Function at 0x10010200
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10041856
mov eax, dword fs:[0]
push eax
mov eax, 0x2ac4
call fcn.10027440
mov eax, dword [0x10050fc0]
xor eax, esp
mov dword [esp + 0x2ac0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050fc0]
xor eax, esp
push eax
lea eax, [esp + 0x2ad8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2ae8]
mov esi, ecx
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], edi
call fcn.10001c60
mov ebx, eax
cmp ebx, edi
je 0x100180ef
push str.hai_long__set_policy_32_
call fcn.10009a60
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Class
call fcn.10001ea0
lea eax, [esp + 0x28]
push eax
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [esp + 0x24]
push str.jjlpathsec
push ecx
mov dword [esp + 0x2ae8], edi
call fcn.10029339
add esp, 8
cmp eax, edi
sete al
test al, al
je 0x100108d0
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
call fcn.10001ea0
lea edx, [esp + 0x4f0]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10052460
mov ebx, 1
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x100102f0
mov eax, dword [esp + 0x4ec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001031f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, ebp
call fcn.10001f60
push 0x48
mov edi, eax
push 0
push 0x100f5178
mov dword [0x10131e14], edi
call fcn.10027470
push 0x1b6c
push 0
push 0x100f51c0
call fcn.10027470
add esp, 0x18
mov dword [0x100f51c0], edi
xor eax, eax
jmp 0x10010360
mov cl, byte [eax + 0x10052460]
mov byte [eax + 0x100f51c4], cl
add eax, ebx
test cl, cl
jne 0x10010360
xor eax, eax
jmp 0x10010380
mov cl, byte [eax + 0x100c3108]
mov byte [eax + 0x100f52be], cl
add eax, ebx
test cl, cl
jne 0x10010380
movzx eax, word [0x100455cc]
mov edx, dword [0x100455c8]
mov ecx, dword [str.C:AAABBB]
mov dword [0x100f53e4], ecx
mov ecx, dword [str.D:AAABBB]
mov dword [0x100f53e8], edx
mov edx, dword [0x100455bc]
mov word [0x100f53ec], ax
movzx eax, word [0x100455c0]
mov dword [0x100f54ec], ecx
mov ecx, dword [str.E:AAABBB]
mov dword [0x100f54f0], edx
mov edx, dword [0x100455b0]
mov word [0x100f54f4], ax
movzx eax, word [0x100455b4]
mov dword [0x100f55f0], ecx
mov ecx, dword [str..ILK]
mov dword [0x100f55f4], edx
movzx edx, byte [0x100455a8]
mov word [0x100f55f8], ax
mov eax, dword [str.RECENT_]
mov dword [0x100f5f18], ecx
mov ecx, dword [0x1004559c]
mov byte [0x100f5f1c], dl
movzx edx, byte [0x100455a0]
mov dword [0x100f6714], eax
mov eax, dword [0x10045590]
mov dword [0x100f6718], ecx
mov cl, byte [0x10045594]
push 0x100f6304
mov edi, 2
push 0x104
mov dword [0x100f53c4], ebx
mov dword [0x100f53c8], ebx
mov dword [0x100f53cc], ebx
mov dword [0x100f53d0], ebx
mov dword [0x100f53d4], ebx
mov dword [0x100f53d8], ebx
mov dword [0x100f53dc], ebx
mov dword [0x100f53e0], 0
mov dword [0x100f54e8], edi
mov dword [0x100f5f14], ebx
mov dword [0x100f6300], 5
mov byte [0x100f671c], dl
mov dword [0x100f6610], eax
mov byte [0x100f6614], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x100f6304
call fcn.10028a08
add esp, 4
push 0x104
push 0x100f6408
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x100f6408
call fcn.10028a08
add esp, 4
lea edx, [esp + 0x5d8]
push edx
lea eax, [esp + 0x378]
push eax
push 0
push 0xf003f
push 0
push 0x10043690
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsCachePaths
push 0x80000002
mov dword [esp + 0x5fc], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001054c
lea ecx, [esp + 0x4fc]
push ecx
push 0x100f650c
lea edx, [esp + 0x64]
push edx
push eax
mov eax, dword [esp + 0x384]
push str.Directory
push eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x514], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x100f650c
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x68]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov dword [0x100f51bc], eax
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100105a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Class
call fcn.10001ea0
lea ecx, [esp + 0x5c8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100f5178
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x100105d0
mov eax, dword [esp + 0x5c4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100105ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x70]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov dword [0x100f51b8], eax
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001064c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0x384]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f5198], eax
mov eax, dword [esp + 0x384]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100106a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x7c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f519c], eax
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100106ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT2
call fcn.10001ea0
lea ecx, [esp + 0x50c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f51a0], eax
mov eax, dword [esp + 0x50c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10010743
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0x84]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f51a4], eax
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10010798
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x38c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f51a8], eax
mov eax, dword [esp + 0x38c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100107ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET3
call fcn.10001ea0
lea ecx, [esp + 0x8c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f51ac], eax
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10010841
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x620]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
mov dword [0x100f51b0], eax
mov eax, dword [esp + 0x620]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10010895
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x94]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
mov dword [0x100f51b4], eax
mov eax, dword [esp + 0x94]
jmp 0x10011a37
lea ecx, [esp + 0x24]
push 0x10043b94
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x10011a5f
push 0x100454ac
call fcn.10009a60
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
call fcn.10001ea0
lea edx, [esp + 0x390]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10052460
mov esi, 1
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x10010932
lea ecx, [esp + 0x38c]
call fcn.100018d0
mov ecx, ebp
call fcn.10001f60
push 0x2f7c
push 0
push 0x100f21f8
mov dword [0x10131e14], eax
call fcn.10027470
push 0x48
push 0
push 0x100f21b0
call fcn.10027470
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UpRegionService
call fcn.10001ea0
lea eax, [esp + 0x98]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x94]
mov dword [0x100f446c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.WriteLocalFile
call fcn.10001ea0
lea ecx, [esp + 0x510]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x50c]
mov dword [0x100f4470], eax
call fcn.100018d0
mov edx, dword [0x10131e14]
mov dword [0x100f21f8], edx
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x10052460]
mov byte [eax + 0x100f21fc], cl
add eax, esi
test cl, cl
jne 0x10010a00
xor eax, eax
jmp 0x10010a20
mov cl, byte [eax + 0x100c3108]
mov byte [eax + 0x100f22f6], cl
add eax, esi
test cl, cl
jne 0x10010a20
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisableOnTimeSoftSendFile
call fcn.10001ea0
lea eax, [esp + 0xa0]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x9c]
mov dword [0x100f4c50], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisableOnTimeSoftRecvFile
call fcn.10001ea0
lea ecx, [esp + 0x398]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x394]
mov dword [0x100f4c54], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisabledCopyFileFromUDisk
call fcn.10001ea0
lea edx, [esp + 0xa8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xa4]
mov dword [0x100f4c58], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisabledCopyFileFromUDisk
call fcn.10001ea0
lea eax, [esp + 0x5d0]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x5cc]
mov dword [0x100f4c5c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AppointPrintControl
call fcn.10001ea0
lea ecx, [esp + 0xb0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xac]
mov dword [0x100f4d70], eax
call fcn.100018d0
push 0x3ff
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.ProcessNameFileExtensions
call fcn.10001ea0
lea edx, [esp + 0x3a4]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f4d74
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x39c]
call fcn.100018d0
push 0x100f4d74
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisablePrintFile
call fcn.10001ea0
lea eax, [esp + 0xb8]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xb4]
mov dword [0x100f3404], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.BackupPrintFile
call fcn.10001ea0
lea ecx, [esp + 0x518]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x514]
mov dword [0x100f3408], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllowPrintDayControl
call fcn.10001ea0
lea edx, [esp + 0xc0]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
lea ecx, [esp + 0xbc]
setg byte [esp + 0x1f]
call fcn.100018d0
cmp byte [esp + 0x1f], 0
je 0x10010ddc
push 0x100453bc
call fcn.10009a60
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllowPrintDayControl
call fcn.10001ea0
lea ecx, [esp + 0x3a8]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x3a4]
mov dword [0x100f4c60], eax
call fcn.100018d0
cmp dword [0x100f4c60], 0
je 0x10010ddc
push str.PrintWeekDay
call fcn.10009a60
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PrintWeekDay
call fcn.10001ea0
lea edx, [esp + 0xc8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xc4]
mov dword [0x100f4c64], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PrintTime
call fcn.10001ea0
lea eax, [esp + 0x3b0]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0x104
mov byte [esp + 0x2ae0], 1
jle 0x10010d33
mov eax, 0x103
jmp 0x10010d64
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PrintTime
call fcn.10001ea0
lea edx, [esp + 0xd0]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov byte [esp + 0x2ae0], 2
mov dword [esp + 0x20], esi
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PrintTime
call fcn.10001ea0
lea ecx, [esp + 0x628]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f4c6c
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x620]
call fcn.100018d0
test byte [esp + 0x20], 1
mov dword [esp + 0x2ae0], esi
je 0x10010dbb
lea ecx, [esp + 0xcc]
call fcn.100018d0
lea ecx, [esp + 0x3ac]
mov byte [esp + 0x2ae0], 0
call fcn.100018d0
push 0x100f4c6c
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.EnableSpecExePrint
call fcn.10001ea0
lea edx, [esp + 0xd8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xd4]
mov dword [0x100f2400], eax
call fcn.100018d0
push 0x1001
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PrintExeList
call fcn.10001ea0
lea eax, [esp + 0x524]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f2404
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0x51c]
call fcn.100018d0
push 0x100f2404
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditPrintFile
call fcn.10001ea0
lea ecx, [esp + 0xe0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xdc]
mov dword [0x100f340c], eax
call fcn.100018d0
cmp dword [0x100f340c], 0
je 0x10010eae
push 0x10045358
jmp 0x10010eb3
push 0x1004533c
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.RefusePrintExtName
call fcn.10001ea0
lea edx, [esp + 0x3b8]
push edx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100f3414
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x10010ee2
lea ecx, [esp + 0x3b4]
call fcn.100018d0
push 0x100f3414
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllowedPrinterServerIP
call fcn.10001ea0
lea eax, [esp + 0x5d8]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AllowedPrinterServerIP
mov byte [esp + 0x2aec], 3
call fcn.10001ea0
lea edx, [esp + 0xec]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f35a4
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0xe4]
call fcn.100018d0
lea ecx, [esp + 0x5d4]
mov byte [esp + 0x2ae0], 0
call fcn.100018d0
mov edi, 0x100f35a4
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10010f87
mov ax, word [0x10043808]
push 0x100f35a4
mov word [edi], ax
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllowPrintFile
call fcn.10001ea0
lea ecx, [esp + 0xf0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xec]
mov dword [0x100f3410], eax
call fcn.100018d0
cmp dword [0x100f3410], esi
je 0x10010fec
push 0x100452e8
jmp 0x10010ff1
push 0x100452cc
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllowPrintExtName
call fcn.10001ea0
lea edx, [esp + 0x3c0]
push edx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100f39a4
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x10011020
lea ecx, [esp + 0x3bc]
call fcn.100018d0
push 0x100f39a4
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisableMailFile
call fcn.10001ea0
lea eax, [esp + 0xf8]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xf4]
mov dword [0x100f3b34], eax
call fcn.100018d0
push 0x1ff
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.ExceptSMTPServer
call fcn.10001ea0
lea ecx, [esp + 0x52c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f3b38
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x524]
call fcn.100018d0
push 0x100f3b38
call fcn.100408b1
mov ecx, dword [esp + 0x38]
add esp, 4
push 0x100f3b38
call fcn.10003550
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditMailFile
call fcn.10001ea0
lea edx, [esp + 0x100]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xfc]
mov dword [0x100f3d38], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.RefuseMailExtName
call fcn.10001ea0
lea eax, [esp + 0x3c8]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov edi, 0x100f3d3c
lea esp, [esp]
mov cl, byte [eax]
mov byte [edi], cl
add eax, esi
add edi, esi
test cl, cl
jne 0x10011140
lea ecx, [esp + 0x3c4]
call fcn.100018d0
push 0x100f3d3c
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisableNetFile
call fcn.10001ea0
lea ecx, [esp + 0x108]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x104]
mov dword [0x100f3ecc], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditNetFile
call fcn.10001ea0
lea edx, [esp + 0x62c]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x628]
mov dword [0x100f3ed0], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.RefuseNetFileExtName
call fcn.10001ea0
lea eax, [esp + 0x110]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100f3ed4
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x10011200
lea ecx, [esp + 0x10c]
call fcn.100018d0
push 0x100f3ed4
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditNetFileExtName
call fcn.10001ea0
lea ecx, [esp + 0x3d0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100f40d4
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x10011248
lea ecx, [esp + 0x3cc]
call fcn.100018d0
push 0x100f40d4
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisableFTPFile
call fcn.10001ea0
lea edx, [esp + 0x118]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x114]
mov dword [0x100f42d4], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditFTPFile
call fcn.10001ea0
lea eax, [esp + 0x530]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x52c]
mov dword [0x100f42d8], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.RefuseFTPFileExtName
call fcn.10001ea0
lea ecx, [esp + 0x120]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov edi, 0x100f42dc
mov cl, byte [eax]
mov byte [edi], cl
add eax, esi
add edi, esi
test cl, cl
jne 0x10011308
lea ecx, [esp + 0x11c]
call fcn.100018d0
push 0x100f42dc
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.CheckKeyWorkInFile
call fcn.10001ea0
lea edx, [esp + 0x3d8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x3d4]
mov dword [0x100f4474], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.FindKeyWorkHowToDeal
call fcn.10001ea0
lea eax, [esp + 0x128]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x124]
mov dword [0x100f4478], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.KeyWorkInFileString
call fcn.10001ea0
lea ecx, [esp + 0x5e0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
lea edx, [esp + 0x15e0]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x100113d0
lea ecx, [esp + 0x5dc]
call fcn.100018d0
cmp byte [esp + 0x15e0], 0
jne 0x10011401
mov dword [0x100f4474], 0
jmp 0x10011485
xor ebx, ebx
lea edi, [esp + 0x15e0]
mov dword [esp + 0x2c], ebx
mov esi, 0x100f4480
test edi, edi
je 0x10011485
push 0x10043808
push edi
call fcn.10027f00
add esp, 8
test eax, eax
je 0x1001145f
mov ebx, esi
mov byte [eax], 0
mov ecx, edi
sub ebx, edi
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
test dl, dl
jne 0x10011432
lea edi, [eax + 1]
mov eax, dword [esp + 0x2c]
inc eax
add esi, 0xc8
cmp esi, 0x100f4c50
mov ebx, eax
mov dword [0x100f447c], eax
mov dword [esp + 0x2c], ebx
jl 0x10011413
jmp 0x10011485
cmp byte [edi], 0
je 0x1001147f
mov edx, ebx
imul edx, edx, 0xc8
sub edx, edi
lea ecx, [edx + 0x100f4480]
mov al, byte [edi]
mov byte [edi + ecx], al
inc edi
test al, al
jne 0x10011474
inc ebx
mov dword [0x100f447c], ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x130]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov dword [0x100f23fc], eax
mov eax, dword [esp + 0x130]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100114d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, 1
push 0x10052560
cmp dword [0x100f23fc], edi
jne 0x1001161e
lea ecx, [esp + 0x40]
call fcn.10001ea0
push 0x10043700
lea ecx, [esp + 0x40]
mov byte [esp + 0x2ae4], 4
call fcn.10009050
push edi
lea ecx, [esp + 0x670]
push str.authmail.flg
push ecx
call fcn.10009930
add esp, 0xc
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x2ae0], 5
jb 0x10011536
mov eax, dword [eax + 4]
jmp 0x10011539
add eax, 4
push eax
lea ecx, [esp + 0x40]
call fcn.10009050
lea ecx, [esp + 0x66c]
mov byte [esp + 0x2ae0], 4
call fcn.10006260
mov edx, dword [esp + 0x3c]
push 0x100448c0
push edx
call fcn.1002a300
mov esi, eax
add esp, 8
test esi, esi
je 0x10011606
push 0x208
lea eax, [esp + 0x700]
push 0
push eax
call fcn.10027470
add esp, 0xc
mov dword [esp + 0x6f8], 0x20c
cmp dword [0x100f3b34], edi
jne 0x100115c0
push 0x200
lea ecx, [esp + 0x708]
push 0x100f3b38
push ecx
mov dword [esp + 0x708], edi
call fcn.10028df0
add esp, 0xc
jmp 0x100115d0
cmp dword [0x100f3d38], 0
je 0x100115d0
mov dword [esp + 0x700], edi
lea eax, [esp + 0x6f8]
mov ecx, 0x20c
lea esp, [esp]
xor byte [eax], 0xaa
add eax, edi
sub ecx, edi
jne 0x100115e0
push esi
push edi
lea edx, [esp + 0x700]
push 0x20c
push edx
call fcn.1002a1ba
push esi
call fcn.10029fdc
add esp, 0x14
cmp dword [0x100f340c], 0
je 0x10011618
push edi
call fcn.1000cf00
add esp, 4
mov eax, dword [esp + 0x3c]
jmp 0x1001168e
lea ecx, [esp + 0x3c]
call fcn.10001ea0
push 0x10043700
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2ae4], 6
call fcn.10009050
push edi
lea ecx, [esp + 0x6a8]
push str.authmail.flg
push ecx
call fcn.10009930
add esp, 0xc
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x2ae0], 7
jb 0x10011666
mov eax, dword [eax + 4]
jmp 0x10011669
add eax, 4
push eax
lea ecx, [esp + 0x3c]
call fcn.10009050
lea ecx, [esp + 0x6a4]
call fcn.10006260
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x2ae0], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100116b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x3e0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov dword [0x100f21f4], eax
mov eax, dword [esp + 0x3e0]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10011705
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Class
call fcn.10001ea0
lea ecx, [esp + 0x138]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100f21b0
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
test al, al
jne 0x10011730
mov eax, dword [esp + 0x134]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001175f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x538]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov dword [0x100f21f0], eax
mov eax, dword [esp + 0x538]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100117b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0x144]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f21d0], eax
mov eax, dword [esp + 0x144]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10011806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x3ec]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f21d4], eax
mov eax, dword [esp + 0x3ec]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001185b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT2
call fcn.10001ea0
lea ecx, [esp + 0x14c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f21d8], eax
mov eax, dword [esp + 0x14c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100118af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0x638]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f21dc], eax
mov eax, dword [esp + 0x638]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10011904
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x154]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f21e0], eax
mov eax, dword [esp + 0x154]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10011958
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET3
call fcn.10001ea0
lea ecx, [esp + 0x3f4]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
mov dword [0x100f21e4], eax
mov eax, dword [esp + 0x3f4]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100119ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x15c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
mov dword [0x100f21e8], eax
mov eax, dword [esp + 0x15c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10011a01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x544]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
mov dword [0x100f21ec], eax
mov eax, dword [esp + 0x544]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100180c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x100180c4
lea ecx, [esp + 0x24]
push 0x10043b20
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x10012df3
push 0x10045188
call fcn.10009a60
push 0x87b8
push edi
push 0x100e99f8
call fcn.10027470
push 0x14c
push edi
push 0x100e98a8
call fcn.10027470
add esp, 0x1c
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
mov dword [0x100e99f8], eax
call fcn.10001ea0
lea edx, [esp + 0x160]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100e99fc
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10011ae0
lea ecx, [esp + 0x15c]
call fcn.100018d0
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
mov dword [0x100e98a8], eax
call fcn.10001ea0
lea eax, [esp + 0x3f8]
push eax
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100e98ac
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10011b30
lea ecx, [esp + 0x3f4]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x168]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x164]
mov dword [0x100e99e8], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Class
call fcn.10001ea0
lea edx, [esp + 0x610]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100e99a6
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10011bb0
lea ecx, [esp + 0x60c]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x170]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x16c]
mov dword [0x100e99e4], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0x404]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3fc]
mov dword [0x100e99c4], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET1
call fcn.10001ea0
lea edx, [esp + 0x17c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x174]
mov dword [0x100e99c8], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT2
call fcn.10001ea0
lea eax, [esp + 0x54c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x544]
mov dword [0x100e99cc], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0x184]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x17c]
mov dword [0x100e99d0], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DBT3
call fcn.10001ea0
lea edx, [esp + 0x40c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x404]
mov dword [0x100e99d4], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.DET3
call fcn.10001ea0
lea eax, [esp + 0x18c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x184]
mov dword [0x100e99d8], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x600]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x5f8]
mov dword [0x100e99dc], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.PolicyEndTime
call fcn.10001ea0
lea edx, [esp + 0x194]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x18c]
mov dword [0x100e99e0], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x410]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x40c]
mov dword [0x100e9bfc], eax
call fcn.100018d0
cmp dword [0x100e9bfc], edi
je 0x10011e3f
push 0x10045170
call fcn.10009a60
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [0x100e9c00], edi
jmp 0x10011e50
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Kind
call fcn.10001ea0
lea ecx, [esp + 0x198]
push ecx
mov ecx, ebx
call fcn.10001a90
mov edi, dword [eax]
mov eax, str.ProcList
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10011e97
test cl, cl
je 0x10011e93
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10011e97
add eax, 2
add edi, 2
test cl, cl
jne 0x10011e77
xor eax, eax
jmp 0x10011e9c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x194]
sete byte [esp + 0x1f]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10011ec6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x1f], 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
je 0x100123da
push str.UpRegionService
call fcn.10001ea0
lea ecx, [esp + 0x550]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x54c]
mov dword [0x100f21a8], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.WriteLocalFile
call fcn.10001ea0
lea edx, [esp + 0x1a0]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x19c]
mov dword [0x100f21ac], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UpRegionService
call fcn.10001ea0
lea eax, [esp + 0x418]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x414]
mov dword [0x100e99ec], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.WriteLocalFile
call fcn.10001ea0
lea ecx, [esp + 0x1a8]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1a4]
mov dword [0x100e99f0], eax
call fcn.100018d0
push 0x3e4
push ecx
mov edx, 0x3b
mov ecx, esp
mov dword [esp + 0x20], esp
push str.ValidProc
mov word [0x100f151c], dx
call fcn.10001ea0
lea eax, [esp + 0x5f4]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f151c
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0x5ec]
call fcn.100018d0
mov eax, 0x100f151c
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012016
sub eax, edi
cmp byte [eax + 0x100f151b], 0x3b
je 0x10012042
mov edi, 0x100f151c
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10012030
mov cx, word [0x10043808]
mov word [edi], cx
push 0x100f151c
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ValidMode
call fcn.10001ea0
lea edx, [esp + 0x1b0]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1ac]
mov dword [0x100f1968], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditMode
call fcn.10001ea0
lea eax, [esp + 0x420]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100f1970
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100120b0
lea ecx, [esp + 0x41c]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditValidMode
call fcn.10001ea0
lea ecx, [esp + 0x1b8]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1b4]
mov dword [0x100f196c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditExtMode
call fcn.10001ea0
lea edx, [esp + 0x558]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x554]
mov dword [0x100f1984], eax
call fcn.100018d0
cmp byte [0x100f1988], 0x2e
je 0x10012152
mov eax, 0x2e
mov word [0x100f1988], ax
push 0x1fe
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.ExtensionFilter
call fcn.10001ea0
lea ecx, [esp + 0x1c4]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f1988
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0x1bc]
call fcn.100018d0
push 0x100f1988
call fcn.10028a08
mov eax, 0x100f1988
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100121a8
sub eax, edx
cmp byte [eax + 0x100f1987], 0x2e
je 0x100121d2
mov edi, 0x100f1988
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100121c0
mov dx, word [0x100443b8]
mov word [edi], dx
push 5
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.BackupMode
call fcn.10001ea0
lea eax, [esp + 0x42c]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f1b90
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x424]
call fcn.100018d0
push 0x1fe
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.BackupExtension
call fcn.10001ea0
lea ecx, [esp + 0x1cc]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f1b95
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x1c4]
call fcn.100018d0
mov eax, 0x100f1b95
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012260
sub eax, edi
cmp byte [eax + 0x100f1b94], 0x2e
je 0x1001228a
mov edi, 0x100f1b95
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10012278
mov dx, word [0x100443b8]
mov word [edi], dx
push 0x100f1b95
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UsingProtect
call fcn.10001ea0
lea eax, [esp + 0x630]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x62c]
mov dword [0x100f197c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.UsingAudit
call fcn.10001ea0
lea ecx, [esp + 0x1d0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1cc]
mov dword [0x100f1980], eax
call fcn.100018d0
push 0x1fc
push ecx
mov edx, 0x3b
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AuditIgnorePath
mov word [0x100f1d9d], dx
call fcn.10001ea0
lea eax, [esp + 0x434]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f1d9d
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0x42c]
call fcn.100018d0
mov eax, 0x100f1d9d
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012360
sub eax, edi
cmp byte [eax + 0x100f1d9c], 0x3b
je 0x1001238a
mov edi, 0x100f1d9d
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10012378
mov cx, word [0x10043808]
mov word [edi], cx
push 0x100f1d9d
call fcn.10028a08
add esp, 4
push 5
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AuditModeEx
call fcn.10001ea0
lea edx, [esp + 0x1dc]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f1f9d
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x1d4]
call fcn.100018d0
jmp 0x10012ddd
push str.Kind
call fcn.10001ea0
lea eax, [esp + 0x560]
push eax
mov ecx, ebx
call fcn.10001a90
mov edi, dword [eax]
mov eax, str.FileList
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10012420
test cl, cl
je 0x1001241c
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10012420
add eax, 2
add edi, 2
test cl, cl
jne 0x10012400
xor eax, eax
jmp 0x10012425
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x55c]
sete byte [esp + 0x1f]
call fcn.100018d0
cmp byte [esp + 0x1f], 0
je 0x10012ce8
push 0x208
lea ecx, [esp + 0x1d00]
push ecx
call esi
lea edx, [esp + 0x1cfc]
push edx
call fcn.10028a08
add esp, 4
push 0x208
lea eax, [esp + 0x1af8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x1af4]
push ecx
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.FilePath
call fcn.10001ea0
lea edx, [esp + 0x1e0]
push edx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
lea edx, [esp + 0x12d4]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100124b0
lea ecx, [esp + 0x1dc]
call fcn.100018d0
lea eax, [esp + 0x12d4]
push eax
call fcn.10028a08
add esp, 4
lea ecx, [esp + 0x20]
call fcn.100018a0
lea ecx, [esp + 0x12d4]
push str._WINDIR__
push ecx
mov byte [esp + 0x2ae8], 8
call fcn.10027f00
add esp, 8
test eax, eax
je 0x1001264d
push 0x208
lea edx, [esp + 0x18f0]
push edx
call esi
lea eax, [esp + 0x12dc]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012520
lea edi, [esp + 0x18ec]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012531
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisenableMode
call fcn.10001ea0
lea eax, [esp + 0x438]
push eax
mov ecx, ebx
call fcn.10001a90
mov edx, dword [eax]
mov eax, dword [0x100e9c00]
imul eax, eax, 0x208
add eax, 0x100e9c04
lea esp, [esp]
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x10012580
lea ecx, [esp + 0x434]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ProtectPathExtensionFilter
call fcn.10001ea0
lea ecx, [esp + 0x1e8]
push ecx
mov ecx, ebx
call fcn.10001a90
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x2ae4], 9
call fcn.10001a30
lea ecx, [esp + 0x1e4]
mov byte [esp + 0x2ae0], 8
call fcn.100018d0
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], 0
je 0x100125fd
mov eax, dword [0x100e9c00]
imul eax, eax, 0x64
add eax, 0x100f0194
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x100125f3
mov edx, dword [0x100e9c00]
imul edx, edx, 0x208
lea eax, [esp + 0x18ec]
mov byte [edx + 0x100e9c07], 0
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012620
mov edi, dword [0x100e9c00]
imul edi, edi, 0x208
add edi, 0x100e9c04
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012640
jmp 0x10012868
lea edi, [esp + 0x1af4]
lea eax, [esp + 0x12d4]
jmp 0x10012660
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10012680
test cl, cl
je 0x1001267c
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10012680
add eax, 2
add edi, 2
test cl, cl
jne 0x10012660
xor eax, eax
jmp 0x10012685
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10012c6b
lea edi, [esp + 0x1cfc]
lea eax, [esp + 0x12d4]
jmp 0x100126a0
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100126c0
test cl, cl
je 0x100126bc
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100126c0
add eax, 2
add edi, 2
test cl, cl
jne 0x100126a0
xor eax, eax
jmp 0x100126c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10012c6b
lea ecx, [esp + 0x12d4]
push str._PROGRAMFILES__
push ecx
call fcn.10027f00
add esp, 8
test eax, eax
je 0x10012982
push 0x208
lea edx, [esp + 0x16e8]
push edx
call esi
lea eax, [esp + 0x16e4]
mov byte [esp + 0x16e7], 0
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10012710
mov ecx, dword [str.Program_Files]
mov edx, dword [0x10045048]
mov dword [eax], ecx
mov ecx, dword [0x1004504c]
mov dword [eax + 4], edx
mov dx, word [0x10045050]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x12e2]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012746
lea edi, [esp + 0x16e4]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012757
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisenableMode
call fcn.10001ea0
lea eax, [esp + 0x5f8]
push eax
mov ecx, ebx
call fcn.10001a90
mov edx, dword [eax]
mov eax, dword [0x100e9c00]
imul eax, eax, 0x208
add eax, 0x100e9c04
nop
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x100127a0
lea ecx, [esp + 0x5f4]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ProtectPathExtensionFilter
call fcn.10001ea0
lea ecx, [esp + 0x1f0]
push ecx
mov ecx, ebx
call fcn.10001a90
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x2ae4], 0xa
call fcn.10001a30
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x2ae0], 8
call fcn.100018d0
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], 0
je 0x1001281d
mov eax, dword [0x100e9c00]
imul eax, eax, 0x64
add eax, 0x100f0194
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x10012813
mov edx, dword [0x100e9c00]
imul edx, edx, 0x208
lea eax, [esp + 0x16e4]
mov byte [edx + 0x100e9c07], 0
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012840
mov edi, dword [0x100e9c00]
imul edi, edi, 0x208
add edi, 0x100e9c04
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012860
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x100e9c00]
imul eax, eax, 0x208
mov byte [eax + 0x100e9df8], 0
mov ecx, dword [0x100e9c00]
mov eax, ecx
imul eax, eax, 0x208
cmp byte [eax + 0x100e9c04], 0
je 0x10012c85
cmp byte [eax + 0x100e9c07], 0
je 0x10012c85
inc ecx
cmp ecx, 0x31
mov dword [0x100e9c00], ecx
jle 0x10012c85
lea ecx, [esp + 0x20]
mov byte [esp + 0x2ae0], 0
call fcn.100018d0
xor ebp, ebp
cmp dword [0x100e9c00], ebp
jle 0x100180c4
mov esi, 0x100e9c04
or ebx, 0xffffffff
push esi
call fcn.10028a08
push esi
call fcn.10009a60
push 0x100443b8
push esi
call fcn.10027f00
add esp, 0x10
test eax, eax
jne 0x10012964
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012910
sub eax, edx
cmp byte [ebx + eax + 0x100e9c04], 0x20
lea ecx, [ebx + eax + 0x100e9c04]
jne 0x1001293b
lea eax, [esi + eax - 1]
mov edi, edi
dec eax
mov byte [ecx], 0
cmp byte [eax], 0x20
mov ecx, eax
je 0x10012930
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012940
sub eax, edx
cmp byte [esi + eax - 1], 0x5c
je 0x10012964
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10012953
mov ax, word [0x10043700]
mov word [edi], ax
inc ebp
add ebx, 0x208
add esi, 0x208
cmp ebp, dword [0x100e9c00]
jl 0x100128e7
jmp 0x100180c4
lea ecx, [esp + 0x12d4]
push str._SHAREFOLDER_
push ecx
call fcn.10027f00
add esp, 8
test eax, eax
je 0x10012b2f
mov ecx, dword [esp + 0x34]
push 0x208
push 0x100f6d30
call fcn.10004000
mov dword [0x100fd2c0], eax
mov dword [esp + 0x18], 0
test eax, eax
jle 0x10012c85
mov dword [esp + 0x2c], 0x100f6d30
nop
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisenableMode
call fcn.10001ea0
lea edx, [esp + 0x440]
push edx
mov ecx, ebx
call fcn.10001a90
mov edx, dword [eax]
mov eax, dword [0x100e9c00]
imul eax, eax, 0x208
add eax, 0x100e9c04
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x10012a02
lea ecx, [esp + 0x43c]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ProtectPathExtensionFilter
call fcn.10001ea0
lea eax, [esp + 0x1f8]
push eax
mov ecx, ebx
call fcn.10001a90
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x2ae4], 0xb
call fcn.10001a30
lea ecx, [esp + 0x1f4]
mov byte [esp + 0x2ae0], 8
call fcn.100018d0
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], 0
je 0x10012a7f
mov eax, dword [0x100e9c00]
imul eax, eax, 0x64
add eax, 0x100f0194
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x10012a75
mov ecx, dword [0x100e9c00]
mov eax, dword [esp + 0x2c]
imul ecx, ecx, 0x208
mov byte [ecx + 0x100e9c07], 0
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012a98
mov edi, dword [0x100e9c00]
imul edi, edi, 0x208
add edi, 0x100e9c04
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012ab4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x100e9c00]
imul edx, edx, 0x208
mov byte [edx + 0x100e9df8], 0
mov ecx, dword [0x100e9c00]
mov eax, ecx
imul eax, eax, 0x208
cmp byte [eax + 0x100e9c04], 0
je 0x10012b0d
cmp byte [eax + 0x100e9c07], 0
je 0x10012b0d
inc ecx
cmp ecx, 0x31
mov dword [0x100e9c00], ecx
jg 0x10012c85
mov eax, dword [esp + 0x18]
add dword [esp + 0x2c], 0x208
inc eax
cmp eax, dword [0x100fd2c0]
mov dword [esp + 0x18], eax
jl 0x100129d0
jmp 0x10012c85
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisenableMode
call fcn.10001ea0
lea eax, [esp + 0x568]
push eax
mov ecx, ebx
call fcn.10001a90
mov edx, dword [eax]
mov eax, dword [0x100e9c00]
imul eax, eax, 0x208
add eax, 0x100e9c04
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x10012b61
lea ecx, [esp + 0x564]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ProtectPathExtensionFilter
call fcn.10001ea0
lea ecx, [esp + 0x200]
push ecx
mov ecx, ebx
call fcn.10001a90
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x2ae4], 0xc
call fcn.10001a30
lea ecx, [esp + 0x1fc]
mov byte [esp + 0x2ae0], 8
call fcn.100018d0
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], 0
je 0x10012bde
mov eax, dword [0x100e9c00]
imul eax, eax, 0x64
add eax, 0x100f0194
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x10012bd4
mov edx, dword [0x100e9c00]
imul edx, edx, 0x208
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FilePath
mov byte [edx + 0x100e9c07], 0
call fcn.10001ea0
lea eax, [esp + 0x448]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012c15
mov edi, dword [0x100e9c00]
imul edi, edi, 0x208
add edi, 0x100e9c04
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012c31
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x444]
call fcn.100018d0
mov ecx, dword [0x100e9c00]
imul ecx, ecx, 0x208
mov byte [ecx + 0x100e9df8], 0
jmp 0x10012888
push 0x1004501c
call fcn.10009a60
lea edx, [esp + 0x12d8]
push edx
call fcn.10009a60
add esp, 8
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.CopyMode
call fcn.10001ea0
lea eax, [esp + 0x20c]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov ecx, dword [0x100e9c00]
push eax
lea edx, [ecx*2 + 0x100f1902]
push edx
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x204]
call fcn.100018d0
lea ecx, [esp + 0x20]
mov byte [esp + 0x2ae0], 0
call fcn.100018d0
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10012ddd
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Kind
call fcn.10001ea0
lea eax, [esp + 0x618]
push eax
mov ecx, ebx
call fcn.10001a90
mov edi, dword [eax]
mov eax, str.AllDisk
nop
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10012d30
test cl, cl
je 0x10012d2c
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10012d30
add eax, 2
add edi, 2
test cl, cl
jne 0x10012d10
xor eax, eax
jmp 0x10012d35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x614]
sete byte [esp + 0x1f]
call fcn.100018d0
cmp byte [esp + 0x1f], 0
je 0x10012ddd
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DeleteMark
call fcn.10001ea0
lea ecx, [esp + 0x210]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x20c]
mov dword [0x100f1fa4], eax
call fcn.100018d0
push 0x1fe
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AuditExtension
call fcn.10001ea0
lea edx, [esp + 0x454]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100f1fa8
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x44c]
call fcn.100018d0
push 0x100f1fa8
call fcn.10028a08
add esp, 4
mov ecx, ebp
call fcn.10001c40
mov ebx, eax
test ebx, ebx
jne 0x10011e50
jmp 0x100128d1
lea ecx, [esp + 0x24]
push 0x10043af4
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x1001326e
push 0x10044fc8
call fcn.10009a60
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
call fcn.10001ea0
lea edx, [esp + 0x218]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10052460
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10012e50
lea ecx, [esp + 0x214]
call fcn.100018d0
mov ecx, ebp
call fcn.10001f60
push 0x404
push edi
push 0x100e94a0
mov dword [0x10131e14], eax
call fcn.10027470
push 0x48
push edi
push 0x100e9458
call fcn.10027470
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea eax, [esp + 0x570]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x56c]
mov dword [0x100e989c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea ecx, [esp + 0x220]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x21c]
mov dword [0x100e98a0], eax
call fcn.100018d0
mov edx, dword [0x10131e14]
mov dword [0x100e94a0], edx
xor eax, eax
jmp 0x10012f20
mov cl, byte [eax + 0x10052460]
mov byte [eax + 0x100e94a4], cl
inc eax
test cl, cl
jne 0x10012f20
xor eax, eax
mov cl, byte [eax + 0x100c3108]
mov byte [eax + 0x100e959e], cl
inc eax
test cl, cl
jne 0x10012f33
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ProcName
call fcn.10001ea0
lea eax, [esp + 0x458]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100e96a8
jmp 0x10012f70
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10012f70
lea ecx, [esp + 0x454]
call fcn.100018d0
push 0x100e96a8
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x228]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x224]
mov dword [0x100e96a4], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea edx, [esp + 0x600]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x5fc]
mov dword [0x100e949c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea eax, [esp + 0x230]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov ecx, 0x100e9458
mov edi, edi
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x10013030
lea ecx, [esp + 0x22c]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x460]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x45c]
mov dword [0x100e9498], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea edx, [esp + 0x23c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x234]
mov dword [0x100e9478], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea eax, [esp + 0x57c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x574]
mov dword [0x100e947c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea ecx, [esp + 0x244]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x23c]
mov dword [0x100e9480], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea edx, [esp + 0x46c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x464]
mov dword [0x100e9484], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea eax, [esp + 0x24c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x244]
mov dword [0x100e9488], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea ecx, [esp + 0x62c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x624]
mov dword [0x100e948c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea edx, [esp + 0x254]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x24c]
mov dword [0x100e9490], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea eax, [esp + 0x474]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x100e9494], eax
lea ecx, [esp + 0x46c]
jmp 0x100180bf
lea ecx, [esp + 0x24]
push 0x10043b50
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x10013822
push 0x10044f98
call fcn.10009a60
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
call fcn.10001ea0
lea edx, [esp + 0x258]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10052460
jmp 0x100132d0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100132d0
lea ecx, [esp + 0x254]
call fcn.100018d0
mov ecx, ebp
call fcn.10001f60
push 0x9f0
push edi
push 0x100e8a68
mov dword [0x10131e14], eax
call fcn.10027470
push 0x48
push edi
push 0x100e8a20
call fcn.10027470
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea eax, [esp + 0x580]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x57c]
mov dword [0x100e9450], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea ecx, [esp + 0x260]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x25c]
mov dword [0x100e9454], eax
call fcn.100018d0
mov edx, dword [0x10131e14]
mov dword [0x100e8a68], edx
xor eax, eax
jmp 0x100133a0
mov cl, byte [eax + 0x10052460]
mov byte [eax + 0x100e8a6c], cl
inc eax
test cl, cl
jne 0x100133a0
xor eax, eax
mov cl, byte [eax + 0x100c3108]
mov byte [eax + 0x100e8b66], cl
inc eax
test cl, cl
jne 0x100133b3
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ExecptProcessName
call fcn.10001ea0
lea eax, [esp + 0x478]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100e8c80
jmp 0x100133f0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100133f0
lea ecx, [esp + 0x474]
call fcn.100018d0
push 0x100e8c80
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ExecptFileName
call fcn.10001ea0
lea ecx, [esp + 0x268]
push ecx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100e9068
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10013436
lea ecx, [esp + 0x264]
call fcn.100018d0
push 0x100e9068
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisableAddRegRun
call fcn.10001ea0
lea edx, [esp + 0x608]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x604]
mov dword [0x100e8c70], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisableAddRegServices
call fcn.10001ea0
lea eax, [esp + 0x270]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x26c]
mov dword [0x100e8c74], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisableAddProgramRun
call fcn.10001ea0
lea ecx, [esp + 0x480]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x47c]
mov dword [0x100e8c78], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisableAddProgramLink
call fcn.10001ea0
lea edx, [esp + 0x278]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x274]
mov dword [0x100e8c7c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x588]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
mov dword [0x100e8c6c], eax
lea ecx, [esp + 0x584]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x280]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x27c]
mov dword [0x100e8a64], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea edx, [esp + 0x488]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov ecx, 0x100e8a20
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x100135e4
lea ecx, [esp + 0x484]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x288]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x284]
mov dword [0x100e8a60], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0x624]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x61c]
mov dword [0x100e8a40], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea edx, [esp + 0x294]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x28c]
mov dword [0x100e8a44], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea eax, [esp + 0x494]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x48c]
mov dword [0x100e8a48], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0x29c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x294]
mov dword [0x100e8a4c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea edx, [esp + 0x594]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x58c]
mov dword [0x100e8a50], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea eax, [esp + 0x2a4]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x29c]
mov dword [0x100e8a54], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x49c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x494]
mov dword [0x100e8a58], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea edx, [esp + 0x2ac]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x100e8a5c], eax
lea ecx, [esp + 0x2a4]
jmp 0x100180bf
lea eax, [esp + 0x24]
push 0x10043b68
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x10013e32
push 0x10044ef4
call fcn.10009a60
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
call fcn.10001ea0
lea ecx, [esp + 0x5e8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10052460
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10013880
lea ecx, [esp + 0x5e4]
call fcn.100018d0
mov ecx, ebp
call fcn.10001f60
push 0x29a0
mov dword [0x10131e14], eax
call fcn.1001b1cc
mov edi, eax
add esp, 4
test edi, edi
je 0x100180c4
push 0x2958
push 0
push edi
call fcn.10027470
push 0x48
lea eax, [edi + 0x2958]
push 0
push eax
call fcn.10027470
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea edx, [esp + 0x2b0]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2ac]
mov dword [edi + 0x2950], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea eax, [esp + 0x4a0]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x49c]
mov dword [edi + 0x2954], eax
call fcn.100018d0
mov ecx, dword [0x10131e14]
mov eax, 0x10052460
mov edx, edi
sub edx, eax
mov dword [edi], ecx
add edx, 4
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10013966
mov eax, 0x100c3108
mov ecx, edi
sub ecx, eax
lea edx, [ecx + 0xfe]
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10013980
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WEBList
call fcn.10001ea0
lea edx, [esp + 0x34]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], 0x1f40
mov byte [esp + 0x2ae0], 0xd
jle 0x100139f8
push 0x1f3e
lea ecx, [esp + 0x2b8]
push ecx
lea ecx, [esp + 0x38]
call fcn.10005ec0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2ae4], 0xe
call fcn.10001a30
lea ecx, [esp + 0x2b4]
mov byte [esp + 0x2ae0], 0xd
call fcn.100018d0
mov ecx, dword [esp + 0x30]
lea esi, [edi + 0x20c]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10013a04
push esi
call fcn.10028a08
mov ecx, dword [esp + 0x38]
add esp, 4
push esi
call fcn.100032d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AccessMode
call fcn.10001ea0
lea edx, [esp + 0x598]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x594]
mov dword [edi + 0x208], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FindBlackWebPromt
call fcn.10001ea0
lea eax, [esp + 0x2c0]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2bc]
mov dword [edi + 0x214c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FindBlackWebPromtInfo
call fcn.10001ea0
lea ecx, [esp + 0x4a8]
push ecx
mov ecx, ebx
call fcn.10001a90
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2ae4], 0xf
call fcn.10001a30
lea ecx, [esp + 0x4a4]
mov byte [esp + 0x2ae0], 0xd
call fcn.100018d0
mov edx, dword [esp + 0x30]
cmp dword [edx - 0xc], 0x7ff
jle 0x10013b0a
push 0x7fe
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
call fcn.10005ec0
lea ecx, [esp + 0x18]
call fcn.100018d0
mov ecx, dword [esp + 0x30]
lea edx, [edi + 0x2150]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10013b14
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x2c8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2c4]
mov dword [edi + 0x204], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea edx, [esp + 0x5ec]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x5e8]
mov dword [edi + 0x299c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea eax, [esp + 0x2d0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
lea ecx, [edi + 0x2958]
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x10013bc0
lea ecx, [esp + 0x2cc]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x4b0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x4ac]
mov dword [edi + 0x2998], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea edx, [esp + 0x2dc]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2d4]
mov dword [edi + 0x2978], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea eax, [esp + 0x5a4]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x59c]
mov dword [edi + 0x297c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea ecx, [esp + 0x2e4]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2dc]
mov dword [edi + 0x2980], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea edx, [esp + 0x4bc]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x4b4]
mov dword [edi + 0x2984], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea eax, [esp + 0x2ec]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2e4]
mov dword [edi + 0x2988], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea ecx, [esp + 0x5f8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x5f0]
mov dword [edi + 0x298c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea edx, [esp + 0x2f4]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x2ec]
mov dword [edi + 0x2990], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea eax, [esp + 0x4c4]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x4bc]
mov dword [edi + 0x2994], eax
call fcn.100018d0
push edi
mov ecx, 0x10131e18
call fcn.100051a0
push 0x29a0
push edi
push 0x100e6080
call fcn.10029ac0
add esp, 0xc
lea ecx, [esp + 0x30]
jmp 0x100180bf
lea ecx, [esp + 0x24]
push str.INTERNET_MONITOR_AUDIT
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x100143cd
push 0x1c174
push edi
push 0x100c6640
call fcn.10027470
add esp, 8
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0x2f8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2f4]
mov dword [0x100c6844], eax
call fcn.100018d0
cmp dword [0x100c6844], edi
je 0x10013eaf
push str.HttpAccessMainPolicy_New_policy__is_run
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.OtherState
call fcn.10001ea0
lea eax, [esp + 0x5a8]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x5a4]
mov dword [0x100c6848], eax
call fcn.100018d0
cmp dword [0x100c6848], edi
je 0x10013f00
push str.HttpAccessMainPolicy_New_OtherState__is_run
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.OtherAudit
call fcn.10001ea0
lea ecx, [esp + 0x300]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2fc]
mov dword [0x100c684c], eax
call fcn.100018d0
cmp dword [0x100c684c], edi
je 0x10013f51
push str.HttpAccessMainPolicy_New_OtherAudit__is_run
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Prompt
call fcn.10001ea0
lea edx, [esp + 0x4c8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x4c4]
mov dword [0x100c6850], eax
call fcn.100018d0
cmp dword [0x100c6850], edi
je 0x10013fa2
push str.HttpAccessMainPolicy_New_Prompt__is_run
call fcn.10009a60
add esp, 4
mov eax, dword [0x100c684c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x100e27ac], eax
call fcn.10001ea0
lea ecx, [esp + 0x308]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100c6644
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10013fd3
lea ecx, [esp + 0x304]
call fcn.100018d0
xor eax, eax
jmp 0x10013ff0
mov cl, byte [eax + 0x100c3108]
mov byte [eax + 0x100c673e], cl
inc eax
test cl, cl
jne 0x10013ff0
cmp dword [0x100c6850], edi
je 0x10014084
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PromptInfo
call fcn.10001ea0
lea edx, [esp + 0x5e4]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov edi, dword [eax - 0xc]
lea ecx, [esp + 0x5e0]
call fcn.100018d0
cmp edi, 0x208
jle 0x10014047
mov edi, 0x207
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PromptInfo
call fcn.10001ea0
lea ecx, [esp + 0x314]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100c6854
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x30c]
call fcn.100018d0
lea ecx, [esp + 0x6dc]
call fcn.10006240
mov byte [esp + 0x2ae0], 0x10
mov edi, 0x100c6a64
cmp edi, 0x100e80c4
jge 0x100143bc
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Type
call fcn.10001ea0
lea edx, [esp + 0x318]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
or dword [esp + 0x20], 2
push eax
push str.Site
mov byte [esp + 0x2ae8], 0x11
call fcn.100302af
add esp, 8
test eax, eax
je 0x10014128
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Type
call fcn.10001ea0
lea eax, [esp + 0x4d0]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
or dword [esp + 0x20], 4
push eax
push str.group
call fcn.100302af
add esp, 8
mov byte [esp + 0x1f], 0
test eax, eax
jne 0x1001412d
mov byte [esp + 0x1f], 1
test byte [esp + 0x20], 4
je 0x10014145
and dword [esp + 0x20], 0xfffffffb
lea ecx, [esp + 0x4cc]
call fcn.100018d0
test byte [esp + 0x20], 2
mov dword [esp + 0x2ae0], 0x10
je 0x10014168
and dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x314]
call fcn.100018d0
cmp byte [esp + 0x1f], 0
je 0x100143ab
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Name
call fcn.10001ea0
lea ecx, [esp + 0x5b0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov edx, dword [eax]
mov esi, dword [edx - 0xc]
lea ecx, [esp + 0x5ac]
call fcn.100018d0
cmp esi, 0x64
mov dword [edi - 8], 1
jle 0x100141b5
mov esi, 0x63
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Name
call fcn.10001ea0
lea eax, [esp + 0x324]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push edi
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x31c]
call fcn.100018d0
push edi
lea ecx, [esp + 0x6e0]
call fcn.10007280
push 0
push 0x100436dc
lea ecx, [esp + 0x6e4]
call fcn.10004c20
mov esi, eax
cmp esi, 0xffffffff
je 0x100142e9
lea ecx, [esi - 1]
push ecx
lea ecx, [esp + 0x6e0]
call fcn.10004200
movsx edx, byte [eax]
push edx
call fcn.1002b0b5
add esp, 4
test eax, eax
je 0x100142e9
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x6e0]
mov dword [esp + 0x1c], eax
call fcn.10004200
movsx eax, byte [eax]
push eax
call fcn.1002b0b5
add esp, 4
test eax, eax
je 0x100142e9
push 0xc8
push 0
push edi
call fcn.10027470
add esp, 0xc
push esi
push 0
lea ecx, [esp + 0x658]
push ecx
lea ecx, [esp + 0x6e8]
call fcn.10007ff0
mov ecx, eax
call fcn.10004820
mov edx, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x10014295
lea ecx, [esp + 0x650]
call fcn.10006260
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push edx
lea eax, [esp + 0x690]
push eax
lea ecx, [esp + 0x6e8]
call fcn.10007ff0
mov ecx, eax
call fcn.10004820
lea edx, [edi + 0xc8]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x100142d3
lea ecx, [esp + 0x688]
call fcn.10006260
push edi
call fcn.10028a08
push edi
call fcn.10009a60
add esp, 4
mov ecx, esp
mov dword [esp + 0x18], esp
push str.State
call fcn.10001ea0
lea ecx, [esp + 0x4d8]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x4d4]
mov byte [edi - 3], al
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Audit
call fcn.10001ea0
lea edx, [esp + 0x328]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x324]
mov byte [edi - 1], al
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Realm
call fcn.10001ea0
lea eax, [esp + 0x604]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x600]
mov byte [edi - 2], al
call fcn.100018d0
add edi, 0xe4
mov ecx, ebp
call fcn.10001c40
mov ebx, eax
test ebx, ebx
jne 0x1001409d
lea ecx, [esp + 0x6dc]
call fcn.10006260
jmp 0x100180c4
lea ecx, [esp + 0x24]
push str.HTTP_VISITED_CONTROL
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x10014b52
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 8
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
call fcn.10001ea0
lea edx, [esp + 0x330]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10052460
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10014420
lea ecx, [esp + 0x32c]
call fcn.100018d0
mov ecx, ebp
call fcn.10001f60
push 0x38c8
push edi
push 0x100e27b8
mov dword [0x10131e14], eax
call fcn.10027470
push 0x48
push edi
push 0x100c65f8
call fcn.10027470
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea eax, [esp + 0x4e0]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x4dc]
mov dword [0x100e3964], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea ecx, [esp + 0x338]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x334]
mov dword [0x100e3968], eax
call fcn.100018d0
mov edx, dword [0x10131e14]
mov dword [0x100e27b8], edx
xor eax, eax
jmp 0x100144f0
mov cl, byte [eax + 0x10052460]
mov byte [eax + 0x100e27bc], cl
inc eax
test cl, cl
jne 0x100144f0
xor eax, eax
mov cl, byte [eax + 0x100c3108]
mov byte [eax + 0x100e28b6], cl
inc eax
test cl, cl
jne 0x10014503
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WEBList
call fcn.10001ea0
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 0xc]
cmp eax, 0xfa0
mov byte [esp + 0x2ae0], 0x12
jle 0x100145ca
push 0xf9e
lea edx, [esp + 0x5b8]
push edx
lea ecx, [esp + 0x30]
call fcn.10005ec0
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2ae4], 0x13
call fcn.10001a30
lea ecx, [esp + 0x5b4]
mov byte [esp + 0x2ae0], 0x12
call fcn.100018d0
push 0x3b
lea ecx, [esp + 0x2c]
call fcn.100041d0
push eax
lea eax, [esp + 0x340]
push eax
lea ecx, [esp + 0x30]
call fcn.10005ec0
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2ae4], 0x14
call fcn.10001a30
lea ecx, [esp + 0x33c]
mov byte [esp + 0x2ae0], 0x12
call fcn.100018d0
mov ecx, dword [esp + 0x28]
mov edx, 0x100e29c4
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100145d3
push 0x100e29c4
call fcn.10028a08
add esp, 4
push 0x100e29c4
mov ecx, esi
call fcn.100032d0
lea ecx, [esp + 0x28]
call fcn.100017f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.KeyWordList
call fcn.10001ea0
lea ecx, [esp + 0x4e8]
push ecx
mov ecx, ebx
call fcn.10001a90
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2ae4], 0x15
call fcn.10001a30
lea ecx, [esp + 0x4e4]
mov byte [esp + 0x2ae0], 0x12
call fcn.100018d0
mov edx, dword [esp + 0x28]
cmp dword [edx - 0xc], 0x2328
jle 0x100146d5
push 0x2327
lea eax, [esp + 0x348]
push eax
lea ecx, [esp + 0x30]
call fcn.10005ec0
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2ae4], 0x16
call fcn.10001a30
lea ecx, [esp + 0x344]
mov byte [esp + 0x2ae0], 0x12
call fcn.100018d0
push 0x3b
lea ecx, [esp + 0x2c]
call fcn.100041d0
push eax
lea ecx, [esp + 0x60c]
push ecx
lea ecx, [esp + 0x30]
call fcn.10005ec0
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2ae4], 0x17
call fcn.10001a30
lea ecx, [esp + 0x608]
mov byte [esp + 0x2ae0], 0x12
call fcn.100018d0
mov ecx, dword [esp + 0x28]
mov edx, 0x100e3d58
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100146e0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.KeyWordTipAllow
call fcn.10001ea0
lea edx, [esp + 0x350]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x34c]
mov dword [0x100e396c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.KeyWordTip
call fcn.10001ea0
lea eax, [esp + 0x54]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100e3970
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10014750
lea ecx, [esp + 0x50]
call fcn.100018d0
push 0x100e3d58
call fcn.10009a60
push 0x100e29c4
call fcn.10028a08
push 0x1004381c
push 0x100e29c4
call fcn.10027f00
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1001482e
push 0x7d0
lea ecx, [esp + 0x2308]
push 0
push ecx
call fcn.10027470
mov edx, edi
sub edx, 0x100e29c4
push edx
lea eax, [esp + 0x2314]
push 0x100e29c4
push eax
call fcn.10028df0
lea eax, [edi + 4]
add esp, 0x18
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100147d0
lea edi, [esp + 0x2304]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100147e1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x2304]
mov byte [eax + 0x100e29c4], cl
inc eax
test cl, cl
jne 0x10014800
push 0x1004381c
push 0x100e29c4
call fcn.10027f00
mov edi, eax
add esp, 8
test edi, edi
jne 0x10014793
push 0x100e29c4
call fcn.10009a60
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuditMode
call fcn.10001ea0
lea ecx, [esp + 0x358]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x354]
mov dword [0x100e29c0], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0x5c0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x5bc]
mov dword [0x100e29bc], eax
call fcn.100018d0
cmp dword [0x100e29bc], 0
je 0x100148c5
push 0x10044d6c
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea eax, [esp + 0x360]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x35c]
mov dword [0x100c663c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea ecx, [esp + 0x4f8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100c65f8
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10014928
lea ecx, [esp + 0x4f4]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0x368]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x364]
mov dword [0x100c6638], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea eax, [esp + 0x618]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x610]
mov dword [0x100c6618], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x374]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x36c]
mov dword [0x100c661c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea edx, [esp + 0x5c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x54]
mov dword [0x100c6620], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea eax, [esp + 0x60]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x58]
mov dword [0x100c6624], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x68]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x60]
mov dword [0x100c6628], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea edx, [esp + 0x70]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x68]
mov dword [0x100c662c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea eax, [esp + 0x78]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x70]
mov dword [0x100c6630], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x80]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x78]
mov dword [0x100c6634], eax
call fcn.100018d0
lea ecx, [esp + 0x28]
jmp 0x100180bf
lea edx, [esp + 0x24]
push 0x10043b7c
push edx
call fcn.10004bf0
add esp, 8
test al, al
je 0x10014b8a
push 0x10044d44
call fcn.10009a60
push 0xfa
push edi
push 0x10052460
call fcn.10027470
add esp, 0x10
jmp 0x100180c4
lea eax, [esp + 0x24]
push 0x10043b08
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x10015036
push 0x10044d1c
call fcn.10009a60
push 0x5cec
push edi
push 0x100fd3d8
call fcn.10027470
push 0x14c
push edi
push 0x101030c8
call fcn.10027470
add esp, 0x1c
mov ecx, ebp
call fcn.10001f60
push 0xfa
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
mov dword [0x100fd3d8], eax
call fcn.10001ea0
lea ecx, [esp + 0x88]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
push 0x100fd3dc
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x80]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0x8c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x88]
mov dword [0x100fd4d8], eax
call fcn.100018d0
push 0x104
lea eax, [esp + 0x14e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [0x100fd4dc], 0xf
jge 0x100180c4
push 0x207
lea ecx, [esp + 0x10d1]
push 0
push ecx
mov byte [esp + 0x10d8], 0
call fcn.10027470
add esp, 0xc
push 0x206
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.WorkFolder
call fcn.10001ea0
lea edx, [esp + 0x98]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
lea eax, [esp + 0x10d4]
push eax
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x90]
call fcn.100018d0
lea eax, [esp + 0x10cc]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014cf0
sub eax, edx
cmp eax, 4
jbe 0x10015020
lea eax, [esp + 0x14dc]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014d10
sub eax, edx
push eax
lea ecx, [esp + 0x14e0]
push ecx
lea edx, [esp + 0x10d4]
push edx
call fcn.1003c2bd
add esp, 0xc
test eax, eax
je 0x10015020
push 0xe
lea eax, [esp + 0x10d2]
push str.Program_files
push eax
call fcn.1003c2bd
add esp, 0xc
test eax, eax
je 0x10015020
lea eax, [esp + 0x10cc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014d63
sub eax, edx
cmp byte [esp + eax + 0x10cb], 0x5c
je 0x10014d92
lea edi, [esp + 0x10cc]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10014d80
mov cx, word [0x10043700]
mov word [edi], cx
cmp dword [0x100fd4dc], 0
jne 0x10014ea1
push 0x207
lea edx, [esp + 0xec9]
push 0
push edx
mov byte [esp + 0xed0], 0
call fcn.10027470
push 0x1fe
lea eax, [esp + 0x10dc]
push eax
lea ecx, [esp + 0xed8]
push ecx
call fcn.10028df0
lea eax, [esp + 0xedc]
add esp, 0x18
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014de0
mov edx, dword [str.temp]
mov cl, byte [0x10044cfc]
mov dword [eax], edx
lea edx, [esp + 0xec4]
push 0
push edx
mov byte [eax + 4], cl
call fcn.1002a3a0
add esp, 8
test eax, eax
je 0x10014e49
push 0
lea eax, [esp + 0xec8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [esp + 0xec4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10014e27
mov ecx, dword [0x10044cf4]
push 0
lea edx, [esp + 0xec8]
push edx
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x10014ea1
lea edi, [esp + 0xec4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10014e51
mov eax, dword [0x10044cf4]
push 0
lea ecx, [esp + 0xec8]
push ecx
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0xec4]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014e80
sub eax, edx
lea edx, [esp + 0xec4]
mov byte [esp + eax + 0xec1], cl
mov ecx, dword [esp + 0x34]
push edx
call fcn.100030b0
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x10cc]
push eax
call fcn.10002eb0
lea eax, [esp + 0x10cc]
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014ec0
mov ecx, dword [0x100fd4dc]
imul ecx, ecx, 0x410
push 0x410
add ecx, 0x100fd558
push ecx
sub eax, edi
push eax
lea edx, [esp + 0x10d8]
push edx
push 0
push 0
call esi
push 0x1ff
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.FolderAllowProc
call fcn.10001ea0
lea eax, [esp + 0xa0]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [0x100fd4dc]
mov eax, dword [eax]
imul ecx, ecx, 0x208
push eax
add ecx, 0x10101248
push ecx
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x98]
call fcn.100018d0
mov edx, dword [0x100fd4dc]
imul edx, edx, 0x208
add edx, 0x10101248
push edx
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AllowProcOutside
call fcn.10001ea0
lea eax, [esp + 0xa4]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov ecx, dword [0x100fd4dc]
mov dword [ecx*4 + 0x100fd4e0], eax
add esp, 4
lea ecx, [esp + 0xa0]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.OtherProcOperaterWorkFolder
call fcn.10001ea0
lea edx, [esp + 0xac]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
mov ecx, dword [0x100fd4dc]
mov dword [ecx*4 + 0x100fd51c], eax
add esp, 4
lea ecx, [esp + 0xa8]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AllowCopyWorkFolderFileToUsbStorage
call fcn.10001ea0
lea edx, [esp + 0xb4]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xb0]
mov dword [0x101030c0], eax
call fcn.100018d0
inc dword [0x100fd4dc]
mov ecx, ebp
call fcn.10001c40
mov ebx, eax
test ebx, ebx
jne 0x10014c73
jmp 0x100180c4
lea eax, [esp + 0x24]
push str.UDISK_WRITEONLY_CONTROL
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x1001535d
push 0x10c
push edi
push 0x100c64e8
call fcn.10027470
push 0x144
push edi
push 0x100c63a0
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push 0xfa
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
mov dword [0x100c64e8], eax
call fcn.10001ea0
lea ecx, [esp + 0xc0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
push 0x100c64ec
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0xb8]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0xc4]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xc0]
mov dword [0x100c65e8], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisabledCopyFileFromUDisk
call fcn.10001ea0
lea eax, [esp + 0xcc]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0xc8]
mov dword [0x100c65ec], eax
call fcn.100018d0
mov eax, dword [0x100c65e8]
mov ecx, dword [0x100c65ec]
mov edx, dword [0x100c64e8]
mov dword [0x100c64bc], eax
mov dword [0x100c65f0], ecx
mov dword [0x100c63a0], edx
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x100c64ec]
mov byte [eax + 0x100c63a4], cl
inc eax
test cl, cl
jne 0x10015160
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0xd8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0xd0]
mov dword [0x100c64c0], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea edx, [esp + 0xe0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0xd8]
mov dword [0x100c64c4], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea eax, [esp + 0xe8]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0xe0]
mov dword [0x100c64c8], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0xf0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0xe8]
mov dword [0x100c64cc], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea edx, [esp + 0xf8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0xf0]
mov dword [0x100c64d0], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea eax, [esp + 0x100]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0xf8]
mov dword [0x100c64d4], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x108]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x100]
mov dword [0x100c64d8], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea edx, [esp + 0x110]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x100c64dc], eax
lea ecx, [esp + 0x108]
jmp 0x100180bf
lea eax, [esp + 0x24]
push str.ANTI_ROGUE_CONTROL
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x10015a43
mov ecx, 0x10131e34
call fcn.100068c0
push 0x3ff
lea ecx, [esp + 0x1f09]
push 0
push ecx
mov byte [esp + 0x1f10], 0
call fcn.10027470
lea edx, [esp + 0x4c]
push edx
call fcn.1000a9b0
push 1
lea eax, [esp + 0x6d4]
push 0x10044c84
push eax
mov byte [esp + 0x2afc], 0x18
call fcn.10009930
mov edi, eax
push 0x10043700
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x134]
push edx
mov byte [esp + 0x2b08], 0x19
call fcn.10007050
add esp, 0x28
mov esi, eax
mov ecx, edi
mov byte [esp + 0x2ae0], 0x1a
call fcn.10004820
push eax
lea eax, [esp + 0x50]
push esi
push eax
call fcn.10007050
add esp, 0xc
lea ecx, [esp + 0x110]
call fcn.100018d0
lea ecx, [esp + 0x6c0]
mov byte [esp + 0x2ae0], 0x1d
call fcn.10006260
push 1
lea ecx, [esp + 0x638]
push str.HostRegMon.ini
push ecx
call fcn.10009930
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x2ae0], 0x1e
call fcn.10004820
push eax
lea ecx, [esp + 0x44]
call fcn.10009050
lea ecx, [esp + 0x634]
mov byte [esp + 0x2ae0], 0x1d
call fcn.10006260
push 0x610
push 0
push 0x100c5d90
call fcn.10027470
push 0x144
push 0
push 0x100c63a0
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push 0xfa
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyName
mov dword [0x100c5d90], eax
call fcn.10001ea0
lea edx, [esp + 0x120]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
push 0x100c5d94
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x118]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x124]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x120]
mov dword [0x100c5e90], eax
call fcn.100018d0
mov ecx, dword [0x100c5d90]
mov edx, dword [0x100c5e90]
mov dword [0x100c5c48], ecx
mov dword [0x100c5d64], edx
xor eax, eax
mov cl, byte [eax + 0x100c5d94]
mov byte [eax + 0x100c5c4c], cl
inc eax
test cl, cl
jne 0x10015533
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea eax, [esp + 0x130]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x128]
mov dword [0x100c5d68], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x138]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x130]
mov dword [0x100c5d6c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea edx, [esp + 0x140]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x138]
mov dword [0x100c5d70], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea eax, [esp + 0x148]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x140]
mov dword [0x100c5d74], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x150]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x148]
mov dword [0x100c5d78], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea edx, [esp + 0x158]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x150]
mov dword [0x100c5d7c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea eax, [esp + 0x160]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x158]
mov dword [0x100c5d80], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x168]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x160]
mov dword [0x100c5d84], eax
call fcn.100018d0
mov esi, dword [esp + 0x34]
push 0xf9
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DefinedBy
call fcn.10001ea0
lea edx, [esp + 0x170]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100c5e98
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x168]
call fcn.100018d0
push str.IERegControl
push 0x100c5e98
call fcn.100302af
add esp, 8
test eax, eax
jne 0x1001588f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IEModifyRegUsed
call fcn.10001ea0
lea eax, [esp + 0x174]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x170]
mov dword [0x100c5f94], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IEModifyRegMode
call fcn.10001ea0
lea ecx, [esp + 0x17c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x178]
mov dword [0x100c5e94], eax
call fcn.100018d0
cmp dword [0x100c5f94], 0
je 0x1001588f
mov edx, dword [esp + 0x40]
push edx
push 0x400
lea eax, [esp + 0x1f0c]
push eax
push 0x10043690
push str.MonitorProc
push str.Global
mov dword [0x100c6398], 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x3fc
lea edx, [esp + 0x1f08]
push edx
mov ecx, 0x3b
push 0x100c5f98
mov word [0x100c5f98], cx
call fcn.10029e30
mov edi, 0x100c5f98
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10015871
mov ax, word [0x10043808]
push 0x100c5f98
mov word [edi], ax
call fcn.10028a08
add esp, 4
push str.IEBHO
push 0x100c5e98
call fcn.100302af
add esp, 8
test eax, eax
jne 0x100159ee
push 0x63
push eax
lea ecx, [esp + 0xe05]
push ecx
mov dword [0x100c639c], 1
mov byte [esp + 0xe08], al
call fcn.10027470
push 0x63
lea edx, [esp + 0xe71]
push 0
push edx
mov byte [esp + 0xe78], 0
call fcn.10027470
add esp, 0x18
lea ecx, [esp + 0x2c]
call fcn.100018a0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Mode
mov byte [esp + 0x2ae8], 0x1f
call fcn.10001ea0
lea eax, [esp + 0x184]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x2ae4], 0x20
call fcn.10001a50
lea ecx, [esp + 0x180]
mov byte [esp + 0x2ae0], 0x1f
call fcn.100018d0
push 0x64
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x10044c0c
call fcn.10001ea0
lea ecx, [esp + 0x190]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
lea edx, [esp + 0xe04]
push edx
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x188]
call fcn.100018d0
push 0x64
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DllName
call fcn.10001ea0
lea eax, [esp + 0x198]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
lea ecx, [esp + 0xe68]
push ecx
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x190]
call fcn.100018d0
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0xe64]
push eax
lea ecx, [esp + 0xe04]
push ecx
mov ecx, esi
call fcn.1000f140
mov byte [esp + 0x2ae0], 0x1d
lea ecx, [esp + 0x2c]
call fcn.100018d0
mov ecx, ebp
call fcn.10001c40
mov ebx, eax
test ebx, ebx
jne 0x10015738
cmp dword [0x100c6398], eax
jne 0x10015a19
cmp dword [0x100c639c], eax
jne 0x10015a19
mov dword [0x100c5e90], eax
mov dword [0x100c5d64], eax
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.100017d0
mov ecx, esi
call fcn.10007c80
lea ecx, [esp + 0x4c]
call fcn.100018d0
lea ecx, [esp + 0x40]
jmp 0x100180bf
lea eax, [esp + 0x24]
push str.UDISK_ACTION_CONTROL
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x1001626e
push str.PolicyClassNameUDISK_ACTION_CONTROL
call fcn.10009a60
push 0xc20
push edi
push 0x100c5028
call fcn.10027470
push 0x1e14
push edi
push 0x100c3210
call fcn.10027470
add esp, 0x1c
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x100c3210], eax
call fcn.10001ea0
lea ecx, [esp + 0x19c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x100c3214
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10015ac0
lea ecx, [esp + 0x198]
call fcn.100018d0
mov edx, dword [0x100c3210]
mov dword [0x100c502c], edx
xor eax, eax
jmp 0x10015af0
mov cl, byte [eax + 0x100c3214]
mov byte [eax + 0x100c5030], cl
inc eax
test cl, cl
jne 0x10015af0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuditCopyIn
call fcn.10001ea0
lea eax, [esp + 0x1a4]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1a0]
mov dword [0x100c512c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InFileExtName
call fcn.10001ea0
lea ecx, [esp + 0x1ac]
push ecx
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100c5130
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10015b64
lea ecx, [esp + 0x1a8]
call fcn.100018d0
push 0x100c5130
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuditCopyOut
call fcn.10001ea0
lea edx, [esp + 0x1b4]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1b0]
mov dword [0x100c5450], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.OutFileExtName
call fcn.10001ea0
lea eax, [esp + 0x1bc]
push eax
mov ecx, ebx
call fcn.10001a90
mov ecx, dword [eax]
mov edx, 0x100c52c0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10015be6
lea ecx, [esp + 0x1b8]
call fcn.100018d0
push 0x100c52c0
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuditCopyOut
call fcn.10001ea0
lea ecx, [esp + 0x1c4]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1c0]
mov dword [0x100c5450], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisableUdiskRunApp
call fcn.10001ea0
lea edx, [esp + 0x1cc]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1c8]
mov dword [0x100c5454], eax
call fcn.100018d0
cmp dword [0x100c5454], edi
je 0x10015c92
push 0x10044b44
call fcn.10009a60
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea eax, [esp + 0x1d4]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1d0]
mov dword [0x100c3c04], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea ecx, [esp + 0x1dc]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1d8]
mov dword [0x100c3c08], eax
call fcn.100018d0
mov edx, dword [0x100c3c04]
mov eax, dword [0x100c3c08]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.BackupCopyOrCutFileToUDisk
mov dword [0x100c5458], edx
mov dword [0x100c545c], eax
call fcn.10001ea0
lea ecx, [esp + 0x1e4]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1e0]
mov dword [0x100c5468], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0x1ec]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1e8]
mov dword [0x100c5028], eax
call fcn.100018d0
cmp dword [0x100c5028], edi
je 0x10015f86
call fcn.1000cc10
test eax, eax
je 0x10015f86
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartCheckSensitive
call fcn.10001ea0
lea eax, [esp + 0x1f4]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x1f0]
mov dword [0x100c546c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SensitiveWord
call fcn.10001ea0
lea ecx, [esp + 0x20c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov byte [esp + 0x2ae0], 0x21
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015e20
sub eax, edx
cmp eax, 0x3e7
jbe 0x10015e37
mov eax, 0x3e7
jmp 0x10015e79
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.SensitiveWord
call fcn.10001ea0
lea edx, [esp + 0x204]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
mov byte [esp + 0x2ae0], 0x22
mov dword [esp + 0x20], 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015e70
sub eax, edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SensitiveWord
call fcn.10001ea0
lea eax, [esp + 0x200]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x100c5470
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x1f8]
call fcn.100018d0
test byte [esp + 0x20], 8
mov dword [esp + 0x2ae0], 0x21
je 0x10015ed4
lea ecx, [esp + 0x200]
call fcn.100018d0
lea ecx, [esp + 0x208]
mov byte [esp + 0x2ae0], 0
call fcn.100018d0
mov ecx, dword [0x100c546c]
mov eax, dword [0x100c3c04]
mov edx, dword [0x100c3210]
mov dword [esp + 0x914], ecx
mov ecx, dword [0x100c3c08]
mov dword [esp + 0x908], eax
mov dword [esp + 0x910], 1
mov dword [esp + 0x904], edx
mov dword [esp + 0x90c], ecx
xor eax, eax
jmp 0x10015f30
mov cl, byte [eax + 0x100c3214]
mov byte [esp + eax + 0x918], cl
inc eax
test cl, cl
jne 0x10015f30
xor eax, eax
jmp 0x10015f50
mov cl, byte [eax + 0x100c5470]
mov byte [esp + eax + 0xa12], cl
inc eax
test cl, cl
jne 0x10015f50
lea edx, [esp + 0x904]
push edx
call fcn.1000cb00
push 0x10044af4
call fcn.10009a60
push 0x100c5470
call fcn.10009a60
add esp, 0xc
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea eax, [esp + 0x214]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x210]
mov dword [0x100c3c00], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DvdAction
call fcn.10001ea0
lea ecx, [esp + 0x21c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x218]
mov dword [0x100c5c40], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
mov dword [0x100c5c44], edi
call fcn.10001ea0
lea edx, [esp + 0x224]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov ecx, 0x100c330e
jmp 0x10016030
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x10016030
lea ecx, [esp + 0x220]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x22c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x228]
mov dword [0x100c3bfc], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0x238]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x230]
mov dword [0x100c332c], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea edx, [esp + 0x240]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x238]
mov dword [0x100c3330], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea eax, [esp + 0x248]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x240]
mov dword [0x100c3334], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0x250]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x248]
mov dword [0x100c3338], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea edx, [esp + 0x258]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x250]
mov dword [0x100c333c], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea eax, [esp + 0x260]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x258]
mov dword [0x100c3340], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x268]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x260]
mov dword [0x100c3344], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea edx, [esp + 0x270]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x100c3348], eax
lea ecx, [esp + 0x268]
jmp 0x100180bf
lea eax, [esp + 0x24]
push str.ONLINE_DEAL_CONTROL
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x100166c2
push 0x508
push edi
push 0x10103218
call fcn.10027470
push 0x144
push edi
push 0x10103720
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x10103720], eax
call fcn.10001ea0
lea ecx, [esp + 0x274]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10103724
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100162e0
lea ecx, [esp + 0x270]
call fcn.100018d0
mov edx, dword [0x10103720]
mov dword [0x1010321c], edx
xor eax, eax
jmp 0x10016310
mov cl, byte [eax + 0x10103724]
mov byte [eax + 0x10103220], cl
inc eax
test cl, cl
jne 0x10016310
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x27c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x278]
mov dword [0x10103218], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.OnlyAllowSpecCode
call fcn.10001ea0
lea ecx, [esp + 0x284]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x280]
mov dword [0x1010331c], eax
call fcn.100018d0
push 0x3fc
push ecx
mov edx, 0x3b
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllowDialCode
mov word [0x10103320], dx
call fcn.10001ea0
lea eax, [esp + 0x290]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10103320
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0x288]
call fcn.100018d0
mov eax, 0x10103320
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100163f0
sub eax, ecx
cmp byte [eax + 0x1010331f], 0x3b
je 0x1001641a
mov edi, 0x10103320
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10016408
mov cx, word [0x10043808]
mov word [edi], cx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea edx, [esp + 0x294]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x290]
mov dword [0x1010385c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea eax, [esp + 0x29c]
push eax
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x1010381e
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10016480
lea ecx, [esp + 0x298]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x2a4]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2a0]
mov dword [0x10103860], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea edx, [esp + 0x2b0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2a8]
mov dword [0x1010383c], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea eax, [esp + 0x2b8]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2b0]
mov dword [0x10103840], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea ecx, [esp + 0x2c0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2b8]
mov dword [0x10103844], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea edx, [esp + 0x2c8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2c0]
mov dword [0x10103848], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea eax, [esp + 0x2d0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2c8]
mov dword [0x1010384c], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea ecx, [esp + 0x2d8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x2d0]
mov dword [0x10103850], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea edx, [esp + 0x2e0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x2d8]
mov dword [0x10103854], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea eax, [esp + 0x2e8]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x10103858], eax
lea ecx, [esp + 0x2e0]
jmp 0x100180bf
lea ecx, [esp + 0x24]
push str.OTHER_BEHAVIOR_MANAGE
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x10016a5a
push 0x108
push edi
push 0x10103868
call fcn.10027470
push 0x144
push edi
push 0x10103970
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x10103970], eax
call fcn.10001ea0
lea edx, [esp + 0x2ec]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10103974
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10016732
lea ecx, [esp + 0x2e8]
call fcn.100018d0
mov eax, dword [0x10103970]
mov dword [0x1010386c], eax
xor eax, eax
jmp 0x10016760
mov cl, byte [eax + 0x10103974]
mov byte [eax + 0x10103870], cl
inc eax
test cl, cl
jne 0x10016760
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x2f4]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x2f0]
mov dword [0x10103aac], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea edx, [esp + 0x2fc]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10103a6e
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x100167d4
lea ecx, [esp + 0x2f8]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x304]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x300]
mov dword [0x10103ab0], eax
call fcn.100018d0
mov ecx, dword [0x10103ab0]
push ecx
mov dword [0x10103868], ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CanModifySystemTime
call fcn.10001ea0
lea edx, [esp + 0x30c]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x308]
mov dword [0x1010396c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea eax, [esp + 0x318]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x310]
mov dword [0x10103a8c], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x320]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x318]
mov dword [0x10103a90], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea edx, [esp + 0x328]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x320]
mov dword [0x10103a94], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea eax, [esp + 0x330]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x328]
mov dword [0x10103a98], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x338]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x330]
mov dword [0x10103a9c], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea edx, [esp + 0x340]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x338]
mov dword [0x10103aa0], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea eax, [esp + 0x348]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x340]
mov dword [0x10103aa4], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x350]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x10103aa8], eax
lea ecx, [esp + 0x348]
jmp 0x100180bf
lea edx, [esp + 0x24]
push str.ONLINE_DEAL_PROXY_CONTROL
push edx
call fcn.10004bf0
add esp, 8
test al, al
je 0x100171a1
push 0x1698
push edi
push 0x10103ab8
call fcn.10027470
push 0x48
push edi
push 0x10105150
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x10103abc], eax
call fcn.10001ea0
lea eax, [esp + 0x354]
push eax
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10103ac0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10016ac7
lea ecx, [esp + 0x350]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x35c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x358]
mov dword [0x10105194], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea edx, [esp + 0x364]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10105150
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10016b40
lea ecx, [esp + 0x360]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x36c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x368]
mov dword [0x10103ab8], eax
call fcn.100018d0
mov ecx, dword [0x10103ab8]
push ecx
mov dword [0x10105190], ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Prompt
call fcn.10001ea0
lea edx, [esp + 0x374]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x370]
mov dword [0x10103bbc], eax
call fcn.100018d0
push 0x63
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PromptInfo
call fcn.10001ea0
lea eax, [esp + 0x380]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10103bc0
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x378]
call fcn.100018d0
cmp dword [0x10103bbc], edi
je 0x10016c47
mov eax, 0x10103bc0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016c28
sub eax, edx
jne 0x10016c47
mov ecx, 7
mov esi, 0x10044a7c
mov edi, 0x10103bc0
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuditProxyServer
call fcn.10001ea0
lea ecx, [esp + 0x384]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x380]
mov dword [0x10104c30], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ForbidProxyServer
call fcn.10001ea0
lea edx, [esp + 0x38c]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x388]
mov dword [0x10103c24], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.GateWayMode
call fcn.10001ea0
lea eax, [esp + 0x394]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x390]
mov dword [0x10104c28], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.GateWayMode
call fcn.10001ea0
lea ecx, [esp + 0x39c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x398]
mov dword [0x10104c2c], eax
call fcn.100018d0
push 0x7fe
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.NetIPList
call fcn.10001ea0
lea edx, [esp + 0x3a8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10104428
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x3a0]
call fcn.100018d0
mov eax, 0x10104428
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016d80
sub eax, edi
cmp byte [eax + 0x10104427], 0x3b
je 0x10016da9
mov edi, 0x10104428
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10016d98
mov ax, word [0x10043808]
mov word [edi], ax
push 0x3ff
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.NotAllowsList
call fcn.10001ea0
lea ecx, [esp + 0x3b0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10104028
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x3a8]
call fcn.100018d0
push 0x3ff
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.OnlyAllowsList
call fcn.10001ea0
lea edx, [esp + 0x3b8]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10103c28
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x3b0]
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea eax, [esp + 0x3c0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3b8]
mov dword [0x10105170], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x3c8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3c0]
mov dword [0x10105174], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea edx, [esp + 0x3d0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3c8]
mov dword [0x10105178], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea eax, [esp + 0x3d8]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3d0]
mov dword [0x1010517c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x3e0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3d8]
mov dword [0x10105180], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea edx, [esp + 0x3e8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x3e0]
mov dword [0x10105184], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea eax, [esp + 0x3f0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x3e8]
mov dword [0x10105188], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x3f8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x3f0]
mov dword [0x1010518c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.DisableIEProxySeting
call fcn.10001ea0
lea edx, [esp + 0x3fc]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x3f8]
mov dword [0x10104c34], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.EnforceIEProxySeting
call fcn.10001ea0
lea eax, [esp + 0x404]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x400]
mov dword [0x10104c38], eax
call fcn.100018d0
push 0x103
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.IEProxyIPAddress
call fcn.10001ea0
lea ecx, [esp + 0x410]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10104c3c
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x408]
call fcn.100018d0
push 9
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.IEProxyPort
call fcn.10001ea0
lea edx, [esp + 0x418]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10104d40
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x410]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IELOCALNOTPROXY
call fcn.10001ea0
lea eax, [esp + 0x41c]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x418]
mov dword [0x10104d4c], eax
call fcn.100018d0
push 0x3ff
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.IEEXCEPTIONADDR
call fcn.10001ea0
lea ecx, [esp + 0x428]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10104d50
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x420]
call fcn.100018d0
push 0x10104d50
call fcn.100408b1
add esp, 4
jmp 0x100180c4
lea edx, [esp + 0x24]
push str.CLIP_BOARD_CONTROL
push edx
call fcn.10004bf0
add esp, 8
test al, al
je 0x100177a2
push 0x584
push edi
push 0x10105198
call fcn.10027470
push 0x48
push edi
push 0x10105720
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x1010519c], eax
call fcn.10001ea0
lea eax, [esp + 0x42c]
push eax
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x101051a0
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10017210
lea ecx, [esp + 0x428]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea ecx, [esp + 0x434]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x430]
mov dword [0x10105198], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IsCut
call fcn.10001ea0
lea edx, [esp + 0x43c]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x438]
mov dword [0x10105304], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IsPaste
call fcn.10001ea0
lea eax, [esp + 0x444]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x440]
mov dword [0x10105308], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IsOpenKeyWords
call fcn.10001ea0
lea ecx, [esp + 0x44c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x448]
mov dword [0x1010530c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.IsCanRun
call fcn.10001ea0
lea edx, [esp + 0x454]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
mov dword [0x10105310], eax
lea ecx, [esp + 0x450]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Prompt
call fcn.10001ea0
lea eax, [esp + 0x45c]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x458]
mov dword [0x1010529c], eax
call fcn.100018d0
push 0x62
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PromptInfo
call fcn.10001ea0
lea ecx, [esp + 0x468]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x101052a0
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x460]
call fcn.100018d0
cmp dword [0x1010529c], edi
je 0x100173fc
mov eax, 0x101052a0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100173e0
sub eax, edx
jne 0x100173fc
mov ecx, 7
mov esi, 0x10044964
mov edi, 0x101052a0
rep movsd dword es:[edi], dword [esi]
push 0x3fc
push ecx
mov edx, 0x3b
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.KeyWords
mov word [0x10105314], dx
call fcn.10001ea0
lea eax, [esp + 0x470]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x10105314
call fcn.10029e30
add esp, 0xc
lea ecx, [esp + 0x468]
call fcn.100018d0
mov eax, 0x10105314
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10017451
sub eax, edx
cmp byte [eax + 0x10105313], 0x3b
je 0x10017482
mov edi, 0x10105314
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10017470
mov cx, word [0x10043808]
mov word [edi], cx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea edx, [esp + 0x474]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x470]
mov dword [0x10105714], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea eax, [esp + 0x47c]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x478]
mov dword [0x10105718], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea ecx, [esp + 0x484]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x480]
mov dword [0x10105764], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea edx, [esp + 0x48c]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov ecx, 0x10105720
lea ecx, [ecx]
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x10017560
lea ecx, [esp + 0x488]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x494]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x490]
mov dword [0x10105760], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea ecx, [esp + 0x4a0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x498]
mov dword [0x10105740], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea edx, [esp + 0x4a8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x4a0]
mov dword [0x10105744], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea eax, [esp + 0x4b0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x4a8]
mov dword [0x10105748], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea ecx, [esp + 0x4b8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x4b0]
mov dword [0x1010574c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea edx, [esp + 0x4c0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x4b8]
mov dword [0x10105750], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea eax, [esp + 0x4c8]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x4c0]
mov dword [0x10105754], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea ecx, [esp + 0x4d0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x4c8]
mov dword [0x10105758], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea edx, [esp + 0x4d8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x1010575c], eax
lea ecx, [esp + 0x4d0]
jmp 0x100180bf
lea eax, [esp + 0x24]
push str.WEB_VISIT_CONTROL
push eax
call fcn.10004bf0
add esp, 8
test al, al
je 0x10017c2a
push 0x150c
push edi
push 0x10105768
call fcn.10027470
push 0x48
push edi
push 0x10106c78
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x1010576c], eax
call fcn.10001ea0
lea ecx, [esp + 0x4dc]
push ecx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10105770
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10017810
lea ecx, [esp + 0x4d8]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea edx, [esp + 0x4e4]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x4e0]
mov dword [0x10105768], eax
call fcn.100018d0
mov eax, dword [0x10105768]
push 0xffa
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Imperative
mov dword [0x10106cb8], eax
call fcn.10001ea0
lea ecx, [esp + 0x4f0]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x1010586a
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x4e8]
call fcn.100018d0
push 0x1010586a
mov ecx, esi
call fcn.100032d0
mov eax, 0x1010586a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100178c1
sub eax, edx
cmp byte [eax + 0x10105869], 0x3b
je 0x100178f2
mov edi, 0x1010586a
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100178e0
mov dx, word [0x10043808]
mov word [edi], dx
push 0x1010586a
call fcn.10028a08
add esp, 4
push 0x3fe
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.FileObject
call fcn.10001ea0
lea eax, [esp + 0x4f8]
push eax
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
push 0x1010686a
call fcn.10028df0
add esp, 0xc
lea ecx, [esp + 0x4f0]
call fcn.100018d0
push 0x1010686a
call fcn.10028a08
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea ecx, [esp + 0x4fc]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x4f8]
mov dword [0x10106c6c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea edx, [esp + 0x504]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x500]
mov dword [0x10106c70], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
call fcn.10001ea0
lea eax, [esp + 0x50c]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x508]
mov dword [0x10106cbc], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea ecx, [esp + 0x514]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov ecx, 0x10106c78
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x10017a24
lea ecx, [esp + 0x510]
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea edx, [esp + 0x520]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x518]
mov dword [0x10106c98], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea eax, [esp + 0x528]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x520]
mov dword [0x10106c9c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea ecx, [esp + 0x530]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x528]
mov dword [0x10106ca0], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea edx, [esp + 0x538]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x530]
mov dword [0x10106ca4], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea eax, [esp + 0x540]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x538]
mov dword [0x10106ca8], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea ecx, [esp + 0x548]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x540]
mov dword [0x10106cac], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea edx, [esp + 0x550]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x548]
mov dword [0x10106cb0], eax
call fcn.100018d0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea eax, [esp + 0x558]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
mov dword [0x10106cb4], eax
lea ecx, [esp + 0x550]
jmp 0x100180bf
lea ecx, [esp + 0x24]
push str.SYSTEM_CONNECT_MONITOR
push ecx
call fcn.10004bf0
add esp, 8
test al, al
je 0x100180c4
push 0x2b094
push edi
push 0x10106cc0
call fcn.10027470
push 0x48
push edi
push 0x10131d58
call fcn.10027470
add esp, 0x18
mov ecx, ebp
call fcn.10001f60
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PolicyName
mov dword [0x10106cc4], eax
call fcn.10001ea0
lea edx, [esp + 0x55c]
push edx
mov ecx, ebp
call fcn.10001da0
mov ecx, dword [eax]
mov edx, 0x10106cc8
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10017c97
lea ecx, [esp + 0x558]
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartPolicy
call fcn.10001ea0
lea eax, [esp + 0x564]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x560]
mov dword [0x10106cc0], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ControlMode
call fcn.10001ea0
lea ecx, [esp + 0x56c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x568]
mov dword [0x10106dc4], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuditMode
call fcn.10001ea0
lea edx, [esp + 0x574]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x570]
mov dword [0x10106dc8], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.White_List
call fcn.10001ea0
lea eax, [esp + 0x4c]
push eax
mov ecx, ebx
call fcn.10001a90
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x1004491c
mov byte [esp + 0x2ae8], 0x23
call fcn.10001ea0
lea ecx, [esp + 0x48]
push ecx
mov ecx, ebx
call fcn.10001a90
lea edx, [esp + 0x48]
push 1
push edx
mov byte [esp + 0x2ae8], 0x24
call fcn.100079a0
lea eax, [esp + 0x4c]
push 2
push eax
call fcn.100079a0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push str.UpRegionService
call fcn.10001ea0
lea ecx, [esp + 0x57c]
push ecx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x578]
mov dword [0x10131d4c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WriteLocalFile
call fcn.10001ea0
lea edx, [esp + 0x584]
push edx
mov ecx, ebx
call fcn.10001a90
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x580]
mov dword [0x10131d50], eax
call fcn.100018d0
mov eax, dword [0x10106cc0]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.InvalidWeekDay
mov dword [0x10131d98], eax
call fcn.10001ea0
lea ecx, [esp + 0x58c]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10027dfb
add esp, 4
lea ecx, [esp + 0x588]
mov dword [0x10131d9c], eax
call fcn.100018d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Class
call fcn.10001ea0
lea edx, [esp + 0x594]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
mov ecx, 0x10131d58
lea ebx, [ebx]
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x10017eb0
lea ecx, [esp + 0x590]
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT1
call fcn.10001ea0
lea eax, [esp + 0x5a0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x598]
mov dword [0x10131d78], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET1
call fcn.10001ea0
lea ecx, [esp + 0x5a8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x5a0]
mov dword [0x10131d7c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT2
call fcn.10001ea0
lea edx, [esp + 0x5b0]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x5a8]
mov dword [0x10131d80], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET2
call fcn.10001ea0
lea eax, [esp + 0x5b8]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x5b0]
mov dword [0x10131d84], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DBT3
call fcn.10001ea0
lea ecx, [esp + 0x5c0]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x5b8]
mov dword [0x10131d88], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DET3
call fcn.10001ea0
lea edx, [esp + 0x5c8]
push edx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002080
add esp, 8
lea ecx, [esp + 0x5c0]
mov dword [0x10131d8c], eax
call fcn.100018d0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyStartTime
call fcn.10001ea0
lea eax, [esp + 0x5d0]
push eax
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x5c8]
mov dword [0x10131d90], eax
call fcn.100018d0
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.PolicyEndTime
call fcn.10001ea0
lea ecx, [esp + 0x5d8]
push ecx
mov ecx, ebp
call fcn.10001da0
mov eax, dword [eax]
push eax
call fcn.10002220
add esp, 8
lea ecx, [esp + 0x5d0]
mov dword [0x10131d94], eax
call fcn.100018d0
lea ecx, [esp + 0x44]
call fcn.100018d0
lea ecx, [esp + 0x48]
call fcn.100018d0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x2ae0], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100180ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2ad8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2ac0]
xor ecx, esp
call fcn.1002742c
add esp, 0x2ad0
ret 4