Function at 0x407010
Capabilities:
Check if file exists
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x248
mov eax, dword [0x48f008]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov dword [0x492128], 0
mov edi, 0x492140
mov dword [0x492118], 0
mov esi, 0x492118
mov dword [0x492130], 1
mov dword [0x492134], 0
mov dword [0x492140], 0x45f6a8
mov dword [0x48f8f0], 0x492118
mov ecx, dword [edi]
lea eax, [esi + 8]
push eax
push 0
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0x44], ecx
push eax
push 1
push ecx
push esi
mov dword [esp + 0x58], 0
lea edi, [edi + 4]
push 0x406f10
mov dword [esi + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov esi, dword [esi]
test esi, esi
jne 0x407072
push 0x4640d0
push str.__s__built_using_kernullist_library__Apr__7_2021_15:15:06_.__n
call fcn.0040ac70
push 0x4640d0
push str.__s__built_on_Apr__7_2021_17:48:29.__n
call fcn.0040ac70
push 0x4582b0
push 0x11c
call fcn.0043fc9a
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40714d
push 0x11c
push 0
push esi
call fcn.00441560
mov eax, dword [0x4948a8]
add esp, 0xc
mov dword [esi], 0x11c
test eax, eax
jne 0x40711d
push str.RtlGetVersion
push 0x47a174
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4948a8], eax
test eax, eax
je 0x40713f
push esi
call eax
test eax, eax
js 0x40713f
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push 0x4640d0
push str.__s__running_on_windows__d._d._d_x86__user_mode.__n
call fcn.0040ac70
add esp, 0x14
push 0x11c
push esi
call fcn.0043fc69
add esp, 8
lea ecx, [esp + 0x110]
call fcn.00421c20
mov esi, eax
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 2
mov ecx, esi
call dword [edi + 0x18]
mov eax, dword [esp + 0x14c]
mov dword [esp + method.js::dlp::plcmgr_device_control.virtual_0], vtable.js::dlp::plcmgr_device_control.0
mov dword [esp + method.kn::auto_handle_base_void___struct_kn::system::handle_delete_.virtual_0], vtable.kn::auto_handle_base_void___struct_kn::system::handle_delete_.0
test eax, eax
je 0x40719a
cmp eax, 0xffffffff
je 0x40719f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40719f
cmp eax, 0xffffffff
jne 0x4071aa
mov dword [esp + 0x14c], 0
lea ecx, [esp + 0x110]
mov dword [esp + method.kn::handle_storage_void__.virtual_0], vtable.kn::handle_storage_void__.0
call fcn.00406a30
lea ecx, [esp + 0x110]
call fcn.00421c20
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [esi]
call eax
push eax
mov ecx, esi
call dword [edi + 0x20]
mov eax, dword [esp + 0x14c]
mov dword [esp + method.js::dlp::plcmgr_device_control.virtual_0], vtable.js::dlp::plcmgr_device_control.0
mov dword [esp + method.kn::auto_handle_base_void___struct_kn::system::handle_delete_.virtual_0], vtable.kn::auto_handle_base_void___struct_kn::system::handle_delete_.0
test eax, eax
je 0x40720d
cmp eax, 0xffffffff
je 0x407212
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407212
cmp eax, 0xffffffff
jne 0x40721d
mov dword [esp + 0x14c], 0
lea ecx, [esp + 0x110]
mov dword [esp + method.kn::handle_storage_void__.virtual_0], vtable.kn::handle_storage_void__.0
call fcn.00406a30
xor eax, eax
mov dword [esp + 0xcc], 0
lea ecx, [esp + 0xbc]
mov dword [esp + 0xd0], 7
mov word [esp + 0xbc], ax
call fcn.004254b0
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4072f3
push str.jsdlp_installer.log
lea edx, [esp + 0xc0]
mov dword [esp + 0x100], eax
lea ecx, [esp + 0xf0]
mov dword [esp + 0x104], 7
mov word [esp + 0xf0], ax
call fcn.00405e40
add esp, 4
test al, al
jne 0x4073c1
mov edx, dword [esp + 0x100]
mov dword [esp + 0xc], 0x7a
cmp edx, 8
jb 0x4072f3
mov ecx, dword [esp + 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4072e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x407335
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40732b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00406fb0
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0xc]
mov ecx, eax
push eax
call fcn.0040bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_end_main___hs___exit_code___d_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov ecx, dword [esp + 0x280]
add esp, 0x34
mov eax, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x100], 8
lea eax, [esp + 0xec]
mov edi, dword [esp + 0xec]
cmovae eax, edi
mov dword [esp + 0x40], eax
call fcn.00406de0
mov edx, dword [esp + 0x40]
mov esi, eax
test edx, edx
je 0x4074c4
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040b450
add esp, 4
test al, al
je 0x4074bd
cmp dword [esi + 0x10], 0
mov word [esi + 0x18], 0x101
je 0x4075ab
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40741f
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4075ab
cmp dword [esi + 0x14], 8
mov ecx, esi
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
jb 0x407448
mov ecx, dword [esi]
push ecx
lea edx, [esp + 0x44]
call fcn.00415380
mov edx, dword [esp + 0x44]
add esp, 4
mov ecx, dword [esp + 0x44]
mov eax, edx
or eax, ecx
je 0x4075ab
cmp edx, 0xffffffff
jne 0x407474
cmp ecx, edx
je 0x4075ab
test ecx, ecx
jl 0x4075ab
jg 0x40748a
cmp edx, 0xa00000
jbe 0x4075ab
cmp dword [esi + 0x10], 0
je 0x4074a9
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40749a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4075ab
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x4074b8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov edi, dword [esp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
push 0x71
push str.C:codeswindows_dlp_rootcommonjsdlp_sourcejsdlp_installerexewinmain.cpp
push str._warning___jsdlp_installer__wWinMain:_kn::trace_logger::instance____initialize___failed.__s___d__pid___d__tid___d__n
call fcn.0040ac70
add esp, 0x14
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:______________________________________________________________________________________________________n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
call fcn.004455ae
cmp dword [eax], 0
jne 0x4075bd
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:__no_args__n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
jmp 0x4076ee
mov edi, dword [esp + 0xec]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x4074e8
call fcn.004455ae
cmp dword [eax], 0
je 0x4076ee
call fcn.004455b4
cmp dword [eax], 0
je 0x4076ee
xor eax, eax
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 7
xor esi, esi
mov word [esp + 0x8c], ax
call fcn.004455ae
cmp dword [eax], esi
jle 0x40762d
call fcn.004455b4
mov eax, dword [eax]
push dword [eax + esi*4]
lea eax, [esp + 0x90]
push 0x46439c
push eax
call fcn.0040aad0
add esp, 0xc
inc esi
call fcn.004455ae
cmp dword [eax], esi
jg 0x407604
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [esp + 0xa0], 8
lea esi, [esp + 0x8c]
cmovae esi, dword [esp + 0x8c]
call fcn.004455ae
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:__argc___d__argv___s__n
call fcn.00406de0
push eax
call fcn.0040b320
mov edx, dword [esp + 0xd4]
add esp, 0x34
cmp edx, 8
jb 0x4076ee
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4076e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a272
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x74]
mov dword [esp + 0x88], 7
mov word [esp + 0x74], ax
call fcn.0041f120
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [esp + 0x84], 0
jne 0x407738
mov eax, str.unknown_windows_version
jmp 0x407749
cmp dword [esp + 0x88], 8
lea eax, [esp + 0x74]
cmovae eax, dword [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_os_version:__s_n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
lea eax, [esp + 0x40]
xorps xmm0, xmm0
movaps xmmword [esp + 0x40], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_module_version:_1.0.34.0_x86_n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
mov dword [esp + 0x9c], 0
xor eax, eax
mov dword [esp + 0xa0], 7
lea ecx, [esp + 0x8c]
mov word [esp + 0x8c], ax
call fcn.00425690
mov dword [esp + 0xc], eax
test eax, eax
je 0x407947
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x407865
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40785b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x4078a4
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40789a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x4078fc
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4078f2
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407938
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
xor eax, eax
mov dword [esp + 0xe4], 0
push str.jsdlp_installer.dmp
lea edx, [esp + 0x90]
mov dword [esp + 0xec], 7
lea ecx, [esp + 0xd8]
mov word [esp + 0xd8], ax
call fcn.00405e40
add esp, 4
test al, al
jne 0x407b52
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_string_path_append___failed._n
call fcn.00406de0
push eax
call fcn.0040b320
mov edx, dword [esp + 0x114]
add esp, 0x2c
mov dword [esp + 0xc], 0x7a
cmp edx, 8
jb 0x407a2e
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407a24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x407a70
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407a66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x407aaf
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407aa5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x407b07
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x407afd
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407b43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
cmp dword [esp + 0xe8], 8
lea ecx, [esp + 0xd4]
cmovae ecx, dword [esp + 0xd4]
mov dword [esp + 0x70], ecx
call fcn.0040a290
mov edx, dword [esp + 0x70]
mov dword [esp + 0x40], eax
test edx, edx
jne 0x407b8b
mov dword [esp + 0xc], 0x57
jmp 0x407c2c
mov ecx, edx
mov dword [esp + 0x60], 0
xor eax, eax
mov dword [esp + 0x64], 7
mov word [esp + 0x50], ax
lea eax, [ecx + 2]
mov dword [esp + 0x70], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407bb0
sub ecx, dword [esp + 0x70]
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x58]
call fcn.0040b340
cmp dword [esp + 0x60], 0
je 0x407be8
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x50]
call fcn.00416fe0
test al, al
jne 0x407df6
mov edx, dword [esp + 0x64]
cmp edx, 8
jb 0x407c24
mov ecx, dword [esp + 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a277
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov dword [esp + 0xc], 0x7a
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0xc]
call fcn.0040bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_exception_handler::instance____initialize___failed___hs_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov eax, dword [esp + 0x118]
add esp, 0x30
cmp eax, 8
jb 0x407cd2
mov ecx, dword [esp + 0xd4]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407cc8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x407d14
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407d0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x407d53
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407d49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x407dab
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x407da1
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407de7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x64]
mov dword [eax + 0xa8], 0
cmp edx, 8
jb 0x407e40
mov ecx, dword [esp + 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407e36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a277
push edx
push ecx
call fcn.0043fc69
add esp, 8
call fcn.0040a290
push 0x41f8b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi + 0xac], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov eax, dword [0x4948b0]
test eax, eax
jne 0x407e8d
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4948b0], eax
test eax, eax
je 0x408092
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
push ecx
push esi
call eax
test eax, eax
je 0x408092
cmp dword [esp + 0x40], 0
je 0x408092
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_you_must_be_running_a_64_bit_installation._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
push 0x10
push str.JiranSecurity_DLP_Installer
push str.You_must_be_running_a_64_bit_installation.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esp + 0xe8]
mov dword [esp + 0xc], 0x32
cmp edx, 8
jb 0x407f6e
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407f64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x407fb0
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407fa6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x407fef
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407fe5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x408047
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x40803d
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408083
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
push 4
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0x6010000
push eax
call fcn.0041c730
test al, al
je 0x408290
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_unsupported_windows_versions._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
push 0x10
push str.JiranSecurity_DLP_Installer
push str.Unsupported_Windows_versions.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esp + 0xe8]
mov dword [esp + 0xc], 0x32
cmp edx, 8
jb 0x40816c
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408162
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x4081ae
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4081a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x4081ed
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4081e3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x408245
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x40823b
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408281
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
push 3
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0x6010000
push eax
call fcn.0041c730
test al, al
je 0x4082f0
push 5
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0x6010100
push eax
call fcn.0041c730
test al, al
je 0x4082f0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40851c
push str.CryptCATAdminAcquireContext2
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
test eax, eax
je 0x408516
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Global6F091F4E_2E64_4264_A939_B1653FA1B47A
push 0
xorps xmm0, xmm0
mov dword [esp + method.kn::auto_handle_base_void___struct_kn::system::handle_delete_.virtual_0], vtable.kn::auto_handle_void___struct_kn::system::handle_delete_.0
push 0
movlpd qword [esp + 0x114], xmm0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x108], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0xc], esi
test esi, esi
je 0x4086fe
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, esi
call fcn.0040bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_setup_acquire_lock___failed___hs_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov eax, dword [esp + 0x138]
add esp, 0x30
test eax, eax
je 0x4083b0
cmp eax, 0xffffffff
je 0x4083b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xe8]
cmp edx, 8
jb 0x4083f2
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4083e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x408434
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40842a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x408473
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408469
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x4084cb
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4084c1
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408507
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_windows_7_sha_2_update__KB3033929__required._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
push 0x10
push str.JiranSecurity_DLP_Installer
push str.Windows_7_SHA_2_update__KB3033929__required.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esp + 0xe8]
mov dword [esp + 0xc], 0x32
cmp edx, 8
jb 0x4085da
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4085d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x40861c
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408612
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x40865b
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408651
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x4086b3
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4086a9
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4086ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
lea ecx, [esp + 0x110]
mov dword [esp + 0x38], 0
call fcn.00421c20
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
mov dword [esp + method.js::dlp::plcmgr_device_control.virtual_0], vtable.js::dlp::plcmgr_device_control.0
mov eax, dword [esp + 0x14c]
sete byte [esp + 0x13]
mov dword [esp + method.kn::auto_handle_base_void___struct_kn::system::handle_delete_.virtual_0], vtable.kn::auto_handle_base_void___struct_kn::system::handle_delete_.0
test eax, eax
je 0x408756
cmp eax, 0xffffffff
je 0x40875b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40875b
cmp eax, 0xffffffff
jne 0x408766
mov dword [esp + 0x14c], 0
lea ecx, [esp + 0x110]
mov dword [esp + method.kn::handle_storage_void__.virtual_0], vtable.kn::handle_storage_void__.0
call fcn.00406a30
cmp byte [esp + 0x13], 0
je 0x408980
cmp dword [esp + 0x38], 3
jne 0x408980
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ecx, ecx
call fcn.0040bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_reboot_required_before_install_or_update._n
call fcn.00406de0
push eax
call fcn.0040b320
mov eax, dword [esp + 0x138]
add esp, 0x30
mov dword [esp + 0xc], 0xbc9
test eax, eax
je 0x40881a
cmp eax, 0xffffffff
je 0x40881a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xe8]
cmp edx, 8
jb 0x40885c
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408852
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x40889e
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408894
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x4088dd
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4088d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x408935
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x40892b
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408971
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
xor eax, eax
mov dword [esp + 0xb4], 0
lea ecx, [esp + 0xa4]
mov dword [esp + 0xb8], 7
mov word [esp + 0xa4], ax
call fcn.00420000
mov esi, eax
mov dword [esp + 0xc], esi
test esi, esi
je 0x408c01
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, esi
call fcn.0040bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_get_temp_jiransecurity_path___failed___hs_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov edx, dword [esp + 0xe8]
add esp, 0x30
cmp edx, 8
jb 0x408a64
mov ecx, dword [esp + 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a5a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
mov eax, dword [esp + 0x108]
mov dword [esp + 0xb8], 7
test eax, eax
je 0x408a9b
cmp eax, 0xffffffff
je 0x408a9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xe8]
cmp edx, 8
jb 0x408add
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ad3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x408b1f
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408b15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x408b5e
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408b54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x408bb6
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x408bac
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408bf2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
mov edx, dword [esp + 0xb4]
test edx, edx
je 0x408cc1
cmp dword [esp + 0xb8], 8
lea eax, [esp + 0xa4]
mov ecx, dword [esp + 0xa4]
mov esi, 0x5c
cmovae eax, ecx
cmp si, word [eax + edx*2 - 2]
mov esi, dword [esp + 0xb8]
je 0x408cc8
cmp esi, 8
lea eax, [esp + 0xa4]
mov esi, 0x2f
cmovae eax, ecx
cmp si, word [eax + edx*2 - 2]
mov esi, dword [esp + 0xb8]
je 0x408cc8
cmp esi, 8
lea eax, [esp + 0xa4]
mov esi, 0x5c
cmovae eax, ecx
cmp si, word [eax + edx*2 - 2]
mov esi, dword [esp + 0xb8]
je 0x408d4c
cmp esi, 8
lea eax, [esp + 0xa4]
cmovae eax, ecx
mov ecx, 0x2f
cmp cx, word [eax + edx*2 - 2]
je 0x408d4c
lea edx, [esp + 0x40]
mov dword [esp + 0x40], 0x5c
lea ecx, [esp + 0xa4]
call fcn.00406100
test al, al
je 0x408d4c
mov esi, dword [esp + 0xb8]
xor eax, eax
mov dword [esp + 0x244], 0x2f005c
lea ecx, [esp + 0x244]
mov word [esp + 0x248], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ce7
sub ecx, edx
lea eax, [esp + 0x244]
sar ecx, 1
mov edx, 0x17
push ecx
push 1
push ecx
push eax
mov ecx, str.DLPmarked_for_deletion
call fcn.00406280
add esp, 0x10
test eax, eax
je 0x408f9a
sub eax, str.DLPmarked_for_deletion
sar eax, 1
cmp eax, 0xffffffff
je 0x408f9a
push 0xffffffffffffffff
lea edx, [eax*2 + str.DLPmarked_for_deletion]
lea ecx, [esp + 0xa8]
call fcn.004064b0
add esp, 4
test al, al
jne 0x408f93
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x58]
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_string_path_append_marked_for_deletion_path__failed._n
call fcn.00406de0
push eax
call fcn.0040b320
mov edx, dword [esp + 0xe4]
add esp, 0x2c
mov dword [esp + 0xc], 0x7a
cmp edx, 8
jb 0x408df6
mov ecx, dword [esp + 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408dec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
mov eax, dword [esp + 0x108]
mov dword [esp + 0xb8], 7
test eax, eax
je 0x408e2d
cmp eax, 0xffffffff
je 0x408e2d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xe8]
cmp edx, 8
jb 0x408e6f
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408e65
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x408eb1
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ea7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x408ef0
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ee6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x408f48
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x408f3e
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408f84
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
jmp 0x40733b
mov esi, dword [esp + 0xb8]
lea eax, [esp + 0xa4]
mov dword [esp + 0x40], eax
cmp esi, 8
jb 0x408fbe
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x40], eax
test eax, eax
jne 0x408fbe
lea esi, [eax + 0x57]
jmp 0x408ff6
push dword [0x492158]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x40]
mov ecx, 0x48f900
push 0xffffffffffffffff
call fcn.0040b450
add esp, 4
push dword [0x492158]
test al, al
jne 0x40923b
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0x7a
lea eax, [esp + 0x40]
mov dword [esp + 0xc], esi
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, esi
call fcn.0040bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_set_marked_for_deletion_path___failed___hs_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov edx, dword [esp + 0xe8]
add esp, 0x30
cmp edx, 8
jb 0x4090a4
mov ecx, dword [esp + 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40909a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
mov eax, dword [esp + 0x108]
mov dword [esp + 0xb8], 7
test eax, eax
je 0x4090db
cmp eax, 0xffffffff
je 0x4090db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xe8]
cmp edx, 8
jb 0x40911d
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409113
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xa0]
cmp edx, 8
jb 0x40915f
mov ecx, dword [esp + 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409155
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0x88]
cmp edx, 8
jb 0x40919e
mov ecx, dword [esp + 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409194
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push edx
push ecx
call fcn.0043fc69
add esp, 8
xor eax, eax
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x88], 7
cmp eax, 8
jb 0x4091f6
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4091ec
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
push ecx
push edi
call fcn.0043fc69
add esp, 8
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40733b
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407938
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a27c
jmp 0x407938
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x110]
call fcn.00421c20
mov ecx, eax
push 0
mov edx, dword [eax]
mov eax, dword [edx + 0x3c]
call eax
mov ecx, dword [esp + 0x14c]
mov esi, eax
mov dword [esp + method.js::dlp::plcmgr_device_control.virtual_0], vtable.js::dlp::plcmgr_device_control.0
mov dword [esp + method.kn::auto_handle_base_void___struct_kn::system::handle_delete_.virtual_0], vtable.kn::auto_handle_base_void___struct_kn::system::handle_delete_.0
test ecx, ecx
je 0x409289
cmp ecx, 0xffffffff
je 0x40928e
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40928e
cmp ecx, 0xffffffff
jne 0x409299
mov dword [esp + 0x14c], 0
lea ecx, [esp + 0x110]
mov dword [esp + method.kn::handle_storage_void__.virtual_0], vtable.kn::handle_storage_void__.0
call fcn.00406a30
test esi, esi
je 0x409320
lea eax, [esp + 0x40]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, esi
call fcn.0040bee0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_plcmgr_device_control__.set_protection_0__failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
jmp 0x40932c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x110]
call fcn.00421c20
push 0
push 0
mov ecx, eax
mov edx, dword [eax]
push 0xffffffffffffffff
mov eax, dword [edx + 0x58]
call eax
mov ecx, dword [esp + 0x14c]
mov dword [esp + 0x40], eax
mov dword [esp + method.js::dlp::plcmgr_device_control.virtual_0], vtable.js::dlp::plcmgr_device_control.0
mov dword [esp + method.kn::auto_handle_base_void___struct_kn::system::handle_delete_.virtual_0], vtable.kn::auto_handle_base_void___struct_kn::system::handle_delete_.0
test ecx, ecx
je 0x40937a
cmp ecx, 0xffffffff
je 0x40937f
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40937f
cmp ecx, 0xffffffff
jne 0x40938a
mov dword [esp + 0x14c], 0
lea ecx, [esp + 0x110]
mov dword [esp + method.kn::handle_storage_void__.virtual_0], vtable.kn::handle_storage_void__.0
call fcn.00406a30
cmp dword [esp + 0x40], 0
je 0x409408
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x40]
call fcn.0040bee0
push eax
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_plcmgr_device_control__.set_active_policies___failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____opening_the_device._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push str..jsdlp_plcmgr
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40976c
cmp eax, 0xffffffff
je 0x40976c
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____set_except_process._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
call esi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x70], eax
call fcn.00405f00
mov byte [esp + 0x13], al
test al, al
jne 0x409507
mov dword [esp + 0x40], 6
jmp 0x409542
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push 0
push 0
push 4
lea eax, [esp + 0x84]
push eax
push 0x222028
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4095a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x40], eax
test eax, eax
je 0x4095a4
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x40]
call fcn.0040bee0
push eax
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____device_transaction_by_handle___jsdlp_ioctl_plcmgr_add_except_process__failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
jmp 0x4095fa
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____device_transaction_by_handle___jsdlp_ioctl_plcmgr_add_except_process__returns_success._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____clear_protection._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
mov dword [esp + 0x70], 0
cmp byte [esp + 0x13], 0
jne 0x409669
mov dword [esp + 0x40], 6
jmp 0x4096a7
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push 0
push 0
push 4
lea eax, [esp + 0x84]
push eax
push 0x2220f0
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x409710
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x40], eax
test eax, eax
je 0x409710
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x40]
call fcn.0040bee0
push eax
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____device_transaction_by_handle___jsdlp_ioctl_plcmgr_set_protection__failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
mov eax, dword [esp + 0x44]
add esp, 0x30
jmp 0x4097dd
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____device_transaction_by_handle___jsdlp_ioctl_plcmgr_set_protection__returns_success._n
call fcn.00406de0
push eax
call fcn.0040b320
mov eax, dword [esp + 0x40]
add esp, 0x2c
jmp 0x4097dd
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040bee0
push eax
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:____deprecated_support_updates_from_v1_0_26_or_lower____CreateFile___failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
mov eax, dword [esp + 0x44]
add esp, 0x30
test eax, eax
je 0x4097e4
cmp eax, 0xffffffff
je 0x4097e4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea eax, [esp + 0x50]
push eax
movlpd qword [esp + 0x44], xmm0
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_checking_modules_to_install_or_update.._n
call fcn.00406de0
push eax
call fcn.0040b320
xor eax, eax
mov dword [esp + 0x1ec], 1
add esp, 0x2c
mov word [esp + 0x1d0], ax
xorps xmm0, xmm0
mov dword [esp + 0x200], eax
mov word [esp + 0x1f0], ax
lea ecx, [esp + 0x110]
mov dword [esp + 0x228], eax
mov word [esp + 0x218], ax
lea eax, [esp + 0x1c0]
push eax
mov dword [esp + 0x1cc], 0xffffffff
mov dword [esp + 0x1e4], 0
mov dword [esp + 0x1e8], 7
movlpd qword [esp + 0x1ec], xmm0
mov dword [esp + 0x208], 7
movlpd qword [esp + 0x20c], xmm0
movlpd qword [esp + 0x214], xmm0
mov dword [esp + 0x230], 7
movlpd qword [esp + 0x234], xmm0
movlpd qword [esp + 0x23c], xmm0
call fcn.0040a810
lea ecx, [esp + 0x1d0]
call fcn.0040a880
lea eax, [esp + 0x1c0]
push eax
call fcn.0040a780
mov eax, dword [esp + 0x1c0]
cmp dword [esp + 0x110], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
je 0x409981
nop word [eax + eax]
lea ecx, [esp + 0x110]
call fcn.0042aa70
mov dword [esp + 0x40], eax
mov ecx, dword [eax]
call fcn.0042a990
test al, al
je 0x409965
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
or ecx, dword [eax + 0x20]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x70]
or ecx, dword [eax + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x110]
call fcn.0040a760
mov eax, dword [esp + 0x1c0]
cmp dword [esp + 0x110], eax
jne 0x409930
lea ecx, [esp + 0x1d0]
call fcn.0040a880
lea ecx, [esp + 0x120]
call fcn.0040a880
push dword [esp + 0x70]
lea ecx, [esp + 0x1ac]
push dword [esp + 0x20]
call fcn.0042aca0
add esp, 8
lea ecx, [esp + 0x190]
push eax
call fcn.0040a700
lea ecx, [esp + 0x1a8]
call fcn.0040a6b0
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [esp + 0x1a0], 0
jne 0x4099ed
mov eax, 0x466924
jmp 0x4099f9
lea ecx, [esp + 0x190]
call fcn.0040a6a0
push eax
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_installed_modules___hs._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
mov byte [esp + 0x13], 0
call fcn.004455ae
cmp dword [eax], 2
jne 0x409e27
call fcn.004455b4
xorps xmm0, xmm0
movaps xmmword [esp + 0x50], xmm0
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esp + 0x18]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_load_install_config___s_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov ecx, dword [esp + 0x48]
add esp, 0x30
call fcn.004149c0
test al, al
jne 0x409b8d
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esp + 0x18]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_the_install_config_file_not_found___s_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov dword [esp + 0x3c], 2
add esp, 0x30
lea ecx, [esp + 0x190]
call fcn.0040a6b0
lea ecx, [esp + 0xa4]
call fcn.00406eb0
lea ecx, [esp + 0x104]
call fcn.00406b60
lea ecx, [esp + 0xd4]
call fcn.00406eb0
lea ecx, [esp + 0x8c]
call fcn.00406eb0
lea ecx, [esp + 0x74]
call fcn.00406eb0
lea ecx, [esp + 0xec]
call fcn.00406eb0
lea ecx, [esp + 0xbc]
call fcn.00406eb0
jmp 0x40733b
mov ecx, dword [esp + 0x18]
call fcn.0042bc30
mov dword [esp + 0xc], eax
test eax, eax
je 0x409c07
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0xc]
call fcn.0040bee0
push eax
push dword [esp + 0x1c]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_load_install_config__s__failed___hs_._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x34
jmp 0x409b2b
call fcn.0042bd90
mov eax, dword [eax + 0x28]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x409dc3
test eax, eax
je 0x409dc3
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x14]
mov ecx, edx
call fcn.0042aba0
push eax
push edx
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_client_id___d___hs_._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x34
call fcn.0042bd90
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x40], edx
test ecx, ecx
jne 0x409ca6
test edx, edx
je 0x409d75
push 0
push 1
push edx
push ecx
call fcn.0040a3c0
add esp, 0x10
test al, al
je 0x409d75
push edx
push dword [esp + 0x10]
lea ecx, [esp + 0x58]
call fcn.0042aca0
add esp, 8
lea ecx, [esp + 0x1a8]
push eax
call fcn.0040a700
lea ecx, [esp + 0x50]
call fcn.0040a6b0
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [esp + 0x1b8], 0
jne 0x409d07
mov eax, 0x466924
jmp 0x409d13
lea ecx, [esp + 0x1a8]
call fcn.0040a6a0
push eax
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_installing_modules___hs._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
mov byte [esp + 0x13], 1
lea ecx, [esp + 0x1a8]
call fcn.0040a6b0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0xc]
jmp 0x409e8b
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esp + 0x18]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_invalid_module_info_flags___s_._n
jmp 0x409e0f
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esp + 0x18]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_invalid_client_id___s_._n
call fcn.00406de0
push eax
call fcn.0040b320
mov dword [esp + 0x3c], 0xd
jmp 0x409b28
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x68]
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_default_installation._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x2c
mov dword [esp + 0x14], 0
or ecx, 0xffffffff
or eax, 0xffffffff
or eax, dword [esp + 0x70]
xorps xmm0, xmm0
or ecx, dword [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x40], eax
mov edi, ecx
lea eax, [esp + 0x50]
mov dword [esp + 0xc], ecx
push eax
not edi
movaps xmmword [esp + 0x54], xmm0
not esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0042aca0
add esp, 8
mov ecx, eax
call fcn.0040a6a0
push eax
push ecx
push dword [esp + 0x48]
lea ecx, [esp + 0x1b4]
push dword [esp + 0x18]
call fcn.0042aca0
add esp, 0xc
mov ecx, eax
call fcn.0040a6a0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_modules_to_install_or_update___hs___modules_to_uninstall___hs._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x34
lea ecx, [esp + 0x1a8]
call fcn.0040a6b0
lea ecx, [esp + 0x20]
call fcn.0040a6b0
push esi
push edi
push dword [esp + 0x48]
push dword [esp + 0x18]
call fcn.00404920
add esp, 0x10
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc], esi
xorps xmm0, xmm0
movaps xmmword [esp + 0x50], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, esi
call fcn.0040bee0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_install_or_update___returns__hs._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
cmp byte [esp + 0x13], 0
je 0x40a222
mov eax, dword [esp + 0xc]
test eax, eax
je 0x409fed
cmp eax, 0xbc2
jne 0x40a222
mov ecx, dword [esp + 0x14]
call fcn.0042a990
test al, al
je 0x40a0d7
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x14]
call fcn.0042aba0
push eax
mov dword [esp + 0x74], eax
call edi
push eax
call esi
movzx ecx, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x66]
push ecx
movzx ecx, word [esp + 0x6c]
push ecx
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_try_to_unregister_an_existing_client__hs._n
call fcn.00406de0
push eax
call fcn.0040b320
mov ecx, dword [esp + 0x44]
add esp, 0x30
call fcn.0042a900
mov dword [esp + 0x40], eax
test eax, eax
je 0x40a0d7
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x40]
call fcn.0040bee0
push eax
push dword [esp + 0x74]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_unregister_client__hs__failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x34
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x54], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.0042bd90
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.0042aba0
lea ecx, [edx + 0x38]
mov dword [esp + 0x40], eax
call fcn.00406990
push eax
push dword [esp + 0x44]
call edi
push eax
call esi
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_try_to_register_a_new_client__hs__desc___s_._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x34
call fcn.0042bd90
mov esi, eax
call fcn.0042bd90
lea edx, [esi + 0x38]
mov ecx, dword [eax + 0x28]
call fcn.0042a7d0
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movaps xmmword [esp + 0x50], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test esi, esi
jne 0x40a1cd
push dword [esp + 0x40]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_the_client__hs_was_registered_successfully._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x30
jmp 0x40a222
mov ecx, esi
call fcn.0040bee0
push eax
push dword [esp + 0x44]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
movzx eax, word [esp + 0x72]
push eax
movzx eax, word [esp + 0x74]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x76]
push eax
movzx eax, word [esp + 0x78]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d____d._d__wWinMain:_register_client__hs__failed___hs___continue._n
call fcn.00406de0
push eax
call fcn.0040b320
add esp, 0x34
call fcn.004167c0
lea ecx, [esp + 0x110]
call fcn.00421c20
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x58]
lea ecx, [esp + 0x110]
call fcn.00406ba0
lea ecx, [esp + 0x1c0]
call fcn.00421c20
push 0xffffffffffffffff
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x3c]
lea ecx, [esp + 0x1c0]
call fcn.00406ba0
jmp 0x409b2b
call fcn.0044316c
call fcn.0044316c
call fcn.0044316c
int3