Function at 0x4d0124
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0x28c
mov eax, 0x78a642
call fcn.00700ca1
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x28c], ebx
push eax
call fcn.004d00ca
pop ecx
pop ecx
push 0xf
pop eax
push eax
push str.CiscoWebexStart
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x28], bl
call fcn.00439710
lea eax, [ebp - 0x28]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.006210e3
and dword [ebp - 0x90], 0
mov edi, eax
pop ecx
push 0xa
push str.strCmdLine
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.00439710
push 0
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00620ff2
add esp, 0xc
push 0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 4
push eax
push 0x858903
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.00439710
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 5
push str.CURLProtocolHandler::ProcessCommands
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
push ecx
push eax
lea ecx, [ebp - 0x1f0]
call fcn.0061c551
mov byte [ebp - 4], 7
push esi
push eax
mov ecx, edi
call fcn.006215aa
lea ecx, [ebp - 0x1d8]
call fcn.00438e20
lea ecx, [ebp - 0x1f0]
call fcn.00438e20
lea ecx, [ebp - 0xe8]
call fcn.00438e20
mov eax, dword [ebp - 0x44]
mov edi, 0x1000
cmp eax, 0x10
jb 0x4d02a2
mov ecx, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], ecx
cmp eax, edi
jb 0x4d0299
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x288]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x284]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.00438e20
lea ecx, [ebp - 0x148]
call fcn.00438e20
lea ecx, [ebp - 0x160]
call fcn.00438e20
mov eax, dword [ebp - 0x8c]
cmp eax, 0x10
jb 0x4d031e
mov ecx, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d0315
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], eax
mov byte [ebp - 0xa0], al
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4d037f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d0376
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004fb6d7
pop ecx
pop ecx
lea ecx, [ebp - 0xd0]
cmp ecx, eax
je 0x4d03b1
mov byte [ebp - 0x284], 0
push dword [ebp - 0x284]
push eax
call fcn.004cc546
lea ecx, [ebp - 0xe8]
call fcn.004c0931
push 0x20
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004fb896
lea ecx, [ebp - 0xd0]
add esp, 0xc
cmp ecx, eax
je 0x4d03f1
mov byte [ebp - 0x284], 0
push dword [ebp - 0x284]
push eax
call fcn.004cc546
lea ecx, [ebp - 0xe8]
call fcn.004c0931
push str._registerdaemon
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
je 0x4d0562
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x28], 0
call fcn.00439710
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 8
push eax
call fcn.006210e3
pop ecx
push 0xf
pop edi
mov esi, eax
mov dword [ebp - 0x44], edi
xor eax, eax
lea ecx, [ebp - 0x58]
push eax
push 0x858903
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x58], al
call fcn.00439710
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 9
push str.preJME__ProcessCommands__set_daemon_auto_run
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
push ecx
push eax
lea ecx, [ebp - 0x1f0]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.006215be
lea ecx, [ebp - 0x1d8]
call fcn.00438e20
lea ecx, [ebp - 0x1f0]
call fcn.00438e20
lea ecx, [ebp - 0xe8]
call fcn.00438e20
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4d04ff
mov ecx, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, 0x1000
jb 0x4d04f6
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x58], al
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4d0556
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, 0x1000
jb 0x4d054d
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
push ebx
call fcn.0054554c
pop ecx
jmp 0x4d131f
push str._uninstalldaemon
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
je 0x4d0918
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x28], 0
call fcn.00439710
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
call fcn.006210e3
pop ecx
mov esi, eax
mov dword [ebp - 0x44], 0xf
xor eax, eax
lea ecx, [ebp - 0x58]
push eax
push 0x858903
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x58], al
call fcn.00439710
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0xd
push str.preJME__ProcessCommands__uninstallDaemon_auto_run
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xe
push ecx
push eax
lea ecx, [ebp - 0x1f0]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0xf
call fcn.006215be
lea ecx, [ebp - 0x1d8]
call fcn.00438e20
lea ecx, [ebp - 0x1f0]
call fcn.00438e20
lea ecx, [ebp - 0xe8]
call fcn.00438e20
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4d0663
mov ecx, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d065a
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x58], al
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4d06bb
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d06b2
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea eax, [ebp - 0x40]
push eax
call fcn.00543f2f
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 0x10
push eax
call fcn.0051eb4a
pop ecx
pop ecx
mov edi, dword [ebp - 0x298]
lea ecx, [ebp - 0x28]
push 0x805188
mov byte [ebp - 4], 0x11
mov eax, dword [edi]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov esi, dword [eax + 4]
xor eax, eax
mov word [ebp - 0x28], ax
call fcn.004c097f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x12
push eax
push dword [0x8ea700]
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call dword [0x7f07dc]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x14]
neg eax
mov byte [ebp - 4], 0x11
mov edi, 0x1000
sbb al, al
inc al
mov dword [ebp - 0x28c], eax
cmp ecx, 8
jb 0x4d0788
lea eax, [ecx*2 + 2]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d0779
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
test al, al
je 0x4d08cd
push 0xf
pop eax
push eax
xor ebx, ebx
mov dword [ebp - 0x14], eax
push str.CiscoWebexStart
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00439710
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x13
push eax
call fcn.006210e3
pop ecx
push ebx
push 0x858903
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], ebx
mov esi, eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
call fcn.00439710
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x14
push str.CURLProtocolHandler::ProcessCommands__VerifyModuleSignatureAndSubject_fail
push eax
call fcn.006212a1
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x15
push ecx
push eax
lea ecx, [ebp - 0x1f0]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.00621a68
lea ecx, [ebp - 0x1d8]
call fcn.00438e20
lea ecx, [ebp - 0x1f0]
call fcn.00438e20
lea ecx, [ebp - 0xe8]
call fcn.00438e20
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4d0876
mov ecx, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d086d
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
cmp eax, 0x10
jb 0x4d08c9
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d08c0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov esi, ebx
jmp 0x4d08fc
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x290]
push ecx
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push str._stopdaemon
push eax
call fcn.00503fc2
push 0
call fcn.0054554c
add esp, 0x10
mov dword [ebp - 0x284], ebx
mov esi, ebx
mov ecx, dword [ebp - 0x294]
test ecx, ecx
je 0x4d090b
call fcn.004c06f9
lea ecx, [ebp - 0x40]
call fcn.004c0931
jmp 0x4d16f4
push 0x8062c4
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d1c51
push str._registerall
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d1c51
push 0x8063bc
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d1707
push str._unregisterall
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d1707
push 0x806434
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d0c70
push str._register
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d0c70
push 0x806548
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d0b36
push str._unregister
lea ecx, [ebp - 0xd0]
call fcn.004d2b1c
test al, al
jne 0x4d0b36
push 0
push str._update
lea ecx, [ebp - 0xd0]
call fcn.004cccc1
cmp eax, 0xffffffff
je 0x4d0b0e
push ebx
call fcn.004cf9f4
lea ecx, [ebp - 0x178]
mov dword [esp], str.CiscoWebexStart
call fcn.00438eb0
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 0x74
push eax
call fcn.006210e3
lea ecx, [ebp - 0x160]
mov dword [esp], str.strCmdLine
mov edi, eax
call fcn.00438eb0
push 0
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x75
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00620ff2
add esp, 0xc
push 0
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x76
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov esi, eax
push 0x858903
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x77
call fcn.00438eb0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x78
push str.preJME__ProcessCommands__wait_process_to_exit_and_copy_self
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x79
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x7a
call fcn.006215aa
lea ecx, [ebp - 0x118]
call fcn.004c37b0
lea ecx, [ebp - 0x40]
call fcn.00438e20
lea ecx, [ebp - 0xe8]
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.004c37b0
lea ecx, [ebp - 0x28]
call fcn.00438e20
lea ecx, [ebp - 0x160]
call fcn.00438e20
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0
call fcn.00438e20
lea eax, [ebp - 0xd0]
push eax
call fcn.0052441c
pop ecx
jmp 0x4d16f2
push 0
push str._delete:
lea ecx, [ebp - 0xd0]
call fcn.004cccc1
test eax, eax
jne 0x4d16ec
lea eax, [ebp - 0xd0]
push eax
call fcn.004f593d
jmp 0x4d0b08
push str.CiscoWebexStart
lea ecx, [ebp - 0x40]
call fcn.00438eb0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x6c
push eax
call fcn.006210e3
lea ecx, [ebp - 0x178]
mov dword [esp], 0x858903
mov edi, eax
call fcn.00438eb0
push str.PreJME_CiscoWebexStart_Unregister
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x6d
call fcn.00438eb0
push 0x40110106
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00620538
add esp, 0xc
push 0
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x6f
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov esi, eax
push 0x858903
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x70
call fcn.00438eb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x71
push str.preJME__ProcessCommands__unregister_all
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x72
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x73
call fcn.006215aa
lea ecx, [ebp - 0x118]
call fcn.004c37b0
lea ecx, [ebp - 0x28]
call fcn.00438e20
lea ecx, [ebp - 0xe8]
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.004c37b0
lea ecx, [ebp - 0x70]
call fcn.00438e20
lea ecx, [ebp - 0x160]
call fcn.00438e20
lea ecx, [ebp - 0x178]
call fcn.00438e20
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00438e20
push 0
call fcn.00503634
push eax
call fcn.004d2ae8
call fcn.004d2501
push ebx
call fcn.004cf9f4
add esp, 0xc
jmp 0x4d16f2
and dword [ebp - 0x90], 0
lea ecx, [ebp - 0xa0]
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x8c], esi
push str.ciscowebexstart.exe
mov word [ebp - 0xa0], ax
call fcn.004c097f
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x3a
push eax
call fcn.0050f5b0
push 0x5c
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x3b
push ecx
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.005126ee
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.004c0931
mov eax, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x3e
cmp eax, 8
jb 0x4d0d21
mov ecx, dword [ebp - 0xa0]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d0d18
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x90], 0
lea ecx, [ebp - 0xb8]
xor eax, eax
mov dword [ebp - 0x8c], esi
and dword [ebp - 0xa8], eax
push str.ciscowebexstart.exe
mov word [ebp - 0xa0], ax
mov dword [ebp - 0xa4], esi
mov word [ebp - 0xb8], ax
call fcn.004c097f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3f
push eax
call fcn.0050f258
push 0x5c
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x40
push ecx
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.005126ee
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.004c0931
mov eax, dword [ebp - 0xa4]
mov byte [ebp - 4], 0x43
cmp eax, 8
jb 0x4d0de2
mov ecx, dword [ebp - 0xb8]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d0dd9
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0xa8], 0
xor eax, eax
mov word [ebp - 0xb8], ax
lea eax, [ebp - 0x1dc]
push eax
mov dword [ebp - 0xa4], esi
call fcn.005483f8
pop ecx
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x1d8]
and dword [ebp - 0x44], 0
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0x44
call fcn.004c0690
cmp dword [ebp - 0x48], 0
mov byte [ebp - 4], 0x45
je 0x4d137d
cmp byte [ebp - 0x1dc], 0
lea ecx, [ebp - 0xe8]
lea eax, [ebp - 0x160]
cmove eax, ecx
and dword [ebp - 0x90], 0
and dword [ebp - 0x8c], 0
lea ecx, [ebp - 0xa0]
push eax
call fcn.004c0690
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x46
push eax
call fcn.0050f908
pop ecx
test eax, eax
je 0x4d1327
push 0xf
pop eax
push eax
xor ebx, ebx
mov dword [ebp - 0x2c], eax
push str.CiscoWebexStart
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
call fcn.00439710
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x47
push eax
call fcn.006210e3
pop ecx
push 0xa
push str.msiCwsPath
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00439710
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x48
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.0062113d
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x49
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
mov ebx, eax
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x70]
push 9
push str.webexHome
mov byte [ebp - 4], 0x4a
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.00439710
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x4b
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.0062113d
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x4c
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov edi, eax
xor eax, eax
mov byte [ebp - 4], 0x4d
push eax
push 0x858903
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], al
call fcn.00439710
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0x208]
push str.ForceLockDown__neednt_register_urlprotocol_to_local_folder
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x4f
push ecx
push eax
lea ecx, [ebp - 0x280]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x50
push eax
push 0x858903
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], al
call fcn.00439710
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x51
push str.CURLProtocolHandler::ProcessCommands
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x52
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.0061c551
mov ecx, dword [ebp - 0x284]
push ebx
push edi
push esi
push eax
mov byte [ebp - 4], 0x53
call fcn.00621579
lea ecx, [ebp - 0x238]
call fcn.00438e20
lea ecx, [ebp - 0x250]
call fcn.00438e20
lea ecx, [ebp - 0x220]
call fcn.00438e20
mov eax, dword [ebp - 0xa4]
mov esi, 0x1000
push 0x10
pop edi
cmp eax, edi
jb 0x4d1080
mov ecx, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1077
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 0xa4], 0xf
lea ecx, [ebp - 0x268]
mov dword [ebp - 0xa8], ebx
mov byte [ebp - 0xb8], bl
call fcn.00438e20
lea ecx, [ebp - 0x280]
call fcn.00438e20
lea ecx, [ebp - 0x208]
call fcn.00438e20
mov eax, dword [ebp - 0x74]
cmp eax, edi
jb 0x4d1101
mov ecx, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d10f8
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], bl
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.00438e20
lea ecx, [ebp - 0x190]
call fcn.00438e20
mov eax, dword [ebp - 0x5c]
cmp eax, edi
jb 0x4d1177
mov ecx, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d116e
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], bl
call fcn.00438e20
lea ecx, [ebp - 0x118]
call fcn.00438e20
lea ecx, [ebp - 0x130]
call fcn.00438e20
mov eax, dword [ebp - 0x14]
cmp eax, edi
jb 0x4d11ea
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d11e1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
cmp eax, edi
jb 0x4d123c
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1233
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, dword [ebp - 0x8c]
cmp eax, 8
jb 0x4d128e
mov ecx, dword [ebp - 0xa0]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1285
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x90], ebx
push 7
mov word [ebp - 0xa0], ax
mov eax, dword [ebp - 0x44]
pop edi
mov dword [ebp - 0x8c], edi
cmp eax, 8
jb 0x4d12f2
mov ecx, dword [ebp - 0x58]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d12e9
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x44], edi
mov word [ebp - 0x58], ax
call fcn.004c0931
lea ecx, [ebp - 0x160]
call fcn.004c0931
lea ecx, [ebp - 0xe8]
call fcn.004c0931
xor esi, esi
inc esi
jmp 0x4d16f4
mov eax, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x45
cmp eax, 8
jb 0x4d137d
mov ecx, dword [ebp - 0xa0]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d1374
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea eax, [ebp - 0x130]
push eax
call fcn.00543f2f
pop ecx
lea ecx, [ebp - 0x130]
call fcn.004c0931
lea eax, [ebp - 0x190]
push eax
call fcn.00501dab
push 0
push eax
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 0x54
push eax
call fcn.005139cc
add esp, 0x10
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x56
call fcn.004c0931
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x70]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x70], 0
call fcn.00439710
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x57
push eax
call fcn.006210e3
pop ecx
mov edi, eax
mov dword [ebp - 0x14], 0xf
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push 0x858903
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00439710
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push 0x1f
push str.PreJME_CiscoWebexStart_Retister
mov byte [ebp - 4], 0x58
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.00439710
push 0x40110104
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x59
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00620538
add esp, 0xc
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x5a
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov esi, eax
push 0x858903
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x5b
call fcn.00438eb0
mov byte [ebp - 4], 0x5c
push str.preJME__ProcessCommands__register_begin
lea eax, [ebp - 0x130]
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x5d
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x5e
call fcn.006215aa
lea ecx, [ebp - 0x118]
call fcn.004c37b0
lea ecx, [ebp - 0x130]
call fcn.00438e20
lea ecx, [ebp - 0x88]
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.004c37b0
lea ecx, [ebp - 0x208]
call fcn.00438e20
lea ecx, [ebp - 0x40]
call fcn.00438e20
lea ecx, [ebp - 0x28]
call fcn.00438e20
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x56
call fcn.00438e20
push 0
call fcn.004cf9f4
pop ecx
call fcn.004cf2b8
cmp dword [ebp - 0x168], 0
je 0x4d159a
push str.ciscowebexstart.exe
lea ecx, [ebp - 0x40]
call fcn.004c01bc
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x5f
push eax
call fcn.0050f092
push 0x5c
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x60
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005126ee
add esp, 0x14
lea ecx, [ebp - 0x130]
call fcn.004c0931
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x63
call fcn.004c0931
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.004cf8a5
lea eax, [ebp - 0x178]
push eax
call fcn.004f43a6
add esp, 0xc
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x28]
call fcn.004c0931
jmp 0x4d1628
push str.CiscoWebexStart
lea ecx, [ebp - 0x28]
call fcn.00438eb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x64
push eax
call fcn.006210e3
lea ecx, [ebp - 0x40]
mov dword [esp], 0x858903
mov esi, eax
call fcn.00438eb0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x65
push str.preJME__should_not_call_RegisterBrowserExtension
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x66
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0x67
call fcn.006215be
lea ecx, [ebp - 0x118]
call fcn.004c37b0
lea ecx, [ebp - 0x130]
call fcn.00438e20
lea ecx, [ebp - 0x40]
call fcn.00438e20
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x56
call fcn.00438e20
push str.CiscoWebexStart
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28c], ebx
call fcn.00438eb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x68
push eax
call fcn.006210e3
lea ecx, [ebp - 0x40]
mov dword [esp], 0x858903
mov esi, eax
call fcn.00438eb0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x69
push str.preJME__ProcessCommands__register_end
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x6a
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6b
call fcn.006215be
lea ecx, [ebp - 0x118]
call fcn.004c37b0
lea ecx, [ebp - 0x130]
call fcn.00438e20
lea ecx, [ebp - 0x40]
call fcn.00438e20
lea ecx, [ebp - 0x28]
call fcn.00438e20
lea ecx, [ebp - 0x178]
call fcn.004c0931
lea ecx, [ebp - 0x58]
call fcn.004c0931
lea ecx, [ebp - 0x1d8]
call fcn.004c0931
lea ecx, [ebp - 0x160]
call fcn.004c0931
lea ecx, [ebp - 0xe8]
call fcn.004c0931
mov ebx, dword [ebp - 0x28c]
mov esi, ebx
lea ecx, [ebp - 0xd0]
call fcn.004c0931
mov eax, esi
call fcn.00700c4b
ret
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x40], 0
call fcn.00439710
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2b
push eax
call fcn.006210e3
pop ecx
mov edi, eax
mov dword [ebp - 0x74], 0xf
xor eax, eax
lea ecx, [ebp - 0x88]
push eax
push 0x858903
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x88], al
call fcn.00439710
xor eax, eax
mov byte [ebp - 4], 0x2c
push str.PreJME_CiscoWebexStart_Unregisterall
mov byte [ebp - 0x284], al
lea ecx, [ebp - 0x70]
push dword [ebp - 0x284]
mov dword [ebp - 0x60], eax
push 0x24
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], al
call fcn.0043a610
push 0x40110107
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00620538
add esp, 0xc
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x2e
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x2f
push eax
push 0x858903
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.00439710
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x30
push str.preJME__ProcessCommands__unregister_all
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x31
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x32
call fcn.006215aa
lea ecx, [ebp - 0x100]
call fcn.00438e20
lea ecx, [ebp - 0x118]
call fcn.00438e20
lea ecx, [ebp - 0x130]
call fcn.00438e20
mov eax, dword [ebp - 0x14]
mov esi, 0x1000
push 0x10
pop edi
cmp eax, edi
jb 0x4d1884
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d187b
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.00438e20
lea ecx, [ebp - 0x190]
call fcn.00438e20
mov eax, dword [ebp - 0x5c]
cmp eax, edi
jb 0x4d18f9
mov ecx, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d18f0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], cl
cmp eax, edi
jb 0x4d1952
mov ecx, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1947
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], cl
mov byte [ebp - 4], cl
cmp eax, edi
jb 0x4d19aa
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d19a1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea eax, [ebp - 0xb8]
push eax
call fcn.00543f2f
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 0x33
push eax
call fcn.0051eb4a
pop ecx
pop ecx
mov edi, dword [ebp - 0x298]
lea ecx, [ebp - 0x40]
push 0x805188
mov byte [ebp - 4], 0x34
mov eax, dword [edi]
and dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov esi, dword [eax + 4]
xor eax, eax
mov word [ebp - 0x40], ax
call fcn.004c097f
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x35
push eax
push dword [0x8ea700]
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0x7f07dc]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x2c]
neg eax
mov byte [ebp - 4], 0x34
mov edi, 0x1000
sbb al, al
inc al
mov dword [ebp - 0x28c], eax
cmp ecx, 8
jb 0x4d1a7d
lea eax, [ecx*2 + 2]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d1a6e
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
test al, al
je 0x4d1bdd
push 0xf
pop eax
push eax
xor ebx, ebx
mov dword [ebp - 0x2c], eax
push str.CiscoWebexStart
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
call fcn.00439710
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x36
push eax
call fcn.006210e3
pop ecx
push ebx
push 0x858903
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov esi, eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00439710
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x37
push str.CURLProtocolHandler::ProcessCommands__VerifyModuleSignatureAndSubject_fail
push eax
call fcn.006212a1
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x38
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0x39
call fcn.00621a68
lea ecx, [ebp - 0x100]
call fcn.00438e20
lea ecx, [ebp - 0x118]
call fcn.00438e20
lea ecx, [ebp - 0x130]
call fcn.00438e20
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4d1b6b
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d1b62
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
cmp eax, 0x10
jb 0x4d1bbe
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, edi
jb 0x4d1bb5
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x294]
test ecx, ecx
je 0x4d1bcd
call fcn.004c06f9
lea ecx, [ebp - 0xb8]
call fcn.004c0931
jmp 0x4d16f2
and dword [ebp - 0x290], 0
lea ecx, [ebp - 0x290]
cmp dword [ebp - 0xa4], 8
lea eax, [ebp - 0xb8]
push ecx
cmovae eax, dword [ebp - 0xb8]
push str._stopdaemon
push eax
call fcn.00503fc2
push 0
call fcn.0054554c
push 0
call fcn.00503634
push eax
call fcn.004d2ae8
push ebx
call fcn.004cf9f4
add esp, 0x1c
call fcn.004d2754
call fcn.004f7f20
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x28c], ebx
test ecx, ecx
je 0x4d1c46
call fcn.004c06f9
lea ecx, [ebp - 0xb8]
jmp 0x4d16e7
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x40], 0
call fcn.00439710
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x17
push eax
call fcn.006210e3
pop ecx
mov edi, eax
mov dword [ebp - 0x74], 0xf
xor eax, eax
lea ecx, [ebp - 0x88]
push eax
push 0x858903
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x88], al
call fcn.00439710
xor eax, eax
mov byte [ebp - 4], 0x18
push str.PreJME_CiscoWebexStart_RetisterAll
mov byte [ebp - 0x290], al
lea ecx, [ebp - 0x70]
push dword [ebp - 0x290]
mov dword [ebp - 0x60], eax
push 0x22
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], al
call fcn.0043a610
push 0x40110105
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00620538
add esp, 0xc
push 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x1a
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x1b
push eax
push 0x858903
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.00439710
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x1c
push str.preJME__ProcessCommands__register_all
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1e
call fcn.006215aa
lea ecx, [ebp - 0x100]
call fcn.00438e20
lea ecx, [ebp - 0x118]
call fcn.00438e20
lea ecx, [ebp - 0x130]
call fcn.00438e20
mov eax, dword [ebp - 0x14]
mov esi, 0x1000
push 0x10
pop edi
cmp eax, edi
jb 0x4d1dce
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1dc5
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.00438e20
lea ecx, [ebp - 0x190]
call fcn.00438e20
mov eax, dword [ebp - 0x5c]
cmp eax, edi
jb 0x4d1e43
mov ecx, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1e3a
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], cl
cmp eax, edi
jb 0x4d1e9c
mov ecx, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1e91
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], cl
mov byte [ebp - 4], cl
cmp eax, edi
jb 0x4d1ef4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d1eeb
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
lea eax, [ebp - 0x130]
push eax
call fcn.00543f2f
pop ecx
lea ecx, [ebp - 0x130]
call fcn.004c0931
push 0
call fcn.004cf9f4
pop ecx
call fcn.004cf2b8
call fcn.004f2a50
test eax, eax
je 0x4d1f31
call fcn.004d22ae
call fcn.004f7bcb
jmp 0x4d2164
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x40], 0
call fcn.00439710
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x1f
push eax
call fcn.006210e3
mov edi, eax
mov dword [esp], str.CGPCSystemUtil::GetProcessName__
xor eax, eax
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x290], al
lea ecx, [ebp - 0x70]
push dword [ebp - 0x290]
mov dword [ebp - 0x60], eax
push 0x20
mov byte [ebp - 0x70], al
call fcn.0043a610
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 0x20
push eax
call fcn.00501c54
push eax
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x21
push eax
call fcn.0062113d
add esp, 0xc
push 0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x22
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x23
push eax
push 0x858903
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.00439710
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x24
push 0x806358
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x25
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push esi
push eax
mov ecx, edi
mov byte [ebp - 4], 0x26
call fcn.006215aa
lea ecx, [ebp - 0x100]
call fcn.00438e20
lea ecx, [ebp - 0x118]
call fcn.00438e20
lea ecx, [ebp - 0x130]
call fcn.00438e20
mov eax, dword [ebp - 0x14]
mov esi, 0x1000
push 0x10
pop edi
cmp eax, edi
jb 0x4d208d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d2084
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00438e20
lea ecx, [ebp - 0x1c0]
call fcn.00438e20
lea ecx, [ebp - 0x190]
call fcn.00438e20
lea ecx, [ebp - 0x208]
call fcn.004c0931
mov eax, dword [ebp - 0x5c]
cmp eax, edi
jb 0x4d210d
mov ecx, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d2104
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x70], al
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2c]
cmp eax, edi
jb 0x4d2164
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4d215b
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x40], 0
call fcn.00439710
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x27
push eax
call fcn.006210e3
pop ecx
mov esi, eax
mov dword [ebp - 0x14], 0xf
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push 0x858903
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00439710
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x28
push str.preJME__ProcessCommands__register_all_finished
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x29
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0061c551
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2a
call fcn.006215be
lea ecx, [ebp - 0x100]
call fcn.00438e20
lea ecx, [ebp - 0x118]
call fcn.00438e20
lea ecx, [ebp - 0x130]
call fcn.00438e20
mov eax, dword [ebp - 0x14]
cmp eax, edi
jb 0x4d224f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, 0x1000
jb 0x4d2246
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, edi
jb 0x4d16f2
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ecx
cmp eax, 0x1000
jb 0x4d22a1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.007009b8
pop ecx
jmp 0x4d0b08