Function at 0x40a040
Capabilities:
Check mutex on windows
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445b9c
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x45e0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4e8], 7
mov word [ebp - 0x4fc], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x548], 7
mov word [ebp - 0x55c], ax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], 7
mov word [ebp - 0x4cc], ax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], 7
mov word [ebp - 0x49c], ax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], 7
mov word [ebp - 0x484], ax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x64c], eax
call sub.utilsdll.dll_bBypassFShield
push str.FA_VULN
mov dword [ebp - 0x6a4], eax
call sub.utilsdll.dll_log_initialize
mov dword [0x45ef80], eax
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x824]
push eax
call sub.utilsdll.dll_GetFullAccessSecuAttr
add esp, 0xc
lea eax, [ebp - 0x6b0]
push str.GlobalFC_85ACFE41_C205_4a45_A34E_53AB75C1654F
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x67c], eax
test eax, eax
je 0x40a19b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40a19b
lea esi, [eax - 0x52]
jmp 0x40c5cd
mov esi, dword [ebp + 8]
push str.s:t:de:p:no:ua:
push edi
push esi
call sub.utilsdll.dll_getopt
movzx eax, ax
mov ecx, 0xffff
add esp, 0xc
cmp ax, cx
je 0x40a3e9
nop
movzx eax, ax
add eax, 0xffffff9f
cmp eax, 0x14
ja case.0x40a1d6.98
movzx eax, byte [eax + 0x40c720]
jmp dword [eax*4 + 0x40c6f8]
mov eax, dword [sym.imp.utilsdll.dll_optarg]
push dword [eax]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x45f194], eax
test eax, eax
je case.0x40a1d6.98
mov eax, dword [sym.imp.utilsdll.dll_optarg]
push 0x5f
push dword [eax]
call fcn.0041fd0b
add esp, 8
mov dword [0x45f198], eax
test eax, eax
je case.0x40a1d6.98
add eax, 2
mov dword [0x45f198], eax
jmp case.0x40a1d6.98
mov eax, dword [sym.imp.utilsdll.dll_optarg]
push section..data
push 0x44943c
push dword [eax]
call fcn.0040a010
push 1
push 0x104
push 0x45ef88
push dword [section..data]
call sub.utilsdll.dll_GetTSSessionUserName
push 0x45ef88
push dword [section..data]
push str.initial_TS_session_id_d__user_s
call fcn.00408340
add esp, 0x28
jmp case.0x40a1d6.98
mov dword [0x45e004], 1
push str.debug_mode_is_enabled
jmp 0x40a3c1
mov eax, dword [sym.imp.utilsdll.dll_optarg]
mov edx, dword [eax]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x654], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a2a0
sub ecx, dword [ebp - 0x654]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x55c]
call fcn.00404130
cmp dword [ebp - 0x548], 8
lea eax, [ebp - 0x55c]
cmovae eax, dword [ebp - 0x55c]
push eax
push str.parameters_from_GUI:__s
call fcn.00408340
add esp, 8
jmp case.0x40a1d6.98
mov eax, dword [sym.imp.utilsdll.dll_optarg]
mov edx, dword [eax]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x654], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a300
sub ecx, dword [ebp - 0x654]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x49c]
call fcn.00404130
cmp dword [ebp - 0x488], 8
lea eax, [ebp - 0x49c]
cmovae eax, dword [ebp - 0x49c]
push eax
push str.patch_list_file:__s
call fcn.00408340
add esp, 8
jmp case.0x40a1d6.98
mov dword [ebp - 0x648], 1
push str.auto_patch_is_diabled
jmp 0x40a3c1
lea eax, [ebp - 0x670]
push eax
mov eax, dword [sym.imp.utilsdll.dll_optarg]
push 0x44953c
push dword [eax]
call fcn.0040a010
push dword [ebp - 0x670]
push str.auto_patch_level_is_set_to__d
call fcn.00408340
add esp, 0x14
jmp case.0x40a1d6.98
lea eax, [ebp - 0x680]
push eax
mov eax, dword [sym.imp.utilsdll.dll_optarg]
push 0x44953c
push dword [eax]
call fcn.0040a010
push dword [ebp - 0x680]
push str.search_vulns_that_exist_for_a_long_time__nDays_d
call fcn.00408340
add esp, 0x14
jmp case.0x40a1d6.98
mov dword [0x45f1c8], 1
push str.this_scan_is_cancellable
call fcn.00408340
add esp, 4
push str.s:t:de:p:no:ua:
push edi
push esi
call sub.utilsdll.dll_getopt
movzx eax, ax
mov ecx, 0xffff
add esp, 0xc
cmp ax, cx
jne 0x40a1c0
cmp dword [ebp - 0x680], 0
je 0x40a52f
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
call fcn.00409c00
mov dword [ebp - 0x45c], eax
push str.logs_vcm_
lea eax, [ebp - 0x4e4]
mov byte [ebp - 4], 7
push 0x45f1e8
push eax
call fcn.00405b40
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 8
jb 0x40a444
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.00410f40
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0xa
call fcn.00403c50
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x680]
lea ecx, [ebp - 0x5dc]
call fcn.0041b6f0
mov ecx, dword [ebp - 0x45c]
mov eax, dword [ecx]
mov dword [ebp - 0x648], eax
cmp eax, ecx
je 0x40a4c6
nop dword [eax]
cmp dword [eax + 0x24], 8
lea ecx, [eax + 0x10]
jb 0x40a49c
mov ecx, dword [eax + 0x10]
push dword [eax + 0x28]
push ecx
push str.level_ws__count_d_n
call fcn.0040c750
add esp, 0xc
lea ecx, [ebp - 0x648]
call fcn.00412920
mov eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x45c]
jne 0x40a490
lea ecx, [ebp - 0x5dc]
call fcn.00411a80
mov edi, dword [ebp - 0x45c]
mov byte [ebp - 4], 6
mov esi, dword [edi]
mov dword [ebp - 0x648], esi
push dword [edi + 4]
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0xb
call fcn.00415950
mov eax, dword [ebp - 0x45c]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x45c]
mov dword [eax], eax
mov eax, dword [ebp - 0x45c]
mov dword [eax + 8], eax
mov edi, dword [ebp - 0x45c]
push edi
mov dword [ebp - 0x458], 0
call fcn.0041c221
add esp, 4
xor esi, esi
jmp 0x40c687
push str.softwareFortinetFortiClientFA_VULN
push 0x80000002
call sub.utilsdll.dll_reg_openkey
mov esi, eax
add esp, 8
test esi, esi
je 0x40a5a8
cmp dword [ebp - 0x648], 0
jne 0x40a56e
cmp dword [ebp - 0x670], 0
jne 0x40a56e
lea eax, [ebp - 0x670]
push eax
push str.auto_patch_level
push esi
call sub.utilsdll.dll_reg_getDWORD
add esp, 0xc
lea eax, [ebp - 0x648]
mov dword [ebp - 0x648], 0
push eax
push str.windows_update
push esi
call sub.utilsdll.dll_reg_getDWORD
mov ecx, dword [0x45e008]
test al, al
push esi
cmovne ecx, dword [ebp - 0x648]
mov dword [0x45e008], ecx
call sub.utilsdll.dll_reg_closekey
add esp, 0x10
mov ecx, dword [ebp - 0x670]
test ecx, ecx
je 0x40a660
dec ecx
cmp ecx, 4
ja case.default.0x40a5bc
jmp dword [ecx*4 + 0x40c738]
push 0x4496d8
lea ecx, [ebp - 0x4fc]
call fcn.00407d90
jmp 0x40a62f
push 0x4496ec
lea ecx, [ebp - 0x4fc]
call fcn.00407d90
jmp 0x40a62f
push 0x4496f8
lea ecx, [ebp - 0x4fc]
call fcn.00407d90
jmp 0x40a62f
push 0x449708
lea ecx, [ebp - 0x4fc]
call fcn.00407d90
jmp 0x40a62f
push 0x449710
lea ecx, [ebp - 0x4fc]
call fcn.00407d90
jmp 0x40a62f
push 4
push 0x4496ec
lea ecx, [ebp - 0x4fc]
call fcn.00404130
cmp dword [ebp - 0x4e8], 8
lea eax, [ebp - 0x4fc]
cmovae eax, dword [ebp - 0x4fc]
push eax
push str.wmain
push str._ws____szAutoPatchlevel_ws
call fcn.00408340
mov ecx, dword [ebp - 0x670]
add esp, 0xc
test ecx, ecx
jne 0x40a669
cmp dword [ebp - 0x48c], 0
je 0x40a69b
cmp dword [ebp - 0x488], 8
lea eax, [ebp - 0x49c]
cmovae eax, dword [ebp - 0x49c]
push eax
push ecx
push str.wmain
push str._ws____this_is_a_patching__so_set_it_to_non_cancellable__AutoPatchLevel_d__sPatchListFile_s
call fcn.00408340
add esp, 0x10
mov dword [0x45f1c8], 0
push 0
call fcn.0043170c
add esp, 4
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x48c], 0
je 0x40ae00
push str.wmain
push str._ws____patch_list_is_not_empty
call fcn.00408340
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0xf
mov byte [ebp - 0x43c], 0
cmp dword [ebp - 0x488], 8
lea ecx, [ebp - 0x43c]
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 0xc
cmovae eax, dword [ebp - 0x49c]
push ecx
push eax
call fcn.004099c0
add esp, 0x10
test eax, eax
jne 0x40adef
push str.wmain
push str._ws____loaded_patch_list
call fcn.00408340
add esp, 8
lea ecx, [ebp - 0x61c]
push 0
push 0x400
push 0
call fcn.004079e0
cmp dword [ebp - 0x428], 0x10
lea eax, [ebp - 0x43c]
lea ecx, [ebp - 0x61c]
mov byte [ebp - 4], 0xd
cmovae eax, dword [ebp - 0x43c]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00406910
cmp dword [ebp - 0x5e4], 0
jne 0x40ade4
push str.wmain
push str._ws____parsed_patch_list
call fcn.00408340
add esp, 8
lea ecx, [ebp - 0x61c]
push str.Install
call fcn.00409110
test al, al
je 0x40ade4
push str.wmain
push str._ws____patch_list_has_Install_section
call fcn.00408340
add esp, 8
mov dword [ebp - 0x45c], 0
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x458], 0
call fcn.00409c30
mov dword [ebp - 0x45c], eax
push str.Install
lea ecx, [ebp - 0x61c]
mov byte [ebp - 4], 0xe
call fcn.00405980
mov edi, eax
mov dword [ebp - 0x648], 0
cmp dword [edi + 4], 0
jbe 0x40a8da
xor esi, esi
nop dword [eax + eax]
mov ecx, dword [edi]
add ecx, esi
push 0x44991c
call fcn.00409110
test al, al
je 0x40a8c1
push str.wmain
push 0x449920
call fcn.00408340
mov ecx, dword [edi]
add esp, 8
add ecx, esi
push 0x44991c
call fcn.00405980
mov ecx, eax
mov eax, dword [ecx + 0x10]
movzx edx, al
cmp edx, 5
jne 0x40a88a
test eax, 0x400000
jne 0x40a85c
mov ecx, dword [ecx]
push 0xa
push 0
push ecx
call fcn.00429579
add esp, 0xc
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x660]
mov dword [ebp - 0x65c], edx
push dword [ebp - 0x67c]
push eax
lea eax, [ebp - 0x694]
jmp 0x40a8b3
cmp edx, 6
jne 0x40a8c1
mov eax, dword [ecx]
push dword [ebp - 0x67c]
mov dword [ebp - 0x658], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x668]
push 0
push eax
lea ecx, [ebp - 0x45c]
call fcn.00407600
mov eax, dword [ebp - 0x648]
add esi, 0x18
inc eax
mov dword [ebp - 0x648], eax
cmp eax, dword [edi + 4]
jb 0x40a810
mov eax, dword [0x45e040]
mov esi, 0x45e040
mov dword [ebp - 0x664], esi
test eax, eax
je 0x40a907
nop
cmp eax, 0x1790a
je 0x40a911
mov eax, dword [esi + 0x14]
add esi, 0x14
mov dword [ebp - 0x664], esi
test eax, eax
jne 0x40a8f0
mov dword [ebp - 0x664], 0
push str.logs_vcm_
lea eax, [ebp - 0x4e4]
push 0x45f1e8
push eax
call fcn.00405b40
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xf
jb 0x40a936
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.00410f40
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0x11
call fcn.00403c50
mov eax, dword [ebp - 0x5dc]
mov esi, dword [eax]
cmp esi, eax
je 0x40adce
mov ecx, dword [ebp - 0x45c]
mov eax, dword [ecx + 4]
cmp byte [eax + 0xd], 0
jne 0x40ad64
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
nop word [eax + eax]
cmp dword [eax + 0x14], edi
jg 0x40a991
jl 0x40a98c
cmp dword [eax + 0x10], edx
jae 0x40a991
mov eax, dword [eax + 8]
jmp 0x40a995
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x40a980
cmp ecx, dword [ebp - 0x45c]
je 0x40ad64
cmp edi, dword [ecx + 0x14]
jl 0x40ad64
jg 0x40a9bb
cmp edx, dword [ecx + 0x10]
jb 0x40ad64
push edi
push edx
push str.wmain
push str._ws____VID__I64d_is_in_the_patch_list
call fcn.00408340
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0041ee20
push dword [esi + 0x14]
lea eax, [ebp - 0x21c]
push dword [esi + 0x10]
push 0x449a10
push str._s_d
push 0x104
push eax
call fcn.00409f70
add esp, 0x34
lea ecx, [ebp - 0x760]
push 1
push 3
call fcn.00402450
mov eax, dword [esi + 0x114]
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
mov dword [ebp - 0x648], ecx
cmp ecx, eax
je 0x40aa76
nop dword [eax + eax]
mov eax, dword [ecx + 0x20]
add ecx, 0x10
cmp dword [ecx + 0x14], 0x10
jb 0x40aa3e
mov ecx, dword [ecx]
push 0x449a88
push eax
push ecx
lea eax, [ebp - 0x750]
push eax
call fcn.00401920
add esp, 0xc
push eax
call fcn.00401150
add esp, 8
lea ecx, [ebp - 0x648]
call fcn.00412920
mov ecx, dword [ebp - 0x648]
cmp ecx, dword [esi + 0x114]
jne 0x40aa30
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x500], 0xf
mov byte [ebp - 0x514], 0
lea eax, [ebp - 0x574]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x760]
call fcn.00405240
lea ecx, [ebp - 0x574]
mov edi, dword [eax + 0x10]
call fcn.00403bf0
test edi, edi
je 0x40ab5c
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x760]
call fcn.00405240
mov edi, eax
lea eax, [ebp - 0x544]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x760]
call fcn.00405240
mov ecx, dword [edi + 0x10]
dec ecx
mov byte [ebp - 4], 0x15
push 0xffffffffffffffff
push ecx
lea ecx, [ebp - 0x574]
push ecx
mov ecx, eax
call fcn.00409ed0
mov edi, eax
lea eax, [ebp - 0x514]
cmp eax, edi
je 0x40ab3b
mov ecx, eax
call fcn.00403bf0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x514], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x504], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x574]
call fcn.00403bf0
lea ecx, [ebp - 0x544]
call fcn.00403bf0
lea ecx, [ebp - 0x4b4]
call fcn.00403bf0
xor eax, eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 7
mov word [ebp - 0x454], ax
mov edi, dword [ebp - 0x500]
lea eax, [ebp - 0x514]
mov ecx, dword [ebp - 0x514]
cmp edi, 0x10
mov byte [ebp - 4], 0x16
cmovae eax, ecx
cmp dword [ebp - 0x504], 1
jne 0x40abb8
push 1
push 0x449a88
push eax
call fcn.00409d00
add esp, 0xc
test eax, eax
je 0x40ac05
mov ecx, dword [ebp - 0x514]
cmp edi, 0x10
lea eax, [ebp - 0x514]
cmovae eax, ecx
push eax
call fcn.00409ac0
mov edi, eax
add esp, 4
test edi, edi
je 0x40ac05
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40abe0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x454]
call fcn.00404130
push edi
call fcn.00422f30
add esp, 4
push dword [esi + 0x14]
push dword [esi + 0x10]
push str.wmain
push str._ws____create_log_for_VID__I64d
call fcn.00408340
add esp, 0x10
lea eax, [ebp - 0x454]
cmp dword [ebp - 0x440], 8
lea edi, [esi + 0xfc]
mov dword [ebp - 0x648], edi
cmovae eax, dword [ebp - 0x454]
cmp dword [ebp - 0x5a0], 8
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x5b4]
cmovae eax, dword [ebp - 0x5b4]
cmp dword [ebp - 0x5b8], 8
mov dword [ebp - 0x690], eax
lea eax, [ebp - 0x5cc]
cmovae eax, dword [ebp - 0x5cc]
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x65c], eax
jb 0x40ac85
mov edi, dword [edi]
mov dword [ebp - 0x648], edi
cmp dword [esi + 0xb0], 8
lea edx, [esi + 0x9c]
jb 0x40ac96
mov edx, dword [edx]
cmp dword [esi + 0x80], 8
lea ecx, [esi + 0x6c]
jb 0x40aca4
mov ecx, dword [ecx]
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x40acaf
mov eax, dword [eax]
push dword [ebp - 0x664]
lea edi, [ebp - 0x21c]
push dword [ebp - 0x654]
push dword [ebp - 0x690]
push dword [ebp - 0x65c]
push edi
mov edi, dword [ebp - 0x648]
push edi
push edx
push ecx
push eax
push dword [esi + 0x10]
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Result
add esp, 0x30
lea ecx, [ebp - 0x454]
call fcn.00403c50
lea ecx, [ebp - 0x514]
call fcn.00403bf0
mov eax, dword [ebp - 0x760]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x760]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x764], eax
lea ecx, [ebp - 0x748]
call fcn.00402e80
lea ecx, [ebp - 0x740]
call fcn.00402d50
lea eax, [ebp - 0x6f8]
mov byte [ebp - 4], 0x17
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041df9c
add esp, 4
mov byte [ebp - 4], 0x11
jmp 0x40ad7c
push dword [esi + 0x14]
push dword [esi + 0x10]
push str.wmain
push str._ws____VID__I64d_is_not_in_the_patch_list___skipping
call fcn.00408340
add esp, 0x10
cmp byte [esi + 0xd], 0
jne 0x40adc2
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x40ada1
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x40adc2
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x40ad95
jmp 0x40adc2
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40adc0
nop word [eax + eax]
cmp esi, dword [eax + 8]
jne 0x40adc0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40adb0
mov esi, eax
cmp esi, dword [ebp - 0x5dc]
jne 0x40a961
lea ecx, [ebp - 0x5dc]
call fcn.00411a80
lea ecx, [ebp - 0x45c]
call fcn.00407b50
lea ecx, [ebp - 0x61c]
call fcn.00407ac0
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 6
call fcn.00403bf0
jmp 0x40ae3a
mov ecx, dword [0x45e040]
mov eax, 0x45e040
test ecx, ecx
je 0x40ae22
nop
cmp ecx, 0x17908
je 0x40ae24
mov ecx, dword [eax + 0x14]
add eax, 0x14
test ecx, ecx
jne 0x40ae10
xor eax, eax
push eax
push 1
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Status
add esp, 0x10
push str.GlobalFC_C4952543_9228_437E_895A_FDA9E483EF8C
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40ae5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x40aeb8
push 1
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x438]
mov dword [ebp - 0x460], 0xc
push str.GlobalFC_C4952543_9228_437E_895A_FDA9E483EF8C
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x460]
push 1
push eax
mov dword [ebp - 0x458], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call sub.utilsdll.dll_signal_scheduler
cmp dword [ebp - 0x4ec], 0
mov dword [0x45f19c], esi
je 0x40b099
lea eax, [ebp - 0x4b4]
push eax
call fcn.00407df0
add esp, 4
lea ecx, [ebp - 0x484]
push eax
call fcn.00403250
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
cmovae eax, dword [ebp - 0x484]
push eax
push str.wmain
push str._ws____pre_scan_for_3rd_party__working_folder:__s
call fcn.00408340
add esp, 0xc
cmp dword [0x45e008], 0
je 0x40af33
push 3
push 0x449b34
lea ecx, [ebp - 0x4cc]
call fcn.00404130
push dword [section..data]
mov ecx, 0x45f1a0
push 1
call fcn.00405970
push 0
mov dword [ebp - 0x664], 0
call fcn.0043170c
add esp, 4
mov edi, eax
lea eax, [ebp - 0x664]
push eax
sub esp, 0x18
lea eax, [ebp - 0x4cc]
mov ecx, esp
mov dword [ebp - 0x65c], esp
push eax
call fcn.00402370
sub esp, 0x18
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x484]
mov ecx, esp
push eax
call fcn.00402370
mov byte [ebp - 4], 6
call fcn.004084f0
push 0
mov dword [ebp - 0x65c], eax
call fcn.0043170c
add esp, 0x38
lea ecx, [ebp - 0x484]
cmp dword [ebp - 0x470], 8
mov esi, eax
cmovae ecx, dword [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x5dc]
call fcn.00410f40
push 0x4487cc
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0x19
call fcn.00402400
sub esi, edi
mov byte [ebp - 4], 0x1a
push esi
lea eax, [ebp - 0x4e4]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.004163c0
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 0x64d], al
mov byte [ebp - 4], 0x19
call fcn.00403c50
cmp byte [ebp - 0x64d], 0
jne 0x40b032
push dword [ebp - 0x664]
push dword [ebp - 0x65c]
push str.wmain
push str._ws____DoScan___returned__d__dwExitCode0x_08lx
call fcn.00408340
add esp, 0x10
mov eax, dword [ebp - 0x664]
test al, al
movzx edx, byte [ebp - 0x64c]
push dword [ebp - 0x670]
movzx ecx, al
mov ax, word [ebp - 0x662]
cmovne edx, ecx
or word [ebp - 0x64a], ax
lea ecx, [ebp - 0x5dc]
lea eax, [ebp - 0x4b4]
mov byte [ebp - 0x64c], dl
push eax
call fcn.00415dc0
push eax
lea ecx, [ebp - 0x49c]
call fcn.00403250
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 6
call fcn.00411a80
cmp dword [ebp - 0x548], 8
lea eax, [ebp - 0x55c]
push dword [ebp - 0x54c]
cmovae eax, dword [ebp - 0x55c]
lea ecx, [ebp - 0x4cc]
push eax
call fcn.00404130
cmp dword [ebp - 0x4ec], 0
je 0x40b12a
push str.__a
lea ecx, [ebp - 0x544]
call fcn.00402400
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0x1b
push ecx
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00405a70
add esp, 0xc
cmp dword [eax + 0x14], 8
mov ecx, eax
mov byte [ebp - 4], 0x1c
jb 0x40b101
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x4cc]
call fcn.00403f00
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 6
call fcn.00403c50
cmp dword [ebp - 0x48c], 0
lea eax, [ebp - 0x4b4]
push eax
je 0x40b31d
call fcn.00408d30
add esp, 4
lea ecx, [ebp - 0x484]
push eax
call fcn.00403250
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
cmovae eax, dword [ebp - 0x484]
push eax
push str.wmain
push str._ws____doing_list_patching__we_will_re_use_the_most_recent_working_folder___s
call fcn.00408340
push str.install.json
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00405b40
add esp, 0x18
cmp dword [ebp - 0x428], 8
lea ecx, [ebp - 0x43c]
push 0
cmovae ecx, dword [ebp - 0x43c]
lea eax, [ebp - 0x49c]
cmp dword [ebp - 0x488], 8
push ecx
cmovae eax, dword [ebp - 0x49c]
push eax
mov byte [ebp - 4], 0x1d
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40b25f
push 0x449c6c
lea ecx, [ebp - 0x574]
call fcn.00402400
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 0x1e
push ecx
push eax
lea eax, [ebp - 0x544]
push eax
call fcn.00405a70
push 0x449c68
push eax
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x1f
push eax
call fcn.00405ad0
add esp, 0x18
cmp dword [eax + 0x14], 8
mov ecx, eax
mov byte [ebp - 4], 0x20
jb 0x40b229
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x4cc]
call fcn.00403f00
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
lea ecx, [ebp - 0x544]
call fcn.00403c50
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x1d
call fcn.00403c50
jmp 0x40b288
cmp dword [ebp - 0x428], 8
lea eax, [ebp - 0x43c]
cmovae eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_move_patch_list_file__err_d___s
call fcn.00408340
add esp, 0xc
cmp dword [ebp - 0x488], 8
lea eax, [ebp - 0x49c]
cmovae eax, dword [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x428], 8
lea eax, [ebp - 0x43c]
push dword [ebp - 0x42c]
cmovae eax, dword [ebp - 0x43c]
lea ecx, [ebp - 0x49c]
push eax
call fcn.00404130
cmp dword [ebp - 0x488], 8
lea ecx, [ebp - 0x6a0]
push ecx
lea ecx, [ebp - 0x68c]
lea eax, [ebp - 0x49c]
cmovae eax, dword [ebp - 0x49c]
push ecx
push eax
call fcn.00409180
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x43c]
call fcn.00403c50
mov eax, dword [ebp - 0x69c]
mov edi, dword [ebp - 0x6a0]
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x66c], edi
jmp 0x40b365
call fcn.00407df0
add esp, 4
lea ecx, [ebp - 0x484]
push eax
call fcn.00403250
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
cmovae eax, dword [ebp - 0x484]
push eax
push str.wmain
push str._ws____create_new_working_folder___s
call fcn.00408340
add esp, 0xc
xor edi, edi
push dword [section..data]
xor eax, eax
mov ecx, 0x45f1a0
cmp dword [ebp - 0x48c], eax
setne al
inc eax
push eax
call fcn.00405970
cmp dword [0x45e008], 0
je 0x40b3a5
push 3
push 0x449b34
lea ecx, [ebp - 0x4cc]
call fcn.00403f00
mov esi, dword [ebp - 0x688]
jmp 0x40b3d6
mov esi, dword [ebp - 0x68c]
lea eax, [ebp - 0x68c]
push eax
push dword [ebp - 0x688]
push esi
call fcn.004014f0
push str.wmain
push str._ws____windows_update_is_disabled__so_clear_all_windows_patch_from_patch_list
mov dword [ebp - 0x688], esi
call fcn.00408340
add esp, 0x14
cmp dword [ebp - 0x48c], 0
je 0x40b3fe
cmp dword [ebp - 0x68c], esi
jne 0x40b406
push str.wmain
push str._ws____no_windows_patch_in_this_list__go_to_next_step_for_3rd_party_patching
call fcn.00408340
add esp, 8
jmp 0x40b4e3
cmp dword [ebp - 0x68c], esi
je 0x40b43f
mov ecx, dword [0x45e040]
mov eax, 0x45e040
test ecx, ecx
je 0x40b427
cmp ecx, 0x17908
je 0x40b429
mov ecx, dword [eax + 0x14]
add eax, 0x14
test ecx, ecx
jne 0x40b415
xor eax, eax
push eax
push 2
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Status
add esp, 0x10
lea eax, [ebp - 0x64c]
push eax
sub esp, 0x18
lea eax, [ebp - 0x4cc]
mov ecx, esp
mov dword [ebp - 0x65c], esp
push eax
call fcn.00402370
sub esp, 0x18
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x484]
mov ecx, esp
push eax
call fcn.00402370
mov byte [ebp - 4], 6
call fcn.004084f0
mov esi, eax
add esp, 0x34
mov eax, dword [ebp - 0x68c]
cmp eax, dword [ebp - 0x688]
je 0x40b4ca
mov edx, dword [0x45e040]
mov ecx, 0x45e040
test edx, edx
je 0x40b4b2
nop dword [eax]
cmp edx, 0x17908
je 0x40b4b4
mov edx, dword [ecx + 0x14]
add ecx, 0x14
test edx, edx
jne 0x40b4a0
xor ecx, ecx
push ecx
push 4
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Status
add esp, 0x10
push dword [ebp - 0x64c]
push esi
push str.wmain
push str._ws____DoScan___returned__d__dwExitCode0x_08lx
call fcn.00408340
add esp, 0x10
push str.softwareFortinetFortiClientFA_VULN
push 0x80000002
mov dword [ebp - 0x648], 0
call sub.utilsdll.dll_reg_openkey
add esp, 8
mov dword [ebp - 0x65c], eax
test eax, eax
je 0x40b5d3
push 0
lea ecx, [ebp - 0x648]
push ecx
push str.exemptions
push eax
call sub.utilsdll.dll_reg_getmultistring
add esp, 0x10
test al, al
je 0x40b5c5
mov esi, dword [ebp - 0x648]
cmp word [esi], 0
je 0x40b5c5
nop dword [eax]
mov ecx, esi
mov dword [ebp - 0x444], 0
xor eax, eax
mov dword [ebp - 0x440], 7
mov word [ebp - 0x454], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b562
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x454]
call fcn.00404130
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0x22
push eax
mov ecx, 0x45f200
call fcn.00401eb0
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 6
call fcn.00403c50
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b5a7
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], ax
jne 0x40b540
push dword [ebp - 0x65c]
call sub.utilsdll.dll_reg_closekey
add esp, 4
mov ecx, dword [ebp - 0x678]
cmp edi, ecx
je 0x40baea
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
push esi
push str.wmain
push str._ws____doing_3rd_party_patches__count_d
mov dword [ebp - 0x690], esi
call fcn.00408340
mov ecx, dword [0x45e040]
add esp, 0xc
mov eax, 0x45e040
test ecx, ecx
je 0x40b632
nop dword [eax]
cmp ecx, 0x17908
je 0x40b634
mov ecx, dword [eax + 0x14]
add eax, 0x14
test ecx, ecx
jne 0x40b620
xor eax, eax
push eax
push 2
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Status
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0041ee20
xor ecx, ecx
add esp, 0x1c
mov dword [ebp - 0x654], ecx
test esi, esi
jle 0x40baad
nop dword [eax]
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x40b67a
mov eax, dword [edi]
push eax
push esi
push ecx
push str.wmain
push str._ws____3rd_party___d_of__d___hs
call fcn.00408340
add esp, 0x14
mov ecx, edi
cmp dword [edi + 0x14], 0x10
jb 0x40b699
mov ecx, dword [edi]
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
push ecx
cmovae eax, dword [ebp - 0x484]
push eax
push str._s_hs.json
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00409f70
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00429655
add esp, 0x1c
test eax, eax
je 0x40b6f8
lea eax, [ebp - 0x21c]
push eax
push str.wmain
push str._ws____3rd_party_patch_file_is_not_exist___s
call fcn.00408340
add esp, 0xc
jmp 0x40ba8f
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x40b702
mov eax, dword [edi]
push eax
call fcn.0042954f
add esp, 4
mov dword [ebp - 0x65c], eax
xor eax, eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 7
mov word [ebp - 0x454], ax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x45c], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b752
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x46c]
call fcn.00404130
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.00408f00
add esp, 8
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x46c]
call fcn.00403c50
push str.softwareFortinetFortiClientFA_VULN
push 0x80000002
mov dword [ebp - 0x678], 0
call sub.utilsdll.dll_reg_openkey
mov esi, eax
add esp, 8
test esi, esi
je 0x40b7ea
lea eax, [ebp - 0x678]
push eax
push str.exempt_no_auto_patch
push esi
call sub.utilsdll.dll_reg_getDWORD
add esp, 0xc
cmp dword [ebp - 0x678], 0
push esi
jne 0x40bb91
call sub.utilsdll.dll_reg_closekey
add esp, 4
push 0x35
push str.https:__www.fortiguard.com_product_encyclopedia_vuln_
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 0xf
mov byte [ebp - 0x4e4], 0
call fcn.00404040
cmp dword [edi + 0x14], 0x10
mov eax, edi
mov byte [ebp - 4], 0x25
jb 0x40b825
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x4e4]
push eax
call fcn.00403db0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x43c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x42c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0x27
call fcn.00403bf0
push 0x208
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0041ee20
mov esi, dword [ebp - 0x428]
lea edx, [ebp - 0x43c]
add esp, 0xc
cmp esi, 0x10
cmovae edx, dword [ebp - 0x43c]
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x40b8b0
sub edx, ecx
cmp esi, 0x10
lea ecx, [ebp - 0x43c]
cmovae ecx, dword [ebp - 0x43c]
lea eax, [edx + 1]
push eax
lea eax, [ebp - 0x424]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x428], 0x10
lea ecx, [ebp - 0x43c]
cmovae ecx, dword [ebp - 0x43c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b8f8
sub ecx, edx
xor eax, eax
mov word [ebp + ecx*2 - 0x424], ax
mov ecx, 0x45e040
mov eax, dword [0x45e040]
test eax, eax
je 0x40b931
nop dword [eax]
cmp eax, 0x1790a
je 0x40b933
mov eax, dword [ecx + 0x14]
add ecx, 0x14
test eax, eax
jne 0x40b920
xor ecx, ecx
cmp dword [ebp - 0x440], 8
lea eax, [ebp - 0x454]
push ecx
cmovae eax, dword [ebp - 0x454]
push eax
push 0
push 0
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x65c]
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Result
add esp, 0x30
lea ecx, [ebp - 0x574]
push str.___install_3rd_apps_json__
call fcn.00402400
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x28
push ecx
push eax
lea eax, [ebp - 0x544]
push eax
call fcn.00405ad0
push 0x449c68
push eax
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x29
push eax
call fcn.00405ad0
add esp, 0x18
lea ecx, [ebp - 0x4cc]
push eax
call fcn.00403250
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
lea ecx, [ebp - 0x544]
call fcn.00403c50
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0x27
call fcn.00403c50
lea eax, [ebp - 0x664]
mov dword [ebp - 0x664], 0
push eax
sub esp, 0x18
lea eax, [ebp - 0x4cc]
mov ecx, esp
mov dword [ebp - 0x458], esp
push eax
call fcn.00402370
sub esp, 0x18
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x484]
mov ecx, esp
push eax
call fcn.00402370
mov byte [ebp - 4], 0x27
call fcn.004084f0
push dword [ebp - 0x664]
push eax
push str.wmain
push str._ws____DoScan___returned__d__dwExitCode0x_08lx
call fcn.00408340
mov eax, dword [ebp - 0x664]
add esp, 0x44
movzx edx, byte [ebp - 0x64c]
test al, al
movzx ecx, al
mov ax, word [ebp - 0x662]
cmovne edx, ecx
or word [ebp - 0x64a], ax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 0x64c], dl
call fcn.00403bf0
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 6
call fcn.00403c50
mov esi, dword [ebp - 0x690]
mov ecx, dword [ebp - 0x654]
add edi, 0x18
inc ecx
mov dword [ebp - 0x66c], edi
mov dword [ebp - 0x654], ecx
cmp ecx, esi
jl 0x40b670
mov ecx, dword [0x45e040]
mov eax, 0x45e040
test ecx, ecx
je 0x40bad2
nop dword [eax]
cmp ecx, 0x17908
je 0x40bad4
mov ecx, dword [eax + 0x14]
add eax, 0x14
test ecx, ecx
jne 0x40bac0
xor eax, eax
push eax
push 4
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Status
add esp, 0x10
mov al, byte [ebp - 0x64a]
test al, 1
je 0x40bc53
push str.wmain
push str._ws____this_is_a_patch_scan_and_system_reboot_is_required__send_msg_to_tray_icon
call fcn.00408340
cmp dword [0x45f1c8], 0
mov ecx, 0x44a090
mov eax, str._n__u
cmove eax, ecx
push eax
push 0x18
push str.VcmPatch
call sub.utilsdll.dll_sch_set_run_once
add esp, 0x14
test eax, eax
jns 0x40bb48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.wmain
push str._ws____sch_set_run_once___failed__err_d
call fcn.00408340
add esp, 0xc
xor eax, eax
cmp dword [0x45f1cc], 2
sete al
add eax, 5
push eax
call sub.utilsdll.dll_SetGlobalRebootRequestFlag
push 6
push 0
call sub.utilsdll.dll_SendTrayRebootRequestPopup
movzx eax, al
push eax
push str.wmain
push str._ws____SendTrayRebootRequestPopup___returned__d
call fcn.00408340
add esp, 0x18
mov ecx, 0x45f1a0
push dword [ebp - 0x64c]
call fcn.00405930
jmp 0x40c5cb
call sub.utilsdll.dll_reg_closekey
mov esi, dword [0x45f200]
xor ecx, ecx
mov dword [ebp - 0x648], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [0x45f204]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40b7ea
xor edi, edi
nop dword [eax + eax]
cmp dword [esi + edi + 0x14], 8
lea ecx, [esi + edi]
jb 0x40bbdc
mov ecx, dword [ecx]
cmp dword [ebp - 0x440], 8
lea eax, [ebp - 0x454]
push ecx
cmovae eax, dword [ebp - 0x454]
push eax
call fcn.00431777
add esp, 8
test eax, eax
je 0x40bc39
mov ecx, dword [0x45f204]
mov eax, 0x2aaaaaab
mov esi, dword [0x45f200]
add edi, 0x18
inc dword [ebp - 0x648]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x648], eax
jb 0x40bbd0
mov edi, dword [ebp - 0x66c]
jmp 0x40b7ea
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 6
call fcn.00403c50
mov edi, dword [ebp - 0x66c]
jmp 0x40ba89
test al, 2
je 0x40bdb2
lea eax, [ebp - 0x4b4]
push eax
call fcn.00407df0
add esp, 4
lea ecx, [ebp - 0x484]
push eax
call fcn.00403250
lea ecx, [ebp - 0x4b4]
call fcn.00403c50
lea eax, [ebp - 0x544]
push eax
call fcn.00408d30
push str.Install.json
push eax
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x2b
push eax
call fcn.00405ad0
add esp, 0x10
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0x2d
call fcn.00403c50
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
cmovae eax, dword [ebp - 0x484]
push eax
push str.wmain
push str._ws____this_is_final_scan_after_patching__working_folder:__s
call fcn.00408340
add esp, 0xc
lea ecx, [ebp - 0x4cc]
push 3
push 0x44a204
call fcn.00404130
cmp dword [0x45e008], 0
je 0x40bd09
push 3
push 0x449b34
lea ecx, [ebp - 0x4cc]
call fcn.00403f00
push dword [section..data]
mov ecx, 0x45f1a0
push 1
call fcn.00405970
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x66c], 0
push eax
sub esp, 0x18
lea eax, [ebp - 0x4cc]
mov ecx, esp
mov dword [ebp - 0x458], esp
push eax
call fcn.00402370
sub esp, 0x18
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x484]
mov ecx, esp
push eax
call fcn.00402370
mov byte [ebp - 4], 0x2d
call fcn.004084f0
push dword [ebp - 0x66c]
push eax
push str.wmain
push str._ws____DoScan___returned__d__dwExitCode0x_08lx
call fcn.00408340
mov eax, dword [ebp - 0x66c]
add esp, 0x44
movzx edx, byte [ebp - 0x64c]
test al, al
movzx ecx, al
mov ax, word [ebp - 0x66a]
cmovne edx, ecx
or word [ebp - 0x64a], ax
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 0x64c], dl
mov byte [ebp - 4], 6
call fcn.00403c50
push 0
call fcn.0043170c
mov cl, byte [ebp - 0x64c]
add esp, 4
mov edi, eax
mov dword [ebp - 0x664], edi
cmp cl, 0x64
jbe 0x40bddd
cmp cl, 0x68
je 0x40bddd
cmp cl, 0x67
jne 0x40c5cb
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x4b8], 8
lea ecx, [ebp - 0x4cc]
mov eax, dword [ebp - 0x4bc]
cmovae ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0x654], ecx
cmp eax, 2
jb 0x40bf10
dec eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x65c], eax
nop dword [eax + eax]
sub eax, ecx
sar eax, 1
je 0x40bf0a
cmp word [ecx], 0x2d
je 0x40be38
add ecx, 2
sub eax, 1
jmp 0x40be24
test ecx, ecx
je 0x40bf0a
mov edx, 0x44a20c
mov edi, ecx
mov esi, 2
sub edi, edx
nop
mov ax, word [edi + edx]
cmp ax, word [edx]
jne 0x40bea1
add edx, 2
sub esi, 1
jne 0x40be50
sub ecx, dword [ebp - 0x654]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x40bf0a
xor eax, eax
mov dword [ebp - 0x444], 0
lea edx, [ecx + 2]
mov word [ebp - 0x454], ax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x440], 7
cmp eax, edx
jae 0x40beb3
call fcn.00403cd0
xor al, al
jne 0x40be61
mov eax, dword [ebp - 0x65c]
add ecx, 2
jmp 0x40be20
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [ebp - 0x4b8], 8
lea eax, [ebp - 0x4cc]
cmovae eax, dword [ebp - 0x4cc]
push ecx
lea ecx, [ebp - 0x454]
lea eax, [eax + edx*2]
push eax
call fcn.00404130
cmp dword [ebp - 0x440], 8
lea eax, [ebp - 0x454]
cmovae eax, dword [ebp - 0x454]
push eax
call fcn.00429525
add esp, 4
lea ecx, [ebp - 0x454]
call fcn.00403c50
mov edi, dword [ebp - 0x664]
mov eax, dword [0x45e040]
mov esi, 0x45e040
mov dword [ebp - 0x648], esi
test eax, eax
je 0x40bf3b
cmp eax, 0x17909
je 0x40bf45
mov eax, dword [esi + 0x14]
add esi, 0x14
mov dword [ebp - 0x648], esi
test eax, eax
jne 0x40bf24
mov dword [ebp - 0x648], 0
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
lea ecx, [ebp - 0x644]
cmovae eax, dword [ebp - 0x484]
push eax
call fcn.00410f40
push 0x4487cc
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0x2f
call fcn.00402400
sub edi, dword [ebp - 0x674]
lea eax, [ebp - 0x4e4]
push edi
push eax
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0x30
call fcn.004163c0
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 0x64d], al
mov byte [ebp - 4], 0x2f
call fcn.00403c50
cmp byte [ebp - 0x64d], 0
jne 0x40bfc1
push str.createSummaryJSON___failed
call fcn.00408340
add esp, 4
mov eax, dword [ebp - 0x644]
mov esi, dword [eax]
cmp esi, eax
je 0x40c423
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0041ee20
push dword [esi + 0x14]
lea eax, [ebp - 0x21c]
push dword [esi + 0x10]
push 0x449a10
push str._s_d
push 0x104
push eax
call fcn.00409f70
add esp, 0x24
lea ecx, [ebp - 0x810]
push 1
push 3
call fcn.00402450
mov eax, dword [esi + 0x114]
mov byte [ebp - 4], 0x31
mov ecx, dword [eax]
mov dword [ebp - 0x654], ecx
cmp ecx, eax
je 0x40c076
nop dword [eax]
mov eax, dword [ecx + 0x20]
add ecx, 0x10
cmp dword [ecx + 0x14], 0x10
jb 0x40c03e
mov ecx, dword [ecx]
push 0x449a88
push eax
push ecx
lea eax, [ebp - 0x800]
push eax
call fcn.00401920
add esp, 0xc
push eax
call fcn.00401150
add esp, 8
lea ecx, [ebp - 0x654]
call fcn.00412920
mov ecx, dword [ebp - 0x654]
cmp ecx, dword [esi + 0x114]
jne 0x40c030
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x518], 0xf
mov byte [ebp - 0x52c], 0
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x810]
call fcn.00405240
lea ecx, [ebp - 0x4b4]
mov edi, dword [eax + 0x10]
call fcn.00403bf0
test edi, edi
je 0x40c19c
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x810]
call fcn.00405240
mov edi, eax
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0x810]
call fcn.00405240
mov edi, dword [edi + 0x10]
dec edi
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0xf
mov byte [ebp - 0x454], 0
mov ecx, dword [eax + 0x10]
mov byte [ebp - 4], 0x34
cmp ecx, edi
jb 0x40c6f1
sub ecx, edi
or edx, 0xffffffff
cmp ecx, 0xffffffff
cmovb edx, ecx
cmp dword [eax + 0x14], 0x10
jb 0x40c128
mov eax, dword [eax]
push edx
add eax, edi
lea ecx, [ebp - 0x454]
push eax
call fcn.00404040
lea ecx, [ebp - 0x52c]
call fcn.00403bf0
movups xmm0, xmmword [ebp - 0x454]
lea ecx, [ebp - 0x454]
mov byte [ebp - 0x454], 0
movups xmmword [ebp - 0x52c], xmm0
movq xmm0, qword [ebp - 0x444]
movq qword [ebp - 0x51c], xmm0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0xf
call fcn.00403bf0
lea ecx, [ebp - 0x4b4]
call fcn.00403bf0
lea ecx, [ebp - 0x544]
call fcn.00403bf0
xor eax, eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 7
mov word [ebp - 0x43c], ax
mov edi, dword [ebp - 0x518]
lea eax, [ebp - 0x52c]
mov ecx, dword [ebp - 0x52c]
cmp edi, 0x10
mov byte [ebp - 4], 0x35
cmovae eax, ecx
cmp dword [ebp - 0x51c], 1
jne 0x40c203
push 1
push 0x449a88
push eax
call fcn.00409d00
add esp, 0xc
test eax, eax
jne 0x40c1fd
lea eax, [ebp - 0x43c]
jmp 0x40c2af
mov ecx, dword [ebp - 0x52c]
push 0
push 0
cmp edi, 0x10
lea eax, [ebp - 0x52c]
push 0xffffffffffffffff
cmovae eax, ecx
push eax
push 0
push 0
mov dword [ebp - 0x65c], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x674], eax
push 2
test eax, eax
jle 0x40c25c
push eax
call fcn.00422f25
mov edi, eax
add esp, 8
test edi, edi
je 0x40c29b
push dword [ebp - 0x674]
push edi
push 0xffffffffffffffff
push dword [ebp - 0x65c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x40c271
push 1
call fcn.00422f25
mov edi, eax
add esp, 8
test edi, edi
je 0x40c29b
xor eax, eax
mov word [edi], ax
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c276
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x43c]
call fcn.00404130
push edi
call fcn.00422f30
add esp, 4
cmp dword [ebp - 0x428], 8
lea eax, [ebp - 0x43c]
cmovae eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x608], 8
lea ecx, [ebp - 0x61c]
cmovae ecx, dword [ebp - 0x61c]
cmp dword [ebp - 0x620], 8
mov dword [ebp - 0x674], ecx
lea ecx, [ebp - 0x634]
cmovae ecx, dword [ebp - 0x634]
cmp dword [esi + 0x110], 8
mov dword [ebp - 0x65c], ecx
lea ecx, [esi + 0xfc]
mov dword [ebp - 0x654], ecx
jb 0x40c300
mov ecx, dword [ecx]
mov dword [ebp - 0x654], ecx
cmp dword [esi + 0xb0], 8
lea ecx, [esi + 0x9c]
jb 0x40c311
mov ecx, dword [ecx]
cmp dword [esi + 0x80], 8
lea edi, [esi + 0x6c]
jb 0x40c31f
mov edi, dword [edi]
cmp dword [esi + 0x50], 8
lea edx, [esi + 0x3c]
jb 0x40c32a
mov edx, dword [edx]
push dword [ebp - 0x648]
push eax
push dword [ebp - 0x674]
lea eax, [ebp - 0x21c]
push dword [ebp - 0x65c]
push eax
push dword [ebp - 0x654]
push ecx
push edi
push edx
push dword [esi + 0x10]
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Result
add esp, 0x30
lea ecx, [ebp - 0x43c]
call fcn.00403c50
lea ecx, [ebp - 0x52c]
call fcn.00403bf0
mov eax, dword [ebp - 0x810]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x814], eax
lea ecx, [ebp - 0x7f8]
call fcn.00402e80
lea ecx, [ebp - 0x7f0]
call fcn.00402d50
lea eax, [ebp - 0x7a8]
mov byte [ebp - 4], 0x36
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041df9c
add esp, 4
mov byte [ebp - 4], 0x2f
cmp byte [esi + 0xd], 0
jne 0x40c417
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x40c3fc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x40c417
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x40c3f0
jmp 0x40c417
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x40c415
cmp esi, dword [eax + 8]
jne 0x40c415
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x40c405
mov esi, eax
cmp esi, dword [ebp - 0x644]
jne 0x40bfd1
push 0
call fcn.0043170c
push eax
call sub.utilsdll.dll_cfg_set_vuln_last_scan_time
mov ecx, dword [0x45e040]
add esp, 8
mov eax, 0x45e040
test ecx, ecx
je 0x40c454
cmp ecx, 0x17908
je 0x40c456
mov ecx, dword [eax + 0x14]
add eax, 0x14
test ecx, ecx
jne 0x40c442
xor eax, eax
push eax
xor eax, eax
cmp dword [0x45f1cc], 1
setne al
add eax, 3
push eax
push 0x45ef88
push dword [0x45ef80]
call sub.utilsdll.dll_log_VULN_Status
mov eax, dword [0x45f1cc]
add esp, 0x10
cmp eax, 1
je 0x40c489
cmp eax, 2
jne 0x40c4a3
push 0
push 0
push 0
push 0x1f
push 0x80d1
push str..pipeFC_886C0338_4742_41e3_B721_9BAB02678391
call sub.utilsdll.dll_MsgPipe_PostMessage
add esp, 0x18
push str.logs_vcm_
lea eax, [ebp - 0x4b4]
push 0x45f1e8
push eax
call fcn.00405b40
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x37
jb 0x40c4c8
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.00410f40
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 0x39
call fcn.00403c50
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.00419db0
push str.PatchedByProduct.json
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00405b40
add esp, 0xc
cmp dword [ebp - 0x444], 0
mov byte [ebp - 4], 0x3b
je 0x40c580
cmp dword [ebp - 0x428], 8
lea ecx, [ebp - 0x43c]
push 0
cmovae ecx, dword [ebp - 0x43c]
lea eax, [ebp - 0x454]
cmp dword [ebp - 0x440], 8
push ecx
cmovae eax, dword [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40c580
cmp dword [ebp - 0x428], 8
lea eax, [ebp - 0x43c]
cmovae eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_create_patched_vid_file__err_d___s
call fcn.00408340
add esp, 0xc
cmp dword [ebp - 0x440], 8
lea eax, [ebp - 0x454]
cmovae eax, dword [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x43c]
call fcn.00403c50
lea ecx, [ebp - 0x454]
call fcn.00403c50
lea ecx, [ebp - 0x5dc]
call fcn.00411a80
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 6
call fcn.00411a80
xor esi, esi
mov eax, dword [0x45f19c]
test eax, eax
je 0x40c5ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call sub.utilsdll.dll_signal_scheduler
mov dword [0x45f19c], 0
mov eax, dword [0x45ef80]
test eax, eax
je 0x40c608
push eax
call sub.utilsdll.dll_log_deinitialize
add esp, 4
mov dword [0x45ef80], 0
mov eax, dword [0x45f194]
test eax, eax
je 0x40c618
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45e004], 0
jne 0x40c655
cmp dword [0x45e020], 8
mov eax, 0x45e00c
cmovae eax, dword [0x45e00c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x45e038], 8
mov eax, 0x45e024
cmovae eax, dword [0x45e024]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x6a4]
test eax, eax
je 0x40c666
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x67c]
test eax, eax
je 0x40c677
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64c]
mov ecx, 0x45f1a0
call fcn.00405930
lea ecx, [ebp - 0x6a0]
call fcn.00407c80
lea ecx, [ebp - 0x68c]
call fcn.00407c80
lea ecx, [ebp - 0x484]
call fcn.00403c50
lea ecx, [ebp - 0x49c]
call fcn.00403c50
lea ecx, [ebp - 0x4cc]
call fcn.00403c50
lea ecx, [ebp - 0x55c]
call fcn.00403c50
lea ecx, [ebp - 0x4fc]
call fcn.00403c50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c1e0
mov esp, ebp
pop ebp
ret
call fcn.00403cd0
nop
pop eax
mov dword [-1569587136], eax
inc eax
add byte [esi + 0x470040a2], al
mov dword [0xa3850040], eax
inc eax
add bh, ah
mov byte [0xa1dd0040], al
inc eax
add byte [eax], ch
mov byte [0xa3b20040], al
inc eax
add cl, cl
mov dword [0x9000040], eax
or dword [ecx], eax
add cl, byte [ecx]
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ebx], eax
add al, 5
or dword [ecx], ecx
push es
pop es
or byte [edi], cl
pop ds
add byte [ebx], cl
cmpsb byte [esi], byte es:[edi]
inc eax
add cl, bh
movsd dword es:[edi], dword [esi]
inc eax
add bh, ah
movsd dword es:[edi], dword [esi]
inc eax
add ch, dl
movsd dword es:[edi], dword [esi]
inc eax
add bl, al
movsd dword es:[edi], dword [esi]
inc eax
add ah, cl
int3