMicrosoftOneDrive
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 8
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b5cba
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5cb1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b5d05
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5cfc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.GPOEnabled
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 9
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b5d9c
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5d93
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b5de7
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5dde
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.GPOEnabled
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
push str.Remote_Access
push str.SoftwareMicrosoftOneDrive
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0x17
push eax
call fcn.004ae02d
push 0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x18
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 9
mov ecx, ebx
call fcn.004b3b8c
lea ecx, [ebp - 0x90]
call fcn.00405795
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4b5e82
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5e79
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.PreventNetworkTrafficPreUserSignIn
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xa
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b5f19
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5f10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b5f64
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5f5b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.PreventNetworkTrafficPreUserSignIn
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwareMicrosoftOneDrive
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xa
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b5ffb
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b5ff2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b6046
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b603d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.SilentAccountConfig
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b60dd
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b60d4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b6128
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b611f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.SilentAccountConfig
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwareMicrosoftOneDrive
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b61bf
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b61b6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
cmp eax, 8
jb 0x4b620a
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6201
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x1c], 0
xor eax, eax
push str.DisableAutoConfig
mov dword [ebp - 0x18], edi
mov word [ebp - 0x2c], ax
call fcn.0040c8c9
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x39
call fcn.004b3b8c
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0x21
cmp eax, 8
jb 0x4b62a5
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b629c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.SoftwareMicrosoftOneDrive
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x39
call fcn.004b3b8c
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0x21
cmp eax, 8
jb 0x4b631e
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6315
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
mov edi, str.DiskSpaceCheckThresholdMB
lea eax, [ebp - 0x90]
push edi
push str.SoftwarePoliciesMicrosoftOneDrive
push eax
call fcn.004ae02d
push 0
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xc
mov ecx, ebx
mov byte [ebp - 4], 0x24
call fcn.004b3b8c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x21
call fcn.00405795
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push edi
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xc
call fcn.004b3b8c
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0x21
cmp eax, 8
jb 0x4b63d3
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b63ca
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push 7
pop edi
push str.FilesOnDemandEnabled
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xd
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b646d
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6464
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 0x21
cmp eax, 8
jb 0x4b64b9
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b64b0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.DehydrateSyncedTeamSites
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x29
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xe
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x4b6550
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6547
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 0x21
cmp eax, 8
jb 0x4b659c
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6593
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
push str.AllowTenantList
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x90]
push eax
call fcn.004ae02d
push 0
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xf
mov ecx, ebx
mov byte [ebp - 4], 0x2a
call fcn.004b3b8c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.BlockTenantList
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x90]
push eax
call fcn.004ae02d
push 0
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x10
mov ecx, ebx
mov byte [ebp - 4], 0x2b
call fcn.004b3b8c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x21
call fcn.00405795
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.UploadBandwidthLimit
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.WS2_32.dll_accept
push 0x11
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
push 8
pop esi
cmp eax, esi
jb 0x4b66ab
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b66a2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 0x21
cmp eax, esi
jb 0x4b66f6
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b66ed
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.DownloadBandwidthLimit
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.WS2_32.dll_accept
push 0x12
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jb 0x4b678c
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6783
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 0x21
cmp eax, esi
jb 0x4b67d7
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b67ce
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.SharePointOnPremPrioritization
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x31
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x13
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jb 0x4b686d
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6864
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 0x21
cmp eax, esi
jb 0x4b68b8
mov ecx, dword [ebp - 0x78]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b68af
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x78], 0
lea ecx, [ebp - 0x78]
and dword [ebp - 0x68], 0
xor eax, eax
push str.SharePointOnPremFrontDoorUrl
mov dword [ebp - 0x64], edi
mov word [ebp - 0x78], ax
call fcn.0040c8c9
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
and dword [ebp - 0x50], 0
xor eax, eax
push str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
call fcn.0040c8c9
push 0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x33
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x14
call fcn.004b3b8c
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jb 0x4b694e
mov ecx, dword [ebp - 0x60]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4b6945
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x50], 0
lea ecx, [ebp - 0x78]
xor eax, eax
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x60], ax
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.SharePointOnPremTenantName
lea ecx, [ebp - 0x60]
call fcn.0040c8f2
mov edi, str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x34
push edi
lea ecx, [ebp - 0x78]
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x35
push eax
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x15
call fcn.004b3b8c
lea ecx, [ebp - 0x78]
call fcn.00405795
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x21
call fcn.00405795
mov esi, str.DisableTutorial
lea ecx, [ebp - 0x60]
push esi
call fcn.0040c8f2
push edi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x36
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x78]
mov edi, reloc.WS2_32.dll_accept
push eax
push edi
push 0x16
mov ecx, ebx
call fcn.004b3b8c
lea ecx, [ebp - 0x78]
call fcn.00405795
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x21
call fcn.00405795
push esi
lea ecx, [ebp - 0x60]
call fcn.0040c8f2
push str.SoftwareMicrosoftOneDrive
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x38
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x39
push eax
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
push edi
push 0x16
call fcn.004b3b8c
lea ecx, [ebp - 0x78]
call fcn.00405795
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x60]
call fcn.00405795
mov edi, 0x6609a0
lea ecx, [ebp - 0x78]
push edi
call fcn.0040c8f2
mov esi, str.TenantAutoMount
mov byte [ebp - 4], 0x3a
push esi
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x60]
push eax
call fcn.004ae02d
push 0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x3b
push ecx
push eax
push reloc.WS2_32.dll_accept
push 0x1f
mov ecx, ebx
call fcn.004b3b8c
lea ecx, [ebp - 0x60]
call fcn.00405795
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x21
call fcn.00405795
push edi
lea ecx, [ebp - 0x78]
call fcn.0040c8f2
push esi
mov esi, str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x3c
push esi
lea eax, [ebp - 0x60]
push eax
call fcn.004ae02d
push 0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x3d
push ecx
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
push edi
push 0x1f
call fcn.004b3b8c
lea ecx, [ebp - 0x60]
call fcn.00405795
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.LocalMassDeleteFileDeleteThreshold
lea ecx, [ebp - 0xa8]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x3e
call fcn.0040c8f2
push 0
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 0x3f
push eax
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
push edi
push 0x20
call fcn.004b3b8c
lea ecx, [ebp - 0x78]
call fcn.00405795
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.MinDiskSpaceLimitInMB
lea ecx, [ebp - 0xc0]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x40
call fcn.0040c8f2
push 0
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x41
push eax
lea eax, [ebp - 0xa8]
mov ecx, ebx
push eax
push edi
push 0x23
call fcn.004b3b8c
lea ecx, [ebp - 0xa8]
call fcn.00405795
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.WarningMinDiskSpaceLimitInMB
lea ecx, [ebp - 0xd8]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x42
call fcn.0040c8f2
push 0
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x43
push eax
lea eax, [ebp - 0xc0]
mov ecx, ebx
push eax
push edi
push 0x24
call fcn.004b3b8c
lea ecx, [ebp - 0xc0]
call fcn.00405795
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.ForcedLocalMassDeleteDetection
lea ecx, [ebp - 0xf0]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x44
call fcn.0040c8f2
push 0
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x45
push eax
lea eax, [ebp - 0xd8]
mov ecx, ebx
push eax
push edi
push 0x25
call fcn.004b3b8c
lea ecx, [ebp - 0xd8]
call fcn.00405795
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.PermitDisablePermissionInheritance
lea ecx, [ebp - 0x108]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x46
call fcn.0040c8f2
mov byte [ebp - 4], 0x47
push 0
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
lea eax, [ebp - 0xf0]
push eax
push edi
push 0x26
call fcn.004b3b8c
lea ecx, [ebp - 0xf0]
call fcn.00405795
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.EnableAutomaticUploadBandwidthManagement
lea ecx, [ebp - 0x120]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x48
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x49
push eax
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
push edi
push 0x27
call fcn.004b3b8c
lea ecx, [ebp - 0x108]
call fcn.00405795
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.AADJMachineDomainGuid
lea ecx, [ebp - 0x138]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x4a
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 0x4b
push eax
lea eax, [ebp - 0x120]
mov ecx, ebx
push eax
push edi
push 0x28
call fcn.004b3b8c
lea ecx, [ebp - 0x120]
call fcn.00405795
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.EnableOneNoteSupportPreview
lea ecx, [ebp - 0x210]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x4c
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 0x4d
push eax
lea eax, [ebp - 0x138]
mov ecx, ebx
push eax
push edi
push 0x29
call fcn.004b3b8c
lea ecx, [ebp - 0x138]
call fcn.00405795
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x21
call fcn.00405795
mov esi, str.EnableODIgnoreListFromGPO
lea ecx, [ebp - 0x150]
push esi
call fcn.0040c8f2
push esi
mov esi, str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x4e
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.004ae02d
push 1
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x4f
push ecx
push eax
push edi
push 0x2a
mov ecx, ebx
call fcn.004b3b8c
lea ecx, [ebp - 0x210]
call fcn.00405795
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.SyncAdminReportsPreview
lea ecx, [ebp - 0x168]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x50
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x51
push eax
lea eax, [ebp - 0x150]
mov ecx, ebx
push eax
push edi
push 0x2b
call fcn.004b3b8c
lea ecx, [ebp - 0x150]
call fcn.00405795
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.SyncAdminReports
lea ecx, [ebp - 0x180]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x52
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x53
push eax
lea eax, [ebp - 0x168]
mov ecx, ebx
push eax
push edi
push 0x2c
call fcn.004b3b8c
lea ecx, [ebp - 0x168]
call fcn.00405795
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.EnableSyncAdminReports
lea ecx, [ebp - 0x198]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x54
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x198]
mov byte [ebp - 4], 0x55
push eax
lea eax, [ebp - 0x180]
mov ecx, ebx
push eax
push edi
push 0x2d
call fcn.004b3b8c
lea ecx, [ebp - 0x180]
call fcn.00405795
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.DisableFirstDeleteDialog
lea ecx, [ebp - 0x1b0]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x56
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x1b0]
mov byte [ebp - 4], 0x57
push eax
lea eax, [ebp - 0x198]
mov ecx, ebx
push eax
push edi
push 0x30
call fcn.004b3b8c
lea ecx, [ebp - 0x198]
call fcn.00405795
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.TelemetryUploadUri
lea ecx, [ebp - 0x1c8]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x58
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x59
push eax
lea eax, [ebp - 0x1b0]
mov ecx, ebx
push eax
push edi
push 0x31
call fcn.004b3b8c
lea ecx, [ebp - 0x1b0]
call fcn.00405795
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.DisableFREAnimation
lea ecx, [ebp - 0x1e0]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x5a
call fcn.0040c8f2
mov byte [ebp - 4], 0x5b
push 0
lea eax, [ebp - 0x1e0]
dec edi
push eax
lea eax, [ebp - 0x1c8]
mov ecx, ebx
push eax
push edi
push 0x32
call fcn.004b3b8c
lea ecx, [ebp - 0x1c8]
call fcn.00405795
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.AddedFolderHardDeleteOnUnmount
lea ecx, [ebp - 0x1f8]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x5c
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x1f8]
mov byte [ebp - 4], 0x5d
push eax
lea eax, [ebp - 0x1e0]
mov ecx, ebx
push eax
push edi
push 0x3a
call fcn.004b3b8c
lea ecx, [ebp - 0x1e0]
call fcn.00405795
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x21
call fcn.00405795
push str.AddedFolderUnmountOnPermissionsLoss
lea ecx, [ebp - 0x90]
call fcn.0040c8f2
push esi
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x5e
call fcn.0040c8f2
push 0
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0x5f
push eax
lea eax, [ebp - 0x1f8]
mov ecx, ebx
push eax
push edi
push 0x3b
call fcn.004b3b8c
lea ecx, [ebp - 0x1f8]
call fcn.00405795
lea ecx, [ebp - 0x90]
call fcn.00405795
lea ecx, [ebp - 0x2c]
call fcn.00405795
lea ecx, [ebp - 0x44]
call fcn.00405795
call fcn.004f0607
ret 4