Function at 0x4398ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58e1f2
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x76c], ecx
mov dword [ebp - 0x768], 0
call fcn.00402270
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
movzx edx, word [ebp + 0xc]
push edx
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.004418d0
test eax, eax
jne 0x438f9b
xor eax, eax
jmp 0x43a6b2
push 0x5f4e38
push 0x5f4ea8
call fcn.0040c230
add esp, 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x5c], 1
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x58]
call fcn.004370d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x76c]
add ecx, 4
call fcn.004373f0
movzx edx, al
test edx, edx
je 0x43a454
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.00441c00
lea ecx, [ebp - 0xbc]
call fcn.00406020
mov byte [ebp - 4], 1
push 0x10
mov ecx, dword [ebp - 0x51]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.00408360
lea ecx, [ebp - 0x9c]
call fcn.00418b60
mov byte [ebp - 4], 2
lea edx, [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0x41]
push eax
mov ecx, dword [ebp - 0x4d]
push ecx
call fcn.00491a40
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.00406020
mov byte [ebp - 4], 3
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xc0], 0
movzx edx, byte [ebp - 0x58]
cmp edx, 2
jne 0x43949b
push str.TIP:_Begin_ConfQuery_...
push 0x5f4f0c
call fcn.0040c230
add esp, 8
mov byte [ebp - 0xe0], 0
xor eax, eax
mov dword [ebp - 0xdf], eax
mov dword [ebp - 0xdb], eax
mov dword [ebp - 0xd7], eax
mov word [ebp - 0xd3], ax
mov byte [ebp - 0xd1], al
call fcn.00402270
mov dword [ebp - 0xd0], eax
movzx ecx, word [ebp - 0x57]
mov dword [ebp - 0x770], ecx
mov edx, dword [ebp - 0x770]
sub edx, 1
mov dword [ebp - 0x770], edx
cmp dword [ebp - 0x770], 0x1e
ja case.0x4390e5.6
mov eax, dword [ebp - 0x770]
movzx ecx, byte [eax + 0x43a714]
jmp dword [ecx*4 + 0x43a6d4]
push 0x5f4f38
push 0x5f4f78
call fcn.0040c230
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.00491280
push 0x5f4fa4
push 0x5f4fe0
call fcn.0040c230
add esp, 8
push str.TIP:_Begin_LoadCnntWhiteList_...
push 0x5f5058
call fcn.0040c230
add esp, 8
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043a7b0
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadCnntWhiteList_...
push 0x5f50cc
call fcn.0040c230
add esp, 8
push 0x5f50f8
push 0x5f5138
call fcn.0040c230
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.00438bc0
push eax
call fcn.00402a70
mov ecx, eax
call fcn.00491220
push 0x5f5164
push 0x5f51a0
call fcn.0040c230
add esp, 8
jmp 0x439496
push str.TIP:_Begin_StopSelfLearn_...
push 0x5f520c
call fcn.0040c230
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.00491280
push str.TIP:_End_StopSelfLearn_...
push 0x5f5274
call fcn.0040c230
add esp, 8
push str.TIP:_Begin_LoadLocalPortWhiteList_...
push 0x5f52f0
call fcn.0040c230
add esp, 8
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043b010
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadLocalPortWhiteList_...
push 0x5f536c
call fcn.0040c230
add esp, 8
push str.TIP:_Begin_StartSelfLearn_...
push 0x5f53d8
call fcn.0040c230
add esp, 8
call fcn.00402a70
mov ecx, eax
call fcn.00438bc0
push eax
call fcn.00402a70
mov ecx, eax
call fcn.00491220
push str.TIP:_End_StartSelfLearn_...
push 0x5f5440
call fcn.0040c230
add esp, 8
jmp 0x439496
push str.TIP:_Begin_LoadFileMonList_...
push 0x5f54b4
call fcn.0040c230
add esp, 8
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043b660
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadFileMonList_...
push 0x5f5520
call fcn.0040c230
add esp, 8
jmp 0x439496
push 0xa
lea edx, [ebp - 0xe0]
push edx
mov eax, dword [0x6414c4]
push eax
call fcn.00440b50
add esp, 0xc
lea ecx, [ebp - 0xe0]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00406110
jmp 0x439496
push 0xa
lea edx, [ebp - 0xe0]
push edx
mov eax, dword [0x6414c8]
push eax
call fcn.00440b50
add esp, 0xc
lea ecx, [ebp - 0xe0]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00406110
jmp 0x439496
push str.TIP:_Begin_LoadUSBStatus_...
push 0x5f558c
call fcn.0040c230
add esp, 8
mov edx, dword [0x64065c]
and edx, 0xf
cmp edx, 2
jb 0x43930a
lea eax, [ebp - 0x80]
push eax
call fcn.00496080
add esp, 4
mov dword [ebp - 0xa0], eax
jmp 0x43931c
lea ecx, [ebp - 0x80]
push ecx
call fcn.00496240
add esp, 4
mov dword [ebp - 0xa0], eax
push str.TIP:_End_LoadUSBStatus_...
push str.CNetCmdConfigMgr::NetTaskCallbackRoutine
call fcn.0040c230
add esp, 8
jmp 0x439496
mov edx, dword [0x64065c]
and edx, 0xf
cmp edx, 2
jb 0x439355
lea eax, [ebp - 0x80]
push eax
call fcn.004a0880
add esp, 4
mov dword [ebp - 0xa0], eax
jmp 0x439388
lea ecx, [ebp - 0xe5]
call fcn.0047c500
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0xe5]
call fcn.0049d530
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe5]
call fcn.00495d30
jmp 0x439496
mov dword [ebp - 0xec], 0
lea edx, [ebp - 0xec]
push edx
call fcn.0049d340
add esp, 4
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xec], 0
je 0x4393c1
mov dword [ebp - 0x774], 0x5f5620
jmp 0x4393cb
mov dword [ebp - 0x774], 0x5f5624
mov eax, dword [ebp - 0x774]
push eax
lea ecx, [ebp - 0x80]
call fcn.00406110
jmp 0x439496
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043bac0
mov dword [ebp - 0xa0], eax
jmp 0x439496
push 0
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043bfe0
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x5c], 0
jmp 0x439496
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043c4e0
mov dword [ebp - 0xa0], eax
jmp 0x439496
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043e7c0
mov dword [ebp - 0xa0], eax
jmp 0x439496
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043f7b0
mov dword [ebp - 0xa0], eax
jmp 0x439496
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043e940
mov dword [ebp - 0xa0], eax
jmp 0x439496
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043f9e0
mov dword [ebp - 0xa0], eax
jmp 0x439496
mov dword [ebp - 0xa0], 2
jmp 0x43a222
movzx edx, byte [ebp - 0x58]
cmp edx, 3
jne 0x43a218
mov byte [ebp - 0xf1], 1
lea ecx, [ebp - 0x110]
call fcn.00406020
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0xf0], eax
movzx eax, word [ebp - 0x57]
mov dword [ebp - 0x778], eax
mov ecx, dword [ebp - 0x778]
sub ecx, 1
mov dword [ebp - 0x778], ecx
cmp dword [ebp - 0x778], 0x1e
ja case.0x4394f6.6
mov edx, dword [ebp - 0x778]
jmp dword [edx*4 + 0x43a734]
call fcn.00402a70
mov ecx, eax
call fcn.00491280
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043adb0
mov dword [ebp - 0xa0], eax
call fcn.00402a70
mov ecx, eax
call fcn.00438bc0
push eax
call fcn.00402a70
mov ecx, eax
call fcn.00491220
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439558
push str.network_whitelist_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439568
push 0x5f5644
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
call fcn.00402a70
mov ecx, eax
call fcn.00491280
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043b390
mov dword [ebp - 0xa0], eax
call fcn.00402a70
mov ecx, eax
call fcn.00438bc0
push eax
call fcn.00402a70
mov ecx, eax
call fcn.00491220
cmp dword [ebp - 0xf0], 0x1b5
jne 0x4395c8
push str.port_whitelist_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x4395d8
push 0x5f566c
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043b7d0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439613
push str.key_files_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439623
push 0x5f5690
lea ecx, [ebp - 0x110]
call fcn.00406110
cmp dword [ebp - 0xa0], 0
jne 0x439665
call fcn.00402dc0
mov ecx, eax
call fcn.004588c0
mov ecx, 0x6412b4
call fcn.00406290
push eax
call fcn.0048bec0
add esp, 4
test eax, eax
jne 0x439659
mov dword [ebp - 0xa0], 9
call fcn.00402dc0
mov ecx, eax
call fcn.004583e0
jmp 0x439e8b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x69c], esp
lea eax, [ebp - 0x9c]
push eax
call fcn.00408070
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043a9e0
mov dword [ebp - 0x780], eax
mov ecx, dword [ebp - 0x780]
mov dword [ebp - 0xa0], ecx
cmp dword [ebp - 0xf0], 0x1b5
jne 0x4396c2
push str.optical_drive_check_cycle_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x4396d2
push 0x5f56c4
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6a0], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x784], eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043ab00
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x43972f
push str.illegal_port_check_cycle_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x43973f
push 0x5f5700
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
mov ecx, dword [0x64065c]
and ecx, 0xf
cmp ecx, 2
jb 0x439761
mov dword [ebp - 0xa0], 0
jmp 0x439805
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6a4], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x78c], eax
call fcn.00495d50
add esp, 0x1c
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0xa0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6a8], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x794], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.004159d0
add esp, 0x20
mov dword [ebp - 0x798], eax
mov byte [ebp - 4], 6
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6ac], esp
lea edx, [ebp - 0x12c]
push edx
call fcn.00406090
mov dword [ebp - 0x79c], eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043e220
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x12c]
call fcn.004060d0
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439823
push str.USB_status_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439833
push 0x5f572c
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
mov eax, dword [0x64065c]
and eax, 0xf
cmp eax, 2
jb 0x439880
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6b0], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7a0], eax
call fcn.00496920
add esp, 0x20
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xa0], eax
jmp 0x4398b9
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6b4], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7a8], eax
call fcn.00499740
add esp, 0x20
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x4398d7
push str.add_firewall_rule
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x4398e7
push 0x5f5750
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
mov ecx, dword [0x64065c]
and ecx, 0xf
cmp ecx, 2
jb 0x439935
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6b8], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7b0], eax
call fcn.00496920
add esp, 0x20
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xa0], eax
jmp 0x43996e
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6bc], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7b8], eax
call fcn.00499740
add esp, 0x20
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x43998c
push str.delete_firewall_rules
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x43999c
push 0x5f5778
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
mov ecx, dword [ebp - 0x41]
push ecx
mov edx, dword [ebp - 0x4d]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043dd00
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x4399ca
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xf0], 0x1b5
jne 0x4399e8
push 0x5f5788
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x4399f8
push 0x5f5790
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c0], esp
lea eax, [ebp - 0x9c]
push eax
call fcn.00408070
mov dword [ebp - 0x7c0], eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043deb0
mov dword [ebp - 0x7c4], eax
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp - 0xa0], ecx
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439a55
push str.change_password
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439a65
push 0x5f57a8
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c4], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7c8], eax
lea eax, [ebp - 0x148]
push eax
call fcn.004159d0
add esp, 0x20
mov dword [ebp - 0x7cc], eax
mov byte [ebp - 4], 7
push 0x5f57b4
lea ecx, [ebp - 0x148]
push ecx
call fcn.00407ad0
add esp, 8
mov byte [ebp - 0x149], al
movzx edx, byte [ebp - 0x149]
push edx
call fcn.0049d230
add esp, 4
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439aee
push str.firewall_status_change
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439afe
push 0x5f57d0
lea ecx, [ebp - 0x110]
call fcn.00406110
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x148]
call fcn.004060d0
jmp 0x439e8b
mov eax, dword [0x64065c]
and eax, 0xf
cmp eax, 2
jb 0x439b5a
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c8], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7d0], eax
call fcn.00496920
add esp, 0x20
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0xa0], eax
jmp 0x439b93
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6cc], esp
lea edx, [ebp - 0x9c]
push edx
call fcn.00408070
mov dword [ebp - 0x7d8], eax
call fcn.00499740
add esp, 0x20
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439bb1
push str.edit_firewall_rule
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439bc1
push 0x5f57f8
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043bec0
mov dword [ebp - 0xa0], eax
push 0x5f5808
lea ecx, [ebp - 0x6ec]
call fcn.00406230
mov dword [ebp - 0x7e0], eax
mov edx, dword [ebp - 0x7e0]
mov dword [ebp - 0x7e4], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x768]
or eax, 1
mov dword [ebp - 0x768], eax
mov ecx, dword [ebp - 0x7e4]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.00440b70
add esp, 8
movzx eax, al
test eax, eax
je 0x439c45
cmp dword [ebp - 0xa0], 0
jne 0x439c45
mov dword [ebp - 0x7e8], 1
jmp 0x439c4f
mov dword [ebp - 0x7e8], 0
mov cl, byte [ebp - 0x7e8]
mov byte [ebp - 0x6cd], cl
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x768]
and edx, 1
je 0x439c7f
and dword [ebp - 0x768], 0xfffffffe
lea ecx, [ebp - 0x6ec]
call fcn.00406270
movzx eax, byte [ebp - 0x6cd]
test eax, eax
je 0x439c8f
call fcn.004a10d0
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439cad
push str.process_protect_mode_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439cbd
push 0x5f582c
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
push 0
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043c3b0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439cfa
push str.add_process_whitelist
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439d0a
push 0x5f5858
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
push 1
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043c3b0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439d47
push str.remove_process_whitelist
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439d57
push 0x5f5884
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043cbd0
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439d92
push str.firewall_attribute_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439da2
push 0x5f58b0
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043d670
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x439dcc
mov byte [ebp - 0x15], 1
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439dea
push str.report_parameters_changed
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439dfa
push 0x5f58dc
lea ecx, [ebp - 0x110]
call fcn.00406110
jmp 0x439e8b
mov ecx, dword [ebp - 0x76c]
call fcn.0043da60
mov dword [ebp - 0xa0], eax
jmp 0x439e8b
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043e700
mov dword [ebp - 0xa0], eax
jmp 0x439e8b
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x76c]
call fcn.0043f920
mov dword [ebp - 0xa0], eax
jmp 0x439e8b
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043f080
mov dword [ebp - 0xa0], eax
jmp 0x439e8b
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x76c]
call fcn.0043fac0
mov dword [ebp - 0xa0], eax
jmp 0x439e8b
mov dword [ebp - 0xa0], 2
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x43a03a
lea ecx, [ebp - 0x14a]
call fcn.0047c500
mov byte [ebp - 4], 9
mov dword [ebp - 0x16c], 0
lea ecx, [ebp - 0x168]
call fcn.00406020
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x14a]
call fcn.0041f970
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6f0], esp
lea edx, [ebp - 0x168]
push edx
call fcn.00406090
mov dword [ebp - 0x7ec], eax
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x14a]
call fcn.0041fb50
mov byte [ebp - 0x7ed], al
movzx ecx, byte [ebp - 0x7ed]
test ecx, ecx
je 0x43a01c
lea ecx, [ebp - 0x1fc]
call fcn.00481e20
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0xf0], 0x1b5
jne 0x439f76
push 0x5f58ec
lea ecx, [ebp - 0x1e0]
call fcn.00406110
cmp dword [ebp - 0xa0], 0
jne 0x439f58
mov dword [ebp - 0x7f4], 0x5f5900
jmp 0x439f62
mov dword [ebp - 0x7f4], 0x5f5908
mov edx, dword [ebp - 0x7f4]
push edx
lea ecx, [ebp - 0x1a8]
call fcn.00406110
jmp 0x439fb7
push 0x5f5910
lea ecx, [ebp - 0x1e0]
call fcn.00406110
cmp dword [ebp - 0xa0], 0
jne 0x439f9b
mov dword [ebp - 0x7f8], 0x5f591c
jmp 0x439fa5
mov dword [ebp - 0x7f8], 0x5f5924
mov eax, dword [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00406110
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.004060f0
push 0x59a9b2
lea ecx, [ebp - 0x18c]
call fcn.00406110
lea edx, [ebp - 0x1fc]
push edx
mov eax, dword [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x14a]
call fcn.0041fc30
cmp dword [ebp - 0x16c], 0
je 0x43a00d
mov ecx, dword [ebp - 0x16c]
push ecx
lea ecx, [ebp - 0x14a]
call fcn.0041fc00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1fc]
call fcn.004691f0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x168]
call fcn.004060d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14a]
call fcn.00495d30
movzx edx, word [ebp - 0x57]
cmp edx, 0xf
je 0x43a050
movzx eax, word [ebp - 0x57]
cmp eax, 0x10
jne 0x43a207
lea ecx, [ebp - 0x220]
call fcn.00406020
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x76c]
call fcn.0043bfe0
xor edx, edx
mov word [ebp - 0x42c], dx
push 0x206
push 0
lea eax, [ebp - 0x42a]
push eax
call fcn.00568440
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x42c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x204], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x204], 0
je 0x43a1f8
cmp dword [ebp - 0x200], 0x7a
je 0x43a1f8
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.proc_list.txt
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00402270
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x434], 0
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x438], ecx
cmp dword [ebp - 0x438], 0
jne 0x43a127
mov dword [ebp - 0x7fc], 0
jmp 0x43a19d
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x3fffffff
jle 0x43a155
mov dword [ebp - 0x800], 0
jmp 0x43a191
mov eax, dword [ebp - 0x430]
shl eax, 1
call fcn.00570840
mov dword [ebp - 0x804], esp
mov eax, dword [ebp - 0x43c]
push eax
mov ecx, dword [ebp - 0x430]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x804]
push eax
call fcn.004022d0
mov dword [ebp - 0x800], eax
mov ecx, dword [ebp - 0x800]
mov dword [ebp - 0x7fc], ecx
push 0x5f5948
mov edx, dword [ebp - 0x7fc]
push edx
call fcn.00562a9d
add esp, 8
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x43a1f8
mov eax, dword [ebp - 0x434]
push eax
push 1
lea ecx, [ebp - 0x220]
call fcn.004061b0
push eax
lea ecx, [ebp - 0x220]
call fcn.00406190
push eax
call fcn.00562c16
add esp, 0x10
mov ecx, dword [ebp - 0x434]
push ecx
call fcn.00562d0f
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x220]
call fcn.004060d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x110]
call fcn.004060d0
jmp 0x43a222
mov dword [ebp - 0xa0], 2
lea ecx, [ebp - 0x80]
call fcn.004061b0
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x43a3df
cmp dword [ebp - 0x5c], 0
je 0x43a3df
mov edx, dword [ebp - 0xc4]
push edx
lea ecx, [ebp - 0x80]
call fcn.00406190
push eax
call fcn.0042bc30
add esp, 8
test eax, eax
jne 0x43a3c2
lea ecx, [ebp - 0x444]
call fcn.0042eca0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0xc4]
add eax, 1
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
push ecx
lea ecx, [ebp - 0x444]
call fcn.00405fe0
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x43a2ec
mov edx, dword [ebp - 0x450]
shl edx, 1
push edx
push 0
mov eax, dword [ebp - 0x448]
push eax
call fcn.00568440
add esp, 0xc
mov ecx, dword [ebp - 0x450]
push ecx
mov edx, dword [ebp - 0x448]
push edx
lea ecx, [ebp - 0x80]
call fcn.00406190
push eax
call fcn.00491d10
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x444]
call fcn.0042e5a0
lea ecx, [ebp - 0x44c]
call fcn.0042eca0
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xc4]
imul eax, eax, 3
add eax, 1
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0042e5f0
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
je 0x43a370
mov edx, dword [ebp - 0x454]
push edx
push 0
mov eax, dword [ebp - 0x458]
push eax
call fcn.00568440
add esp, 0xc
mov ecx, dword [ebp - 0x454]
push ecx
mov edx, dword [ebp - 0x458]
push edx
mov eax, dword [ebp - 0x448]
push eax
call fcn.00491c30
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x44c]
call fcn.0042e610
lea ecx, [ebp - 0x44c]
call fcn.00406000
test eax, eax
je 0x43a3a4
lea ecx, [ebp - 0x44c]
call fcn.004027c0
push eax
lea ecx, [ebp - 0x80]
call fcn.00406110
lea ecx, [ebp - 0x44c]
call fcn.00406000
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x44c]
call fcn.0042ecc0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x444]
call fcn.0042ecc0
lea ecx, [ebp - 0x80]
call fcn.004061b0
push eax
lea ecx, [ebp - 0x80]
call fcn.0042e660
push eax
lea ecx, [ebp - 0xbc]
call fcn.00408360
cmp dword [ebp - 0xc4], 0
je 0x43a3fd
cmp dword [ebp - 0x5c], 0
jne 0x43a3fd
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.00408120
lea ecx, [ebp - 0xbc]
call fcn.0042e660
push eax
lea ecx, [ebp - 0xbc]
call fcn.004061b0
push eax
movzx edx, word [ebp - 0xa0]
push edx
movzx eax, byte [ebp - 0x58]
push eax
call fcn.00432500
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.004060d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c]
call fcn.00406270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.004060d0
cmp dword [ebp - 0x14], 0
jne 0x43a466
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43a693
xor edx, edx
mov word [ebp - 0x664], dx
push 0x206
push 0
lea eax, [ebp - 0x662]
push eax
call fcn.00568440
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x664]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x66c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x66c], 0
je 0x43a693
cmp dword [ebp - 0x668], 0x7a
je 0x43a693
lea edx, [ebp - 0x664]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.00402270
mov dword [ebp - 0x694], eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0
jne 0x43a4fe
mov dword [ebp - 0x808], 0
jmp 0x43a574
mov ecx, dword [ebp - 0x690]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0x3fffffff
jle 0x43a52c
mov dword [ebp - 0x80c], 0
jmp 0x43a568
mov eax, dword [ebp - 0x670]
shl eax, 1
call fcn.00570840
mov dword [ebp - 0x810], esp
mov edx, dword [ebp - 0x694]
push edx
mov eax, dword [ebp - 0x670]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x690]
push ecx
mov edx, dword [ebp - 0x810]
push edx
call fcn.004022d0
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x808], eax
push str.___AD_ESS.exe_restart
lea ecx, [ebp - 0x70c]
call fcn.00406050
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
mov dword [ebp - 0x818], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x808]
push edx
lea ecx, [ebp - 0x728]
call fcn.00406050
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x820], eax
mov byte [ebp - 4], 0x10
push str.cd__d__
lea ecx, [ebp - 0x744]
call fcn.00406050
mov dword [ebp - 0x824], eax
mov ecx, dword [ebp - 0x824]
mov dword [ebp - 0x828], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x820]
push edx
mov eax, dword [ebp - 0x828]
push eax
lea ecx, [ebp - 0x760]
push ecx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x82c], eax
mov edx, dword [ebp - 0x82c]
mov dword [ebp - 0x830], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x830]
push ecx
lea edx, [ebp - 0x68c]
push edx
call fcn.0041ea00
add esp, 0xc
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x760]
call fcn.004060d0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x744]
call fcn.004060d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x728]
call fcn.004060d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70c]
call fcn.004060d0
lea ecx, [ebp - 0x68c]
call fcn.00406190
push eax
call fcn.00560cc1
add esp, 4
lea ecx, [ebp - 0x68c]
call fcn.004060d0
mov dword [ebp - 0x764], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004370f0
mov eax, dword [ebp - 0x764]
lea esp, [ebp - 0x834]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret 0x10