Function at 0x43a000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c696f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb2c
push esi
push edi
mov byte [ebp - 0x9c], 0
xor eax, eax
mov al, byte [0x521341]
test eax, eax
je 0x43a040
mov byte [ebp - 0x9c], 1
mov byte [0x521341], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4f565c
call fcn.0040e116
add esp, 8
cmp dword [0x521a00], 0x67
jge 0x43a05f
jmp 0x43c3dc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00439f35
add esp, 0xc
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
jne 0x43a087
jmp 0x43c3dc
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 4
and ecx, 1
cmp ecx, 1
jne 0x43a0ae
mov byte [0x52134c], 1
jmp 0x43a0b5
mov byte [0x52134c], 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.RtlLib.dll_RT_GetStatusLinkInfo]
add esp, 0x10
cmp dword [0x521a00], 0x6d
jge 0x43a10b
call dword [sym.imp.RtlLib.dll_RT_Disassociate]
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetNetworkType]
add esp, 4
jmp 0x43a12e
cmp dword [0x521a4c], 2
je 0x43a11d
cmp dword [0x521a4c], 3
jne 0x43a12e
call dword [sym.imp.RtlLib.dll_RT_Disassociate]
push 1
call dword [sym.imp.RtlLib.dll_RT_SetNetworkType]
add esp, 4
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
test edx, edx
je 0x43a16c
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
cmp edx, 2
jbe 0x43a217
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x43a217
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x60]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetChannel]
add esp, 4
mov eax, dword [ebp - 0x9c]
and eax, 0xff
test eax, eax
je 0x43a1e7
xor ecx, ecx
mov cl, byte [0x52134c]
test ecx, ecx
je 0x43a1e7
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov esi, dword [ebp + 8]
add esi, edx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004400ee
add esp, 0x440
jmp 0x43a212
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov esi, dword [ebp + 8]
add esi, eax
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fff4
add esp, 0x440
jmp 0x43c3dc
cmp dword [0x521a4c], 2
je 0x43a22d
cmp dword [0x521a4c], 3
jne 0x43a8c5
push 0x440
mov ecx, dword [ebp + 8]
push ecx
push 0x505a90
call fcn.0048a150
add esp, 0xc
push 0x32
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x32]
push ecx
push 0x505a90
call fcn.0048a150
add esp, 0xc
mov edx, dword [0x505aec]
and edx, 0xfffffff7
mov dword [0x505aec], edx
mov eax, dword [0x505aec]
and al, 0xf9
mov dword [0x505aec], eax
mov ecx, dword [0x505aec]
and ecx, 0xfffffffe
mov dword [0x505aec], ecx
mov edx, dword [0x505aec]
and dh, 0xf3
mov dword [0x505aec], edx
mov eax, dword [0x505aec]
and al, 0xef
mov dword [0x505aec], eax
sub esp, 0x440
mov ecx, 0x110
mov esi, 0x505a90
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00440071
add esp, 0x440
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0xd8], 0
jmp 0x43a2ef
mov ecx, dword [ebp - 0xd8]
add ecx, 1
mov dword [ebp - 0xd8], ecx
cmp dword [ebp - 0xd8], 0x1e
jge 0x43a39c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xd4]
push ecx
lea edx, [ebp - 0xdc]
push edx
call dword [sym.imp.RtlLib.dll_RT_GetStatusLinkInfo]
add esp, 0x10
cmp dword [ebp - 0xdc], 2
jne 0x43a342
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43a39c
cmp dword [ebp - 0xd8], 0x1e
jl 0x43a397
xor eax, eax
mov al, byte [0x521a05]
test eax, eax
je 0x43a397
cmp dword [ebp - 0xc8], 0
je 0x43a397
mov ecx, dword [ebp - 0xc8]
sub ecx, 1
mov dword [ebp - 0xc8], ecx
sub esp, 0x440
mov ecx, 0x110
mov esi, 0x505a90
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00440071
add esp, 0x440
mov dword [ebp - 0xd8], 0
jmp 0x43a2e0
push 0x521a80
lea ecx, [ebp - 0xf4]
call fcn.004a3312
mov dword [ebp - 4], 0
push 4
lea edx, [ebp - 0xb08]
push edx
lea ecx, [ebp - 0xf4]
call fcn.0049f64e
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xb28], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xb28]
push ecx
lea ecx, [ebp - 0xf4]
call fcn.004a33dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb08]
call fcn.004a32a4
mov edx, dword [ebp - 0xf4]
push edx
mov eax, dword [0x521864]
push eax
push 0x4f5674
lea ecx, [ebp - 0x204]
push ecx
call fcn.0048a750
add esp, 0x10
lea edx, [ebp - 0xfc]
push edx
lea eax, [ebp - 0x204]
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 6
push 0
lea ecx, [ebp - 0x214]
push ecx
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0x208], 6
mov dword [ebp - 0xf8], 1
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xf8]
push ecx
push 0
push 0x4f568c
mov edx, dword [ebp - 0xfc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43a4a7
lea eax, [ebp - 0x214]
push eax
call fcn.0048b5ba
add esp, 4
push eax
call dword [sym.imp.RtlLib.dll_RT_Set_Filter_Type]
add esp, 4
jmp 0x43a4b2
push 0
call dword [sym.imp.RtlLib.dll_RT_Set_Filter_Type]
add esp, 4
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0044068f
add esp, 4
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x43a581
mov eax, dword [ebp - 0x220]
imul eax, eax, 6
add eax, 1
push eax
call fcn.004a3802
add esp, 4
mov dword [ebp - 0xb0c], eax
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x220]
imul edx, edx, 6
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call fcn.0048a490
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.0044068f
add esp, 4
mov dword [ebp - 0x220], eax
mov dl, byte [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetFILTER_STA_ADDRESS]
add esp, 8
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0xb10], ecx
mov edx, dword [ebp - 0xb10]
push edx
call fcn.004a382b
add esp, 4
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x20c], 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
add ecx, 1
push ecx
call fcn.00440371
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a5c1
mov dl, byte [ebp - 0x20c]
add dl, 1
mov byte [ebp - 0x20c], dl
jmp 0x43a588
mov eax, dword [ebp - 0x20c]
and eax, 0xff
test eax, eax
je 0x43a6b7
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
imul ecx, ecx, 6
push ecx
call fcn.004a3802
add esp, 4
mov dword [ebp - 0xb14], eax
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 1
jmp 0x43a623
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
cmp dword [ebp - 0x228], ecx
jg 0x43a685
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x228]
push eax
call fcn.00440371
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a683
push 6
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x224]
add edx, dword [ebp - 0x22c]
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp - 0x22c]
add eax, 6
mov dword [ebp - 0x22c], eax
jmp 0x43a614
mov cl, byte [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetLOCKED_STA_ADDRESS]
add esp, 8
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xb18]
push ecx
call fcn.004a382b
add esp, 4
mov dword [ebp - 0x218], 0xa
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0xf0]
push eax
push 1
push 0x4f569c
push 0x4f56a8
call fcn.004298ee
add esp, 0x14
lea ecx, [ebp - 0xf0]
push ecx
call fcn.0048a4f0
add esp, 4
test eax, eax
je 0x43a724
lea edx, [ebp - 0xf0]
push edx
call fcn.0048b5ba
add esp, 4
cmp eax, 1
jne 0x43a717
push 1
call dword [sym.imp.RtlLib.dll_RT_SetIsHidden_SSID]
add esp, 4
jmp 0x43a722
push 0
call dword [sym.imp.RtlLib.dll_RT_SetIsHidden_SSID]
add esp, 4
jmp 0x43a72f
push 0
call dword [sym.imp.RtlLib.dll_RT_SetIsHidden_SSID]
add esp, 4
mov byte [ebp - 0x20c], 0
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
add ecx, 1
push ecx
call fcn.004404af
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a76f
mov dl, byte [ebp - 0x20c]
add dl, 1
mov byte [ebp - 0x20c], dl
jmp 0x43a736
mov eax, dword [ebp - 0x20c]
and eax, 0xff
test eax, eax
je 0x43a865
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
shl ecx, 3
push ecx
call fcn.004a3802
add esp, 4
mov dword [ebp - 0xb1c], eax
mov edx, dword [ebp - 0xb1c]
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 1
jmp 0x43a7d1
mov eax, dword [ebp - 0x234]
add eax, 1
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x20c]
and ecx, 0xff
cmp dword [ebp - 0x234], ecx
jg 0x43a833
lea edx, [ebp - 0xe4]
push edx
mov eax, dword [ebp - 0x234]
push eax
call fcn.004404af
add esp, 8
and eax, 0xff
test eax, eax
je 0x43a831
push 8
lea ecx, [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0x230]
add edx, dword [ebp - 0x238]
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp - 0x238]
add eax, 8
mov dword [ebp - 0x238], eax
jmp 0x43a7c2
mov cl, byte [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetDATA_RATE_STA]
add esp, 8
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xb20], eax
mov ecx, dword [ebp - 0xb20]
push ecx
call fcn.004a382b
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.004a32a4
xor edx, edx
mov dl, byte [0x521db2]
test edx, edx
je 0x43a8c5
xor eax, eax
mov al, byte [0x505fc1]
test eax, eax
jne 0x43a8c5
mov byte [0x52134c], 0
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov esi, dword [ebp + 8]
add esi, ecx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fa08
add esp, 0x440
jmp 0x43c3dc
mov edx, dword [ebp + 0x10]
push edx
push 0x4f56b8
call fcn.0040e116
add esp, 8
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 4
and edx, 1
test edx, edx
je 0x43a912
cmp dword [0x521a4c], 2
je 0x43a912
cmp dword [0x521a4c], 3
je 0x43a912
push 1
call dword [sym.imp.RtlLib.dll_RT_Set802_1xStatus]
add esp, 4
jmp 0x43a946
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
and edx, 0xffffffef
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x5c], edx
push 0
call dword [sym.imp.RtlLib.dll_RT_Set802_1xStatus]
add esp, 4
mov edx, dword [0x4f4e8c]
mov dword [edx + 0x43c], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.RtlLib.dll_RT_GetStatusLinkInfo]
add esp, 0x10
cmp dword [0x521a4c], 2
je 0x43a9b6
cmp dword [0x521a4c], 3
je 0x43a9b6
mov dword [ebp - 0x23c], 0x23c
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x478]
push edx
push 0x813bfe20
call dword [sym.imp.RtlLib.dll_RT_CustomRequest]
add esp, 0xc
call dword [sym.imp.RtlLib.dll_RT_REMOVE_PSK_CONX]
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x60]
cmp edx, 0x63
jne 0x43a9f0
cmp dword [0x521a4c], 2
je 0x43a9e3
cmp dword [0x521a4c], 3
jne 0x43a9ee
push 1
call dword [sym.imp.RtlLib.dll_RT_SetAUTOChannel]
add esp, 4
jmp 0x43aa2d
cmp dword [0x521a4c], 2
je 0x43aa02
cmp dword [0x521a4c], 3
jne 0x43aa0d
push 0
call dword [sym.imp.RtlLib.dll_RT_SetAUTOChannel]
add esp, 4
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x60]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetChannel]
add esp, 4
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x56]
test edx, edx
jne 0x43aabd
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x57]
test edx, edx
jne 0x43aabd
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x58]
test edx, edx
jne 0x43aabd
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x59]
test edx, edx
jne 0x43aabd
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x5a]
test edx, edx
jne 0x43aabd
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x5b]
test edx, edx
je 0x43aada
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x56]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetBSSID]
add esp, 4
call dword [sym.imp.RtlLib.dll_RT_GetPowerSaveMode]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetPowerSaveMode]
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.RtlLib.dll_RT_GetRates]
add esp, 0x14
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
xor eax, eax
cmp dword [ebp - 0x98], 0
setne al
push eax
call dword [sym.imp.RtlLib.dll_RT_SetRates]
add esp, 0x14
call dword [sym.imp.RtlLib.dll_RT_GetPreambleMode]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetPreambleMode]
add esp, 4
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
and eax, 1
test eax, eax
jne 0x43ac2f
mov dword [0x4f4e88], 7
push 0x40
push 0
call dword [sym.imp.RtlLib.dll_RT_SetPrivacy]
add esp, 8
mov ecx, dword [0x4f4e8c]
mov dword [ecx + 4], 1
cmp dword [0x521a4c], 2
je 0x43abad
cmp dword [0x521a4c], 3
je 0x43abad
push 0
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x4f4e8c]
mov dword [edx], 0
jmp 0x43abee
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
push edx
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
mov eax, dword [0x4f4e8c]
mov dword [eax], edx
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43ac03
cmp dword [0x521a00], 0x67
jne 0x43ac2a
push 0
push 0
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c2d3
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 2
je 0x43b0a9
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 3
je 0x43b0a9
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 4
and ecx, 1
cmp ecx, 1
je 0x43b0a9
mov edx, dword [0x4f4e8c]
mov dword [edx + 4], 0
mov dword [0x4f4e88], 0
mov dword [ebp - 0x484], 1
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 1
and edx, 3
test edx, edx
jne 0x43acda
mov dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
add ecx, eax
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
xor esi, esi
mov si, word [eax + edx + 0x62]
xor edx, edx
mov dx, word [ecx + esi*2 + 0x64]
xor eax, eax
cmp edx, 0xa
setg al
dec eax
and al, 0xc0
add eax, 0x80
push eax
push 1
call dword [sym.imp.RtlLib.dll_RT_SetPrivacy]
add esp, 8
cmp dword [0x521a4c], 2
je 0x43ad90
cmp dword [0x521a4c], 3
je 0x43ad90
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 3
and eax, 1
neg eax
sbb eax, eax
and eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 3
and eax, 1
neg eax
sbb eax, eax
and eax, dword [ebp - 0x484]
mov ecx, dword [0x4f4e8c]
mov dword [ecx], eax
jmp 0x43add2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
mov edx, dword [0x4f4e8c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + eax + 0x62]
mov eax, dword [0x4f4e8c]
mov dword [eax + 0x438], edx
mov ecx, dword [0x4f4e8c]
mov edx, dword [ecx + 0x438]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetDefaultKeyID]
add esp, 4
mov dword [ebp - 0x480], 0
jmp 0x43ae24
mov eax, dword [ebp - 0x480]
add eax, 1
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 4
jge 0x43ae9c
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
add edx, ecx
mov eax, dword [ebp - 0x480]
mov ecx, dword [0x4f4e8c]
mov esi, dword [ebp - 0x480]
mov dx, word [edx + esi*2 + 0x64]
mov word [ecx + eax*2 + 8], dx
push 0x10
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
add ecx, eax
mov edx, dword [ebp - 0x480]
shl edx, 4
lea eax, [ecx + edx + 0x6c]
push eax
mov ecx, dword [ebp - 0x480]
shl ecx, 4
mov edx, dword [0x4f4e8c]
lea eax, [edx + ecx + 0x10]
push eax
call fcn.0048a150
add esp, 0xc
jmp 0x43ae15
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x6c]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x64]
push eax
push 0
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x7c]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x66]
push eax
push 1
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x8c]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x68]
push eax
push 2
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x9c]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + ecx + 0x6a]
push eax
push 3
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov ecx, dword [0x4f4e8c]
mov edx, dword [ecx + 0x438]
shl edx, 4
mov eax, dword [0x4f4e8c]
lea ecx, [eax + edx + 0x10]
push ecx
mov edx, dword [0x4f4e8c]
mov eax, dword [edx + 0x438]
mov ecx, dword [0x4f4e8c]
xor edx, edx
mov dx, word [ecx + eax*2 + 8]
push edx
mov eax, dword [0x4f4e8c]
mov ecx, dword [eax + 0x438]
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetWEPKey]
add esp, 0xc
mov edx, dword [0x4f4e8c]
mov eax, dword [edx + 0x438]
push eax
call dword [sym.imp.RtlLib.dll_RT_SetDefaultKeyID]
add esp, 4
call dword [sym.imp.RtlLib.dll_RT_GetDefaultEncryptionAlgorithm]
add eax, 1
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0xb2c], ecx
cmp dword [ebp - 0xb2c], 3
ja case.default.0x43b002
mov edx, dword [ebp - 0xb2c]
jmp dword [edx*4 + 0x43c3ec]
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 1
jmp case.default.0x43b002
mov ecx, dword [0x4f4e8c]
mov dword [ecx + 4], 0
jmp case.default.0x43b002
mov edx, dword [0x4f4e8c]
mov dword [edx + 4], 4
jmp case.default.0x43b002
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43b056
cmp dword [0x521a00], 0x67
jne 0x43b0a4
mov edx, dword [ebp - 0x47c]
push edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
neg edx
sbb edx, edx
and edx, dword [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c2d3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 4
and edx, 1
cmp edx, 1
jne 0x43bc76
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 5
and edx, 7
test edx, edx
jne 0x43b4ea
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b12c
mov eax, dword [0x4f4e8c]
mov dword [eax], 8
push 8
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x4f4e88], 4
jmp 0x43b14d
mov ecx, dword [0x4f4e8c]
mov dword [ecx], 9
push 9
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x4f4e88], 6
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
mov dword [ebp - 0xb30], ecx
cmp dword [ebp - 0xb30], 3
ja case.default.0x43b17f
mov edx, dword [ebp - 0xb30]
jmp dword [edx*4 + 0x43c3fc]
mov dword [ebp - 0x488], 1
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b415
mov dword [ebp - 0x488], 2
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b415
mov dword [ebp - 0x488], 3
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b415
mov dword [ebp - 0x488], 4
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b415
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 4
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x3e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
push edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
push edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_tunnle]
add esp, 0xc
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
cmp edx, 4
jne 0x43b3f3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
add edx, 5
mov dword [ebp - 0x488], edx
jmp 0x43b415
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
add edx, 0xa
mov dword [ebp - 0x488], edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b48d
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43b45f
cmp dword [0x521a00], 0x67
jne 0x43b48b
mov edx, dword [ebp - 0x488]
push edx
push 6
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43b4e5
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43b4b9
cmp dword [0x521a00], 0x67
jne 0x43b4e5
mov edx, dword [ebp - 0x488]
push edx
push 7
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43bc71
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 1
jne 0x43b90a
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b54c
mov eax, dword [0x4f4e8c]
mov dword [eax], 0xa
push 0xa
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x4f4e88], 4
jmp 0x43b56d
mov ecx, dword [0x4f4e8c]
mov dword [ecx], 0xb
push 0xb
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov dword [0x4f4e88], 6
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
mov dword [ebp - 0xb34], ecx
cmp dword [ebp - 0xb34], 3
ja case.default.0x43b59f
mov edx, dword [ebp - 0xb34]
jmp dword [edx*4 + 0x43c40c]
mov dword [ebp - 0x48c], 1
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b835
mov dword [ebp - 0x48c], 2
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b835
mov dword [ebp - 0x48c], 3
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b835
mov dword [ebp - 0x48c], 4
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43b835
push 2
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x212]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x276]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 4
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x3e0]
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
push edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
push edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
push edx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_tunnle]
add esp, 0xc
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xc
and edx, 0xf
cmp edx, 4
jne 0x43b813
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x10
and edx, 0xf
add edx, 5
mov dword [ebp - 0x48c], edx
jmp 0x43b835
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0x14
and edx, 0xf
add edx, 0xa
mov dword [ebp - 0x48c], edx
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 2
jne 0x43b8ad
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43b87f
cmp dword [0x521a00], 0x67
jne 0x43b8ab
mov edx, dword [ebp - 0x48c]
push edx
push 8
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43b905
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43b8d9
cmp dword [0x521a00], 0x67
jne 0x43b905
mov edx, dword [ebp - 0x48c]
push edx
push 9
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43bc71
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 2
jne 0x43bc71
mov dword [0x4f4e88], 0
mov eax, dword [0x4f4e8c]
mov dword [eax], 0xc
push 0xc
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0xb38], eax
cmp dword [ebp - 0xb38], 3
ja case.default.0x43b97e
mov ecx, dword [ebp - 0xb38]
jmp dword [ecx*4 + 0x43c41c]
mov dword [ebp - 0x490], 1
push 2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43bc14
mov dword [ebp - 0x490], 2
push 2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43bc14
mov dword [ebp - 0x490], 3
push 2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x276]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43bc14
mov dword [ebp - 0x490], 4
push 2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
jmp 0x43bc14
push 2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x1e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 3
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x212]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 1
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x276]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
push 4
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x3e0]
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_conf]
add esp, 8
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x14
and ecx, 0xf
push ecx
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x10
and ecx, 0xf
push ecx
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
push ecx
call dword [sym.imp.RtlLib.dll_RT_Set_8021x_tunnle]
add esp, 0xc
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xc
and ecx, 0xf
cmp ecx, 4
jne 0x43bbf2
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x10
and ecx, 0xf
add ecx, 5
mov dword [ebp - 0x490], ecx
jmp 0x43bc14
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0x14
and ecx, 0xf
add ecx, 0xa
mov dword [ebp - 0x490], ecx
mov edx, dword [0x4f4e8c]
mov dword [edx + 4], 0
mov eax, dword [0x4f4e8c]
mov dword [eax + 0x43c], 1
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43bc45
cmp dword [0x521a00], 0x67
jne 0x43bc71
mov edx, dword [ebp - 0x490]
push edx
push 0xa
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c2d3
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x32]
push edx
call fcn.0048a4f0
add esp, 4
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x32]
push eax
lea ecx, [ebp - 0x6cc]
push ecx
call fcn.0048a150
add esp, 0xc
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x6d0], edx
push 6
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x56]
push edx
lea eax, [ebp - 0x6a8]
push eax
call fcn.0048a150
add esp, 0xc
push 0x20
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x1c0]
push eax
lea ecx, [ebp - 0x69c]
push ecx
call fcn.0048a150
add esp, 0xc
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x6a0], 0x20
mov dword [ebp - 0x494], 0x23c
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
test ecx, ecx
je 0x43c0e0
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 2
jne 0x43be8f
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 2
jne 0x43be0f
mov dword [0x4f4e88], 4
push 3
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x4f4e8c]
mov dword [edx], 3
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43bde6
cmp dword [0x521a00], 0x67
jne 0x43be0d
push 2
push 3
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43be83
mov dword [0x4f4e88], 6
push 6
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x4f4e8c]
mov dword [edx], 6
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43be5c
cmp dword [0x521a00], 0x67
jne 0x43be83
push 4
push 5
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
mov byte [ebp - 0x49a], 0
jmp 0x43bf9e
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 3
jne 0x43bf23
mov dword [0x4f4e88], 6
push 4
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x4f4e8c]
mov dword [edx], 4
push 6
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43befa
cmp dword [0x521a00], 0x67
jne 0x43bf21
push 3
push 4
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43bf97
mov dword [0x4f4e88], 4
push 7
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov edx, dword [0x4f4e8c]
mov dword [edx], 7
push 4
call dword [sym.imp.RtlLib.dll_RT_SetEncryptionStatus]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 4
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43bf70
cmp dword [0x521a00], 0x67
jne 0x43bf97
push 5
push 5
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
mov byte [ebp - 0x49a], 1
call dword [sym.imp.RtlLib.dll_RT_AP_GetIsAPMode]
and eax, 0xff
test eax, eax
jne 0x43c04b
lea edx, [ebp - 0x494]
push edx
lea eax, [ebp - 0x6d4]
push eax
push 0x813bfe1c
call dword [sym.imp.RtlLib.dll_RT_CustomRequest]
add esp, 0xc
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43bfe2
cmp dword [0x521a00], 0x67
jne 0x43c046
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
cmp dword [eax + edx + 0x1bc], 0x3f
ja 0x43c034
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x1bc]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0xbc]
push eax
call dword [sym.imp.RtlLib.dll_RT_ADD_PSK_CONX]
add esp, 8
jmp 0x43c046
push 0x20
lea ecx, [ebp - 0x69c]
push ecx
call dword [sym.imp.RtlLib.dll_RT_ADD_PMK_CONX]
add esp, 8
jmp 0x43c0db
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
cmp dword [eax + edx + 0x1bc], 0x40
je 0x43c09d
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x1bc]
push eax
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0xbc]
push eax
call dword [sym.imp.RtlLib.dll_RT_AP_SetPassphrase]
add esp, 8
jmp 0x43c0db
push 0
push 0x20
lea ecx, [ebp - 0x6f4]
push ecx
push 0x40
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0xbc]
push ecx
call fcn.0042fc57
add esp, 0x14
push 0x40
lea edx, [ebp - 0x6f4]
push edx
call dword [sym.imp.RtlLib.dll_RT_AP_SetPassphrase]
add esp, 8
jmp 0x43c2d3
mov byte [ebp - 0xb00], 0xff
mov byte [ebp - 0xaff], 0xff
mov byte [ebp - 0xafe], 0xff
mov byte [ebp - 0xafd], 0xff
mov byte [ebp - 0xafc], 0xff
mov byte [ebp - 0xafb], 0xff
mov eax, dword [0x4f4e8c]
add eax, 0x50
mov dword [ebp - 0xaf8], eax
push 6
lea ecx, [ebp - 0xb00]
push ecx
mov edx, dword [ebp - 0xaf8]
add edx, 0xc
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp - 0xaf8]
mov dword [eax + 4], 0
mov dword [ebp - 0xb04], 0x20
mov ecx, dword [ebp - 0xb04]
push ecx
lea edx, [ebp - 0x69c]
push edx
mov eax, dword [ebp - 0xaf8]
add eax, 0x20
push eax
call fcn.0048a150
add esp, 0xc
mov ecx, dword [ebp - 0xaf8]
mov edx, dword [ebp - 0xb04]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xaf8]
mov ecx, dword [eax + 8]
add ecx, 0x27
mov edx, dword [ebp - 0xaf8]
mov dword [edx], ecx
push 5
call dword [sym.imp.RtlLib.dll_RT_SetAuthenticaionMode]
add esp, 4
mov eax, dword [0x4f4e8c]
mov dword [eax], 5
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 2
jne 0x43c216
mov dword [0x4f4e88], 4
mov ecx, dword [0x4f4e8c]
mov dword [ecx + 4], 4
xor edx, edx
mov dl, byte [0x4f7471]
test edx, edx
jne 0x43c1ed
cmp dword [0x521a00], 0x67
jne 0x43c214
push 2
push 5
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 3
and edx, 1
push edx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
jmp 0x43c286
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 3
jne 0x43c286
mov dword [0x4f4e88], 6
mov eax, dword [0x4f4e8c]
mov dword [eax + 4], 6
xor ecx, ecx
mov cl, byte [0x4f7471]
test ecx, ecx
jne 0x43c25f
cmp dword [0x521a00], 0x67
jne 0x43c286
push 3
push 5
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x5c]
shr ecx, 3
and ecx, 1
push ecx
call dword [sym.imp.RtlLib.dll_RT_SetMHSecurityInfo]
add esp, 0xc
push 0x400
push 0
lea edx, [ebp - 0xaf4]
push edx
call fcn.0048a490
add esp, 0xc
push 0x3e8
mov eax, dword [0x4f4e8c]
add eax, 0x50
push eax
lea ecx, [ebp - 0xaec]
push ecx
call fcn.0048a150
add esp, 0xc
push 0x3e8
lea edx, [ebp - 0xaf4]
push edx
push 0xd01011d
call dword [sym.imp.RtlLib.dll_RT_SetOID]
add esp, 0xc
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0x5c]
shr edx, 4
and edx, 1
cmp edx, 1
jne 0x43c2fa
mov byte [0x52134c], 1
jmp 0x43c301
mov byte [0x52134c], 0
mov dword [ebp - 0x8c], 0x32
xor eax, eax
mov al, byte [0x5217ac]
test eax, eax
je 0x43c338
cmp dword [ebp - 0x8c], 0
je 0x43c338
mov ecx, dword [ebp - 0x8c]
sub ecx, 1
mov dword [ebp - 0x8c], ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43c30b
cmp dword [0x521a4c], 2
je 0x43c3bf
cmp dword [0x521a4c], 3
je 0x43c3bf
mov edx, dword [ebp - 0x9c]
and edx, 0xff
test edx, edx
je 0x43c392
xor eax, eax
mov al, byte [0x52134c]
test eax, eax
je 0x43c392
mov ecx, dword [ebp - 0x94]
imul ecx, ecx, 0x440
mov esi, dword [ebp + 8]
add esi, ecx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004400ee
add esp, 0x440
jmp 0x43c3bd
mov edx, dword [ebp - 0x94]
imul edx, edx, 0x440
mov esi, dword [ebp + 8]
add esi, edx
sub esp, 0x440
mov ecx, 0x110
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0043fff4
add esp, 0x440
jmp 0x43c3dc
mov eax, dword [ebp - 0x94]
imul eax, eax, 0x440
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x32]
push edx
call dword [sym.imp.RtlLib.dll_RT_SetSSID]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret