Function at 0x57d510
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61cd1d
mov eax, dword fs:[0]
push eax
sub esp, 0x304
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2ec]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2d4], 0
call fcn.00589d5a
mov dword [ebp - 4], 0
mov dword [ebp - 0x2dc], 0
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 1
push eax
push 0x657120
push 0x17
push 0
push 0x657130
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x57d5d3
push dword [ebp - 0x2d0]
call dword [sym.imp.ole32.dll_OleRun]
mov esi, eax
test esi, esi
js 0x57d5c3
mov eax, dword [ebp - 0x2d0]
lea edx, [ebp - 0x2dc]
push edx
push 0x655f44
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x2d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jns 0x57d5fb
mov dword [ebp - 0x2dc], 0
test esi, esi
jns 0x57d5fb
push esi
push str.could_not_create_instance__error_0x_08x_
push str.XMLPolicyParser::XMLEFRPolicyParser::TryParseEFRPolicyXml
push 1
call fcn.00587c13
add esp, 0x10
jmp 0x57f785
cmp dword [edi + 0x14], 8
jb 0x57d603
mov edi, dword [edi]
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push edi
call fcn.004a83f0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d62a
push 0x80004003
call fcn.00586de0
mov byte [ebp - 4], 1
call fcn.004a88e0
test ax, ax
jne 0x57d651
push str.could_not_load_xml
push str.XMLPolicyParser::XMLEFRPolicyParser::TryParseEFRPolicyXml
push 1
call fcn.00587c13
add esp, 0xc
jmp 0x57f785
lea ecx, [ebp - 0x2cc]
call fcn.0040bfc0
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 3
call fcn.005822d0
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 4
call fcn.0051c610
push str.XPath
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 5
call fcn.004a8360
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.004a8500
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 7
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str.SelectionLanguage
call fcn.004a8360
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d6ce
push 0x80004003
call fcn.00586de0
mov byte [ebp - 4], 7
call fcn.004a8970
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x24]
push eax
call esi
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2d8]
test ecx, ecx
je 0x57d6f6
call fcn.004a84b0
push str.xmlns:ahttp:__schema.checkpoint.com_policy_v1_
lea ecx, [ebp - 0x2d8]
call fcn.004a8360
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.004a8500
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0xa
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str.SelectionNamespaces
call fcn.004a8360
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d746
push 0x80004003
call fcn.00586de0
mov byte [ebp - 4], 0xa
call fcn.004a8970
lea eax, [ebp - 0x24]
push eax
call esi
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2d8]
test ecx, ecx
je 0x57d768
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:enable_efr
call fcn.004a83f0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d793
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 5
push eax
call fcn.004a8800
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57d7f9
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0xe
mov eax, dword [eax]
test eax, eax
je 0x57d7cb
mov eax, dword [eax]
jmp 0x57d7cd
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d8]
mov byte [ebp - 0x160], al
test ecx, ecx
je 0x57d7f9
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:DiskSpaceUsage
call fcn.004a83f0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d824
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57d85c
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57d856
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57d872
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57d8c0
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x10
mov eax, dword [eax]
test eax, eax
je 0x57d890
mov eax, dword [eax]
jmp 0x57d892
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a5b0
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d8]
movsd qword [ebp - 0x124], xmm0
test ecx, ecx
je 0x57d8c0
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:WarnUser
call fcn.004a83f0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d8eb
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57d923
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57d91d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57d939
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57d985
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x12
mov eax, dword [eax]
test eax, eax
je 0x57d957
mov eax, dword [eax]
jmp 0x57d959
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d8]
mov byte [ebp - 0x144], al
test ecx, ecx
je 0x57d985
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:WarnUserFreeSpace
call fcn.004a83f0
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57d9b0
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57d9e8
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57d9e2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57d9fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57da4c
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x14
mov eax, dword [eax]
test eax, eax
je 0x57da1c
mov eax, dword [eax]
jmp 0x57da1e
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a5b0
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d8]
movsd qword [ebp - 0x13c], xmm0
test ecx, ecx
je 0x57da4c
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:WarnUserUnits
call fcn.004a83f0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57da77
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57daaf
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57daa9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57dac5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57db2c
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x16
mov eax, dword [eax]
test eax, eax
je 0x57dae3
mov eax, dword [eax]
jmp 0x57dae5
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a650
add esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d8]
test al, al
sete bl
test ecx, ecx
je 0x57db10
call fcn.004a84b0
test bl, bl
je 0x57db2c
movsd xmm0, qword [ebp - 0x13c]
movaps xmm1, xmm0
call fcn.0057a680
movsd qword [ebp - 0x13c], xmm0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:DeactivateEfr
call fcn.004a83f0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57db57
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57db8f
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57db89
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57dba5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57dbf1
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x18
mov eax, dword [eax]
test eax, eax
je 0x57dbc3
mov eax, dword [eax]
jmp 0x57dbc5
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d8]
mov byte [ebp - 0x134], al
test ecx, ecx
je 0x57dbf1
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:DeactivateEfrFreeSpace
call fcn.004a83f0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57dc1c
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57dc54
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57dc4e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57dc6a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57dcb8
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x1a
mov eax, dword [eax]
test eax, eax
je 0x57dc88
mov eax, dword [eax]
jmp 0x57dc8a
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a5b0
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d8]
movsd qword [ebp - 0x12c], xmm0
test ecx, ecx
je 0x57dcb8
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:DeactivateEfrUnits
call fcn.004a83f0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57dce3
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57dd1b
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57dd15
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57dd31
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57dd98
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x1c
mov eax, dword [eax]
test eax, eax
je 0x57dd4f
mov eax, dword [eax]
jmp 0x57dd51
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a650
add esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d8]
test al, al
sete bl
test ecx, ecx
je 0x57dd7c
call fcn.004a84b0
test bl, bl
je 0x57dd98
movsd xmm0, qword [ebp - 0x12c]
movaps xmm1, xmm0
call fcn.0057a680
movsd qword [ebp - 0x12c], xmm0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:DiskSpace_a:DiskSpaceUsageUnits
call fcn.004a83f0
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57ddc3
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57ddfb
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ddf5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57de11
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57de78
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x1e
mov eax, dword [eax]
test eax, eax
je 0x57de2f
mov eax, dword [eax]
jmp 0x57de31
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a650
add esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d8]
test al, al
sete bl
test ecx, ecx
je 0x57de5c
call fcn.004a84b0
test bl, bl
je 0x57de78
movsd xmm0, qword [ebp - 0x124]
movaps xmm1, xmm0
call fcn.0057a680
movsd qword [ebp - 0x124], xmm0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:UepmPolicyInfo__policyName
call fcn.004a83f0
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57dea3
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57dedb
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ded5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57def1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57df30
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x20
mov eax, dword [eax]
test eax, eax
je 0x57df0f
mov eax, dword [eax]
jmp 0x57df11
xor eax, eax
push eax
lea ecx, [ebp - 0x188]
call fcn.00434220
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d8]
test ecx, ecx
je 0x57df30
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d4], esp
push str._a:EFRPolicy_a:UepmPolicyInfo__policyVersion
call fcn.004a83f0
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57df5b
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57df93
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57df8d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x57dfa9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e041
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x22
mov eax, dword [eax]
test eax, eax
je 0x57dfcb
mov eax, dword [eax]
jmp 0x57dfcd
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.004347d0
mov byte [ebp - 4], 0x23
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae esi, dword [ebp - 0x2c]
call fcn.005dae4c
push 0xa
mov dword [eax], 0
lea eax, [ebp - 0x2d8]
push eax
push esi
call fcn.005ddccf
add esp, 0xc
mov edi, eax
cmp esi, dword [ebp - 0x2d8]
jne 0x57e016
push str.invalid_stoi_argument
call fcn.0059dcf3
call fcn.005dae4c
cmp dword [eax], 0x22
je 0x57e06c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x164], edi
call fcn.00413860
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x57e041
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:UepmPolicyInfo__installedOn
call fcn.004a83f0
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e076
push 0x80004003
call fcn.00586de0
push str.stoi_argument_out_of_range
call fcn.0059dd33
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e0ae
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e0a8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e0c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e124
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x25
mov eax, dword [eax]
test eax, eax
je 0x57e0e2
mov eax, dword [eax]
jmp 0x57e0e4
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.004347d0
push ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x26
call fcn.00507b60
add esp, 4
mov dword [ebp - 0x16c], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x168], edx
call fcn.00413860
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x57e124
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:EnabledSal_a:User
call fcn.004a83f0
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e14f
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e187
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e181
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e19d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e1e9
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x28
mov eax, dword [eax]
test eax, eax
je 0x57e1bb
mov eax, dword [eax]
jmp 0x57e1bd
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x15e], al
test ecx, ecx
je 0x57e1e9
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:EnabledSal_a:File
call fcn.004a83f0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e214
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e24c
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e246
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e262
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e2ae
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x2a
mov eax, dword [eax]
test eax, eax
je 0x57e280
mov eax, dword [eax]
jmp 0x57e282
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x15d], al
test ecx, ecx
je 0x57e2ae
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:EnabledSal_a:Injection
call fcn.004a83f0
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e2d9
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e311
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e30b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e327
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e373
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x2c
mov eax, dword [eax]
test eax, eax
je 0x57e345
mov eax, dword [eax]
jmp 0x57e347
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x15c], al
test ecx, ecx
je 0x57e373
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:EnabledSal_a:Network
call fcn.004a83f0
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e39e
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e3d6
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e3d0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e3ec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e438
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x2e
mov eax, dword [eax]
test eax, eax
je 0x57e40a
mov eax, dword [eax]
jmp 0x57e40c
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x15b], al
test ecx, ecx
je 0x57e438
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:EnabledSal_a:Process
call fcn.004a83f0
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e463
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e49b
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e495
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e4b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e4fd
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x30
mov eax, dword [eax]
test eax, eax
je 0x57e4cf
mov eax, dword [eax]
jmp 0x57e4d1
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x15a], al
test ecx, ecx
je 0x57e4fd
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:EnabledSal_a:Registry
call fcn.004a83f0
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e528
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e560
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e55a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e576
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e5c2
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x32
mov eax, dword [eax]
test eax, eax
je 0x57e594
mov eax, dword [eax]
jmp 0x57e596
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x159], al
test ecx, ecx
je 0x57e5c2
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:ProcessExclusion_a:ProcessList
call fcn.004a83f0
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e5ed
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e625
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e61f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e63b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e656
lea eax, [ebp - 0x2cc]
push eax
push ecx
mov eax, esp
push ecx
mov dword [eax], ecx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0057c200
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:log_a:logAll
call fcn.004a83f0
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e681
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e6b9
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e6b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e6cf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e71b
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x35
mov eax, dword [eax]
test eax, eax
je 0x57e6ed
mov eax, dword [eax]
jmp 0x57e6ef
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x15f], al
test ecx, ecx
je 0x57e71b
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:ftp_a:url
call fcn.004a83f0
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e746
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e77e
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e778
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e794
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e7d3
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x37
mov eax, dword [eax]
test eax, eax
je 0x57e7b2
mov eax, dword [eax]
jmp 0x57e7b4
xor eax, eax
push eax
lea ecx, [ebp - 0x98]
call fcn.00434220
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x57e7d3
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:ftp_a:username
call fcn.004a83f0
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e7fe
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e836
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e830
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e84c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e888
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x39
mov eax, dword [eax]
test eax, eax
je 0x57e86a
mov eax, dword [eax]
jmp 0x57e86c
xor eax, eax
push eax
lea ecx, [ebp - 0x68]
call fcn.00434220
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x57e888
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:ftp_a:password
call fcn.004a83f0
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57e8b3
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57e8eb
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57e8e5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57e901
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57e93d
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x3b
mov eax, dword [eax]
test eax, eax
je 0x57e91f
mov eax, dword [eax]
jmp 0x57e921
xor eax, eax
push eax
lea ecx, [ebp - 0x80]
call fcn.00434220
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x57e93d
call fcn.004a84b0
mov esi, dword [ebp - 0x154]
mov edi, dword [ebp - 0x150]
nop dword [eax]
cmp esi, edi
je 0x57e969
cmp dword [esi + 0x10], 0
je 0x57e964
push esi
push esi
call fcn.0058c407
add esp, 8
add esi, 0x60
jmp 0x57e950
push str._a:EFRPolicy_a:EnableEventsDetectionByConfidence
lea ecx, [ebp - 0x2c]
call fcn.004347d0
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0057f830
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x57e9aa
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
push str._a:EFRPolicy_a:QuarantineMachineByConfidence
lea ecx, [ebp - 0x2c]
call fcn.004347d0
lea eax, [ebp - 0xfc]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0057f830
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x57e9eb
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
call fcn.0058dfd1
test eax, eax
jne 0x57ea5b
push str._a:EFRPolicy_a:AttackRemediationByConfidence
lea ecx, [ebp - 0x2c]
call fcn.004347d0
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0057f830
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
call fcn.00413860
mov edx, dword [ebp - 0xd8]
mov byte [ebp - 0xbc], 0
mov eax, dword [edx]
cmp eax, edx
je 0x57ea5b
nop dword [eax + eax]
cmp dword [eax + 0xc], 0
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1c], ecx
jne 0x57ea54
mov eax, dword [eax]
cmp eax, edx
jne 0x57ea40
jmp 0x57ea5b
mov byte [ebp - 0xbc], 1
push 0x1a
xor eax, eax
mov dword [ebp - 0x18], 7
push str._a:EFRPolicy_a:Remediation
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004346a0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x3f
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0057fb00
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x57eab2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
push 0x26
xor eax, eax
mov dword [ebp - 0x18], 7
push str._a:EFRPolicy_a:FileOps_a:SystemFileOps
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004346a0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0057fde0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x57eb06
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
push 0x27
xor eax, eax
mov dword [ebp - 0x18], 7
push str._a:EFRPolicy_a:FileOps_a:RegularFileOps
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004346a0
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x41
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0057fde0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x57eb5a
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
push 0x1a
xor eax, eax
mov dword [ebp - 0x18], 7
push str._a:EFRPolicy_a:RegistryOps
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004346a0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00580030
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x57ebae
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00434bd0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:AntiRansomeWare_a:MaintenanceTasks_a:CPUUtilization
call fcn.004a83f0
mov byte [ebp - 4], 0x43
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57ebd9
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57ec11
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ec0b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57ec27
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57ec3f
lea eax, [ebp - 0x40]
push eax
push ecx
mov eax, esp
push ecx
mov dword [eax], ecx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00580f80
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str._a:EFRPolicy_a:AntiRansomeWare_a:AntiRansomewareEnabled
call fcn.004a83f0
mov byte [ebp - 4], 0x44
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57ec6a
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57eca2
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ec9c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57ecb8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57ed26
lea eax, [ebp - 0x2d8]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x45
mov eax, dword [eax]
mov dword [ebp - 0x2d4], 1
test eax, eax
je 0x57ece0
mov eax, dword [eax]
jmp 0x57ece2
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
add esp, 0x18
test al, al
je 0x57ed09
cmp byte [ebp - 0x160], 0
mov byte [ebp - 0x269], 1
jne 0x57ed10
mov byte [ebp - 0x269], 0
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2d8]
test ecx, ecx
je 0x57ed26
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._a:EFRPolicy_a:AntiRansomeWare_a:SilentModeEnable
call fcn.004a83f0
mov byte [ebp - 4], 0x46
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57ed4e
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57ed86
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ed80
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57ed9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57edf1
cmp byte [ebp - 0x268], 0
jne 0x57edf1
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x47
mov eax, dword [eax]
test eax, eax
je 0x57edc3
mov eax, dword [eax]
jmp 0x57edc5
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x268], al
test ecx, ecx
je 0x57edf1
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._a:EFRPolicy_a:AntiRansomeWare_a:networkShareProtectionEnabled
call fcn.004a83f0
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57ee19
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57ee51
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ee4b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57ee67
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57eebc
cmp byte [ebp - 0x268], 0
jne 0x57eebc
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x49
mov eax, dword [eax]
test eax, eax
je 0x57ee8e
mov eax, dword [eax]
jmp 0x57ee90
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.005915b6
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
mov byte [ebp - 0x267], al
test ecx, ecx
je 0x57eebc
call fcn.004a84b0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._a:EFRPolicy_a:AntiRansomeWare_a:BackupAndRestore_a:BackupDiskSpaceUsageGB
call fcn.004a83f0
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57eee4
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57ef1c
mov dword [ebp - 0x2d0], edx
mov dword [eax], 0
test ecx, ecx
je 0x57ef16
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x57ef32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x57ef88
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a86c0
mov byte [ebp - 4], 0x4b
mov eax, dword [eax]
test eax, eax
je 0x57ef50
mov eax, dword [eax]
jmp 0x57ef52
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004347d0
call fcn.0057a5b0
divsd xmm0, qword [0x680bd0]
mov byte [ebp - 4], 0xd
add esp, 0x18
mov ecx, dword [ebp - 0x2d4]
movsd qword [ebp - 0x25c], xmm0
test ecx, ecx
je 0x57ef88
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._a:EFRPolicy_a:AntiRansomeWare_a:BackupAndRestore_a:BackupTimeIntervalMinutes
call fcn.004a83f0
mov byte [ebp - 4], 0x4c
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
jne 0x57efb0
push 0x80004003
call fcn.00586de0
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a8800
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [eax]
cmp ecx, edx
je 0x57efe8
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x57f799
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x2ec]
call fcn.0058a0dc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 8