Function at 0x4e6900
Capabilities:
Manipulate safe mode programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51305b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
lea ecx, [ebp - 0x3c]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 3
push 0x5a035c
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e69e1
push 0x5a0374
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e69e1
push 0x5a0394
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e69e1
push 0x5a03ac
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e69e1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.0051046c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0051046c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call sub.MFC42.DLL_CString::CString
jmp 0x4e8e00
push 0x5b78a4
push str._sSYSTEMCurrentControlSetControlSafeBoot
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a03f4
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.cmd.exe
push 0x54
push str.AlternateShell
push str.SYSTEMCurrentControlSetControlSafeBoot
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a0448
push str.SYSTEMCurrentControlSetControlSafeBootMinimal
push 0x80000002
lea eax, [ebp - 0x240]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x248]
mov dword [ebp - 0x24c], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x24c]
push edx
lea ecx, [ebp - 0x3c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x240]
call sub.MFC42.DLL_CString::CString
push 0x5a0480
push str.SYSTEMCurrentControlSetControlSafeBootNetwork
push 0x80000002
lea eax, [ebp - 0x244]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x254], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x254]
push edx
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call sub.MFC42.DLL_CString::CString
push 0x5a04b8
lea ecx, [ebp - 0x3c]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e6bbe
push 0x5a04c0
lea ecx, [ebp - 0x38]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e6bbe
push 0x5a04c8
push 0x54
push 0x5a04d4
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E967_E325_11CE_BFC1_08002BE10318
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a0534
push 0x54
push 0x5a0540
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E967_E325_11CE_BFC1_08002BE10318
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a05a0
push 0x54
push 0x5a05c0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E969_E325_11CE_BFC1_08002BE10318
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a0620
push 0x54
push 0x5a0640
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E969_E325_11CE_BFC1_08002BE10318
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.0051046c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0051046c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call sub.MFC42.DLL_CString::CString
jmp 0x4e8e00
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a06a0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a06a8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a06b0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a06b8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a06c8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a06dc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a06ec
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0700
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0710
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a071c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0724
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0730
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0740
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0748
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0758
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0764
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a076c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0780
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0790
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a079c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a07a4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a07b0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a07c0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a07d0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a07e0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a07e8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a07f0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a07fc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a080c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a081c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0824
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0838
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0848
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0850
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0858
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0864
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a086c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0874
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a087c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a08a4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a08c8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a08f0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0900
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0928
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0934
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a095c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a097c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a09a4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a09a8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a09d0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a09dc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0a04
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0a0c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0a34
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0a44
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0a6c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0a78
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0aa0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0aa8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0ad0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0ae4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0b0c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0b14
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0b3c
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e6f27
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e6fab
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5a0b54
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x23c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x23c]
push eax
push 0x54
push 0x5a0b8c
lea ecx, [ebp - 0x13c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e6f1a
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a0b90
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0b94
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.AppMgmt
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0ba4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Base
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0bb4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Boot_Bus_Extender
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0bd8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Boot_file_system
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0bfc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Browser
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c14
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Dhcp
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c24
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.DnsCache
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c38
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.EventLog
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c4c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.File_system
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c60
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Filter
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c78
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.LanmanServer
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0c98
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.LanmanWorkstation
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0cb4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.LmHosts
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0cc4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Messenger
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0cd8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NDIS
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0ce8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NDIS_Wrapper
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d08
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Ndisuio
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d20
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NetBIOS
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d30
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NetBIOSGroup
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d48
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NetBT
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d60
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NetDDEGroup
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d74
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Netlogon
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0d90
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NetMan
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0da0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Network
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0db0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NetworkProvider
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0dd0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.PCI_Configuration
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0df4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.PlugPlay
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0e10
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.PNP_Filter
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0e24
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.PNP_TDI
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0e3c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Primary_disk
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0e5c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.RpcSs
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0e74
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.SCSI_Class
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0e88
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.sermouse.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0ea8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Streams_Drivers
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0ec0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.System_Bus_Extender
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0ee4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Tcpip
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0efc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a0f04
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Driver_Group
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.vga.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0f20
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.vgasave.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0f34
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WinMgmt
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a0f44
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.36FC9E60_C465_11CF_8056_444553540000
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Universal_Serial_Bus_controllers
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E965_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.CD_ROM_Drive
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E967_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.DiskDrive
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E969_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Standard_floppy_disk_controller
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E96A_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1074
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E96B_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Keyboard
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E96F_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Mouse
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E972_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1104
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E973_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.NetClient
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E974_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.NetService
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E975_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.NetTrans
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E977_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.PCMCIA_Adapters
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E97B_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.SCSIAdapter
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E97D_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1238
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.4D36E980_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Floppy_disk_drive
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.71A27CDD_812A_11D0_BEC7_08002BE2092F
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Volume
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.745A17A0_74D3_11D0_B6FE_00A0C90F57DA
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Human_Interface_Devices
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e75ba
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e763c
mov eax, dword [0x5b84b8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5a12ec
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov eax, dword [0x5b84b8]
push eax
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x23c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x23c]
push edx
push 0x54
push 0x5a1324
lea eax, [ebp - 0x13c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e75ab
push str.Microsoft_Windows_2000
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4e79d4
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a1340
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1348
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1350
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a135c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1364
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1370
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1378
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1384
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a138c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1398
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a13a0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a13ac
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a13b4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a13bc
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e7737
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e77bb
mov edx, dword [0x5b84b8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5a13c4
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [0x5b84b8]
push edx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x23c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x54
push 0x5a13fc
lea edx, [ebp - 0x13c]
push edx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e7728
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a1400
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1408
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1410
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a141c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1424
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1430
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1438
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1444
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a144c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1458
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1460
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1464
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.nbf.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1474
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a147c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1480
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.nm.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1490
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1498
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a14a0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.ProtectedStorage
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a14bc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.sglfb.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a14d0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.tga.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a14e0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a14e8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a14f0
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e7950
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e79d4
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5a14f8
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x23c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x23c]
push eax
push 0x54
push 0x5a1530
lea ecx, [ebp - 0x13c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e7943
push str.Microsoft_Windows_Server_2003
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4e7ef2
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a1554
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1560
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1568
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1574
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a157c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1584
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a158c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1598
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a15a0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a15ac
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a15b4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a15c0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a15c8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a15d4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a15dc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a15e4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a15ec
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a15f4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a15fc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1600
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.wd.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1610
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1618
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1640
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e7b51
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e7bd3
mov eax, dword [0x5b84b8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5a1654
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov eax, dword [0x5b84b8]
push eax
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x23c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x23c]
push edx
push 0x54
push 0x5a168c
lea eax, [ebp - 0x13c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e7b42
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a1690
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a169c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a16a4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a16b0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a16b8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a16c0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a16c8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a16d4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a16dc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a16e8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a16f0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a16fc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1704
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1710
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1718
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1720
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1728
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1734
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a173c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1748
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1750
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1758
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1760
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a176c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1774
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1780
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1788
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1794
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a179c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a17a8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a17b0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a17b8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a17c0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a17d0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a17d8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a17e4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a17ec
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a17f8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1800
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a180c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1814
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1820
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1828
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a182c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1834
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a183c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1844
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a186c
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e7e6e
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e7ef2
mov edx, dword [0x5b84b8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5a1880
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [0x5b84b8]
push edx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x23c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x54
push 0x5a18b8
lea edx, [ebp - 0x13c]
push edx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e7e5f
push str.Microsoft_Windows_XP
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4e83f4
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a18d4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a18e0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a18e8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a18f4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a18fc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1904
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a190c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1918
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1920
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a192c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1934
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1940
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1948
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1954
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a195c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1964
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a196c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1974
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1990
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a199c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a19a4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a19a8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a19b0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a19d8
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e806d
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e80f1
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5a19ec
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x23c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x23c]
push eax
push 0x54
push 0x5a1a24
lea ecx, [ebp - 0x13c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e8060
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a1a28
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1a34
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1a3c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1a48
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.dmadmin
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1a58
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.dmboot.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1a6c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.dmio.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1a80
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.dmload.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1a94
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.dmserver
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1aa8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1ab0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ab8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.ip6fw.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1acc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1ad4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ae0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NtLmSsp
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1af0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.rdpcdd.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b04
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.rdpdd.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b18
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.rdpwd.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b2c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1b34
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b40
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.tdpipe.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b54
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.tdtcp.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b68
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.termservice
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b7c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.UploadMgr
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1b90
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.sharedaccess
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ba8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.sr.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.FSFilter_System_Recovery
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.SRService
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1be0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WZCSVC
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1bf0
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e8372
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e83f4
mov eax, dword [0x5b84b8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5a1bf8
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov eax, dword [0x5b84b8]
push eax
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x23c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x23c]
push edx
push 0x54
push 0x5a1c30
lea eax, [ebp - 0x13c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e8363
push str.Windows_7_Professional
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4e8dbe
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push 0x5a1c4c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1c54
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1c5c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1c68
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1c70
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1c7c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1c84
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1c88
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1c90
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1c98
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1ca0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ca8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1cb0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1cb8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1cc0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1cc8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1cd0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1cd8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1ce0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1cf0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1cf8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d00
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d08
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d10
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d18
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d2c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d34
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d38
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d40
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d54
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d5c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d60
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d68
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d70
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d78
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d84
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1d8c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1d98
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1da0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1dac
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1db4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1dbc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1dc4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1dcc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1dd4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ddc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1de4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1e0c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1e20
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1e48
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1e68
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1e90
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1ea8
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ed0
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e86f7
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e877b
mov edx, dword [0x5b84b8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_s
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [0x5b84b8]
push edx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x23c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x54
push 0x5a1f18
lea edx, [ebp - 0x13c]
push edx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e86e8
lea ecx, [ebp - 0x20]
call fcn.0050f5b0
lea ecx, [ebp - 0x34]
call fcn.0050f5b0
push str.AppInfo
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f24
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1f2c
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f30
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.bowser
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f40
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.CryptSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f54
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.DcomLaunch
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f68
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.dfsc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f78
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Dot3Svc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f88
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Eaphost
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1f98
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a1fa0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1fa4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.HelpSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1fb4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.IKEEXT
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1fc4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.ipnat.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1fd8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.KeyIso
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1fe8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.MPSDrv
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a1ff8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.MPSSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2008
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.mrxsmb
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2018
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.mrxsmb10
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a202c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.mrxsmb20
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2040
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NativeWifiP
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2054
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.ndiscap
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2064
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.netprofm
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2078
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NlaSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2088
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a2090
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2094
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.nsiproxy.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a20ac
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.NTDS
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a20bc
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.PolicyAgent
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a20d0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Power
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a20e0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.ProfSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a20f0
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.rdbss
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2100
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.rdpencdd.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2118
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.rdsessmgr
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a212c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.RpcEptMapper
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2144
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.sacsvr
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2154
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.SCardSvr
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2168
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.SharedAccess
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2180
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.SWPRV
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2190
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.TabletInputService
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a21ac
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a21b4
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a21b8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.TrustedInstaller
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a21d4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.VaultSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a21e8
lea ecx, [ebp - 0x34]
call fcn.0050f680
push 0x5a21f0
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a21f4
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.vmms
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2204
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.volmgr.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2218
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.volmgrx.sys
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a222c
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WinDefend
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2240
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.Wlansvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2250
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WudfPf
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2260
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WudfRd
lea ecx, [ebp - 0x20]
call fcn.0050f680
push 0x5a2270
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WudfSvc
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Service
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.WudfUsbccidDriver
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Driver
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.50DD5230_BA8A_11D1_BF5D_0000F805F530
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Smart_card_readers
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.533C5B84_EC70_11D2_9505_00C04F79DEAF
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.Volume_shadow_copy
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.6BDD1FC1_810F_11D0_BEC7_08002BE2092F
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.IEEE_1394_Bus_host_controllers
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.D48179BE_EC20_11D1_B6B8_00C04FA372A7
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.SBP2_IEEE_1394_Devices
lea ecx, [ebp - 0x34]
call fcn.0050f680
push str.D94EE5D8_D189_4994_83D2_F68D7D41B0E6
lea ecx, [ebp - 0x20]
call fcn.0050f680
push str.SecurityDevices
lea ecx, [ebp - 0x34]
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4e8d3a
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
lea ecx, [ebp - 0x20]
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4e8dbe
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_s
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [0x5b84b8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x23c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x23c]
push eax
push 0x54
push 0x5a2414
lea ecx, [ebp - 0x13c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4e8d2d
push str.Restaurada_Clave:__SafeBootMinimal_y_Network__n
mov ecx, 0x5b5b78
call fcn.0050f680
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.0051046c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0051046c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret