Function at 0x410870
Capabilities:
Contain obfuscated stackstrings
Copy file
Get common file path
Read file on windows
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e47d8
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xf60
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xe80], ecx
push 3
call fcn.00506ac0
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc74], esp
push str.ywSMPAgent
call fcn.0040bf50
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0xe84]
mov dword [ebp - 0xe88], eax
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.0050b720
mov dword [ebp - 0xe8c], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.0050b3a0
push 0x5648
lea ecx, [ebp - 0x114]
call fcn.00414ed0
push 0x5648
lea ecx, [ebp - 0x114]
call fcn.00414eb0
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
push ecx
push str.eds_kernel_appdirectory
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
push 0x62913c
mov edx, dword [ebp - 0xe80]
add edx, 0x44
push edx
lea eax, [ebp - 0xc90]
push eax
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0xe90], eax
mov ecx, dword [ebp - 0xe90]
mov dword [ebp - 0xe94], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xe94]
push edx
mov ecx, dword [ebp - 0xe80]
add ecx, 0x7c
call fcn.0040c030
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc90]
call fcn.0040c050
mov byte [ebp - 4], 3
push 0x1c
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0xc98], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0xc98], 0
je 0x4109df
mov ecx, dword [ebp - 0xe80]
add ecx, 0x7c
call fcn.0040bf30
push eax
mov ecx, dword [ebp - 0xc98]
call fcn.0051b970
mov dword [ebp - 0xe98], eax
jmp 0x4109e9
mov dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0xc94], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xe80]
mov edx, dword [ebp - 0xc94]
mov dword [ecx + 0x40], edx
jmp 0x410ac0
mov dword [ebp - 4], 1
xor ecx, ecx
jne 0x41099c
push 0x629174
mov edx, dword [ebp - 0xe80]
add edx, 0x7c
push edx
lea eax, [ebp - 0xdc]
push eax
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x54]
call fcn.0040c000
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b8]
call fcn.0040c000
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xcd0]
push ecx
call fcn.00513b50
add esp, 4
mov dword [ebp - 0xea4], eax
mov edx, dword [ebp - 0xea4]
mov dword [ebp - 0xea8], edx
mov byte [ebp - 4], 0xb
push str.config.ini
mov eax, dword [ebp - 0xea8]
push eax
lea ecx, [ebp - 0x484]
push ecx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xcd0]
call fcn.0040c050
lea ecx, [ebp - 0x484]
call fcn.0040bf30
push eax
lea ecx, [ebp - 0x468]
call fcn.0051b970
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xe80]
add edx, 0x28
push edx
lea ecx, [ebp - 0x44c]
call fcn.0040bfb0
mov byte [ebp - 4], 0xf
push 0x60a112
push 0x629188
push 0x629190
lea eax, [ebp - 0xcec]
push eax
lea ecx, [ebp - 0x468]
call fcn.0051b9f0
mov dword [ebp - 0xeac], eax
mov ecx, dword [ebp - 0xeac]
mov dword [ebp - 0xeb0], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xeb0]
push edx
lea ecx, [ebp - 0x2b8]
call fcn.0040c030
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xcec]
call fcn.0040c050
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x44c]
call fcn.0040bf90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x468]
call fcn.00415550
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x484]
call fcn.0040c050
lea ecx, [ebp - 0x29c]
call fcn.0040c000
mov byte [ebp - 4], 0x11
mov byte [ebp - 0x590], 0
push 0x103
push 0
lea eax, [ebp - 0x58f]
push eax
call fcn.005b4520
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x590]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x590]
push edx
lea eax, [ebp - 0x5ac]
push eax
mov ecx, dword [ebp - 0xe80]
call fcn.00410630
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x5ac]
call fcn.0040bfe0
movzx ecx, al
test ecx, ecx
je 0x410cd3
lea edx, [ebp - 0x590]
add edx, 0xffffffff
mov dword [ebp - 0xeb4], edx
mov eax, dword [ebp - 0xeb4]
mov cl, byte [eax + 1]
mov byte [ebp - 0xeb5], cl
add dword [ebp - 0xeb4], 1
cmp byte [ebp - 0xeb5], 0
jne 0x410c90
mov edi, dword [ebp - 0xeb4]
mov edx, dword [str._tempywSMP]
mov dword [edi], edx
mov eax, dword [0x62919c]
mov dword [edi + 4], eax
mov ecx, dword [0x6291a0]
mov dword [edi + 8], ecx
jmp 0x410e1c
lea ecx, [ebp - 0x5ac]
call fcn.0040bf30
mov dword [ebp - 0xebc], eax
lea edx, [ebp - 0x590]
mov dword [ebp - 0xec0], edx
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0xec4], eax
mov ecx, dword [ebp - 0xebc]
mov dl, byte [ecx]
mov byte [ebp - 0xec5], dl
mov eax, dword [ebp - 0xec0]
mov cl, byte [ebp - 0xec5]
mov byte [eax], cl
mov edx, dword [ebp - 0xebc]
add edx, 1
mov dword [ebp - 0xebc], edx
mov eax, dword [ebp - 0xec0]
add eax, 1
mov dword [ebp - 0xec0], eax
cmp byte [ebp - 0xec5], 0
jne 0x410cfc
lea ecx, [ebp - 0x590]
add ecx, 0xffffffff
mov dword [ebp - 0xecc], ecx
mov edx, dword [ebp - 0xecc]
mov al, byte [edx + 1]
mov byte [ebp - 0xecd], al
add dword [ebp - 0xecc], 1
cmp byte [ebp - 0xecd], 0
jne 0x410d4e
mov edi, dword [ebp - 0xecc]
mov ecx, dword [str.___temp___]
mov dword [edi], ecx
mov edx, dword [0x6291a8]
mov dword [edi + 4], edx
mov eax, dword [0x6291ac]
mov dword [edi + 8], eax
mov cx, word [0x6291b0]
mov word [edi + 0xc], cx
mov dl, byte [0x6291b2]
mov byte [edi + 0xe], dl
lea eax, [ebp - 0x590]
push eax
call fcn.00503060
add esp, 4
lea ecx, [ebp - 0x590]
push ecx
call fcn.00500e80
add esp, 4
push 2
lea edx, [ebp - 0x590]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x590]
add eax, 0xffffffff
mov dword [ebp - 0xed4], eax
mov ecx, dword [ebp - 0xed4]
mov dl, byte [ecx + 1]
mov byte [ebp - 0xed5], dl
add dword [ebp - 0xed4], 1
cmp byte [ebp - 0xed5], 0
jne 0x410ddc
mov edi, dword [ebp - 0xed4]
mov eax, dword [str.ywSMP]
mov dword [edi], eax
mov cx, word [0x6291b8]
mov word [edi + 4], cx
mov dl, byte [0x6291ba]
mov byte [edi + 6], dl
lea eax, [ebp - 0x590]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040bee0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x5ac]
call fcn.0040c050
mov ecx, dword [ebp - 0xe80]
cmp dword [ecx + 0x184], 0
je 0x410e7b
lea edx, [ebp - 0x2b8]
push edx
lea ecx, [ebp - 0x54]
call fcn.0040c030
lea ecx, [ebp - 0x54]
call fcn.0040bfe0
movzx eax, al
test eax, eax
je 0x410e79
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x54]
call fcn.0040c030
jmp 0x410ece
lea edx, [ebp - 0x29c]
push edx
lea ecx, [ebp - 0x54]
call fcn.0040c030
lea ecx, [ebp - 0x54]
call fcn.0040bf30
push eax
push str.tempdir
push 0x6291c4
mov ecx, dword [ebp - 0xe80]
call fcn.0040f550
lea ecx, [ebp - 0x2b8]
call fcn.0040bfe0
movzx eax, al
test eax, eax
jne 0x410ece
lea ecx, [ebp - 0x2b8]
call fcn.0040bf30
push eax
call fcn.005007e0
add esp, 4
lea ecx, [ebp - 0x54]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
lea ecx, [ebp - 0x54]
call fcn.0040bf30
push eax
call fcn.00500e80
add esp, 4
push 2
lea ecx, [ebp - 0x54]
call fcn.0040bf30
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 0xe80]
cmp dword [ecx + 0x184], 0
je 0x411059
lea ecx, [ebp - 0x54]
call fcn.0040bf30
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x6291cc
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0xd08]
push eax
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0xedc]
mov dword [ebp - 0xee0], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0xee0]
push edx
mov ecx, dword [ebp - 0xe80]
add ecx, 0x60
call fcn.0040c030
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xd08]
call fcn.0040c050
push str.ywSMPNPF.sys
mov eax, dword [ebp - 0xe80]
add eax, 0x44
push eax
lea ecx, [ebp - 0x9cc]
push ecx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0x14
mov byte [ebp - 0x9b0], 0
push 0x3ff
push 0
lea edx, [ebp - 0x9af]
push edx
call fcn.005b4520
add esp, 0xc
push 0x400
lea eax, [ebp - 0x9b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x9b0]
add ecx, 0xffffffff
mov dword [ebp - 0xee4], ecx
mov edx, dword [ebp - 0xee4]
mov al, byte [edx + 1]
mov byte [ebp - 0xee5], al
add dword [ebp - 0xee4], 1
cmp byte [ebp - 0xee5], 0
jne 0x410fd5
mov edi, dword [ebp - 0xee4]
mov ecx, dword [str.driversywSMPNPF.sys]
mov dword [edi], ecx
mov edx, dword [0x6291e4]
mov dword [edi + 4], edx
mov eax, dword [0x6291e8]
mov dword [edi + 8], eax
mov ecx, dword [0x6291ec]
mov dword [edi + 0xc], ecx
mov edx, dword [0x6291f0]
mov dword [edi + 0x10], edx
mov ax, word [0x6291f4]
mov word [edi + 0x14], ax
push 0
lea ecx, [ebp - 0x9b0]
push ecx
lea ecx, [ebp - 0x9cc]
call fcn.0040bf30
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9cc]
call fcn.0040c050
push 0x6291f8
lea ecx, [ebp - 0x54]
call fcn.004024c0
lea ecx, [ebp - 0x54]
call fcn.0040bf30
push eax
push str.eds_kernel_tempdirectory
mov ecx, dword [ebp - 0xe80]
call fcn.0040ced0
mov edx, dword [ebp - 0xe80]
add edx, 0x60
push edx
push str.eds_kernel_datadirectory
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
push str.backup
mov eax, dword [ebp - 0xe80]
add eax, 0x44
push eax
lea ecx, [ebp - 0x318]
push ecx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0x15
push 1
lea ecx, [ebp - 0x38]
call fcn.004fe190
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
call fcn.0040bf30
push eax
lea ecx, [ebp - 0x318]
call fcn.0040bf30
push eax
lea ecx, [ebp - 0x38]
call fcn.005032b0
push str..bkp
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
call fcn.0040bf30
push eax
call fcn.00500c50
add esp, 8
push str..db_journal
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
call fcn.0040bf30
push eax
call fcn.00500c50
add esp, 8
push str..db3_journal
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
call fcn.0040bf30
push eax
call fcn.00500c50
add esp, 8
push str.mb1.vbs
mov edx, dword [ebp - 0xe80]
add edx, 0x44
push edx
lea eax, [ebp - 0x16c]
push eax
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x16c]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
push str.nselib
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x150]
push edx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x150]
call fcn.0040bf30
push eax
call fcn.005007e0
add esp, 4
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x98], 4
push 1
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x5c]
push edx
push str.time
push 0x62927c
push reloc.WS2_32.dll_bind
call fcn.004fef20
add esp, 0x1c
mov esi, dword [ebp - 0x134]
xor edi, edi
push 0
call fcn.004f0db0
add esp, 4
push 0
push 0x15180
push edx
push eax
call fcn.005b61c0
mov dword [ebp - 0xef0], esi
mov dword [ebp - 0xeec], edi
mov dword [ebp - 0xef8], eax
mov dword [ebp - 0xef4], edx
mov eax, dword [ebp - 0xef0]
cmp eax, dword [ebp - 0xef8]
jne 0x41123b
mov ecx, dword [ebp - 0xeec]
cmp ecx, dword [ebp - 0xef4]
je 0x411275
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd0c], esp
push 0x60a113
call fcn.0040bf50
mov dword [ebp - 0xefc], eax
mov edx, dword [ebp - 0xefc]
mov dword [ebp - 0xf00], edx
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0xe80]
call fcn.0040f400
lea ecx, [ebp - 0x94]
call fcn.0040c000
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x94]
push eax
call fcn.00516600
add esp, 4
test eax, eax
je 0x4112af
lea ecx, [ebp - 0x94]
call fcn.0040bf30
push eax
call fcn.00409980
mov ecx, eax
call fcn.004faa30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x58], eax
push 1
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push str.agent
push 0x629294
push reloc.WS2_32.dll_bind
call fcn.004ff7d0
add esp, 0x1c
lea ecx, [ebp - 0x358]
call fcn.005173c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x208]
call fcn.00414df0
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x358]
call fcn.00519250
test eax, eax
je 0x41135d
mov ecx, dword [ebp - 0x1f4]
push ecx
mov edx, dword [ebp - 0x1f8]
push edx
lea eax, [ebp - 0x9e8]
push eax
call fcn.00517c90
add esp, 0xc
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x9e8]
push ecx
push str.eds_kernel_starttime
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x9e8]
call fcn.0040c050
jmp 0x4113f6
push 1
push 2
lea ecx, [ebp - 0xa68]
call fcn.0040b160
mov byte [ebp - 4], 0x1d
push 0x6292bc
lea edx, [ebp - 0xa68]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0xd28]
push eax
lea ecx, [ebp - 0xa68]
call fcn.00409610
mov dword [ebp - 0xf04], eax
mov ecx, dword [ebp - 0xf04]
mov dword [ebp - 0xf08], ecx
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0xf08]
call fcn.0040bf30
push eax
push 0x6292d0
push 0x42a
push 0x6292e8
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xd28]
call fcn.0040c050
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa68]
call fcn.00409ef0
push 0x60a117
push 0x6292f8
push 0x629304
lea edx, [ebp - 0x78]
push edx
mov eax, dword [ebp - 0xe80]
mov ecx, dword [eax + 0x40]
call fcn.0051b9f0
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0xe80]
cmp dword [ecx + 0x184], 0
jne 0x4115a9
mov edx, dword [ebp - 0xe80]
cmp dword [edx + 0x188], 0
jne 0x4115a9
lea ecx, [ebp - 0x78]
call fcn.0040bfe0
movzx eax, al
test eax, eax
je 0x411584
push 1
push 2
lea ecx, [ebp - 0xae8]
call fcn.0040b160
mov byte [ebp - 4], 0x20
push 0x62930c
lea ecx, [ebp - 0xae8]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0xd44]
push edx
lea ecx, [ebp - 0xae8]
call fcn.00409610
mov dword [ebp - 0xf0c], eax
mov eax, dword [ebp - 0xf0c]
mov dword [ebp - 0xf10], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xf10]
call fcn.0040bf30
push eax
push 0x629334
push 0x434
push 0x62934c
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xd44]
call fcn.0040c050
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xae8]
call fcn.00409ef0
lea ecx, [ebp - 0xdc]
call fcn.0040bf30
push eax
call fcn.00519e80
add esp, 4
test eax, eax
je 0x411582
push 0
mov ecx, dword [ebp - 0xe80]
add ecx, 0x7c
call fcn.0040bf30
push eax
lea ecx, [ebp - 0xdc]
call fcn.0040bf30
push eax
call fcn.00502b50
add esp, 0xc
push 0x60a11b
push str.serverip
push 0x629368
lea ecx, [ebp - 0xd60]
push ecx
mov edx, dword [ebp - 0xe80]
mov ecx, dword [edx + 0x40]
call fcn.0051b9f0
mov dword [ebp - 0xf14], eax
mov eax, dword [ebp - 0xf14]
mov dword [ebp - 0xf18], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0xf18]
push ecx
lea ecx, [ebp - 0x78]
call fcn.0040c030
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xd60]
call fcn.0040c050
jmp 0x4115a9
push 0
lea ecx, [ebp - 0xdc]
call fcn.0040bf30
push eax
mov ecx, dword [ebp - 0xe80]
add ecx, 0x7c
call fcn.0040bf30
push eax
call fcn.00502b50
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
push str.eds_kernel_serveripaddr
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
push 0
push 0
lea ecx, [ebp - 0x78]
call fcn.0040bf30
push eax
lea ecx, [ebp - 0x384]
call fcn.0050a760
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x384]
call fcn.0052a1c0
cmp eax, 2
jne 0x4115ff
lea eax, [ebp - 0x78]
push eax
push str.eds_kernel_serveripv4addr
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
jmp 0x411623
lea ecx, [ebp - 0x384]
call fcn.0052a1c0
cmp eax, 0x17
jne 0x411623
lea ecx, [ebp - 0x78]
push ecx
push str.eds_kernel_serveripv6addr
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
push 0x60a11f
push str.myonlyid
push 0x6293cc
lea edx, [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0xe80]
mov ecx, dword [eax + 0x40]
call fcn.0051b9f0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x2f0]
call fcn.0040bfe0
movzx ecx, al
test ecx, ecx
je 0x4116fa
push 1
push 2
lea ecx, [ebp - 0xb68]
call fcn.0040b160
mov byte [ebp - 4], 0x25
push 0x6293d4
lea edx, [ebp - 0xb68]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0xd7c]
push eax
lea ecx, [ebp - 0xb68]
call fcn.00409610
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
mov dword [ebp - 0xf20], ecx
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0xf20]
call fcn.0040bf30
push eax
push 0x6293f0
push 0x456
push 0x629408
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xd7c]
call fcn.0040c050
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xb68]
call fcn.00409ef0
lea edx, [ebp - 0x2f0]
push edx
push str.eds_kernel_onlyid
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
lea ecx, [ebp - 0x2f0]
call fcn.0040bfe0
movzx eax, al
test eax, eax
jne 0x41175c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd80], esp
lea edx, [ebp - 0x2f0]
push edx
call fcn.0040c070
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0xf24]
mov dword [ebp - 0xf28], eax
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x24
call fcn.00515420
add esp, 0x1c
lea ecx, [ebp - 0x2f0]
push ecx
call fcn.004fadd0
add esp, 4
mov edx, dword [ebp - 0xe80]
mov dword [edx + 0x180], eax
mov byte [ebp - 0x280], 0
push 0x3f
push 0
lea eax, [ebp - 0x27f]
push eax
call fcn.005b4520
add esp, 0xc
push 0x5648
push 0x62942c
lea ecx, [ebp - 0x280]
push ecx
call fcn.005b0b2c
add esp, 0xc
lea edx, [ebp - 0x280]
push edx
push str.eds_kernel_localport
mov ecx, dword [ebp - 0xe80]
call fcn.0040ced0
lea eax, [ebp - 0xd9c]
push eax
call fcn.00513d70
add esp, 4
mov dword [ebp - 0xf2c], eax
mov ecx, dword [ebp - 0xf2c]
mov dword [ebp - 0xf30], ecx
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0xf30]
call fcn.0040bf30
push eax
lea ecx, [ebp - 0x240]
call fcn.0051b970
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xd9c]
call fcn.0040c050
mov edx, dword [str.yegnP]
mov dword [ebp - 0x3c4], edx
mov ax, word [0x62944c]
mov word [ebp - 0x3c0], ax
mov byte [ebp - 0x3c4], 0x52
mov byte [ebp - 0x3c1], 0x49
push 0x60a123
lea ecx, [ebp - 0x3c4]
push ecx
push str.SYSTEM
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x240]
call fcn.0051b9f0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x30]
call fcn.0040bfe0
movzx eax, al
test eax, eax
jne 0x41187a
lea ecx, [ebp - 0x30]
push ecx
push str.eds_kernel_vrvserveripaddr
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
mov ecx, dword [ebp - 0xe80]
call fcn.0040f680
push 0x60a126
push 0x629474
push 0x629478
lea edx, [ebp - 0xdb8]
push edx
mov eax, dword [ebp - 0xe80]
mov ecx, dword [eax + 0x40]
call fcn.0051b9f0
mov dword [ebp - 0xf34], eax
mov ecx, dword [ebp - 0xf34]
mov dword [ebp - 0xf38], ecx
mov byte [ebp - 4], 0x2c
mov edx, dword [ebp - 0xf38]
push edx
mov ecx, dword [ebp - 0xe80]
add ecx, 0xb4
call fcn.0040c030
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xdb8]
call fcn.0040c050
push 0x60a127
push str.ipv6
push 0x629488
lea eax, [ebp - 0xdd4]
push eax
mov ecx, dword [ebp - 0xe80]
mov ecx, dword [ecx + 0x40]
call fcn.0051b9f0
mov dword [ebp - 0xf3c], eax
mov edx, dword [ebp - 0xf3c]
mov dword [ebp - 0xf40], edx
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0xf40]
push eax
mov ecx, dword [ebp - 0xe80]
add ecx, 0xd0
call fcn.0040c030
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xdd4]
call fcn.0040c050
push 0x60a12a
push 0x629490
push 0x629494
lea ecx, [ebp - 0xdf0]
push ecx
mov edx, dword [ebp - 0xe80]
mov ecx, dword [edx + 0x40]
call fcn.0051b9f0
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xf44]
mov dword [ebp - 0xf48], eax
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0xf48]
push ecx
mov ecx, dword [ebp - 0xe80]
add ecx, 0x98
call fcn.0040c030
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xdf0]
call fcn.0040c050
push 0
push str.fwtoolversion
push str.CONFIG
mov edx, dword [ebp - 0xe80]
mov ecx, dword [edx + 0x40]
call fcn.0051bbd0
mov ecx, dword [ebp - 0xe80]
mov dword [ecx + 0x18c], eax
mov edx, dword [ebp - 0xe80]
add edx, 0x15c
push edx
call fcn.00519db0
add esp, 4
test eax, eax
je 0x411a08
mov eax, dword [ebp - 0xe80]
add eax, 0x15c
push eax
push str.eds_kernel_powertime
mov ecx, dword [ebp - 0xe80]
call fcn.0040cd10
jmp 0x411aa1
push 1
push 2
lea ecx, [ebp - 0xbe8]
call fcn.0040b160
mov byte [ebp - 4], 0x2f
push 0x6294cc
lea ecx, [ebp - 0xbe8]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0xe0c]
push edx
lea ecx, [ebp - 0xbe8]
call fcn.00409610
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0xf50], eax
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0xf50]
call fcn.0040bf30
push eax
push 0x6294e0
push 0x484
push 0x6294f8
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xe0c]
call fcn.0040c050
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xbe8]
call fcn.00409ef0
push str.uplog2.db3.sed
mov ecx, dword [ebp - 0xe80]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x224]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
mov dword [ebp - 0xa4], 0
lea eax, [ebp - 0x2d4]
push eax
mov ecx, dword [ebp - 0xe80]
call fcn.0040dc80
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00413270
mov ecx, eax
call fcn.004e1990
mov byte [ebp - 0x2f9], 0
push 0x629518
lea ecx, [ebp - 0x2d4]
call fcn.0040bf30
push eax
call fcn.005b0ac9
add esp, 8
push eax
lea ecx, [ebp - 0xbec]
call fcn.00487ae0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xbec]
call fcn.0041b290
test eax, eax
je 0x411bb2
lea ecx, [ebp - 0xbec]
call fcn.0041b290
push eax
push 1
push 1
lea edx, [ebp - 0x2f9]
push edx
call fcn.005b1816
add esp, 0x10
push 2
push 0
lea ecx, [ebp - 0xbec]
call fcn.0041b290
push eax
call fcn.005b18b8
add esp, 0xc
lea ecx, [ebp - 0xbec]
call fcn.0041b290
push eax
call fcn.005b1ad5
add esp, 4
mov dword [ebp - 0xa4], eax
push 0
push 0
lea ecx, [ebp - 0xbec]
call fcn.0041b290
push eax
call fcn.005b18b8
add esp, 0xc
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xbec]
call fcn.00413420
lea eax, [ebp - 0x3bc]
push eax
mov ecx, dword [ebp - 0xe80]
call fcn.0040dd50
mov byte [ebp - 4], 0x34
movsx ecx, byte [ebp - 0x2f9]
cmp ecx, 0x59
jne 0x411bef
cmp dword [ebp - 0xa4], 0x500000
jb 0x411c25
lea ecx, [ebp - 0x3bc]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
push 0
lea ecx, [ebp - 0x3bc]
call fcn.0040bf30
push eax
lea ecx, [ebp - 0x2d4]
call fcn.0040bf30
push eax
call fcn.004fe150
add esp, 0xc
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 0
lea edx, [ebp - 0x340]
push edx
lea ecx, [ebp - 0x3bc]
call fcn.0040bf30
push eax
call fcn.0051b730
add esp, 8
cmp dword [ebp - 0x33c], 0
ja 0x411c69
cmp dword [ebp - 0x340], 0x6400000
jb 0x411c7d
lea ecx, [ebp - 0x3bc]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0xe80]
call fcn.0040daf0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x130]
call fcn.0040bf30
push eax
call fcn.0051b730
add esp, 8
cmp dword [ebp - 0x9c], 0
ja 0x411cd7
cmp dword [ebp - 0xa0], 0x19000000
jb 0x411ceb
lea ecx, [ebp - 0x130]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0
lea edx, [ebp - 0xc0]
push edx
mov ecx, dword [ebp - 0xe80]
call fcn.0040dbf0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040bf30
push eax
call fcn.0051b730
add esp, 8
cmp dword [ebp - 0x2f4], 0
ja 0x411d45
cmp dword [ebp - 0x2f8], 0x19000000
jb 0x411d59
lea ecx, [ebp - 0xc0]
call fcn.0040bf30
push eax
call fcn.00503060
add esp, 4
lea ecx, [ebp - 0xe28]
push ecx
call fcn.00513b50
add esp, 4
mov dword [ebp - 0xf54], eax
mov edx, dword [ebp - 0xf54]
mov dword [ebp - 0xf58], edx
mov byte [ebp - 4], 0x37
push str.errorfiletemp
mov eax, dword [ebp - 0xf58]
push eax
lea ecx, [ebp - 0xe44]
push ecx
call fcn.00404a40
add esp, 0xc
mov dword [ebp - 0xf5c], eax
mov edx, dword [ebp - 0xf5c]
mov dword [ebp - 0xf60], edx
mov byte [ebp - 4], 0x38
push 0x5c
mov eax, dword [ebp - 0xf60]
push eax
lea ecx, [ebp - 0x3a0]
push ecx
call fcn.00414720
add esp, 0xc
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xe44]
call fcn.0040c050
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xe28]
call fcn.0040c050
lea ecx, [ebp - 0x3a0]
call fcn.0040bf30
push eax
call fcn.004ff4a0
add esp, 4
test eax, eax
je 0x411e11
lea ecx, [ebp - 0x3a0]
call fcn.0040bf30
push eax
call fcn.005007e0
add esp, 4
mov edx, dword [ebp - 0xe80]
mov dword [edx + 0x154], 1
mov eax, dword [ebp - 0xe80]
add eax, 0x154
push eax
push 0x62952c
mov ecx, dword [ebp - 0xe80]
call fcn.00412120
mov ecx, dword [ebp - 0xe80]
mov dword [ecx + 0x158], 0
mov edx, dword [ebp - 0xe80]
add edx, 0x158
push edx
push 0x629530
mov ecx, dword [ebp - 0xe80]
call fcn.00412120
push str.policycycle.dat
mov eax, dword [ebp - 0xe80]
add eax, 0x44
push eax
lea ecx, [ebp - 0x334]
push ecx
call fcn.00404a40
add esp, 0xc
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x334]
call fcn.0040bf30
push eax
lea edx, [ebp - 0xe60]
push edx
call fcn.0051a010
add esp, 8
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0xf68], eax
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0xf68]
push ecx
lea ecx, [ebp - 0x334]
call fcn.0040c030
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xe60]
call fcn.0040c050
mov ecx, dword [ebp - 0xe80]
add ecx, 0x18
call fcn.004fad10
mov ecx, eax
call fcn.00413000
push 0x629544
lea edx, [ebp - 0x334]
push edx
mov ecx, dword [ebp - 0xe80]
add ecx, 0x18
call fcn.004fd2f0
push 1
push 2
lea ecx, [ebp - 0xc70]
call fcn.0040b160
mov byte [ebp - 4], 0x3e
push str.ywSMPAgent.exe
lea eax, [ebp - 0xc70]
push eax
call fcn.00409c80
add esp, 8
lea ecx, [ebp - 0xe7c]
push ecx
lea ecx, [ebp - 0xc70]
call fcn.00409610
mov dword [ebp - 0xf6c], eax
mov edx, dword [ebp - 0xf6c]
mov dword [ebp - 0xf70], edx
mov byte [ebp - 4], 0x3f
mov ecx, dword [ebp - 0xf70]
call fcn.0040bf30
push eax
push str.CAppConfig::Initalize
push 0x4d5
push str..AppConfig.cpp
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0xe7c]
call fcn.0040c050
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xc70]
call fcn.00409ef0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x334]
call fcn.0040c050
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x3a0]
call fcn.0040c050
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xc0]
call fcn.0040c050
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x130]
call fcn.0040c050
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x3bc]
call fcn.0040c050
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2d4]
call fcn.0040c050
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x224]
call fcn.0040c050
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x30]
call fcn.0040c050
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x240]
call fcn.00415550
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2f0]
call fcn.0040c050
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x384]
call fcn.00508420
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x78]
call fcn.0040c050
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x208]
call fcn.00414d70
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x358]
call fcn.0040f090
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x94]
call fcn.0040c050
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x150]
call fcn.0040c050
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x16c]
call fcn.0040c050
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x318]
call fcn.0040c050
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x29c]
call fcn.0040c050
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b8]
call fcn.0040c050
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x54]
call fcn.0040c050
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.0040ce70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret