Function at 0x401000
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Create directory
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Get file attributes
Move file
Persist via windows service
Query or enumerate registry value
Self delete
Set current directory
Set registry value

Disassembly:
mov eax, 0x10a0
call fcn.00405c80
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
xor edi, edi
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1100
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [esp + 0x10bc]
test eax, eax
jne 0x4010c4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push 0x414fcc
push edx
push edi
push str.Debug
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x4010a0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4010c4
push str.PATCH___1100
call fcn.00402bc0
add esp, 4
test eax, eax
jne 0x4010c4
jmp 0x4010b1
push str.PATCH___1100
call fcn.00402bc0
add esp, 4
test eax, eax
jne 0x4010c4
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1100
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0xea60
call esi
push str.SHFOLDER.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x4011e4
push str.SHGetFolderPathA
push ebx
call dword [0x414ea4]
test eax, eax
je 0x4011e4
lea edx, [esp + 0x184]
push edx
push 0
push 0
push 0x26
push 0
call eax
mov edi, 0x413764
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x184]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x188]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Network_Associates
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ecx, 3
lea eax, [esp + 0x188]
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
mov edi, 0x413764
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x184]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x184]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.System_Compliance_Profiler
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
lea eax, [esp + 0x188]
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
mov ebp, dword [esp + 0x10bc]
jmp 0x4011f7
lea ecx, [esp + 0x184]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test ebx, ebx
je 0x401202
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x414fcc], 3
jne 0x40126a
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
push str._BEGIN__r_n
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x414ec0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanInstaller.log
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414ec0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004027f0
add esp, 4
mov eax, dword [str.Install_path:]
mov ecx, dword [0x413704]
mov dword [esp + 0x3c], eax
mov ax, word [0x41370c]
mov dword [esp + 0x40], ecx
mov cl, byte [0x41370e]
mov word [esp + 0x48], ax
mov byte [esp + 0x4a], cl
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x413708]
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x44], edx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
mov ebx, 3
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, ebx
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x401311
lea eax, [esp + 0x3c]
push eax
call fcn.004027f0
add esp, 4
test ebp, ebp
mov edi, 1
je 0x401432
push 0x4136f8
push ebp
call fcn.0040bf40
add esp, 8
test eax, eax
jne 0x40134a
mov eax, dword [0x414fcc]
mov dword [esp + 0x20], edi
cmp eax, ebx
jne 0x40134a
push str.Uninstall_r_n
call fcn.004027f0
add esp, 4
push 0x4136e8
push ebp
call fcn.0040bf40
add esp, 8
test eax, eax
jne 0x401376
mov eax, dword [0x414fcc]
mov dword [esp + 0x1c], edi
cmp eax, ebx
jne 0x401376
push str.Remove_r_n
call fcn.004027f0
add esp, 4
push str._parser
push ebp
call fcn.0040bf40
add esp, 8
test eax, eax
jne 0x4013a2
mov eax, dword [0x414fcc]
mov dword [esp + 0x18], edi
cmp eax, ebx
jne 0x4013a2
push str.Server_r_n
call fcn.004027f0
add esp, 4
push 7
push str._update
push ebp
call fcn.0040be30
add esp, 0xc
test eax, eax
jne 0x401432
cmp dword [0x414fcc], ebx
jne 0x4013cb
push str.Update_r_n
call fcn.004027f0
add esp, 4
push 0x4136b0
push ebp
call fcn.00405bd2
push 0x4136b0
push 0
call fcn.00405bd2
mov esi, eax
mov eax, dword [0x414fcc]
add esp, 0x10
cmp eax, ebx
jne 0x4013fd
push str.Running_update_task_r_n
call fcn.004027f0
add esp, 4
push esi
call fcn.004031c0
mov eax, dword [0x414fcc]
add esp, 4
cmp eax, ebx
jne 0x4027dc
push str.Update_task_launched_r_n
call fcn.004027f0
mov eax, dword [0x414fcc]
add esp, 4
cmp eax, ebx
jne 0x4027dc
jmp 0x4027cf
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push str.SYSTEMCurrentControlSetServicesNAIMSERV350
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4014a6
lea edx, [esp + 0x14]
lea eax, [esp + 0xcb0]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push str.ImagePath
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401596
cmp dword [0x414fcc], ebx
jne 0x401499
push str.Were_on_an_ePO_3.5_server_r_n
call fcn.004027f0
add esp, 4
mov dword [esp + 0x18], 0
jmp 0x401582
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push str.SYSTEMCurrentControlSetServicesNAIMSERV301
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x401521
lea edx, [esp + 0x14]
lea eax, [esp + 0xcb0]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push str.ImagePath
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401596
cmp dword [0x414fcc], ebx
jne 0x401507
push str.Were_on_an_ePO_3.0.1_server_r_n
call fcn.004027f0
add esp, 4
mov dword [esp + 0x18], edi
mov dword [0x414fc4], 0x4135f4
mov dword [0x414fc8], 0x4135c8
jmp 0x401596
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push str.SYSTEMCurrentControlSetServicesNAIMSERV3
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4015a1
lea edx, [esp + 0x14]
lea eax, [esp + 0xcb0]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push str.ImagePath
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401596
cmp dword [0x414fcc], ebx
jne 0x40157e
push str.Were_on_an_ePO_3.0_server_r_n
call fcn.004027f0
add esp, 4
mov dword [esp + 0x18], edi
mov dword [0x414fc4], str.SYSTEMCurrentControlSetServicesNAIMSERV3
mov dword [0x414fc8], 0x413570
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ecx, 0xffffffff
mov edi, 0x413764
xor eax, eax
lea edx, [esp + 0x184]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, 3
mov esi, edi
mov ebx, ecx
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x490]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x184]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x490]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanInstaller.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
and ecx, ebp
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x401a02
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x401a02
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x401a02
lea eax, [esp + 0x698]
push 0x104
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
lea edi, [esp + 0x698]
xor eax, eax
lea edx, [esp + 0x38c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x38c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413764
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x38c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanEventParser.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x38c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401894
mov eax, dword [0x414fcc]
mov esi, 3
cmp eax, esi
mov ebp, 1
jne 0x40172f
push str.Removing_old_event_parser_DLL...stopping_services_r_n
call fcn.004027f0
add esp, 4
call fcn.004029c0
cmp dword [0x414fcc], esi
jne 0x401749
push str.Deleting_old_event_parser_DLL_r_n
call fcn.004027f0
add esp, 4
lea ecx, [esp + 0x38c]
push ecx
call ebx
test eax, eax
jne 0x401894
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x401793
call esi
cmp eax, 3
je 0x401810
push 0x3e8
call edi
lea edx, [esp + 0x38c]
push edx
call ebx
test eax, eax
je 0x401767
jmp 0x401894
mov ecx, 5
mov esi, str.DLL_file_not_found:
lea edi, [esp + 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x38c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, 3
cmp eax, 3
rep movsb byte es:[edi], byte [esi]
jne 0x4018aa
jmp 0x401887
mov ecx, 5
mov esi, str.DLL_path_not_found:
lea edi, [esp + 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x38c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, 3
cmp eax, 3
rep movsb byte es:[edi], byte [esi]
jne 0x4018aa
lea eax, [esp + 0x3c]
push eax
call fcn.004027f0
add esp, 4
cmp dword [0x414fcc], 3
jne 0x4018aa
push str.Install_event_parser_DLL_r_n
call fcn.004027f0
add esp, 4
mov edx, dword [esp + 0x10b4]
lea ecx, [esp + 0x184]
push str.PatchScanEventParser.dll
push ecx
push 0x68
push edx
call fcn.004028d0
lea edi, [esp + 0x194]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x298]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x298]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanEventParser.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x298]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x6ac]
lea edx, [esp + 0x50]
push ecx
push str._s_regsvr32.exe__s___s__r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x414fcc]
add esp, 0x20
cmp eax, 3
jne 0x40195c
lea eax, [esp + 0x3c]
push eax
call fcn.004027f0
add esp, 4
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, 2
lea edi, [esp + 0x140]
mov esi, 3
mov byte [ecx + edx], al
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov eax, dword [0x414fcc]
mov dword [esp + 0x140], 0x44
cmp eax, esi
jne 0x4019a8
push str.Registering_event_parser_DLL_r_n
call fcn.004027f0
add esp, 4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x140]
push eax
lea edx, [esp + 0x188]
push ecx
push edx
push 0
push 0x20
push 0
push 0
lea eax, [esp + 0x58]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test ebp, ebp
je 0x4019fd
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x414fcc], esi
jne 0x4019f8
push str.Restarting_services_r_n
call fcn.004027f0
add esp, 4
call fcn.00402a90
mov ebp, 3
or ecx, 0xffffffff
lea edi, [esp + 0x184]
xor eax, eax
lea edx, [esp + 0x288]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x288]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.PtchScan.dll
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x8a0]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x184]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x8a0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PtchScan.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x9a4]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x184]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PtchScan.scp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x9a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, ebp
push eax
push 1
push 0
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1000
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, eax
test esi, esi
je 0x401b44
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1100
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, eax
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, dword [esp + 0x1c]
jne 0x402056
test eax, eax
jne 0x40205e
cmp dword [0x414fcc], ebp
jne 0x401b71
push str.Install_SCP_r_n
call fcn.004027f0
add esp, 4
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test esi, esi
jne 0x401cd2
lea edx, [esp + 0x594]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x413764
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x594]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1100
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x598]
and ecx, 3
push reloc.OLEAUT32.dll_SysReAllocString
rep movsb byte es:[edi], byte [esi]
mov edi, str.PtchScan.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call esi
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1000
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [0x414fcc], 3
jne 0x401c26
push str.Upgrading...waiting_to_delete_plugin_DLL_r_n
call fcn.004027f0
add esp, 4
push str.PATCH___1100
call fcn.00402bc0
push str.PATCH___1000
call fcn.00402bc0
add esp, 8
lea eax, [esp + 0x288]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401c7a
call esi
cmp eax, 2
je 0x401c7a
call esi
cmp eax, 3
je 0x401c7a
push 0x3e8
call edi
lea ecx, [esp + 0x288]
push ecx
call ebx
test eax, eax
je 0x401c57
lea edx, [esp + 0x594]
push edx
call ebx
test eax, eax
jne 0x401cab
call esi
cmp eax, 2
je 0x401cab
call esi
cmp eax, 3
je 0x401cab
push 0x3e8
call edi
lea eax, [esp + 0x594]
push eax
call ebx
test eax, eax
je 0x401c88
lea ecx, [esp + 0x8a0]
push ecx
call ebx
mov eax, dword [0x414fcc]
mov edi, 3
cmp eax, edi
jne 0x401cfd
push str.Plugin_DLL_deleted_r_n
call fcn.004027f0
add esp, 4
jmp 0x401cfd
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x414fd0
push 0
push str.SOFTWARENetwork_AssociatesPatch_Scanner
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov edi, 3
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x414fcc], edi
jne 0x401d1d
push str.Copying_files_and_creating_reg_keys_r_n
call fcn.004027f0
add esp, 4
lea edx, [esp + 0xaa8]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x490]
push 0
lea ecx, [esp + 0xaac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x184]
push str.PtchScan.dll
mov esi, dword [esp + 0x10b8]
push edx
push 0x67
push esi
call fcn.004028d0
lea eax, [esp + 0x194]
push str.PtchScan.exe
push eax
push 0x6a
push esi
call fcn.004028d0
lea ecx, [esp + 0x1a4]
push str.PtchScan.scp
push ecx
push 0x6b
push esi
call fcn.004028d0
add esp, 0x30
lea edx, [esp + 0x38c]
mov dword [esp + 0x38c], 0x94
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x390], 4
jne 0x401e88
mov eax, dword [esp + 0x394]
cmp eax, 0xa
je 0x401dcf
cmp eax, 0x5a
jne 0x401e88
cmp dword [0x414fcc], edi
jne 0x401de4
push str.Windows_9x_r_n
call fcn.004027f0
add esp, 4
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x594]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x594]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.unicows.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x594]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401e88
cmp dword [0x414fcc], 3
jne 0x401e69
push str.Installing_unicows.dll_r_n
call fcn.004027f0
add esp, 4
mov edx, dword [esp + 0x10b4]
lea ecx, [esp + 0x184]
push str.unicows.dll
push ecx
push 0x69
push edx
call fcn.004028d0
add esp, 0x10
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x414fd0
push 0
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1100
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov edx, dword [esp + 0x14]
push 0x4132d0
push 1
push 0
push str.Build_Number
push edx
call ebx
push 4
push 0x414fcc
mov eax, dword [esp + 0x18]
push 4
push 0
push str.Debug
push eax
call ebx
push 5
push str.0000
mov ecx, dword [esp + 0x18]
push 1
push 0
push str.Language
push ecx
call ebx
lea edi, [esp + 0x288]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x288]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.Plugin_Path
push eax
call ebx
push 0x1b
push str.System_Compliance_Profiler
mov ecx, dword [esp + 0x18]
push 1
push 0
push str.Product_Name
push ecx
call ebx
push 0xd
push str.PATCH___1100
mov edx, dword [esp + 0x18]
push 1
push 0
push str.Software_ID
push edx
call ebx
lea edi, [esp + 0x490]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x698]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413280
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x698]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x698]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x698]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.Uninstall_Command
push ecx
call ebx
push 0xa
push str.1.1.0.182
mov edx, dword [esp + 0x18]
push 1
push 0
push str.Version
push edx
call ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.PATCH___1100
call fcn.00402ae0
mov eax, dword [0x414fcc]
add esp, 4
cmp eax, 3
jne 0x402018
push str.Waiting_for_ePO_Agent_to_load_plug_in..._r_n
call fcn.004027f0
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x3e8
call ebx
push str.PATCH___1100
push 0
push 0x1f0001
call edi
inc esi
cmp esi, 0x1e
ja 0x402045
test eax, eax
je 0x402026
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 3
jmp 0x4027c7
test eax, eax
je 0x40232f
cmp dword [0x414fcc], ebp
jne 0x402073
push str.Removing_product...waiting_to_delete_installer_r_n
call fcn.004027f0
add esp, 4
lea ecx, [esp + 0x490]
push ecx
call ebx
test eax, eax
jne 0x4021b7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call esi
cmp eax, 2
je 0x4020bc
call esi
cmp eax, ebp
je 0x402136
push 0x3e8
call edi
lea edx, [esp + 0x490]
push edx
call ebx
test eax, eax
je 0x402091
jmp 0x4021b7
mov ecx, 5
mov esi, str.Exe_file_not_found:
lea edi, [esp + 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x490]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, ebp
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
jne 0x4021b7
jmp 0x4021aa
mov ecx, 5
mov esi, str.Exe_path_not_found:
lea edi, [esp + 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x490]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, ebp
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
jne 0x4021b7
lea eax, [esp + 0x3c]
push eax
call fcn.004027f0
add esp, 4
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x79c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x79c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PtchScan.log
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x79c]
and ecx, ebp
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x79c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x79c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanEventParser.log
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x79c]
and ecx, ebp
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov eax, dword [0x414fcc]
xor esi, esi
cmp eax, ebp
jne 0x402297
push str.Removing_SCP_directory_r_n
call fcn.004027f0
add esp, 4
push 0x41317c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x184]
push ecx
call edi
test eax, eax
jne 0x40231a
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jae 0x4022dc
push 0x3e8
call ebx
lea edx, [esp + 0x184]
push edx
call edi
test eax, eax
je 0x4022bc
cmp esi, 5
jb 0x40231a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x188]
push eax
lea ecx, [esp + 0xab0]
push str.Couldnt_remove__s:__d_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x414fcc]
add esp, 0x10
cmp eax, ebp
jne 0x40231a
lea edx, [esp + 0xaa8]
push edx
call fcn.004027f0
add esp, 4
push str.SOFTWARENetwork_AssociatesPatch_Scanner
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4027c7
test esi, esi
jne 0x40233e
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00402ca0
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_PluginsPATCH___1100
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40243f
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x288]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x288]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanEventParser.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x288]
and ecx, ebp
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x188]
lea edx, [esp + 0xaac]
push ecx
push str._sregsvr32.exe__s__u__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x150]
add esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x414fcc]
mov dword [esp + 0x140], 0x44
cmp eax, ebp
jne 0x402410
push str.Un_registering_event_parser_DLL_r_n
call fcn.004027f0
add esp, 4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x140]
push eax
lea edx, [esp + 0x188]
push ecx
push edx
push 0
push 0x20
push 0
push 0
lea eax, [esp + 0xac4]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x288]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x288]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PtchScan.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, ebp
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
jne 0x4024af
push str.Removing_product...waiting_to_delete_plug_in_r_n
call fcn.004027f0
add esp, 4
push str.PATCH___1100
call fcn.00402bc0
add esp, 4
lea eax, [esp + 0x288]
push eax
call ebx
test eax, eax
jne 0x402600
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call esi
cmp eax, 2
je 0x402505
call esi
cmp eax, ebp
je 0x40257f
push 0x3e8
call edi
lea ecx, [esp + 0x288]
push ecx
call ebx
test eax, eax
je 0x4024da
jmp 0x402600
mov ecx, 5
mov esi, str.DLL_file_not_found:
lea edi, [esp + 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x288]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, ebp
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
jne 0x402600
jmp 0x4025f3
mov ecx, 5
mov esi, str.DLL_path_not_found:
lea edi, [esp + 0x3c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x288]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4136fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x414fcc]
mov ecx, edx
and ecx, ebp
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
jne 0x402600
lea eax, [esp + 0x3c]
push eax
call fcn.004027f0
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4026a4
cmp dword [0x414fcc], ebp
jne 0x402621
push str.Removing_product...stopping_services_r_n
call fcn.004027f0
add esp, 4
call fcn.004029c0
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x288]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x288]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov edi, str.PatchScanEventParser.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x288]
and ecx, ebp
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
cmp dword [0x414fcc], ebp
jne 0x40269f
push str.Removing_product...restarting_services_r_n
call fcn.004027f0
add esp, 4
call fcn.00402a90
lea ecx, [esp + 0x8a0]
push ecx
call ebx
lea edx, [esp + 0x9a4]
push edx
call ebx
lea eax, [esp + 0x38c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.PatchScanInstaller.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x390]
and ecx, ebp
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 4
lea edx, [esp + 0x390]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, 0x41309c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x11
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
mov eax, dword [0x414fcc]
mov dword [esp + 0x140], 0x44
cmp eax, ebp
jne 0x402783
push str.Creating_temp_executable_to_continue_uninstallation_r_n
call fcn.004027f0
add esp, 4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x140]
push eax
lea edx, [esp + 0x188]
push ecx
push edx
push 0
push 0x20
push 0
push 0
lea eax, [esp + 0x3a8]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [0x414fcc], ebp
jne 0x4027dc
push str.Temp_executable_created_r_n
call fcn.004027f0
add esp, 4
cmp dword [0x414fcc], ebp
jne 0x4027dc
push str._END__r_n
call fcn.004027f0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10a0
ret 0x10