Function at 0x410030
Capabilities:
Contain obfuscated stackstrings
Copy file
Get common file path
Read file on windows
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee8b8
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xf84
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xe9c], ecx
push 3
call fcn.0050f460
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc8c], esp
push str.ywSMPAgent
call fcn.0040b540
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0xea4], eax
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.005246e0
mov dword [ebp - 0xea8], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xfc]
call fcn.00524360
push 0x5648
lea ecx, [ebp - 0xfc]
call fcn.004156e0
push 0x5648
lea ecx, [ebp - 0xfc]
call fcn.004156c0
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
push ecx
push str.eds_kernel_appdirectory
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
push 0x639610
mov edx, dword [ebp - 0xe9c]
add edx, 0x44
push edx
lea eax, [ebp - 0xca8]
push eax
call fcn.004041b0
add esp, 0xc
mov dword [ebp - 0xeac], eax
mov ecx, dword [ebp - 0xeac]
mov dword [ebp - 0xeb0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xeb0]
push edx
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x7c
call fcn.0040b620
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xca8]
call fcn.0040b640
mov byte [ebp - 4], 3
push 0x1c
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0xcb0], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0xcb0], 0
je 0x41019f
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x7c
call fcn.0040b520
push eax
mov ecx, dword [ebp - 0xcb0]
call fcn.00516260
mov dword [ebp - 0xeb4], eax
jmp 0x4101a9
mov dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0xeb4]
mov dword [ebp - 0xcac], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xe9c]
mov edx, dword [ebp - 0xcac]
mov dword [ecx + 0x40], edx
jmp 0x410280
mov dword [ebp - 4], 1
xor ecx, ecx
jne 0x41015c
push 0x639648
mov edx, dword [ebp - 0xe9c]
add edx, 0x7c
push edx
lea eax, [ebp - 0xc4]
push eax
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.0040b5f0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b0]
call fcn.0040b5f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xce8]
push ecx
call fcn.00515ac0
add esp, 4
mov dword [ebp - 0xec0], eax
mov edx, dword [ebp - 0xec0]
mov dword [ebp - 0xec4], edx
mov byte [ebp - 4], 0xb
push str.config.ini
mov eax, dword [ebp - 0xec4]
push eax
lea ecx, [ebp - 0x494]
push ecx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xce8]
call fcn.0040b640
lea ecx, [ebp - 0x494]
call fcn.0040b520
push eax
lea ecx, [ebp - 0x478]
call fcn.00516260
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xe9c]
add edx, 0x28
push edx
lea ecx, [ebp - 0x45c]
call fcn.0040b5a0
mov byte [ebp - 4], 0xf
push 0x6183ad
push 0x63965c
push 0x639664
lea eax, [ebp - 0xd04]
push eax
lea ecx, [ebp - 0x478]
call fcn.005162e0
mov dword [ebp - 0xec8], eax
mov ecx, dword [ebp - 0xec8]
mov dword [ebp - 0xecc], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xecc]
push edx
lea ecx, [ebp - 0x2b0]
call fcn.0040b620
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xd04]
call fcn.0040b640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x45c]
call fcn.0040b580
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x478]
call fcn.004a2dd0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x494]
call fcn.0040b640
lea ecx, [ebp - 0x294]
call fcn.0040b5f0
mov byte [ebp - 4], 0x11
mov byte [ebp - 0x5a0], 0
push 0x103
push 0
lea eax, [ebp - 0x59f]
push eax
call fcn.005c0cf0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x5a0]
push edx
lea eax, [ebp - 0x5bc]
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.0040fdf0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x5bc]
call fcn.0040b5d0
movzx ecx, al
test ecx, ecx
je 0x410493
lea edx, [ebp - 0x5a0]
add edx, 0xffffffff
mov dword [ebp - 0xed0], edx
mov eax, dword [ebp - 0xed0]
mov cl, byte [eax + 1]
mov byte [ebp - 0xed1], cl
add dword [ebp - 0xed0], 1
cmp byte [ebp - 0xed1], 0
jne 0x410450
mov edi, dword [ebp - 0xed0]
mov edx, dword [str._tempywSMP]
mov dword [edi], edx
mov eax, dword [0x639670]
mov dword [edi + 4], eax
mov ecx, dword [0x639674]
mov dword [edi + 8], ecx
jmp 0x4105dc
lea ecx, [ebp - 0x5bc]
call fcn.0040b520
mov dword [ebp - 0xed8], eax
lea edx, [ebp - 0x5a0]
mov dword [ebp - 0xedc], edx
mov eax, dword [ebp - 0xedc]
mov dword [ebp - 0xee0], eax
mov ecx, dword [ebp - 0xed8]
mov dl, byte [ecx]
mov byte [ebp - 0xee1], dl
mov eax, dword [ebp - 0xedc]
mov cl, byte [ebp - 0xee1]
mov byte [eax], cl
mov edx, dword [ebp - 0xed8]
add edx, 1
mov dword [ebp - 0xed8], edx
mov eax, dword [ebp - 0xedc]
add eax, 1
mov dword [ebp - 0xedc], eax
cmp byte [ebp - 0xee1], 0
jne 0x4104bc
lea ecx, [ebp - 0x5a0]
add ecx, 0xffffffff
mov dword [ebp - 0xee8], ecx
mov edx, dword [ebp - 0xee8]
mov al, byte [edx + 1]
mov byte [ebp - 0xee9], al
add dword [ebp - 0xee8], 1
cmp byte [ebp - 0xee9], 0
jne 0x41050e
mov edi, dword [ebp - 0xee8]
mov ecx, dword [str.___temp___]
mov dword [edi], ecx
mov edx, dword [0x63967c]
mov dword [edi + 4], edx
mov eax, dword [0x639680]
mov dword [edi + 8], eax
mov cx, word [0x639684]
mov word [edi + 0xc], cx
mov dl, byte [0x639686]
mov byte [edi + 0xe], dl
lea eax, [ebp - 0x5a0]
push eax
call fcn.0050ba00
add esp, 4
lea ecx, [ebp - 0x5a0]
push ecx
call fcn.00509820
add esp, 4
push 2
lea edx, [ebp - 0x5a0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x5a0]
add eax, 0xffffffff
mov dword [ebp - 0xef0], eax
mov ecx, dword [ebp - 0xef0]
mov dl, byte [ecx + 1]
mov byte [ebp - 0xef1], dl
add dword [ebp - 0xef0], 1
cmp byte [ebp - 0xef1], 0
jne 0x41059c
mov edi, dword [ebp - 0xef0]
mov eax, dword [str.ywSMP]
mov dword [edi], eax
mov cx, word [0x63968c]
mov word [edi + 4], cx
mov dl, byte [0x63968e]
mov byte [edi + 6], dl
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b4d0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x5bc]
call fcn.0040b640
mov ecx, dword [ebp - 0xe9c]
cmp dword [ecx + 0x184], 0
je 0x41063b
lea edx, [ebp - 0x2b0]
push edx
lea ecx, [ebp - 0x38]
call fcn.0040b620
lea ecx, [ebp - 0x38]
call fcn.0040b5d0
movzx eax, al
test eax, eax
je 0x410639
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040b620
jmp 0x41068e
lea edx, [ebp - 0x294]
push edx
lea ecx, [ebp - 0x38]
call fcn.0040b620
lea ecx, [ebp - 0x38]
call fcn.0040b520
push eax
push str.tempdir
push 0x639698
mov ecx, dword [ebp - 0xe9c]
call fcn.0040ed10
lea ecx, [ebp - 0x2b0]
call fcn.0040b5d0
movzx eax, al
test eax, eax
jne 0x41068e
lea ecx, [ebp - 0x2b0]
call fcn.0040b520
push eax
call fcn.00509180
add esp, 4
lea ecx, [ebp - 0x38]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
lea ecx, [ebp - 0x38]
call fcn.0040b520
push eax
call fcn.00509820
add esp, 4
push 2
lea ecx, [ebp - 0x38]
call fcn.0040b520
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 0xe9c]
cmp dword [ecx + 0x184], 0
je 0x410819
lea ecx, [ebp - 0x38]
call fcn.0040b520
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x6396a0
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0xd20]
push eax
call fcn.004041b0
add esp, 0xc
mov dword [ebp - 0xef8], eax
mov ecx, dword [ebp - 0xef8]
mov dword [ebp - 0xefc], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0xefc]
push edx
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x60
call fcn.0040b620
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xd20]
call fcn.0040b640
push str.ywSMPNPF.sys
mov eax, dword [ebp - 0xe9c]
add eax, 0x44
push eax
lea ecx, [ebp - 0x9dc]
push ecx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0x14
mov byte [ebp - 0x9c0], 0
push 0x3ff
push 0
lea edx, [ebp - 0x9bf]
push edx
call fcn.005c0cf0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x9c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x9c0]
add ecx, 0xffffffff
mov dword [ebp - 0xf00], ecx
mov edx, dword [ebp - 0xf00]
mov al, byte [edx + 1]
mov byte [ebp - 0xf01], al
add dword [ebp - 0xf00], 1
cmp byte [ebp - 0xf01], 0
jne 0x410795
mov edi, dword [ebp - 0xf00]
mov ecx, dword [str.driversywSMPNPF.sys]
mov dword [edi], ecx
mov edx, dword [0x6396b8]
mov dword [edi + 4], edx
mov eax, dword [0x6396bc]
mov dword [edi + 8], eax
mov ecx, dword [0x6396c0]
mov dword [edi + 0xc], ecx
mov edx, dword [0x6396c4]
mov dword [edi + 0x10], edx
mov ax, word [0x6396c8]
mov word [edi + 0x14], ax
push 0
lea ecx, [ebp - 0x9c0]
push ecx
lea ecx, [ebp - 0x9dc]
call fcn.0040b520
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9dc]
call fcn.0040b640
push 0x6396cc
lea ecx, [ebp - 0x38]
call fcn.004024c0
lea ecx, [ebp - 0x38]
call fcn.0040b520
push eax
push str.eds_kernel_tempdirectory
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c660
mov edx, dword [ebp - 0xe9c]
add edx, 0x60
push edx
push str.eds_kernel_datadirectory
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
push str.backup
mov eax, dword [ebp - 0xe9c]
add eax, 0x44
push eax
lea ecx, [ebp - 0x330]
push ecx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0x15
push 1
lea ecx, [ebp - 0x18]
call fcn.00506660
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
call fcn.0040b520
push eax
lea ecx, [ebp - 0x330]
call fcn.0040b520
push eax
lea ecx, [ebp - 0x18]
call fcn.0050bc50
push str..bkp
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
call fcn.0040b520
push eax
call fcn.005095f0
add esp, 8
push str..db_journal
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
call fcn.0040b520
push eax
call fcn.005095f0
add esp, 8
push str..db3_journal
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
call fcn.0040b520
push eax
call fcn.005095f0
add esp, 8
push str.mb1.vbs
mov edx, dword [ebp - 0xe9c]
add edx, 0x44
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x154]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
push str.nselib
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x138]
push edx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x138]
call fcn.0040b520
push eax
call fcn.00509180
add esp, 4
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x7c], 4
push 1
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x40]
push edx
push str.time
push 0x639750
push reloc.WS2_32.dll_bind
call fcn.00507510
add esp, 0x1c
mov esi, dword [ebp - 0x11c]
xor edi, edi
push 0
call fcn.0048b1f0
add esp, 4
push 0
push 0x15180
push edx
push eax
call fcn.005c24b0
mov dword [ebp - 0xf0c], esi
mov dword [ebp - 0xf08], edi
mov dword [ebp - 0xf14], eax
mov dword [ebp - 0xf10], edx
mov eax, dword [ebp - 0xf0c]
cmp eax, dword [ebp - 0xf14]
jne 0x4109f5
mov ecx, dword [ebp - 0xf08]
cmp ecx, dword [ebp - 0xf10]
je 0x410a2f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd24], esp
push 0x6183ae
call fcn.0040b540
mov dword [ebp - 0xf18], eax
mov edx, dword [ebp - 0xf18]
mov dword [ebp - 0xf1c], edx
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0xe9c]
call fcn.0040ebc0
lea ecx, [ebp - 0x78]
call fcn.0040b5f0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x78]
push eax
call fcn.0052ca90
add esp, 4
test eax, eax
je 0x410a60
lea ecx, [ebp - 0x78]
call fcn.0040b520
push eax
call fcn.00408f70
mov ecx, eax
call fcn.00512770
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x3c], eax
push 1
push 4
lea ecx, [ebp - 0x3c]
push ecx
push 4
push str.agent
push 0x639768
push reloc.WS2_32.dll_bind
call fcn.00508170
add esp, 0x1c
lea ecx, [ebp - 0x370]
call fcn.0052d7b0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x218]
call fcn.004155f0
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x370]
call fcn.0052f640
test eax, eax
je 0x410b0e
mov ecx, dword [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x208]
push edx
lea eax, [ebp - 0x9f8]
push eax
call fcn.0052e080
add esp, 0xc
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x9f8]
push ecx
push str.eds_kernel_starttime
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x9f8]
call fcn.0040b640
jmp 0x410ba7
push 1
push 2
lea ecx, [ebp - 0xa78]
call fcn.0040a750
mov byte [ebp - 4], 0x1d
push 0x639790
lea edx, [ebp - 0xa78]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0xd40]
push eax
lea ecx, [ebp - 0xa78]
call fcn.00408c00
mov dword [ebp - 0xf20], eax
mov ecx, dword [ebp - 0xf20]
mov dword [ebp - 0xf24], ecx
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0xf24]
call fcn.0040b520
push eax
push 0x6397a4
push 0x43f
push 0x6397bc
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xd40]
call fcn.0040b640
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa78]
call fcn.004094e0
push 0x6183af
push 0x6397cc
push 0x6397d8
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [eax + 0x40]
call fcn.005162e0
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0xe9c]
cmp dword [ecx + 0x184], 0
jne 0x410d5a
mov edx, dword [ebp - 0xe9c]
cmp dword [edx + 0x188], 0
jne 0x410d5a
lea ecx, [ebp - 0x5c]
call fcn.0040b5d0
movzx eax, al
test eax, eax
je 0x410d35
push 1
push 2
lea ecx, [ebp - 0xaf8]
call fcn.0040a750
mov byte [ebp - 4], 0x20
push 0x6397e0
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0xd5c]
push edx
lea ecx, [ebp - 0xaf8]
call fcn.00408c00
mov dword [ebp - 0xf28], eax
mov eax, dword [ebp - 0xf28]
mov dword [ebp - 0xf2c], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xf2c]
call fcn.0040b520
push eax
push 0x639808
push 0x449
push 0x639820
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xd5c]
call fcn.0040b640
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xaf8]
call fcn.004094e0
lea ecx, [ebp - 0xc4]
call fcn.0040b520
push eax
call fcn.00514170
add esp, 4
test eax, eax
je 0x410d33
push 0
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x7c
call fcn.0040b520
push eax
lea ecx, [ebp - 0xc4]
call fcn.0040b520
push eax
call fcn.0050b4f0
add esp, 0xc
push 0x6183d5
push str.serverip
push 0x63983c
lea ecx, [ebp - 0xd78]
push ecx
mov edx, dword [ebp - 0xe9c]
mov ecx, dword [edx + 0x40]
call fcn.005162e0
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0xf30]
mov dword [ebp - 0xf34], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0xf34]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0040b620
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xd78]
call fcn.0040b640
jmp 0x410d5a
push 0
lea ecx, [ebp - 0xc4]
call fcn.0040b520
push eax
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x7c
call fcn.0040b520
push eax
call fcn.0050b4f0
add esp, 0xc
lea edx, [ebp - 0x5c]
push edx
push str.eds_kernel_serveripaddr
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
push 0
push 0
lea ecx, [ebp - 0x5c]
call fcn.0040b520
push eax
lea ecx, [ebp - 0x39c]
call fcn.00523720
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x39c]
call fcn.00521320
cmp eax, 2
jne 0x410db0
lea eax, [ebp - 0x5c]
push eax
push str.eds_kernel_serveripv4addr
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
jmp 0x410dd4
lea ecx, [ebp - 0x39c]
call fcn.00521320
cmp eax, 0x17
jne 0x410dd4
lea ecx, [ebp - 0x5c]
push ecx
push str.eds_kernel_serveripv6addr
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
push 0x6183d6
push str.myonlyid
push 0x6398a0
lea edx, [ebp - 0x2e8]
push edx
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [eax + 0x40]
call fcn.005162e0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x2e8]
call fcn.0040b5d0
movzx ecx, al
test ecx, ecx
je 0x410eab
push 1
push 2
lea ecx, [ebp - 0xb78]
call fcn.0040a750
mov byte [ebp - 4], 0x25
push 0x6398a8
lea edx, [ebp - 0xb78]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0xd94]
push eax
lea ecx, [ebp - 0xb78]
call fcn.00408c00
mov dword [ebp - 0xf38], eax
mov ecx, dword [ebp - 0xf38]
mov dword [ebp - 0xf3c], ecx
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0xf3c]
call fcn.0040b520
push eax
push 0x6398c4
push 0x46b
push 0x6398dc
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xd94]
call fcn.0040b640
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xb78]
call fcn.004094e0
lea edx, [ebp - 0x2e8]
push edx
push str.eds_kernel_onlyid
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd98], esp
lea eax, [ebp - 0x2e8]
push eax
call fcn.0040b660
mov dword [ebp - 0xf40], eax
mov ecx, dword [ebp - 0xf40]
mov dword [ebp - 0xf44], ecx
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0xe9c]
call fcn.00412580
lea ecx, [ebp - 0x2e8]
call fcn.0040b5d0
movzx edx, al
test edx, edx
jne 0x410f49
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd9c], esp
lea eax, [ebp - 0x2e8]
push eax
call fcn.0040b660
mov dword [ebp - 0xf48], eax
mov ecx, dword [ebp - 0xf48]
mov dword [ebp - 0xf4c], ecx
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x24
call fcn.00520170
add esp, 0x1c
lea edx, [ebp - 0x2e8]
push edx
call fcn.005101c0
add esp, 4
mov ecx, dword [ebp - 0xe9c]
mov dword [ecx + 0x180], eax
mov byte [ebp - 0x278], 0
push 0x3f
push 0
lea edx, [ebp - 0x277]
push edx
call fcn.005c0cf0
add esp, 0xc
push 0x5648
push 0x639900
lea eax, [ebp - 0x278]
push eax
call fcn.005bd49b
add esp, 0xc
lea ecx, [ebp - 0x278]
push ecx
push str.eds_kernel_localport
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c660
mov ecx, dword [ebp - 0xe9c]
call fcn.0040ee40
push 0x6183d7
push 0x63991c
push 0x639920
lea edx, [ebp - 0xdb8]
push edx
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [eax + 0x40]
call fcn.005162e0
mov dword [ebp - 0xf50], eax
mov ecx, dword [ebp - 0xf50]
mov dword [ebp - 0xf54], ecx
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0xf54]
push edx
mov ecx, dword [ebp - 0xe9c]
add ecx, 0xb4
call fcn.0040b620
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xdb8]
call fcn.0040b640
push 0x6183df
push str.ipv6
push 0x639930
lea eax, [ebp - 0xdd4]
push eax
mov ecx, dword [ebp - 0xe9c]
mov ecx, dword [ecx + 0x40]
call fcn.005162e0
mov dword [ebp - 0xf58], eax
mov edx, dword [ebp - 0xf58]
mov dword [ebp - 0xf5c], edx
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0xf5c]
push eax
mov ecx, dword [ebp - 0xe9c]
add ecx, 0xd0
call fcn.0040b620
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xdd4]
call fcn.0040b640
push 0x6183e2
push 0x639938
push 0x63993c
lea ecx, [ebp - 0xdf0]
push ecx
mov edx, dword [ebp - 0xe9c]
mov ecx, dword [edx + 0x40]
call fcn.005162e0
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0xf64], eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0xf64]
push ecx
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x98
call fcn.0040b620
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xdf0]
call fcn.0040b640
push 0
push str.fwtoolversion
push str.CONFIG
mov edx, dword [ebp - 0xe9c]
mov ecx, dword [edx + 0x40]
call fcn.005164c0
mov ecx, dword [ebp - 0xe9c]
mov dword [ecx + 0x18c], eax
mov edx, dword [ebp - 0xe9c]
add edx, 0x15c
push edx
call fcn.005301d0
add esp, 4
test eax, eax
je 0x41113c
mov eax, dword [ebp - 0xe9c]
add eax, 0x15c
push eax
push str.eds_kernel_powertime
mov ecx, dword [ebp - 0xe9c]
call fcn.0040c500
jmp 0x4111d5
push 1
push 2
lea ecx, [ebp - 0xbf8]
call fcn.0040a750
mov byte [ebp - 4], 0x2c
push 0x639974
lea ecx, [ebp - 0xbf8]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0xe0c]
push edx
lea ecx, [ebp - 0xbf8]
call fcn.00408c00
mov dword [ebp - 0xf68], eax
mov eax, dword [ebp - 0xf68]
mov dword [ebp - 0xf6c], eax
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0xf6c]
call fcn.0040b520
push eax
push 0x639988
push 0x49a
push 0x6399a0
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xe0c]
call fcn.0040b640
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xbf8]
call fcn.004094e0
push str.uplog2.db3.sed
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x234]
push edx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x234]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
mov dword [ebp - 0x8c], 0
lea eax, [ebp - 0x2cc]
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.0040d440
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x2cc]
push ecx
call fcn.00412c20
mov ecx, eax
call fcn.004eb240
mov byte [ebp - 0x311], 0
push 0x6399c0
lea ecx, [ebp - 0x2cc]
call fcn.0040b520
push eax
call fcn.005bd438
add esp, 8
push eax
lea ecx, [ebp - 0xbfc]
call fcn.00445e90
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xbfc]
call fcn.0048acf0
test eax, eax
je 0x4112e6
lea ecx, [ebp - 0xbfc]
call fcn.0048acf0
push eax
push 1
push 1
lea edx, [ebp - 0x311]
push edx
call fcn.005be7ff
add esp, 0x10
push 2
push 0
lea ecx, [ebp - 0xbfc]
call fcn.0048acf0
push eax
call fcn.005be8a1
add esp, 0xc
lea ecx, [ebp - 0xbfc]
call fcn.0048acf0
push eax
call fcn.005be152
add esp, 4
mov dword [ebp - 0x8c], eax
push 0
push 0
lea ecx, [ebp - 0xbfc]
call fcn.0048acf0
push eax
call fcn.005be8a1
add esp, 0xc
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xbfc]
call fcn.00412e10
lea eax, [ebp - 0x3d4]
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.0040d510
mov byte [ebp - 4], 0x31
movsx ecx, byte [ebp - 0x311]
cmp ecx, 0x59
jne 0x411323
cmp dword [ebp - 0x8c], 0x500000
jb 0x411359
lea ecx, [ebp - 0x3d4]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
push 0
lea ecx, [ebp - 0x3d4]
call fcn.0040b520
push eax
lea ecx, [ebp - 0x2cc]
call fcn.0040b520
push eax
call fcn.00506620
add esp, 0xc
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x354], 0
lea edx, [ebp - 0x358]
push edx
lea ecx, [ebp - 0x3d4]
call fcn.0040b520
push eax
call fcn.00530270
add esp, 8
cmp dword [ebp - 0x354], 0
ja 0x41139d
cmp dword [ebp - 0x358], 0x6400000
jb 0x4113b1
lea ecx, [ebp - 0x3d4]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.0040d2b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x118]
call fcn.0040b520
push eax
call fcn.00530270
add esp, 8
cmp dword [ebp - 0x84], 0
ja 0x41140b
cmp dword [ebp - 0x88], 0x19000000
jb 0x41141f
lea ecx, [ebp - 0x118]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
lea edx, [ebp - 0xa8]
push edx
mov ecx, dword [ebp - 0xe9c]
call fcn.0040d3b0
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0040b520
push eax
call fcn.00530270
add esp, 8
cmp dword [ebp - 0x30c], 0
ja 0x411479
cmp dword [ebp - 0x310], 0x19000000
jb 0x41148d
lea ecx, [ebp - 0xa8]
call fcn.0040b520
push eax
call fcn.0050ba00
add esp, 4
lea ecx, [ebp - 0xe28]
push ecx
call fcn.00515ac0
add esp, 4
mov dword [ebp - 0xf70], eax
mov edx, dword [ebp - 0xf70]
mov dword [ebp - 0xf74], edx
mov byte [ebp - 4], 0x34
push str.errorfiletemp
mov eax, dword [ebp - 0xf74]
push eax
lea ecx, [ebp - 0xe44]
push ecx
call fcn.004041b0
add esp, 0xc
mov dword [ebp - 0xf78], eax
mov edx, dword [ebp - 0xf78]
mov dword [ebp - 0xf7c], edx
mov byte [ebp - 4], 0x35
push 0x5c
mov eax, dword [ebp - 0xf7c]
push eax
lea ecx, [ebp - 0x3b8]
push ecx
call fcn.00414ec0
add esp, 0xc
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xe44]
call fcn.0040b640
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xe28]
call fcn.0040b640
lea ecx, [ebp - 0x3b8]
call fcn.0040b520
push eax
call fcn.00507e40
add esp, 4
test eax, eax
je 0x411545
lea ecx, [ebp - 0x3b8]
call fcn.0040b520
push eax
call fcn.00509180
add esp, 4
mov edx, dword [ebp - 0xe9c]
mov dword [edx + 0x154], 1
mov eax, dword [ebp - 0xe9c]
add eax, 0x154
push eax
push 0x6399d4
mov ecx, dword [ebp - 0xe9c]
call fcn.00411940
mov ecx, dword [ebp - 0xe9c]
mov dword [ecx + 0x158], 0
mov edx, dword [ebp - 0xe9c]
add edx, 0x158
push edx
push 0x6399d8
mov ecx, dword [ebp - 0xe9c]
call fcn.00411940
push str.policycycle.dat
mov eax, dword [ebp - 0xe9c]
add eax, 0x44
push eax
lea ecx, [ebp - 0x34c]
push ecx
call fcn.004041b0
add esp, 0xc
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x34c]
call fcn.0040b520
push eax
lea edx, [ebp - 0xe60]
push edx
call fcn.00514300
add esp, 8
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0xf80]
mov dword [ebp - 0xf84], eax
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0xf84]
push ecx
lea ecx, [ebp - 0x34c]
call fcn.0040b620
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xe60]
call fcn.0040b640
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x18
call fcn.00510100
mov ecx, eax
call fcn.00412990
push 0x6399ec
lea edx, [ebp - 0x34c]
push edx
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x18
call fcn.00512330
push 0x6399f0
push 0x6399f8
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.0040ec80
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x304]
call fcn.0040b5d0
movzx ecx, al
test ecx, ecx
je 0x411744
push 0
push 0
push 3
push 0
push 7
push closesocket
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x7c
call fcn.0040b520
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc08], eax
cmp dword [ebp - 0xc08], 0
je 0x411723
push 0
push 0
lea edx, [ebp - 0xc04]
push edx
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc00]
push edx
mov eax, dword [ebp - 0xc04]
push eax
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.0052e080
add esp, 0xc
mov dword [ebp - 0xf88], eax
mov edx, dword [ebp - 0xf88]
mov dword [ebp - 0xf8c], edx
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0xf8c]
push eax
lea ecx, [ebp - 0x304]
call fcn.0040b620
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xe7c]
call fcn.0040b640
lea ecx, [ebp - 0x304]
call fcn.0040b520
push eax
push str.RegTime
push str.SYSTEM_REG
mov ecx, dword [ebp - 0xe9c]
call fcn.0040ed10
push 1
push 2
lea ecx, [ebp - 0xc88]
call fcn.0040a750
mov byte [ebp - 4], 0x3d
push str.ywSMPAgent.exe
lea ecx, [ebp - 0xc88]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0xe98]
push edx
lea ecx, [ebp - 0xc88]
call fcn.00408c00
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0xf90]
mov dword [ebp - 0xf94], eax
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0xf94]
call fcn.0040b520
push eax
push str.CAppConfig::Initalize
push 0x503
push str..AppConfig.cpp
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0xe98]
call fcn.0040b640
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xc88]
call fcn.004094e0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x304]
call fcn.0040b640
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x34c]
call fcn.0040b640
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x3b8]
call fcn.0040b640
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xa8]
call fcn.0040b640
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x118]
call fcn.0040b640
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x3d4]
call fcn.0040b640
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x2cc]
call fcn.0040b640
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x234]
call fcn.0040b640
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2e8]
call fcn.0040b640
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x39c]
call fcn.00521330
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x5c]
call fcn.0040b640
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x218]
call fcn.00415560
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x370]
call fcn.0040e850
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x78]
call fcn.0040b640
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x138]
call fcn.0040b640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x154]
call fcn.0040b640
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x330]
call fcn.0040b640
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x294]
call fcn.0040b640
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b0]
call fcn.0040b640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.0040b640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc4]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.004d16a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret