Function at 0x8aeeb0
Capabilities:
Check for time delay via gettickcount
Create thread
Persist via ginadll registry key
Persist via winlogon helper dll registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb16460
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x24e8
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x24f8], ebx
mov byte [ebp - 0xd74], bl
push 0x40f
push ebx
lea eax, [ebp - 0xd73]
push eax
call fcn.00a7ffb0
mov dword [ebp - 0x24f0], 0x80004005
mov byte [ebp - 0x24be], bl
mov byte [ebp - 0x24bd], bl
mov dword [ebp - 0x24b4], ebx
push ebx
push 1
push str.MSI_LoadMonitorEx___Started...
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0xb8da58], eax
call fcn.00898680
push 1
xor edx, edx
xor ecx, ecx
call fcn.008bb810
add esp, 4
cmp dword [0xb54184], 9
jae 0x8af0bf
mov dword [ebp - 4], ebx
call esi
mov dword [0xb8da58], eax
cmp dword [0xbc27fc], ebx
je 0x8aef95
push ebx
push 1
push str.Querying_Driver...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x24bd]
push ecx
lea edx, [ebp - 0x24be]
push edx
call dword [0xb8dab8]
add esp, 8
mov esi, eax
mov dword [ebp - 0x24b4], esi
cmp esi, ebx
jge 0x8af03d
mov byte [ebp - 0x34c], bl
push 0x103
push ebx
lea eax, [ebp - 0x34b]
push eax
call fcn.00a7ffb0
push esi
lea edx, [ebp - 0x34c]
call fcn.008aaa40
add esp, 0x10
cmp byte [ebp - 0x34c], bl
jne 0x8aeffa
push esi
push str.FlQueryDriver_Failed._Error_Returned:_0x_x
lea ecx, [ebp - 0xd74]
push ecx
jmp 0x8af00d
lea edx, [ebp - 0x34c]
push edx
push str.FlQueryDriver_Failed._Error_Returned:__s
lea eax, [ebp - 0xd74]
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xd74]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x80004005
jmp 0x8b2825
push ebx
push 1
cmp byte [ebp - 0x24be], bl
jne 0x8af06b
push str.Bd_Driver_Unregistered._Existing_On_Access_Module
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x80004005
jmp 0x8b2825
cmp byte [ebp - 0x24bd], bl
jne 0x8af07a
push str.On_Access_Module_Is_Not_Running_Initially
jmp 0x8af07f
push str.On_Access_Driver_Running_Initially
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
jmp 0x8af0bf
mov dword [ebp - 4], 1
xor esi, esi
call fcn.0095e560
mov edi, eax
push ebx
push 1
push str.Reading_Monitor_Settings...
push 0xb54ce8
call fcn.008808e0
call fcn.008b74b0
mov dword [ebp - 0x24f8], eax
push ebx
push 1
push str.Finished_Reading_Monitor_Settings...
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [0xb567e4], ebx
jne 0x8af111
cmp edi, 0xc0000
jae 0x8af117
mov dword [0xb38e8c], ebx
push 0xb38e8c
push str.BlockMalwareUrls
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8af14f
mov eax, dword [0xb38e8c]
mov esi, str.BlockMalwareUrls
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea edx, [ebp - 0x24b8]
push edx
push str.dwBMUSet
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8af182
push str.dwBMUSet
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
push 0xb8db38
push str.dwBMUSetA
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8af1bd
mov dword [0xb8db38], ebx
xor eax, eax
mov esi, str.dwBMUSetA
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb8db38], ebx
jne 0x8af219
cmp dword [0xb38e8c], ebx
jne 0x8af219
cmp dword [0xb567e4], ebx
jne 0x8af1e2
cmp edi, 0xc0000
jb 0x8af1e2
mov ebx, 1
mov dword [0xb38e8c], ebx
mov eax, ebx
mov esi, str.BlockMalwareUrls
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov eax, 1
mov dword [0xb8db38], eax
mov esi, str.dwBMUSetA
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x8af24c
mov esi, 1
cmp dword [ebp - 0x24f8], esi
jne 0x8b27ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
mov dword [ebp - 4], 2
cmp dword [0xbe7d38], ebx
jne 0x8b06e4
mov byte [ebp - 0x38], bl
xor eax, eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov byte [ebp - 0x2f], al
mov dword [ebp - 0x24d8], ebx
mov byte [ebp - 0x1994], bl
push 0x207
push ebx
lea eax, [ebp - 0x1993]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1480], bl
mov dword [ebp - 0x24fc], ebx
mov dword [ebp - 0x24b8], ebx
mov dword [0xbe7d38], esi
cmp byte [str.C:Program_Files__x86_eScanGroupsTemp], bl
je 0x8af340
cmp dword [0xbd04f4], ebx
jne 0x8af340
push ebx
push ebx
push 0x8babe0
call fcn.00a791b2
mov esi, eax
push str.CBD_5x
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8af33e
mov byte [ebp - 0xe78], bl
push 0x103
push ebx
lea ecx, [ebp - 0xe77]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_g__fails_with_error__d
lea edx, [ebp - 0xe78]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0xe78]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
push 0xb55508
push str.C:PROGRA2eScanWGWIN.EXE
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, str.C:PROGRA2eScanWGWIN.EXE
call fcn.00960910
push str.WGWIN.EXE
push str.C:PROGRA2eScanWGWIN.EXE
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push ebx
xor edx, edx
mov ecx, str.C:PROGRA2eScanWGWIN.EXE
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8afd14
mov dword [ebp - 0x24e8], ebx
mov dword [ebp - 0x24e4], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x24e4]
push ecx
push ebx
push ebx
push str.C:PROGRA2eScanWGWIN.EXE
lea edx, [ebp - 0x24e8]
xor ecx, ecx
call fcn.0096d300
test eax, eax
je 0x8afd14
mov eax, dword [ebp - 0x24e8]
cmp eax, 0x40000
ja 0x8af3db
jne 0x8afd14
cmp dword [ebp - 0x24e4], 0x32
jb 0x8afd14
mov dword [ebp - 0x24fc], 1
mov dword [ebp - 0x24c4], ebx
mov dword [ebp - 0x24bc], ebx
lea edx, [ebp - 0x24c4]
push edx
push str.AutoDownloadWinPatch
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8af431
mov eax, 1
mov dword [ebp - 0x24c4], eax
mov esi, str.AutoDownloadWinPatch
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
call fcn.00968db0
test eax, eax
je 0x8af44b
call fcn.009634d0
test eax, eax
je 0x8af44b
mov dword [ebp - 0x24bc], ebx
jmp 0x8af4a9
cmp dword [0xb567d0], ebx
jne 0x8af463
cmp dword [0xb567d4], ebx
jne 0x8af463
cmp dword [0xb567d8], ebx
je 0x8af4a9
lea eax, [ebp - 0x24bc]
push eax
push str.AutoDownloadWinPatchAll
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8af4a9
xor eax, eax
cmp dword [0xb567d0], ebx
setne al
mov dword [ebp - 0x24bc], eax
mov esi, str.AutoDownloadWinPatchAll
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb56804], ebx
je 0x8af4d2
mov dword [ebp - 0x24bc], ebx
mov dword [ebp - 0x24c4], ebx
push ebx
push 1
push str._OSPATCH__AutoDownload_WinPatch_Disabled_as_this_is_Cluster_Server
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [ebp - 0x24c4]
cmp eax, 1
jne 0x8afcd6
cmp dword [0xb44c9c], ebx
je 0x8afcd1
call fcn.00968db0
test eax, eax
je 0x8af50c
call fcn.009634d0
test eax, eax
je 0x8af50c
push ebx
push 1
push str._OSPATCH__W2K_Citrix_Environment___WinPatch_AutoDownload_Disabled...
jmp 0x8afcde
push ebx
push 1
push str._OSPATCH__Checking_Patch_Update_File...
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x1994]
push ecx
mov ecx, str.C:PROGRA2eScanup.avs
call fcn.00920cc0
add esp, 0x14
cmp eax, 1
jne 0x8afca0
mov eax, str.UpAvsFile
call fcn.008975a0
mov edi, eax
cmp byte [ebp - 0x1994], bl
je 0x8afc56
push 1
mov esi, str.C:PROGRA2eScanup.avs
call fcn.0098d390
add esp, 4
test eax, eax
jne 0x8af56e
cmp edi, ebx
je 0x8afc56
mov byte [ebp - 0x1080], bl
push 0x207
push ebx
lea edx, [ebp - 0x107f]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x450], bl
push 0x103
push ebx
lea eax, [ebp - 0x44f]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x554], bl
push 0x103
push ebx
lea ecx, [ebp - 0x553]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x248], bl
push 0x103
push ebx
lea edx, [ebp - 0x247]
push edx
call fcn.00a7ffb0
add esp, 0x30
cmp dword [0xb388dc], ebx
je 0x8af673
mov eax, 0x5a
lea esi, [ebp - 0x2c]
call fcn.0096f360
call fcn.009675f0
push 0x104
test eax, eax
jne 0x8af609
lea eax, [ebp - 0x450]
push eax
push 0xabeed4
mov ecx, esi
push ecx
jmp 0x8af619
lea edx, [ebp - 0x450]
push edx
push str.yyyy_MM_dd
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.00951d70
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x104
lea ecx, [ebp - 0x554]
push ecx
push 0xabeeec
lea edx, [ebp - 0x2c]
push edx
push ebx
call fcn.00951d70
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp - 0x554]
push eax
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x1994]
push edx
push str._OSPATCH__WinPatch_Checking_Via__s__Will_Begin_At:__s__s_
lea eax, [ebp - 0x1080]
push eax
call fcn.00a78f30
add esp, 0x14
jmp 0x8af687
push str._OSPATCH__WinPatch_Checking_will_begin_after_1.5_mins
lea ecx, [ebp - 0x1080]
push ecx
call fcn.00a78f30
add esp, 8
push ebx
mov edi, 1
push edi
lea edx, [ebp - 0x1080]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [0xbd0b04], edi
lea eax, [ebp - 0x1994]
push eax
push str.C:PROGRA2eScanup.dat
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x248]
push ecx
mov ecx, 0xb55f40
call fcn.00933f00
add esp, 4
cmp byte [ebp - 0x248], bl
jne 0x8af7a8
cmp dword [0xbd0b10], ebx
jne 0x8af7a8
mov dword [0xbd6340], 0xbd07c4
mov dword [0xbd6348], 0xbd09d8
mov dword [0xbd6344], 0xbd08d0
mov dword [0xbd634c], edi
mov dword [0xbd0b10], edi
cmp dword [0xbd04f4], ebx
jne 0x8af81d
mov dword [0xbd6354], ebx
push ebx
push edi
push str._CONN__Connectivity_Check_Started_A_...
push 0xb54ce8
call fcn.008808e0
push 0xbd6340
push ebx
push 0x88fc10
call fcn.00a791b2
mov esi, eax
push str.CBD_5y
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8afc42
mov byte [ebp - 0x20a0], bl
push 0x103
push ebx
lea edx, [ebp - 0x209f]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_i__fails_with_error__d
lea eax, [ebp - 0x20a0]
push eax
call fcn.00a78f30
push ebx
push edi
lea ecx, [ebp - 0x20a0]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xbd04f4], ebx
jne 0x8af81d
push ebx
push ebx
push 0x8979f0
call fcn.00a791b2
mov esi, eax
push str.CBD_5z
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8af81b
mov byte [ebp - 0x23ac], bl
push 0x103
push ebx
lea edx, [ebp - 0x23ab]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_j__fails_with_error__d
lea eax, [ebp - 0x23ac]
push eax
call fcn.00a78f30
push ebx
push edi
lea ecx, [ebp - 0x23ac]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xbd0b04], ebx
jne 0x8af8c9
call fcn.00968fe0
test eax, eax
je 0x8af8c9
call fcn.008970e0
test eax, eax
je 0x8af8c9
cmp dword [0xbd04f4], ebx
jne 0x8af8c9
push ebx
push edi
push str._OSPATCH__Critical_XP_Patch_Check_1_...
push 0xb54ce8
call fcn.008808e0
push ebx
push ebx
push fcn.008971f0
call fcn.00a791b2
mov esi, eax
push str.CBD_6a
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8af8c7
mov byte [ebp - 0x1f9c], bl
push 0x103
push ebx
lea edx, [ebp - 0x1f9b]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_k__fails_with_error__d
lea eax, [ebp - 0x1f9c]
push eax
call fcn.00a78f30
push ebx
push edi
lea ecx, [ebp - 0x1f9c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [ebp - 0x24bc], ebx
je 0x8afa95
cmp dword [0xb44c9c], ebx
je 0x8afa95
mov byte [ebp - 0x1d94], bl
push 0x103
push ebx
lea edx, [ebp - 0x1d93]
push edx
call fcn.00a7ffb0
lea eax, [ebp - 0x1d94]
push eax
mov ecx, 0xb55f40
call fcn.00933f00
add esp, 0x10
cmp byte [ebp - 0x1d94], bl
jne 0x8af9e7
cmp dword [0xbd0b10], ebx
jne 0x8af9e7
mov dword [0xbd6340], 0xbd07c4
mov dword [0xbd6348], 0xbd09d8
mov dword [0xbd6344], 0xbd08d0
mov dword [0xbd634c], edi
mov dword [0xbd0b10], edi
cmp dword [0xbd04f4], ebx
jne 0x8afa95
mov dword [0xbd6354], ebx
push ebx
push edi
push str._CONN__Connectivity_Check_Started_B_...
push 0xb54ce8
call fcn.008808e0
push 0xbd6340
push ebx
push 0x88fc10
call fcn.00a791b2
mov esi, eax
push str.CBD_5y2
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8afd00
mov byte [ebp - 0x22a8], bl
push 0x103
push ebx
lea ecx, [ebp - 0x22a7]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_i__fails_with_error__d
lea edx, [ebp - 0x22a8]
push edx
call fcn.00a78f30
push ebx
push edi
lea eax, [ebp - 0x22a8]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xbd04f4], ebx
jne 0x8afa95
mov byte [ebp - 0x34c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x34b]
push ecx
call fcn.00a7ffb0
mov edx, dword [0xb567d8]
push edx
mov eax, dword [0xb567d4]
push eax
mov ecx, dword [0xb567d0]
push ecx
push str._OSPATCH__WinPatch_All_Download_Thread_Started__Pri:_u__Sec:_u__UAgnt:_u_
lea edx, [ebp - 0x34c]
push edx
call fcn.00a78f30
push ebx
push edi
lea eax, [ebp - 0x34c]
push eax
push 0xb54ce8
call fcn.008808e0
push ebx
push ebx
push 0x897620
call fcn.00a791b2
mov esi, eax
push str.CBD_5zAx
xor ebx, ebx
call fcn.0085df20
add esp, 0x40
cmp esi, 0xffffffff
jne 0x8afa93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_j__fails_with_error__d
lea ecx, [ebp - 0x34c]
push ecx
call fcn.00a78f30
push ebx
push edi
lea edx, [ebp - 0x34c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xb45d94], ebx
je 0x8afd47
mov eax, dword [0xbd04f4]
cmp eax, edi
jne 0x8afab0
mov dword [0xb3df20], ebx
cmp dword [0xbd0b10], ebx
jne 0x8afb8e
cmp dword [0xb3df20], edi
je 0x8afad0
cmp dword [0xb3dc8c], ebx
je 0x8afb8e
mov dword [0xbd6340], 0xbd07c4
mov dword [0xbd6348], 0xbd09d8
mov dword [0xbd6344], 0xbd08d0
mov dword [0xbd634c], edi
mov dword [0xbd0b10], edi
cmp eax, ebx
jne 0x8afb8e
mov dword [0xbd6354], ebx
push ebx
push edi
push str._CONN__Connectivity_Check_Started_C_...
push 0xb54ce8
call fcn.008808e0
push 0xbd6340
push ebx
push 0x88fc10
call fcn.00a791b2
mov esi, eax
push str.CBD_6b
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8afd33
mov byte [ebp - 0x24b0], bl
push 0x103
push ebx
lea eax, [ebp - 0x24af]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_L__fails_with_error__d
lea ecx, [ebp - 0x24b0]
push ecx
call fcn.00a78f30
push ebx
push edi
lea edx, [ebp - 0x24b0]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xb3df20], edi
jne 0x8afd4d
mov dword [ebp - 0x28], ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0xbd61e4
mov dword [ebp - 0x24], edi
push ebx
push edi
push str.Starting_QueryCloudThread...
push 0xb54ce8
call fcn.008808e0
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x9da9b0
call fcn.00a791b2
mov esi, eax
push str.CBD_6c
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8afc31
mov byte [ebp - 0x21a4], bl
push 0x103
push ebx
lea ecx, [ebp - 0x21a3]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_p__fails_with_error__d
lea edx, [ebp - 0x21a4]
push edx
call fcn.00a78f30
push ebx
push edi
lea eax, [ebp - 0x21a4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov dword [0xbddcac], 0
xor ebx, ebx
jmp 0x8afd4d
cmp dword [0xbd6354], 0
jne 0x8af7a6
call fcn.0094d150
jmp 0x8afc42
mov byte [ebp - 0x1c90], bl
push 0x103
push ebx
lea edx, [ebp - 0x1c8f]
push edx
call fcn.00a7ffb0
push str._OSPATCH__No_new_updates_in_OSPatch_Updates...
lea eax, [ebp - 0x1c90]
push eax
call fcn.00a78f30
lea ecx, [ebp - 0x1c90]
push ebx
push 1
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x24
mov edi, 1
jmp 0x8af81d
mov byte [ebp - 0x1e98], bl
push 0x103
push ebx
lea edx, [ebp - 0x1e97]
push edx
call fcn.00a7ffb0
push str._OSPATCH__OSPatch_Update_file_unavailable_
lea eax, [ebp - 0x1e98]
push eax
call fcn.00a78f30
lea ecx, [ebp - 0x1e98]
jmp 0x8afc85
cmp eax, 1
je 0x8afcf5
push ebx
push 1
push str._OSPATCH__Not_Checking___WinPatch_AutoDownload_Disabled...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, 1
jmp 0x8af8c9
push ebx
push 1
push str._OSPATCH__Not_Checking___eScan_AutoDownload_of_Updates_Disabled...
jmp 0x8afcde
cmp dword [0xbd6354], 0
jne 0x8af9e5
call fcn.0094d150
jmp 0x8afd00
push ebx
push 1
push str._OSPATCH__Not_Checking___Version_of_WGWIN_Old...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, 1
jmp 0x8afa95
cmp dword [0xbd6354], 0
jne 0x8afb8c
call fcn.0094d150
jmp 0x8afd33
mov dword [0xb3df20], ebx
mov dword [ebp - 0x24ec], ebx
mov dword [ebp - 0x24e0], ebx
lea ecx, [ebp - 0x24e0]
push ecx
push str.MonitorBldSet
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x24e0], edi
jne 0x8afda4
push str.MonitorCLX
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
push str.MonitorCLB
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
lea edx, [ebp - 0x24ec]
push edx
push str.MonitorCLX
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, dword [ebp - 0x24ec]
cmp eax, 0xffff
je 0x8aff28
cmp eax, 0xa
jae 0x8aff28
cmp dword [0xbd04f4], ebx
jne 0x8aff28
cmp dword [0xbd0b10], ebx
jne 0x8afebb
cmp dword [0xb567cc], ebx
jne 0x8afeb3
mov dword [0xbd6340], 0xbd07c4
mov dword [0xbd6348], 0xbd09d8
mov dword [0xbd6344], 0xbd08d0
mov dword [0xbd634c], edi
mov dword [0xbd0b10], edi
mov dword [0xbd6354], ebx
push ebx
push edi
push str._CONN__Connectivity_Check_Started_D_...
push 0xb54ce8
call fcn.008808e0
push 0xbd6340
push ebx
push 0x88fc10
call fcn.00a791b2
mov esi, eax
push str.CBD_6d
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8b0170
mov byte [ebp - 0x1688], bl
push 0x103
push ebx
lea eax, [ebp - 0x1687]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_m__fails_with_error__d
lea ecx, [ebp - 0x1688]
push ecx
call fcn.00a78f30
push ebx
push edi
lea edx, [ebp - 0x1688]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xbd0b10], ebx
je 0x8aff28
push ebx
push ebx
push 0x8972d0
call fcn.00a791b2
mov esi, eax
push str.CBD_6e
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8aff26
mov byte [ebp - 0x1584], bl
push 0x103
push ebx
lea eax, [ebp - 0x1583]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_n__fails_with_error__d
lea ecx, [ebp - 0x1584]
push ecx
call fcn.00a78f30
push ebx
push edi
lea edx, [ebp - 0x1584]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
cmp dword [0xb54194], ebx
je 0x8aff3c
cmp dword [0xb567cc], ebx
jne 0x8b00fb
cmp dword [0xbd0b10], ebx
jne 0x8b0016
cmp dword [0xb567cc], ebx
jne 0x8b0016
mov dword [0xbd6340], 0xbd07c4
mov dword [0xbd6348], 0xbd09d8
mov dword [0xbd6344], 0xbd08d0
mov dword [0xbd634c], edi
mov dword [0xbd0b10], edi
cmp dword [0xbd04f4], ebx
jne 0x8b0016
mov dword [0xbd6354], ebx
push ebx
push edi
push str._CONN__Connectivity_Check_Started_E_...
push 0xb54ce8
call fcn.008808e0
push 0xbd6340
push ebx
push 0x88fc10
call fcn.00a791b2
mov esi, eax
push str.CBD_6f
xor ebx, ebx
call fcn.0085df20
add esp, 0x20
cmp esi, 0xffffffff
jne 0x8b0190
mov byte [ebp - 0x75c], bl
push 0x103
push ebx
lea eax, [ebp - 0x75b]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_m__fails_with_error__d
lea ecx, [ebp - 0x75c]
push ecx
call fcn.00a78f30
push ebx
push edi
lea edx, [ebp - 0x75c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
mov dword [ebp - 0x24dc], 0xffffffff
mov dword [ebp - 0x24d4], ebx
push ebx
call fcn.00a7aace
add esp, 4
mov esi, eax
mov edi, edx
lea eax, [ebp - 0x24d4]
push eax
push str.MacIdTd
mov ecx, str.SoftwareMicroWorldeScan_for_Windows
mov edx, 0x80000002
call fcn.0094c0d0
lea ecx, [ebp - 0x24dc]
push ecx
push str.MacIdSendStatus
mov ecx, str.SoftwareMicroWorldeScan_for_Windows
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x24dc], ebx
jne 0x8b0088
push edi
push esi
push ebx
mov edx, dword [ebp - 0x24d4]
push edx
call fcn.00972c10
add esp, 0x10
cmp eax, 4
jbe 0x8b00f6
push ebx
push ebx
push 0x86fcc0
call fcn.00a791b2
mov esi, eax
push str.CBD_6g
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8b00f4
mov byte [ebp - 0x658], bl
push 0x103
push ebx
lea eax, [ebp - 0x657]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_v1x__fails_with_error__d
lea ecx, [ebp - 0x658]
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x658]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
mov edi, 1
cmp dword [0xb54194], ebx
jne 0x8b0110
test byte [0xb8db58], 0x80
je 0x8b03d4
push 0xb3ddb0
push str.RestartServInHrs
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0148
mov eax, dword [0xb3ddb0]
mov esi, str.RestartServInHrs
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push 0xb3ddb8
push str.ServiceStatusCheckTimeInMins
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b01a4
mov eax, dword [0xb3ddb8]
jmp 0x8b01b7
cmp dword [0xbd6354], 0
jne 0x8afeb1
call fcn.0094d150
jmp 0x8b0170
cmp dword [0xbd6354], 0
jne 0x8b0014
call fcn.0094d150
jmp 0x8b0190
cmp dword [0xb3ddb8], 0xa
ja 0x8b01cd
mov eax, 0xf
mov dword [0xb3ddb8], eax
mov esi, str.ServiceStatusCheckTimeInMins
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb3ddb0], ebx
jbe 0x8b03d4
mov byte [ebp - 0x964], bl
push 0x103
push ebx
lea eax, [ebp - 0x963]
push eax
call fcn.00a7ffb0
push 0x104
lea ecx, [ebp - 0x964]
push ecx
push 0xaa1543
mov edx, str.server
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0x18
cmp byte [ebp - 0x964], 0x30
jne 0x8b0234
push ebx
push ebx
push ebx
push str.escan_trayicoc
mov edx, str.trayicoc.exe
mov ecx, str.traycser.exe
jmp 0x8b03cc
mov byte [ebp - 0x860], bl
push 0x103
push ebx
lea edx, [ebp - 0x85f]
push edx
call fcn.00a7ffb0
add esp, 0xc
push 0xb55f40
push 0x104
lea eax, [ebp - 0x860]
push eax
push 0xaa1543
push str.DownloadFromAnotherServer
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x860], 0x31
jne 0x8b02b4
push ebx
push ebx
push edi
push str.escan_eserv
mov edx, str.eserv.exe
mov ecx, str.trayeser.exe
call fcn.008ae250
push ebx
push ebx
push ebx
push str.escan_trayicos
mov edx, str.trayicos.exe
mov ecx, str.traysser.exe
call fcn.008ae250
add esp, 0x20
jmp 0x8b03d4
cmp dword [0xb3ddb8], ebx
jbe 0x8b03d4
mov dword [ebp - 0x24c8], ebx
mov dword [ebp - 0x24cc], ebx
push 0xb3ddbc
push str.PhpCheckTimeInMins
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8b02f2
cmp dword [0xb3ddbc], 0x14
jne 0x8b0312
mov eax, 0x50
mov dword [0xb3ddbc], eax
mov esi, str.PhpCheckTimeInMins
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea ecx, [ebp - 0x24c8]
push ecx
push str.PeriodicRestartEServ
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b034d
mov eax, dword [ebp - 0x24c8]
mov esi, str.PeriodicRestartEServ
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea edx, [ebp - 0x24cc]
push edx
push str.PeriodicRestartTrayicos
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0388
mov eax, dword [ebp - 0x24cc]
mov esi, str.PeriodicRestartTrayicos
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov eax, edi
cmp dword [ebp - 0x24c8], ebx
je 0x8b0394
xor eax, eax
push edi
push eax
push edi
push str.escan_eserv
mov edx, str.eserv.exe
mov ecx, str.trayeser.exe
call fcn.008ae250
add esp, 0x10
mov eax, edi
cmp dword [ebp - 0x24cc], ebx
je 0x8b03ba
xor eax, eax
push edi
push eax
push ebx
push str.escan_trayicos
mov edx, str.trayicos.exe
mov ecx, str.traysser.exe
call fcn.008ae250
add esp, 0x10
mov eax, dword [0xb3ddd0]
cmp eax, 0xffffffff
jne 0x8b03e8
call fcn.0091ded0
mov dword [0xb3ddd0], eax
cmp eax, ebx
je 0x8b043f
lea eax, [ebp - 0x24d8]
push eax
push str.DWMinDiskSpaceRequiredMB
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
push 2
push 0xb8dff8
lea ecx, [ebp - 0x38]
push ecx
call fcn.00a7b9de
add esp, 0xc
mov byte [ebp - 0x36], bl
mov eax, dword [ebp - 0x24d8]
cmp eax, ebx
jbe 0x8b043f
mov esi, eax
lea edi, [ebp - 0x38]
call fcn.0098bfc0
cmp eax, esi
jae 0x8b043f
mov dword [ebp - 0x24b8], 1
cmp dword [0xb45d94], ebx
je 0x8b046d
push ebx
push 1
push str.Cleaning_up_FBCache...
push 0xb54ce8
call fcn.008808e0
call fcn.0085f7c0
lea edx, [ebp - 0x24b8]
push edx
call fcn.0085f470
add esp, 0x14
mov eax, dword [str.dummy]
mov dword [ebp - 0x40], eax
mov cx, word [0xac5f44]
mov word [ebp - 0x3c], cx
cmp dword [0xb45d94], ebx
je 0x8b05cc
push ebx
push 1
push str.Loading_Lists...
push 0xb54ce8
call fcn.008808e0
call fcn.00933c70
push ebx
push ebx
call fcn.00a65cb0
xor ecx, ecx
call fcn.009158e0
push ebx
call fcn.00903e40
push ebx
mov ecx, str.dummy
call fcn.00903770
push 1
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x24d4]
lea ecx, [ebp - 0x137c]
call fcn.00904050
push 0xaaab94
call fcn.00904ac0
push 0xaaab94
call fcn.009188f0
push 0xac5f5c
call fcn.00915090
push ebx
push 0xac5f60
xor ecx, ecx
call fcn.00915440
push ebx
push ebx
xor ecx, ecx
call fcn.00a691a0
add esp, 0x44
push 0xac5f60
call fcn.00918530
push 0xac5f60
call fcn.00918670
push 0xac5f60
call fcn.009187b0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00911220
add esp, 0x5c
push ebx
xor ecx, ecx
call fcn.00a5c170
xor edx, edx
xor ecx, ecx
call fcn.00923f90
push ebx
push ebx
push ebx
push ebx
push ebx
xor ecx, ecx
xor edx, edx
call fcn.00923c30
push ebx
push ebx
push ebx
xor edx, edx
xor ecx, ecx
call fcn.00925a30
push ebx
call fcn.00859830
push ebx
push ebx
push ebx
xor ebx, ebx
xor edi, edi
call fcn.00892a10
xor ecx, ecx
call fcn.00a5c820
xor ecx, ecx
call fcn.00a5c490
call fcn.00a7c1b5
add eax, 0x40
push eax
push str._c:_
lea eax, [ebp - 0x28]
push eax
call fcn.00a78f30
add esp, 0x40
lea eax, [ebp - 0x28]
call fcn.00966890
push edi
push 1
push str.Finished_Loading_Lists...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov byte [ebp - 0x144], bl
push 0x103
push ebx
lea ecx, [ebp - 0x143]
push ecx
call fcn.00a7ffb0
mov edx, dword [0xbd064c]
push edx
mov eax, dword [0xbd0648]
push eax
push str._SHA2__A__SHA256Chk:_u__ItemCount:_u
lea ecx, [ebp - 0x144]
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x144]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x2c
mov edi, 1
mov eax, 0xaaf41c
call fcn.008aed40
mov eax, str.SPReg
call fcn.008aed40
lea eax, [ebp - 0x2500]
push eax
push str.ProtectWinsock
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8b0665
push str.ProtectWinsock
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
xor edi, edi
mov eax, str.ProtectWinsockEx
call fcn.008aed40
mov edi, 1
mov eax, str.ProtectAppId
call fcn.008aed40
mov eax, str.ProtectCLSID
call fcn.008aed40
mov eax, str.ProtectIFEO
call fcn.008aed40
mov eax, str.ProtectEScanServices
call fcn.008aed40
mov eax, str.ProtectWinlogon
call fcn.008aed40
mov eax, str.ProtectWindows
call fcn.008aed40
mov eax, str.ProtectSvcHost
call fcn.008aed40
mov eax, str.ProtectEConceal
call fcn.008aed40
mov eax, str.ProtectControl
call fcn.008aed40
mov eax, str.ProtectSYSTEM
call fcn.008aed40
mov eax, str.RegMonitor
call fcn.008aed40
push ebx
push 1
push str.Loading_Protected_Folders_List_A_...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00898e10
mov edi, edi
cmp dword [0xbd5aac], ebx
jne 0x8b0714
mov esi, 0xa
call fcn.0094d160
jmp 0x8b0700
push ebx
push 1
push str.Continuing_with_Monitor_Loading...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b075c
cmp dword [0xbd04f0], ebx
jne 0x8b07be
cmp dword [0xbd04e8], ebx
jne 0x8b07be
push 0x186c
mov ebx, dword [0xb5635c]
mov ecx, 0xb3703c
call fcn.009630d0
mov dword [0xbd04f0], eax
test eax, eax
je 0x8b07bc
push 0x186c
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0xbd04e8], eax
test eax, eax
je 0x8b27c4
push 0x186c
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
xor ebx, ebx
push ebx
mov ecx, 0xb3736c
call fcn.00962f00
cmp eax, ebx
je 0x8b07d4
mov dword [0xbd04ec], eax
jmp 0x8b07d9
mov eax, dword [0xbd04ec]
cmp eax, ebx
je 0x8b2797
cmp eax, 0xffffffff
je 0x8b2797
mov dword [ebp - 0x24f4], ebx
mov dword [ebp - 4], 3
mov eax, 0x9e76d0
cdq
push edx
push eax
push ebx
push 0x10001003
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b0832
push eax
mov esi, str.OPT_INITIALIZE_THREAD_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov eax, 0x9e76d0
cdq
push edx
push eax
push ebx
push 0x10001004
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b086d
push eax
mov esi, str.OPT_FINALIZE_THREAD_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov eax, 0x9e76d0
cdq
push edx
push eax
push ebx
push 0x10001001
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b08a8
push eax
mov esi, str.OPT_INITIALIZE_GLOBAL_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov eax, 0x9e76d0
cdq
push edx
push eax
push ebx
push 0x10001002
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b08e3
push eax
mov esi, str.OPT_FINALIZE_GLOBAL_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
call fcn.008aede0
mov eax, 0x8dae20
cdq
push edx
push eax
push ebx
push 0x10001006
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b0923
push eax
mov esi, str.OPT_BOOT_SCAN_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov esi, 1
cmp dword [0xbd0500], ebx
je 0x8b093d
cmp dword [0xbd0508], esi
mov eax, 0xa734a0
jne 0x8b0942
mov eax, 0x8c6700
cdq
push edx
push eax
push ebx
push 0x10001007
call dword [0xb8dac4]
mov dword [ebp - 0x24b4], eax
add esp, 0x10
cmp eax, ebx
jge 0x8b0978
push eax
mov esi, str.OPT_REGISTRY_SCAN_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov eax, 0x8dae20
cdq
push edx
push eax
push ebx
push 0x10001008
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b09b3
push eax
mov esi, str.OPT_GUI_CONFIRM_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov eax, 0x8ca970
cdq
push edx
push eax
push ebx
push 0x1000100a
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0x24b4], eax
cmp eax, ebx
jge 0x8b09ee
push eax
mov esi, str.OPT_STOP_FILESCAN_CALLBACK_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
cmp dword [0xbd0500], ebx
je 0x8b0a03
cmp dword [0xbd050c], esi
mov eax, 0x9e76d0
jne 0x8b0a08
mov eax, 0x8cd120
cdq
push edx
push eax
push ebx
push 0x1000100e
call dword [0xb8dac4]
mov dword [ebp - 0x24b4], eax
add esp, 0x10
cmp eax, ebx
jge 0x8b0a3b
push eax
mov esi, str.0x1000100E_Call_Failed_
call fcn.008ab970
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
mov dword [ebp - 0x24f4], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0a74
cmp dword [ebp - 0x24f4], ebx
jne 0x8b0a96
push ebx
push 1
push str.Error_Setting_On_Access_Callbacks
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8b27c6
mov dword [ebp - 4], 4
mov byte [ebp - 0x450], bl
push 0x103
push ebx
lea ecx, [ebp - 0x44f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
cmp dword [0xb43a14], ebx
je 0x8b0ae2
cmp dword [0xb567c0], ebx
jne 0x8b0ae2
push 0xa
mov esi, 3
call fcn.008be990
add esp, 4
push ebx
push 1
push str.Calling_FlStartScanner2A_For_Loading_File_Monitor...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push ebx
push ebx
mov eax, dword [0xb3acec]
lea edx, [eax + 1]
push edx
push ebx
push 1
push eax
push 1
call dword [0xb8dad0]
add esp, 0x1c
mov esi, eax
mov dword [ebp - 0x24b4], esi
cmp esi, ebx
jge 0x8b0d0a
push esi
lea edx, [ebp - 0x450]
call fcn.008aaa40
add esp, 4
cmp byte [ebp - 0x450], bl
jne 0x8b0b4f
push esi
push str.Error._Starting_Filter_Library_Threads_And_Connecting_Them_To_The_Filter_Driver__1_._Reason:_0x_x
lea eax, [ebp - 0xd74]
push eax
jmp 0x8b0b62
lea ecx, [ebp - 0x450]
push ecx
push str.Error._Starting_Filter_Library_Threads_And_Connecting_Them_To_The_Filter_Driver__1_._Reason:__s
lea edx, [ebp - 0xd74]
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0xd74]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 5
cmp esi, 0xc1000007
jne 0x8b0cbe
mov byte [ebp - 0x24cd], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
lea ecx, [ebp - 0x24cd]
push ecx
push ebx
call dword [0xb8dabc]
add esp, 8
mov esi, eax
mov dword [ebp - 0x24b4], esi
cmp esi, ebx
jl 0x8b0c66
push ebx
push ebx
mov eax, dword [0xb3acec]
lea edx, [eax + 1]
push edx
push ebx
push 1
push eax
push ebx
call dword [0xb8dad0]
add esp, 0x1c
mov esi, eax
mov dword [ebp - 0x24b4], esi
cmp esi, ebx
jge 0x8b0c4d
push esi
lea edx, [ebp - 0x450]
call fcn.008aaa40
add esp, 4
cmp byte [ebp - 0x450], bl
jne 0x8b0c26
push esi
push str.Error._Starting_Filter_Library_Threads_And_Connecting_Them_To_The_Filter_Driver__2_._Reason:_0x_x
lea eax, [ebp - 0xd74]
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0xd74]
push eax
jmp 0x8b0cb1
lea ecx, [ebp - 0x450]
push ecx
push str.Error._Starting_Filter_Library_Threads_And_Connecting_Them_To_The_Filter_Driver__2_._Reason:__s
lea edx, [ebp - 0xd74]
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0xd74]
push eax
jmp 0x8b0cb1
mov dword [0xbd0b20], ebx
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0d7a
push esi
lea edx, [ebp - 0x450]
call fcn.008aaa40
add esp, 4
cmp byte [ebp - 0x450], bl
jne 0x8b0c8c
push esi
push str.2_Error._Starting_Filter_Library_Threads_And_Connecting_Them_To_The_Filter_Driver__3_._Reason:_0x_x
lea ecx, [ebp - 0xd74]
push ecx
jmp 0x8b0c9f
lea edx, [ebp - 0x450]
push edx
push str.2_Error._Starting_Filter_Library_Threads_And_Connecting_Them_To_The_Filter_Driver__3_._Reason:__s
lea eax, [ebp - 0xd74]
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xd74]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0d7a
mov dword [0xbd0b20], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
push eax
push str.Scanner_Started___u_ms_
lea edx, [ebp - 0xd74]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0xd74]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b0d7a
cmp esi, ebx
jge 0x8b0d92
push 0xb
mov esi, 2
call fcn.008be990
add esp, 4
jmp 0x8b27c6
mov dword [ebp - 0x24f0], ebx
cmp dword [0xb567c0], ebx
jne 0x8b0daf
push 0xc
mov esi, 3
call fcn.008be990
add esp, 4
mov eax, dword [0xb54184]
cmp eax, 9
jae 0x8b22c7
cmp eax, 6
je 0x8b22c7
push ebx
push 1
push str.Setting_Filter_Options
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 6
mov byte [ebp - 0x554], bl
push 0x103
push ebx
lea ecx, [ebp - 0x553]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x24ec], 0x104
mov dword [0xb3ddd4], 0x3c
push 0xb3ddd4
push str.ReloadWaitForIdleTimeInSecs
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0e49
mov eax, dword [0xb3ddd4]
mov esi, str.ReloadWaitForIdleTimeInSecs
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov dword [ebp - 0x24c4], ebx
lea edx, [ebp - 0x24c4]
push edx
push str.IdleTimeAction
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0e8c
mov dword [ebp - 0x24c4], ebx
xor eax, eax
mov esi, str.IdleTimeAction
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea eax, [ebp - 0x24c4]
push eax
push str.IdleTimeMins
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0ec9
mov dword [ebp - 0x24c4], ebx
xor eax, eax
mov esi, str.IdleTimeMins
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov dword [0xbd4adc], ebx
push 0xbd4adc
push str.BlockChromeSettingsResetOnUnload
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0f07
mov eax, dword [0xbd4adc]
mov esi, str.BlockChromeSettingsResetOnUnload
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov dword [0xbd4ad8], ebx
push 0xbd4ad8
push str.BlockChromeSettings
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b0f45
mov eax, dword [0xbd4ad8]
mov esi, str.BlockChromeSettings
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xbd4adc], ebx
je 0x8b0f5e
push 6
push ebx
mov ecx, dword [0xbd4ad8]
call fcn.008a3370
add esp, 8
push str.GinaDLL
lea eax, [ebp - 0x24ec]
lea edi, [ebp - 0x554]
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov edx, 0x80000002
call fcn.0094c020
push 4
push ebx
xor edi, edi
mov esi, str.DisableNetworkScan
call fcn.008807d0
add esp, 8
mov esi, eax
cmp esi, 1
je 0x8b11f3
cmp dword [0xb8e22c], ebx
je 0x8b11f3
cmp dword [0xb45d94], ebx
je 0x8b11f3
call fcn.008ac280
test eax, eax
jne 0x8b11f3
mov edi, 1
mov dword [0xb3df38], edi
cmp byte [ebp - 0x554], bl
je 0x8b101a
mov eax, str.nwgina.dll
lea ecx, [ebp - 0x554]
call fcn.0094c330
test eax, eax
jne 0x8b101a
mov dword [0xbd6314], edi
mov dword [0xbd6310], edi
push ebx
push edi
push str.Note:_GINADLL__Network_Scan_Temporarily_Disabled__NWLogRes.tmp_
push 0xb54ce8
call fcn.008808e0
push ebx
push edi
push ebx
push 0x2000107
call dword [0xb8dac4]
add esp, 0x20
jmp 0x8b110d
call fcn.00964550
push ebx
push edi
test eax, eax
je 0x8b106c
push str.Note:_Network_Scan_Enabled__1_ShellReady_
push 0xb54ce8
call fcn.008808e0
push ebx
push ebx
push ebx
push 0x2000107
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x200010d
call dword [0xb8dac4]
push ebx
push ebx
push ebx
push 0x2000110
call dword [0xb8dac4]
add esp, 0x40
mov dword [0xbd6318], ebx
jmp 0x8b110d
push str.Note:_Network_Scan_Temporarily_Disabled__1_
push 0xb54ce8
call fcn.008808e0
push ebx
push edi
push ebx
push 0x2000107
call dword [0xb8dac4]
add esp, 0x20
mov dword [0xbd6310], edi
mov dword [0xbd6318], edi
cmp dword [0xbd04f4], ebx
jne 0x8b110d
push ebx
push ebx
push 0x8ae560
call fcn.00a791b2
mov esi, eax
push str.CBD_6j
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8b110b
mov byte [ebp - 0x144], bl
push 0x103
push ebx
lea ecx, [ebp - 0x143]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_q__fails_with_error__d
lea edx, [ebp - 0x144]
push edx
call fcn.00a78f30
push ebx
push edi
lea eax, [ebp - 0x144]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
call fcn.009686d0
test eax, eax
je 0x8b11e3
cmp dword [0xbd6324], ebx
jne 0x8b11e3
mov ecx, str.wtsapi32.dll
call fcn.0094c620
mov dword [0xbd6324], eax
cmp eax, ebx
je 0x8b11e3
push str.WTSRegisterSessionNotification
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0xbd6328], eax
push str.WTSUnRegisterSessionNotification
mov eax, dword [0xbd6324]
push eax
call esi
mov dword [0xbd632c], eax
cmp dword [0xbd6328], ebx
je 0x8b11e3
cmp eax, ebx
je 0x8b11e3
cmp dword [0xbd04f4], ebx
jne 0x8b11e3
push ebx
push ebx
push 0x8ae610
call fcn.00a791b2
mov esi, eax
push str.CBD_6k
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8b11e1
mov byte [ebp - 0x964], bl
push 0x103
push ebx
lea ecx, [ebp - 0x963]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_r__fails_with_error__d
lea edx, [ebp - 0x964]
push edx
call fcn.00a78f30
push ebx
push edi
lea eax, [ebp - 0x964]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ebx, ebx
push ebx
cmp dword [0xbd4afc], ebx
jne 0x8b1271
push edi
jmp 0x8b1272
mov dword [0xb3df38], ebx
push ebx
push 1
push ebx
push 0x2000107
call dword [0xb8dac4]
add esp, 0x10
cmp dword [0xb45d94], ebx
je 0x8b1267
mov byte [ebp - 0x860], bl
push 0x103
push ebx
lea ecx, [ebp - 0x85f]
push ecx
call fcn.00a7ffb0
call fcn.008ac280
push eax
mov edx, dword [0xb45d94]
push edx
mov eax, dword [0xb8e22c]
push eax
push esi
push str.Note:_Disabling_Network_Scan__1_:_DWD:_u__ISC:_u__AVE:_u__Serv:_u
lea ecx, [ebp - 0x860]
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x860]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x34
mov edi, 1
jmp 0x8b110d
push ebx
push ebx
push 0x2000119
call dword [0xb8dac4]
add esp, 0x10
push ebx
push ebx
push ebx
push 0x200010b
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x2000b00
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x200010f
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x2000112
call dword [0xb8dac4]
add esp, 0x40
push ebx
push edi
push ebx
push 0x2000111
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x2000804
call dword [0xb8dac4]
add esp, 0x20
mov dword [ebp - 0x24d8], ebx
mov dword [ebp - 0x24b8], ebx
mov dword [ebp - 0x24d4], ebx
mov dword [ebp - 0x24c8], ebx
cmp dword [0xbd0c54], ebx
jne 0x8b1306
mov dword [0xbd0c54], edi
call fcn.008aea10
cmp dword [0xb56800], ebx
je 0x8b1323
lea ecx, [ebp - 0x24d8]
push ecx
call fcn.009681c0
add esp, 4
mov dword [ebp - 0x24b8], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0xbd0e64], ebx
jne 0x8b136f
push str._sysdir_drivers_avdisk.sys
push str.C:WINDOWS_system32drivers_avdisk.sys
call esi
push edi
push str.C:WINDOWS_system32drivers_avdisk.sys
call fcn.00977760
push ebx
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32drivers_avdisk.sys
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b136f
push 0xbd0e64
mov ecx, str.C:WINDOWS_system32drivers_avdisk.sys
call fcn.008abc50
add esp, 4
cmp dword [0xbd1174], ebx
jne 0x8b13bb
push str._sysdir_drivers_avc3.sys
lea edx, [ebp - 0x144]
push edx
call esi
push edi
lea eax, [ebp - 0x144]
push eax
call fcn.00977760
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x144]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b13bb
push 0xbd1174
lea ecx, [ebp - 0x144]
call fcn.008abc50
add esp, 4
cmp dword [0xbd127c], ebx
jne 0x8b1407
push str._sysdir_drivers_avchv.sys
lea ecx, [ebp - 0x144]
push ecx
call esi
push edi
lea edx, [ebp - 0x144]
push edx
call fcn.00977760
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x144]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b1407
push 0xbd127c
lea ecx, [ebp - 0x144]
call fcn.008abc50
add esp, 4
cmp dword [0xbd1384], ebx
jne 0x8b1453
push str._sysdir_drivers_avckf.sys
lea eax, [ebp - 0x144]
push eax
call esi
push edi
lea ecx, [ebp - 0x144]
push ecx
call fcn.00977760
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x144]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b1453
push 0xbd1384
lea ecx, [ebp - 0x144]
call fcn.008abc50
add esp, 4
cmp dword [0xb567dc], ebx
jne 0x8b14a1
cmp dword [0xbd148c], ebx
jne 0x8b14a1
push str._sysdir_driverseconceal.sys
push str.C:WINDOWS_system32driverseconceal.sys
call esi
push edi
push str.C:WINDOWS_system32driverseconceal.sys
call fcn.00977760
push ebx
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32driverseconceal.sys
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b14a1
push 0xbd148c
mov ecx, str.C:WINDOWS_system32driverseconceal.sys
call fcn.008abc50
add esp, 4
cmp dword [0xbd169c], ebx
jne 0x8b14e7
push str._sysdir__slock.exe
push str.C:WINDOWS_system32_slock.exe
call esi
push edi
push str.C:WINDOWS_system32_slock.exe
call fcn.00977760
push ebx
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32_slock.exe
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b14e7
push 0xbd169c
mov ecx, str.C:WINDOWS_system32_slock.exe
call fcn.008abc50
add esp, 4
cmp dword [0xbd1594], ebx
jne 0x8b152d
push str._sysdir_drivers_bdfsfltr.sys
push str.C:WINDOWS_system32drivers_bdfsfltr.sys
call esi
push edi
push str.C:WINDOWS_system32drivers_bdfsfltr.sys
call fcn.00977760
push ebx
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32drivers_bdfsfltr.sys
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b152d
push 0xbd1594
mov ecx, str.C:WINDOWS_system32drivers_bdfsfltr.sys
call fcn.008abc50
add esp, 4
cmp dword [0xbd17a4], ebx
jne 0x8b1573
push str._sysdir_drivers_trufos.sys
push str.C:WINDOWS_system32drivers_trufos.sys
call esi
push edi
push str.C:WINDOWS_system32drivers_trufos.sys
call fcn.00977760
push ebx
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32drivers_trufos.sys
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b1573
push 0xbd17a4
mov ecx, str.C:WINDOWS_system32drivers_trufos.sys
call fcn.008abc50
add esp, 4
cmp dword [0xbd17a8], ebx
jne 0x8b1684
call fcn.00968d70
test eax, eax
je 0x8b1684
push str._sysdir_TaskseScan_Updater
lea edx, [ebp - 0x248]
push edx
call esi
push edi
lea eax, [ebp - 0x248]
push eax
call fcn.00977760
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x248]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b15d0
push 0xbd17a8
lea ecx, [ebp - 0x248]
call fcn.008abc50
add esp, 4
push str._sysdir_TaskseScan_Server
lea ecx, [ebp - 0x248]
push ecx
call esi
push edi
lea edx, [ebp - 0x248]
push edx
call fcn.00977760
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x248]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b1614
push 0xbd17a8
lea ecx, [ebp - 0x248]
call fcn.008abc50
add esp, 4
push 0x104
lea eax, [ebp - 0x144]
push eax
push 0xaa1543
mov edx, str.eScanInstalledWithMailScanSupport
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x144], 0x31
jne 0x8b1684
push str._sysdir_TasksMailScan_Dispatcher
lea ecx, [ebp - 0x248]
push ecx
call esi
push edi
lea edx, [ebp - 0x248]
push edx
call fcn.00977760
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x248]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b1684
push 0xbd17a8
lea ecx, [ebp - 0x248]
call fcn.008abc50
add esp, 4
lea eax, [ebp - 0x24e0]
push eax
push str.ProtectHosts
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8b16f0
push 0xb3df28
push str.ProtectHostsX
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b16dc
mov eax, dword [ebp - 0x24e0]
mov esi, str.ProtectHostsX
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push str.ProtectHosts
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
cmp dword [0xb45d94], ebx
jne 0x8b16fe
mov dword [0xb3df28], ebx
push 0xb3df28
push str.ProtectHostsX
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8b1788
cmp dword [0xb54194], ebx
je 0x8b176d
mov byte [ebp - 0x658], bl
push 0x103
push ebx
lea ecx, [ebp - 0x657]
push ecx
call fcn.00a7ffb0
push 0x104
lea edx, [ebp - 0x658]
push edx
push 0xaa1543
mov edx, str.server
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0x18
cmp byte [ebp - 0x658], 0x31
jne 0x8b176d
mov dword [0xb3df28], ebx
mov eax, dword [0xb3df28]
mov esi, str.ProtectHostsX
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb3df28], ebx
je 0x8b17e6
mov byte [ebp - 0x75c], bl
push 0x103
push ebx
lea eax, [ebp - 0x75b]
push eax
call fcn.00a7ffb0
push 0x104
lea ecx, [ebp - 0x75c]
push ecx
push 0xaa1543
mov edx, str.ProtectHostsCustom
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0x18
cmp byte [ebp - 0x75c], 0x30
jne 0x8b17dc
mov dword [0xb3df28], ebx
jmp 0x8b17e6
cmp dword [0xb3df28], ebx
mov esi, edi
jne 0x8b17eb
mov esi, 2
call fcn.008abf40
cmp dword [ebp - 0x24b8], ebx
je 0x8b1807
mov edx, dword [ebp - 0x24d8]
push edx
call fcn.00968240
add esp, 4
push ebx
push 2
push ebx
push 0x2000d11
call dword [0xb8dac4]
add esp, 0x10
cmp eax, ebx
jl 0x8b195e
cmp dword [0xb8db58], ebx
jne 0x8b18bb
push ebx
push edi
push str.Driver_Extention_Filtering_Has_Been_Enabled
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb8e210]
cmp eax, ebx
je 0x8b196c
cmp byte [eax], bl
je 0x8b196c
mov dword [0xbd0af8], edi
mov dword [0xbd0b00], ebx
mov eax, dword [0xbd09d4]
cmp eax, ebx
je 0x8b187a
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd09d4], ebx
mov eax, dword [0xbd0adc]
cmp eax, ebx
je 0x8b1892
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0adc], ebx
push 0xbd0adc
push edi
mov eax, dword [0xb8e210]
push eax
call fcn.008c10f0
push 0xbd09d4
push ebx
push str..rpt_.log_.avc_.pf_.log1_.log2_.chk_.edb_.war_.nlb_.ora_.msb_.pm_.ctl_.ix_.manifest_.policy_.lan_.ecn_.ldb_.trc_.cdr_.klr_.avs_.dwg_.bak_.dws_.dwt_.sv__.dwl_.dwl2_.vsv_.vhd_.vhdx_.avhd_.avhdx_.vbox_.vbox_prev_.ev1
call fcn.008c10f0
add esp, 0x18
jmp 0x8b196c
cmp dword [0xb3a52c], ebx
je 0x8b1937
mov dword [0xbd0b00], edi
mov dword [0xbd0af8], ebx
mov eax, dword [0xbd09d4]
cmp eax, ebx
je 0x8b18e7
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd09d4], ebx
mov eax, dword [0xbd0adc]
cmp eax, ebx
je 0x8b18ff
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0adc], ebx
push 0xbd09d4
push edi
push str..rpt_.log_.avc_.pf_.log1_.log2_.chk_.edb_.war_.nlb_.ora_.msb_.pm_.ctl_.ix_.manifest_.policy_.lan_.ecn_.ldb_.trc_.cdr_.klr_.avs_.dwg_.bak_.dws_.dwt_.sv__.dwl_.dwl2_.vsv_.vhd_.vhdx_.avhd_.avhdx_.vbox_.vbox_prev_.ev1
call fcn.008c10f0
push 0xbd0adc
push ebx
mov ecx, dword [0xb8e210]
push ecx
call fcn.008c10f0
push ebx
push edi
push str.Pre_defined_Extensions_excluded_in_driver_1___LOG_FILE_TXFERS_TO_USB_
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8b196c
mov dword [0xbd0af8], ebx
mov dword [0xbd0b00], ebx
call fcn.008c0ca0
push ebx
push edi
push str.No_Extensions_excluded_in_driver_1___LOG_FILE_TXFERS_TO_USB_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8b196c
push eax
mov esi, str.OPT_USE_FILEEXT_FILTERING_LOCAL_Failed_
call fcn.008ab970
add esp, 4
call fcn.008b2cf0
push 1
call fcn.008c0890
mov edx, dword [str.AVPMAPP.EXE]
mov dword [ebp - 0x34c], edx
mov eax, dword [0xac6a3c]
mov dword [ebp - 0x348], eax
mov ecx, dword [0xac6a40]
mov dword [ebp - 0x344], ecx
push 0xf8
push ebx
lea edx, [ebp - 0x340]
push edx
call fcn.00a7ffb0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
push ebx
push 6
mov esi, edi
lea ebx, [ebp - 0x34c]
call fcn.008cab40
add esp, 8
test eax, eax
jne 0x8b1a2f
push eax
push edi
push eax
push 0x2000700
call dword [0xb8dac4]
add esp, 0x10
mov esi, eax
push edi
mov eax, ebx
lea ecx, [ebp - 0xd74]
push eax
test esi, esi
jl 0x8b1a15
push str.___Process___s:_d__Registered_For_FSBP__8_
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0xd74]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8b1a2f
push str.___Process___s:_d__Registration_For_FSBP_Failed__8_
push ecx
call fcn.00a78f30
push esi
lea esi, [ebp - 0xd74]
call fcn.008ab970
add esp, 0x14
xor ebx, ebx
push ebx
push edi
push ebx
push 0x2000702
call dword [0xb8dac4]
add esp, 0x10
cmp dword [0xb8db30], ebx
je 0x8b1a7d
push ebx
push 4
push ebx
push 0x2000700
call dword [0xb8dac4]
push ebx
push 4
push ebx
push 0x2000702
call dword [0xb8dac4]
push ebx
push 1
push str.SYSTEM_PID_4__EXCLUDED...
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
push ebx
push 0x1adb0
push ebx
push 0x2000103
call dword [0xb8dac4]
call fcn.009b7980
push ebx
mov edi, 1
push edi
push ebx
push 0x200070e
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x2000505
call dword [0xb8dac4]
push ebx
push edi
push ebx
push 0x2000605
call dword [0xb8dac4]
add esp, 0x40
lea esi, [ebp - 0x24d4]
call fcn.008abba0
lea esi, [ebp - 0x24c8]
call fcn.008abad0
cmp dword [0xb56804], ebx
je 0x8b1b06
cmp dword [ebp - 0x24c8], ebx
je 0x8b1b06
push ebx
push edi
push str.Registry_Self_Protection_Disabled_as_Cluster_Server.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x24c8], ebx
mov ecx, 0xb56938
mov edx, str.C:WINDOWS_system32eEmpty.exe
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
test al, al
jne 0x8b1b10
mov ecx, str.C:WINDOWS_system32eEmpty.exe
call fcn.00960910
push str.eEmpty.exe
push str.C:WINDOWS_system32eEmpty.exe
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x24d4], ebx
jne 0x8b1b4a
cmp dword [ebp - 0x24c8], ebx
je 0x8b1bc8
push edi
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32eEmpty.exe
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8b1bc2
push ebx
push edi
push str.Starting_Callback_Check_Process...
push 0xb54ce8
call fcn.008808e0
mov dword [0xbd0b14], ebx
push ebx
push edi
push str.C:WINDOWS_system32eEmpty.exe
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0x1c
test eax, eax
jne 0x8b1bc2
push ebx
push edi
cmp dword [0xbd0b14], ebx
jne 0x8b1bae
push str.Self_Protection_Disabled_as_Callback_Not_Received.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8b1bc8
push str.Self_Protection_Kept_Enabled._Callback_Reception_Success.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8b1bc8
mov dword [0xbd0b14], edi
call fcn.008f7500
mov esi, eax
call fcn.008f76a0
mov dword [ebp - 0x24e4], eax
call fcn.008f7870
mov dword [ebp - 0x24e8], eax
mov dword [0xbdd834], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, eax
mov dword [0xbdc574], 0
call fcn.009bba60
mov dword [0xbdc574], 1
push 0
push 1
push str.Iterating_Apps_in_Memory_1_...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x24b8], eax
mov dword [ebp - 0x24dc], eax
call fcn.00968110
test eax, eax
je 0x8b1c50
lea edx, [ebp - 0x24dc]
push edx
call fcn.009681c0
add esp, 4
mov dword [ebp - 0x24b8], eax
call fcn.008f43f0
cmp dword [ebp - 0x24b8], 0
je 0x8b1c6d
mov eax, dword [ebp - 0x24dc]
push eax
call fcn.00968240
add esp, 4
call fcn.009baca0
mov dword [0xbdc574], 2
call ebx
sub eax, edi
push eax
push str.Iteration_of_Apps_in_Memory_1__Finished_in__u_ms.
lea ecx, [ebp - 0x1584]
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x1584]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
xor ecx, ecx
call fcn.008c31a0
test esi, esi
je 0x8b1cd8
push 0
push 1
push str.Iterating_For_Self_Protection_Folders_1_...
push 0xb54ce8
call fcn.008808e0
push 1
mov eax, dword [0xbd0b48]
push eax
call fcn.009006c0
add esp, 0x18
cmp dword [ebp - 0x24e4], 0
je 0x8b1cfc
push 0
push 1
push str.Iterating_For_Self_Protection_Registry_1_...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.008ffb20
cmp dword [ebp - 0x24e8], 0
je 0x8b2280
mov byte [ebp - 0x1480], 0
push 0x207
push 0
lea ecx, [ebp - 0x147f]
push ecx
call fcn.00a7ffb0
push 0
push 0
lea edx, [ebp - 0x1480]
push edx
push 0
push 0
push 0
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call fcn.009748c0
add esp, 0x24
cmp byte [ebp - 0x1480], bl
je 0x8b1e77
lea ecx, [ebp - 0x1480]
call fcn.00960910
push str.Startup
lea eax, [ebp - 0x1480]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x1480]
call fcn.0095a450
test eax, eax
je 0x8b1de1
lea ecx, [ebp - 0x1480]
push ecx
push str.AllUsers_Startup:___s_
lea edx, [ebp - 0x1080]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x1080]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
lea ecx, [ebp - 0x1480]
call fcn.00960910
push 1
push ebx
lea ecx, [ebp - 0x1480]
mov edx, 0xbe48a8
call fcn.0097faa0
test eax, eax
je 0x8b1e10
push ebx
push 0x2c
lea ecx, [ebp - 0x1480]
push ecx
mov edi, 0xbd08cc
call fcn.0098d640
jmp 0x8b1e10
lea edx, [ebp - 0x1480]
push edx
push str.AllUsers_Startup_Folder_Absent:___s_
lea eax, [ebp - 0x1080]
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x1080]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
push str._windir_Tasks
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x248]
push eax
call fcn.00977760
lea ecx, [ebp - 0x248]
call fcn.0095a450
test eax, eax
je 0x8b1e9f
lea ecx, [ebp - 0x248]
call fcn.00960910
push 1
push ebx
lea ecx, [ebp - 0x248]
mov edx, 0xbe48a8
call fcn.0097faa0
test eax, eax
je 0x8b1e9f
push ebx
push 0x2c
lea ecx, [ebp - 0x248]
push ecx
mov edi, 0xbd08cc
call fcn.0098d640
jmp 0x8b1e9f
push str.GetFolderPaths_failed_Startup_Folder_Computation_
lea edx, [ebp - 0x1080]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x1080]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
cmp dword [0xbc27fc], ebx
je 0x8b1ef6
mov eax, dword [0xbd08cc]
cmp eax, ebx
je 0x8b1ec7
push eax
push str.FoldersToBeMonitoredForSuspiciousFiles_A_:__s
lea ecx, [ebp - 0xd74]
push ecx
call fcn.00a78f30
add esp, 0xc
jmp 0x8b1edb
push str.FoldersToBeMonitoredForSuspiciousFiles_A_:_NULL
lea edx, [ebp - 0xd74]
push edx
call fcn.00a78f30
add esp, 8
push ebx
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0xd74]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.009861a0
test eax, eax
je 0x8b2201
mov dword [ebp - 0x24bc], ebx
mov byte [ebp - 0x1278], bl
push 0x3ff
push ebx
lea edx, [ebp - 0x1277]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x1b8c], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x1b8b]
push eax
call fcn.00a7ffb0
add esp, 0x18
lea ecx, [ebp - 0x24b8]
push ecx
push ebx
call fcn.00986570
mov edi, dword [ebp - 0x24b8]
push edi
mov esi, str.Administrator
call fcn.0098c9f0
mov byte [ebp - 0x1b8c], bl
lea edx, [ebp - 0x1b8c]
push edx
push 2
lea ecx, [ebp - 0x1278]
mov ebx, edi
call fcn.0098cc00
add esp, 0xc
cmp byte [ebp - 0x1b8c], 0
je 0x8b1f9a
push 0
push 1
lea eax, [ebp - 0x1b8c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x1278], 0
je 0x8b1fc9
push 0x80000003
lea eax, [ebp - 0x24bc]
mov ecx, 1
lea edx, [ebp - 0x1278]
call fcn.0097f000
add esp, 4
test eax, eax
je 0x8b2104
mov byte [ebp - 0x1278], 0
call fcn.00986750
mov ebx, eax
cmp ebx, edi
je 0x8b201e
push ebx
mov esi, str.Administrator
call fcn.0098c9f0
lea edx, [ebp - 0x1b8c]
push edx
push 4
lea ecx, [ebp - 0x1278]
call fcn.0098cc00
add esp, 0xc
cmp byte [ebp - 0x1b8c], 0
je 0x8b201e
push 0
push 1
lea eax, [ebp - 0x1b8c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x1278], 0
je 0x8b204d
push 0x80000003
lea eax, [ebp - 0x24bc]
mov ecx, 1
lea edx, [ebp - 0x1278]
call fcn.0097f000
add esp, 4
test eax, eax
je 0x8b2104
mov byte [ebp - 0x1278], 0
jmp 0x8b2060
cmp byte [ebp - 0x1278], 0
jne 0x8b211c
test edi, edi
jbe 0x8b2113
dec edi
mov dword [ebp - 0x24b8], edi
push edi
mov esi, str.Administrator
call fcn.0098c9f0
lea edx, [ebp - 0x1b8c]
push edx
push 5
lea ecx, [ebp - 0x1278]
mov ebx, edi
call fcn.0098cc00
add esp, 0xc
cmp byte [ebp - 0x1b8c], 0
je 0x8b20c1
push 0
push 1
lea eax, [ebp - 0x1b8c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x1278], 0
je 0x8b204d
push 0x80000003
lea eax, [ebp - 0x24bc]
mov ecx, 1
lea edx, [ebp - 0x1278]
call fcn.0097f000
add esp, 4
test eax, eax
jne 0x8b204d
lea ecx, [ebp - 0x24bc]
push ecx
call fcn.009851c0
add esp, 4
jmp 0x8b2060
lea ecx, [ebp - 0x24bc]
push ecx
call fcn.009851c0
add esp, 4
cmp byte [ebp - 0x1278], 0
je 0x8b2159
lea edx, [ebp - 0x1278]
push edx
call fcn.008fcde0
push 2
lea ecx, [ebp - 0x1278]
call fcn.008fd240
add esp, 8
cmp dword [0xbd444c], 0
je 0x8b2201
lea eax, [ebp - 0x1278]
push eax
call fcn.008ac2f0
add esp, 4
jmp 0x8b2201
cmp byte [str.Administrator], 0
je 0x8b2201
push 0x5c
push str.Administrator
call fcn.00a7aa50
add esp, 8
mov esi, eax
test esi, esi
je 0x8b217e
inc esi
jmp 0x8b2183
mov esi, str.Administrator
mov byte [ebp - 0x178c], 0
push 0x207
push 0
lea ecx, [ebp - 0x178b]
push ecx
call fcn.00a7ffb0
push esi
movsx edx, byte [0xbd5ab0]
push edx
push str._cUsers_sAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
lea eax, [ebp - 0x178c]
push eax
call fcn.00a78f30
add esp, 0x1c
lea ecx, [ebp - 0x178c]
call fcn.0095a450
test eax, eax
je 0x8b2201
lea ecx, [ebp - 0x178c]
call fcn.00960910
push 1
push 0
lea ecx, [ebp - 0x178c]
mov edx, 0xbe48a8
call fcn.0097faa0
test eax, eax
je 0x8b2201
push 0
push 0x2c
lea ecx, [ebp - 0x178c]
push ecx
mov edi, 0xbd08cc
call fcn.0098d640
cmp dword [0xb3dea0], 0
je 0x8b2276
push str.SOFTWAREIObitUninstaller
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x24cc]
push eax
lea ecx, [ebp - 0x144]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x8b2246
mov edx, dword [ebp - 0x24cc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00968110
test eax, eax
je 0x8b2276
lea eax, [ebp - 0x24cc]
lea ecx, [ebp - 0x144]
mov edx, 0x80000002
call fcn.0097ee20
test eax, eax
jne 0x8b2276
mov eax, dword [ebp - 0x24cc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.008f8740
add esp, 4
push 0
push 1
push str._BDCACHE__Invalidate__LoadMon_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.008b2850
jmp 0x8b22be
mov dword [ebp - 4], 0xfffffffe
xor ebx, ebx
mov edi, dword [ebp - 0x24f0]
cmp edi, ebx
jl 0x8b27c6
mov byte [ebp - 0x248], bl
push 0x103
push ebx
lea ecx, [ebp - 0x247]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x554], bl
push 0x103
push ebx
lea edx, [ebp - 0x553]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0xe78], bl
push 0x103
push ebx
lea eax, [ebp - 0xe77]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x450], bl
push 0x103
push ebx
lea ecx, [ebp - 0x44f]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x964], bl
push 0x103
push ebx
lea edx, [ebp - 0x963]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x860], bl
push 0x103
push ebx
lea eax, [ebp - 0x85f]
push eax
call fcn.00a7ffb0
add esp, 0x48
mov byte [ebp - 0x34c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x34b]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x658], bl
push 0x103
push ebx
lea edx, [ebp - 0x657]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x144], bl
push 0x103
push ebx
lea eax, [ebp - 0x143]
push eax
call fcn.00a7ffb0
add esp, 0x24
push 0x104
lea ecx, [ebp - 0x248]
push ecx
push 0xab88e0
push ebx
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x104
lea edx, [ebp - 0x554]
push edx
push str.HH:mm:ss
push ebx
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov esi, 0xaa1543
call fcn.008bdb10
push str._Initializing_Log_File...
lea eax, [ebp - 0xd74]
push eax
call fcn.00a78f30
add esp, 8
lea esi, [ebp - 0xd74]
call fcn.008bdb10
cmp byte [ebp - 0x248], bl
je 0x8b244b
cmp byte [ebp - 0x554], bl
je 0x8b244b
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x248]
push edx
push 0xab891c
mov eax, esi
push eax
call fcn.00a78f30
add esp, 0x10
call fcn.008bdb10
push 0xb55918
push 0x410
lea ecx, [ebp - 0xd74]
push ecx
push 0xab3780
push 0xab91c4
push str.Prompt
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
xor eax, eax
jmp 0x8b2480
mov cl, byte [ebp + eax - 0xd74]
mov byte [ebp + eax - 0xe78], cl
inc eax
cmp cl, bl
jne 0x8b2480
push 0xb55918
push 0x410
lea edx, [ebp - 0xd74]
push edx
push str.eScan_Monitor_Successfully_Loaded
push 0xaae0f8
push 0xaaec30
call esi
push 0xab7b28
lea eax, [ebp - 0xd74]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push 0x104
lea ecx, [ebp - 0x450]
push ecx
push 0xaa1543
mov edx, 0xaa1548
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x450], bl
jne 0x8b250b
mov edx, dword [str.Null]
mov dword [ebp - 0x450], edx
mov al, byte [0xac6dd0]
mov byte [ebp - 0x44c], al
push 0x104
lea ecx, [ebp - 0x34c]
push ecx
push 0xaa1543
mov edx, str.Server
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x34c], bl
jne 0x8b257d
push 0xb55508
push str._sIUPDATE.INI
lea edx, [ebp - 0x144]
push edx
call fcn.00a78f30
push 1
push ebx
xor edx, edx
lea ecx, [ebp - 0x144]
call fcn.0095a0f0
add esp, 0x14
test eax, eax
jne 0x8b2571
mov eax, 0x30
mov word [ebp - 0x34c], ax
jmp 0x8b257d
mov ecx, 0x31
mov word [ebp - 0x34c], cx
push 0x104
lea edx, [ebp - 0x964]
push edx
push 0xaa1ac4
mov edx, str.StandAlone
mov ecx, 0xaa154c
call fcn.00958d30
push 0x104
lea eax, [ebp - 0x860]
push eax
push 0xaa1ac4
mov edx, str.eScanDeployed
mov ecx, 0xaa154c
call fcn.00958d30
push str.9.0.2.1669
lea ecx, [ebp - 0x860]
push ecx
lea edx, [ebp - 0x964]
push edx
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x450]
push ecx
push str._s._s._s._s____s
lea edx, [ebp - 0x658]
push edx
call fcn.00a78f30
add esp, 0x34
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0xd74]
push ecx
call esi
push 0xab7b2c
lea edx, [ebp - 0xd74]
push edx
call esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.eScan_Monitor
lea eax, [ebp - 0xe78]
push eax
lea ecx, [ebp - 0xd74]
push ecx
push 0xaa154c
push ebx
push 0x98
mov ecx, str.eScan_Monitor
call fcn.00982e00
xor eax, eax
mov cl, byte [ebp + eax - 0xe78]
mov byte [eax + 0xbd18d0], cl
inc eax
cmp cl, bl
jne 0x8b2640
xor eax, eax
jmp 0x8b2660
mov cl, byte [ebp + eax - 0xd74]
mov byte [eax + str.eScan_monitor_successfully_loaded__5DH.0.0.0___9.0.2.1669_], cl
inc eax
cmp cl, bl
jne 0x8b2660
mov dword [0xbd18cc], 0x98
mov dword [0xbd19d4], ebx
cmp dword [0xb436fc], ebx
je 0x8b2790
xor esi, esi
call fcn.0095e560
mov esi, eax
call fcn.00968b30
test eax, eax
jne 0x8b26b2
call fcn.00963620
cmp eax, 2
jg 0x8b26b2
cmp esi, 0x180000
jb 0x8b26c8
cmp dword [0xb436fc], 4
je 0x8b26c8
mov dword [0xb436fc], ebx
mov eax, edi
jmp 0x8b2825
cmp dword [0xb436fc], ebx
je 0x8b2790
cmp dword [0xbd04f4], ebx
jne 0x8b2790
push ebx
push 1
push str.Memory_Optimization_Done_After_Loading_Databases
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ebx, [ebp - 0xd74]
xor ecx, ecx
call fcn.0098aa50
push 0
push 0
push 0x98ac70
call fcn.00a791b2
mov esi, eax
push str.CBD_6m
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8b2770
mov byte [ebp - 0x75c], bl
push 0x103
push ebx
lea edx, [ebp - 0x75b]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_s__fails_with_error__d
lea eax, [ebp - 0x75c]
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x75c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
cmp byte [ebp - 0xd74], bl
je 0x8b2790
push 0
push 1
lea edx, [ebp - 0xd74]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, edi
jmp 0x8b2825
push ebx
push 1
push str.Error:_Unable_To_Create_Mwav_Sync_Mutex
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8b27c6
push ebx
push esi
push str.Read_of_KLR_Failed_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8b27c6
xor ebx, ebx
mov eax, dword [0xbd04e8]
cmp eax, ebx
je 0x8b27dc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0xbd04e8], ebx
mov eax, dword [0xbd04f0]
cmp eax, ebx
je 0x8b27f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0xbd04f0], ebx
cmp dword [0xbd04ec], ebx
je 0x8b281f
mov esi, 1
push 0xbd04ec
call fcn.00985290
test eax, eax
jne 0x8b280f
xor esi, esi
mov dword [0xbd04ec], ebx
cmp esi, ebx
je 0x8b281f
mov dword [0xbd04ec], ebx
mov eax, dword [ebp - 0x24f0]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret