Function at 0x462f70
Capabilities:
Get common file path
Manipulate safe mode programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0xc4fc
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x44]
push ecx
call fcn.00401350
add esp, 4
lea edx, [ebp - 0x50c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
push 0x80
push edx
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xc50c]
push eax
lea edx, [ebp - 0x24]
push ecx
lea eax, [ebp - 0x850c]
push edx
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x450c]
push ecx
push edx
call fcn.004c5900
add esp, 0x18
lea ecx, [ebp - 0x8c]
push 1
call fcn.004f0653
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x8c]
push eax
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 1
call fcn.004f0727
mov ebx, dword [ebp + 0x1b4]
xor edi, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x1c]
cmp edi, eax
jge 0x46337c
cmp dword [0xe56da0], 1
jne 0x463080
mov ecx, edi
push str._SystemRoot__servicingTrustedInstaller.exe
shl ecx, 8
lea esi, [ebp + ecx - 0x450c]
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x463371
push str.servicingTrustedInstaller.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x463371
mov edx, edi
push str.wins_rscsession.exe
shl edx, 8
lea esi, [ebp + edx - 0x450c]
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x463371
push str.winswdrsession.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x463371
mov ecx, dword [0xe56be4]
mov eax, 1
cmp ecx, eax
jne 0x4631c5
cmp dword [0xe56bec], eax
jne 0x4631c5
push str.WINSWdrSession.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46314e
mov eax, dword [ebp - 0x1c]
push esi
lea ecx, [ebp - 0x44]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x522160
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
inc edi
xor esi, esi
mov dword [ebp - 0x14], edi
jmp 0x463034
push str.WINSRscSession.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4631c5
mov edx, dword [ebp - 0x1c]
push esi
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x522160
push edx
call fcn.004f175f
add esp, 0x18
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
inc edi
xor esi, esi
mov dword [ebp - 0x14], edi
jmp 0x463034
push esi
mov byte [ebp - 0x38c], 0
call fcn.004627b0
add esp, 4
mov edi, eax
push str.Microsoft_Corp
push edi
call fcn.004f2d80
push 0x5144fc
push edi
mov ebx, eax
call fcn.004f2d80
add esp, 0x10
test ebx, ebx
jne 0x463304
test eax, eax
jne 0x463304
push edi
call fcn.004fa6c0
mov ecx, dword [ebp - 0x1c]
add esp, 4
lea edx, [ebp - 0x44]
push eax
push esi
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x5220e4
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x46329f
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x38c]
push edx
push eax
push ecx
jne 0x463282
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x463299
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov edx, dword [0xe56d38]
mov ecx, dword [0xe56d24]
inc edx
inc ecx
mov dword [0xe56d38], edx
lea edx, [ebp - 0x38c]
mov dword [0xe56d24], ecx
push edx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
call fcn.004c6140
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
add esp, 4
inc edi
mov dword [ebp - 0x14], edi
xor esi, esi
jmp 0x463034
push edi
call fcn.004fa6c0
mov ecx, dword [ebp - 0x1c]
add esp, 4
lea edx, [ebp - 0x44]
push eax
push esi
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x5220ac
push ecx
call fcn.004f175f
add esp, 0x1c
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ebx, dword [ebp + 0x1b4]
mov edi, dword [ebp - 0x14]
inc edi
xor esi, esi
mov dword [ebp - 0x14], edi
jmp 0x463034
cmp dword [ebp - 0x18], esi
jne 0x463448
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x52206c
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x463424
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4633f8
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x38c]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x46341e
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x38c]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jge 0x46361d
mov edx, ecx
mov byte [ebp - 0x38c], 0
shl edx, 8
lea ebx, [ebp + edx - 0x850c]
push ebx
call fcn.004621b0
add esp, 4
mov esi, eax
push str.Microsoft_Corp
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
test edi, edi
jne 0x4635a7
test eax, eax
jne 0x4635a7
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x24]
push ebx
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x522018
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x463544
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x38c]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x463527
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x46353e
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov edx, dword [0xe56d38]
mov ecx, dword [0xe56d24]
inc edx
inc ecx
mov dword [0xe56d24], ecx
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
mov dword [0xe56d38], edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push edx
call fcn.004c6390
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
add esp, 4
inc eax
mov dword [ebp - 0x14], eax
jmp 0x463450
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x24]
push ebx
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x521fdc
push eax
call fcn.004f175f
add esp, 0x1c
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x463450
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4636eb
lea edx, [ebp - 0x44]
push eax
push edx
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x521f9c
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x4636c7
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x46369b
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x38c]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4636c1
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x38c]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jge 0x4638be
shl ecx, 8
mov byte [ebp - 0x38c], 0
lea ebx, [ebp + ecx - 0xc50c]
push ebx
call fcn.00461bc0
add esp, 4
mov esi, eax
push str.Microsoft_Corp
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
test edi, edi
jne 0x463848
test eax, eax
jne 0x463848
push esi
call fcn.004fa6c0
mov edx, dword [ebp - 0x20]
add esp, 4
push eax
push ebx
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x521f48
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4637e5
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x38c]
push eax
push ecx
push edx
jne 0x4637c8
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4637df
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov esi, dword [0xe56d38]
mov edx, dword [0xe56d24]
inc esi
lea eax, [ebp - 0x38c]
inc edx
push eax
lea ecx, [ebp - 0x80]
mov dword [0xe56d38], esi
mov dword [0xe56d24], edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push ecx
call fcn.004c65e0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
add esp, 4
inc eax
mov dword [ebp - 0x14], eax
jmp 0x4636f3
push esi
call fcn.004fa6c0
mov edx, dword [ebp - 0x20]
add esp, 4
push eax
push ebx
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x521f0c
push edx
call fcn.004f175f
add esp, 0x1c
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x4636f3
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x46398c
lea ecx, [ebp - 0x44]
push eax
push ecx
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x521ecc
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x463968
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x46393c
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x38c]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x463962
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x38c]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push 0x521ec4
mov dword [ebp - 0x18], 0
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x48c]
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_s
push eax
call fcn.004f175f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x48c]
push ecx
push 0x20019
push 0
push edx
push closesocket
call esi
test eax, eax
jne 0x4639fb
push str.open__base_SUCCESS....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x463a02
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push str.4D36E967_E325_11CE_BFC1_08002BE10318
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x48c]
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x48c]
push edx
push 0x20019
push 0
push eax
push closesocket
call esi
test eax, eax
jne 0x463a70
push str.open__base_SUCCESS....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x463a77
mov dword [ebp - 0x1c], 1
mov ecx, dword [ebp - 0x18]
push ecx
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jge 0x463b63
lea edx, [ebp - 0x44]
push eax
push edx
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x521dfc
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x463b28
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x463afc
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x38c]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x463b22
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x38c]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push str.c:endpcache
call fcn.004f2beb
push str.regedit.exe__s_safeboot.reg
call fcn.004f2ce2
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0xc50c]
push ecx
lea eax, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x850c]
push eax
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x450c]
push edx
push eax
call fcn.004c5d20
add esp, 0x18
xor esi, esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jge 0x463dd5
cmp dword [0xe56da0], 1
jne 0x463beb
mov ecx, esi
push str.SCardSvr.exe
shl ecx, 8
lea edi, [ebp + ecx - 0x450c]
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x463dc6
push str.SCardSvr.exe
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x463dc6
mov edx, esi
push str.wins_rscsession.exe
shl edx, 8
lea edi, [ebp + edx - 0x450c]
push edi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x463dc6
push str.winswdrsession.exe
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x463dc6
push edi
mov byte [ebp - 0x38c], al
call fcn.004627b0
add esp, 4
mov esi, eax
push str.Microsoft_Corp
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov ebx, eax
call fcn.004f2d80
add esp, 0x10
test ebx, ebx
jne 0x463d5f
test eax, eax
jne 0x463d5f
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x1c]
push edi
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x521d7c
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x463cfc
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x38c]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x463cdf
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x463cf6
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov edx, dword [0xe56d38]
mov ecx, dword [0xe56d24]
inc edx
inc ecx
mov dword [0xe56d24], ecx
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
mov dword [0xe56d38], edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push edx
call fcn.004c6140
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
add esp, 4
inc esi
mov dword [ebp - 0x14], esi
jmp 0x463b9f
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x1c]
push edi
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x521d40
push eax
call fcn.004f175f
add esp, 0x1c
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
inc esi
mov dword [ebp - 0x14], esi
jmp 0x463b9f
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x463ea3
lea edx, [ebp - 0x44]
push eax
push edx
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x521d00
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x463e7f
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x463e53
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x38c]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x463e79
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x38c]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jge 0x464076
shl ecx, 8
mov byte [ebp - 0x38c], 0
lea ebx, [ebp + ecx - 0x850c]
push ebx
call fcn.004621b0
add esp, 4
mov esi, eax
push str.Microsoft_Corp
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
test edi, edi
jne 0x464000
test eax, eax
jne 0x464000
push esi
call fcn.004fa6c0
mov edx, dword [ebp - 0x24]
add esp, 4
push eax
push ebx
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x521cac
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x463f9d
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x38c]
push eax
push ecx
push edx
jne 0x463f80
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x463f97
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov esi, dword [0xe56d38]
mov edx, dword [0xe56d24]
inc esi
lea eax, [ebp - 0x38c]
inc edx
push eax
lea ecx, [ebp - 0x80]
mov dword [0xe56d38], esi
mov dword [0xe56d24], edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push ecx
call fcn.004c6390
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
add esp, 4
inc eax
mov dword [ebp - 0x14], eax
jmp 0x463eab
push esi
call fcn.004fa6c0
mov edx, dword [ebp - 0x24]
add esp, 4
push eax
push ebx
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x521c70
push edx
call fcn.004f175f
add esp, 0x1c
lea eax, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x463eab
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x464144
lea ecx, [ebp - 0x44]
push eax
push ecx
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x521c30
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x464120
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4640f4
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x38c]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x46411a
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x38c]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jge 0x464319
mov eax, ecx
mov byte [ebp - 0x38c], 0
shl eax, 8
lea ebx, [ebp + eax - 0xc50c]
push ebx
call fcn.00461bc0
add esp, 4
mov esi, eax
push str.Microsoft_Corp
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
test edi, edi
jne 0x4642a3
test eax, eax
jne 0x4642a3
push esi
call fcn.004fa6c0
mov ecx, dword [ebp - 0x20]
add esp, 4
lea edx, [ebp - 0x44]
push eax
push ebx
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x521f48
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x464240
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x38c]
push edx
push eax
push ecx
jne 0x464223
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x46423a
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov edx, dword [0xe56d38]
mov ecx, dword [0xe56d24]
inc edx
inc ecx
mov dword [0xe56d38], edx
lea edx, [ebp - 0x38c]
mov dword [0xe56d24], ecx
push edx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
call fcn.004c65e0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
add esp, 4
inc eax
mov dword [ebp - 0x14], eax
jmp 0x46414c
push esi
call fcn.004fa6c0
mov ecx, dword [ebp - 0x20]
add esp, 4
lea edx, [ebp - 0x44]
push eax
push ebx
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38c]
push eax
push 0x521bf4
push ecx
call fcn.004f175f
add esp, 0x1c
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x1b4]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x46414c
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4643e7
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x10c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38c]
push eax
push 0x521bb4
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x4643c3
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x464397
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x38c]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4643bd
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x38c]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x38c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push 0x5180e8
mov dword [ebp + 0x1b4], 0
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x48c]
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_s
push edx
call fcn.004f175f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea eax, [ebp + 0x1b4]
lea ecx, [ebp - 0x48c]
push eax
push 0x20019
push 0
push ecx
push closesocket
call esi
test eax, eax
jne 0x46445c
push str.open__NDIS_SUCCESS....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x464487
push str.open__NDIS_defeat....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp + 0x1b4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
push str.4D36E967_E325_11CE_BFC1_08002BE10318
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x48c]
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp + 0x1b4]
lea edx, [ebp - 0x48c]
push ecx
push 0x20019
push 0
push edx
push closesocket
call esi
test eax, eax
jne 0x4644fb
push str.open__NDIS_SUCCESS....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x464526
push str.open__NDIS_defeat....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp + 0x1b4]
push eax
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, 3
jge 0x464615
lea ecx, [ebp - 0x44]
push eax
push ecx
mov byte [ebp - 0x38c], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x10c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38c]
push 0x521b00
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x4645da
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4645ae
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x38c]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4645d4
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x38c]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x38c]
lea ecx, [ebp - 0x80]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push str.c:endpcache
call fcn.004f2beb
push str.regedit.exe__s_safeboot.reg
call fcn.004f2ce2
add esp, 8
lea ecx, [ebp - 0x8c]
call fcn.004f076e
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x78]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret