Function at 0x4d3f9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x10c
mov eax, 0x61e6e1
call fcn.0042d958
mov edi, ecx
mov esi, dword [ebp + 8]
lea ebx, [edi + 8]
push esi
mov ecx, ebx
call fcn.004142ba
push esi
push str.SOFTWAREMicrosoftOneDriveTenants_
lea eax, [ebp - 0x28]
push eax
call fcn.0041991d
and dword [ebp - 4], 0
mov ecx, edi
call fcn.004d3597
mov ecx, edi
call fcn.004d39c2
mov ecx, edi
call fcn.004d345e
mov ecx, edi
call fcn.004d37f5
xor eax, eax
mov dword [ebp - 0x44], 7
xor esi, esi
mov word [ebp - 0x58], ax
push str.DisablePersonalSync
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], esi
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 1
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00414483
push esi
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 1
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d405b
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
push 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
pop esi
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4086
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.DisablePersonalSync
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 3
push str.SoftwareMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 1
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d40f2
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d411a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.GPOSetUpdateRing
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 5
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 2
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4186
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d41ae
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.EnableEnterpriseUpdate
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 7
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 3
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d421e
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 7
cmp eax, 8
jb 0x4d424a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
call fcn.004c7ae4
test al, al
jne 0x4d4389
xor eax, eax
mov dword [ebp - 0x44], 7
xor esi, esi
mov word [ebp - 0x58], ax
push str.EnableEnterpriseUpdate
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], esi
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 9
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00414483
push esi
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 3
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d42ca
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
push 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
pop esi
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d42f5
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.EnableEnterpriseUpdate
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0xb
push str.SoftwareMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 3
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4361
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4389
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
mov esi, str.DefaultRootDir
lea eax, [ebp - 0x70]
push esi
push str.SoftwarePoliciesMicrosoftOneDrive
push eax
call fcn.004cc3af
push 0
push ebx
push eax
push reloc.WS2_32.dll_accept
push 4
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.004d308c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00415bf1
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], 7
push esi
mov word [ebp - 0x58], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 4
call fcn.004d308c
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4d4411
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
mov esi, str.DisableCustomRoot
lea eax, [ebp - 0x70]
push esi
push str.SoftwarePoliciesMicrosoftOneDrive
push eax
call fcn.004cc3af
push 0
push ebx
push eax
push reloc.WS2_32.dll_accept
push 5
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.004d308c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00415bf1
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], 7
push esi
mov word [ebp - 0x58], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 5
call fcn.004d308c
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4d4499
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x44], esi
push str.AutomaticUploadBandwidthPercentage
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x11
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 8
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4508
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4530
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.AutomaticUploadBandwidthPercentage
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x13
push str.SoftwareMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 8
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d459c
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d45c4
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.GPOEnabled
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x15
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 9
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4630
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4658
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.GPOEnabled
mov word [ebp - 0x58], ax
call fcn.00414483
push str.Remote_Access
push str.SoftwareMicrosoftOneDrive
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x17
push eax
call fcn.004cc3af
push 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x18
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 9
mov ecx, edi
call fcn.004d308c
lea ecx, [ebp - 0x70]
call fcn.00415bf1
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4d46c6
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.PreventNetworkTrafficPreUserSignIn
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x19
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xa
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4732
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d475a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.PreventNetworkTrafficPreUserSignIn
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x1b
push str.SoftwareMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xa
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d47c6
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d47ee
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.SilentAccountConfig
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x1d
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d485a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4882
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.SilentAccountConfig
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x1f
push str.SoftwareMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d48ee
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4916
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
mov esi, str.DiskSpaceCheckThresholdMB
lea eax, [ebp - 0x70]
push esi
push str.SoftwarePoliciesMicrosoftOneDrive
push eax
call fcn.004cc3af
push 0
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xc
mov ecx, edi
mov byte [ebp - 4], 0x21
call fcn.004d308c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00415bf1
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], 7
push esi
mov word [ebp - 0x58], ax
call fcn.00414483
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xc
call fcn.004d308c
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4d499e
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x44], esi
push str.FilesOnDemandEnabled
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x23
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xd
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4a0d
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4a35
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], esi
push str.DehydrateSyncedTeamSites
mov word [ebp - 0x58], ax
call fcn.00414483
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov byte [ebp - 4], 0x25
push str.SoftwarePoliciesMicrosoftOneDrive
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xe
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4aa1
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
and dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
cmp eax, 8
jb 0x4d4ac9
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
push str.AllowTenantList
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x70]
push eax
call fcn.004cc3af
push 0
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0xf
mov ecx, edi
mov byte [ebp - 4], 0x27
call fcn.004d308c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00415bf1
push str.BlockTenantList
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x70]
push eax
call fcn.004cc3af
push 0
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x10
mov ecx, edi
mov byte [ebp - 4], 0x28
call fcn.004d308c
xor ebx, ebx
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00415bf1
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.UploadBandwidthLimit
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x29
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 0x11
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4b9d
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4bc4
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.DownloadBandwidthLimit
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x2b
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 0x12
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4c2d
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4c54
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.SharePointOnPremPrioritization
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x2d
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x13
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4cbd
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4ce4
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.SharePointOnPremFrontDoorUrl
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x2f
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x30
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x14
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4d4d
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4d74
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.SharePointOnPremTenantName
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x31
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x32
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x15
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4ddd
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4e04
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.DisableTutorial
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x33
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x34
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 0x16
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4e6d
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4e94
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.DisableTutorial
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x35
push str.SoftwareMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 0x16
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d4efd
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4f24
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push 0x677a8c
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
push str.TenantAutoMount
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x37
push eax
call fcn.004cc3af
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x38
push ecx
push eax
push reloc.WS2_32.dll_accept
push 0x1f
mov ecx, edi
call fcn.004d308c
lea ecx, [ebp - 0x70]
call fcn.00415bf1
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4f8f
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push 0x677a8c
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
push str.TenantAutoMount
push str.SoftwarePoliciesMicrosoftOneDrive
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x39
push eax
call fcn.004cc3af
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x3a
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x1f
mov ecx, edi
call fcn.004d308c
lea ecx, [ebp - 0x70]
call fcn.00415bf1
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d4ffa
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.LocalMassDeleteFileDeleteThreshold
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x3b
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x20
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d5063
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d508a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.MinDiskSpaceLimitInMB
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x3d
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x23
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d50f3
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d511a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.WarningMinDiskSpaceLimitInMB
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x3f
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x24
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d5183
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d51aa
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.ForcedLocalMassDeleteDetection
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x41
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x25
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d5213
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d523a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x48], ebx
push str.PermitDisablePermissionInheritance
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], esi
mov word [ebp - 0x58], ax
call fcn.00414483
xor eax, eax
mov byte [ebp - 4], 0x43
push str.SoftwarePoliciesMicrosoftOneDrive
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00414483
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x26
call fcn.004d308c
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4d52a3
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004157b4
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d52ca
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.004157b4
push str.EnableAutomaticUploadBandwidthManagement
lea ecx, [ebp - 0x40]
call fcn.00414308
mov esi, str.SoftwarePoliciesMicrosoftOneDrive
mov byte [ebp - 4], 0x45
push esi
lea ecx, [ebp - 0x58]
call fcn.00414308
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x27
call fcn.004d308c
lea ecx, [ebp - 0x58]
call fcn.00415bf1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.AADJMachineDomainGuid
lea ecx, [ebp - 0x88]
call fcn.00414308
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x47
call fcn.00414308
push ebx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x48
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x28
call fcn.004d308c
lea ecx, [ebp - 0x58]
call fcn.00415bf1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.EnableOneNoteSupportPreview
lea ecx, [ebp - 0x118]
call fcn.00414308
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x49
call fcn.00414308
push ebx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0x88]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x29
call fcn.004d308c
lea ecx, [ebp - 0x88]
call fcn.00415bf1
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], bl
call fcn.00415bf1
mov esi, str.EnableODIgnoreListFromGPO
lea ecx, [ebp - 0xa0]
push esi
call fcn.00414308
push esi
mov byte [ebp - 4], 0x4b
mov esi, str.SoftwarePoliciesMicrosoftOneDrive
push esi
lea eax, [ebp - 0x118]
push eax
call fcn.004cc3af
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x4c
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2a
mov ecx, edi
call fcn.004d308c
lea ecx, [ebp - 0x118]
call fcn.00415bf1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.SyncAdminReportsPreview
lea ecx, [ebp - 0xb8]
call fcn.00414308
push esi
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x4d
call fcn.00414308
push ebx
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x4e
push eax
lea eax, [ebp - 0xa0]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2b
call fcn.004d308c
lea ecx, [ebp - 0xa0]
call fcn.00415bf1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.SyncAdminReports
lea ecx, [ebp - 0xd0]
call fcn.00414308
push esi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x4f
call fcn.00414308
push ebx
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x50
push eax
lea eax, [ebp - 0xb8]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2c
call fcn.004d308c
lea ecx, [ebp - 0xb8]
call fcn.00415bf1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.DisableFirstDeleteDialog
lea ecx, [ebp - 0xe8]
call fcn.00414308
push esi
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x51
call fcn.00414308
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x52
push ebx
push eax
lea eax, [ebp - 0xd0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2f
mov ecx, edi
call fcn.004d308c
lea ecx, [ebp - 0xd0]
call fcn.00415bf1
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.TelemetryUploadUri
lea ecx, [ebp - 0x100]
call fcn.00414308
push esi
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x53
call fcn.00414308
push ebx
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x54
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0x30
call fcn.004d308c
lea ecx, [ebp - 0xe8]
call fcn.00415bf1
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], bl
call fcn.00415bf1
push str.DisableFREAnimation
lea ecx, [ebp - 0x70]
call fcn.00414308
push esi
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x55
call fcn.00414308
push ebx
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x56
push eax
lea eax, [ebp - 0x100]
mov ecx, edi
push eax
push reloc.WS2_32.dll_accept
push 0x31
call fcn.004d308c
lea ecx, [ebp - 0x100]
call fcn.00415bf1
lea ecx, [ebp - 0x70]
call fcn.00415bf1
lea ecx, [ebp - 0x28]
call fcn.00415bf1
call fcn.0042d907
ret 4