Function at 0x41cac0
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5d29e9
push eax
mov eax, 0xcd50
mov dword fs:[0], esp
call fcn.00454b00
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xcd74]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
mov dword [esp + 0x2c], esi
je 0x41caff
mov ecx, edi
call fcn.0047ebf0
jmp 0x41cb01
xor eax, eax
push eax
mov eax, dword [esp + 0xcd74]
push eax
push str.ParsePolicy_dype_0x_x__Data_size__lu_
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x18
cmp edi, ebx
mov ebp, 2
je 0x41f40c
mov ecx, edi
call fcn.0047ebf0
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.0047f310
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x28], ebx
jbe 0x41f40c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
add ecx, 4
cmp ecx, eax
ja 0x41f3e7
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
mov edi, dword [eax + edx]
lea ecx, [eax + edx]
mov edx, dword [esp + 0x24]
add edi, 4
add eax, edi
mov dword [esp + 0x14], ecx
cmp eax, edx
mov dword [esp + 0x28], eax
ja 0x41f3ee
cmp dword [ecx + 4], 2
jne 0x41f3bc
push str.ParsePolicy_parse_1
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
cmp edi, 0x1d
jbe 0x41cbcd
add edi, 0xffffffe3
cmp edi, 0x50
jb 0x41cbcf
mov eax, dword [esp + 0x14]
add eax, 0x1d
mov dword [esp + 0x18], eax
jmp 0x41cbd3
xor edi, edi
mov dword [esp + 0x18], ebx
lea ecx, [esi + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.0046c220
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x10]
push edx
push eax
push 0xaa
push str.ParsePolicy_line__lu__wstrTempFile__s__username__s__parse_2
push str.CheckModule
push 0xf
push 0x663464
mov dword [esp + 0xcd84], ebx
call fcn.00447850
mov ecx, dword [esp + 0xcd8c]
add esp, 0x1c
lea eax, [ecx - 1]
cmp eax, 0x4f
ja case.0x41cc29.30
xor edx, edx
mov dl, byte [eax + 0x41f4c4]
jmp dword [edx*4 + 0x41f44c]
push str.ParsePolicy_POLICY_TYPE_SD_ONLINE_AUTH
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0xa4b8]
call fcn.004d6a10
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x98a8]
mov byte [esp + 0xcd68], 1
call fcn.004d6a10
push ebp
push ebx
push ebx
push str.SDRightsPolicy
mov byte [esp + 0xcd78], 2
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x98a8]
mov byte [esp + 0xcd68], 1
call fcn.004d7330
lea ecx, [esp + 0x168]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eb0ec
mov dword [esp + 0x17c], ebx
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 3
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ecx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 4
je 0x41ccf3
mov ecx, eax
call fcn.00421230
mov ebp, eax
jmp 0x41ccf5
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 3
je 0x41cd29
mov edx, dword [esp + 0x18]
push edi
push edx
mov ecx, ebp
call fcn.00427190
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
push eax
push ecx
mov ecx, ebp
call fcn.00427300
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eb0ec
lea ecx, [esp + 0x168]
mov byte [esp + 0xcd68], 5
call fcn.004228b0
lea ecx, [esp + 0x168]
mov byte [esp + 0xcd68], 1
call fcn.005b6dfc
lea ecx, [esp + 0xa4b8]
mov byte [esp + 0xcd68], bl
call fcn.004d7330
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SD_OFFLINE_AUTH
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
push 0x18
call fcn.005b83cc
mov esi, eax
add esp, 0x14
mov dword [esp + 0x1c], esi
cmp esi, ebx
mov byte [esp + 0xcd68], 6
je 0x41cdc1
mov ecx, esi
call fcn.005b6dc9
mov dword [esi], method.CPtrArray.virtual_0
mov dword [esi + 0x14], ebx
mov dword [esp + 0x14], esi
jmp 0x41cdc5
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov byte [esp + 0xcd68], bl
cmp eax, ebx
je 0x41ced1
mov ecx, dword [esp + 0x14]
call fcn.004228f0
cmp edi, 0x50
jb 0x41ced1
mov esi, dword [esp + 0x18]
mov dword [esp + 0x20], edi
mov ecx, dword [esi + 0x48]
mov edi, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 0x44]
add ecx, eax
lea edx, [ecx + ecx + 0x54]
cmp edi, edx
jb 0x41ced1
cmp word [esi + eax*2 + 0x50], bx
jne 0x41ceb0
cmp word [esi + ecx*2 + 0x52], bx
jne 0x41ceb0
push 0x5e0
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 7
je 0x41ce4b
mov ecx, eax
call fcn.004e1320
mov edi, eax
jmp 0x41ce4d
xor edi, edi
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov byte [esp + 0xcd68], bl
mov ecx, dword [eax + 0x14]
push ecx
mov ecx, edi
call dword [edx + 0x10]
mov edx, dword [edi]
push esi
mov ecx, edi
call dword [edx + 0x94]
test eax, eax
je 0x41ce7e
mov ecx, dword [esp + 0x14]
push edi
call fcn.0041f540
jmp 0x41ce8a
cmp edi, ebx
je 0x41ce8a
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov edx, dword [esi + 0x48]
xor ecx, ecx
mov cx, word [esi + 0x44]
lea eax, [ecx + edx]
mov edx, 0xffffffac
lea ecx, [eax + eax]
lea esi, [esi + eax*2 + 0x54]
sub edx, ecx
mov ecx, dword [esp + 0x20]
add ecx, edx
mov dword [esp + 0x20], ecx
jmp 0x41cec6
mov edi, dword [esp + 0x20]
lea eax, [ecx + ecx]
mov ecx, 0xffffffac
sub ecx, eax
add edi, ecx
add esi, edx
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], 0x50
jae 0x41cdf2
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call fcn.005b6dc9
lea ecx, [esp + 0x64]
mov byte [esp + 0xcd68], 8
call fcn.005b69e3
mov eax, dword [esp + 0x14]
xor esi, esi
mov byte [esp + 0xcd68], 9
cmp dword [eax + 8], ebx
jle 0x41cf64
mov edx, dword [eax + 4]
mov ecx, dword [edx + esi*4]
cmp ecx, ebx
je 0x41cf54
mov eax, dword [ecx]
call dword [eax + 0x90]
mov edi, eax
lea ecx, [esp + 0x3c]
push edi
call fcn.0041f540
mov ecx, dword [edi + 0x2ec]
lea edx, [ecx + ecx + 0x2f2]
lea ecx, [esp + 0x64]
push edx
call fcn.0041f520
mov eax, dword [edi + 0x2ec]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*2 + 0x2f2]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 8]
inc esi
cmp esi, ecx
jl 0x41cf06
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x41cf8c
lea ecx, [esp + 0x64]
mov byte [esp + 0xcd68], 8
call fcn.005b6a16
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcd68], bl
call fcn.005b6dfc
xor esi, esi
jmp 0x41d05a
push eax
call fcn.005b83cc
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [esp + 0x1c], esi
jne 0x41cfc7
lea ecx, [esp + 0x64]
mov byte [esp + 0xcd68], 8
call fcn.005b6a16
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcd68], bl
call fcn.005b6dfc
xor esi, esi
jmp 0x41d05a
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], esi
cmp eax, ebx
mov dword [esp + 0x18], ebx
jle 0x41d031
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x14]
mov ecx, dword [ecx + eax*4]
mov esi, dword [edx + eax*4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + eax*4]
mov ecx, dword [esp + 0x14]
add ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + eax*4]
push eax
call fcn.005b83f5
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
add esp, 4
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x41cfd7
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x64]
mov dword [esp + 0x18], edx
mov byte [esp + 0xcd68], 8
call fcn.005b6a16
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcd68], bl
call fcn.005b6dfc
lea ecx, [esp + 0x50]
call fcn.005b669a
mov edi, dword [esp + 0x18]
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x58]
mov byte [esp + 0xcd70], 0xa
call fcn.005b66fa
mov ecx, edi
mov edi, dword [esp + 0x54]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.004211b0
cmp eax, ebx
je 0x41d175
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0047e0d0
add esp, 0xc
lea ecx, [esp + 0x92c8]
mov byte [esp + 0xcd68], 0xb
call fcn.004e1320
mov edx, dword [0x5f1614]
mov dword [esp + 0x30], edx
push str.SDOfflinePolicy
lea eax, [esp + 0x34]
push str._s_2
push eax
mov byte [esp + 0xcd74], 0xd
call fcn.0046fcb0
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x40]
mov eax, dword [ecx + 8]
mov ecx, dword [esp + 0x44]
push ecx
push eax
push edx
call fcn.004a9700
add esp, 0x1c
mov esi, eax
mov eax, dword [esp + 0x58]
push esi
push eax
push str.ParsePolicy_POLICY_TYPE_SD_OFFLINE_AUTH_size_0x_x__WriteIniString
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x18
cmp esi, ebx
je 0x41d13f
mov ebp, 1
lea ecx, [esp + 0x30]
mov byte [esp + 0xcd68], 0xc
call fcn.0046cca0
lea ecx, [esp + 0x92c8]
mov byte [esp + 0xcd68], 0xb
call fcn.004e18d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xcd68], 0xa
call fcn.0046cca0
lea ecx, [esp + 0x50]
mov byte [esp + 0xcd68], bl
call fcn.005b66cd
mov esi, dword [esp + 0x2c]
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SD_AGENT_CONFIG
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x2fd0]
call fcn.004eb880
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x58f0]
mov byte [esp + 0xcd68], 0xe
call fcn.004eb880
push ebp
push ebx
push ebx
push str.SDParamPolicy
mov byte [esp + 0xcd78], 0xf
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x58f0]
mov byte [esp + 0xcd68], 0xe
call fcn.0041f8f0
lea ecx, [esp + 0x210]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eb0d4
mov dword [esp + 0x224], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x10
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x11
je 0x41d251
mov ecx, eax
call fcn.004212e0
mov ebp, eax
jmp 0x41d253
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x10
je 0x41d287
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00427590
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00427700
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eb0d4
lea ecx, [esp + 0x210]
mov byte [esp + 0xcd68], 0x12
call fcn.00422930
lea ecx, [esp + 0x210]
mov byte [esp + 0xcd68], 0xe
call fcn.005b6dfc
lea ecx, [esp + 0x3308]
mov byte [esp + 0xcd68], 0x14
call fcn.004739c0
lea ecx, [esp + 0x32f8]
mov byte [esp + 0xcd68], 0x13
call fcn.004739c0
lea ecx, [esp + 0x2fd0]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_AGENT_CONFIG
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x1ec0]
call fcn.004c6e00
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x5580]
mov byte [esp + 0xcd68], 0x15
call fcn.004c6e00
push ebp
push ebx
push ebx
push str.ConfigPolicy
mov byte [esp + 0xcd78], 0x16
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x5580]
mov byte [esp + 0xcd68], 0x15
call fcn.0041f950
lea ecx, [esp + 0xd8]
call fcn.005b6dc9
mov dword [esp + 0xd8], 0x5eb0c8
mov dword [esp + 0xec], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x17
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x18
je 0x41d3c2
mov ecx, eax
call fcn.00421390
mov ebp, eax
jmp 0x41d3c4
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x17
je 0x41d3f8
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.004279c0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00427b30
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xd8], 0x5eb0c8
lea ecx, [esp + 0xd8]
mov byte [esp + 0xcd68], 0x19
call fcn.00422970
lea ecx, [esp + 0xd8]
mov byte [esp + 0xcd68], 0x15
call fcn.005b6dfc
lea ecx, [esp + 0x221c]
mov byte [esp + 0xcd68], 0x1d
call fcn.004739c0
lea ecx, [esp + 0x2208]
mov byte [esp + 0xcd68], 0x1c
call fcn.005b6a16
lea ecx, [esp + 0x21f8]
mov byte [esp + 0xcd68], 0x1b
call fcn.004739c0
lea ecx, [esp + 0x21e8]
mov byte [esp + 0xcd68], 0x1a
call fcn.004739c0
lea ecx, [esp + 0x1ec0]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SD_SAFE_COMM
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x2590]
call fcn.004f0b70
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x6020]
mov byte [esp + 0xcd68], 0x1e
call fcn.004f0b70
push ebp
push ebx
push ebx
push str.SDGatewayPolicy
mov byte [esp + 0xcd78], 0x1f
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x6020]
mov byte [esp + 0xcd68], 0x1e
call fcn.0041f9d0
lea ecx, [esp + 0x1c8]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eb0bc
mov dword [esp + 0x1dc], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x20
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x21
je 0x41d55b
mov ecx, eax
call fcn.00421440
mov ebp, eax
jmp 0x41d55d
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x20
je 0x41d591
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00427e10
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00427f80
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eb0bc
lea ecx, [esp + 0x1c8]
mov byte [esp + 0xcd68], 0x22
call fcn.004229b0
lea ecx, [esp + 0x1c8]
mov byte [esp + 0xcd68], 0x1e
call fcn.005b6dfc
lea ecx, [esp + 0x28fc]
mov byte [esp + 0xcd68], 0x25
call fcn.00423800
lea ecx, [esp + 0x28e0]
mov byte [esp + 0xcd68], 0x24
call fcn.00423a00
lea ecx, [esp + 0x28b8]
mov byte [esp + 0xcd68], 0x23
call fcn.00420bf0
lea ecx, [esp + 0x2590]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_BASIC
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x1b80]
call fcn.005261e0
lea ecx, [esp + 0x1ea8]
mov byte [esp + 0xcd68], 0x26
call fcn.004bd620
mov dword [esp + 0x1b80], 0x5eafec
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x4e80]
mov byte [esp + 0xcd68], 0x27
call fcn.0041faf0
push ebp
push ebx
push ebx
push str.BasicPolicy
mov byte [esp + 0xcd78], 0x28
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x4e80]
mov byte [esp + 0xcd68], 0x27
call fcn.0041fb40
lea ecx, [esp + 0x108]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eafe0
mov dword [esp + 0x11c], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x29
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x2a
je 0x41d6ff
mov ecx, eax
call fcn.004214f0
mov ebp, eax
jmp 0x41d701
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x29
je 0x41d735
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.004282a0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00428430
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eafe0
lea ecx, [esp + 0x108]
mov byte [esp + 0xcd68], 0x2b
call fcn.004229f0
lea ecx, [esp + 0x108]
mov byte [esp + 0xcd68], 0x27
call fcn.005b6dfc
lea ecx, [esp + 0x1ea8]
mov byte [esp + 0xcd68], 0x2c
call fcn.004bd660
lea ecx, [esp + 0x1b80]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_APP
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x2230]
call fcn.005261e0
lea ecx, [esp + 0x2558]
mov byte [esp + 0xcd68], 0x2d
call fcn.004bda20
mov dword [esp + 0x2230], 0x5eaf10
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x82f0]
mov byte [esp + 0xcd68], 0x2e
call fcn.0041fb90
push ebp
push ebx
push ebx
push str.AppPolicy
mov byte [esp + 0xcd78], 0x2f
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x82f0]
mov byte [esp + 0xcd68], 0x2e
call fcn.0041fbe0
lea ecx, [esp + 0x198]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eaf04
mov dword [esp + 0x1ac], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x30
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x31
je 0x41d87b
mov ecx, eax
call fcn.004215a0
mov ebp, eax
jmp 0x41d87d
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x30
je 0x41d8b1
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00428710
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.004288a0
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eaf04
lea ecx, [esp + 0x198]
mov byte [esp + 0xcd68], 0x32
call fcn.00422a30
lea ecx, [esp + 0x198]
mov byte [esp + 0xcd68], 0x2e
call fcn.005b6dfc
lea ecx, [esp + 0x2558]
mov byte [esp + 0xcd68], 0x33
call fcn.0041f890
lea ecx, [esp + 0x2230]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_WEB
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0xcf8]
call fcn.005261e0
lea ecx, [esp + 0x1020]
mov byte [esp + 0xcd68], 0x34
call fcn.005b69e3
lea ecx, [esp + 0x1034]
mov byte [esp + 0xcd68], 0x35
call fcn.004739b0
lea ecx, [esp + 0x1044]
mov byte [esp + 0xcd68], 0x36
call fcn.004bda20
mov dword [esp + 0xcf8], 0x5eae34
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7490]
mov byte [esp + 0xcd68], 0x37
call fcn.0041fc60
push ebp
push ebx
push ebx
push str.UrlPolicy
mov byte [esp + 0xcd78], 0x38
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x7490]
mov byte [esp + 0xcd68], 0x37
call fcn.0041fcd0
lea ecx, [esp + 0x138]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eae28
mov dword [esp + 0x14c], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x39
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x3a
je 0x41da1f
mov ecx, eax
call fcn.00421650
mov ebp, eax
jmp 0x41da21
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x39
je 0x41da55
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00428bb0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00428d60
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eae28
lea ecx, [esp + 0x138]
mov byte [esp + 0xcd68], 0x3b
call fcn.00422a70
lea ecx, [esp + 0x138]
mov byte [esp + 0xcd68], 0x37
call fcn.005b6dfc
lea ecx, [esp + 0x1044]
mov byte [esp + 0xcd68], 0x3e
call fcn.0041f890
lea ecx, [esp + 0x1034]
mov byte [esp + 0xcd68], 0x3d
call fcn.004739c0
lea ecx, [esp + 0x1020]
mov byte [esp + 0xcd68], 0x3c
call fcn.005b6a16
lea ecx, [esp + 0xcf8]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_DEVICE
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x2c78]
call fcn.004bfd50
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x6710]
mov byte [esp + 0xcd68], 0x3f
call fcn.004bfd50
push ebp
push ebx
push ebx
push str.DevicePolicy
mov byte [esp + 0xcd78], 0x40
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x6710]
mov byte [esp + 0xcd68], 0x3f
call fcn.0041fd70
lea ecx, [esp + 0x1f8]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eae1c
mov dword [esp + 0x20c], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x41
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x42
je 0x41dba4
mov ecx, eax
call fcn.00421700
mov ebp, eax
jmp 0x41dba6
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x41
je 0x41dbda
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.004290c0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429230
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eae1c
lea ecx, [esp + 0x1f8]
mov byte [esp + 0xcd68], 0x43
call fcn.00422ab0
lea ecx, [esp + 0x1f8]
mov byte [esp + 0xcd68], 0x3f
call fcn.005b6dfc
lea ecx, [esp + 0x2fc8]
mov byte [esp + 0xcd68], 0x46
call fcn.0046cca0
lea ecx, [esp + 0x2fb8]
mov byte [esp + 0xcd68], 0x45
call fcn.004739c0
lea ecx, [esp + 0x2fa0]
mov byte [esp + 0xcd68], 0x44
call fcn.004bd660
lea ecx, [esp + 0x2c78]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_PRINT
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x51c0]
call fcn.004c00b0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7810]
mov byte [esp + 0xcd68], 0x47
call fcn.004c00b0
push ebp
push ebx
push ebx
push str.PrintPolicy
mov byte [esp + 0xcd78], 0x48
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x7810]
mov byte [esp + 0xcd68], 0x47
call fcn.004c01f0
lea ecx, [esp + 0xa8]
call fcn.005b6dc9
mov dword [esp + 0xa8], 0x5eae10
mov dword [esp + 0xbc], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x49
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x4a
je 0x41dd29
mov ecx, eax
call fcn.004217b0
mov ebp, eax
jmp 0x41dd2b
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x49
je 0x41dd5f
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00429500
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429670
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xa8], 0x5eae10
lea ecx, [esp + 0xa8]
mov byte [esp + 0xcd68], 0x4b
call fcn.00422af0
lea ecx, [esp + 0xa8]
mov byte [esp + 0xcd68], 0x47
call fcn.005b6dfc
lea ecx, [esp + 0x51c0]
mov byte [esp + 0xcd68], bl
call fcn.004c01f0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SNAPSHOT
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x4450]
call fcn.004c0e00
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7130]
mov byte [esp + 0xcd68], 0x4c
call fcn.004c0e00
push ebp
push ebx
push ebx
push str.SnapshotPolicy
mov byte [esp + 0xcd78], 0x4d
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x7130]
mov byte [esp + 0xcd68], 0x4c
call fcn.0041fde0
lea ecx, [esp + 0xc0]
call fcn.005b6dc9
mov dword [esp + 0xc0], 0x5eae04
mov dword [esp + 0xd4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x4e
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x4f
je 0x41de72
mov ecx, eax
call fcn.00421860
mov ebp, eax
jmp 0x41de74
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x4e
je 0x41dea8
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00429900
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429a70
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xc0], 0x5eae04
lea ecx, [esp + 0xc0]
mov byte [esp + 0xcd68], 0x50
call fcn.00422b30
lea ecx, [esp + 0xc0]
mov byte [esp + 0xcd68], 0x4c
call fcn.005b6dfc
lea ecx, [esp + 0x4778]
mov byte [esp + 0xcd68], 0x51
call fcn.0041f890
lea ecx, [esp + 0x4450]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_LOG
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x300]
call fcn.004c0f70
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0xaae8]
mov byte [esp + 0xcd68], 0x52
call fcn.004c0f70
push ebp
push ebx
push ebx
push str.LogPolicy
mov byte [esp + 0xcd78], 0x53
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0xaae8]
mov byte [esp + 0xcd68], 0x52
call fcn.0041fe60
lea ecx, [esp + 0xf0]
call fcn.005b6dc9
mov dword [esp + 0xf0], 0x5eadf8
mov dword [esp + 0x104], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x54
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x55
je 0x41dfcf
mov ecx, eax
call fcn.00421910
mov ebp, eax
jmp 0x41dfd1
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x54
je 0x41e005
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00429d50
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429ec0
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xf0], 0x5eadf8
lea ecx, [esp + 0xf0]
mov byte [esp + 0xcd68], 0x56
call fcn.00422b70
lea ecx, [esp + 0xf0]
mov byte [esp + 0xcd68], 0x52
call fcn.005b6dfc
lea ecx, [esp + 0x85c]
mov byte [esp + 0xcd68], 0x6b
call fcn.004739c0
lea ecx, [esp + 0x84c]
mov byte [esp + 0xcd68], 0x6a
call fcn.004739c0
lea ecx, [esp + 0x834]
mov byte [esp + 0xcd68], 0x69
call fcn.004bd660
lea ecx, [esp + 0x81c]
mov byte [esp + 0xcd68], 0x68
call fcn.004bd660
lea ecx, [esp + 0x804]
mov byte [esp + 0xcd68], 0x67
call fcn.004bd660
lea ecx, [esp + 0x7e4]
mov byte [esp + 0xcd68], 0x66
call fcn.004bd660
lea ecx, [esp + 0x7d4]
mov byte [esp + 0xcd68], 0x65
call fcn.004739c0
lea ecx, [esp + 0x7c0]
mov byte [esp + 0xcd68], 0x64
call fcn.004739c0
lea ecx, [esp + 0x798]
mov byte [esp + 0xcd68], 0x63
call fcn.004739c0
lea ecx, [esp + 0x788]
mov byte [esp + 0xcd68], 0x62
call fcn.004739c0
lea ecx, [esp + 0x774]
mov byte [esp + 0xcd68], 0x61
call fcn.005b6a16
lea ecx, [esp + 0x760]
mov byte [esp + 0xcd68], 0x60
call fcn.00422d70
lea ecx, [esp + 0x750]
mov byte [esp + 0xcd68], 0x5f
call fcn.004739c0
lea ecx, [esp + 0x71c]
mov byte [esp + 0xcd68], 0x5e
call fcn.0041f890
lea ecx, [esp + 0x6e4]
mov byte [esp + 0xcd68], 0x5d
call fcn.0041f890
lea ecx, [esp + 0x6d4]
mov byte [esp + 0xcd68], 0x5c
call fcn.004739c0
lea ecx, [esp + 0x6c0]
mov byte [esp + 0xcd68], 0x5b
call fcn.004739c0
lea ecx, [esp + 0x6ac]
mov byte [esp + 0xcd68], 0x5a
call fcn.005b6a16
lea ecx, [esp + 0x678]
mov byte [esp + 0xcd68], 0x59
call fcn.0041f890
lea ecx, [esp + 0x644]
mov byte [esp + 0xcd68], 0x58
call fcn.0041f890
lea ecx, [esp + 0x628]
mov byte [esp + 0xcd68], 0x57
call fcn.004bd660
lea ecx, [esp + 0x300]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_REMOTE_CONTROL
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x2910]
call fcn.004c2380
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x6dc8]
mov byte [esp + 0xcd68], 0x6c
call fcn.004c2380
push ebp
push ebx
push ebx
push str.RemoteControlPolicy
mov byte [esp + 0xcd78], 0x6d
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x6dc8]
mov byte [esp + 0xcd68], 0x6c
call fcn.00420090
lea ecx, [esp + 0x120]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadec
mov dword [esp + 0x134], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x6e
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x6f
je 0x41e2bc
mov ecx, eax
call fcn.004219c0
mov ebp, eax
jmp 0x41e2be
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x6e
je 0x41e2f2
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042a360
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042a4d0
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadec
lea ecx, [esp + 0x120]
mov byte [esp + 0xcd68], 0x70
call fcn.00422bb0
lea ecx, [esp + 0x120]
mov byte [esp + 0xcd68], 0x6c
call fcn.005b6dfc
lea ecx, [esp + 0x2c64]
mov byte [esp + 0xcd68], 0x73
call fcn.00422d70
lea ecx, [esp + 0x2c54]
mov byte [esp + 0xcd68], 0x72
call fcn.004739c0
lea ecx, [esp + 0x2c44]
mov byte [esp + 0xcd68], 0x71
call fcn.004739c0
lea ecx, [esp + 0x2910]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_IMFILE
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x3318]
call fcn.004c41e0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x63a0]
mov byte [esp + 0xcd68], 0x74
call fcn.004c41e0
push ebp
push ebx
push ebx
push str.IMFilePolicy
mov byte [esp + 0xcd78], 0x75
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x63a0]
mov byte [esp + 0xcd68], 0x74
call fcn.00420120
lea ecx, [esp + 0x150]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eade0
mov dword [esp + 0x164], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x76
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x77
je 0x41e441
mov ecx, eax
call fcn.00421a70
mov ebp, eax
jmp 0x41e443
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x76
je 0x41e477
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042a7c0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042a930
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eade0
lea ecx, [esp + 0x150]
mov byte [esp + 0xcd68], 0x78
call fcn.00422bf0
lea ecx, [esp + 0x150]
mov byte [esp + 0xcd68], 0x74
call fcn.005b6dfc
lea ecx, [esp + 0x365c]
mov byte [esp + 0xcd68], 0x7a
call fcn.004739c0
lea ecx, [esp + 0x3644]
mov byte [esp + 0xcd68], 0x79
call fcn.004bd660
lea ecx, [esp + 0x3318]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_IMFILE
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x17e8]
call fcn.004c2e60
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7f58]
mov byte [esp + 0xcd68], 0x7b
call fcn.004c2e60
push ebp
push ebx
push ebx
push str.NetTrafficPolicy
mov byte [esp + 0xcd78], 0x7c
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x7f58]
mov byte [esp + 0xcd68], 0x7b
call fcn.00420180
lea ecx, [esp + 0x180]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadd4
mov dword [esp + 0x194], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x7d
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x7e
je 0x41e5b2
mov ecx, eax
call fcn.00421b20
mov ebp, eax
jmp 0x41e5b4
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x7d
je 0x41e5e8
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042abf0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042ad60
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadd4
lea ecx, [esp + 0x180]
mov byte [esp + 0xcd68], 0x7f
call fcn.00422c30
lea ecx, [esp + 0x180]
mov byte [esp + 0xcd68], 0x7b
call fcn.005b6dfc
lea ecx, [esp + 0x1b60]
mov byte [esp + 0xcd68], 0x84
call fcn.004231c0
lea ecx, [esp + 0x1b4c]
mov byte [esp + 0xcd68], 0x83
call fcn.005b6a16
lea ecx, [esp + 0x1b38]
mov byte [esp + 0xcd68], 0x82
call fcn.00422d70
lea ecx, [esp + 0x1b24]
mov byte [esp + 0xcd68], 0x81
call fcn.00422f70
lea ecx, [esp + 0x1b10]
mov byte [esp + 0xcd68], 0x80
call fcn.005b6a16
lea ecx, [esp + 0x17e8]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_NETWORK
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x1078]
call fcn.004c3450
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x5c38]
mov byte [esp + 0xcd68], 0x85
call fcn.004c3450
push ebp
push ebx
push ebx
push str.NetControlPolicy
mov byte [esp + 0xcd78], 0x86
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x5c38]
mov byte [esp + 0xcd68], 0x85
call fcn.00420280
lea ecx, [esp + 0x1b0]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadc8
mov dword [esp + 0x1c4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x87
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x88
je 0x41e75f
mov ecx, eax
call fcn.00421bd0
mov ebp, eax
jmp 0x41e761
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x87
je 0x41e795
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042b0e0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042b250
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadc8
lea ecx, [esp + 0x1b0]
mov byte [esp + 0xcd68], 0x89
call fcn.00422c70
lea ecx, [esp + 0x1b0]
mov byte [esp + 0xcd68], 0x85
call fcn.005b6dfc
lea ecx, [esp + 0x142c]
mov byte [esp + 0xcd68], 0x90
call fcn.0041f890
lea ecx, [esp + 0x1408]
mov byte [esp + 0xcd68], 0x8f
call fcn.005b6a16
lea ecx, [esp + 0x13f0]
mov byte [esp + 0xcd68], 0x8e
call fcn.004231c0
lea ecx, [esp + 0x13dc]
mov byte [esp + 0xcd68], 0x8d
call fcn.005b6a16
lea ecx, [esp + 0x13c8]
mov byte [esp + 0xcd68], 0x8c
call fcn.00422d70
lea ecx, [esp + 0x13b4]
mov byte [esp + 0xcd68], 0x8b
call fcn.00422f70
lea ecx, [esp + 0x13a0]
mov byte [esp + 0xcd68], 0x8a
call fcn.005b6a16
lea ecx, [esp + 0x1078]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_MAIL
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x1460]
call fcn.004c3cb0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7bd0]
mov byte [esp + 0xcd68], 0x91
call fcn.004c3cb0
push ebp
push ebx
push ebx
push str.MailPolicy
mov byte [esp + 0xcd78], 0x92
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x7bd0]
mov byte [esp + 0xcd68], 0x91
call fcn.004203c0
lea ecx, [esp + 0x90]
call fcn.005b6dc9
mov dword [esp + 0x90], 0x5eadbc
mov dword [esp + 0xa4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x93
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x94
je 0x41e934
mov ecx, eax
call fcn.00421c80
mov ebp, eax
jmp 0x41e936
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x93
je 0x41e96a
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042b620
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042b790
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0x90], 0x5eadbc
lea ecx, [esp + 0x90]
mov byte [esp + 0xcd68], 0x95
call fcn.00422cb0
lea ecx, [esp + 0x90]
mov byte [esp + 0xcd68], 0x91
call fcn.005b6dfc
lea ecx, [esp + 0x17d4]
mov byte [esp + 0xcd68], 0x9a
call fcn.00422d70
lea ecx, [esp + 0x17bc]
mov byte [esp + 0xcd68], 0x99
call fcn.004739c0
lea ecx, [esp + 0x17ac]
mov byte [esp + 0xcd68], 0x98
call fcn.004739c0
lea ecx, [esp + 0x1798]
mov byte [esp + 0xcd68], 0x97
call fcn.004739c0
lea ecx, [esp + 0x1788]
mov byte [esp + 0xcd68], 0x96
call fcn.004739c0
lea ecx, [esp + 0x1460]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_UPDOWN
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x870]
call fcn.004c4720
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x8e40]
mov byte [esp + 0xcd68], 0x9b
call fcn.004c4720
push ebp
push ebx
push ebx
push str.UpDownPolicy
mov byte [esp + 0xcd78], 0x9c
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x8e40]
mov byte [esp + 0xcd68], 0x9b
call fcn.00420470
lea ecx, [esp + 0x1e0]
call fcn.005b6dc9
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadb0
mov dword [esp + 0x1f4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcd6c], 0x9d
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005b83cc
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcd68], 0x9e
je 0x41eae1
mov ecx, eax
call fcn.00421d30
mov ebp, eax
jmp 0x41eae3
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcd68], 0x9d
je 0x41eb17
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042baa0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042bc10
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eadb0
lea ecx, [esp + 0x1e0]
mov byte [esp + 0xcd68], 0x9f
call fcn.00422cf0
lea ecx, [esp + 0x1e0]
mov byte [esp + 0xcd68], 0x9b
call fcn.005b6dfc
lea ecx, [esp + 0xce4]
mov byte [esp + 0xcd68], 0xaf
call fcn.005b6a16
lea ecx, [esp + 0xcd0]
mov byte [esp + 0xcd68], 0xae
call fcn.005b6a16
lea ecx, [esp + 0xcc0]
mov byte [esp + 0xcd68], 0xad
call fcn.004739c0
lea ecx, [esp + 0xcac]
mov byte [esp + 0xcd68], 0xac
call fcn.004231c0
lea ecx, [esp + 0xc98]
mov byte [esp + 0xcd68], 0xab
call fcn.005b6a16
lea ecx, [esp + 0xc78]
mov byte [esp + 0xcd68], 0xaa
call fcn.005b6a16
lea ecx, [esp + 0xc64]
mov byte [esp + 0xcd68], 0xa9
call fcn.005b6a16
lea ecx, [esp + 0xc50]
mov byte [esp + 0xcd68], 0xa8
call fcn.004739c0
lea ecx, [esp + 0xc3c]
mov byte [esp + 0xcd68], 0xa7
call fcn.00422d70
lea ecx, [esp + 0xc38]
mov byte [esp + 0xcd68], 0xa6
call fcn.0046cca0
lea ecx, [esp + 0xc28]
mov byte [esp + 0xcd68], 0xa5
call fcn.004739c0
lea ecx, [esp + 0xc08]
mov byte [esp + 0xcd68], 0xa4
call fcn.005b6a16
lea ecx, [esp + 0xbf4]
mov byte [esp + 0xcd68], 0xa3
call fcn.005b6a16
lea ecx, [esp + 0xbf0]
mov byte [esp + 0xcd68], 0xa2
call fcn.0046cca0
lea ecx, [esp + 0xbe0]
mov byte [esp + 0xcd68], 0xa1
call fcn.004739c0
lea ecx, [esp + 0xb9c]
mov byte [esp + 0xcd68], 0xa0
call fcn.0041f890
lea ecx, [esp + 0x870]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_IDS
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x6a68]
call fcn.004c5d20
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x8650]
mov byte [esp + 0xcd68], 0xb0
call fcn.004c5d20
push ebp
push ebx
push ebx
push str.IDSPolicy
mov byte [esp + 0xcd78], 0xb1
call fcn.004a9700
add esp, 0x10
lea ecx, [esp + 0x8650]
mov byte [esp + 0xcd68], 0xb0
call fcn.00420600
lea ecx, [esp + 0x78]
call fcn.005b6dc9
mov dword [esp + 0x78], 0x5eada4
mov dword [esp + 0x8c], ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x84]
push edx
push eax
mov byte [esp + 0xcd7c], 0xb2
call fcn.004243e0
add esp, 0x14
mov ebp, 1
mov dword [esp + 0x78], 0x5eada4
lea ecx, [esp + 0x78]
mov byte [esp + 0xcd68], 0xb3
call fcn.00422d30
lea ecx, [esp + 0x78]
mov byte [esp + 0xcd68], 0xb0
call fcn.005b6dfc
lea ecx, [esp + 0x6a68]
mov byte [esp + 0xcd68], bl
call fcn.00420600
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_DOC
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x3688]
call fcn.004c59d0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3688]
push ecx
push edx
mov byte [esp + 0xcd70], 0xb4
call fcn.00424730
add esp, 8
lea ecx, [esp + 0x2d0]
call fcn.00421e70
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2dc]
push edx
push eax
mov byte [esp + 0xcd7c], 0xb5
call fcn.00424810
add esp, 0x14
lea ecx, [esp + 0x2d0]
mov ebp, 1
mov byte [esp + 0xcd68], 0xb4
call fcn.00421e90
lea ecx, [esp + 0x3688]
mov byte [esp + 0xcd68], bl
call fcn.00420690
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SYSALERT
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x47b0]
call fcn.004c2720
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x47b0]
push ecx
push edx
mov byte [esp + 0xcd70], 0xb6
call fcn.00424b60
add esp, 8
lea ecx, [esp + 0x270]
call fcn.00421f20
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x27c]
push edx
push eax
mov byte [esp + 0xcd7c], 0xb7
call fcn.00424c10
add esp, 0x14
lea ecx, [esp + 0x270]
mov ebp, 1
mov byte [esp + 0xcd68], 0xb6
call fcn.00421f40
lea ecx, [esp + 0x47b0]
mov byte [esp + 0xcd68], bl
call fcn.00420720
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_UDISK
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x3d48]
call fcn.004c6230
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3d48]
push ecx
push edx
mov byte [esp + 0xcd70], 0xb8
call fcn.00424f20
add esp, 8
lea ecx, [esp + 0x2e8]
call fcn.00421fd0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2f4]
push edx
push eax
mov byte [esp + 0xcd7c], 0xb9
call fcn.00425030
add esp, 0x14
lea ecx, [esp + 0x2e8]
mov ebp, 1
mov byte [esp + 0xcd68], 0xb8
call fcn.00421ff0
lea ecx, [esp + 0x3d48]
mov byte [esp + 0xcd68], bl
call fcn.00420780
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SEC_CONFIG
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x40e0]
call fcn.004ef760
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x40e0]
push ecx
push edx
mov byte [esp + 0xcd70], 0xba
call fcn.004253b0
add esp, 8
lea ecx, [esp + 0x288]
call fcn.00422080
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x294]
push edx
push eax
mov byte [esp + 0xcd7c], 0xbb
call fcn.00425430
add esp, 0x14
lea ecx, [esp + 0x288]
mov ebp, 1
mov byte [esp + 0xcd68], 0xba
call fcn.004220a0
lea ecx, [esp + 0x40e0]
mov byte [esp + 0xcd68], bl
call fcn.005262e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_PRINTPAGE
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0xb058]
call fcn.004c7440
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xb058]
push ecx
push edx
mov byte [esp + 0xcd70], 0xbc
call fcn.00425720
add esp, 8
lea ecx, [esp + 0x2a0]
call fcn.00422130
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2ac]
push edx
push eax
mov byte [esp + 0xcd7c], 0xbd
call fcn.004257a0
add esp, 0x14
lea ecx, [esp + 0x2a0]
mov ebp, 1
mov byte [esp + 0xcd68], 0xbc
call fcn.00422150
lea ecx, [esp + 0xb058]
mov byte [esp + 0xcd68], bl
call fcn.004c76c0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_GENERAL
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
mov ebp, 3
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_UDISK_REGISTER_CONTROL
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x4b30]
call fcn.004f6de0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x4b30]
push ecx
push edx
mov byte [esp + 0xcd70], 0xbe
call fcn.00425a90
add esp, 8
lea ecx, [esp + 0x258]
call fcn.004221e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x264]
push edx
push eax
mov byte [esp + 0xcd7c], 0xbf
call fcn.00425b80
add esp, 0x14
lea ecx, [esp + 0x258]
mov ebp, 1
mov byte [esp + 0xcd68], 0xbe
call fcn.00422200
lea ecx, [esp + 0x4b30]
mov byte [esp + 0xcd68], bl
call fcn.00420850
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_SOFT_INSTALL_CONTROL_or_POLICY_TYPE_SOFT_UNINSTALL_CONTROL
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x89b0]
call fcn.0041f590
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x89b0]
push ecx
push edx
mov byte [esp + 0xcd70], 0xc0
call fcn.00425ed0
add esp, 8
lea ecx, [esp + 0x228]
call fcn.00422290
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x234]
push edx
push eax
mov byte [esp + 0xcd7c], 0xc1
call fcn.00426190
add esp, 0x14
lea ecx, [esp + 0x228]
mov ebp, 1
mov byte [esp + 0xcd68], 0xc0
call fcn.004222b0
lea ecx, [esp + 0x89b0]
mov byte [esp + 0xcd68], bl
call fcn.004f8c30
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_AUTH_REQUEST
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x9ed8]
call fcn.004fca00
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x9ed8]
push ecx
push edx
mov byte [esp + 0xcd70], 0xc2
call fcn.00426480
add esp, 8
lea ecx, [esp + 0x2b8]
call fcn.00422340
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2c4]
push edx
push eax
mov byte [esp + 0xcd7c], 0xc3
call fcn.00426880
add esp, 0x14
lea ecx, [esp + 0x2b8]
mov ebp, 1
mov byte [esp + 0xcd68], 0xc2
call fcn.00422360
lea ecx, [esp + 0x9ed8]
mov byte [esp + 0xcd68], bl
call fcn.004208e0
jmp 0x41f3a6
push str.ParsePolicy_POLICY_TYPE_TDS
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
lea ecx, [esp + 0x3a08]
call fcn.004f72c0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3a08]
push ecx
push edx
mov byte [esp + 0xcd70], 0xc4
call fcn.00426ce0
add esp, 8
lea ecx, [esp + 0x240]
call fcn.004223f0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x24c]
push edx
push eax
mov byte [esp + 0xcd7c], 0xc5
call fcn.00426d60
add esp, 0x14
lea ecx, [esp + 0x240]
mov ebp, 1
mov byte [esp + 0xcd68], 0xc4
call fcn.00422410
lea ecx, [esp + 0x3a08]
mov byte [esp + 0xcd68], bl
call fcn.004f7330
jmp 0x41f3a6
push ecx
push str.ParsePolicy_type_0x_x__unsupported_
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x14
lea ecx, [esp + 0x10]
mov dword [esp + 0xcd68], 0xffffffff
call fcn.0046cca0
jmp 0x41f3d5
push str.ParsePolicy_user_policy_unsupported_
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x10
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jb 0x41cb56
jmp 0x41f40c
push 0x90
jmp 0x41f3f3
push 0x99
push str.ParsePolicy_line__lu__break
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
add esp, 0x14
mov edx, dword [esp + 0xcd70]
push ebp
push edx
push str.ParsePolicy_type_0x_x__ret_0x_x_
push str.CheckModule
push 0xf
push 0x663464
call fcn.00447850
mov ecx, dword [esp + 0xcd78]
add esp, 0x18
mov eax, ebp
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcd5c
ret 8