Function at 0x8edee0
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0xa9c21e
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, 0x3234
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x3230], eax
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0x3278]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
push 0x27ff
mov esi, edx
lea edx, [esp + 0xa41]
push 0
push edx
mov dword [esp + 0x54], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], 0
mov byte [esp + 0xa48], 0
call fcn.00a7ffb0
xor eax, eax
add esp, 0xc
push 0x103
push eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov byte [esp + 0x79], al
mov byte [esp + 0x8c], al
lea eax, [esp + 0x8d]
push eax
mov byte [esp + 0x74], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x521]
push 0
push ecx
mov byte [esp + 0x528], 0
call fcn.00a7ffb0
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x40], ebx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
test edi, edi
jne 0x8ee054
cmp dword [0xbc27fc], edi
je 0x8ee03b
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xa40]
push str._CBX__Entering_eScanScanCallback__iAFlag___x_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push edi
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
mov eax, dword [0xbc27fc]
add esp, 0x10
test eax, eax
je 0x8ee03b
push edi
push eax
push str._CBX__Null_Context
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [esp + 0x34]
test eax, eax
je 0x8f0c57
mov ecx, dword [0xb8dae8]
mov dword [eax], ecx
jmp 0x8f0c57
cmp dword [edi + 0x99c], 0
mov byte [edi + 0x9e0], 1
je 0x8ee070
push str._CBI_
lea edx, [esp + 0x6c]
push edx
jmp 0x8ee07a
push str._CBA_
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0xbc27fc], 0
je 0x8ee0ee
cmp dword [edi + 0x99c], 0
mov edx, dword [ebp + 8]
lea eax, [esp + 0x68]
je 0x8ee0b9
mov ecx, dword [edi + 0x9fc]
push ecx
push edx
push eax
lea ecx, [esp + 0xa48]
push str._s_Entering_eScanScanCallback_from_Intercept__iAFlag:__x__FBS:__u_
push ecx
call fcn.00a78f30
add esp, 0x14
jmp 0x8ee0d0
push edx
push eax
lea ecx, [esp + 0xa44]
push str._s_Entering_eScanScanCallback_from_AltScan__iAFlag:__x_
push ecx
call fcn.00a78f30
add esp, 0x10
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp + 8], 0
jle 0x8ee23f
mov dword [esp + 0x38], 0
test esi, esi
je 0x8ee23f
cmp word [esi], 0
je 0x8ee23f
push esi
lea ebx, [esp + 0x3c]
call fcn.00970520
mov esi, dword [esp + 0x3c]
add esp, 4
test esi, esi
je 0x8ee23c
push 0
push str.SCRIPT
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ee171
push 0
push str.IFRAME
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ee171
push 0
push str.__dummy_
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8ee179
mov eax, 1
jmp 0x8ee17d
mov dword [esp + 0x64], 1
mov eax, dword [esp + 0x44]
cmp dword [0xbc27fc], 0
je 0x8ee233
cmp byte [esi], 0x3d
jne 0x8ee1e9
test eax, eax
jne 0x8ee1be
mov ecx, dword [edi + 0x9dc]
push ecx
push esi
lea edx, [edi + 0x578]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0xa4c]
push str._s_ECB_Obj_Name:__s_s___d_
push ecx
call fcn.00a78f30
add esp, 0x18
jmp 0x8ee216
mov edx, dword [edi + 0x9dc]
push edx
push esi
lea eax, [edi + 0x578]
push eax
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0xa4c]
push str._s_ECB_Obj_Name:__s_s__DUMMY___d_
push edx
call fcn.00a78f30
add esp, 0x18
jmp 0x8ee216
test eax, eax
mov eax, dword [edi + 0x9dc]
push eax
lea ecx, [esp + 0x6c]
push esi
lea edx, [esp + 0xa44]
push ecx
jne 0x8ee208
push str._s_ECB_Obj_Name:__s___d_
jmp 0x8ee20d
push str._s_ECB_Obj_Name:__s__DUMMY___d_
push edx
call fcn.00a78f30
add esp, 0x14
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push esi
call fcn.00a78fec
add esp, 4
mov ebx, dword [ebp + 0xc]
lea esi, [edi + 0x578]
push 0x2e
push esi
mov dword [esp + 0x34], esi
call fcn.00a7aa50
add esp, 8
mov dword [esp + 0x60], eax
test eax, eax
je 0x8ee261
inc eax
mov dword [esp + 0x60], eax
cmp dword [0xb38014], 0
je 0x8ee302
cmp dword [edi + 0x99c], 1
jne 0x8ee302
cmp ebx, 2
je 0x8ee28f
cmp ebx, 3
je 0x8ee28f
cmp ebx, 4
je 0x8ee28f
cmp ebx, 5
jne 0x8ee302
cmp dword [0xbd0654], 0
jne 0x8ee2bc
push 0x5c
push esi
call fcn.00a7aa50
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x8ee2ac
inc ecx
jmp 0x8ee2ae
mov ecx, esi
mov eax, str.IMG0
call fcn.0094c3e0
test eax, eax
jne 0x8ee302
cmp dword [0xbc27fc], 0
je 0x8ee2fd
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Logging_Ports_5_...
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.008edbc0
cmp dword [edi + 0x9dc], 0
jbe 0x8ee3a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0xb38434]
sub eax, dword [edi + 8]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jb 0x8ee3a2
cmp ebx, 2
je 0x8ee3a2
cmp ebx, 3
je 0x8ee3a2
cmp ebx, 4
je 0x8ee3a2
cmp ebx, 5
je 0x8ee3a2
cmp dword [edi + 0x99c], 1
jne 0x8ee3a2
cmp dword [0xbc27fc], 0
je 0x8ee386
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Cancelling_Object_Scan._Reason:_Timeout_Or_Explicit_Cancel
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [esp + 0x34], 0
je 0x8f0b45
mov eax, dword [esp + 0x34]
mov dword [eax], 2
mov esi, eax
jmp 0x8f0b49
cmp dword [ebp + 8], 0
jle 0x8ee3ed
mov ecx, dword [edi + 0x9dc]
mov eax, dword [0xb389e4]
cmp ecx, eax
jbe 0x8ee3ed
cmp dword [edi + 0x9d4], 0
je 0x8ee3cb
lea edx, [eax*4]
cmp ecx, edx
jbe 0x8ee3ed
push eax
push esi
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0xa48]
push str._s_Cancelling_Object_Scan___s_._Reason:_Objects_Scanned_Exceeded:__u_
push ecx
call fcn.00a78f30
add esp, 0x14
push 0
push 1
jmp 0x8ee371
cmp dword [0xbc27fc], 0
je 0x8ee52d
push 0x103
lea ecx, [esp + 0x191]
push 0
push ecx
mov byte [esp + 0x198], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x299]
push 0
push edx
mov byte [esp + 0x2a0], 0
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x18c]
mov ecx, ebx
call fcn.008ed950
cmp ebx, 3
jne 0x8ee4c5
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x294]
call fcn.008ed8a0
cmp byte [edi + 0x230], 0
lea eax, [edi + 0x230]
je 0x8ee497
push eax
lea eax, [esp + 0x298]
push eax
push ebx
lea ecx, [esp + 0x198]
push ecx
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0xa50]
push str._s_FileScan_Started_With_Status__s__d___TT:_s___H:_s_
push eax
call fcn.00a78f30
add esp, 0x1c
jmp 0x8ee50f
lea ecx, [esp + 0x294]
push ecx
push 3
lea edx, [esp + 0x194]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0xa4c]
push str._s_FileScan_Started_With_Status__s__d___TT:_s_
push ecx
call fcn.00a78f30
add esp, 0x18
jmp 0x8ee50f
cmp byte [edi + 0x230], 0
lea eax, [edi + 0x230]
lea edx, [esp + 0x18c]
lea ecx, [esp + 0xa3c]
je 0x8ee4fa
push eax
push ebx
push edx
lea eax, [esp + 0x74]
push eax
push str._s_FileScan_Started_With_Status__s__d___H:_s_
push ecx
call fcn.00a78f30
add esp, 0x18
jmp 0x8ee50f
push ebx
push edx
lea eax, [esp + 0x70]
push eax
push str._s_FileScan_Started_With_Status__s__d_
push ecx
call fcn.00a78f30
add esp, 0x14
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp + 8], 0
jle 0x8ee5ac
cmp ebx, 3
jne 0x8ee5ac
cmp dword [esp + 0x48], 0
je 0x8ef076
mov ecx, dword [esp + 0x48]
push 0xaa8704
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x8ef076
cmp dword [0xbc27fc], eax
je 0x8ee59b
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str.__s__Blank_Virus_Name____Resetting_iScanStatus_to_OBJECT_STATUS_CLEAN...
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [esp + 0x40], 1
mov byte [edi + 0x9e2], 1
jmp 0x8ee5b5
cmp ebx, 1
jne 0x8eebab
cmp byte [edi + 0x230], 0
lea ebx, [edi + 0x230]
je 0x8ee60e
cmp dword [edi + 0x9d8], 2
jne 0x8ee60e
cmp dword [0xbc27fc], 0
je 0x8ee60e
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0xa40]
push str._s_Will_NOT_CHECK_IN_VSIGNS_as_OBJECT_has_been_DISINFECTED.
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [edi + 0x18], 0x1c0a
jne 0x8ee6a1
call fcn.00966c80
test eax, eax
je 0x8ee6a1
cmp byte [edi + 0x12c], 0
lea esi, [edi + 0x12c]
jne 0x8ee6a1
cmp dword [0xbc27fc], 0
je 0x8ee676
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xa44]
push str._s_Computing_Hash_CXX_:___s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [esp + 0xa54]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, dword [edi + 0x20]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push eax
push esi
push ecx
call fcn.008bdff0
add esp, 0x14
cmp byte [esi], 0
je 0x8ee6a1
mov edx, ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x8ee697
cmp byte [ebx], 0
je 0x8ee8d5
cmp dword [edi + 0x9d8], 2
je 0x8ee8d5
xor esi, esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x44], esi
cmp dword [0xbd5bb4], esi
je 0x8ee6e3
lea edx, [esp + 0x84]
mov ecx, ebx
call fcn.00a52150
mov dword [esp + 0x50], eax
cmp eax, esi
jne 0x8ee81c
mov eax, str.3fb121fbbccb27969668cc36d0a8f15b
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x8ee73f
mov edx, dword [str.AMTSO_CLOUD_Test]
mov eax, dword [0xad61e8]
mov ecx, dword [0xad61ec]
mov dword [esp + 0x84], edx
mov edx, dword [0xad61f0]
mov dword [esp + 0x88], eax
mov al, byte [0xad61f4]
mov dword [esp + 0x50], 1
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
mov byte [esp + 0x94], al
jmp 0x8ee81c
cmp dword [0xb3df20], 1
jne 0x8ee8d5
cmp dword [edi + 0x990], 0
je 0x8ee8d5
push 0x207
lea ecx, [esp + 0x629]
push 0
push ecx
mov dword [esp + 0x44], 0
mov byte [esp + 0x630], 0
call fcn.00a7ffb0
mov edx, dword [esp + 0x38]
add esp, 0xc
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x62c]
mov edi, ebx
call 0x9da7f0
add esp, 8
test eax, eax
je 0x8ee8d1
mov esi, dword [esp + 0x38]
cmp esi, 0x10
jbe 0x8ee7c9
lea ecx, [esp + 0x624]
push ecx
lea edx, [esp + 0x88]
push edx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x8ee7cd
mov edi, dword [esp + 0x44]
cmp dword [0xbc27fc], 0
je 0x8ee810
push esi
push ebx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0xa48]
push str._s_Found_in_Cloud___s__28_u_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test edi, edi
mov edi, dword [esp + 0x4c]
je 0x8ee8d5
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
cmp dword [0xbc27fc], 0
mov dword [esp + 0x54], 1
mov dword [esp + 0x40], 3
mov dword [esp + 0x5c], 0
je 0x8ee899
cmp dword [esp + 0x50], 0
lea ecx, [esp + 0x84]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0xa40]
push edx
je 0x8ee86d
push str._s_Present_In_The_Infected_Cache__VName:__s_
jmp 0x8ee872
push str._s_Present_In_The_CLOUD_Infected_Cache__VName:__s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x10
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [esp + 0x84], 0
je 0x8ef081
push str.__ES_
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x84]
push ecx
lea edx, [edi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x8ef081
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x2c]
cmp byte [eax], 0
mov esi, dword [esp + 0x60]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x8eeaa9
cmp dword [edi + 0x18], 0
jbe 0x8eeaa9
test esi, esi
je 0x8eeaa9
cmp byte [esi], 0
je 0x8eeaa9
cmp dword [edi + 0x9e8], 0
je 0x8eea4b
mov eax, str.HTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8ee948
mov eax, 0xad628c
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8ee948
mov eax, str.ASPX
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8eeaa9
cmp dword [0xbc27fc], 0
je 0x8ee988
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0xa40]
push str._s_Searching_for_Script
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [edi + 0x20]
mov eax, dword [esp + 0x2c]
push 0
push edx
push eax
call fcn.00920c60
add esp, 0xc
cmp eax, 1
jne 0x8eeaa9
push str.HTML.Script
lea ecx, [esp + 0x88]
push ecx
call ebx
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
cmp dword [0xbc27fc], 0
mov dword [esp + 0x40], 3
mov dword [esp + 0x5c], 0
je 0x8eea17
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x6c]
push eax
push str._s_HTML_Script_IFrame_Found__VName:__s_
lea ecx, [esp + 0xa48]
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa54]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp byte [esp + 0x84], 0
je 0x8ef081
push str.__ES_
lea ecx, [esp + 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x84]
push edx
lea eax, [edi + 0x28]
push eax
call ebx
jmp 0x8ef081
cmp dword [edi + 0x994], 2
jne 0x8eeaa9
push str.Trojan.EML.Leftover
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x44], 1
call ebx
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
cmp dword [0xbc27fc], 0
mov dword [esp + 0x40], 3
mov dword [esp + 0x5c], 0
je 0x8eea17
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x6c]
push eax
push str._s_Trojan.EML.Leftover_Found__VName:__s_
jmp 0x8ee9ec
mov eax, dword [edi + 0x9bc]
test eax, eax
jne 0x8eeabf
cmp dword [edi + 0x9c0], eax
je 0x8eebb3
mov ecx, dword [esp + 0x2c]
cmp byte [ecx], 0
je 0x8eebb3
cmp dword [edi + 0x18], 0
jbe 0x8eebb3
cmp eax, 1
jne 0x8eeaea
push str.WScript.LNKFile
lea edx, [esp + 0x88]
push edx
jmp 0x8eeb0b
cmp eax, 2
jne 0x8eeafe
push str.RunDLL32.LNKFile
lea eax, [esp + 0x88]
push eax
jmp 0x8eeb0b
push str.Worm.LNKFile
lea ecx, [esp + 0x88]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
cmp dword [0xbc27fc], 0
mov dword [esp + 0x40], 3
mov dword [esp + 0x5c], 0
je 0x8eeb77
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xa44]
push str._s_Infected_LNK_Found__VName:__s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa54]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp byte [esp + 0x84], 0
je 0x8ef081
push str.__ES_
lea ecx, [esp + 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x84]
push edx
lea eax, [edi + 0x28]
push eax
call esi
jmp 0x8ef081
test ebx, ebx
jne 0x8ef076
mov ebx, dword [esp + 0x2c]
cmp byte [ebx], 0
je 0x8eef1b
cmp dword [edi + 0x18], 0
jbe 0x8eef1b
cmp dword [0xb386cc], 0
je 0x8eef1b
mov al, byte [ebx + 1]
lea ecx, [ebx + 1]
cmp al, 0x3a
jne 0x8eecbf
mov eax, str.:_autorun.inf
call fcn.0094c330
test eax, eax
jne 0x8eef1b
movsx ecx, byte [ebx]
push ecx
lea edx, [esp + 0x78]
push str._c:_
push edx
mov byte [esp + 0x80], al
mov dword [esp + 0x81], eax
mov dword [esp + 0x85], eax
mov byte [esp + 0x89], al
mov dword [edi + 0x9b8], 1
call fcn.00a78f30
add esp, 0xc
lea eax, [esp + 0x74]
call fcn.00966890
cmp eax, 3
je 0x8eed11
cmp eax, 4
je 0x8eed11
test eax, eax
je 0x8eed11
cmp eax, 2
jne 0x8eef1b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [esp + 0x298]
push eax
call esi
push str.TMP3344.TMP
lea ecx, [esp + 0x298]
push ecx
mov byte [esp + 0x29f], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x294]
push 0xaa1578
push edx
call fcn.00a7932f
add esp, 8
test eax, eax
je 0x8eef21
push eax
call fcn.00a79e9e
add esp, 4
lea eax, [esp + 0x294]
call fcn.0094dd20
jmp 0x8eed17
cmp byte [ebx], 0x5c
jne 0x8eef1b
cmp al, 0x5c
jne 0x8eef1b
mov edx, ebx
call fcn.00975920
cmp eax, 4
jne 0x8eef1b
push 0x5c
push ebx
call fcn.00a7aa50
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x8eef1b
mov eax, str._autorun.inf
call fcn.0094c330
test eax, eax
jne 0x8eef1b
mov dword [edi + 0x9b8], 1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0xb38014], 1
jne 0x8eee40
push 0x207
lea eax, [esp + 0x629]
push 0
push eax
mov byte [esp + 0x630], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [esp + 0x299]
push 0
push ecx
mov byte [esp + 0x2a0], 0
call fcn.00a7ffb0
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8eeda4
mov edx, dword [edi + 0x24]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xa44]
push str._s_Getting_ImagePath_for_PID:_ld...
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa54]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, dword [edi + 0x24]
cmp eax, 4
jbe 0x8eedc4
push eax
lea ecx, [esp + 0x628]
lea ebx, [esp + 0x298]
call fcn.0097b130
mov ebx, dword [esp + 0x2c]
cmp byte [esp + 0x624], 0
je 0x8eee40
cmp dword [0xbc27fc], 0
je 0x8eee1f
mov eax, dword [edi + 0x24]
lea ecx, [esp + 0x294]
push ecx
lea edx, [esp + 0x628]
push edx
push eax
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0xa4c]
push str._s_ImagePath_for_PID:_ld_is__s___s_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [esp + 0xa5c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov eax, str.svchost.exe
lea ecx, [esp + 0x294]
call fcn.0094c330
test eax, eax
je 0x8eee40
mov byte [edi + 0x9e4], 1
jmp 0x8eef21
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], eax
call fcn.00968110
test eax, eax
je 0x8eee64
lea edx, [esp + 0x44]
push edx
call fcn.009681c0
add esp, 4
mov dword [esp + 0x38], eax
mov ecx, ebx
call fcn.008ed450
test eax, eax
jne 0x8eef05
mov dword [esp + 0x5c], eax
push str.AUTORUN.INF:Blocked
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x48], 3
call esi
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
cmp dword [0xbc27fc], 0
je 0x8eeeda
push ebx
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0xa44]
push str._s__s_:_Autorun.inf_Blocked_by_us.
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [esp + 0xa54]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp byte [esp + 0x84], 0
je 0x8eef05
push str.__ES_
lea edx, [esp + 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x84]
push eax
lea ecx, [edi + 0x28]
push ecx
call esi
cmp dword [esp + 0x38], 0
je 0x8eef21
mov edx, dword [esp + 0x44]
push edx
call fcn.00968240
add esp, 4
jmp 0x8eef21
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
cmp dword [edi + 0x9c4], ebx
je 0x8eef6a
push str.User:Blocked__ES_
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x48], 3
mov dword [esp + 0x64], ebx
call esi
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], bl
cmp byte [esp + 0x84], bl
je 0x8eef6a
lea ecx, [esp + 0x84]
push ecx
lea edx, [edi + 0x28]
push edx
call esi
cmp dword [edi + 0x9c8], ebx
je 0x8eefb3
push str.Network:Blocked__ES_
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x48], 3
mov dword [esp + 0x64], ebx
call esi
cmp byte [esp + 0x84], 0
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
je 0x8eefb3
lea ecx, [esp + 0x84]
push ecx
lea edx, [edi + 0x28]
push edx
call esi
cmp dword [edi + 0x9cc], ebx
je 0x8eeffc
push str.USB:Blocked__ES_
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x48], 3
mov dword [esp + 0x64], ebx
call esi
cmp byte [esp + 0x84], 0
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
je 0x8eeffc
lea ecx, [esp + 0x84]
push ecx
lea edx, [edi + 0x28]
push edx
call esi
mov eax, dword [edi + 0x9d0]
cmp eax, ebx
je 0x8ef076
mov dword [esp + 0x40], 3
mov dword [esp + 0x5c], ebx
cmp eax, 1
jne 0x8ef026
push str.Attachment:Blocked__ES_
lea eax, [esp + 0x88]
push eax
jmp 0x8ef04c
cmp eax, 2
jne 0x8ef03a
push str.Password_Archive:Blocked__ES_
lea ecx, [esp + 0x88]
push ecx
jmp 0x8ef04c
cmp eax, 4
jne 0x8ef04e
push str.Internet:Blocked__ES_
lea edx, [esp + 0x88]
push edx
call esi
cmp byte [esp + 0x84], 0
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
je 0x8ef081
lea eax, [esp + 0x84]
push eax
lea ecx, [edi + 0x28]
push ecx
call esi
jmp 0x8ef081
cmp dword [esp + 0x40], 5
ja case.default.0x8ef085
mov edx, dword [esp + 0x40]
jmp dword [edx*4 + 0x8f0c7c]
cmp dword [0xbc27fc], 0
je 0x8ef0d1
mov eax, dword [edi]
push 1
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0xa48]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_CLEAN_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [esp + 0x2c]
cmp byte [edx], 0
je 0x8ef22e
cmp byte [edi + 0x12c], 0
lea eax, [edi + 0x12c]
mov dword [esp + 0x3c], eax
je 0x8ef22e
cmp dword [edi + 0x99c], 0
je 0x8ef22e
cmp dword [edi + 0x9b0], 0
jne 0x8ef22e
mov eax, dword [edi + 0x9d8]
cmp eax, 3
je 0x8ef1ef
cmp eax, 4
je 0x8ef1ef
cmp eax, 5
je 0x8ef1ef
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push 0x150
call fcn.00a7b9f8
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x8ef1c3
lea esi, [edi + 0x438]
mov ecx, 0x50
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x2c]
push 0
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8ef17e
push ebx
call fcn.00a78fec
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8ef1bf
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0xa40]
push str._s__DLXCACHE__Inserted_in_CacheTree_4_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x40]
call fcn.008bd720
add esp, 4
push 0xb52450
mov dword [edi + 0x9b0], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x8ef22e
cmp dword [0xbc27fc], 0
je 0x8ef22e
push eax
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xa44]
push str._s__DLXCACHE__NOT_NOT_NOT_Inserted_in_CacheTree_4__as_SContext__iScanStatus_is__u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [esp + 0xa54]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [esp + 0x34], 0
je 0x8f0b45
mov eax, dword [esp + 0x34]
mov dword [eax], 1
jmp case.default.0x8f034a
mov dword [edi + 0x9d8], 4
cmp dword [0xbc27fc], 0
je 0x8ef2b0
cmp dword [esp + 0x40], 3
jne 0x8ef2b0
cmp dword [esp + 0x48], 0
jne 0x8ef2b0
cmp byte [esp + 0x84], 0
jne 0x8ef2b0
mov ecx, dword [edi]
push 3
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0xa48]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_INFECTED_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [esp + 0x40]
mov dword [edi + 0x9d8], eax
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x8ef2cf
cmp byte [esp + 0x84], al
je 0x8f02fd
cmp byte [esp + 0x84], 0
mov dword [esp + 0x50], 0
je 0x8ef32a
lea eax, [esp + 0x84]
mov ebx, 1
lea ecx, [ecx]
add eax, ebx
cmp byte [eax], 0
jne 0x8ef2f0
lea ecx, [esp + 0x84]
sub eax, ecx
add eax, ebx
push eax
call fcn.00a7a155
mov esi, eax
add esp, 4
mov dword [esp + 0x50], esi
test esi, esi
je 0x8f0302
lea edx, [esp + 0x84]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x8ef340
push eax
lea ebx, [esp + 0x54]
call fcn.00970520
mov esi, dword [esp + 0x54]
add esp, 4
mov ebx, 1
test esi, esi
je 0x8f0302
cmp byte [esi], 0
je 0x8f02f2
mov eax, esi
add eax, ebx
cmp byte [eax], 0
jne 0x8ef353
sub eax, esi
cmp eax, 0x3c
jbe 0x8ef379
push 0x20
push esi
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8ef375
mov byte [eax], 0
jmp 0x8ef379
mov byte [esi + 0x3c], 0
push esi
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0xb8db38], ebx
jne 0x8ef451
cmp dword [0xb38e8c], 0
jne 0x8ef451
push 0
lea ecx, [esp + 0x88]
push str.EICAR
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef451
xor esi, esi
call fcn.0095e560
cmp dword [0xb567e4], esi
jne 0x8ef42f
cmp eax, 0xc0000
jbe 0x8ef42f
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xa44]
push str._s_Forcing_BlockMalwareUrls_to_1_as___s__found...
push ecx
call fcn.00a78f30
push esi
push 1
lea edx, [esp + 0xa54]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [esi + 1]
add esp, 0x20
mov esi, str.BlockMalwareUrls
mov ebx, 0xaa21e4
mov ecx, 0x80000002
mov dword [0xb38e8c], 1
call fcn.0094be90
mov eax, 2
mov esi, str.dwBMUSetA
mov ebx, 0xaa21e4
mov ecx, 0x80000002
mov dword [0xb8db38], eax
call fcn.0094be90
mov esi, dword [esp + 0x50]
cmp dword [0xbc27fc], 0
je 0x8ef482
push 0x103
lea eax, [esp + 0x520]
push esi
push eax
call fcn.00a7a620
add esp, 0xc
cmp byte [esp + 0x61e], 0
je 0x8ef482
mov byte [esp + 0x61f], 0
cmp dword [edi + 0x99c], 0
jne 0x8ef70c
cmp dword [esp + 0x54], 0
jne 0x8ef6a8
cmp dword [esp + 0x3c], 0
jne 0x8ef6a8
push 0
mov ecx, esi
call fcn.00903770
add esp, 4
test eax, eax
je 0x8ef4fc
cmp dword [0xbc27fc], 0
je 0x8ef704
push esi
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0xa44]
push str._s__s___Can_be_Deleted_or_Quarantined.
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [esp + 0xa54]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8ef704
cmp dword [ebp + 8], 0
jle 0x8ef546
cmp dword [esp + 0x64], 0
jne 0x8ef546
cmp dword [0xbc27fc], 0
je 0x8ef704
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Its_Archive___Can_be_Deleted_or_Quarantined.
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
jmp 0x8ef6f7
push 0
push str.download
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef664
push 0
push str.drop
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef664
push 0
push 0xad66b8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef664
push 0
push 0xad66bc
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef664
push 0
push str.heur
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef664
push 0
push str.agent
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ef664
mov ebx, dword [esp + 0x60]
test ebx, ebx
je 0x8ef70c
mov eax, str.crdownload
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x8ef61c
mov eax, 0xab99f8
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x8ef61c
mov eax, str.part
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x8ef70c
cmp dword [0xbc27fc], 0
je 0x8ef704
push esi
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xa44]
push str._s_Its_Browser_Temp___s____Can_be_Deleted_or_Quarantined.
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa54]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8ef704
cmp dword [0xbc27fc], 0
je 0x8ef704
push esi
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0xa44]
push str._s_Its_Downloader___s____Can_be_Deleted_or_Quarantined.
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [esp + 0xa54]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8ef704
cmp dword [0xbc27fc], 0
je 0x8ef704
cmp dword [esp + 0x3c], 0
push esi
je 0x8ef6cd
lea edx, [esp + 0x6c]
push edx
push str._s_Its_Leftover___Can_be_Deleted_or_Quarantined.
lea eax, [esp + 0xa48]
push eax
jmp 0x8ef6df
lea ecx, [esp + 0x6c]
push ecx
push str._s_Its_from_VSIGNS___Can_be_Deleted_or_Quarantined.
lea edx, [esp + 0xa48]
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x10
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [esp + 0x58], 1
cmp dword [0xbc27fc], 0
je 0x8ef78c
mov eax, dword [esp + 0x40]
cmp eax, 3
jne 0x8ef74d
mov edx, dword [edi]
push esi
push eax
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0xa4c]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_INFECTED_:__s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa5c]
push eax
jmp 0x8ef77f
cmp eax, 4
jne 0x8ef78c
mov ecx, dword [edi]
push esi
push eax
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0xa4c]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_SUSPICIOUS_:__s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [esp + 0xa5c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [0xbc27fc], ebx
je 0x8ef7e5
mov eax, dword [0xb8db60]
mov ecx, dword [0xb38224]
push eax
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0xa48]
push str._s_Searching_in_NVLists___u____u_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push ebx
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb38224], ebx
je 0x8ef80e
cmp dword [0xb8db60], ebx
jne 0x8ef80e
mov eax, dword [esp + 0x50]
cmp byte [eax], 0
je 0x8ef80e
mov esi, eax
call fcn.008bb470
cmp eax, 1
je 0x8f02de
cmp dword [edi + 0x9a4], ebx
jne 0x8f02de
cmp byte [edi + 0x12c], 0
lea eax, [edi + 0x12c]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
jne 0x8ef9a2
cmp dword [edi + 0x18], 0xa00000
jae 0x8ef9a2
mov esi, dword [esp + 0x2c]
call fcn.00966c80
test eax, eax
je 0x8ef9a2
cmp byte [edi + 0x9e3], 0
jne 0x8ef9a2
cmp dword [0xbc27fc], ebx
je 0x8ef89f
mov ecx, esi
push ecx
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xa44]
push str._s_Infected_File___Computing_Hash_C_:___s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push ebx
push ecx
lea edx, [esp + 0xa54]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, dword [edi + 0x20]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push eax
push esi
push ecx
call fcn.008bdff0
add esp, 0x14
cmp byte [esi], 0
je 0x8ef99a
push 0x207
lea edx, [esp + 0x629]
push ebx
push edx
mov byte [esp + 0x630], 0
call fcn.00a7ffb0
mov ecx, edi
add esp, 0xc
sub ecx, esi
mov eax, esi
lea edx, [ecx + 0x230]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x8ef8f0
cmp dword [0xbc27fc], ebx
je 0x8ef939
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Searching_Clnsigns_XX_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push ebx
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea edx, [esp + 0x624]
mov ecx, esi
call fcn.00a51fd0
test eax, eax
je 0x8ef9a2
cmp dword [0xbc27fc], ebx
je 0x8ef98e
lea eax, [esp + 0x624]
push eax
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0xa44]
push str._s_CS_XX__:__s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0xa54]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov dword [edi + 0x9a4], 1
jmp 0x8ef9a2
mov dword [esp + 0x38], 1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ebx
cmp dword [0xbf4aa0], ebx
jne 0x8efa83
push 0x103
lea edx, [esp + 0x191]
push ebx
push edx
mov byte [esp + 0x198], 0
call fcn.00a7ffb0
add esp, 0xc
mov esi, 1
push str.MonitorCLB
lea eax, [esp + 0x48]
lea edi, [esp + 0x190]
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [esp + 0x48], 0x104
mov dword [0xbf4aa0], esi
call fcn.0094c020
cmp byte [esp + 0x18c], 0
je 0x8efa30
cmp byte [esp + 0x195], 0x4f
jne 0x8efa30
cmp byte [esp + 0x194], 0x52
jne 0x8efa30
mov dword [0xbd066c], esi
mov edi, dword [esp + 0x4c]
jmp 0x8efa88
push 0x7f
lea eax, [esp + 0x4a1]
push ebx
push eax
mov byte [esp + 0x4a8], 0
call fcn.00a7ffb0
add esp, 0xc
lea edi, [esp + 0x49c]
call fcn.0098daa0
mov eax, str.0200
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8efa77
mov eax, str.0300
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x8efa2a
mov edi, dword [esp + 0x4c]
mov dword [0xbd066c], esi
jmp 0x8efa88
mov esi, 1
cmp dword [0xb3dc8c], 2
jne 0x8efa95
mov dword [esp + 0x48], esi
mov esi, dword [esp + 0x50]
cmp byte [esi], 0
je 0x8efb51
mov eax, str.Android
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8efb51
push ebx
push str..Heur
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8efb42
push ebx
push str.Gen:
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8efb42
push ebx
push str.Deepscan:
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8efb42
push ebx
push str.:Gen
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8efb42
push ebx
push 0xad6898
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8efb42
push ebx
push str..Generic
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8efb42
push ebx
push str.Generic.
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8efb55
mov eax, 1
mov dword [esp + 0x54], eax
mov dword [esp + 0x48], eax
jmp 0x8efb55
mov dword [esp + 0x48], ebx
cmp byte [edi + 0x9e3], 0
je 0x8efb62
mov dword [esp + 0x48], ebx
cmp dword [esp + 0x38], ebx
jne 0x8f0248
cmp dword [0xb3dc8c], ebx
je 0x8f0248
cmp byte [esi], 0
je 0x8f0248
cmp dword [esp + 0x48], ebx
je 0x8f0248
cmp dword [0xbd07c4], 1
jne 0x8f0248
cmp dword [edi + 0x9a4], ebx
jne 0x8f0248
cmp dword [edi + 0x18], 0x4000000
jae 0x8f0248
cmp dword [0xbd066c], ebx
jne 0x8f0248
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [0xc11b5c], 1
jne 0x8efc01
or dword [0xc11b5c], 1
mov ecx, 0xc11ac8
mov dword [esp + 0x3280], ebx
call fcn.0097f770
push 0xa9cf90
call fcn.00a7a607
add esp, 4
mov dword [esp + 0x3280], 0xffffffff
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp byte [esi], bl
jne 0x8efd15
push 0x103
xor esi, esi
lea ecx, [esp + 0x299]
push esi
push ecx
mov byte [esp + 0x2a0], 0
call fcn.00a7ffb0
mov edx, dword [esp + 0x38]
add esp, 0xc
cmp byte [edx], 0x5c
jne 0x8efc5c
cmp byte [edi + 0x579], 0x5c
jne 0x8efc5c
push esi
push esi
push esi
lea edx, [esp + 0x2a0]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8efc5c
lea esi, [ebx + 1]
cmp dword [0xbc27fc], 0
je 0x8efc9d
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0xa40]
push str._s_Computing_Hash_D_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [edi + 0x20]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
push 0
push 0
push ecx
push edx
push eax
call fcn.008bdff0
add esp, 0x14
test eax, eax
jne 0x8efcfd
cmp dword [0xbc27fc], eax
je 0x8efcfd
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xa44]
push str._s_Error_getting_hash_of__s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [esp + 0xa54]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp esi, 1
jne 0x8efd08
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [esp + 0x3c]
cmp byte [esi], 0
je 0x8f0229
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
xor ecx, ecx
mov edx, 0xc11ac8
call fcn.00980160
test eax, eax
je 0x8efd75
cmp dword [0xbc27fc], 0
mov ebx, 1
je 0x8efd75
push esi
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xa44]
push str._s___PDB:_Already_Present_In_FPTree:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa54]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esi], 0
je 0x8f0229
test ebx, ebx
jne 0x8f022d
xor eax, eax
mov byte [esp + 0x33], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x74], bl
mov dword [esp + 0x75], eax
mov dword [esp + 0x79], eax
mov dword [esp + 0x7d], eax
mov word [esp + 0x81], ax
mov byte [esp + 0x83], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x54]
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x5d2d5b
mov dword [esp + 0x74], eax
cmp dword [0xbc27fc], ebx
je 0x8efe16
push esi
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0xa44]
push str._s___PDB:_Posting_to_Cloud:__s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0xa54]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x3c]
push esi
lea edx, [esp + 0x36]
lea ecx, [esp + 0x37]
call fcn.0085a270
add esp, 4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x44]
cmp dword [0xbc27fc], 0
je 0x8efea0
mov edx, dword [esp + 0x3c]
push edx
mov dword [esp + 0x58], eax
fild dword [esp + 0x58]
push esi
test eax, eax
jge 0x8efe5c
fadd qword [0xb0baa8]
fdiv qword [0xb0bad0]
sub esp, 8
lea eax, [esp + 0x78]
lea ecx, [esp + 0xa4c]
fstp qword [esp]
push eax
push str._s___PDB:_Cloud_Finish___.2f_Secs_._File_s:_s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x1c
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test ebx, ebx
je 0x8f0237
xor al, al
cmp byte [esp + 0x33], al
jne 0x8eff57
cmp byte [esp + 0x32], 1
jne 0x8eff57
mov byte [esp + 0x33], al
mov byte [esp + 0x32], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x3c]
push esi
lea edx, [esp + 0x36]
lea ecx, [esp + 0x37]
mov dword [esp + 0x48], eax
call fcn.0085a270
add esp, 4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x44]
cmp dword [0xbc27fc], 0
je 0x8eff57
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x58], eax
fild dword [esp + 0x58]
push esi
test eax, eax
jge 0x8eff13
fadd qword [0xb0baa8]
fdiv qword [0xb0bad0]
sub esp, 8
lea edx, [esp + 0x78]
lea eax, [esp + 0xa4c]
fstp qword [esp]
push edx
push str._s___PDB:__RECONFIRM__Cloud_Finish___.2f_Secs_._File_s:_s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x1c
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test ebx, ebx
je 0x8f0237
cmp byte [esp + 0x33], 0
jne 0x8f0237
cmp byte [esp + 0x32], 1
jne 0x8f0237
push 0xb52450
mov dword [esp + 0x48], 0
mov dword [edi + 0x9a4], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x3c]
push 1
push 0
mov ecx, ebx
mov edx, 0xc11ac8
call fcn.0097faa0
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0xbc27fc], 0
je 0x8f0038
mov eax, dword [esp + 0x50]
push eax
push ebx
push esi
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0xa50]
push str._s___PDB:__sFile_s:_s__Original_Detection:_s__CLDB_FP
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x1c
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
push esi
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0xa54]
push str._s___PDB:_Posting_FP_to_our_Server:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [esp + 0xa64]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
push 0x103
lea ecx, [esp + 0x629]
push 0
push ecx
mov dword [esp + 0x60], 0
mov byte [esp + 0x630], 0
call fcn.00a7ffb0
add esp, 0xc
cmp byte [esi], 0x5c
jne 0x8f0090
cmp byte [edi + 0x579], 0x5c
jne 0x8f0090
push 0
push 0
push 0
lea edx, [esp + 0x630]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8f0090
mov dword [esp + 0x54], 1
cmp dword [edi + 0x20], 0
je 0x8f01c6
push 0x103
lea edx, [esp + 0x191]
push 0
push edx
mov byte [esp + 0x198], 0
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x18c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x8f01c6
mov ecx, esi
push 0x5c
push ecx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8f01c6
lea ecx, [esp + 0x18c]
call fcn.00960910
lea eax, [esi + 1]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8f0100
lea edi, [esp + 0x18c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8f0111
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x18c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8f0131
mov edx, dword [str..MWT]
mov cl, byte [0xad6a04]
mov dword [eax], edx
mov edx, dword [esp + 0x4c]
mov byte [eax + 4], cl
mov eax, dword [edx + 0x20]
push eax
lea ecx, [esp + 0x190]
push ecx
push 0
call fcn.008bdf40
add esp, 0xc
test eax, eax
je 0x8f01c2
mov dx, word [0xad6a08]
mov al, byte [0xad6a0a]
push 0x101
lea ecx, [esp + 0x29b]
push 0
push ecx
mov word [esp + 0x2a0], dx
mov byte [esp + 0x2a2], al
call fcn.00a7ffb0
mov edx, dword [esp + 0x38]
add esp, 0xc
push edx
push 1
lea eax, [esp + 0x29c]
push eax
lea ecx, [esp + 0x198]
push ebx
push ecx
mov dword [esp + 0x58], 1
call fcn.009d75b0
add esp, 0x14
mov edi, dword [esp + 0x4c]
cmp dword [esp + 0x54], 1
jne 0x8f01d3
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [0xbc27fc], 0
je 0x8f0237
cmp dword [esp + 0x44], 0
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x68]
push edx
lea ecx, [esp + 0xa40]
push eax
je 0x8f01fb
push str._s___PDB:__SUCCESS__Finished_Posting_FP_to_our_Server:__s
jmp 0x8f0200
push str._s___PDB:__FAILURE__Finished_Posting_FP_to_our_Server:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x10
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f0237
test ebx, ebx
je 0x8f0237
mov dword [edi + 0x9a4], 1
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x50]
xor ebx, ebx
cmp dword [0xbc27fc], ebx
je 0x8f02a9
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x9a4]
mov eax, dword [0xbd07c4]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [0xb3dc8c]
push eax
mov eax, dword [esp + 0x44]
push ecx
push esi
push edx
push eax
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x644]
push str._s_HE_u__Cldb_u__Thrt_s__DoIt_u__Int_u__FP_u__dwSize_lu
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0x654]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x38
cmp dword [edi + 0x9a4], ebx
jne 0x8f02de
mov edx, dword [esp + 0x2c]
cmp byte [edx], 0
je 0x8f02de
mov eax, dword [esp + 0x3c]
cmp byte [eax], 0
mov ebx, edx
mov edi, eax
jne 0x8f02c9
mov edi, edx
call fcn.008bd360
mov ecx, dword [esp + 0x4c]
mov dword [ecx + 0x9b4], 1
mov edi, ecx
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x50]
mov ebx, 1
push esi
call fcn.00a78fec
add esp, 4
jmp 0x8f0302
mov ebx, 1
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 0x12c], 0
lea esi, [edi + 0x12c]
je 0x8f0321
call fcn.008bd610
mov edx, dword [edi + 0x18]
mov esi, dword [esp + 0x2c]
push edx
call fcn.008bbf10
add esp, 4
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x5c]
dec eax
cmp eax, 4
ja case.default.0x8f034a
jmp dword [eax*4 + 0x8f0c94]
mov dword [esp + 0x58], ebx
jmp case.default.0x8f034a
cmp dword [0xbc27fc], 0
je 0x8f039f
mov eax, dword [edi]
push 2
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0xa48]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_DISINFECTED_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [edi + 0x9d8], 2
jmp case.default.0x8f034a
cmp dword [0xbc27fc], 0
je 0x8f03f4
mov edx, dword [edi]
push 5
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0xa48]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_DELETED_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [esp + 0x64]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 2
mov dword [edi + 0x9d8], ecx
jmp case.default.0x8f034a
cmp byte [edi + 0x9e1], 0
mov dword [edi + 0x9d8], 0
jne 0x8f0460
cmp dword [0xbc27fc], 0
je case.default.0x8f034a
mov edx, dword [edi]
push 0
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0xa48]
push str._s_FileScan_Started_For_Id:__d_With_Status__d__OBJECT_STATUS_SCAN_FAILED_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [esp + 0xa44]
push eax
jmp 0x8f04b6
cmp dword [0xbc27fc], 0
je case.default.0x8f034a
mov ecx, dword [edi]
push 0
push ecx
lea edx, [esp + 0x70]
push edx
push str._s_FileScan_Started_For_Id:__d_With_FORCED_Status__d__OSSF:_OBJECT_STATUS_CLEAN_
jmp 0x8f0495
cmp dword [0xbc27fc], 0
je case.default.0x8f034a
mov eax, dword [esp + 0x40]
mov ecx, dword [edi]
push eax
push ecx
lea edx, [esp + 0x70]
push edx
push str._s_FileScan_Started_For_Id:__d_With_Status__d__UNKNOWN_
lea eax, [esp + 0xa4c]
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [esp + 0x34], 0
je 0x8f0b45
cmp dword [edi + 0x99c], 1
jne 0x8f092d
xor eax, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], eax
cmp dword [0xbd0b18], eax
jne 0x8f04fb
mov edi, 0xbd0b18
call fcn.0091cbd0
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x2c]
test ebx, ebx
je 0x8f064e
cmp byte [ebx], 0
je 0x8f064e
push ebx
call fcn.009187b0
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
jne 0x8f064e
mov eax, 0xad6c3c
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f0646
mov eax, 0xaa1b60
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f05bc
mov eax, 0xad6c40
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f05bc
mov eax, 0xad6c44
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f05bc
mov eax, 0xaba7c4
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f05bc
mov eax, 0xad6c48
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f05bc
mov eax, 0xac5f5c
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x8f064e
cmp byte [esi], 0
je 0x8f064e
push 0x5c
push esi
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x8f05c9
inc eax
jmp 0x8f05cb
mov dword [esp + 0x54], 1
jmp 0x8f064e
mov eax, esi
push 0x2e
push eax
call fcn.00a7a2c0
mov esi, eax
add esp, 8
test esi, esi
je 0x8f064e
push 0
inc esi
push 0xad0ff8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f0646
push 0
push 0xad21cc
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f0646
push 0
push str.ppsx
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f0646
push 0
push 0xad21d0
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f0646
push 0
push 0xad21d4
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f064e
mov dword [esp + 0x48], 1
mov esi, 1
cmp dword [edi + 0x9d8], esi
jne 0x8f06d8
cmp dword [edi + 0x9f4], esi
jne 0x8f06d8
cmp dword [0xb52498], 0
jne 0x8f06d8
test ebx, ebx
je 0x8f06d8
push ebx
call fcn.00915090
add esp, 4
cmp eax, esi
jne 0x8f06d8
cmp dword [0xbc27fc], 0
je 0x8f06c2
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0xa40]
push str._s_SCAN_ABRT_A_...
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [esp + 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [esp + 0x34]
mov dword [ecx], 2
mov byte [edi + 0x9e1], 1
jmp 0x8f0904
mov eax, dword [edi + 0x9d8]
cmp eax, esi
jne 0x8f079e
cmp dword [edi + 0x9ec], 0
jne 0x8f079e
cmp dword [edi + 0x9f8], 0
jne 0x8f079e
cmp dword [edi + 0x9f0], 0
jne 0x8f079e
cmp dword [edi + 0x9a8], 0
jne 0x8f079e
cmp dword [edi + 0x9f4], 0
jne 0x8f079e
cmp dword [esp + 0x48], 0
jne 0x8f079e
cmp dword [esp + 0x54], 0
jne 0x8f079e
cmp dword [0xb393b4], 0
je 0x8f079e
cmp dword [0xb52498], 0
jne 0x8f079e
cmp dword [0xbc27fc], 0
je 0x8f0788
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_SCAN_ABRT_B_...
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [esp + 0x34]
mov dword [eax], 2
mov byte [edi + 0x9e1], 1
jmp 0x8f0904
cmp eax, 3
jne 0x8f08ef
cmp dword [ebp + 8], 0
jle 0x8f08ef
cmp byte [esp + 0x84], 0
je 0x8f080a
lea ecx, [esp + 0x84]
push ecx
lea esi, [edi + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea edx, [esp + 0x88]
push str._ES_
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f080a
dec esi
lea ebx, [ebx]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x8f07f0
mov eax, dword [str.__DB_]
mov dword [esi], eax
mov cx, word [0xad0a00]
mov word [esi + 4], cx
lea edx, [esp + 0x38]
push edx
push str.AbortIfInfectionFound
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [esp + 0x40], 1
call fcn.0094c0d0
test al, al
jne 0x8f0847
mov eax, dword [esp + 0x38]
mov esi, str.AbortIfInfectionFound
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
cmp dword [esp + 0x38], 0
je 0x8f08ac
mov eax, dword [esp + 0x34]
mov dword [eax], 2
mov byte [edi + 0x9e3], 1
mov byte [edi + 0x9e2], 0
cmp dword [0xbc27fc], 0
je 0x8f0904
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0xa40]
push str._s_Infected_Archive._Aborting_scan_and_taking_necessary_action...
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f0904
cmp dword [0xbc27fc], 0
je 0x8f0904
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Infected_Archive._NOT_Aborting_scan_as_AbortIfInfectionFound0...
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f0904
mov edx, dword [esp + 0x34]
xor ecx, ecx
cmp eax, 5
sete cl
lea ecx, [ecx*4 + 1]
mov dword [edx], ecx
cmp dword [edi + 0x9d8], 0
jne 0x8f0b45
cmp byte [edi + 0x9e1], 1
jne 0x8f0b45
mov dword [edi + 0x9d8], 1
jmp 0x8f0b45
mov eax, dword [esp + 0x40]
cmp eax, 1
je 0x8f0afb
cmp eax, 2
je 0x8f0afb
cmp eax, 5
je 0x8f0afb
mov ecx, dword [0xb8dae8]
mov esi, dword [esp + 0x34]
mov dword [esi], ecx
cmp ecx, 0xa
jne 0x8f0970
mov ebx, 1
cmp dword [esp + 0x64], ebx
jne 0x8f0970
mov dword [esi], 3
jmp 0x8f0975
mov ebx, 1
test eax, eax
jne 0x8f09bb
cmp dword [0xbc27fc], eax
je 0x8f09c5
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Since_OBJECT_STATUS_SCAN_FAILED_forcing_ObjectCanBeDeletedOrQuarantined_to_TRUE...
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f09c5
cmp dword [esp + 0x58], ebx
jne 0x8f0a86
lea eax, [esp + 0x38]
push eax
push str.AbortIfInfectionFound
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [esp + 0x40], ebx
call fcn.0094c0d0
test al, al
jne 0x8f0a02
mov eax, dword [esp + 0x38]
mov esi, str.AbortIfInfectionFound
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov esi, dword [esp + 0x34]
cmp dword [esp + 0x38], 0
je 0x8f0b49
cmp dword [0xbc27fc], 0
je 0x8f0a7b
cmp byte [esp + 0x51c], 0
je 0x8f0a44
lea ecx, [esp + 0x51c]
push ecx
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xa44]
push str._s__ACTIONQ___s__ObjectCanBeDeletedOrQuarantined_is_SET._Object_Cannot_be_disinfected.
push eax
call fcn.00a78f30
add esp, 0x10
jmp 0x8f0a5e
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0xa40]
push str._s_ObjectCanBeDeletedOrQuarantined_is_SET._Object_Cannot_be_disinfected.
push edx
call fcn.00a78f30
add esp, 0xc
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [esi], 2
jmp 0x8f0b49
cmp dword [0xbc27fc], 0
je 0x8f0b49
cmp byte [esp + 0x51c], 0
je 0x8f0ac1
lea edx, [esp + 0x51c]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xa44]
push str._s__ACTIONC___s__Object_will_be_tried_for_disinfection.
push ecx
call fcn.00a78f30
add esp, 0x10
jmp 0x8f0adb
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0xa40]
push str._s_Object_will_be_tried_for_disinfection.
push eax
call fcn.00a78f30
add esp, 0xc
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f0b49
mov eax, dword [esp + 0x34]
mov dword [eax], 1
cmp dword [0xbc27fc], 0
je 0x8f0b45
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0xa40]
push str._s_Object_is_clean_disinf_deleted._Setting_iScanAct_to_SCAN_ACTION_NONE
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0xa44]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov esi, dword [esp + 0x34]
inc dword [edi + 0x9dc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 8], eax
cmp dword [0xbc27fc], 0
je 0x8f0c57
push 0x103
lea edx, [esp + 0x939]
push 0
push edx
mov byte [esp + 0x940], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0x831]
push 0
push eax
mov byte [esp + 0x838], 0
call fcn.00a7ffb0
mov ecx, dword [esi]
add esp, 0xc
lea eax, [esp + 0x934]
call fcn.008eda70
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x82c]
mov ecx, ebx
call fcn.008ed950
cmp dword [edi + 0x99c], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [esi]
lea edx, [esp + 0x830]
push edx
push ebx
lea eax, [esp + 0x940]
push eax
lea edx, [esp + 0x78]
push ecx
lea eax, [esp + 0xa50]
push edx
je 0x8f0bf7
push str._s_Leaving_eScanScanCallback_from_Intercept__ScanAct___d___s___ScanStat___d___s___ISSP___d_
jmp 0x8f0bfc
push str._s_Leaving_eScanScanCallback_from_AltScan__ScanAct___d___s___ScanStat___d___s___ISSP___d_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x20
push 0
push ecx
lea edx, [esp + 0xa44]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [esi]
add esp, 0x10
cmp eax, 3
je 0x8f0c2f
cmp eax, 0xa
jne 0x8f0c57
cmp byte [str.C:PROGRA2eScanLOGDisInfFL.log], 0
je 0x8f0c57
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x51c]
push eax
push ecx
push str.DisinfectFile:__s___s_
push str.C:PROGRA2eScanLOGDisInfFL.log
call fcn.0096a780
add esp, 0x10
mov ecx, dword [esp + 0x3278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3230]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret