Function at 0x41cda0
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5d6769
push eax
mov eax, 0xcdd0
mov dword fs:[0], esp
call fcn.00454db0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xcdf4]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
mov dword [esp + 0x2c], esi
je 0x41cddf
mov ecx, edi
call fcn.0047eea0
jmp 0x41cde1
xor eax, eax
push eax
mov eax, dword [esp + 0xcdf4]
push eax
push str.ParsePolicy_dype_0x_x__Data_size__lu_
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x18
cmp edi, ebx
mov ebp, 2
je 0x41f6ec
mov ecx, edi
call fcn.0047eea0
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.0047f5c0
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x28], ebx
jbe 0x41f6ec
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
add ecx, 4
cmp ecx, eax
ja 0x41f6c7
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
mov edi, dword [eax + edx]
lea ecx, [eax + edx]
mov edx, dword [esp + 0x24]
add edi, 4
add eax, edi
mov dword [esp + 0x14], ecx
cmp eax, edx
mov dword [esp + 0x28], eax
ja 0x41f6ce
cmp dword [ecx + 4], 2
jne 0x41f69c
push str.ParsePolicy_parse_1
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
cmp edi, 0x1d
jbe 0x41cead
add edi, 0xffffffe3
cmp edi, 0x50
jb 0x41ceaf
mov eax, dword [esp + 0x14]
add eax, 0x1d
mov dword [esp + 0x18], eax
jmp 0x41ceb3
xor edi, edi
mov dword [esp + 0x18], ebx
lea ecx, [esi + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.0046c4d0
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x10]
push edx
push eax
push 0xaa
push str.ParsePolicy_line__lu__wstrTempFile__s__username__s__parse_2
push str.CheckModule
push 0xf
push 0x667744
mov dword [esp + 0xce04], ebx
call fcn.00447b00
mov ecx, dword [esp + 0xce0c]
add esp, 0x1c
lea eax, [ecx - 1]
cmp eax, 0x4f
ja case.0x41cf09.30
xor edx, edx
mov dl, byte [eax + 0x41f7a4]
jmp dword [edx*4 + 0x41f72c]
push str.ParsePolicy_POLICY_TYPE_SD_ONLINE_AUTH
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0xa518]
call fcn.004d6a20
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x98e8]
mov byte [esp + 0xcde8], 1
call fcn.004d6a20
push ebp
push ebx
push ebx
push str.SDRightsPolicy
mov byte [esp + 0xcdf8], 2
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x98e8]
mov byte [esp + 0xcde8], 1
call fcn.004d7370
lea ecx, [esp + 0x168]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5ef0ec
mov dword [esp + 0x17c], ebx
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 3
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ecx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 4
je 0x41cfd3
mov ecx, eax
call fcn.00421520
mov ebp, eax
jmp 0x41cfd5
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 3
je 0x41d009
mov edx, dword [esp + 0x18]
push edi
push edx
mov ecx, ebp
call fcn.00427480
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
push eax
push ecx
mov ecx, ebp
call fcn.004275f0
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5ef0ec
lea ecx, [esp + 0x168]
mov byte [esp + 0xcde8], 5
call fcn.00422ba0
lea ecx, [esp + 0x168]
mov byte [esp + 0xcde8], 1
call fcn.005bab7c
lea ecx, [esp + 0xa518]
mov byte [esp + 0xcde8], bl
call fcn.004d7370
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SD_OFFLINE_AUTH
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
push 0x18
call fcn.005bc14c
mov esi, eax
add esp, 0x14
mov dword [esp + 0x1c], esi
cmp esi, ebx
mov byte [esp + 0xcde8], 6
je 0x41d0a1
mov ecx, esi
call fcn.005bab49
mov dword [esi], method.CPtrArray.virtual_0
mov dword [esi + 0x14], ebx
mov dword [esp + 0x14], esi
jmp 0x41d0a5
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov byte [esp + 0xcde8], bl
cmp eax, ebx
je 0x41d1b1
mov ecx, dword [esp + 0x14]
call fcn.00422be0
cmp edi, 0x50
jb 0x41d1b1
mov esi, dword [esp + 0x18]
mov dword [esp + 0x20], edi
mov ecx, dword [esi + 0x48]
mov edi, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 0x44]
add ecx, eax
lea edx, [ecx + ecx + 0x54]
cmp edi, edx
jb 0x41d1b1
cmp word [esi + eax*2 + 0x50], bx
jne 0x41d190
cmp word [esi + ecx*2 + 0x52], bx
jne 0x41d190
push 0x5e0
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 7
je 0x41d12b
mov ecx, eax
call fcn.004e27c0
mov edi, eax
jmp 0x41d12d
xor edi, edi
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
mov byte [esp + 0xcde8], bl
mov ecx, dword [eax + 0x14]
push ecx
mov ecx, edi
call dword [edx + 0x10]
mov edx, dword [edi]
push esi
mov ecx, edi
call dword [edx + 0x94]
test eax, eax
je 0x41d15e
mov ecx, dword [esp + 0x14]
push edi
call fcn.0041f820
jmp 0x41d16a
cmp edi, ebx
je 0x41d16a
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov edx, dword [esi + 0x48]
xor ecx, ecx
mov cx, word [esi + 0x44]
lea eax, [ecx + edx]
mov edx, 0xffffffac
lea ecx, [eax + eax]
lea esi, [esi + eax*2 + 0x54]
sub edx, ecx
mov ecx, dword [esp + 0x20]
add ecx, edx
mov dword [esp + 0x20], ecx
jmp 0x41d1a6
mov edi, dword [esp + 0x20]
lea eax, [ecx + ecx]
mov ecx, 0xffffffac
sub ecx, eax
add edi, ecx
add esi, edx
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], 0x50
jae 0x41d0d2
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call fcn.005bab49
lea ecx, [esp + 0x64]
mov byte [esp + 0xcde8], 8
call fcn.005ba763
mov eax, dword [esp + 0x14]
xor esi, esi
mov byte [esp + 0xcde8], 9
cmp dword [eax + 8], ebx
jle 0x41d244
mov edx, dword [eax + 4]
mov ecx, dword [edx + esi*4]
cmp ecx, ebx
je 0x41d234
mov eax, dword [ecx]
call dword [eax + 0x90]
mov edi, eax
lea ecx, [esp + 0x3c]
push edi
call fcn.0041f820
mov ecx, dword [edi + 0x2ec]
lea edx, [ecx + ecx + 0x2f2]
lea ecx, [esp + 0x64]
push edx
call fcn.0041f800
mov eax, dword [edi + 0x2ec]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*2 + 0x2f2]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 8]
inc esi
cmp esi, ecx
jl 0x41d1e6
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x41d26c
lea ecx, [esp + 0x64]
mov byte [esp + 0xcde8], 8
call fcn.005ba796
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcde8], bl
call fcn.005bab7c
xor esi, esi
jmp 0x41d33a
push eax
call fcn.005bc14c
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [esp + 0x1c], esi
jne 0x41d2a7
lea ecx, [esp + 0x64]
mov byte [esp + 0xcde8], 8
call fcn.005ba796
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcde8], bl
call fcn.005bab7c
xor esi, esi
jmp 0x41d33a
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], esi
cmp eax, ebx
mov dword [esp + 0x18], ebx
jle 0x41d311
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x14]
mov ecx, dword [ecx + eax*4]
mov esi, dword [edx + eax*4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + eax*4]
mov ecx, dword [esp + 0x14]
add ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + eax*4]
push eax
call fcn.005bc175
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
add esp, 4
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x41d2b7
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x64]
mov dword [esp + 0x18], edx
mov byte [esp + 0xcde8], 8
call fcn.005ba796
lea ecx, [esp + 0x3c]
mov byte [esp + 0xcde8], bl
call fcn.005bab7c
lea ecx, [esp + 0x50]
call fcn.005ba41a
mov edi, dword [esp + 0x18]
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x58]
mov byte [esp + 0xcdf0], 0xa
call fcn.005ba47a
mov ecx, edi
mov edi, dword [esp + 0x54]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.004214a0
cmp eax, ebx
je 0x41d455
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0047e380
add esp, 0xc
lea ecx, [esp + 0x9f38]
mov byte [esp + 0xcde8], 0xb
call fcn.004e27c0
mov edx, dword [0x5f5614]
mov dword [esp + 0x30], edx
push str.SDOfflinePolicy
lea eax, [esp + 0x34]
push str._s_2
push eax
mov byte [esp + 0xcdf4], 0xd
call fcn.0046ff60
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x40]
mov eax, dword [ecx + 8]
mov ecx, dword [esp + 0x44]
push ecx
push eax
push edx
call fcn.004a9710
add esp, 0x1c
mov esi, eax
mov eax, dword [esp + 0x58]
push esi
push eax
push str.ParsePolicy_POLICY_TYPE_SD_OFFLINE_AUTH_size_0x_x__WriteIniString
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x18
cmp esi, ebx
je 0x41d41f
mov ebp, 1
lea ecx, [esp + 0x30]
mov byte [esp + 0xcde8], 0xc
call fcn.0046cf50
lea ecx, [esp + 0x9f38]
mov byte [esp + 0xcde8], 0xb
call fcn.004e2d70
lea ecx, [esp + 0x34]
mov byte [esp + 0xcde8], 0xa
call fcn.0046cf50
lea ecx, [esp + 0x50]
mov byte [esp + 0xcde8], bl
call fcn.005ba44d
mov esi, dword [esp + 0x2c]
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SD_AGENT_CONFIG
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x3340]
call fcn.004ecd20
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x58f8]
mov byte [esp + 0xcde8], 0xe
call fcn.004ecd20
push ebp
push ebx
push ebx
push str.SDParamPolicy
mov byte [esp + 0xcdf8], 0xf
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x58f8]
mov byte [esp + 0xcde8], 0xe
call fcn.0041fbd0
lea ecx, [esp + 0x210]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5ef0d4
mov dword [esp + 0x224], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x10
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x11
je 0x41d531
mov ecx, eax
call fcn.004215d0
mov ebp, eax
jmp 0x41d533
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x10
je 0x41d567
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00427880
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.004279f0
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5ef0d4
lea ecx, [esp + 0x210]
mov byte [esp + 0xcde8], 0x12
call fcn.00422c20
lea ecx, [esp + 0x210]
mov byte [esp + 0xcde8], 0xe
call fcn.005bab7c
lea ecx, [esp + 0x3678]
mov byte [esp + 0xcde8], 0x14
call fcn.00473c70
lea ecx, [esp + 0x3668]
mov byte [esp + 0xcde8], 0x13
call fcn.00473c70
lea ecx, [esp + 0x3340]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_AGENT_CONFIG
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x1ec0]
call fcn.004c6e10
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x5588]
mov byte [esp + 0xcde8], 0x15
call fcn.004c6e10
push ebp
push ebx
push ebx
push str.ConfigPolicy
mov byte [esp + 0xcdf8], 0x16
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x5588]
mov byte [esp + 0xcde8], 0x15
call fcn.0041fc30
lea ecx, [esp + 0xd8]
call fcn.005bab49
mov dword [esp + 0xd8], 0x5ef0c8
mov dword [esp + 0xec], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x17
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x18
je 0x41d6a2
mov ecx, eax
call fcn.00421680
mov ebp, eax
jmp 0x41d6a4
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x17
je 0x41d6d8
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00427cb0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00427e20
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xd8], 0x5ef0c8
lea ecx, [esp + 0xd8]
mov byte [esp + 0xcde8], 0x19
call fcn.00422c60
lea ecx, [esp + 0xd8]
mov byte [esp + 0xcde8], 0x15
call fcn.005bab7c
lea ecx, [esp + 0x221c]
mov byte [esp + 0xcde8], 0x1d
call fcn.00473c70
lea ecx, [esp + 0x2208]
mov byte [esp + 0xcde8], 0x1c
call fcn.005ba796
lea ecx, [esp + 0x21f8]
mov byte [esp + 0xcde8], 0x1b
call fcn.00473c70
lea ecx, [esp + 0x21e8]
mov byte [esp + 0xcde8], 0x1a
call fcn.00473c70
lea ecx, [esp + 0x1ec0]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SD_SAFE_COMM
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x2c50]
call fcn.004f2010
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x6028]
mov byte [esp + 0xcde8], 0x1e
call fcn.004f2010
push ebp
push ebx
push ebx
push str.SDGatewayPolicy
mov byte [esp + 0xcdf8], 0x1f
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x6028]
mov byte [esp + 0xcde8], 0x1e
call fcn.0041fcb0
lea ecx, [esp + 0x1c8]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5ef0bc
mov dword [esp + 0x1dc], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x20
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x21
je 0x41d83b
mov ecx, eax
call fcn.00421730
mov ebp, eax
jmp 0x41d83d
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x20
je 0x41d871
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00428100
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00428270
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5ef0bc
lea ecx, [esp + 0x1c8]
mov byte [esp + 0xcde8], 0x22
call fcn.00422ca0
lea ecx, [esp + 0x1c8]
mov byte [esp + 0xcde8], 0x1e
call fcn.005bab7c
lea ecx, [esp + 0x2fbc]
mov byte [esp + 0xcde8], 0x25
call fcn.00423af0
lea ecx, [esp + 0x2fa0]
mov byte [esp + 0xcde8], 0x24
call fcn.00423cf0
lea ecx, [esp + 0x2f78]
mov byte [esp + 0xcde8], 0x23
call fcn.00420ee0
lea ecx, [esp + 0x2c50]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_BASIC
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x1b80]
call fcn.00529ba0
lea ecx, [esp + 0x1ea8]
mov byte [esp + 0xcde8], 0x26
call fcn.004bd630
mov dword [esp + 0x1b80], 0x5eefec
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x4e88]
mov byte [esp + 0xcde8], 0x27
call fcn.0041fdd0
push ebp
push ebx
push ebx
push str.BasicPolicy
mov byte [esp + 0xcdf8], 0x28
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x4e88]
mov byte [esp + 0xcde8], 0x27
call fcn.0041fe20
lea ecx, [esp + 0x108]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eefe0
mov dword [esp + 0x11c], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x29
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x2a
je 0x41d9df
mov ecx, eax
call fcn.004217e0
mov ebp, eax
jmp 0x41d9e1
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x29
je 0x41da15
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00428590
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00428720
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eefe0
lea ecx, [esp + 0x108]
mov byte [esp + 0xcde8], 0x2b
call fcn.00422ce0
lea ecx, [esp + 0x108]
mov byte [esp + 0xcde8], 0x27
call fcn.005bab7c
lea ecx, [esp + 0x1ea8]
mov byte [esp + 0xcde8], 0x2c
call fcn.004bd670
lea ecx, [esp + 0x1b80]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_APP
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x2230]
call fcn.00529ba0
lea ecx, [esp + 0x2558]
mov byte [esp + 0xcde8], 0x2d
call fcn.004bda30
mov dword [esp + 0x2230], 0x5eef10
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x82f8]
mov byte [esp + 0xcde8], 0x2e
call fcn.0041fe70
push ebp
push ebx
push ebx
push str.AppPolicy
mov byte [esp + 0xcdf8], 0x2f
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x82f8]
mov byte [esp + 0xcde8], 0x2e
call fcn.0041fec0
lea ecx, [esp + 0x198]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eef04
mov dword [esp + 0x1ac], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x30
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x31
je 0x41db5b
mov ecx, eax
call fcn.00421890
mov ebp, eax
jmp 0x41db5d
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x30
je 0x41db91
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00428a00
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00428b90
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eef04
lea ecx, [esp + 0x198]
mov byte [esp + 0xcde8], 0x32
call fcn.00422d20
lea ecx, [esp + 0x198]
mov byte [esp + 0xcde8], 0x2e
call fcn.005bab7c
lea ecx, [esp + 0x2558]
mov byte [esp + 0xcde8], 0x33
call fcn.0041fb70
lea ecx, [esp + 0x2230]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_WEB
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0xcf8]
call fcn.00529ba0
lea ecx, [esp + 0x1020]
mov byte [esp + 0xcde8], 0x34
call fcn.005ba763
lea ecx, [esp + 0x1034]
mov byte [esp + 0xcde8], 0x35
call fcn.00473c60
lea ecx, [esp + 0x1044]
mov byte [esp + 0xcde8], 0x36
call fcn.004bda30
mov dword [esp + 0xcf8], 0x5eee34
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7498]
mov byte [esp + 0xcde8], 0x37
call fcn.0041ff40
push ebp
push ebx
push ebx
push str.UrlPolicy
mov byte [esp + 0xcdf8], 0x38
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x7498]
mov byte [esp + 0xcde8], 0x37
call fcn.0041ffb0
lea ecx, [esp + 0x138]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eee28
mov dword [esp + 0x14c], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x39
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x3a
je 0x41dcff
mov ecx, eax
call fcn.00421940
mov ebp, eax
jmp 0x41dd01
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x39
je 0x41dd35
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00428ea0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429050
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eee28
lea ecx, [esp + 0x138]
mov byte [esp + 0xcde8], 0x3b
call fcn.00422d60
lea ecx, [esp + 0x138]
mov byte [esp + 0xcde8], 0x37
call fcn.005bab7c
lea ecx, [esp + 0x1044]
mov byte [esp + 0xcde8], 0x3e
call fcn.0041fb70
lea ecx, [esp + 0x1034]
mov byte [esp + 0xcde8], 0x3d
call fcn.00473c70
lea ecx, [esp + 0x1020]
mov byte [esp + 0xcde8], 0x3c
call fcn.005ba796
lea ecx, [esp + 0xcf8]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_DEVICE
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x2590]
call fcn.004bfd60
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x6718]
mov byte [esp + 0xcde8], 0x3f
call fcn.004bfd60
push ebp
push ebx
push ebx
push str.DevicePolicy
mov byte [esp + 0xcdf8], 0x40
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x6718]
mov byte [esp + 0xcde8], 0x3f
call fcn.00420050
lea ecx, [esp + 0x1f8]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eee1c
mov dword [esp + 0x20c], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x41
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x42
je 0x41de84
mov ecx, eax
call fcn.004219f0
mov ebp, eax
jmp 0x41de86
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x41
je 0x41deba
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.004293b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429520
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eee1c
lea ecx, [esp + 0x1f8]
mov byte [esp + 0xcde8], 0x43
call fcn.00422da0
lea ecx, [esp + 0x1f8]
mov byte [esp + 0xcde8], 0x3f
call fcn.005bab7c
lea ecx, [esp + 0x28e0]
mov byte [esp + 0xcde8], 0x46
call fcn.0046cf50
lea ecx, [esp + 0x28d0]
mov byte [esp + 0xcde8], 0x45
call fcn.00473c70
lea ecx, [esp + 0x28b8]
mov byte [esp + 0xcde8], 0x44
call fcn.004bd670
lea ecx, [esp + 0x2590]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_PRINT
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x51c8]
call fcn.004c00c0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7818]
mov byte [esp + 0xcde8], 0x47
call fcn.004c00c0
push ebp
push ebx
push ebx
push str.PrintPolicy
mov byte [esp + 0xcdf8], 0x48
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x7818]
mov byte [esp + 0xcde8], 0x47
call fcn.004c0200
lea ecx, [esp + 0xa8]
call fcn.005bab49
mov dword [esp + 0xa8], 0x5eee10
mov dword [esp + 0xbc], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x49
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x4a
je 0x41e009
mov ecx, eax
call fcn.00421aa0
mov ebp, eax
jmp 0x41e00b
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x49
je 0x41e03f
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.004297f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429960
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xa8], 0x5eee10
lea ecx, [esp + 0xa8]
mov byte [esp + 0xcde8], 0x4b
call fcn.00422de0
lea ecx, [esp + 0xa8]
mov byte [esp + 0xcde8], 0x47
call fcn.005bab7c
lea ecx, [esp + 0x51c8]
mov byte [esp + 0xcde8], bl
call fcn.004c0200
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SNAPSHOT
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x4438]
call fcn.004c0e10
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7138]
mov byte [esp + 0xcde8], 0x4c
call fcn.004c0e10
push ebp
push ebx
push ebx
push str.SnapshotPolicy
mov byte [esp + 0xcdf8], 0x4d
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x7138]
mov byte [esp + 0xcde8], 0x4c
call fcn.004200c0
lea ecx, [esp + 0xc0]
call fcn.005bab49
mov dword [esp + 0xc0], 0x5eee04
mov dword [esp + 0xd4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x4e
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x4f
je 0x41e152
mov ecx, eax
call fcn.00421b50
mov ebp, eax
jmp 0x41e154
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x4e
je 0x41e188
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.00429bf0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.00429d60
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xc0], 0x5eee04
lea ecx, [esp + 0xc0]
mov byte [esp + 0xcde8], 0x50
call fcn.00422e20
lea ecx, [esp + 0xc0]
mov byte [esp + 0xcde8], 0x4c
call fcn.005bab7c
lea ecx, [esp + 0x4760]
mov byte [esp + 0xcde8], 0x51
call fcn.0041fb70
lea ecx, [esp + 0x4438]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_LOG
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x300]
call fcn.004c0f80
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0xab68]
mov byte [esp + 0xcde8], 0x52
call fcn.004c0f80
push ebp
push ebx
push ebx
push str.LogPolicy
mov byte [esp + 0xcdf8], 0x53
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0xab68]
mov byte [esp + 0xcde8], 0x52
call fcn.00420140
lea ecx, [esp + 0xf0]
call fcn.005bab49
mov dword [esp + 0xf0], 0x5eedf8
mov dword [esp + 0x104], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x54
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x55
je 0x41e2af
mov ecx, eax
call fcn.00421c00
mov ebp, eax
jmp 0x41e2b1
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x54
je 0x41e2e5
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042a040
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042a1b0
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0xf0], 0x5eedf8
lea ecx, [esp + 0xf0]
mov byte [esp + 0xcde8], 0x56
call fcn.00422e60
lea ecx, [esp + 0xf0]
mov byte [esp + 0xcde8], 0x52
call fcn.005bab7c
lea ecx, [esp + 0x85c]
mov byte [esp + 0xcde8], 0x6b
call fcn.00473c70
lea ecx, [esp + 0x84c]
mov byte [esp + 0xcde8], 0x6a
call fcn.00473c70
lea ecx, [esp + 0x834]
mov byte [esp + 0xcde8], 0x69
call fcn.004bd670
lea ecx, [esp + 0x81c]
mov byte [esp + 0xcde8], 0x68
call fcn.004bd670
lea ecx, [esp + 0x804]
mov byte [esp + 0xcde8], 0x67
call fcn.004bd670
lea ecx, [esp + 0x7e4]
mov byte [esp + 0xcde8], 0x66
call fcn.004bd670
lea ecx, [esp + 0x7d4]
mov byte [esp + 0xcde8], 0x65
call fcn.00473c70
lea ecx, [esp + 0x7c0]
mov byte [esp + 0xcde8], 0x64
call fcn.00473c70
lea ecx, [esp + 0x798]
mov byte [esp + 0xcde8], 0x63
call fcn.00473c70
lea ecx, [esp + 0x788]
mov byte [esp + 0xcde8], 0x62
call fcn.00473c70
lea ecx, [esp + 0x774]
mov byte [esp + 0xcde8], 0x61
call fcn.005ba796
lea ecx, [esp + 0x760]
mov byte [esp + 0xcde8], 0x60
call fcn.00423060
lea ecx, [esp + 0x750]
mov byte [esp + 0xcde8], 0x5f
call fcn.00473c70
lea ecx, [esp + 0x71c]
mov byte [esp + 0xcde8], 0x5e
call fcn.0041fb70
lea ecx, [esp + 0x6e4]
mov byte [esp + 0xcde8], 0x5d
call fcn.0041fb70
lea ecx, [esp + 0x6d4]
mov byte [esp + 0xcde8], 0x5c
call fcn.00473c70
lea ecx, [esp + 0x6c0]
mov byte [esp + 0xcde8], 0x5b
call fcn.00473c70
lea ecx, [esp + 0x6ac]
mov byte [esp + 0xcde8], 0x5a
call fcn.005ba796
lea ecx, [esp + 0x678]
mov byte [esp + 0xcde8], 0x59
call fcn.0041fb70
lea ecx, [esp + 0x644]
mov byte [esp + 0xcde8], 0x58
call fcn.0041fb70
lea ecx, [esp + 0x628]
mov byte [esp + 0xcde8], 0x57
call fcn.004bd670
lea ecx, [esp + 0x300]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_REMOTE_CONTROL
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x28e8]
call fcn.004c2390
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x6dd0]
mov byte [esp + 0xcde8], 0x6c
call fcn.004c2390
push ebp
push ebx
push ebx
push str.RemoteControlPolicy
mov byte [esp + 0xcdf8], 0x6d
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x6dd0]
mov byte [esp + 0xcde8], 0x6c
call fcn.00420370
lea ecx, [esp + 0x120]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedec
mov dword [esp + 0x134], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x6e
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x6f
je 0x41e59c
mov ecx, eax
call fcn.00421cb0
mov ebp, eax
jmp 0x41e59e
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x6e
je 0x41e5d2
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042a650
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042a7c0
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedec
lea ecx, [esp + 0x120]
mov byte [esp + 0xcde8], 0x70
call fcn.00422ea0
lea ecx, [esp + 0x120]
mov byte [esp + 0xcde8], 0x6c
call fcn.005bab7c
lea ecx, [esp + 0x2c3c]
mov byte [esp + 0xcde8], 0x73
call fcn.00423060
lea ecx, [esp + 0x2c2c]
mov byte [esp + 0xcde8], 0x72
call fcn.00473c70
lea ecx, [esp + 0x2c1c]
mov byte [esp + 0xcde8], 0x71
call fcn.00473c70
lea ecx, [esp + 0x28e8]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_IMFILE
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x2fd0]
call fcn.004c41f0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x63a8]
mov byte [esp + 0xcde8], 0x74
call fcn.004c41f0
push ebp
push ebx
push ebx
push str.IMFilePolicy
mov byte [esp + 0xcdf8], 0x75
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x63a8]
mov byte [esp + 0xcde8], 0x74
call fcn.00420400
lea ecx, [esp + 0x150]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eede0
mov dword [esp + 0x164], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x76
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x77
je 0x41e721
mov ecx, eax
call fcn.00421d60
mov ebp, eax
jmp 0x41e723
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x76
je 0x41e757
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042aab0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042ac20
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eede0
lea ecx, [esp + 0x150]
mov byte [esp + 0xcde8], 0x78
call fcn.00422ee0
lea ecx, [esp + 0x150]
mov byte [esp + 0xcde8], 0x74
call fcn.005bab7c
lea ecx, [esp + 0x3314]
mov byte [esp + 0xcde8], 0x7a
call fcn.00473c70
lea ecx, [esp + 0x32fc]
mov byte [esp + 0xcde8], 0x79
call fcn.004bd670
lea ecx, [esp + 0x2fd0]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_IMFILE
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x17e8]
call fcn.004c2e70
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7f60]
mov byte [esp + 0xcde8], 0x7b
call fcn.004c2e70
push ebp
push ebx
push ebx
push str.NetTrafficPolicy
mov byte [esp + 0xcdf8], 0x7c
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x7f60]
mov byte [esp + 0xcde8], 0x7b
call fcn.00420460
lea ecx, [esp + 0x180]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedd4
mov dword [esp + 0x194], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x7d
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x7e
je 0x41e892
mov ecx, eax
call fcn.00421e10
mov ebp, eax
jmp 0x41e894
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x7d
je 0x41e8c8
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042aee0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042b050
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedd4
lea ecx, [esp + 0x180]
mov byte [esp + 0xcde8], 0x7f
call fcn.00422f20
lea ecx, [esp + 0x180]
mov byte [esp + 0xcde8], 0x7b
call fcn.005bab7c
lea ecx, [esp + 0x1b60]
mov byte [esp + 0xcde8], 0x84
call fcn.004234b0
lea ecx, [esp + 0x1b4c]
mov byte [esp + 0xcde8], 0x83
call fcn.005ba796
lea ecx, [esp + 0x1b38]
mov byte [esp + 0xcde8], 0x82
call fcn.00423060
lea ecx, [esp + 0x1b24]
mov byte [esp + 0xcde8], 0x81
call fcn.00423260
lea ecx, [esp + 0x1b10]
mov byte [esp + 0xcde8], 0x80
call fcn.005ba796
lea ecx, [esp + 0x17e8]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_NETWORK
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x1078]
call fcn.004c3460
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x5c40]
mov byte [esp + 0xcde8], 0x85
call fcn.004c3460
push ebp
push ebx
push ebx
push str.NetControlPolicy
mov byte [esp + 0xcdf8], 0x86
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x5c40]
mov byte [esp + 0xcde8], 0x85
call fcn.00420560
lea ecx, [esp + 0x1b0]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedc8
mov dword [esp + 0x1c4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x87
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x88
je 0x41ea3f
mov ecx, eax
call fcn.00421ec0
mov ebp, eax
jmp 0x41ea41
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x87
je 0x41ea75
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042b3d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042b540
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedc8
lea ecx, [esp + 0x1b0]
mov byte [esp + 0xcde8], 0x89
call fcn.00422f60
lea ecx, [esp + 0x1b0]
mov byte [esp + 0xcde8], 0x85
call fcn.005bab7c
lea ecx, [esp + 0x142c]
mov byte [esp + 0xcde8], 0x90
call fcn.0041fb70
lea ecx, [esp + 0x1408]
mov byte [esp + 0xcde8], 0x8f
call fcn.005ba796
lea ecx, [esp + 0x13f0]
mov byte [esp + 0xcde8], 0x8e
call fcn.004234b0
lea ecx, [esp + 0x13dc]
mov byte [esp + 0xcde8], 0x8d
call fcn.005ba796
lea ecx, [esp + 0x13c8]
mov byte [esp + 0xcde8], 0x8c
call fcn.00423060
lea ecx, [esp + 0x13b4]
mov byte [esp + 0xcde8], 0x8b
call fcn.00423260
lea ecx, [esp + 0x13a0]
mov byte [esp + 0xcde8], 0x8a
call fcn.005ba796
lea ecx, [esp + 0x1078]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_MAIL
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x1460]
call fcn.004c3cc0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x7bd8]
mov byte [esp + 0xcde8], 0x91
call fcn.004c3cc0
push ebp
push ebx
push ebx
push str.MailPolicy
mov byte [esp + 0xcdf8], 0x92
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x7bd8]
mov byte [esp + 0xcde8], 0x91
call fcn.004206a0
lea ecx, [esp + 0x90]
call fcn.005bab49
mov dword [esp + 0x90], 0x5eedbc
mov dword [esp + 0xa4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x93
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x94
je 0x41ec14
mov ecx, eax
call fcn.00421f70
mov ebp, eax
jmp 0x41ec16
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x93
je 0x41ec4a
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042b910
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042ba80
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + 0x90], 0x5eedbc
lea ecx, [esp + 0x90]
mov byte [esp + 0xcde8], 0x95
call fcn.00422fa0
lea ecx, [esp + 0x90]
mov byte [esp + 0xcde8], 0x91
call fcn.005bab7c
lea ecx, [esp + 0x17d4]
mov byte [esp + 0xcde8], 0x9a
call fcn.00423060
lea ecx, [esp + 0x17bc]
mov byte [esp + 0xcde8], 0x99
call fcn.00473c70
lea ecx, [esp + 0x17ac]
mov byte [esp + 0xcde8], 0x98
call fcn.00473c70
lea ecx, [esp + 0x1798]
mov byte [esp + 0xcde8], 0x97
call fcn.00473c70
lea ecx, [esp + 0x1788]
mov byte [esp + 0xcde8], 0x96
call fcn.00473c70
lea ecx, [esp + 0x1460]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_UPDOWN
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x870]
call fcn.004c4730
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x8e48]
mov byte [esp + 0xcde8], 0x9b
call fcn.004c4730
push ebp
push ebx
push ebx
push str.UpDownPolicy
mov byte [esp + 0xcdf8], 0x9c
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x8e48]
mov byte [esp + 0xcde8], 0x9b
call fcn.00420750
lea ecx, [esp + 0x1e0]
call fcn.005bab49
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedb0
mov dword [esp + 0x1f4], ebx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
push 0x18
mov byte [esp + 0xcdec], 0x9d
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
call fcn.005bc14c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xcde8], 0x9e
je 0x41edc1
mov ecx, eax
call fcn.00422020
mov ebp, eax
jmp 0x41edc3
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0xcde8], 0x9d
je 0x41edf7
mov eax, dword [esp + 0x18]
push edi
push eax
mov ecx, ebp
call fcn.0042bd90
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, ebp
call fcn.0042bf00
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax + 4]
mov ebp, 1
mov dword [esp + method.CPtrArray.virtual_0], 0x5eedb0
lea ecx, [esp + 0x1e0]
mov byte [esp + 0xcde8], 0x9f
call fcn.00422fe0
lea ecx, [esp + 0x1e0]
mov byte [esp + 0xcde8], 0x9b
call fcn.005bab7c
lea ecx, [esp + 0xce4]
mov byte [esp + 0xcde8], 0xaf
call fcn.005ba796
lea ecx, [esp + 0xcd0]
mov byte [esp + 0xcde8], 0xae
call fcn.005ba796
lea ecx, [esp + 0xcc0]
mov byte [esp + 0xcde8], 0xad
call fcn.00473c70
lea ecx, [esp + 0xcac]
mov byte [esp + 0xcde8], 0xac
call fcn.004234b0
lea ecx, [esp + 0xc98]
mov byte [esp + 0xcde8], 0xab
call fcn.005ba796
lea ecx, [esp + 0xc78]
mov byte [esp + 0xcde8], 0xaa
call fcn.005ba796
lea ecx, [esp + 0xc64]
mov byte [esp + 0xcde8], 0xa9
call fcn.005ba796
lea ecx, [esp + 0xc50]
mov byte [esp + 0xcde8], 0xa8
call fcn.00473c70
lea ecx, [esp + 0xc3c]
mov byte [esp + 0xcde8], 0xa7
call fcn.00423060
lea ecx, [esp + 0xc38]
mov byte [esp + 0xcde8], 0xa6
call fcn.0046cf50
lea ecx, [esp + 0xc28]
mov byte [esp + 0xcde8], 0xa5
call fcn.00473c70
lea ecx, [esp + 0xc08]
mov byte [esp + 0xcde8], 0xa4
call fcn.005ba796
lea ecx, [esp + 0xbf4]
mov byte [esp + 0xcde8], 0xa3
call fcn.005ba796
lea ecx, [esp + 0xbf0]
mov byte [esp + 0xcde8], 0xa2
call fcn.0046cf50
lea ecx, [esp + 0xbe0]
mov byte [esp + 0xcde8], 0xa1
call fcn.00473c70
lea ecx, [esp + 0xb9c]
mov byte [esp + 0xcde8], 0xa0
call fcn.0041fb70
lea ecx, [esp + 0x870]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_IDS
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x6a70]
call fcn.004c5d30
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x8658]
mov byte [esp + 0xcde8], 0xb0
call fcn.004c5d30
push ebp
push ebx
push ebx
push str.IDSPolicy
mov byte [esp + 0xcdf8], 0xb1
call fcn.004a9710
add esp, 0x10
lea ecx, [esp + 0x8658]
mov byte [esp + 0xcde8], 0xb0
call fcn.004208e0
lea ecx, [esp + 0x78]
call fcn.005bab49
mov dword [esp + 0x78], 0x5eeda4
mov dword [esp + 0x8c], ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x84]
push edx
push eax
mov byte [esp + 0xcdfc], 0xb2
call fcn.004246d0
add esp, 0x14
mov ebp, 1
mov dword [esp + 0x78], 0x5eeda4
lea ecx, [esp + 0x78]
mov byte [esp + 0xcde8], 0xb3
call fcn.00423020
lea ecx, [esp + 0x78]
mov byte [esp + 0xcde8], 0xb0
call fcn.005bab7c
lea ecx, [esp + 0x6a70]
mov byte [esp + 0xcde8], bl
call fcn.004208e0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_DOC
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x3688]
call fcn.004c59e0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3688]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xb4
call fcn.00424a20
add esp, 8
lea ecx, [esp + 0x2d0]
call fcn.00422160
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2dc]
push edx
push eax
mov byte [esp + 0xcdfc], 0xb5
call fcn.00424b00
add esp, 0x14
lea ecx, [esp + 0x2d0]
mov ebp, 1
mov byte [esp + 0xcde8], 0xb4
call fcn.00422180
lea ecx, [esp + 0x3688]
mov byte [esp + 0xcde8], bl
call fcn.00420970
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SYSALERT
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x4798]
call fcn.004c2730
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x4798]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xb6
call fcn.00424e50
add esp, 8
lea ecx, [esp + 0x270]
call fcn.00422210
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x27c]
push edx
push eax
mov byte [esp + 0xcdfc], 0xb7
call fcn.00424f00
add esp, 0x14
lea ecx, [esp + 0x270]
mov ebp, 1
mov byte [esp + 0xcde8], 0xb6
call fcn.00422230
lea ecx, [esp + 0x4798]
mov byte [esp + 0xcde8], bl
call fcn.00420a00
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_UDISK
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x3d48]
call fcn.004c6240
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3d48]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xb8
call fcn.00425210
add esp, 8
lea ecx, [esp + 0x2e8]
call fcn.004222c0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2f4]
push edx
push eax
mov byte [esp + 0xcdfc], 0xb9
call fcn.00425320
add esp, 0x14
lea ecx, [esp + 0x2e8]
mov ebp, 1
mov byte [esp + 0xcde8], 0xb8
call fcn.004222e0
lea ecx, [esp + 0x3d48]
mov byte [esp + 0xcde8], bl
call fcn.00420a60
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SEC_CONFIG
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x4b18]
call fcn.004f0c00
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x4b18]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xba
call fcn.004256a0
add esp, 8
lea ecx, [esp + 0x288]
call fcn.00422370
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x294]
push edx
push eax
mov byte [esp + 0xcdfc], 0xbb
call fcn.00425720
add esp, 0x14
lea ecx, [esp + 0x288]
mov ebp, 1
mov byte [esp + 0xcde8], 0xba
call fcn.00422390
lea ecx, [esp + 0x4b18]
mov byte [esp + 0xcde8], bl
call fcn.00529ca0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_PRINTPAGE
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0xb0d8]
call fcn.004c7450
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xb0d8]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xbc
call fcn.00425a10
add esp, 8
lea ecx, [esp + 0x2a0]
call fcn.00422420
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2ac]
push edx
push eax
mov byte [esp + 0xcdfc], 0xbd
call fcn.00425a90
add esp, 0x14
lea ecx, [esp + 0x2a0]
mov ebp, 1
mov byte [esp + 0xcde8], 0xbc
call fcn.00422440
lea ecx, [esp + 0xb0d8]
mov byte [esp + 0xcde8], bl
call fcn.004c76d0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_GENERAL
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
mov ebp, 3
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_UDISK_REGISTER_CONTROL
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x40e0]
call fcn.004f8280
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x40e0]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xbe
call fcn.00425d80
add esp, 8
lea ecx, [esp + 0x258]
call fcn.004224d0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x264]
push edx
push eax
mov byte [esp + 0xcdfc], 0xbf
call fcn.00425e70
add esp, 0x14
lea ecx, [esp + 0x258]
mov ebp, 1
mov byte [esp + 0xcde8], 0xbe
call fcn.004224f0
lea ecx, [esp + 0x40e0]
mov byte [esp + 0xcde8], bl
call fcn.00420b30
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_SOFT_INSTALL_CONTROL_or_POLICY_TYPE_SOFT_UNINSTALL_CONTROL
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x89b8]
call fcn.0041f870
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x89b8]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xc0
call fcn.004261c0
add esp, 8
lea ecx, [esp + 0x228]
call fcn.00422580
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x234]
push edx
push eax
mov byte [esp + 0xcdfc], 0xc1
call fcn.00426480
add esp, 0x14
lea ecx, [esp + 0x228]
mov ebp, 1
mov byte [esp + 0xcde8], 0xc0
call fcn.004225a0
lea ecx, [esp + 0x89b8]
mov byte [esp + 0xcde8], bl
call fcn.004fa100
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_AUTH_REQUEST
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x92d0]
call fcn.004fded0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x92d0]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xc2
call fcn.00426770
add esp, 8
lea ecx, [esp + 0x2b8]
call fcn.00422630
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x2c4]
push edx
push eax
mov byte [esp + 0xcdfc], 0xc3
call fcn.00426b70
add esp, 0x14
lea ecx, [esp + 0x2b8]
mov ebp, 1
mov byte [esp + 0xcde8], 0xc2
call fcn.00422650
lea ecx, [esp + 0x92d0]
mov byte [esp + 0xcde8], bl
call fcn.00420bc0
jmp 0x41f686
push str.ParsePolicy_POLICY_TYPE_TDS
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
lea ecx, [esp + 0x3a08]
call fcn.004f8790
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3a08]
push ecx
push edx
mov byte [esp + 0xcdf0], 0xc4
call fcn.00426fd0
add esp, 8
lea ecx, [esp + 0x240]
call fcn.004226e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x10]
push edi
push ecx
push eax
lea eax, [esp + 0x24c]
push edx
push eax
mov byte [esp + 0xcdfc], 0xc5
call fcn.00427050
add esp, 0x14
lea ecx, [esp + 0x240]
mov ebp, 1
mov byte [esp + 0xcde8], 0xc4
call fcn.00422700
lea ecx, [esp + 0x3a08]
mov byte [esp + 0xcde8], bl
call fcn.004f8800
jmp 0x41f686
push ecx
push str.ParsePolicy_type_0x_x__unsupported_
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x14
lea ecx, [esp + 0x10]
mov dword [esp + 0xcde8], 0xffffffff
call fcn.0046cf50
jmp 0x41f6b5
push str.ParsePolicy_user_policy_unsupported_
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x10
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jb 0x41ce36
jmp 0x41f6ec
push 0x90
jmp 0x41f6d3
push 0x99
push str.ParsePolicy_line__lu__break
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
add esp, 0x14
mov edx, dword [esp + 0xcdf0]
push ebp
push edx
push str.ParsePolicy_type_0x_x__ret_0x_x_
push str.CheckModule
push 0xf
push 0x667744
call fcn.00447b00
mov ecx, dword [esp + 0xcdf8]
add esp, 0x18
mov eax, ebp
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcddc
ret 8