Function at 0x426c10
Capabilities:
Create thread
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66fee8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x421c
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x4200], ebx
mov dword [ebp - 4], ebx
cmp dword [0x752d8c], ebx
je 0x426c71
push str._AVPMAPP__InitService___1
push ebx
call fcn.004f0f30
add esp, 8
push ebx
push 0x6b030c
call fcn.00507770
cmp dword [0x6b030c], ebx
je 0x428f95
cmp dword [0x752d8c], ebx
je 0x426c9e
push str._AVPMAPP__InitService___2
push ebx
call fcn.004f0f30
add esp, 8
push ebx
push 1
push 0x61aaac
push 0x6aec98
call fcn.004311c0
push 0x6af4b8
call fcn.0041b780
add esp, 0x14
cmp dword [0x72bb6c], ebx
je 0x426cda
push ebx
push 1
push str._COREBD_THREADS_DISABLED...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6b0544], ebx
je 0x426cf7
push ebx
push 1
push str._AVPMAPP_THREADS_DISABLED...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x72bb78], ebx
je 0x426d75
mov eax, dword [0x72bb7c]
cmp eax, ebx
jne 0x426d26
cmp dword [0x72bb80], ebx
jne 0x426d22
cmp dword [0x72bb84], ebx
jne 0x426d22
push ebx
push 1
push str._ALL_CALLBACKS_SET_TO_DUMMY...
jmp 0x426d68
cmp eax, ebx
je 0x426d3b
push ebx
push 1
push str._DC_FILE_SCAN_CALLBACK_Set._Other_CALLBACKS_SET_TO_DUMMY...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x72bb80], ebx
je 0x426d58
push ebx
push 1
push str._DC_REGISTRY_SCAN_CALLBACK_Set._Other_CALLBACKS_SET_TO_DUMMY...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x72bb84], ebx
je 0x426d75
push ebx
push 1
push str._DC_ProcessNotify_Set._Other_CALLBACKS_SET_TO_DUMMY...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x752d8c], ebx
je 0x426d8b
push str._AVPMAPP__Into_regular_loggings...
push ebx
call fcn.004f0f30
add esp, 8
push ebx
push 1
push str.Creating_File_Mappings
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x6b030c]
push eax
push 0x758
push 0x67c9e0
call fcn.004e9900
mov dword [0x6b00fc], eax
cmp eax, ebx
je 0x428f80
cmp eax, 0xffffffff
je 0x428f80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x426dfb
push 0x67c9e0
call fcn.004eade0
add esp, 4
mov dword [0x6b00fc], eax
cmp eax, ebx
je 0x428f80
cmp eax, 0xffffffff
je 0x428f80
mov ecx, dword [0x6b030c]
push ecx
push 0x10
push 0x67c9ec
call fcn.004e9900
mov dword [0x6b0204], eax
push ebx
push ebx
push ebx
push 1
lea edx, [ebp - 0x4234]
push edx
call fcn.0050b1f0
add esp, 0x14
cmp dword [0x6ae138], 9
jae 0x426ea1
push ebx
push 1
push str.Loading_Comm_Library
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 1
call fcn.00513800
mov dword [0x6b0554], eax
cmp eax, ebx
jne 0x426e6c
push ebx
push 1
push str.Comm_Library_loading_failed_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x426e7d
push 0x207
push 0x6b0558
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 1
push str.Setting_AR_Entries
push 0x6aec98
call fcn.004311c0
push 1
call fcn.004f5ce0
add esp, 0x14
push ebx
push ebx
push ebx
call fcn.00515670
call fcn.005d9ef0
push 0x67e108
push str.ProtectKernel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x426edd
mov eax, dword [0x67e108]
push eax
push str.ProtectKernel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e108], ebx
je 0x427006
lea ecx, [ebp - 0x41f8]
push ecx
push 1
push ebx
push str.SoftwareAventail_VPN_Client
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
test eax, eax
jne 0x426f31
mov edx, dword [ebp - 0x41f8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x67e108], ebx
push ebx
push str.ProtectKernel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e108], ebx
je 0x427006
lea eax, [ebp - 0x41f8]
push eax
push 1
push ebx
push str.SoftwarePlanit
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
test eax, eax
jne 0x426f85
mov ecx, dword [ebp - 0x41f8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x67e108], ebx
push ebx
push str.ProtectKernel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e108], ebx
je 0x427006
mov byte [ebp - 0x41f0], bl
push 0x7ff
push ebx
lea edx, [ebp - 0x41ef]
push edx
call fcn.005dfd60
push ebx
push ebx
push ebx
lea eax, [ebp - 0x41f0]
push eax
push str.Dual_Monitor
call fcn.00518400
add esp, 0x20
test eax, eax
je 0x426fdb
mov dword [0x67e108], ebx
push ebx
push str.ProtectKernel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e108], ebx
je 0x427006
cmp dword [0x6b07a0], ebx
je 0x427006
mov dword [0x67e108], ebx
push ebx
push str.ProtectKernel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x6ae130], ebx
je 0x427016
cmp dword [0x6b0530], ebx
jne 0x427034
mov eax, dword [0x6940e4]
mov ecx, eax
inc eax
mov dword [0x6940e4], eax
push ecx
push 0x2710
push ebx
push 2
call fcn.0052e1c0
add esp, 0x10
mov byte [ebp - 0x1778], bl
push 0x103
push ebx
lea ecx, [ebp - 0x1777]
push ecx
call fcn.005dfd60
push 0x8c
push 0x80
push 0x7f
lea edx, [ebp - 0x1778]
push edx
push 0x6af4b8
call fcn.004c4eb0
add esp, 0x20
cmp byte [ebp - 0x1778], bl
je 0x42708b
push ebx
push 1
lea eax, [ebp - 0x1778]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0x41fc], ebx
lea ecx, [ebp - 0x41fc]
push ecx
push str.ProPause
push str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp al, 1
jne 0x427152
cmp dword [ebp - 0x41fc], ebx
je 0x427152
push ebx
push str.ProPause
push str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push str.ProPauseESPro
push str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
call fcn.00430810
push str.GlobalSecurity
call fcn.004eae00
add esp, 4
mov esi, eax
lea edx, [ebp - 0x41fc]
push edx
push str.BackUp
push str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp al, 1
jne 0x427147
mov eax, dword [ebp - 0x41fc]
push eax
push str.SecurityMode
push str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp al, 1
jne 0x427147
cmp esi, ebx
je 0x427152
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp esi, ebx
je 0x427152
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x6ae130], ebx
je 0x427162
cmp dword [0x6b0530], ebx
jne 0x427180
mov eax, dword [0x6940e4]
mov ecx, eax
inc eax
mov dword [0x6940e4], eax
push ecx
push 0x2710
push ebx
push 2
call fcn.0052e1c0
add esp, 0x10
push ebx
push 1
push str.Creating_AvpmApp_Events
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.00417f60
mov esi, eax
mov dword [ebp - 0x4200], esi
cmp esi, ebx
je 0x428f1c
mov byte [ebp - 0x146c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x146b]
push ecx
call fcn.005dfd60
push ebx
push 1
push 0x6143ec
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push ebx
push 1
cmp dword [0x6ae130], ebx
je 0x4271f8
cmp dword [0x67e110], ebx
je 0x4271f1
push str.Microworld_Real_Time_File_Monitoring__DB_
jmp 0x4271fd
push str.Microworld_Real_Time_File_Monitoring__AV_Plugin_Absent_
jmp 0x4271fd
push str.Microworld_Real_Time_File_Monitoring__LK_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push ebx
push 1
push 0x61aaac
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.004f0280
mov dword [0x6aa81c], eax
push 0x6af4b8
push 0x6b0cf8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
push 0x6b0cf8
call fcn.004e24e0
add esp, 4
push str.license.ini
push 0x6b0cf8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
push 0x6af4b8
push 0x6b0bf0
call esi
push 0x6b0bf0
call fcn.004e24e0
add esp, 4
push str.verinfo.ini
push 0x6b0bf0
call edi
push 1
push ebx
push ebx
push ebx
push ebx
push 0x6b0bf0
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x427735
mov byte [ebp - 0x738], bl
push 0x103
push ebx
lea edx, [ebp - 0x737]
push edx
call fcn.005dfd60
mov byte [ebp - 0x2ed4], bl
push 0x103
push ebx
lea eax, [ebp - 0x2ed3]
push eax
call fcn.005dfd60
mov byte [ebp - 0x2fd8], bl
push 0x103
push ebx
lea ecx, [ebp - 0x2fd7]
push ecx
call fcn.005dfd60
mov byte [ebp - 0xd50], bl
push 0x103
push ebx
lea edx, [ebp - 0xd4f]
push edx
call fcn.005dfd60
mov byte [ebp - 0x22a4], bl
push 0x103
push ebx
lea eax, [ebp - 0x22a3]
push eax
call fcn.005dfd60
push ebx
push 0x104
lea ecx, [ebp - 0x22a4]
push ecx
push 0x60c81c
push str.SNRM
push 0x60c810
call fcn.004edfd0
add esp, 0x54
cmp byte [ebp - 0x22a4], 0x31
jne 0x427349
mov dword [0x6b0784], 1
push ebx
push 0x104
lea edx, [ebp - 0x940]
push edx
push 0x60c81c
push 0x615660
push 0x60c810
call fcn.004edfd0
push ebx
push str.Rescuecom
lea eax, [ebp - 0x940]
push eax
call fcn.004f5880
add esp, 0x24
cmp eax, 0xffffffff
je 0x42738e
mov dword [0x6b0780], 1
push 0x6b0bf0
push 0x104
lea ecx, [ebp - 0xd50]
push ecx
push 0x60c81c
push str.GPDate
push str.General
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
push 0x6b0bf0
push 0x104
lea edx, [ebp - 0x738]
push edx
push 0x60c81c
push 0x6111d8
push str.General
call esi
cmp byte [ebp - 0x738], bl
je 0x427546
cmp byte [ebp - 0xd50], bl
je 0x427410
lea eax, [ebp - 0xd50]
push eax
lea ecx, [ebp - 0x738]
push ecx
push str.eScan_Version:__s___s_
lea edx, [ebp - 0xf58]
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x42742b
lea eax, [ebp - 0x738]
push eax
push str.eScan_Version:__s
lea ecx, [ebp - 0xf58]
push ecx
call fcn.005dfb23
add esp, 0xc
push ebx
push 1
lea edx, [ebp - 0xf58]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x6b0bf0
push 0x104
lea eax, [ebp - 0x2ed4]
push eax
push 0x60c81c
push str.VersionLogged
push str.General
call esi
push 0x6b0bf0
push 0x104
lea ecx, [ebp - 0x2fd8]
push ecx
push 0x60c81c
push str.AppNameLogged
push str.General
call esi
cmp byte [ebp - 0xd50], bl
je 0x4274b2
lea edx, [ebp - 0xd50]
push edx
lea eax, [ebp - 0x738]
push eax
push 0x61a768
lea ecx, [ebp - 0xf58]
push ecx
call fcn.005dfb23
add esp, 0x10
jmp 0x4274cd
lea edx, [ebp - 0x738]
push edx
push 0x60c800
lea eax, [ebp - 0xf58]
push eax
call fcn.005dfb23
add esp, 0xc
push 0x61a764
lea ecx, [ebp - 0xf58]
push ecx
call edi
lea edx, [ebp - 0x940]
push edx
lea eax, [ebp - 0xf58]
push eax
call edi
push 0x6af8c8
push 0x104
lea ecx, [ebp - 0x83c]
push ecx
push str.eScan_Configured
push 0x61a74c
push 0x614348
call esi
push 0x6b0bf0
lea edx, [ebp - 0x738]
push edx
push str.VersionLogged
push str.General
call fcn.004e0cb0
push 0x6b0bf0
lea eax, [ebp - 0x940]
push eax
push str.AppNameLogged
push str.General
call fcn.004e0cb0
add esp, 0x20
push 0x6af6c0
push 0x6af4b8
push str.eScan_Path:__s___s_
lea ecx, [ebp - 0xf58]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0xf58]
push edx
push 0x6aec98
call fcn.004311c0
mov byte [ebp - 0x328], bl
push 0x103
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.005dfd60
mov byte [ebp - 0x25b0], bl
push 0x103
push ebx
lea ecx, [ebp - 0x25af]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x1160], bl
push 0x103
push ebx
lea edx, [ebp - 0x115f]
push edx
call fcn.005dfd60
add esp, 0x44
push 0x6b0bf0
push 0x104
lea eax, [ebp - 0x1160]
push eax
push 0x60c81c
push str.ESPATCH_InstallDate
push str.General
call esi
push 0x6b0bf0
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push 0x60c81c
push str.ESPATCH
push str.General
call esi
cmp byte [ebp - 0x328], bl
je 0x427735
cmp byte [ebp - 0x1160], bl
je 0x42763c
lea edx, [ebp - 0x1160]
push edx
lea eax, [ebp - 0x328]
push eax
push str.Hotfix_Version:__s___s_
lea ecx, [ebp - 0xf58]
push ecx
call fcn.005dfb23
add esp, 0x10
jmp 0x427657
lea edx, [ebp - 0x328]
push edx
push str.Hotfix_Version:__s
lea eax, [ebp - 0xf58]
push eax
call fcn.005dfb23
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xf58]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x6b0bf0
push 0x104
lea edx, [ebp - 0x25b0]
push edx
push 0x60c81c
push str.ESPVersionLogged
push str.General
call esi
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x25b0]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x427735
cmp byte [ebp - 0x1160], bl
je 0x4276da
lea edx, [ebp - 0x1160]
push edx
lea eax, [ebp - 0x328]
push eax
push 0x61a768
lea ecx, [ebp - 0xf58]
push ecx
call fcn.005dfb23
add esp, 0x10
jmp 0x4276f5
lea edx, [ebp - 0x328]
push edx
push 0x60c800
lea eax, [ebp - 0xf58]
push eax
call fcn.005dfb23
add esp, 0xc
push 0x6af8c8
push 0x104
lea ecx, [ebp - 0x83c]
push ecx
push str.Hotfix_Installed
push 0x61a6c4
push 0x614348
call esi
push 0x6b0bf0
lea edx, [ebp - 0x328]
push edx
push str.ESPVersionLogged
push str.General
call fcn.004e0cb0
add esp, 0x10
call fcn.004f0570
mov dword [0x6e9188], eax
lea eax, [ebp - 0x41f4]
push eax
push str.ShowTrayIconOnTerminalClients
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov edi, 1
test al, al
jne 0x42777e
mov dword [ebp - 0x41f4], edi
push edi
push str.ShowTrayIconOnTerminalClients
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea ecx, [ebp - 0x41f4]
push ecx
push str.ShowTrayIcon
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4277b8
mov dword [ebp - 0x41f4], edi
push edi
push str.ShowTrayIcon
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea edx, [ebp - 0x41f4]
push edx
push str.VKBoardShortCutDisabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4277f2
mov dword [ebp - 0x41f4], ebx
push ebx
push str.VKBoardShortCutDisabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea eax, [ebp - 0x41f4]
push eax
push str.PrintScreenDisabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x42782c
mov dword [ebp - 0x41f4], ebx
push ebx
push str.PrintScreenDisabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea ecx, [ebp - 0x41f4]
push ecx
push str.ShowTrayMenu
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x427866
mov dword [ebp - 0x41f4], edi
push edi
push str.ShowTrayMenu
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea edx, [ebp - 0x41f4]
push edx
push str.DisableMenuItem
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4278a0
mov dword [ebp - 0x41f4], ebx
push ebx
push str.DisableMenuItem
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push ebx
push 0x104
lea eax, [ebp - 0x146c]
push eax
push 0x60c81c
push str.ShowDesktopIcon
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0x146c], bl
je 0x42790e
mov ecx, dword [ebp - 0x146c]
push ecx
call fcn.004da320
add esp, 4
test eax, eax
je 0x42790e
lea edx, [ebp - 0x146c]
push edx
call fcn.005e0909
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [0x685bac], eax
push eax
push str.ShowDesktopIcon
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x685bac
push str.ShowDesktopIcon
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x427948
mov dword [0x685bac], edi
push edi
push str.ShowDesktopIcon
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
jmp 0x427956
mov eax, dword [0x685bac]
push eax
call fcn.00417600
add esp, 4
push 0x61a64c
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
push 0x67cefc
push 0x61a64c
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x67d004
push str.MonitorPrintJobs
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4279c5
xor eax, eax
cmp dword [0x6ae144], ebx
setne al
mov dword [0x67d004], eax
push eax
push str.MonitorPrintJobs
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x6ae144], ebx
jne 0x4279d5
cmp dword [0x67d004], ebx
jne 0x4279dd
cmp dword [0x6b07a0], ebx
je 0x4279e3
mov dword [0x67d004], ebx
push 0x6ae140
push str.FileRightsValue
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x427a09
mov dword [0x6ae140], ebx
push ebx
jmp 0x427a50
cmp dword [0x6ae140], ebx
je 0x427a7a
mov dword [ebp - 0x4214], ebx
lea ecx, [ebp - 0x4214]
push ecx
push str.FileRightsValueDefCh
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x4214], 2
je 0x427a7a
cmp dword [0x6ae144], ebx
jne 0x427a49
mov dword [0x6ae140], ebx
mov edx, dword [0x6ae140]
push edx
push str.FileRightsValue
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 2
push str.FileRightsValueDefCh
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push str.FileInfectorDetected
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
push 0x6b07cc
push str.FileInfectorDetectedEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov esi, 4
cmp dword [0x6ae140], esi
je 0x427ac2
cmp dword [0x6b07cc], ebx
je 0x427ac2
mov dword [0x6ae140], esi
push 0x6e91c4
push str.LogFilesCopiedToUSB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x427af9
mov eax, dword [0x6e91c4]
push eax
push str.LogFilesCopiedToUSB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x685bbc
push str.BlockFileRenamesToMultipleExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x427b31
mov ecx, dword [0x685bbc]
push ecx
push str.BlockFileRenamesToMultipleExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67e110], ebx
jne 0x427b3f
mov dword [0x685bbc], ebx
push str.mwfsmfltr
call fcn.005110b0
mov dword [0x6b07c4], eax
call fcn.00431000
mov dword [0x67e10c], eax
cmp dword [0x6b07a0], ebx
je 0x427b8d
push str.MWFSFLT
push edi
cmp dword [0x6b07c4], ebx
jne 0x427b75
push str.MWFSM_Driver_will_Not_be_installed_as_this_is_Cluster_Server
jmp 0x427b80
mov dword [0x6b07c4], ebx
push str.MWFSM_Driver_Forced_to_FALSE_as_this_is_Cluster_Server
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6b07c4], ebx
jne 0x427ed7
cmp dword [0x6b07a0], ebx
jne 0x427ecb
test byte [0x6e91c4], 4
jne 0x427bc2
cmp dword [0x685bbc], ebx
jne 0x427bc2
cmp dword [0x67e10c], ebx
je 0x427ecb
call fcn.004d9870
test eax, eax
je 0x427ecb
mov byte [ebp - 0x634], bl
push 0x103
push ebx
lea edx, [ebp - 0x633]
push edx
call fcn.005dfd60
mov byte [ebp - 0xb48], bl
push 0x103
push ebx
lea eax, [ebp - 0xb47]
push eax
call fcn.005dfd60
add esp, 0x18
mov ecx, 0x6af4b8
lea edx, [ebp - 0x634]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x427c10
lea ecx, [ebp - 0x634]
push ecx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x634]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x427c32
mov edx, dword [str.mwfsm_]
mov dword [eax], edx
mov cx, word [0x61a594]
mov word [eax + 4], cx
mov dl, byte [0x61a596]
mov byte [eax + 6], dl
push ebx
lea eax, [ebp - 0x634]
push eax
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x427ecb
mov byte [ebp - 0x530], bl
push 0x103
push ebx
lea ecx, [ebp - 0x52f]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x42c], bl
push 0x103
push ebx
lea edx, [ebp - 0x42b]
push edx
call fcn.005dfd60
add esp, 0x18
call fcn.004d96c0
test eax, eax
je 0x427d21
mov byte [ebp - 0x1f98], bl
push 0x103
push ebx
lea eax, [ebp - 0x1f97]
push eax
call fcn.005dfd60
mov byte [ebp - 0x23a8], bl
push 0x103
push ebx
lea ecx, [ebp - 0x23a7]
push ecx
call fcn.005dfd60
lea edx, [ebp - 0x634]
push edx
push str._smwfsmfltx.sys
lea eax, [ebp - 0x1f98]
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x634]
push ecx
push str._smwfsmflt.sys
lea edx, [ebp - 0x23a8]
push edx
call fcn.005dfb23
push ebx
lea eax, [ebp - 0x23a8]
push eax
lea ecx, [ebp - 0x1f98]
push ecx
call fcn.004edd70
add esp, 0x3c
lea edx, [ebp - 0x634]
push edx
push str._smwfsmflt.inf
lea eax, [ebp - 0xb48]
push eax
call fcn.005dfb23
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xb48]
push ecx
call fcn.004ec5a0
add esp, 0x20
test eax, eax
jne 0x427e99
push str.MWFSFLT
push edi
push str.Installing_MWFSMFLT_Driver...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0xb48]
push eax
call fcn.005319c0
push str.mwfsmfltr
call fcn.005110b0
mov dword [0x6b07c4], eax
cmp byte [ebp - 0x42c], bl
je 0x427db4
lea ecx, [ebp - 0x42c]
push ecx
push eax
push str.Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_._Err:__s
lea edx, [ebp - 0x530]
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x427dc9
push eax
push str.Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_
lea eax, [ebp - 0x530]
push eax
call fcn.005dfb23
add esp, 0xc
push str.MWFSFLT
push edi
lea ecx, [ebp - 0x530]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6b07c4], ebx
jne 0x427ed7
mov byte [ebp - 0x42c], bl
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0xb48]
push eax
call fcn.00531c50
push str.MWFSFLT
push edi
push str.Again_Trying_To_Install_MWFSMFLT_Driver...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0xb48]
push edx
call fcn.005319c0
push str.mwfsmfltr
call fcn.005110b0
mov dword [0x6b07c4], eax
cmp byte [ebp - 0x42c], bl
je 0x427e68
lea ecx, [ebp - 0x42c]
push ecx
push eax
push str._A_Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_._Err:__s
lea edx, [ebp - 0x530]
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x427e7d
push eax
push str._A_Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_
lea eax, [ebp - 0x530]
push eax
call fcn.005dfb23
add esp, 0xc
push str.MWFSFLT
push edi
lea ecx, [ebp - 0x530]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x427ecb
lea edx, [ebp - 0xb48]
push edx
push str.File_Missing:__s
lea eax, [ebp - 0x530]
push eax
call fcn.005dfb23
push str.MWFSFLT
push edi
lea ecx, [ebp - 0x530]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [0x6b07c4], ebx
je 0x428177
push ebx
push 0x104
lea edx, [ebp - 0x83c]
push edx
push 0x60c81c
push 0x61a3c8
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0x83c], 0x30
jne 0x427f2e
push str.1eScanProtected.docx
push str.0eScanProtected.docx
push ebx
push esi
call fcn.0052bcf0
push ebx
push ebx
push str.eScanProtected
push 0x6af4b8
call fcn.00517250
add esp, 0x20
jmp 0x427fd6
mov dword [ebp - 0x4218], ebx
mov ecx, 0x6af4b8
lea edx, [ebp - 0x1674]
nop
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x427f40
lea eax, [ebp - 0x1674]
push eax
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x1674]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x427f62
mov ecx, dword [str.eScanProtected.docx]
mov dword [eax], ecx
mov edx, dword [0x61a374]
mov dword [eax + 4], edx
mov ecx, dword [0x61a378]
mov dword [eax + 8], ecx
mov edx, dword [0x61a37c]
mov dword [eax + 0xc], edx
mov ecx, dword [0x61a380]
mov dword [eax + 0x10], ecx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x4218]
push edx
lea eax, [ebp - 0x1674]
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x427fd6
cmp dword [ebp - 0x4218], ebx
jbe 0x427fd6
push str.1eScanProtected.docx
push str.0eScanProtected.docx
lea ecx, [ebp - 0x1674]
push ecx
push 2
call fcn.0052bcf0
add esp, 0x10
cmp dword [0x6b07c4], ebx
je 0x428177
call fcn.004d9930
test eax, eax
je 0x4280aa
mov byte [ebp - 0x27b8], bl
push 0x207
push ebx
lea edx, [ebp - 0x27b7]
push edx
call fcn.005dfd60
add esp, 0xc
push ebx
lea eax, [ebp - 0x27b8]
push eax
call fcn.004f8c70
cmp byte [ebp - 0x27b8], bl
je 0x4280aa
push str.INFOTECH
lea ecx, [ebp - 0x27b8]
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x42806f
push ebx
push str.icici
lea edx, [ebp - 0x27b8]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x42806f
lea eax, [ebp - 0x27b8]
push eax
push str.NT_Domain:__s
lea ecx, [ebp - 0x39f0]
push ecx
call fcn.005dfb23
jmp 0x42808d
lea edx, [ebp - 0x27b8]
push edx
push str.Forcing_FileRightsDriverInstalled_status_to_FALSE_as_Domain_is__s
lea eax, [ebp - 0x39f0]
push eax
call fcn.005dfb23
mov dword [0x6b07c4], ebx
add esp, 0xc
push str.MWFSFLT
push edi
lea ecx, [ebp - 0x39f0]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6b07c4], ebx
je 0x428177
mov byte [ebp - 0x1d90], bl
push 0x103
push ebx
lea edx, [ebp - 0x1d8f]
push edx
call fcn.005dfd60
mov byte [ebp - 0x29c0], bl
push 0x207
push ebx
lea eax, [ebp - 0x29bf]
push eax
call fcn.005dfd60
push str.MWFSFLT
push edi
push str.Initializing_mwfsmflt...
push 0x6aec98
call fcn.004311c0
lea ecx, [ebp - 0x1d90]
push ecx
call fcn.005350d0
add esp, 0x2c
test eax, eax
je 0x42813d
push str.MWFSFLT
push edi
push str.Success_Initializing_mwfsmflt...
push 0x6aec98
call fcn.004311c0
push 0x6aec98
push fcn.004311c0
call fcn.00533d60
add esp, 0x18
mov dword [0x6b07c8], edi
jmp 0x42818f
mov dword [0x6b07c4], ebx
lea edx, [ebp - 0x1d90]
push edx
push str.mwfs_Initialize_failed___s_
lea eax, [ebp - 0x29c0]
push eax
call fcn.005dfb23
push str.MWFSFLT
push edi
lea ecx, [ebp - 0x29c0]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x42818f
push str.MWFSFLT
push edi
push str.File_Rights_driver_is_not_installed
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6ae144], ebx
jne 0x4281a4
test byte [0x6e91c4], 0x80
je 0x42836f
push 0x67d7c4
push str.SendSoftwareInstalledEvent
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x428267
cmp dword [0x67d7c4], 2
jne 0x428282
mov byte [ebp - 0x1b88], bl
push 0x103
push ebx
lea edx, [ebp - 0x1b87]
push edx
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x421c], 0x104
lea eax, [ebp - 0x421c]
push eax
lea ecx, [ebp - 0x1b88]
push ecx
push str.LogMcst
push 0x613dac
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp byte [ebp - 0x1b88], bl
je 0x428267
mov byte [ebp - 0x1e94], bl
push 0x103
push ebx
lea edx, [ebp - 0x1e93]
push edx
call fcn.005dfd60
lea eax, [ebp - 0x1b88]
push eax
push str.SoftwareMicroWorldeScan_for_Windows_s
lea ecx, [ebp - 0x1e94]
push ecx
call fcn.005dfb23
add esp, 0x18
push ebx
push ebx
lea edx, [ebp - 0x1e94]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9480
push edi
push str.SendSoftwareInstalledEvent
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x67d7c4], edi
call fcn.004f48a0
push str.LanmanDependencyOnMonitor
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
cmp dword [0x67e110], ebx
je 0x4282eb
push 0x67dc04
push str.LanmanDependencyOnMonitorEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4282eb
cmp dword [0x6b07ac], ebx
jne 0x4282cf
cmp dword [0x6b07a0], ebx
jne 0x4282cf
mov eax, edi
jmp 0x4282d1
xor eax, eax
mov dword [0x67dc04], eax
push eax
push str.LanmanDependencyOnMonitorEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x67dc04], 2
je 0x42830a
cmp dword [0x6b07ac], ebx
jne 0x428304
cmp dword [0x6b07a0], ebx
je 0x42830a
mov dword [0x67dc04], ebx
mov dword [0x6e9180], ebx
push 0x6e9180
push str.MonitorLoadDelayInSecs
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x67dc04], edi
jne 0x428352
cmp dword [0x6e9180], ebx
jne 0x428352
call fcn.0052ab50
push ebx
push edi
test eax, eax
je 0x42834b
push str.Added_LanmanServer_Dependency_1_...
jmp 0x428362
push str.Unable_to_add_LanmanServer_Dependency_1_...
jmp 0x428362
call fcn.0052acd0
test eax, eax
je 0x42836f
push ebx
push edi
push str.Removed_LanmanServer_Dependency_1_...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6ae130], ebx
je 0x42837f
cmp dword [0x6b0530], ebx
jne 0x42839e
mov eax, dword [0x6940e4]
mov ecx, eax
add eax, edi
mov dword [0x6940e4], eax
push ecx
push 0x2710
push ebx
push 2
call fcn.0052e1c0
add esp, 0x10
push 0x6ae13c
push str.SyncTime
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4283db
mov dword [0x6ae13c], 2
push 2
push str.SyncTime
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
xor esi, esi
mov dword [ebp - 0x4204], esi
mov eax, dword [0x6ae13c]
cmp eax, edi
je 0x4284d7
cmp eax, 2
je 0x4283fe
cmp eax, 3
jne 0x4284df
mov dword [ebp - 0x41f8], ebx
mov byte [ebp - 0xa44], bl
push 0x103
push ebx
lea eax, [ebp - 0xa43]
push eax
call fcn.005dfd60
push str.SOFTWAREMicroWorldDeviceControlSchedule
lea ecx, [ebp - 0xa44]
push ecx
call fcn.005dfb23
add esp, 0x14
lea edx, [ebp - 0x41f8]
push edx
push 0x61726c
lea eax, [ebp - 0xa44]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov eax, dword [ebp - 0x41f8]
cmp eax, ebx
jne 0x428492
push str.SOFTWAREMicroWorldComponentWebScanCContentFilteringSchedule
lea ecx, [ebp - 0xa44]
push ecx
call fcn.005dfb23
add esp, 8
lea edx, [ebp - 0x41f8]
push edx
push 0x61726c
lea eax, [ebp - 0xa44]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov eax, dword [ebp - 0x41f8]
cmp eax, ebx
je 0x42849e
mov esi, edi
mov dword [ebp - 0x4204], esi
cmp eax, ebx
jne 0x4284df
push str.SOFTWAREMicroWorldContentFilteringSchedule
lea ecx, [ebp - 0xa44]
push ecx
call fcn.005dfb23
add esp, 8
lea edx, [ebp - 0x41f8]
push edx
push 0x61726c
lea eax, [ebp - 0xa44]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x41f8], ebx
je 0x4284df
mov esi, edi
mov dword [ebp - 0x4204], esi
cmp dword [0x6ae130], ebx
je 0x4284ef
cmp dword [0x6b0530], ebx
jne 0x42850e
mov eax, dword [0x6940e4]
mov ecx, eax
add eax, edi
mov dword [0x6940e4], eax
push ecx
push 0x2710
push ebx
push 2
call fcn.0052e1c0
add esp, 0x10
cmp esi, ebx
je 0x428546
cmp dword [0x6b0544], ebx
jne 0x428546
push ebx
push edi
push str.Started_TimeSync_Thread_1_...
push 0x6aec98
call fcn.004311c0
push ebx
push ebx
push 0x55cb40
call fcn.005e07ac
push ebx
push eax
push str.AVM_1y
call fcn.00411ca0
add esp, 0x28
cmp dword [0x67e108], ebx
jne 0x428582
cmp dword [0x6b0544], ebx
jne 0x428582
push ebx
push edi
push str.Started_Kernel_Pause_Thread...
push 0x6aec98
call fcn.004311c0
push ebx
push ebx
push 0x418320
call fcn.005e07ac
push ebx
push eax
push str.AVM_1z
call fcn.00411ca0
add esp, 0x28
mov eax, dword [0x67cefc]
cmp eax, ebx
je 0x4285b5
push eax
push str.Memory_Optimization_Enabled__DWOM___u_
lea ecx, [ebp - 0x83c]
push ecx
call fcn.005dfb23
push ebx
push edi
lea edx, [ebp - 0x83c]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4285c9
push ebx
push edi
push str.Memory_Optimization_Disabled
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov byte [ebp - 0x1a84], bl
push 0x103
push ebx
lea eax, [ebp - 0x1a83]
push eax
call fcn.005dfd60
mov byte [ebp - 0x105c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x105b]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x1980], bl
push 0x103
push ebx
lea edx, [ebp - 0x197f]
push edx
call fcn.005dfd60
mov byte [ebp - 0x187c], bl
push 0x103
push ebx
lea eax, [ebp - 0x187b]
push eax
call fcn.005dfd60
mov byte [ebp - 0x31e0], bl
push 0x207
push ebx
lea ecx, [ebp - 0x31df]
push ecx
call fcn.005dfd60
push ebx
lea edx, [ebp - 0x187c]
push edx
call fcn.004fceb0
add esp, 0x44
push ebx
lea eax, [ebp - 0x1a84]
push eax
call fcn.00504d90
lea ecx, [ebp - 0x105c]
push ecx
lea edx, [ebp - 0x1980]
push edx
call fcn.00504d90
cmp byte [ebp - 0x105c], bl
je 0x4286d0
push 0x60c81c
push str.Ver:
lea eax, [ebp - 0x105c]
push eax
call fcn.004e9030
push 0x61a150
push 0x61a140
lea ecx, [ebp - 0x105c]
push ecx
call fcn.004e9030
lea edx, [ebp - 0x187c]
push edx
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1a84]
push ecx
push str._s__s__Install_Date:__s_
lea edx, [ebp - 0x31e0]
push edx
call fcn.005dfb23
add esp, 0x2c
jmp 0x4286f2
lea eax, [ebp - 0x187c]
push eax
lea ecx, [ebp - 0x1a84]
push ecx
push str._s__Install_Date:__s_
lea edx, [ebp - 0x31e0]
push edx
call fcn.005dfb23
add esp, 0x10
push ebx
push edi
lea eax, [ebp - 0x31e0]
push eax
push 0x6aec98
call fcn.004311c0
mov byte [ebp - 0xc4c], bl
push 0x103
push ebx
lea ecx, [ebp - 0xc4b]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x2bc8], bl
push 0x207
push ebx
lea edx, [ebp - 0x2bc7]
push edx
call fcn.005dfd60
push ebx
push 0x104
lea eax, [ebp - 0xc4c]
push eax
push 0x60c81c
push 0x615660
push 0x60c810
call fcn.004edfd0
add esp, 0x40
push ebx
push str.Rescuecom
lea ecx, [ebp - 0xc4c]
push ecx
call fcn.004f5880
add esp, 0xc
lea edx, [ebp - 0xc4c]
lea ecx, [ebp - 0x2bc8]
push edx
cmp eax, 0xffffffff
mov eax, dword [0x6aa81c]
push eax
je 0x42879c
cmp dword [0x6ae144], ebx
jne 0x428795
push str.eScan_Version:__u__RC__SOHO____s_
jmp 0x4287b0
push str.eScan_Version:__u__RC__SMB_Corporate____s_
jmp 0x4287b0
cmp dword [0x6ae144], ebx
jne 0x4287ab
push str.eScan_Version:__u__SOHO____s_
jmp 0x4287b0
push str.eScan_Version:__u__SMB_Corporate____s_
push ecx
call fcn.005dfb23
add esp, 0x10
push ebx
push edi
lea edx, [ebp - 0x2bc8]
push edx
push 0x6aec98
call fcn.004311c0
mov dword [0x6b0518], ebx
xor esi, esi
mov dword [ebp - 0x4200], esi
mov dword [0x6ae134], ebx
push 0x6b0518
push ebx
push 0x426860
call fcn.005e07ac
mov dword [0x6b051c], eax
push ebx
push eax
push str.AVM_1u
call fcn.00411ca0
add esp, 0x28
cmp dword [0x6b051c], 0xffffffff
je 0x428f77
mov byte [ebp - 0x21a0], bl
push 0x207
push ebx
lea eax, [ebp - 0x219f]
push eax
call fcn.005dfd60
mov byte [ebp - 0x1674], bl
push 0x207
push ebx
lea ecx, [ebp - 0x1673]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x37f8], bl
mov byte [ebp - 0x224], bl
push 0x207
push ebx
lea edx, [ebp - 0x223]
push edx
call fcn.005dfd60
add esp, 0x24
mov dword [ebp - 0x4208], esi
push 0x208
lea eax, [ebp - 0x1674]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x1674]
push ecx
call fcn.004e24e0
add esp, 4
cmp dword [0x6ae130], ebx
jne 0x4288ab
push str.Klif
lea edx, [ebp - 0x1674]
push edx
push str._sDrivers_s.sys
lea eax, [ebp - 0x21a0]
push eax
jmp 0x4288c3
push str.BdfsFltr
lea ecx, [ebp - 0x1674]
push ecx
push str._sDrivers_s.sys
lea edx, [ebp - 0x21a0]
push edx
call fcn.005dfb23
add esp, 0x10
call fcn.004d96c0
test eax, eax
je 0x428949
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21a0]
push eax
call fcn.00501600
add esp, 0x14
test eax, eax
je 0x42891f
cmp dword [0x6ae130], ebx
jne 0x428909
push str.Klif
push str.Error:__s_Driver_ABSENT
lea ecx, [ebp - 0x224]
push ecx
jmp 0x4289b7
push str.BdfsFltr
push str.Error:__s_Driver_ABSENT
lea edx, [ebp - 0x224]
push edx
jmp 0x4289b7
mov esi, edi
mov dword [ebp - 0x4208], esi
cmp dword [0x6ae130], ebx
jne 0x428936
push str.Klif
jmp 0x4289ab
push str.BdfsFltr
push str._s_Driver_Present
lea ecx, [ebp - 0x224]
push ecx
jmp 0x4289b7
lea edx, [ebp - 0x21a0]
push edx
call fcn.004ec4c0
add esp, 4
test eax, eax
jne 0x428983
cmp dword [0x6ae130], ebx
jne 0x428970
push str.Klif
push str.Error:__s_Driver_ABSENT
jmp 0x4289b0
push str.BdfsFltr
push str.Error:__s_Driver_ABSENT
lea ecx, [ebp - 0x224]
push ecx
jmp 0x4289b7
mov esi, edi
mov dword [ebp - 0x4208], esi
cmp dword [0x6ae130], ebx
jne 0x4289a6
push str.Klif
push str._s_Driver_Present
lea edx, [ebp - 0x224]
push edx
jmp 0x4289b7
push str.BdfsFltr
push str._s_Driver_Present
lea eax, [ebp - 0x224]
push eax
call fcn.005dfb23
add esp, 0xc
mov dword [ebp - 0x4210], ebx
xor edi, edi
mov dword [ebp - 0x420c], edi
cmp esi, ebx
je 0x428a5a
call fcn.004d96c0
test eax, eax
je 0x428a16
lea ecx, [ebp - 0x4210]
push ecx
call fcn.004f77e0
add esp, 4
cmp eax, ebx
je 0x428a2d
lea edx, [ebp - 0x21a0]
push edx
call fcn.004e8b10
mov edi, eax
mov dword [ebp - 0x420c], edi
mov eax, dword [ebp - 0x4210]
push eax
call fcn.004f7860
add esp, 8
jmp 0x428a2d
lea ecx, [ebp - 0x21a0]
push ecx
call fcn.004e8b10
add esp, 4
mov edi, eax
mov dword [ebp - 0x420c], edi
cmp esi, ebx
je 0x428a5a
push edi
push str.__Size:__d
lea edx, [ebp - 0x1980]
push edx
call fcn.005dfb23
add esp, 0xc
lea eax, [ebp - 0x1980]
push eax
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
mov edi, 1
push edi
lea edx, [ebp - 0x224]
push edx
push 0x6aec98
call fcn.004311c0
mov byte [ebp - 0x33e8], bl
push 0x207
push ebx
lea eax, [ebp - 0x33e7]
push eax
call fcn.005dfd60
mov byte [ebp - 0x35f0], bl
push 0x207
push ebx
lea ecx, [ebp - 0x35ef]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x2dd0], bl
push 0x207
push ebx
lea edx, [ebp - 0x2dcf]
push edx
call fcn.005dfd60
mov byte [ebp - 0x1264], bl
push 0x103
push ebx
lea eax, [ebp - 0x1263]
push eax
call fcn.005dfd60
add esp, 0x40
mov esi, 0x104
mov dword [ebp - 0x4220], esi
mov byte [ebp - 0x83c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x83b]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x1c8c], bl
push 0x103
push ebx
lea edx, [ebp - 0x1c8b]
push edx
call fcn.005dfd60
mov byte [ebp - 0x24ac], bl
push 0x103
push ebx
lea eax, [ebp - 0x24ab]
push eax
call fcn.005dfd60
lea ecx, [ebp - 0x2dd0]
push ecx
lea edx, [ebp - 0x33e8]
push edx
lea eax, [ebp - 0x35f0]
push eax
call fcn.005098d0
add esp, 0x30
cmp byte [ebp - 0x33e8], bl
je 0x428b89
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x33e8]
push ecx
call dword [sym.imp.USER32.dll_CharLowerA]
push eax
push str.AvpmApp_Path:___s__PID:__u_
lea edx, [ebp - 0x224]
push edx
call fcn.005dfb23
push ebx
push edi
lea eax, [ebp - 0x224]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp byte [ebp - 0x2dd0], bl
je 0x428c65
mov byte [ebp - 0x1368], bl
push 0x103
push ebx
lea ecx, [ebp - 0x1367]
push ecx
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x4224], esi
lea edx, [ebp - 0x4224]
push edx
lea eax, [ebp - 0x1368]
push eax
push str.MonitorVersion
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp byte [ebp - 0x1368], bl
je 0x428c2e
lea ecx, [ebp - 0x2dd0]
push ecx
lea edx, [ebp - 0x1368]
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x428c2e
lea eax, [ebp - 0x1368]
push eax
push str.AvpmApp_Earlier_Version:___s_
lea ecx, [ebp - 0x224]
push ecx
call fcn.005dfb23
push ebx
push edi
lea edx, [ebp - 0x224]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [0x6b0524], edi
lea eax, [ebp - 0x2dd0]
push eax
push str.AvpmApp_Version:___s_
lea ecx, [ebp - 0x224]
push ecx
call fcn.005dfb23
push ebx
push edi
lea edx, [ebp - 0x224]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
lea eax, [ebp - 0x2dd0]
push eax
jmp 0x428c6a
push str.Monitor_Version_Unavailable_
push str.MonitorVersion
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
lea ecx, [ebp - 0x24ac]
push ecx
call fcn.00513fd0
push 0x208
lea edx, [ebp - 0x29c0]
push edx
lea eax, [ebp - 0x24ac]
push eax
call fcn.004e82a0
lea ecx, [ebp - 0x29c0]
push ecx
call fcn.004e2520
lea edx, [ebp - 0x29c0]
push edx
push str.AVS_Path:___s_
lea eax, [ebp - 0x224]
push eax
call fcn.005dfb23
push ebx
push edi
lea ecx, [ebp - 0x224]
push ecx
push 0x6aec98
call fcn.004311c0
lea edx, [ebp - 0x4220]
push edx
lea eax, [ebp - 0x1264]
push eax
call fcn.004e7c90
add esp, 0x34
cmp byte [ebp - 0x1264], bl
je 0x428d46
call fcn.004e2580
test eax, eax
je 0x428d15
lea ecx, [ebp - 0x1264]
push ecx
push str.User:___s___ADMIN_
lea edx, [ebp - 0x224]
push edx
jmp 0x428d28
lea eax, [ebp - 0x1264]
push eax
push str.User:___s___NON_ADMIN_
lea ecx, [ebp - 0x224]
push ecx
call fcn.005dfb23
add esp, 0xc
push ebx
push edi
lea edx, [ebp - 0x224]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push ebx
call fcn.004f28b0
cmp eax, ebx
je 0x428d9a
lea ecx, [ebp - 0x1c8c]
push ecx
lea edx, [ebp - 0x83c]
push edx
push eax
call fcn.00515670
cmp byte [ebp - 0x1c8c], bl
je 0x428d9a
lea eax, [ebp - 0x1c8c]
push eax
push str.Parent_Process:___s_
lea ecx, [ebp - 0x224]
push ecx
call fcn.005dfb23
push ebx
push edi
lea edx, [ebp - 0x224]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov byte [ebp - 0x940], bl
push 0x103
push ebx
lea eax, [ebp - 0x93f]
push eax
call fcn.005dfd60
add esp, 0xc
push ebx
lea ecx, [ebp - 0x940]
push ecx
call fcn.004dc7e0
cmp byte [ebp - 0x940], bl
je 0x428df8
lea edx, [ebp - 0x940]
push edx
push str.HostName:__s
lea eax, [ebp - 0x224]
push eax
call fcn.005dfb23
push ebx
push edi
lea ecx, [ebp - 0x224]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push str.wscsvc
call fcn.005110b0
push ebx
push edi
test eax, eax
jne 0x428e0f
push str.WSC:_Windows_Security_Center_NOT_available.
jmp 0x428e14
push str.WSC:_Windows_Security_Center_available.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.00416880
push ebx
push edi
cmp dword [0x6ae144], ebx
je 0x428e6a
cmp dword [0x6b0770], ebx
je 0x428e3f
push str.Edition:_SMB_Corporate__Secondary_Server__n
jmp 0x428e6f
cmp dword [0x6b0768], ebx
je 0x428e5d
cmp dword [0x6b0774], ebx
je 0x428e56
push str.Edition:_SMB_Corporate__eScan_Client___Update_Agent__n
jmp 0x428e6f
push str.Edition:_SMB_Corporate__eScan_Client__n
jmp 0x428e6f
mov dword [0x6b076c], edi
push str.Edition:_SMB_Corporate__eScan_Primary_Server__n
jmp 0x428e6f
push str.Edition:_SOHO_n
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x6ae138]
cmp eax, 9
jne 0x428e8f
push ebx
push edi
push str.VAL_SKELETON_CODE
jmp 0x428eb7
cmp eax, 8
jne 0x428e9d
push ebx
push edi
push str.VAL_RETURN_WITHOUT_SCANNING_ADNC
jmp 0x428eb7
cmp eax, 7
jne 0x428eab
push ebx
push edi
push str.VAL_RETURN_WITHOUT_SCANNING_A
jmp 0x428eb7
cmp eax, 6
jne 0x428ec4
push ebx
push edi
push str.VAL_DO_NOT_SET_FILTER_OPTION
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6ae130], ebx
je 0x428ed4
cmp dword [0x6b0530], ebx
jne 0x428ef3
mov eax, dword [0x6940e4]
mov ecx, eax
add eax, edi
mov dword [0x6940e4], eax
push ecx
push 0x7148
push ebx
push 2
call fcn.0052e1c0
add esp, 0x10
mov edx, dword [0x6ade94]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, edi
mov dword [ebp - 0x4200], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x428fc5
call fcn.00416880
push ebx
push 1
push str.Error_Creating_AvpmApp_Events
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6b030c], ebx
je 0x428f4b
push 0x6b030c
call fcn.004d8d20
add esp, 4
mov eax, dword [0x6b00fc]
cmp eax, ebx
je 0x428f61
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6b00fc], ebx
mov eax, dword [0x6b0204]
cmp eax, ebx
je 0x428f77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6b0204], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x428fc5
cmp dword [0x6b030c], ebx
je 0x428f95
push 0x6b030c
call fcn.004d8d20
add esp, 4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x428fc7
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret