Function at 0x8dd490
Capabilities:
Check for time delay via gettickcount
Create thread
Get common file path
Read .ini file
Read file on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa9c292
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0xe4ac
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x207
mov dword [ebp - 0xdeac], edx
mov dword [ebp - 0xdca8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xdc5c], ecx
mov ecx, dword [ebp + 0x10]
or esi, 0xffffffff
lea edx, [ebp - 0x3ab]
push ebx
push edx
mov dword [ebp - 0xdce8], ebx
mov dword [ebp - 0xddec], ebx
mov dword [ebp - 0xddf4], ebx
mov dword [ebp - 0xdccc], esi
mov dword [ebp - 0xdc64], esi
mov dword [ebp - 0xdc48], esi
mov dword [ebp - 0xdd04], ebx
mov dword [ebp - 0xdc2c], eax
mov dword [ebp - 0xdc4c], 1
mov dword [ebp - 0xdd14], ebx
mov dword [ebp - 0xdd50], ebx
mov dword [ebp - 0xdd0c], ebx
mov dword [ebp - 0xdea0], ebx
mov dword [ebp - 0xdc30], ebx
mov dword [ebp - 0xdd64], ebx
mov dword [ebp - 0xdd94], ecx
mov byte [ebp - 0x3ac], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x1afb]
push ebx
push eax
mov dword [ebp - 0xdd20], ebx
mov dword [ebp - 0xdc88], ebx
mov dword [ebp - 0xdcf4], ebx
mov dword [ebp - 0xdd28], ebx
mov dword [ebp - 0xdc40], ebx
mov dword [ebp - 0xdc28], ebx
mov dword [ebp - 0xdcb4], ebx
mov byte [ebp - 0x1afc], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x2123]
push ebx
push ecx
mov byte [ebp - 0x2124], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x28cb]
push ebx
push edx
mov byte [ebp - 0x28cc], bl
call fcn.00a7ffb0
add esp, 0xc
push 0xfff
lea eax, [ebp - 0x19f3]
push ebx
push eax
mov byte [ebp - 0x19f4], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea ecx, [ebp - 0x74bb]
push ebx
push ecx
mov byte [ebp - 0x74bc], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x7cb]
push ebx
push edx
mov byte [ebp - 0x7cc], bl
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x9dc], bl
push 0x103
lea eax, [ebp - 0x9db]
push ebx
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x183]
push ebx
push ecx
mov byte [ebp - 0x184], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x5b3]
push ebx
push edx
mov byte [ebp - 0x5b4], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x8d3]
push ebx
xor edi, edi
push eax
mov dword [ebp - 0xdc34], edi
mov byte [ebp - 0x8d4], bl
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x27], ebx
mov dword [ebp - 0x23], ebx
mov dword [ebp - 0x1f], ebx
mov word [ebp - 0x1b], bx
mov byte [ebp - 0x19], bl
mov dword [ebp - 0xdcf8], esi
mov dword [ebp - 0xdd74], esi
mov dword [ebp - 0xdcdc], ebx
mov dword [ebp - 0xde68], ebx
mov dword [ebp - 0xdd80], ebx
mov dword [ebp - 0xdd78], ebx
mov dword [ebp - 0xdc90], ebx
mov dword [ebp - 0xdcc4], ebx
mov dword [ebp - 0xdc78], ebx
mov dword [ebp - 0xdd7c], ebx
mov dword [ebp - 0xdda0], ebx
mov dword [ebp - 0xde9c], ebx
mov dword [ebp - 0xdc68], ebx
mov dword [ebp - 0xdc74], ebx
mov dword [ebp - 0xdcc0], ebx
mov dword [ebp - 0xddc4], ebx
mov dword [ebp - 0xdd84], ebx
mov dword [ebp - 0xdc60], ebx
mov dword [ebp - 0xdcf0], ebx
mov dword [ebp - 0xdcc8], ebx
mov dword [ebp - 0xdc3c], ebx
mov dword [ebp - 0xdcb0], ebx
mov dword [ebp - 0xdce0], ebx
mov dword [ebp - 0xdc94], ebx
mov dword [ebp - 0xdcd4], ebx
mov dword [ebp - 0xdc98], ebx
mov dword [ebp - 0xded4], ebx
mov dword [ebp - 0xdddc], ebx
mov dword [ebp - 0xdd98], ebx
mov dword [ebp - 0xdd10], ebx
mov dword [ebp - 0xdc54], ebx
mov dword [ebp - 0xdcec], ebx
mov dword [ebp - 0xdd58], ebx
mov dword [ebp - 0xdd60], ebx
mov dword [ebp - 0xdd54], ebx
mov dword [ebp - 0xdd68], ebx
mov dword [ebp - 0xdd38], ebx
mov dword [ebp - 0xdc70], ebx
mov dword [ebp - 0xdce4], ebx
mov dword [ebp - 0xdc84], ebx
mov dword [ebp - 0xddfc], ebx
mov dword [ebp - 0xdca0], ebx
mov dword [ebp - 0xdcac], ebx
mov dword [ebp - 0xdc44], ebx
mov dword [ebp - 0xdea8], ebx
mov dword [ebp - 0xdd30], ebx
push 0x218
lea ecx, [ebp - 0xd5e0]
push ebx
push ecx
mov dword [ebp - 0xdc9c], ebx
mov dword [ebp - 0xdd3c], ebx
mov dword [ebp - 0xdd18], ebx
mov dword [ebp - 0xdcbc], ebx
mov dword [ebp - 0xdd9c], ebx
mov dword [ebp - 0xdeb4], ebx
mov dword [ebp - 0xdebc], ebx
mov dword [ebp - 0xdd6c], ebx
mov dword [ebp - 0xdc38], ebx
mov dword [ebp - 0xdd2c], ebx
mov dword [ebp - 0xd5e4], ebx
call fcn.00a7ffb0
add esp, 0xc
push 0x13c
lea edx, [ebp - 0xd198]
push ebx
push edx
mov dword [ebp - 0xd19c], ebx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xde14], ebx
mov dword [ebp - 0xdd40], ebx
mov dword [ebp - 0xde0c], ebx
mov dword [ebp - 0xdcb8], ebx
cmp dword [0xbd06a4], ebx
je 0x8dd878
lea eax, [ebp - 0xddec]
lea ecx, [ebp - 0xddf4]
mov dword [ebp - 0xdcd0], eax
mov dword [ebp - 0xdd44], ecx
jmp 0x8dd884
mov dword [ebp - 0xdcd0], ebx
mov dword [ebp - 0xdd44], ebx
mov eax, dword [0xb8db44]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
neg eax
sbb eax, eax
lea edx, [ebp - 0xdddc]
and eax, edx
mov dword [ebp - 0xdd90], eax
call esi
mov dword [ebp - 0xddb8], eax
mov dword [0xb8da58], eax
mov eax, dword [ebp + 8]
push 0xbd5dc4
mov dword [ebp - 0xdc50], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0xbd633c]
cmp eax, ebx
je 0x8dd8f8
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xde14], eax
cmp eax, ebx
jne 0x8dd8f2
mov ecx, dword [0xbd633c]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
mov edx, dword [0xbd633c]
mov dword [edx], eax
mov edi, dword [ebp - 0xdc34]
call esi
mov ecx, dword [ebp + 8]
cmp dword [ecx*4 + 0xb8dbb4], 1
lea ecx, [ecx*4 + 0xb8dbb4]
mov dword [ebp - 0xdcd8], eax
jne 0x8ddbda
mov eax, dword [ebp + 8]
lea eax, [eax*4 + 0xbc280c]
mov dword [ebp - 0xdc58], eax
mov eax, dword [eax]
cmp eax, ebx
je 0x8ddbda
mov dword [ecx], ebx
lea ecx, [ebp - 0xde78]
push ecx
push 0x1a
push eax
mov dword [ebp - 0xde78], ebx
mov dword [ebp - 0xdec0], ebx
mov dword [ebp - 0xdec8], ebx
call dword [0xb8da90]
mov esi, dword [ebp - 0xdc58]
mov eax, dword [esi]
add esp, 0xc
lea edx, [ebp - 0xdec0]
push edx
push 0x1b
push eax
call dword [0xb8da90]
mov edx, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0xdec8]
push ecx
push 0x57
push edx
call dword [0xb8da90]
mov eax, dword [ebp - 0xde78]
add esp, 0xc
cmp eax, ebx
jne 0x8ddaec
cmp dword [0xbc2804], 1
jne 0x8ddbda
cmp dword [0xbc27fc], ebx
je 0x8dd9fd
push 0x103
lea eax, [ebp - 0x4ddb]
push ebx
push eax
mov byte [ebp - 0x4ddc], bl
call fcn.00a7ffb0
mov esi, dword [ebp + 8]
add esp, 0xc
push esi
lea ecx, [ebp - 0x4ddc]
push str._ARCH___FX_a__SETTING_Archive_Scan_on_ScanInstance__d_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push ebx
push edx
lea eax, [ebp - 0x4ddc]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8dda00
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xdc58]
mov edx, dword [ecx]
push 1
push 0x1a
push edx
call dword [0xb8da8c]
mov eax, dword [ebp - 0xdc58]
mov ecx, dword [eax]
add esp, 0xc
push 1
push 0x1b
push ecx
call dword [0xb8da8c]
mov edx, dword [ebp - 0xdc58]
mov eax, dword [edx]
add esp, 0xc
push 1
push 0xff0
push eax
call dword [0xb8da8c]
mov ecx, dword [0xb392ac]
mov edx, dword [ebp - 0xdc58]
mov eax, dword [edx]
add esp, 0xc
push ecx
push 0x28
push eax
call dword [0xb8da8c]
mov ecx, dword [esi*4 + 0xbc2838]
add esp, 0xc
push 1
push 0x1a
push ecx
call dword [0xb8da8c]
mov edx, dword [esi*4 + 0xbc2838]
add esp, 0xc
push 1
push 0x1b
push edx
call dword [0xb8da8c]
mov eax, dword [esi*4 + 0xbc2838]
add esp, 0xc
push 1
push 0xff0
push eax
call dword [0xb8da8c]
mov ecx, dword [0xb392ac]
mov edx, dword [esi*4 + 0xbc2838]
add esp, 0xc
push ecx
push 0x28
push edx
call dword [0xb8da8c]
mov eax, dword [ebp - 0xdc58]
mov ecx, dword [eax]
add esp, 0xc
push 1
push 0x57
push ecx
call dword [0xb8da8c]
mov edx, dword [esi*4 + 0xbc2838]
add esp, 0xc
push 1
push 0x57
push edx
call dword [0xb8da8c]
add esp, 0xc
jmp 0x8ddbdd
cmp eax, 1
jne 0x8ddbda
cmp dword [0xbc2804], ebx
jne 0x8ddbda
cmp dword [0xbc27fc], ebx
je 0x8ddb5a
push 0x103
lea eax, [ebp - 0x4feb]
push ebx
push eax
mov byte [ebp - 0x4fec], bl
call fcn.00a7ffb0
mov esi, dword [ebp + 8]
add esp, 0xc
push esi
lea ecx, [ebp - 0x4fec]
push str._ARCH___FX_a__RESETTING_Archive_Scan_on_ScanInstance__d_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push ebx
push edx
lea eax, [ebp - 0x4fec]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8ddb5d
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xdc58]
mov edx, dword [ecx]
push ebx
push 0x1a
push edx
call dword [0xb8da8c]
mov eax, dword [ebp - 0xdc58]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push 0x1b
push ecx
call dword [0xb8da8c]
mov edx, dword [esi*4 + 0xbc2838]
add esp, 0xc
push ebx
push 0x1a
push edx
call dword [0xb8da8c]
mov eax, dword [esi*4 + 0xbc2838]
add esp, 0xc
push ebx
push 0x1b
push eax
call dword [0xb8da8c]
mov ecx, dword [ebp - 0xdc58]
mov edx, dword [ecx]
add esp, 0xc
push ebx
push 0x57
push edx
call dword [0xb8da8c]
mov eax, dword [esi*4 + 0xbc2838]
add esp, 0xc
push ebx
push 0x57
push eax
call dword [0xb8da8c]
add esp, 0xc
jmp 0x8ddbdd
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xdcd8]
sub ecx, dword [esi*4 + 0xb8db64]
cmp ecx, 0x5265c0
jbe 0x8ddc69
mov eax, dword [esi*4 + 0xbc280c]
cmp eax, ebx
je 0x8ddc5c
push 1
push 0x42
push eax
call dword [0xb8da8c]
add esp, 0xc
cmp eax, ebx
jne 0x8ddc1f
cmp dword [0xbc27fc], ebx
je 0x8ddc57
push esi
push str._optFreeModuleInstances_Done_For_ThreadIndex:__d
jmp 0x8ddc2d
cmp dword [0xbc27fc], ebx
je 0x8ddc57
push esi
push str._optFreeModuleInstances_Failed_For_ThreadIndex:__d
lea edx, [ebp - 0x19f4]
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push ebx
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.008dba50
mov edx, dword [ebp - 0xdcd8]
mov dword [esi*4 + 0xb8db64], edx
mov eax, dword [ebp - 0xdeac]
cmp eax, ebx
je 0x8ddc7b
mov eax, dword [eax]
mov dword [ebp - 0xdc38], eax
mov eax, dword [ebp - 0xdca8]
cmp eax, ebx
je 0x8ddc8b
mov dword [ebp - 0xdc30], eax
mov ecx, dword [0xbc27fc]
cmp ecx, ebx
je 0x8dddf4
cmp dword [0xb567c0], ebx
je 0x8ddcaa
cmp ecx, 2
jne 0x8dddf4
cmp dword [ebp - 0xdc30], 4
jbe 0x8ddce1
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x8d4]
push edx
mov edx, dword [ebp - 0xdc30]
push 0x208
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
push edx
call fcn.009bb790
add esp, 0x1c
cmp byte [ebp - 0x5b4], bl
jne 0x8ddd47
cmp dword [ebp - 0xdc38], ebx
je 0x8ddd1e
mov eax, dword [ebp - 0xdc30]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 0xdc38]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push edx
push eax
push esi
lea ecx, [ebp - 0x19f4]
push str.___d______d__Into_Flt_Clbk__KHand__0x_x__dwf__0x_x___Pid___ld_
push ecx
call fcn.00a78f30
jmp 0x8dddcf
mov edx, dword [ebp - 0xdc30]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push edx
push eax
push ecx
push esi
lea edx, [ebp - 0x19f4]
push str.___d______d__Into_Flt_Clbk__KHand__NULL__dwf__0x_x___Pid___ld_
push edx
call fcn.00a78f30
add esp, 0x18
jmp 0x8dddd2
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
jne 0x8ddd6a
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8ddd71
inc eax
mov dword [ebp - 0xdc34], eax
mov eax, dword [ebp - 0xdc30]
mov ecx, dword [ebp + 0x20]
lea edx, [ebp - 0x5b4]
push edx
push eax
push ecx
cmp dword [ebp - 0xdc38], ebx
je 0x8dddb3
mov edx, dword [ebp - 0xdc38]
mov eax, dword [ebp + 0x10]
push edx
push eax
push esi
lea ecx, [ebp - 0x19f4]
push str.___d______d__Into_Flt_Clbk__KHand__0x_x__dwf__0x_x___Pid___ld__PN:_s__
push ecx
call fcn.00a78f30
mov edi, dword [ebp - 0xdc34]
add esp, 0x20
jmp 0x8dddd2
mov edx, dword [ebp + 0x10]
push edx
push esi
lea eax, [ebp - 0x19f4]
push str.___d______d__Into_Flt_Clbk__KHand__NULL__dwf__0x_x___Pid___ld__PN:_s__
push eax
call fcn.00a78f30
mov edi, dword [ebp - 0xdc34]
add esp, 0x1c
mov ecx, dword [0xbc27fc]
push ebx
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
mov ecx, dword [0xbc27fc]
add esp, 0x10
test byte [ebp + 0x20], 4
je 0x8dde04
mov dword [ebp - 0xdc9c], 1
mov eax, dword [0xb38014]
mov edx, 1
cmp eax, edx
jne 0x8ddf2d
cmp dword [ebp - 0xdc38], ebx
jne 0x8ddf2d
cmp ecx, ebx
je 0x8dde47
cmp dword [0xb567c0], ebx
je 0x8dde33
cmp ecx, 2
jne 0x8dde47
push ebx
push ecx
push str.Kernel_Handle_Not_Available_For_Scanning_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
mov ecx, 7
mov esi, str.FILTER_VERDICT_COULD_NOT_SCAN
lea edi, [ebp - 0x636c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp eax, ebx
je 0x8ddee8
cmp dword [0xb567c0], ebx
je 0x8dde75
cmp eax, 2
jne 0x8ddee8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [ebp - 0xddb8]
sub eax, esi
cmp eax, 0xfa0
jbe 0x8ddea6
call edi
mov ecx, dword [ebp - 0xdca8]
sub eax, esi
push eax
lea eax, [ebp - 0x636c]
push eax
push ecx
push str._____d__Out_of_Flt_Clbk_1_.___s____u_ms_
jmp 0x8ddebe
call edi
mov ecx, dword [ebp - 0xdca8]
sub eax, esi
push eax
lea eax, [ebp - 0x636c]
push eax
push ecx
push str.___d__Out_of_Flt_Clbk_1_.___s____u_ms_
lea edx, [ebp - 0x19f4]
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push ebx
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [0xbd5dc4]
test edx, edx
jle 0x8ddf23
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0xbd5dc4
call esi
mov eax, dword [0xbd633c]
cmp eax, ebx
je 0x8ddf23
cmp dword [ebp - 0xde14], ebx
jne 0x8ddf23
mov eax, dword [eax + 4]
test eax, eax
jle 0x8ddf23
mov ecx, dword [0xbd633c]
add ecx, 4
push ecx
call esi
mov eax, 6
jmp 0x8ed413
cmp dword [0xb56814], ebx
jne 0x8ecee9
cmp dword [0xb8db4c], edx
je 0x8ecef1
cmp dword [0xb567c0], ebx
jne 0x8ecee9
mov edx, dword [ebp - 0xdc5c]
cmp edx, ebx
je 0x8de09f
cmp word [0xbf4268], bx
je 0x8ddfc5
push 0xbf4268
push edx
call fcn.00a97a87
add esp, 8
test eax, eax
jne 0x8ddfbc
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8ddf97
push ebx
push eax
push str.SAMEFILE
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb38014]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xd
mov dword [ebp - 0xdc4c], eax
mov dword [ebp - 0xdcf0], 1
jmp 0x8df754
xor edx, edx
mov word [0xbf4268], dx
mov eax, dword [ebp - 0xdc5c]
push eax
lea ebx, [ebp - 0xdc28]
call fcn.00970520
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xdc28]
add esp, 4
mov ebx, eax
test esi, esi
je 0x8de1b2
cmp byte [esi], 0
je 0x8de1b2
cmp dword [0xbd051c], 0
jbe 0x8de1b2
push 0
push str._sys
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8de1b2
push 0
push str.tasks
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8de1b2
cmp byte [ebp - 0x5b4], 0
jne 0x8de0bc
cmp dword [ebp - 0xdc30], 4
jbe 0x8de07a
push 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x8d4]
push edx
mov edx, dword [ebp - 0xdc30]
push 0x208
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
push edx
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8de0b3
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
mov edi, ecx
jmp 0x8de0c4
cmp ecx, ebx
je 0x8ddf9c
push ebx
push ecx
push str.No_FileName_Provided_By_The_Bd_Engine
jmp 0x8ddf8a
inc eax
mov dword [ebp - 0xdc34], eax
mov edi, eax
test edi, edi
je 0x8de1b2
cmp byte [edi], 0
je 0x8de1b2
push 0x3ff
lea edx, [ebp - 0xa84b]
push 0
push edx
mov byte [ebp - 0xa84c], 0
call fcn.00a7ffb0
add esp, 0xc
mov eax, str.sppsvc.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.reload.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.secexec.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.WmiPrvSE.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.OSPPSVC.EXE
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.php.EXE
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.mwagent.EXE
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
mov eax, str.consctl
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8de37c
mov eax, str.taskmgr.exe
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8de37c
call fcn.009812d0
cmp eax, 1
je 0x8de1b2
mov dword [0xbd051c], 0
test ebx, ebx
je 0x8ecea6
test esi, esi
je 0x8ecea6
cmp byte [esi], 0
je 0x8ecea6
cmp dword [0xb8db20], 0
jne 0x8de1e3
mov eax, dword [ebp - 0xdc5c]
call fcn.00970400
test eax, eax
je 0x8de1ee
mov eax, esi
call fcn.009758e0
test eax, eax
je 0x8de1ff
mov ebx, dword [ebp - 0xdc5c]
call fcn.00970430
mov dword [ebp - 0xdcb4], eax
cmp dword [0xbc27fc], 0
je 0x8de244
mov eax, dword [ebp - 0xdc30]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push esi
lea edx, [ebp - 0x19f4]
push str.Intercept_Callback_Received_For_FileName:___s___BdId:__d__RPid:__ld
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [edx*4 + 0xb8db8c], 1
mov dword [ebp - 4], 2
call fcn.00981330
cmp byte [esi], 0x5c
jne 0x8de370
cmp byte [esi + 1], 0x5c
jne 0x8de370
xor ebx, ebx
push 0x40f
lea eax, [ebp - 0x83fb]
push ebx
push eax
mov byte [ebp - 0x83fc], bl
call fcn.00a7ffb0
mov eax, dword [0xbc27fc]
add esp, 0xc
cmp eax, ebx
je 0x8de2ad
push ebx
push eax
push str.ConvertUNC
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea edx, [ebp - 0x83fc]
mov ecx, esi
call fcn.00981420
cmp eax, 1
jne 0x8de370
cmp byte [ebp - 0x83fc], bl
je 0x8de370
cmp dword [0xbc27fc], ebx
je 0x8de30b
lea ecx, [ebp - 0x83fc]
push ecx
push esi
lea edx, [ebp - 0x19f4]
push str.Converted___s__to___s_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, dword [ebp - 0xdcb4]
cmp eax, ebx
je 0x8de320
call fcn.00970490
mov dword [ebp - 0xdcb4], ebx
push esi
call fcn.00a78fec
lea eax, [ebp - 0x83fc]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x8de332
sub eax, edx
inc eax
push eax
call fcn.00a7a155
add esp, 4
mov dword [ebp - 0xdc28], eax
cmp eax, ebx
je 0x8df752
lea ecx, [ebp - 0x83fc]
mov edx, eax
jmp 0x8de360
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x8de360
mov esi, dword [ebp - 0xdc28]
mov dword [ebp - 4], 0xffffffff
jmp 0x8de3fd
cmp dword [0xbc27fc], 0
je 0x8de3bc
push edi
push esi
push str._DLXCACHE__DCT_Active._Waiting_for_it_to_finish___PRECACHE__FN:__s___PN:__s_
push 0xffffffffffffffff
lea eax, [ebp - 0xa84c]
push 0x400
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0xa84c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov eax, 1
mov dword [ebp - 0xdc4c], eax
mov dword [ebp - 0xdcf0], eax
jmp 0x8df752
cmp dword [0xbc27fc], 0
je 0x8de460
mov eax, dword [ebp - 0xdc30]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xdc9c]
push eax
push eax
mov eax, dword [0xb8db58]
push edx
mov edx, dword [0xb3df08]
push eax
mov eax, dword [0xb3de00]
push ecx
mov ecx, dword [0xbd18b4]
push edx
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.EPS_A:__d__DCE:__d__EPS_E:__d__FBS:__d__dwLF:__d__dwFS:__lu__rPID:__u__0x_x_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x38
lea ebx, [ebp - 0x3ac]
mov eax, esi
mov dword [ebp - 0xdc80], 0
call fcn.0096ff30
lea edi, [ebp - 0x7cc]
call fcn.008bb7e0
mov ecx, edi
call fcn.0094c3d0
xor ecx, ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0xdc58], eax
cmp dword [0xbd18b4], ecx
je 0x8de9da
cmp dword [0xb8db58], ecx
je 0x8de9da
cmp dword [ebp + 0x18], ecx
jbe 0x8de9da
mov eax, dword [ebp - 0xdc5c]
cmp eax, ecx
je 0x8de9da
cmp word [eax], cx
je 0x8de9da
cmp dword [0xb3dde0], ecx
jbe 0x8de9da
mov edi, dword [ebp - 0xdc28]
cmp byte [edi], 0x5c
mov dword [ebp - 0xdcd8], ecx
mov dword [ebp - 0xdd00], ecx
mov dword [ebp - 0xdc8c], ecx
jne 0x8de509
cmp byte [edi + 1], 0x5c
jne 0x8de509
mov dword [ebp - 0xdc8c], 1
mov ebx, dword [ebp - 0xdc30]
cmp byte [ebp - 0x5b4], cl
jne 0x8de574
cmp ebx, 4
jbe 0x8de544
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push ebx
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
jne 0x8de56b
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
mov esi, ecx
jmp 0x8de582
inc esi
mov dword [ebp - 0xdc34], esi
jmp 0x8de57a
mov esi, dword [ebp - 0xdc34]
test esi, esi
je 0x8de6fc
mov cl, byte [esi]
test cl, cl
je 0x8de6fc
cmp cl, 0x61
jl 0x8de59e
cmp cl, 0x7a
jg 0x8de59e
movsx eax, cl
lea edx, [eax - 0x20]
jmp 0x8de5a3
movsx eax, cl
mov edx, eax
cmp edx, 0x53
jne 0x8de6fc
cmp cl, 0x61
jl 0x8de5b8
cmp cl, 0x7a
jg 0x8de5b8
sub al, 0x20
cmp al, 0x53
jne 0x8de645
push str.SearchProtocolHost.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
push str.SearchFilterHost.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
push str.SearchIndexer.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
push str.SearchApp.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
push str.SearchUI.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
push str.SmartScreen.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
jmp 0x8de6fc
cmp al, 0x4d
jne 0x8de650
push str.msmpeng.exe
jmp 0x8de633
cmp al, 0x4e
jne 0x8de65b
push str.ngen.exe
jmp 0x8de633
cmp al, 0x52
jne 0x8de666
push str.RuntimeBroker.exe
jmp 0x8de633
cmp al, 0x55
jne 0x8de671
push str.USOCoreWorker.exe
jmp 0x8de633
cmp al, 0x42
jne 0x8de67c
push str.backgroundTaskHost.exe
jmp 0x8de633
cmp al, 0x48
jne 0x8de687
push str.HxTsr.exe
jmp 0x8de633
cmp al, 0x57
jne 0x8de6fc
push str.wermgr.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de6af
push str.werfault.exe
push esi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8de6fc
cmp dword [0xbc27fc], 0
mov dword [ebp - 0xdcd8], 1
je 0x8de6fc
push edi
push ebx
lea edx, [ebp - 0x5b4]
push edx
lea eax, [ebp - 0xcc5c]
push str._MAP__Process_Ignored___s:_u___s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0xcc5c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x3ac], 0
je 0x8de759
lea ecx, [ebp - 0x3ac]
call fcn.00a5c640
test eax, eax
je 0x8de759
cmp dword [0xbc27fc], 0
je 0x8de74f
push edi
lea eax, [ebp - 0xd05c]
push str._MAP__A__File_Ignored___s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0xd05c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdd00], 1
cmp dword [ebp - 0xdcd8], 0
jne 0x8de9da
cmp dword [ebp - 0xdd00], 0
jne 0x8de9da
mov ebx, dword [ebp - 0xdc9c]
test ebx, ebx
je 0x8deac8
cmp dword [0xb3dde0], 0
je 0x8de9da
mov eax, dword [ebp - 0xdc8c]
test eax, eax
jne 0x8de7a6
test byte [0xb8db58], 3
jne 0x8de7bc
jmp 0x8de9da
cmp eax, 1
jne 0x8de9da
test byte [0xb8db58], 4
je 0x8de9da
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x226a]
push ecx
mov dword [ebp - 0xde7c], 0
mov word [ebp - 0x226c], ax
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x3ac]
push 0xab99f8
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de8a6
lea eax, [ebp - 0x3ac]
push str.temp
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de8a6
lea ecx, [ebp - 0x3ac]
push 0xad16b0
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de8a6
lea edx, [ebp - 0x3ac]
push str.back
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8de8a6
mov ecx, dword [ebp - 0xdc5c]
lea edx, [ebp - 0x226c]
call fcn.00892d60
test eax, eax
je 0x8de931
cmp dword [0xbc27fc], 0
je 0x8de9da
push eax
lea ecx, [ebp - 0x19f4]
push str._MAP__FBS__Excluded_Extn__eii_u__NOT_adding_to_FBS
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8de9da
mov eax, 0xad16bc
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de921
mov eax, 0xad16c0
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de921
mov eax, 0xad16c4
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de921
mov eax, 0xad16c8
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de921
mov eax, 0xad16cc
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de921
mov eax, dword [ebp - 0xdc58]
xor edi, edi
lea esi, [ebp - 0x7cc]
call fcn.0098d9e0
test eax, eax
je 0x8de92b
mov eax, 1
jmp 0x8de862
mov edi, dword [ebp - 0xdc28]
mov esi, dword [ebp - 0xdcb4]
test esi, esi
je 0x8dea3c
cmp byte [esi], 0
je 0x8dea3c
push 0x5c
push esi
call fcn.00a7aa50
mov edi, eax
add esp, 8
test edi, edi
jne 0x8de95d
mov edi, esi
jmp 0x8de95e
inc edi
cmp dword [0xbc27fc], 0
je 0x8de99f
mov eax, dword [ebp + 0x18]
push 0
push esi
push eax
lea ecx, [ebp - 0x19f4]
push str._MAP__FBS__Adding_UTF8__u:_s__eii_u_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [ebp - 0xdc30]
push 0
lea ecx, [ebp - 0x28]
push ecx
push edx
mov edx, dword [ebp + 0x18]
push ebx
lea eax, [ebp - 0xde7c]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
push esi
mov dword [ebp - 0xdc80], 0xb
push edx
mov edx, edi
lea ecx, [ebp - 0x8d4]
call 0x9bc080
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0xdc30]
mov esi, dword [ebp - 0xdc28]
cmp edi, 4
jbe 0x8df15d
cmp byte [ebp - 0x3ac], 0
je 0x8df15d
xor ebx, ebx
cmp dword [ebp - 0xdc9c], ebx
je 0x8df15d
lea eax, [ebp - 0x3ac]
push 0xad17e8
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8dee50
mov dword [ebp - 0xdcb8], 1
jmp 0x8dee8e
push 0x5c
push edi
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
jne 0x8dea51
mov esi, edi
jmp 0x8dea52
inc esi
cmp dword [0xbc27fc], 0
je 0x8dea96
mov ecx, dword [ebp + 0x18]
push 0
lea eax, [ebp - 0x5b4]
push eax
push edi
push ecx
lea edx, [ebp - 0x19f4]
push str._MAP__FBS__Adding_ANSI__u:_s___s___eii_u_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov eax, dword [ebp - 0xdc30]
push 0
lea edx, [ebp - 0x28]
push edx
push eax
mov eax, dword [ebp + 0x18]
push ebx
lea ecx, [ebp - 0xde7c]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
mov dword [ebp - 0xdc80], 0xe
push eax
mov edx, esi
jmp 0x8de9cc
xor ecx, ecx
push 0x3e
push ecx
lea edx, [ebp - 0x22aa]
push edx
mov dword [ebp - 0xde70], 0
mov word [ebp - 0x22ac], cx
call fcn.00a7ffb0
mov eax, dword [ebp - 0xdc8c]
add esp, 0xc
mov ebx, 1
test eax, eax
jne 0x8deb0a
test byte [0xb8db58], 3
jne 0x8deb20
jmp 0x8de9da
cmp eax, 1
jne 0x8de9da
test byte [0xb8db58], 4
je 0x8de9da
mov ecx, dword [ebp - 0xdc5c]
cmp word [ecx], 0
je 0x8deb39
lea edx, [ebp - 0x22ac]
call fcn.00892d60
mov ebx, eax
mov dword [ebp - 0xdc80], 0xa
test ebx, ebx
jbe 0x8deba9
cmp byte [ebp - 0x3ac], 0
je 0x8deba9
lea ecx, [ebp - 0x3ac]
call fcn.00a5c640
test eax, eax
je 0x8deba9
cmp dword [0xbc27fc], 0
je 0x8de9da
mov eax, dword [ebp - 0xdc28]
push eax
lea ecx, [ebp - 0xc85c]
push str._MAP__B__File_Ignored___s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0xc85c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8de9da
lea ecx, [ebp - 0x3ac]
push 0xab99f8
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8dec29
lea edx, [ebp - 0x3ac]
push str.temp
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8dec29
lea eax, [ebp - 0x3ac]
push 0xad16b0
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8dec29
lea ecx, [ebp - 0x3ac]
push str.back
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8dec29
mov eax, dword [ebp - 0xdc58]
xor edi, edi
lea esi, [ebp - 0x7cc]
call fcn.0098d9e0
test eax, eax
je 0x8decbc
jmp 0x8de9da
mov eax, 0xad16bc
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de9da
mov eax, 0xad16c0
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de9da
mov eax, 0xad16c4
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de9da
mov eax, 0xad16c8
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de9da
mov eax, 0xad16cc
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8de9da
mov eax, dword [ebp - 0xdc58]
xor edi, edi
lea esi, [ebp - 0x7cc]
call fcn.0098d9e0
test eax, eax
jne 0x8de9da
mov esi, dword [ebp - 0xdcb4]
test esi, esi
je 0x8ded59
cmp byte [esi], 0
je 0x8ded59
push 0x5c
push esi
call fcn.00a7aa50
mov edi, eax
add esp, 8
test edi, edi
jne 0x8dece8
mov edi, esi
jmp 0x8dece9
inc edi
cmp dword [0xbc27fc], 0
je 0x8ded29
mov edx, dword [ebp + 0x18]
push ebx
push esi
push edx
lea eax, [ebp - 0x19f4]
push str._MAP__ACC__Adding_UTF8__u:_s__eii_u_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [ebp - 0xdc30]
push ebx
lea eax, [ebp - 0x28]
push eax
push ecx
mov ecx, dword [ebp + 0x18]
push 0
lea edx, [ebp - 0xde70]
push edx
lea eax, [ebp - 0x5b4]
push eax
push esi
mov dword [ebp - 0xdc80], 0xb
push ecx
jmp 0x8de9ca
mov edi, dword [ebp - 0xdc28]
push 0x5c
push edi
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
jne 0x8ded74
mov esi, edi
jmp 0x8ded75
inc esi
cmp dword [0xbc27fc], 0
je 0x8dedb9
mov eax, dword [ebp + 0x18]
push ebx
lea edx, [ebp - 0x5b4]
push edx
push edi
push eax
lea ecx, [ebp - 0x19f4]
push str._MAP__ACC__Adding_ANSI__u:_s___s___eii_u_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov edx, dword [ebp - 0xdc30]
push ebx
lea ecx, [ebp - 0x28]
push ecx
push edx
mov edx, dword [ebp + 0x18]
push 0
lea eax, [ebp - 0xde70]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
push edi
push edx
mov dword [ebp - 0xdc80], 0xe
mov edx, esi
jmp 0x8de9cc
lea ecx, [ebp - 0x3ac]
push str.Identifier
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8df15d
push ebx
push str.:Zone.Identifier
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8df15d
mov dword [ebp - 0xde0c], 1
cmp dword [0xbd052c], ebx
je 0x8df15d
cmp byte [ebp - 0x5b4], 0
mov dword [ebp - 0xdd00], ebx
jne 0x8deefb
push ebx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
jne 0x8deef4
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8def03
inc eax
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], ebx
je 0x8def41
mov edi, dword [ebp - 0xdc34]
cmp byte [edi], 0
je 0x8def41
mov ecx, edi
call fcn.009158e0
test eax, eax
jne 0x8def35
cmp dword [ebp - 0xdcb8], ebx
je 0x8def41
mov ecx, edi
call fcn.00915b60
cmp eax, 1
jne 0x8def41
mov dword [ebp - 0xdd00], eax
jmp 0x8def41
cmp dword [0xb3b68c], ebx
jne 0x8df15d
cmp dword [ebp - 0xde0c], ebx
je 0x8df0a9
push 0x103
lea edx, [ebp - 0x688b]
push ebx
push edx
mov dword [ebp - 0xdcd8], ebx
mov byte [ebp - 0x688c], 0
call fcn.00a7ffb0
add esp, 0xc
xor edi, edi
mov dword [ebp - 0xde98], ebx
cmp byte [esi], 0x5c
jne 0x8defa3
cmp byte [esi + 1], 0x5c
jne 0x8defa3
push ebx
push ebx
push ebx
lea edx, [ebp - 0x688c]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8defa3
mov dword [ebp - 0xdcd8], 1
call fcn.00968110
test eax, eax
je 0x8defbd
lea eax, [ebp - 0xde98]
push eax
call fcn.009681c0
add esp, 4
mov edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 0xdc38]
xor ecx, ecx
call fcn.0094d300
cmp dword [0xbc27fc], 0
mov ebx, eax
je 0x8df082
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x8df00a
push ebx
push esi
push str._INTERNET___s__ZN:_u_
push 0xffffffffffffffff
lea ecx, [ebp - 0x943c]
push 0x208
push ecx
call fcn.00a78fcb
add esp, 0x18
jmp 0x8df066
push 0x103
lea edx, [ebp - 0x540b]
push 0
push edx
mov byte [ebp - 0x540c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea esi, [ebp - 0x540c]
call fcn.00960b00
mov ecx, dword [ebp - 0xdc28]
add esp, 4
mov eax, esi
push eax
push ebx
push ecx
push str._INTERNET___s__ZN:_u___s_
push 0xffffffffffffffff
lea edx, [ebp - 0x943c]
push 0x208
push edx
call fcn.00a78fcb
mov esi, dword [ebp - 0xdc28]
add esp, 0x1c
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x943c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test edi, edi
je 0x8df095
mov edx, dword [ebp - 0xde98]
push edx
call fcn.00968240
add esp, 4
cmp dword [ebp - 0xdcd8], 1
jne 0x8df0a4
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp ebx, 3
jae 0x8df0c3
cmp dword [ebp - 0xdcb8], 0
je 0x8df15d
cmp dword [ebp - 0xdd00], 0
je 0x8df15d
mov eax, dword [ebp - 0xdc34]
test eax, eax
je 0x8df0ee
cmp byte [eax], 0
je 0x8df0ee
push 5
push 0
push 0
push 0
mov edx, eax
lea ecx, [ebp - 0x5b4]
call fcn.008cde60
add esp, 0x10
test eax, eax
jne 0x8df15d
cmp dword [ebp - 0xdcb8], 0
jne 0x8df11f
push 0x3a
push esi
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x8df109
mov byte [eax], 0
push esi
push str._INTERNET__Blocking_Internet_Downloaded_File___s_
push 0xffffffffffffffff
push 0x400
lea eax, [ebp - 0xb45c]
push eax
jmp 0x8df133
push esi
push str._INTERNET__Blocking_Save_As_PDF_via_Browser___s_
push 0xffffffffffffffff
push 0x400
lea ecx, [ebp - 0xb45c]
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0xb45c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc44], 4
xor ebx, ebx
mov dword [ebp - 4], 6
mov dword [ebp - 0xde24], ebx
cmp dword [0xb45d94], ebx
jne 0x8df190
mov eax, 1
mov dword [ebp - 0xdcec], eax
mov dword [ebp - 0xdd58], eax
mov dword [ebp - 0xdd60], ebx
jmp 0x8df6ae
cmp byte [ebp - 0x3ac], 0
mov dword [ebp - 0xde24], 1
jne 0x8df1c6
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8df294
push ebx
push eax
push str.No_File_Extension_Present
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8df216
cmp dword [0xbc27fc], ebx
je 0x8df205
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x19f4]
push str.____Physical_Extension:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push ebx
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x3ac]
call fcn.0094c3d0
mov dword [ebp - 0xdd40], eax
cmp byte [ebp - 0x3ac], 0
je 0x8df294
lea ecx, [ebp - 0x7cc]
push 0x2e
push ecx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8df25e
lea edx, [ebp - 0x7cc]
push 0x2e
push edx
mov byte [esi], 0
call fcn.00a7aa50
add esp, 8
mov dword [ebp - 0xdc40], eax
mov byte [esi], 0x2e
test eax, eax
je 0x8df25e
inc eax
mov dword [ebp - 0xdc40], eax
cmp byte [ebp - 0x3ac], 0
je 0x8df294
mov eax, 0xaaab94
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8df28f
mov eax, 0xaaab9c
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8df294
mov ebx, 1
mov eax, dword [ebp - 0xdc28]
mov edi, dword [0xbd4afc]
push 0x5c
push eax
mov dword [ebp - 0xde24], 3
call fcn.00a7a2c0
add esp, 8
mov esi, eax
test ebx, ebx
jne 0x8df43c
cmp byte [ebp - 0x3ac], bl
je 0x8df419
mov al, byte [ebp - 0x7cc]
cmp al, 0x57
je 0x8df2d9
cmp al, 0x77
jne 0x8df2f7
mov ecx, dword [ebp - 0xdc28]
mov eax, str.C:WINDOWSWIN.INI
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov al, byte [ebp - 0x7cc]
cmp byte [ebp - 0x3ac], 0
je 0x8df419
cmp al, 0x56
je 0x8df30c
cmp al, 0x76
jne 0x8df32a
mov eax, str.vsigns.dat
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov al, byte [ebp - 0x7cc]
cmp byte [ebp - 0x3ac], 0
je 0x8df419
cmp al, 0x50
je 0x8df33f
cmp al, 0x70
jne 0x8df375
mov eax, str.proxev1.ev1
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov eax, str.patches.dat.gz
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov al, byte [ebp - 0x7cc]
cmp byte [ebp - 0x3ac], 0
je 0x8df419
cmp al, 0x45
je 0x8df38a
cmp al, 0x65
jne 0x8df3d8
mov eax, str.EVCACHE.DAT
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov eax, str.eScan.DBF
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov eax, str.eupdate.ini
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov al, byte [ebp - 0x7cc]
cmp byte [ebp - 0x3ac], 0
je 0x8df419
cmp al, 0x4d
je 0x8df3e9
cmp al, 0x6d
jne 0x8df419
mov eax, str.mailscan.ini
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8df4ec
mov eax, str.microsoft.exchange.
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8df4ec
test esi, esi
je 0x8df43c
mov al, byte [esi + 1]
cmp al, 0x56
je 0x8df428
cmp al, 0x76
jne 0x8df43c
mov eax, str.Virtual_Machine
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8df4ec
cmp dword [0xbd465c], 0
je 0x8df467
mov ecx, dword [ebp - 0xdc28]
push 0
add ecx, 3
push str.Content.Outlook
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8df4ec
test edi, edi
jne 0x8df50f
mov esi, dword [ebp - 0xdc28]
mov al, byte [esi + 3]
add esi, 3
cmp al, 0x53
je 0x8df483
cmp al, 0x73
jne 0x8df493
mov eax, str.System_Volume_Information
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8df4ec
mov al, byte [esi]
cmp al, 0x52
je 0x8df49d
cmp al, 0x72
jne 0x8df4ad
mov eax, 0xad196c
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8df4ec
mov al, byte [esi]
cmp al, 0x57
je 0x8df4b7
cmp al, 0x77
jne 0x8df4c7
mov eax, 0xad1978
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8df4ec
cmp byte [esi], 0x24
jne 0x8df50f
mov eax, str._Windows.BT_
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8df4ec
mov eax, 0xad1998
mov ecx, esi
call fcn.0094c3e0
test eax, eax
jne 0x8df50f
mov dword [ebp - 0xdcec], 1
mov dword [ebp - 0xdd58], 2
mov dword [ebp - 0xdd60], 0
jmp 0x8df6ae
test ebx, ebx
jne 0x8df6a1
cmp dword [0xbd4af8], ebx
jne 0x8df6a1
cmp dword [ebp - 0xdc44], ebx
jne 0x8df6a1
mov eax, dword [ebp - 0xdd40]
mov esi, dword [ebp - 0xdc30]
lea edx, [ebp - 0xdd60]
push edx
push eax
lea ecx, [ebp - 0xde24]
push ecx
mov ecx, dword [ebp - 0xdc2c]
lea edx, [ebp - 0xdd58]
push edx
lea eax, [ebp - 0xdcec]
push eax
push ecx
lea edx, [ebp - 0xded4]
push edx
lea eax, [ebp - 0xdc34]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x8d4]
push edx
push esi
lea eax, [ebp - 0x7cc]
push eax
push ecx
lea edx, [ebp - 0x5b4]
lea ecx, [ebp - 0x3ac]
call fcn.00a5cdc0
add esp, 0x34
cmp dword [ebp - 0xdcec], ebx
je 0x8df6a1
cmp byte [ebp - 0x3ac], bl
je 0x8df6a1
mov eax, 0xab748c
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8df6a1
cmp dword [ebp - 0xdc58], 0x64
jbe 0x8df6a1
cmp byte [ebp - 0x5b4], al
jne 0x8df63b
cmp esi, 4
jbe 0x8df60d
push eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push esi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x8df632
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8df645
inc ecx
mov dword [ebp - 0xdc34], ecx
jmp 0x8df641
mov ecx, dword [ebp - 0xdc34]
test ecx, ecx
je 0x8df6a1
cmp byte [ecx], 0
je 0x8df6a1
mov eax, str.wscript.exe
call fcn.0094c330
test eax, eax
jne 0x8df6a1
push esi
lea edx, [ebp - 0x5b4]
push edx
lea eax, [ebp - 0x19f4]
push str._XML__Process___s:_d__ForceBypass.
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
mov esi, dword [ebp - 0xdc30]
add esp, 0x20
push 0
push 8
lea ebx, [ebp - 0x5b4]
call fcn.008cab40
add esp, 8
cmp dword [ebp - 0xdcec], 1
jne 0x8df9b4
mov esi, dword [ebp - 0xdc28]
test esi, esi
je 0x8df752
cmp dword [0xbc27fc], 0
je 0x8df705
mov edx, dword [ebp - 0xdd60]
mov eax, dword [ebp - 0xdd58]
push edx
push eax
push esi
lea ecx, [ebp - 0x19f4]
push str.SUP_CL_File:__s___u___u_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbd065c], 0
jne 0x8df717
cmp dword [0xbc27fc], 0
je 0x8df752
mov ecx, dword [ebp - 0xdd60]
mov edx, dword [ebp - 0xdd58]
push ecx
push edx
push esi
lea eax, [ebp - 0x19f4]
push str._s___u___u_
push eax
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push str.C:PROGRA2eScanLOGSuperCL.log
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
mov esi, dword [ebp - 0xdc50]
mov dword [ebp - 4], 0x44
cmp dword [esi*4 + 0xbc280c], ebx
je 0x8df803
cmp dword [ebp - 0xdc68], 1
jne 0x8df803
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8df798
push ebx
push eax
push str._ARCH__Resetting_back_OptScanArch...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [esi*4 + 0xbc280c]
push ebx
push 0x1a
push eax
call dword [0xb8da8c]
mov ecx, dword [esi*4 + 0xbc280c]
add esp, 0xc
push ebx
push 0x1b
push ecx
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xb8db48], ebx
jne 0x8df7d0
cmp dword [ebp - 0xdc74], ebx
je 0x8df7e4
mov edx, dword [esi*4 + 0xbc280c]
push ebx
push 0x57
push edx
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xbc27fc], ebx
je 0x8df803
mov eax, dword [esi*4 + 0xbc280c]
push ebx
push 0xff0
push eax
call dword [0xb8da8c]
add esp, 0xc
cmp dword [ebp - 0xdc38], ebx
je 0x8df84b
lea ecx, [ebp - 0xdc38]
push ecx
call fcn.00985290
cmp eax, 1
jne 0x8ecf6f
mov edx, dword [ebp - 0xdeac]
mov dword [edx], ebx
cmp dword [ebp - 0xde0c], ebx
je 0x8df84b
cmp dword [0xb3c8dc], ebx
je 0x8df84b
mov ecx, dword [ebp - 0xdc28]
cmp ecx, ebx
je 0x8df84b
cmp byte [ecx], bl
je 0x8df84b
call fcn.0094d560
mov eax, dword [ebp - 0xd5e0]
cmp eax, ebx
je 0x8df85b
mov dword [eax], 1
mov dword [ebp - 4], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp - 0xddb8]
mov eax, 1
lea ecx, [eax + 0xc]
cmp dword [ebp - 0xdcf0], ebx
jne 0x8df88c
cmp dword [ebp - 0xdc4c], ecx
jne 0x8df88c
mov dword [ebp - 0xdc4c], eax
cmp dword [ebp - 0xdeb4], ebx
je 0x8df8a2
cmp dword [ebp - 0xdc4c], eax
jne 0x8df8a2
mov dword [ebp - 0xdc4c], ecx
cmp dword [ebp - 0xdebc], eax
je 0x8df8ca
cmp dword [ebp - 0xdd14], eax
jne 0x8df8ba
cmp dword [ebp - 0xdea0], ebx
je 0x8df8ca
cmp dword [ebp - 0xdc4c], eax
jne 0x8df8d0
cmp dword [ebp - 0xdd50], eax
jne 0x8df8d0
mov dword [ebp - 0xdc4c], ecx
mov eax, dword [0xbc27fc]
cmp eax, ebx
jne 0x8ed066
cmp dword [0xbd06b0], ebx
jne 0x8ed066
cmp dword [ebp - 0xdc28], ebx
je 0x8ed3ac
mov edx, dword [ebp - 0xdc28]
cmp byte [edx], bl
je 0x8ed399
call esi
sub eax, edi
cmp eax, 0xfa0
jbe 0x8ed399
mov eax, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
mov byte [ebp - 0x1a4], bl
mov dword [ebp - 0x1a3], ebx
mov dword [ebp - 0x19f], ebx
mov dword [ebp - 0x19b], ebx
mov dword [ebp - 0x197], ebx
mov dword [ebp - 0x193], ebx
mov dword [ebp - 0x18f], ebx
mov dword [ebp - 0x18b], ebx
mov word [ebp - 0x187], bx
mov byte [ebp - 0x185], bl
test eax, eax
jge 0x8df965
fadd qword [0xb0baa8]
sub esp, 8
lea ecx, [ebp - 0x1a4]
fstp qword [esp]
push ecx
call fcn.008dce90
add esp, 0xc
call esi
mov ecx, dword [ebp - 0xdc28]
sub eax, edi
push eax
mov eax, dword [ebp - 0xdca8]
lea edx, [ebp - 0x1a4]
push edx
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.__s:_d___s__took__u_ms
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x19f4]
push eax
jmp 0x8ed38c
cmp dword [ebp - 0xdc44], 0
jne 0x8dfa8f
mov ecx, dword [ebp - 0xdc28]
mov eax, 1
lea esi, [ebp - 0x7cc]
call fcn.008aed80
cmp eax, 1
jne 0x8dfa8f
mov esi, dword [ebp - 0xdc28]
test esi, esi
je 0x8df752
cmp dword [0xbc27fc], 0
je 0x8dfa28
push esi
lea edx, [ebp - 0x19f4]
push str.MONITOR_EXCLUDED_File:__s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbd065c], 0
jne 0x8dfa3e
cmp dword [0xbc27fc], 0
je 0x8df752
mov edx, dword [ebp - 0xdd60]
mov eax, dword [ebp - 0xdd58]
push edx
push eax
push esi
lea ecx, [ebp - 0x19f4]
push str._MON_EXCL___s___u___u_
push ecx
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
jmp 0x8df745
call fcn.00896380
mov edi, dword [ebp - 0xdc44]
mov dword [ebp - 4], 8
mov dword [ebp - 0xdc58], 0
test edi, edi
jne 0x8dfb77
mov eax, str.hh.dat
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
jne 0x8dfb77
cmp dword [0xb8db3c], eax
jne 0x8dfb77
mov dword [ebp - 0xdebc], 1
cmp dword [0xbd5cbc], eax
jne 0x8dfb77
mov dword [0xbd5cbc], 1
cmp dword [0xbd04f4], eax
jne 0x8dfb77
push eax
push eax
push 0x89af80
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7j
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8dfb77
push 0x103
lea eax, [ebp - 0x561b]
push ebx
push eax
mov byte [ebp - 0x561c], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_a2__fails_with_error__d
push esi
lea ecx, [ebp - 0x561c]
push 0x104
push ecx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea edx, [ebp - 0x561c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc58], 1
mov dword [0xbd0d5c], 0
test edi, edi
jne 0x8dfd4d
cmp dword [0xb3dea0], edi
je 0x8dfd4d
cmp dword [ebp - 0xdc9c], edi
je 0x8dfd4d
mov ecx, dword [ebp - 0xdc28]
inc ecx
mov eax, str.:_settings.ini
call fcn.0094c330
test eax, eax
jne 0x8dfd4d
mov eax, dword [ebp - 0xdc38]
call fcn.00964530
test eax, eax
je 0x8dfd4d
mov eax, dword [ebp - 0xdc2c]
add eax, 0x21
mov dword [ebp - 0xded0], edi
call fcn.00966e40
mov esi, eax
cmp esi, edi
je 0x8dfd4d
mov eax, dword [ebp - 0xdc38]
push 1
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0xdc2c]
push edi
lea ecx, [ebp - 0xded0]
push ecx
push edx
mov ebx, eax
mov eax, dword [ebp - 0xdc38]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x8dfc5c
push edi
push str.General_
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8dfc51
push edi
push str.Uninstaller_
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8dfc5c
mov edi, 1
mov dword [0xbd0d5c], edi
mov ecx, dword [ebp - 0xdc38]
push 0
push 0
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.00a78fec
add esp, 4
test edi, edi
je 0x8dfd4d
mov eax, dword [0xbf467c]
test eax, eax
je 0x8dfc94
cmp eax, dword [ebp - 0xdc30]
je 0x8dfd4d
mov esi, dword [ebp - 0xdc30]
push esi
push str._CPL__MEM_SCAN__TERM__Force_Terminating_PID:_u_as_it_is_modifying_Uninstaller_File_
push 0xffffffffffffffff
lea edx, [ebp - 0xae54]
push 0x208
push edx
mov dword [0xbf467c], esi
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0xae54]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push esi
push 0
push 0x8c5d00
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7cR
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8dfd4d
push 0x103
lea ecx, [ebp - 0x3d63]
push ebx
push ecx
mov byte [ebp - 0x3d64], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_w__fails_with_error__d
push esi
lea edx, [ebp - 0x3d64]
push 0x104
push edx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea eax, [ebp - 0x3d64]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov esi, dword [ebp - 0xdc44]
xor ebx, ebx
mov dword [ebp - 0xdc58], 2
cmp esi, ebx
jne 0x8dfdd9
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8dfd80
push ebx
push eax
push str.SearchEDL
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, dword [ebp - 0xdc28]
push ebx
mov ecx, edi
call fcn.00940740
add esp, 4
cmp eax, 1
jne 0x8dfddf
cmp dword [0xbc27fc], ebx
je 0x8dfdcf
push edi
lea ecx, [ebp - 0x19f4]
push str.Excluded_Drive:_Not_Going_Into_Callback_For_FileName:__s
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
jmp 0x8df752
mov edi, dword [ebp - 0xdc28]
mov dword [ebp - 0xdc58], 4
cmp esi, ebx
jne 0x8dfe63
cmp dword [0xb8daf4], ebx
je 0x8dfe63
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8dfe12
push ebx
push eax
push str.SearchEXFL
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push edi
call fcn.0093f9c0
add esp, 4
cmp eax, 1
jne 0x8dfe63
cmp dword [0xbc27fc], ebx
je 0x8dfe59
push edi
lea ecx, [ebp - 0x19f4]
push str.Exclude_Folder:_Not_Going_Into_Callback_For_FileName:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push ebx
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
jmp 0x8df752
mov esi, 1
mov dword [ebp - 0xdc58], 5
cmp dword [0xbd6314], esi
jne 0x8dff2f
cmp dword [0xbd6310], esi
jne 0x8dfeeb
cmp dword [0xb8dafc], esi
jne 0x8dff2f
cmp dword [0xb3df38], ebx
je 0x8dff2f
push ebx
push esi
push str.Re_Enabling_NWScan...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push ebx
push ebx
push ebx
push 0x2000107
mov dword [0xbd6310], ebx
call dword [0xb8dac4]
add esp, 0x10
push ebx
push esi
push ebx
push 0x200010d
call dword [0xb8dac4]
add esp, 0x10
push ebx
push ebx
push ebx
push 0x2000110
call dword [0xb8dac4]
add esp, 0x10
cmp dword [0xbd6310], ebx
jne 0x8dff2f
cmp dword [0xbd630c], 6
jne 0x8dff2f
cmp dword [0xb3df38], ebx
je 0x8dff2f
push ebx
push esi
push str.Re_Disabling_NWScan...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push ebx
push esi
push ebx
push 0x2000107
mov dword [0xbd6310], esi
call dword [0xb8dac4]
add esp, 0x10
cmp byte [edi], 0
mov dword [ebp - 0xdc58], 6
je 0x8e0fac
push 0x103
lea ecx, [ebp - 0x310b]
push ebx
push ecx
mov dword [ebp - 0xdc8c], ebx
mov dword [ebp - 0xdd00], ebx
mov dword [ebp - 0xdcd8], ebx
mov byte [ebp - 0x310c], 0
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x3ac], 0
je 0x8e077d
mov eax, 0xaaab9c
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e077d
push 0x103
lea edx, [ebp - 0x7cc]
push edx
lea eax, [ebp - 0x2adc]
push eax
call fcn.00a7a620
add esp, 0xc
cmp byte [ebp - 0x29da], 0
je 0x8dffc0
mov byte [ebp - 0x29d9], 0
lea ecx, [ebp - 0x2adc]
push 0x2e
push ecx
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
je 0x8e02a8
lea ecx, [ebp - 0x2adc]
mov byte [eax], 0
call fcn.0094c3d0
mov esi, eax
mov dword [ebp - 0xdcd8], esi
cmp esi, 3
jb 0x8e02a8
lea ecx, [ebp - 0x2adc]
lea edx, [ebp - 0x310c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8e0004
mov ecx, edi
mov byte [ebp + esi - 0x2ade], al
call fcn.0094c3d0
add eax, 0x100
push eax
call fcn.00a7a155
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x8e02a6
mov ecx, edi
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8e0038
push 0x5c
push ebx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8e0086
push 0x5c
push ebx
mov byte [esi], 0
call fcn.00a7aa50
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x8e007f
mov eax, str._temp
call fcn.0094c3e0
test eax, eax
jne 0x8e007f
mov dword [ebp - 0xdd00], 1
mov byte [esi], 0x5c
inc esi
mov byte [esi], 0
lea eax, [ebp - 0x2adc]
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8e0090
mov edi, ebx
sub eax, ecx
mov esi, ecx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8e00a0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8e00c0
mov dx, word [0xaacda4]
mov esi, dword [ebp - 0xdc30]
mov word [edi], dx
cmp byte [ebp - 0x5b4], al
jne 0x8e0138
cmp esi, 4
jbe 0x8e010e
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 0x208
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x5b4]
push eax
push esi
call fcn.009bb790
add esp, 0x1c
lea ecx, [ebp - 0x5b4]
push 0x5c
push ecx
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e0131
lea edx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], edx
jmp 0x8e0138
inc eax
mov dword [ebp - 0xdc34], eax
mov eax, ebx
lea ecx, [ebp - 0x5b4]
call fcn.0094c3e0
test eax, eax
jne 0x8e029d
cmp dword [0xb3dc74], eax
je 0x8e029d
push eax
lea eax, [ebp - 0x5b4]
push str.Asis
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e029d
mov edi, dword [ebp - 0xdc28]
push 0
push str.Asis
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e029d
mov eax, str.cam_E.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8e029d
push 0x7ff
lea ecx, [ebp - 0xc45b]
push 0
push ecx
mov byte [ebp - 0xc45c], 0
call fcn.00a7ffb0
add esp, 0xc
push edi
push esi
lea edx, [ebp - 0x5b4]
push edx
push str._CPL__HUNT__TERM__Force_Terminating_Process__s:_u_as_it_accessed_driver___s_
push 0xffffffffffffffff
lea eax, [ebp - 0xc45c]
push 0x800
push eax
call fcn.00a78fcb
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0xc45c]
push ecx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [0xacdaf0]
mov edx, dword [str.PCHunter_Blocked]
mov ecx, dword [0xacdaf4]
mov dword [ebp - 0x2ef8], eax
mov al, byte [0xacdafc]
mov dword [ebp - 0x2efc], edx
mov edx, dword [0xacdaf8]
mov byte [ebp - 0x2eec], al
add esp, 0x10
lea eax, [ebp - 0x2efc]
mov dword [ebp - 0xdc8c], 1
mov dword [ebp - 0x2ef4], ecx
mov dword [ebp - 0x2ef0], edx
call fcn.008c4130
push 0x104
lea ecx, [ebp - 0x76cc]
push ecx
push 0xaa1543
mov edx, str.BlockNotify
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x76cc], 0x30
je 0x8e029d
lea edx, [ebp - 0x2efc]
push edx
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
mov edx, str.Message
mov ecx, 0x80000002
call fcn.0094bd00
push ebx
call fcn.00a78fec
add esp, 4
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xdc58], 7
cmp eax, ebx
je 0x8e02f8
mov eax, dword [ebp - 0xdc38]
call fcn.00964530
mov edi, dword [ebp - 0xdc2c]
mov edx, dword [ebp - 0xdcd8]
push eax
mov eax, dword [ebp - 0xdc9c]
push eax
mov eax, dword [ebp - 0xdd00]
push edi
lea ecx, [ebp - 0x310c]
push ecx
push edx
push eax
push str._GMER__SysInTemp:_u__SysLen:_u__FN:__s___ObjSz:_u__FBS:_u__HandleValid:_u
push 0
call fcn.0096a780
add esp, 0x20
jmp 0x8e02fe
mov edi, dword [ebp - 0xdc2c]
cmp dword [ebp - 0xdc8c], 0
jne 0x8e077d
cmp dword [0xb3dc74], 0
je 0x8e077d
xor ebx, ebx
mov dword [ebp - 0xdc80], ebx
mov dword [ebp - 0xdcb8], ebx
cmp dword [0xb56800], ebx
je 0x8e033a
mov eax, 0xc000
mov ecx, 0x10000
jmp 0x8e0344
mov eax, 0x18400
mov ecx, 0x1c400
cmp dword [ebp - 0xdd00], ebx
je 0x8e042e
cmp dword [ebp - 0xdcd8], 8
jne 0x8e042e
cmp edi, eax
jbe 0x8e042e
cmp edi, ecx
jae 0x8e042e
cmp dword [ebp - 0xdc9c], ebx
je 0x8e042e
mov eax, dword [ebp - 0xdc38]
call fcn.00964530
test eax, eax
je 0x8e042e
lea eax, [edi + 0x21]
mov dword [ebp - 0xdeb8], ebx
call fcn.00966e40
mov esi, eax
cmp esi, ebx
je 0x8e042e
mov ecx, dword [ebp - 0xdc38]
push 1
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0xdeb8]
push edx
push edi
mov ebx, eax
mov eax, dword [ebp - 0xdc38]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x8e040a
mov eax, dword [ebp - 0xdeb8]
test eax, eax
jbe 0x8e040a
cmp dword [0xb56800], 0
push eax
je 0x8e03f0
push str.gmer64.pdb
jmp 0x8e03f2
push 0
push esi
call fcn.008dd160
add esp, 0xc
cmp eax, 0xffffffff
je 0x8e040a
mov dword [ebp - 0xdc80], 1
mov ecx, dword [ebp - 0xdc38]
push 0
push 0
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0xdc80], 0
jne 0x8e0494
mov eax, str.gmer.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8e0456
mov eax, str.gmer64.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
jne 0x8e0462
mov dword [ebp - 0xdc80], 1
jmp 0x8e0494
mov eax, str.sysdiag.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8e048a
mov eax, str.sysdiag64.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
jne 0x8e0494
mov dword [ebp - 0xdcb8], 1
mov eax, str.kEvP.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8e04d2
mov eax, str.kEvP64.sys
lea ecx, [ebp - 0x7cc]
call fcn.0094c330
test eax, eax
je 0x8e04d2
cmp dword [ebp - 0xdc80], 0
jne 0x8e04d2
cmp dword [ebp - 0xdcb8], 0
je 0x8e077d
push 0x7ff
lea edx, [ebp - 0xbc5b]
push 0
push edx
mov byte [ebp - 0xbc5c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x3e6b]
push 0
push eax
mov byte [ebp - 0x3e6c], 0
call fcn.00a7ffb0
mov edi, dword [ebp - 0xdc28]
mov ebx, dword [ebp - 0xdc80]
mov esi, dword [ebp - 0xdc30]
add esp, 0xc
push edi
push esi
test ebx, ebx
jne 0x8e05d4
cmp dword [ebp - 0xdcb8], ebx
jne 0x8e0590
lea ecx, [ebp - 0x5b4]
push ecx
push str._CPL__POWTOOL__TERM__Force_Terminating_Process__s:_u_as_it_accessed_driver___s_
push 0xffffffffffffffff
lea edx, [ebp - 0xbc5c]
push 0x800
push edx
call fcn.00a78fcb
mov eax, dword [str.Powertool_Blocked]
mov ecx, dword [0xacdc48]
mov edx, dword [0xacdc4c]
mov dword [ebp - 0x201c], eax
mov eax, dword [0xacdc50]
mov dword [ebp - 0x2018], ecx
mov cx, word [0xacdc54]
mov dword [ebp - 0x2014], edx
mov dword [ebp - 0x2010], eax
mov word [ebp - 0x200c], cx
jmp 0x8e0622
lea edx, [ebp - 0x5b4]
push edx
push str._CPL__HRSWORD__TERM__Force_Terminating_Process__s:_u_as_it_accessed_driver___s_
push 0xffffffffffffffff
lea eax, [ebp - 0xbc5c]
push 0x800
push eax
call fcn.00a78fcb
mov ecx, dword [str.HRSWord_Blocked]
mov edx, dword [0xacdb5c]
mov eax, dword [0xacdb60]
mov dword [ebp - 0x201c], ecx
mov ecx, dword [0xacdb64]
mov dword [ebp - 0x2010], ecx
jmp 0x8e0616
lea edx, [ebp - 0x5b4]
push edx
push str._CPL__GMER__TERM__Force_Terminating_Process__s:_u_as_it_accessed_driver___s_
push 0xffffffffffffffff
lea eax, [ebp - 0xbc5c]
push 0x800
push eax
call fcn.00a78fcb
mov ecx, dword [str.GMer_Blocked]
mov edx, dword [0xacdbac]
mov eax, dword [0xacdbb0]
mov dword [ebp - 0x201c], ecx
mov cl, byte [0xacdbb4]
mov byte [ebp - 0x2010], cl
mov dword [ebp - 0x2014], eax
mov dword [ebp - 0x2018], edx
add esp, 0x1c
push 0
push 1
lea edx, [ebp - 0xbc5c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea eax, [ebp - 0x201c]
mov dword [ebp - 0xdc8c], 1
call fcn.008c4130
push 0x104
lea eax, [ebp - 0x75c4]
push eax
push 0xaa1543
mov edx, str.BlockNotify
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x75c4], 0x30
je 0x8e0699
lea ecx, [ebp - 0x201c]
push ecx
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
mov edx, str.Message
mov ecx, 0x80000002
call fcn.0094bd00
lea edx, [ebp - 0x3e6c]
push edx
push edi
call fcn.008bdea0
add esp, 8
mov ecx, edi
call fcn.0094c3d0
add eax, 0x100
push eax
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8e074c
mov ecx, edi
mov edx, esi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8e06d0
push 0x5c
push esi
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x8e06ec
inc eax
jmp 0x8e06ee
mov eax, esi
mov byte [eax], 0
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8e06f4
mov ecx, dword [str.ShellExtend.dll]
mov dword [eax], ecx
mov edx, dword [0xad1dac]
mov dword [eax + 4], edx
mov ecx, dword [0xad1db0]
mov dword [eax + 8], ecx
mov edx, dword [0xad1db4]
mov dword [eax + 0xc], edx
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8e0743
lea eax, [ebp - 0x3e6c]
push eax
push esi
call fcn.008bdea0
add esp, 8
push esi
call fcn.00a78fec
add esp, 4
test ebx, ebx
je 0x8e0763
cmp byte [ebp - 0x310c], 0
je 0x8e0763
push 1
lea ebx, [ebp - 0x310c]
jmp 0x8e0773
cmp dword [ebp - 0xdcb8], 0
je 0x8e077d
push 0
mov ebx, str.SysDiag
push 0
call fcn.008f8370
add esp, 8
cmp dword [ebp - 0xdc8c], 0
mov dword [ebp - 0xdc58], 8
je 0x8e079c
mov dword [ebp - 0xdd74], 1
jmp 0x8e07b7
mov edi, dword [ebp - 0xdc28]
lea ebx, [ebp - 0xdd98]
call fcn.008bd470
mov dword [ebp - 0xdd74], eax
test eax, eax
je 0x8e07f8
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e07d5
push 0
push eax
push str.Already_Present_In_The_Infected_Cache_A_.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
xor ecx, ecx
cmp dword [0xb38014], 1
sete cl
lea ecx, [ecx*8 + 2]
mov dword [ebp - 0xdc4c], ecx
jmp 0x8df752
cmp dword [0xb3de28], 0
je 0x8e080e
cmp dword [0xbd4a90], 0
je 0x8e08bf
mov eax, str.bthprops.cpl
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
mov edi, dword [ebp - 0xdc30]
mov ebx, 1
test eax, eax
jne 0x8e08ca
mov dword [ebp - 0xdd50], ebx
cmp byte [ebp - 0x5b4], al
jne 0x8e0897
cmp edi, 4
jbe 0x8e086c
push eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e088f
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8e0897
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp edi, 4
jbe 0x8e08ca
push ebx
push 0xaa1543
push 0xaa1543
push str.fsquirt
push edi
xor ecx, ecx
lea edx, [ebp - 0x5b4]
call fcn.008cc840
add esp, 0x14
jmp 0x8e08ca
mov edi, dword [ebp - 0xdc30]
mov ebx, 1
cmp dword [0xb3dc74], 0
je 0x8e09a9
mov eax, str.dtrampo.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8e0917
mov eax, str.behavior.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
je 0x8e0917
mov eax, str.usysdiag.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e09a9
cmp byte [ebp - 0x5b4], 0
mov dword [ebp - 0xdd50], ebx
jne 0x8e097f
cmp edi, 4
jbe 0x8e0954
push 0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e0977
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8e097f
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp edi, 4
jbe 0x8e09a9
mov ecx, dword [ebp - 0xdc28]
push ebx
push str.huorong
push str.huorong
push str.hrsword
push edi
lea edx, [ebp - 0x5b4]
call fcn.008cc840
add esp, 0x14
cmp dword [0xb3d5bc], 0
je 0x8e0a5a
mov eax, str.pcre.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0a5a
mov dword [ebp - 0xdd50], ebx
cmp byte [ebp - 0x5b4], al
jne 0x8e0a34
cmp edi, 4
jbe 0x8e0a09
push eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e0a2c
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8e0a34
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp edi, 4
jbe 0x8e0a5a
push ebx
push str.Famatech
push str.Port_Scanner
push str.Port_Scanner
push edi
xor ecx, ecx
lea edx, [ebp - 0x5b4]
call fcn.008cc840
add esp, 0x14
cmp dword [0xb3dc6c], 0
je 0x8e0b0b
mov eax, str.rclone.conf
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0b0b
mov dword [ebp - 0xdd50], ebx
cmp byte [ebp - 0x5b4], al
jne 0x8e0ae5
cmp edi, 4
jbe 0x8e0aba
push eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e0add
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8e0ae5
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp edi, 4
jbe 0x8e0b0b
push ebx
push str.rclone.org
push str.rsync
push str.rclone
push edi
xor ecx, ecx
lea edx, [ebp - 0x5b4]
call fcn.008cc840
add esp, 0x14
cmp dword [0xb3de80], 0
je 0x8e0c1c
test byte [0xbd4aa4], 4
je 0x8e0c1c
mov eax, str.dwmapi.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0c1c
lea edx, [ebp - 0xde34]
push edx
push str.CopyPasteDisabledBlockRDPC
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0xde34], ebx
call fcn.0094c0d0
test al, al
jne 0x8e0b81
mov eax, dword [ebp - 0xde34]
mov esi, str.CopyPasteDisabledBlockRDPC
mov ebx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov ecx, 0x80000002
call fcn.0094be90
mov ebx, 1
cmp dword [ebp - 0xde34], ebx
jne 0x8e0c1c
cmp byte [ebp - 0x5b4], 0
mov dword [ebp - 0xdd50], ebx
jne 0x8e0bf5
cmp edi, 4
jbe 0x8e0bca
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 0x208
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x5b4]
push eax
push edi
call fcn.009bb790
add esp, 0x1c
lea ecx, [ebp - 0x5b4]
push 0x5c
push ecx
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e0bed
lea edx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], edx
jmp 0x8e0bf5
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp edi, 4
jbe 0x8e0c1c
push 0
push 0xaa1543
push str.RDP_Clip
push str.RDPClip
push edi
xor ecx, ecx
lea edx, [ebp - 0x5b4]
call fcn.008cc840
add esp, 0x14
mov esi, dword [0xbd4af4]
test esi, esi
jne 0x8e0c4a
cmp dword [0xbd4ae4], esi
jne 0x8e0c4a
cmp dword [0xbd4ae8], esi
jne 0x8e0c4a
cmp dword [0xbd4a90], esi
jne 0x8e0c4a
cmp dword [0xbd4aa8], ebx
jne 0x8e0fac
push 0x103
lea eax, [ebp - 0x1f13]
push 0
push eax
mov byte [ebp - 0x1f14], 0
call fcn.00a7ffb0
add esp, 0xc
cmp dword [0xbd4a90], 0
jne 0x8e0d9a
cmp dword [0xbd4aa8], ebx
je 0x8e0d9a
cmp dword [0xbd4ae4], 0
jne 0x8e0d30
cmp dword [0xbd4ae8], 0
jne 0x8e0d30
test esi, esi
je 0x8e0e1f
mov eax, str.gpedit.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0d01
mov ecx, dword [str.GPEdit_Blocked__GPEDIT_]
mov edx, dword [0xad1f8c]
mov eax, dword [0xad1f90]
mov dword [ebp - 0x1f14], ecx
mov ecx, dword [0xad1f94]
mov dword [ebp - 0x1f10], edx
mov edx, dword [0xad1f98]
mov dword [ebp - 0x1f0c], eax
mov eax, dword [0xad1f9c]
mov dword [ebp - 0x1f08], ecx
mov dword [ebp - 0x1f04], edx
mov dword [ebp - 0x1f00], eax
jmp 0x8e0e19
mov eax, str.mycomput.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0e1f
mov ecx, 0xa
mov esi, str.Computer_Modification_Blocked__COMPMGMT_
lea edi, [ebp - 0x1f14]
rep movsd dword es:[edi], dword [esi]
jmp 0x8e0e12
mov eax, str.devmgr.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0e1f
mov dword [ebp - 0xdd0c], ebx
mov dword [ebp - 0xdd14], ebx
cmp dword [0xbd4ae8], eax
je 0x8e0d7c
mov ecx, 0xc
mov esi, str.Device_Manager_Blocked_as_CD_DVD_Blocked__DEVMGMT_
lea edi, [ebp - 0x1f14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0xdc30]
jmp 0x8e0e1f
mov ecx, 8
mov esi, str.Device_Manager_Blocked__DEVMGMT_
lea edi, [ebp - 0x1f14]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0xdc30]
jmp 0x8e0e1f
mov eax, str.devmgr.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0dc2
mov ecx, 8
mov esi, str.Device_Manager_Blocked__DEVMGMT_
lea edi, [ebp - 0x1f14]
rep movsd dword es:[edi], dword [esi]
jmp 0x8e0e12
mov eax, str.mycomput.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0dea
mov ecx, 0xa
mov esi, str.Computer_Modification_Blocked__COMPMGMT_
lea edi, [ebp - 0x1f14]
rep movsd dword es:[edi], dword [esi]
jmp 0x8e0e12
mov eax, str.dmdskres.dll
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e0e1f
mov ecx, 8
mov esi, str.Disk_Management_Blocked__DISKMGMT_
lea edi, [ebp - 0x1f14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0xdc30]
mov dword [ebp - 0xdd14], ebx
cmp dword [ebp - 0xdd14], 0
je 0x8e0fac
cmp dword [ebp - 0xdd0c], 0
je 0x8e0e4b
cmp dword [0xbd4ae8], 0
je 0x8e0e4b
cmp dword [0xb3deb4], 0
je 0x8e0fac
cmp byte [ebp - 0x5b4], 0
jne 0x8e0ead
cmp edi, 4
jbe 0x8e0e82
push 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x8d4]
push edx
push 0x208
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
push edi
call fcn.009bb790
add esp, 0x1c
lea edx, [ebp - 0x5b4]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e0ea5
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], eax
jmp 0x8e0eba
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], 0
je 0x8e0fac
mov ecx, dword [ebp - 0xdc34]
cmp byte [ecx], 0
je 0x8e0fac
mov eax, str.mmc.exe
call fcn.0094c330
test eax, eax
jne 0x8e0fac
cmp byte [ebp - 0x1f14], al
je 0x8e0f84
push 0x103
push eax
lea ecx, [ebp - 0x582b]
push ecx
mov byte [ebp - 0x582c], al
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x1f14]
push edx
lea eax, [ebp - 0x582c]
push str._TERM___s
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push ebx
lea ecx, [ebp - 0x582c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x1f14], 0
je 0x8e0f84
push 0x104
lea edx, [ebp - 0x79dc]
push edx
push 0xaa1543
mov edx, str.BlockNotify
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x79dc], 0x30
je 0x8e0f84
lea eax, [ebp - 0x1f14]
push eax
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
mov edx, str.Message
mov ecx, 0x80000002
call fcn.0094bd00
call fcn.00896390
xor ecx, ecx
cmp dword [0xb38014], ebx
mov dword [ebp - 0xdea0], ebx
sete cl
lea ecx, [ecx*8 + 2]
mov dword [ebp - 0xdc4c], ecx
jmp 0x8df752
cmp byte [ebp - 0x7cc], 0
mov ebx, dword [ebp - 0xdc30]
mov dword [ebp - 0xdc58], 9
je 0x8e378a
mov edi, dword [ebp - 0xdc44]
xor eax, eax
mov esi, 1
mov dword [ebp - 0xdecc], 0x6ba
mov dword [ebp - 0xddd8], eax
mov dword [ebp - 0xdc80], esi
mov dword [ebp - 0xdd0c], eax
cmp edi, eax
jne 0x8e115c
push eax
xor esi, esi
lea ecx, [ebp - 0x7cc]
call fcn.008bb9e0
add esp, 4
cmp dword [0xbc27fc], 0
mov esi, eax
mov dword [ebp - 0xdc80], esi
je 0x8e106b
push 0x103
lea edx, [ebp - 0x3f73]
push 0
push edx
mov byte [ebp - 0x3f74], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea eax, [ebp - 0x3f74]
push str.SearchICL_Res:_u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x3f74]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test esi, esi
jne 0x8e115c
lea eax, [ebp - 0x7cc]
push 0x3a
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8e10ad
mov eax, dword [0xbc27fc]
mov esi, 1
mov dword [ebp - 0xdc80], esi
test eax, eax
je 0x8e11c7
push 0
push eax
push str.Forcing_Scan_for_File_with_Streams...
jmp 0x8e114f
cmp dword [0xbd4af4], 0
je 0x8e10f5
cmp byte [ebp - 0x3ac], 0
je 0x8e10f5
mov eax, 0xad1fe8
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e10f5
mov eax, dword [0xbc27fc]
mov esi, 1
mov dword [ebp - 0xdc80], esi
test eax, eax
je 0x8e11c7
push 0
push eax
push str.Forcing_Scan_of_File__BlockGPEdit_
jmp 0x8e114f
cmp dword [0xb3dc6c], 0
je 0x8e115c
cmp byte [ebp - 0x3ac], 0
je 0x8e115c
mov eax, str.CONF
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e115c
mov eax, str.rclone
lea ecx, [ebp - 0x7cc]
call fcn.0094c3e0
test eax, eax
jne 0x8e115c
mov eax, dword [0xbc27fc]
mov esi, 1
mov dword [ebp - 0xdc80], esi
test eax, eax
je 0x8e11c7
push 0
push eax
push str.Forcing_Scan_of_File__BlockRClone_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8e11c7
push 0x103
lea ecx, [ebp - 0x3633]
push 0
push ecx
mov byte [ebp - 0x3634], 0
call fcn.00a7ffb0
add esp, 0xc
push edi
cmp esi, 1
jne 0x8e1196
push str.FL_Include:TRUE__FIS:_d_
lea edx, [ebp - 0x3634]
push edx
jmp 0x8e11a2
push str.FL_Include:FALSE__FIS:_d_
lea eax, [ebp - 0x3634]
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x3634]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor esi, esi
mov dword [ebp - 0xdc58], 0xa
cmp edi, esi
jne 0x8e16af
cmp dword [0xb38014], esi
je 0x8e16af
cmp dword [0xbd1b04], esi
je 0x8e16af
cmp ebx, 4
jbe 0x8e16af
cmp dword [0xbd0af4], esi
jne 0x8e16af
push ebx
lea eax, [ebp - 0x5c0]
push str._04x
push eax
mov dword [ebp - 0xde8c], esi
mov dword [ebp - 0xddcc], esi
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x5c0]
push ecx
xor ecx, ecx
mov edx, 0xbe4480
call fcn.00980160
cmp eax, esi
jne 0x8e1663
mov ecx, dword [ebp - 0xdc5c]
lea edx, [ebp - 0xddcc]
push edx
lea eax, [ebp - 0xde8c]
push eax
push ecx
lea ecx, [ebp - 0xddd8]
mov edx, ebx
call 0x895210
mov edi, dword [ebp - 0xddd8]
add esp, 0xc
mov esi, eax
test edi, edi
jne 0x8e1281
lea edi, [ebp - 0xdecc]
mov dword [ebp - 0xddd8], edi
cmp dword [0xbc27fc], 0
je 0x8e12df
push 0x103
lea edx, [ebp - 0x5a3b]
push 0
push edx
mov byte [ebp - 0x5a3c], 0
call fcn.00a7ffb0
add esp, 0xc
push 5
push esi
push str.GCF::_Cnt_u__Max_u
push 0xffffffffffffffff
lea eax, [ebp - 0x5a3c]
push 0x104
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x5a3c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
cmp esi, 5
jb 0x8e15df
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0xde8c]
mov esi, eax
sub esi, edx
cmp dword [edi], 0
jne 0x8e1303
mov dword [edi], 0x6ba
mov ecx, dword [ebp - 0xdc5c]
cmp word [ecx], 0x5c
jne 0x8e1324
cmp word [ecx + 2], 0x5c
jne 0x8e1324
cmp dword [edi], 0x84a
jae 0x8e1324
mov dword [edi], 0x84a
cmp dword [0xbc27fc], 0
jne 0x8e133a
cmp dword [0xbd06b0], 0
je 0x8e13db
mov ebx, dword [ebp - 0xddcc]
cmp esi, dword [edi]
jae 0x8e1393
test ebx, ebx
je 0x8e13db
mov ecx, dword [ebx]
test ecx, ecx
je 0x8e135b
cmp ecx, 2
jne 0x8e13db
push esi
push eax
mov eax, dword [ebp - 0xdc28]
push edx
push eax
lea ecx, [ebp - 0x19f4]
push str._PIDINFO__YES_SKIPPING__s__Last:_u__Now:_u__Diff:_u_
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
mov dword [ebx], 1
jmp 0x8e13d8
test ebx, ebx
je 0x8e13db
mov ecx, dword [ebx]
test ecx, ecx
je 0x8e13a2
cmp ecx, 1
jne 0x8e13db
push esi
push eax
mov eax, dword [ebp - 0xdc28]
push edx
push eax
lea ecx, [ebp - 0x19f4]
push str._PIDINFO__NOT_SKIPPING__s__Last:_u__Now:_u__Diff:_u_
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
mov dword [ebx], 2
add esp, 0x28
cmp esi, dword [edi]
jae 0x8e154f
xor esi, esi
mov dword [ebp - 0xde50], esi
cmp dword [0xbc27fc], esi
je 0x8e1443
push 0x103
lea eax, [ebp - 0x4283]
push esi
push eax
mov byte [ebp - 0x4284], 0
call fcn.00a7ffb0
add esp, 0xc
push str.AddThisFileToPidScanInfo::
push 0xffffffffffffffff
lea ecx, [ebp - 0x4284]
push 0x104
push ecx
call fcn.00a78fcb
mov edx, dword [0xbc27fc]
push esi
push edx
lea eax, [ebp - 0x4284]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov ebx, dword [ebp - 0xdc5c]
mov ecx, ebx
mov edx, 0xbf4268
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x8e1450
mov edx, dword [ebp - 0xdc30]
lea ecx, [ebp - 0xde50]
push ecx
push edx
mov ecx, ebx
call 0x895350
mov ebx, dword [ebp - 0xdc2c]
mov ecx, dword [ebp - 0xdc28]
add esp, 8
push ebx
push 1
push 0
call 0x895d60
add esp, 0xc
cmp dword [0xbc27fc], 0
jne 0x8e14a4
cmp dword [0xbd06b0], 0
je 0x8e14d7
mov eax, dword [ebp - 0xde50]
push eax
lea ecx, [ebp - 0x19f4]
push str._PIDINFO__CleanFileCount:__d
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb38014]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xd
mov dword [ebp - 0xdc4c], eax
cmp ebx, 0xa00000
jb 0x8e1521
mov esi, ebx
shr esi, 0x14
inc esi
imul esi, esi, 0x7d
cmp esi, 0x6ba
jae 0x8e150b
mov esi, 0x6ba
mov dword [edi], esi
mov dword [ebp - 0xdcf0], 1
call fcn.00896390
jmp 0x8df752
mov eax, dword [ebp - 0xdc5c]
cmp word [eax], 0x5c
jne 0x8e14fe
cmp word [eax + 2], 0x5c
jne 0x8e14fe
mov esi, 0x84a
mov dword [edi], esi
mov dword [ebp - 0xdcf0], 1
call fcn.00896390
jmp 0x8df752
cmp dword [0xbc27fc], 0
je 0x8e15aa
push 0x103
lea eax, [ebp - 0x5c4b]
push 0
push eax
mov byte [ebp - 0x5c4c], 0
call fcn.00a7ffb0
add esp, 0xc
push str.ProcessSkippedFolder_A_::
push 0xffffffffffffffff
lea ecx, [ebp - 0x5c4c]
push 0x104
push ecx
call fcn.00a78fcb
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x5c4c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov ecx, dword [ebp - 0xdc30]
mov edx, dword [ebp - 0xdc5c]
call 0x895120
mov ecx, dword [ebp - 0xdc2c]
push ecx
mov ecx, dword [ebp - 0xdc28]
push 2
push 1
call 0x895d60
mov ebx, dword [ebp - 0xdc30]
add esp, 0xc
jmp 0x8e16af
cmp dword [0xbc27fc], 0
je 0x8e1642
push 0x103
lea edx, [ebp - 0x4493]
push 0
push edx
mov byte [ebp - 0x4494], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x6ba
push str.ProcessSkippedFolder_B_::_MaxDiff_u
push 0xffffffffffffffff
lea eax, [ebp - 0x4494]
push 0x104
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x4494]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [ebp - 0xdc2c]
mov ecx, dword [ebp - 0xdc28]
push eax
push 4
push 1
mov dword [edi], 0x6ba
call 0x895d60
add esp, 0xc
jmp 0x8e16af
mov dword [ebp - 0xdd64], 1
cmp dword [0xbc27fc], esi
je 0x8e1716
mov ecx, dword [ebp - 0xdc28]
push ecx
lea edx, [ebp - 0x19f4]
push str.______FROM_EEMPTY__________s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push esi
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8e1716
push 0x103
lea edx, [ebp - 0x50f3]
push 0
push edx
mov byte [ebp - 0x50f4], 0
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x3ac]
push eax
push ebx
push ebx
push str.RequestorPID___u__0x_x___szObjExt___s
push 0xffffffffffffffff
lea ecx, [ebp - 0x50f4]
push 0x104
push ecx
call fcn.00a78fcb
mov edx, dword [0xbc27fc]
add esp, 0x1c
push 0
push edx
lea eax, [ebp - 0x50f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc58], 0xb
cmp ebx, 4
jbe 0x8e19f7
cmp byte [ebp - 0x3ac], 0
je 0x8e19f7
mov eax, 0xac5f5c
lea ecx, [ebp - 0x3ac]
xor ebx, ebx
call fcn.0094c330
test eax, eax
je 0x8e1814
lea esi, [ebp - 0x3ac]
call fcn.00975880
test eax, eax
jne 0x8e1814
mov eax, 0xad21c4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e1814
mov eax, 0xad21c8
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e1814
mov edi, dword [ebp - 0xdc40]
test edi, edi
je 0x8e1858
cmp byte [edi], bl
je 0x8e1858
mov eax, 0xac5f5c
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e17e0
mov esi, edi
call fcn.00975880
test eax, eax
jne 0x8e17e0
mov eax, 0xad21c4
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e17e0
mov eax, 0xad21c8
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8e1858
mov al, byte [edi]
cmp al, 0x72
je 0x8e17ea
cmp al, 0x52
jne 0x8e180a
mov al, byte [edi + 1]
cmp al, 0x30
jl 0x8e180a
cmp al, 0x32
jg 0x8e180a
mov al, byte [edi + 2]
cmp al, 0x30
jl 0x8e180a
cmp al, 0x39
jg 0x8e180a
mov dword [ebp - 0xdc88], 1
mov ebx, 1
jmp 0x8e1905
mov al, byte [ebp - 0x3ac]
cmp al, 0x72
je 0x8e1822
cmp al, 0x52
jne 0x8e1848
mov cl, byte [ebp - 0x3ab]
sub cl, 0x30
cmp cl, 2
ja 0x8e1848
mov dl, byte [ebp - 0x3aa]
sub dl, 0x30
cmp dl, 9
ja 0x8e1848
mov dword [ebp - 0xdc88], 1
mov edi, dword [ebp - 0xdc40]
mov ebx, 1
jmp 0x8e1905
mov eax, 0xad0ff8
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1905
mov eax, 0xad21cc
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1905
mov eax, 0xad21d0
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1905
mov eax, 0xad21d4
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1905
test edi, edi
je 0x8e19fd
cmp byte [edi], 0
je 0x8e19fd
mov eax, 0xad0ff8
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1905
mov eax, 0xad21cc
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1905
mov eax, 0xad21d0
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1905
mov eax, 0xad21d4
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8e19fd
cmp byte [ebp - 0x5b4], 0
jne 0x8e1967
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
mov ecx, dword [ebp - 0xdc30]
push 0x208
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x5b4]
push eax
push ecx
call fcn.009bb790
add esp, 0x1c
lea edx, [ebp - 0x5b4]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e1960
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], eax
jmp 0x8e1970
inc eax
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], 0
je 0x8e1992
mov esi, dword [ebp - 0xdc34]
cmp byte [esi], 0
je 0x8e1998
mov ecx, esi
call fcn.009158e0
test eax, eax
je 0x8e1998
mov dword [ebp - 0xdcdc], 1
jmp 0x8e1998
mov esi, dword [ebp - 0xdc34]
cmp dword [0xbc27fc], 0
je 0x8e19fd
test esi, esi
je 0x8e19fd
cmp byte [esi], 0
je 0x8e19fd
mov ecx, dword [ebp - 0xdcdc]
push ecx
lea edx, [ebp - 0x3ac]
push esi
lea eax, [ebp - 0x19f4]
push edx
test ebx, ebx
je 0x8e19ca
push str.Archive___s__opened_from___s_._MailClient:__u
jmp 0x8e19cf
push str.MSO_file___s__opened_from___s_._MailClient:__u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e19fd
mov edi, dword [ebp - 0xdc40]
cmp byte [ebp - 0x3ac], 0
mov dword [ebp - 0xdc58], 0xd
je 0x8e1b85
mov eax, 0xad0ff8
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, 0xad21cc
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, 0xad21d0
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, str.ppsx
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e1add
mov eax, 0xad21d4
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1add
test edi, edi
je 0x8e1aea
cmp byte [edi], 0
je 0x8e1aea
mov eax, 0xad0ff8
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, 0xad21cc
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, 0xad21d0
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, str.ppsx
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1add
mov eax, 0xad21d4
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8e1aea
mov esi, 1
mov dword [ebp - 0xdd20], esi
jmp 0x8e1aef
mov esi, 1
cmp dword [ebp - 0xdcf4], 0
jne 0x8e1b92
mov eax, 0xad0ff4
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1b7d
mov eax, 0xad0ffc
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1b7d
mov eax, 0xad2240
lea ecx, [ebp - 0x3ac]
call fcn.0094c3e0
test eax, eax
je 0x8e1b7d
test edi, edi
je 0x8e1cf1
cmp byte [edi], 0
je 0x8e1cf1
mov eax, 0xad0ff4
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1b7d
mov eax, 0xad0ffc
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8e1b7d
mov eax, 0xad2240
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8e1cf1
mov dword [ebp - 0xdcf4], esi
jmp 0x8e1b92
cmp dword [ebp - 0xdcf4], 0
je 0x8e1cf1
mov eax, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test eax, eax
jge 0x8e1ba8
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jnp 0x8e1bc8
lea esi, [ebp - 0x7cc]
call fcn.00905840
test eax, eax
je 0x8e1cf1
cmp dword [0xbc27fc], 0
mov edi, dword [ebp - 0xdc28]
mov dword [ebp - 0xde88], 0
je 0x8e1c13
push edi
lea ecx, [ebp - 0x19f4]
push str._DOC__Checking_Suspicious_XLS_in__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [ebp - 0xdc38]
push edi
push 0
lea ecx, [ebp - 0xde88]
push ecx
lea edx, [ebp - 0xdcc0]
push edx
push eax
push edi
call fcn.00928dc0
mov esi, dword [ebp - 0xdcc0]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x8e1ca3
cmp esi, 0x3e7
je 0x8e1ca3
cmp esi, 0x3e5
je 0x8e1ca3
cmp esi, 0x230
je 0x8e1ca3
cmp esi, 0xe0
je 0x8e1ca3
cmp esi, 0x1bd
je 0x8e1ca3
cmp dword [0xbc27fc], eax
je 0x8e1cf7
lea ecx, [ebp - 0x19f4]
push str._DOC__Nothing_suspicious_in_Office_Document__XLS_...
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push ebx
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
jmp 0x8e1cad
mov dword [ebp - 0xdd28], 1
cmp dword [0xbc27fc], 0
je 0x8e1cf7
mov ecx, dword [ebp - 0xde88]
push ecx
push esi
push ebx
lea edx, [ebp - 0x19f4]
push str._DOC__Result__XLS_:_MacrosPresent:_u__ThisDoc:_u__Inf:_u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e1cf7
mov edi, dword [ebp - 0xdc28]
cmp dword [ebp - 0xdd20], 0
je 0x8e1f1a
mov edx, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test edx, edx
jge 0x8e1d1a
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jnp 0x8e1d3a
lea esi, [ebp - 0x7cc]
call fcn.00905840
test eax, eax
je 0x8e1f1a
cmp dword [0xbc27fc], 0
mov dword [ebp - 0xde2c], 0
je 0x8e1d7f
push edi
lea eax, [ebp - 0x19f4]
push str._DOC__Checking_Suspicious_DOC_in__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [ebp - 0xdc38]
push edi
push 0
lea eax, [ebp - 0xde2c]
push eax
lea ecx, [ebp - 0xdcc0]
push ecx
push edx
push edi
mov dword [0xbd85bc], 1
call fcn.00928dc0
mov esi, dword [ebp - 0xdcc0]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x8e1dde
cmp esi, 0x3e7
je 0x8e1dde
cmp esi, 0x3e5
je 0x8e1dde
cmp esi, 0x230
je 0x8e1dde
cmp esi, 0xe0
je 0x8e1dde
cmp esi, 0x1bd
jne 0x8e1de8
mov dword [ebp - 0xdd28], 1
cmp dword [0xbc27fc], 0
je 0x8e1e2b
mov eax, dword [ebp - 0xde2c]
push eax
push esi
push ebx
lea ecx, [ebp - 0x19f4]
push str._DOC__Result:_MacrosPresent:_u__ThisDoc:_u__Inf:_u
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test ebx, ebx
je 0x8e1ecf
cmp dword [ebp - 0xde2c], 0
je 0x8e1f1a
cmp dword [ebp - 0xdcdc], 0
je 0x8e1e80
cmp dword [0xbd06ac], 0
je 0x8e1e80
mov eax, dword [ebp - 0xdcc0]
cmp eax, 0x230
je 0x8e1e86
cmp eax, 0x29c
je 0x8e1e86
push eax
push edi
push str.Suspicious_Attachment:_s____BLOCKING_2b:_u__Forcing_SCRIPT_
lea ecx, [ebp - 0x19f4]
mov dword [ebp - 0xdc44], 1
push ecx
jmp 0x8e1ead
mov eax, dword [ebp - 0xdcc0]
cmp dword [ebp - 0xdc44], 0
je 0x8e1e9f
push eax
push edi
push str.Suspicious_Attachment:_s____BLOCKING_2b:_u__Forcing_SCRIPT_
lea ecx, [ebp - 0x19f4]
push ecx
jmp 0x8e1ead
push eax
push edi
push str.Suspicious_Attachment:_s__2b_1:_u__Forcing_SCRIPT_
lea edx, [ebp - 0x19f4]
push edx
call fcn.00a78f30
add esp, 0x10
push 0
push 1
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e1f1a
cmp esi, 0x3e7
je 0x8e1f1a
cmp dword [ebp - 0xdcc0], 0x3e5
je 0x8e1f1a
cmp dword [0xbc27fc], 0
je 0x8e1f1a
lea ecx, [ebp - 0x19f4]
push str._DOC__Nothing_suspicious_in_Office_Document...
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
cmp dword [ebp - 0xdc44], 0
jne 0x8e364b
cmp dword [ebp - 0xdc80], 0
jne 0x8e364b
mov esi, dword [ebp - 0xdc28]
push 0x5c
push esi
call fcn.00a7bbc7
mov edi, eax
add esp, 8
test edi, edi
jne 0x8e1f55
mov edi, esi
mov dword [ebp - 0xdd40], esi
jmp 0x8e1f5c
inc edi
mov dword [ebp - 0xdd40], edi
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e1f7a
push 0
push eax
push str.SearchEXCTMAP
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0xde58]
push ecx
mov eax, edi
mov dword [ebp - 0xde58], 0
call fcn.009bdca0
mov esi, eax
add esp, 4
mov dword [ebp - 0xdd0c], eax
cmp esi, 1
jne 0x8e204b
mov ebx, dword [ebp - 0xde58]
cmp ebx, dword [ebp - 0xdc2c]
je 0x8e2029
mov esi, edi
call fcn.009bdbe0
xor esi, esi
mov dword [ebp - 0xdd0c], esi
cmp dword [0xbc27fc], esi
je 0x8e2053
push 0x103
lea edx, [ebp - 0x46a3]
push esi
push edx
mov byte [ebp - 0x46a4], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0xdc2c]
add esp, 0xc
push eax
push ebx
push str.SearchEXCTMAP___Different_Size__Earlier:0x_x___New:_0x_x_
push 0xffffffffffffffff
lea ecx, [ebp - 0x46a4]
push 0x104
push ecx
call fcn.00a78fcb
mov edx, dword [0xbc27fc]
push esi
push edx
lea eax, [ebp - 0x46a4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8e2053
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e2251
push 0
push eax
push str.SearchEXCTMAP___Success
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test esi, esi
jne 0x8e2251
mov eax, dword [ebp - 0xdc28]
cmp byte [eax], 0x5c
jne 0x8e2068
cmp byte [eax + 1], 0x5c
je 0x8e2251
cmp dword [0xb8db50], 0
jne 0x8e2251
cmp dword [0xb8db54], 0
jne 0x8e2251
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e20a0
push 0
push eax
push str.GFAt__LOCAL_FILE____A
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0x140
lea ecx, [ebp - 0xd19c]
push 0
push ecx
mov byte [ebp - 4], 9
call fcn.00a7ffb0
mov edx, dword [ebp - 0xdc38]
mov ebx, dword [ebp - 0xdc28]
add esp, 0xc
push edx
lea eax, [ebp - 0xd19c]
push eax
call fcn.008bdef0
add esp, 8
test eax, eax
jne 0x8e214f
push 0x103
push eax
lea ecx, [ebp - 0x5723]
push ecx
mov byte [ebp - 0x5724], al
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea esi, [ebp - 0x5724]
call fcn.00960b00
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8e2145
mov edx, esi
push edx
mov eax, ebx
push eax
lea ecx, [ebp - 0x19f4]
push str.GetFileInformation_Failed_For_The_File:__s.__s.
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
call fcn.00896390
jmp 0x8df752
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e216d
push 0
push eax
push str.SearchCach_A_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, dword [ebp - 0xdc28]
lea ecx, [ebp - 0xdd18]
push ecx
lea edx, [ebp - 0xd19c]
push edx
lea ecx, [ebp - 0x3ac]
mov edx, ebx
call fcn.008bc1d0
mov edi, 1
add esp, 8
mov dword [ebp - 0xdd80], eax
mov dword [ebp - 0xde68], edi
mov dword [ebp - 0xdd78], edi
cmp eax, edi
jne 0x8e221d
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e21ca
push 0
push eax
push str.Already_Present_In_The_Cache_A_.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdcf8], 0xffffffff
jne 0x8e220d
mov eax, dword [ebp - 0xdd64]
mov esi, dword [ebp - 0xdc30]
push edi
push eax
push esi
lea edx, [ebp - 0x3ac]
mov ecx, ebx
call fcn.00896020
add esp, 0xc
mov dword [ebp - 0xdcf8], eax
cmp eax, edi
jne 0x8e220d
mov ecx, dword [ebp - 0xdc5c]
push 0
push esi
call 0x895350
add esp, 8
call fcn.00896390
mov dword [ebp - 0xdc4c], edi
jmp 0x8df752
mov dword [ebp - 4], 8
jmp 0x8e2251
xor eax, eax
mov dword [ebp - 0xdc58], 0xe
mov dword [ebp - 0xdd0c], esi
cmp esi, eax
jne 0x8e364b
cmp dword [ebp - 0xdccc], 0xffffffff
mov dword [ebp - 0xddb0], eax
mov dword [ebp - 0xdc40], eax
jne 0x8e24fe
mov ecx, dword [0xbc27fc]
cmp ecx, eax
je 0x8e22a2
push eax
push ecx
push str.IsItSpecF_a_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
lea ecx, [ebp - 0xdcc4]
push ecx
lea edx, [ebp - 0xdc90]
push edx
lea eax, [ebp - 0xdce4]
push eax
lea ecx, [ebp - 0xdd38]
push ecx
push 0
lea edx, [ebp - 0xdc70]
push edx
lea eax, [ebp - 0xdc54]
push eax
lea ecx, [ebp - 0xdc94]
push ecx
mov ecx, dword [ebp - 0xdd44]
lea edx, [ebp - 0xdc98]
push edx
mov edx, dword [ebp - 0xdd90]
lea eax, [ebp - 0xdcd4]
push eax
push ecx
push edx
mov edx, dword [ebp - 0xdcd0]
lea eax, [ebp - 0xdce0]
push eax
lea ecx, [ebp - 0xdcb0]
push ecx
push edx
lea eax, [ebp - 0xdc3c]
push eax
mov eax, dword [ebp - 0xdc38]
lea ecx, [ebp - 0xdcc8]
push ecx
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x184]
push edx
push eax
push ecx
call fcn.00911220
add esp, 0x50
mov dword [ebp - 0xdccc], eax
call fcn.00896380
cmp dword [ebp - 0xdc3c], 0
jne 0x8e241f
mov eax, 0xad24f8
lea ecx, [ebp - 0x184]
call fcn.0094c330
cmp dword [ebp - 0xdc88], 1
jne 0x8e236d
test eax, eax
jne 0x8e238d
jmp 0x8e2375
test eax, eax
jne 0x8e241f
mov eax, 0xad24f8
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e241f
call fcn.008c19b0
mov esi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp esi, eax
ja 0x8e23e8
mov eax, dword [0xbc27fc]
mov edi, 2
mov dword [ebp - 0xdc3c], edi
mov dword [ebp - 0x184], 0x524152
test eax, eax
je 0x8e23d2
push 0
push eax
push str.Forcing_ArchScan_1XX_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], 1
mov dword [ebp - 0xdc74], 0
jmp 0x8e2424
call fcn.008c19b0
push eax
shr esi, 0xa
push esi
lea edx, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_UCL_1_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov edi, 2
cmp dword [0xbc27fc], 0
je 0x8e24a1
mov eax, dword [ebp - 0xdc90]
mov ecx, dword [ebp - 0xdc70]
lea edx, [ebp - 0x184]
push edx
mov edx, dword [ebp - 0xdc54]
push eax
mov eax, dword [ebp - 0xdc94]
push ecx
mov ecx, dword [ebp - 0xdc98]
push edx
mov edx, dword [ebp - 0xdcd4]
push eax
mov eax, dword [ebp - 0xdce0]
push ecx
mov ecx, dword [ebp - 0xdc3c]
push edx
mov edx, dword [ebp - 0xdcc8]
push eax
push ecx
push edx
lea eax, [ebp - 0x19f4]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x40
cmp dword [0xbd0534], 0
jne 0x8e2503
cmp dword [ebp - 0xdc70], 0
je 0x8e2503
cmp dword [ebp - 0xdc3c], edi
jne 0x8e2503
cmp dword [0xbc27fc], 0
je 0x8e24f2
lea eax, [ebp - 0x19f4]
push str._A__Resetting_Value_of_IsItInfectibleFile_to_1_as_ScanAndroidAPK__0
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov dword [ebp - 0xdc3c], 1
jmp 0x8e2503
mov edi, 2
cmp byte [ebp - 0x184], 0
je 0x8e257e
lea eax, [ebp - 0x184]
push eax
xor ecx, ecx
mov edx, 0xbe4518
call fcn.00980160
test eax, eax
je 0x8e257e
cmp dword [0xbc27fc], 0
je 0x8e2563
lea ecx, [ebp - 0x184]
push ecx
lea edx, [ebp - 0x19f4]
push str.Blocked_File_Extension__1__:__s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, 1
lea eax, [ebp - 0xdc3c]
mov dword [ebp - 0xdc84], ebx
call fcn.008dd470
jmp 0x8e262b
cmp dword [ebp - 0xdc84], 0
jne 0x8e2626
cmp byte [ebp - 0x3ac], 0
je 0x8e25f9
lea eax, [ebp - 0x184]
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e25f9
lea edx, [ebp - 0x3ac]
push edx
xor ecx, ecx
mov edx, 0xbe4518
call fcn.00980160
test eax, eax
je 0x8e25f9
cmp dword [0xbc27fc], 0
je 0x8e2563
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x19f4]
push str.Blocked_File_Extension__2__:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
jmp 0x8e2556
mov esi, dword [ebp - 0xdc28]
mov ebx, 1
mov dword [ebp - 0xdea8], ebx
call fcn.008ed640
mov dword [ebp - 0xdc84], eax
test eax, eax
je 0x8e262b
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
jmp 0x8e262b
mov ebx, 1
cmp dword [ebp - 0xdc3c], 0
jne 0x8e2661
cmp dword [ebp - 0xdc90], 0
jne 0x8e2661
push 5
mov eax, 0xaba8a4
lea ecx, [ebp - 0x7cc]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8e2661
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
cmp dword [ebp - 0xdd28], 0
jne 0x8e272c
cmp dword [ebp - 0xdcf4], 0
je 0x8e26ee
cmp dword [ebp - 0xdc54], 0
jne 0x8e272c
cmp dword [ebp - 0xdc3c], 0
jne 0x8e3565
cmp dword [ebp - 0xdc90], 0
jne 0x8e3565
mov ebx, dword [ebp - 0xdc2c]
cmp ebx, 0x600000
jb 0x8e26b9
cmp dword [0xbd0528], 0
je 0x8e3565
mov esi, dword [ebp - 0xdc28]
cmp byte [esi], 0x5c
jne 0x8e279f
cmp byte [esi + 1], 0x5c
jne 0x8e279f
cmp dword [0xbd0528], 0
jne 0x8e279f
mov dword [ebp - 0xdd3c], 1
jmp 0x8e3565
cmp dword [ebp - 0xdc54], 0
je 0x8e2684
cmp byte [ebp - 0x3ac], 0
je 0x8e2684
mov eax, 0xad2650
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e272c
mov eax, 0xac8844
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e2684
cmp dword [0xbc27fc], 0
je 0x8e2763
lea ecx, [ebp - 0x19f4]
push str.Forcing_PopExt_to_SCRIPT_1_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov ecx, dword [str.SCRIPT]
mov dx, word [0xad2674]
mov al, byte [0xad2676]
mov dword [ebp - 0x184], ecx
mov word [ebp - 0x180], dx
mov byte [ebp - 0x17e], al
mov dword [ebp - 0xdc94], ebx
mov dword [ebp - 0xdc3c], ebx
mov dword [ebp - 0xdc98], ebx
jmp 0x8e3565
cmp dword [ebp - 0xdcc8], 0
mov dword [ebp - 0xdca4], 0
je 0x8e3565
mov eax, 0xac5f5c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e2b02
mov ecx, dword [0xbd0528]
lea edx, [ebp - 0xde18]
push edx
mov edx, dword [ebp - 0xdc38]
mov dword [ebp - 0xde18], ecx
lea eax, [ebp - 0xddc8]
push eax
lea ecx, [ebp - 0xdca4]
push ecx
push edx
lea eax, [ebp - 0xddb0]
push eax
xor ebx, ebx
push esi
lea ecx, [ebp - 0xdcc0]
lea edx, [ebp - 0xde00]
mov dword [ebp - 0xde00], ebx
mov dword [ebp - 0xddc8], ebx
call fcn.009300c0
mov dword [ebp - 0xdc40], eax
mov eax, dword [ebp - 0xde18]
add esp, 0x18
cmp eax, 0xff
je 0x8e283d
xor eax, eax
mov dword [ebp - 0xde18], eax
jmp 0x8e2843
mov dword [ebp - 0xdc44], edi
cmp dword [0xbc27fc], ebx
mov esi, dword [ebp - 0xdcc4]
mov edi, dword [ebp - 0xdc40]
mov ebx, dword [ebp - 0xddb0]
je 0x8e28aa
mov ecx, dword [ebp - 0xddc8]
mov edx, dword [ebp - 0xdcc0]
push eax
mov eax, dword [ebp - 0xdca4]
push ecx
mov ecx, dword [ebp - 0xde00]
push edx
push esi
push eax
push ecx
push ebx
push edi
lea edx, [ebp - 0x19f4]
push str.ZC_1_:__d_PwdProt:__d__PIFSCR:__u__OneExe:__u__FFExe:__u__TDoc:__u__Abn:__u__Bin:_0x_x
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x38
cmp edi, 0xffffffff
jne 0x8e29c8
test esi, esi
je 0x8e29c8
mov edi, 1
mov dword [ebp - 0xdc40], edi
mov dword [ebp - 0xdca4], edi
mov dword [ebp - 0xddb0], 0
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
cmp edi, 1
jne 0x8e28ec
mov dword [ebp - 0xdc60], edi
cmp dword [ebp - 0xde00], 0
je 0x8e3565
cmp dword [0xbc27fc], 0
je 0x8e2948
mov ecx, dword [ebp - 0xdc2c]
mov edx, dword [0xb3ddc8]
mov eax, dword [ebp - 0xdcdc]
push ecx
push edx
push eax
lea ecx, [ebp - 0x19f4]
push str.EMC_1____u_BlockSus___u__dwObjSize___u
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdcdc], 0
je 0x8e3565
cmp dword [0xb3ddc8], 0
je 0x8e3565
mov ecx, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test ecx, ecx
jge 0x8e2978
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x8e3565
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x19f4]
push str.Suspicious_Attachment:_s____BLOCKING_2_
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0xdc44], 1
jmp 0x8e3562
cmp byte [ebp - 0x3ac], 0
je 0x8e2a16
lea edx, [ebp - 0x3ac]
push 0xad26d0
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8e2a16
cmp edi, 0xffffffff
je 0x8e2a16
lea eax, [edi - 2]
cmp eax, 3
ja 0x8e2a16
test ebx, ebx
jne 0x8e2a16
mov edi, 1
mov dword [ebp - 0xdc60], edi
mov dword [ebp - 0xdc40], edi
mov dword [ebp - 0xdca4], edi
jmp 0x8e28d6
mov ecx, dword [ebp - 0xdca4]
test ecx, ecx
jne 0x8e2a4f
cmp edi, 1
jne 0x8e2a40
test ebx, ebx
je 0x8e2a40
test esi, esi
je 0x8e2a40
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov dword [ebp - 0xdc60], edi
jmp 0x8e2a59
mov dword [ebp - 0xdc40], 0
jmp 0x8e3565
cmp edi, 1
je 0x8e2a59
cmp edi, 0xffffffff
jne 0x8e2a7a
test ebx, ebx
je 0x8e2a66
cmp byte [0xbd0540], 0
je 0x8e2a7a
test ecx, ecx
jne 0x8e28d6
cmp dword [ebp - 0xddc8], ecx
jne 0x8e28d6
cmp edi, 1
je 0x8e2a88
cmp edi, 0xffffffff
jne 0x8e3565
test ebx, ebx
je 0x8e2a99
cmp byte [0xbd0540], 0
je 0x8e3565
lea esi, [ebp - 0x7cc]
call fcn.00905840
test eax, eax
je 0x8e3565
cmp dword [0xbc27fc], 0
je 0x8e2ae3
lea ecx, [ebp - 0x19f4]
push str.ZC_1A____Reserved_Name_in_ZIP___Setting_infected
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
cmp edi, 1
jne 0x8e3565
mov dword [ebp - 0xdc60], edi
jmp 0x8e3565
mov eax, 0xad00ac
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e2b2e
mov eax, 0xad275c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e2c59
push 0x103
lea edx, [ebp - 0x48b3]
push 0
push edx
mov byte [ebp - 0x48b4], 0
call fcn.00a7ffb0
mov eax, dword [0xbd0528]
mov dword [ebp - 0xddd0], eax
add esp, 0xc
mov eax, 0xad00ac
lea ecx, [ebp - 0x184]
mov dword [ebp - 0xdeb0], 0
call fcn.0094c330
mov esi, eax
mov eax, dword [ebp - 0xdc38]
neg esi
lea ecx, [ebp - 0xddd0]
push ecx
mov ecx, dword [ebp - 0xdc5c]
sbb esi, esi
lea edx, [ebp - 0xdeb0]
push edx
neg esi
push esi
push eax
push ecx
lea ecx, [ebp - 0xdca4]
lea edx, [ebp - 0x48b4]
call fcn.00923c30
mov ebx, eax
mov eax, dword [ebp - 0xddd0]
add esp, 0x14
cmp eax, 0xff
je 0x8e2bc2
xor eax, eax
mov dword [ebp - 0xddd0], eax
jmp 0x8e2bc8
mov dword [ebp - 0xdc44], edi
cmp dword [0xbc27fc], 0
je 0x8e2c0f
lea edx, [ebp - 0x48b4]
push edx
push eax
mov eax, dword [ebp - 0xdca4]
push eax
push ebx
lea ecx, [ebp - 0x19f4]
push str.ISP_ARCH_A_:_rv_u__OneExe_u__Bin:0x_x__ErMsg:__s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
test ebx, ebx
je 0x8e3565
cmp dword [ebp - 0xdeb0], 0
jne 0x8e3500
cmp dword [ebp - 0xdca4], 0
jne 0x8e3500
cmp dword [0xbd4a7c], 0
je 0x8e3565
cmp byte [ebp - 0x3ac], 0
jne 0x8e3565
cmp esi, 1
jne 0x8e3565
jmp 0x8e3500
mov eax, 0xad2794
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e2c7d
mov ecx, dword [ebp - 0xdc38]
call fcn.009250d0
jmp 0x8e34fc
mov eax, 0xad2798
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e2c98
mov eax, esi
jmp 0x8e34f7
mov eax, 0xad279c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e2e46
cmp dword [0xbc27fc], eax
je 0x8e2ced
mov ecx, dword [ebp - 0xdc9c]
push ebx
push ecx
lea edx, [ebp - 0x19f4]
push str.ISP_ARCH_A1_:_FBS_u__dwObjSize_u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc9c], 0
jne 0x8e2e26
push 0x103
xor ebx, ebx
lea edx, [ebp - 0x373b]
push ebx
push edx
mov byte [ebp - 0x373c], 0
call fcn.00a7ffb0
mov eax, dword [0xbd0528]
add esp, 0xc
mov dword [ebp - 0xde28], ebx
mov dword [ebp - 0xddbc], eax
xor esi, esi
mov dword [ebp - 0xde60], ebx
call fcn.00968110
cmp eax, ebx
je 0x8e2d4b
lea ecx, [ebp - 0xde60]
push ecx
call fcn.009681c0
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x373c]
push edx
lea eax, [ebp - 0xdca4]
push eax
push ecx
lea edx, [ebp - 0xddbc]
lea ecx, [ebp - 0xde28]
call fcn.00925a30
add esp, 0xc
cmp eax, ebx
je 0x8e2d88
cmp dword [ebp - 0xdca4], ebx
je 0x8e2d88
cmp dword [ebp - 0xde28], ebx
je 0x8e2da0
cmp byte [ebp - 0x373c], bl
je 0x8e2df0
cmp dword [ebp - 0xde28], ebx
jne 0x8e2dbe
cmp dword [ebp - 0xdcc4], ebx
je 0x8e2dbe
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
jmp 0x8e2df0
lea edx, [ebp - 0x373c]
push edx
lea eax, [ebp - 0x19f4]
push str._ACE__ErMsg1:_s
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xddbc], 0xff
je 0x8e2e04
mov dword [ebp - 0xddbc], ebx
jmp 0x8e2e0a
mov dword [ebp - 0xdc44], edi
cmp esi, ebx
je 0x8e3565
mov edx, dword [ebp - 0xde60]
push edx
call fcn.00968240
add esp, 4
jmp 0x8e3565
cmp ebx, 0x190
jae 0x8e2f91
mov ecx, dword [ebp - 0xdc38]
push ebx
call fcn.00924fc0
add esp, 4
jmp 0x8e34fc
lea esi, [ebp - 0x184]
call fcn.00975880
test eax, eax
je 0x8e301e
push 0x103
xor esi, esi
lea eax, [ebp - 0x2ceb]
push esi
push eax
mov byte [ebp - 0x2cec], 0
call fcn.00a7ffb0
mov dl, byte [ebp - 0x183]
mov ecx, dword [0xbd0528]
sub dl, 0x30
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0xde90], esi
mov dword [ebp - 0xdd48], ecx
cmp dl, 2
ja 0x8e2e9c
lea ebx, [esi + 1]
cmp dword [ebp - 0xdc9c], esi
je 0x8e2faa
mov edx, dword [ebp - 0xdc38]
lea eax, [ebp - 0xdd48]
push eax
mov eax, dword [ebp - 0xdc5c]
lea ecx, [ebp - 0xde90]
push ecx
push edi
push edx
push eax
lea ecx, [ebp - 0xdca4]
lea edx, [ebp - 0x2cec]
call fcn.00923c30
mov esi, eax
mov eax, dword [ebp - 0xdd48]
add esp, 0x14
cmp eax, 0xff
je 0x8e2ef2
xor eax, eax
mov dword [ebp - 0xdd48], eax
jmp 0x8e2ef8
mov dword [ebp - 0xdc44], edi
cmp dword [0xbc27fc], 0
je 0x8e2f3f
mov edx, dword [ebp - 0xdca4]
lea ecx, [ebp - 0x2cec]
push ecx
push eax
push edx
push esi
lea eax, [ebp - 0x19f4]
push str.ISP_ARCH_B_:_rv_u__OneExe_u__Bin:0x_x__ErMsg:__s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
test esi, esi
je 0x8e2f65
cmp dword [ebp - 0xde90], 0
jne 0x8e3500
cmp dword [ebp - 0xdca4], 0
jne 0x8e3500
test ebx, ebx
jne 0x8e3500
cmp byte [ebp - 0x2cec], 0
je 0x8e3565
push 0
lea eax, [ebp - 0x2cec]
push str.7z_Error
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8e3565
mov dword [ebp - 0xdd3c], 1
mov dword [ebp - 0xdc40], 0xffffffff
jmp 0x8e3565
push esi
lea ecx, [ebp - 0xdd48]
push ecx
mov ecx, dword [ebp - 0xdc5c]
push esi
push esi
push esi
push esi
lea edx, [ebp - 0xdca4]
push edx
lea eax, [ebp - 0x2cec]
push eax
push ecx
push esi
call fcn.00919ec0
add esp, 0x28
cmp eax, esi
je 0x8e2ffc
cmp dword [ebp - 0xdca4], esi
je 0x8e2ffc
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
cmp dword [ebp - 0xdd48], 0xff
je 0x8e3013
mov dword [ebp - 0xdd48], esi
jmp 0x8e3565
mov dword [ebp - 0xdc44], edi
jmp 0x8e3565
mov eax, 0xad21c4
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e3268
mov ecx, dword [ebp - 0xdc38]
mov eax, ecx
xor ebx, ebx
call fcn.00964530
mov edi, eax
test edi, edi
je 0x8e3058
push 1
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
mov edx, dword [ebp - 0xdc38]
mov ecx, dword [ebp - 0xdc28]
call fcn.00923f90
cmp dword [0xbc27fc], 0
mov esi, eax
je 0x8e30a5
push esi
lea edx, [ebp - 0x19f4]
push str.CAB_A____d
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp esi, 1
jne 0x8e3249
push 0x207
lea edx, [ebp - 0x5e53]
push 0
push edx
mov byte [ebp - 0x5e54], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0xdc38]
mov ecx, dword [ebp - 0xdc28]
add esp, 0xc
push eax
lea edx, [ebp - 0x5e54]
call fcn.00924230
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8e3126
lea ecx, [ebp - 0x5e54]
push ecx
lea edx, [ebp - 0x19f4]
push str.EMC_2__FirstFileInCab:__s_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x5e54], 0
je 0x8e3249
push 0
lea edx, [ebp - 0x5e54]
push 0xad283c
push edx
call fcn.0095c8c0
mov esi, dword [ebp - 0xdc2c]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e316c
lea eax, [ebp - 0x5e54]
push esi
push eax
call fcn.00919660
add esp, 8
test eax, eax
je 0x8e3249
mov ecx, 1
lea eax, [ebp - 0xdc3c]
mov dword [ebp - 0xdca4], ecx
call fcn.008dd470
cmp dword [0xbc27fc], 0
mov dword [ebp - 0xdc40], ecx
mov dword [ebp - 0xdc60], ecx
je 0x8e31d7
mov ecx, dword [0xb3ddc8]
mov edx, dword [ebp - 0xdcdc]
push esi
push ecx
push edx
lea eax, [ebp - 0x19f4]
push str.EMC_2____u_BlockSus___u__dwObjSize___u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdcdc], 0
je 0x8e3249
cmp dword [0xb3ddc8], 0
je 0x8e3249
mov dword [ebp - 0xdc88], esi
fild dword [ebp - 0xdc88]
test esi, esi
jge 0x8e31ff
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x8e3249
mov eax, dword [ebp - 0xdc28]
push eax
lea ecx, [ebp - 0x19f4]
push str.Suspicious_Attachment:_s____BLOCKING_2a_
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc44], 1
test edi, edi
je 0x8e3565
mov eax, dword [ebp - 0xdc38]
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x8e3565
mov dword [ebp - 0xdd8c], 0
cmp ebx, 0x600000
jb 0x8e32c4
cmp dword [0xbd0528], 0
jne 0x8e32c4
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e34a3
mov ecx, ebx
mov dword [ebp - 0xdc88], ecx
fild dword [ebp - 0xdc88]
test ecx, ecx
jge 0x8e32b3
fadd qword [0xb0baa8]
fcomp qword [0xb0bb80]
fnstsw ax
test ah, 5
jp 0x8e34a3
mov eax, 0xad28a0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e332c
mov eax, 0xad28a4
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e332c
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e332c
mov eax, 0xad28a8
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e332c
mov eax, 0xad28ac
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e33ea
push 0
lea edx, [ebp - 0x7cc]
push str.xlsx.
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e33c6
push 0
lea eax, [ebp - 0x7cc]
push str.docx.
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e33c6
push 0
lea ecx, [ebp - 0x7cc]
push str..daa
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e33c6
push 0
lea edx, [ebp - 0x7cc]
push str.pdf.
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e33c6
push 0
lea eax, [ebp - 0x7cc]
push str.exe.
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e33c6
lea esi, [ebp - 0x7cc]
call fcn.00905840
test eax, eax
je 0x8e33ea
mov eax, dword [0xbc27fc]
mov dword [ebp - 0xdd8c], 1
test eax, eax
je 0x8e3472
push 0
push eax
push str.ForceScanArj_set__A_
jmp 0x8e3465
mov eax, 0xaaabac
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e3423
cmp ebx, 0x40000
jae 0x8e3423
mov eax, dword [0xbc27fc]
mov dword [ebp - 0xdd8c], 1
test eax, eax
je 0x8e3472
push 0
push eax
push str.ForceScanArj_set__A1_
jmp 0x8e3465
mov eax, 0xad28a0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e3472
mov ecx, dword [ebp - 0xdc38]
push ebx
call fcn.00924ec0
add esp, 4
test eax, eax
je 0x8e3472
mov eax, dword [0xbc27fc]
mov dword [ebp - 0xdd8c], 1
test eax, eax
je 0x8e3472
push 0
push eax
push str.ForceScanArj_set__B_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e34a3
mov esi, dword [ebp - 0xdc38]
lea ecx, [ebp - 0xdd8c]
push 0x43
push ecx
lea ecx, [ebp - 0xddc4]
call fcn.008dd2a0
add esp, 8
cmp ebx, 0x190
jae 0x8e34bc
mov ecx, dword [ebp - 0xdc38]
push ebx
call fcn.00924fc0
add esp, 4
jmp 0x8e34fc
mov eax, 0xad2794
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e34dd
mov ecx, dword [ebp - 0xdc38]
call fcn.009250d0
jmp 0x8e34fc
mov eax, 0xad2798
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e351e
mov eax, dword [ebp - 0xdc28]
call fcn.008dcf30
test eax, eax
je 0x8e3565
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
jmp 0x8e3565
cmp dword [ebp - 0xdd8c], 0
je 0x8e3565
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e360f
push 0
push eax
push str.ForceScanArj_set__FINAL_A_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8e360f
cmp byte [ebp - 0x184], 0
mov eax, dword [ebp - 0xdc3c]
je 0x8e35c0
test eax, eax
je 0x8e35a3
push eax
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x19f4]
push str.FileRes:__s__Infectible__u_
push eax
call fcn.00a78f30
add esp, 0x10
jmp 0x8e35ef
lea ecx, [ebp - 0x184]
push ecx
lea edx, [ebp - 0x19f4]
push str.FileRes:__s__Non_Infectible_
push edx
call fcn.00a78f30
add esp, 0xc
jmp 0x8e35ef
test eax, eax
je 0x8e35db
push eax
lea eax, [ebp - 0x19f4]
push str.FileRes:__Infectible__u_
push eax
call fcn.00a78f30
add esp, 0xc
jmp 0x8e35ef
lea ecx, [ebp - 0x19f4]
push str.FileRes:__Non_Infectible_
push ecx
call fcn.00a78f30
add esp, 8
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e360f
push 0
push eax
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdc3c], 0
jne 0x8e3641
cmp dword [ebp - 0xdc44], 0
jne 0x8e3641
cmp dword [ebp - 0xdc40], 0xffffffff
je 0x8e364b
mov eax, dword [ebp - 0xdc2c]
mov ecx, dword [ebp - 0xdd40]
push eax
call fcn.009bda60
add esp, 4
jmp 0x8e364b
mov dword [ebp - 0xdc80], 1
cmp dword [ebp - 0xdc80], 0
mov dword [ebp - 0xdc58], 0xf
jne 0x8e36a0
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e368c
cmp dword [ebp - 0xdd0c], 0
push 0
push eax
je 0x8e367a
push str.Exct_Cache_List:_Present_In_List._So_Skip_The_File
jmp 0x8e367f
push str.Include_List:_Not_Present_In_Include_Extentions._So_Skip_The_File
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
mov dword [ebp - 0xdc4c], 1
jmp 0x8df752
cmp dword [ebp - 0xdc44], 0
jne 0x8e378a
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e36cb
push 0
push eax
push str.SearchECL
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0
xor esi, esi
lea ecx, [ebp - 0x7cc]
call fcn.008bbb80
add esp, 4
cmp eax, 1
jne 0x8e378a
cmp dword [0xbc27fc], esi
je 0x8e368c
lea ecx, [ebp - 0x7cc]
push ecx
lea edx, [ebp - 0x19f4]
push str.Strong_Exclude_List:___s__File_Present_In_Strong_Exclude_Extentions._So_Skip_The_File
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push esi
push eax
lea ecx, [ebp - 0x19f4]
push ecx
jmp 0x8e367f
call fcn.00896390
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xdc28]
cmp byte [eax], 0x5c
mov ebx, 1
jne 0x8e3c2a
cmp byte [eax + 1], 0x5c
jne 0x8e3c2a
mov dword [ebp - 4], 0xc
mov esi, dword [0xbc27fc]
xor edi, edi
mov dword [ebp - 0xdc88], edi
cmp esi, edi
je 0x8e37e7
push edi
push esi
push str.GFAt__NETWORK_FILE_
push 0xb54ce8
call fcn.008808e0
mov esi, dword [0xbc27fc]
add esp, 0x10
cmp dword [0xb8daf8], ebx
jne 0x8e39fa
push 0x103
lea eax, [ebp - 0x3423]
push edi
push eax
mov byte [ebp - 0x3424], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x5303]
push edi
push ecx
mov byte [ebp - 0x5304], 0
call fcn.00a7ffb0
add esp, 0xc
mov dword [0xb8daf8], edi
cmp esi, edi
je 0x8e3849
push edi
push esi
push str.Impersonating_Client__a_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push edi
push edi
push edi
lea edx, [ebp - 0x5304]
lea ecx, [ebp - 0x3424]
call fcn.009873e0
add esp, 0xc
cmp eax, edi
jne 0x8e39bb
call fcn.00896380
mov esi, dword [0xb8e214]
cmp esi, edi
je 0x8e3890
cmp byte [esi], 0
je 0x8e3890
lea edx, [ebp - 0x3424]
push edx
call fcn.0098d400
test eax, eax
jne 0x8e39ae
push 0x207
lea eax, [ebp - 0x6a93]
push 0
push eax
mov byte [ebp - 0x6a94], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x2be3]
push 0
push ecx
mov byte [ebp - 0x2be4], 0
call fcn.00a7ffb0
add esp, 0xc
push ebx
push 0x2c
lea edx, [ebp - 0x3424]
push edx
mov edi, 0xb8e214
mov dword [ebp - 0xdec4], 0x208
call fcn.0098d640
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e3906
push 0
push eax
push str.Getting_Legacy_Name
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea eax, [ebp - 0xdec4]
push eax
lea esi, [ebp - 0x6a94]
call fcn.0098a0a0
cmp eax, ebx
jne 0x8e39ae
lea ecx, [ebp - 0x2be4]
call fcn.00983630
cmp dword [0xbc27fc], 0
je 0x8e396c
lea ecx, [ebp - 0x2be4]
push ecx
mov edx, esi
push edx
lea eax, [ebp - 0x19f4]
push str.Legacy_Name:__s._Mac_Name:__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
lea ecx, [ebp - 0x2be4]
call fcn.00960910
lea eax, [ebp - 0x2be4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8e3980
sub eax, edx
push eax
lea eax, [ebp - 0x2be4]
push eax
lea ecx, [ebp - 0x6a94]
push ecx
call fcn.00a7be09
add esp, 0xc
test eax, eax
je 0x8e39ae
mov dword [0xb37c74], 0
call fcn.00896390
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x8e39fa
cmp dword [0xbc27fc], edi
je 0x8e39fa
lea edx, [ebp - 0x5304]
push edx
lea eax, [ebp - 0x19f4]
push str.Impersonation__8__Failed._Reason:__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push edi
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb37c74]
cmp eax, 0xffffffff
je 0x8e3a53
cmp eax, 5
jge 0x8e3a53
add eax, ebx
cmp dword [0xbc27fc], 0
mov dword [0xb37c74], eax
je 0x8df752
push 5
push eax
push str.Skip_File__CSCFS____d__d_
lea eax, [ebp - 0x19f4]
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8df752
mov esi, dword [ebp - 0xdc38]
test esi, esi
jne 0x8e3ac4
push 0x207
lea eax, [ebp - 0x78d3]
push esi
push eax
mov byte [ebp - 0x78d4], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
push esi
push esi
lea edx, [ebp - 0x78d4]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
je 0x8e3abe
lea ecx, [ebp - 0x78d4]
push ecx
lea edx, [ebp - 0x19f4]
push str.Impersonation_Failed._Reason:__s
push edx
call fcn.00a78f30
add esp, 0xc
push esi
push ebx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
jmp 0x8df74a
mov dword [ebp - 0xdc88], ebx
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e3ae2
push 0
push eax
push str.GFAxx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0x140
lea ecx, [ebp - 0xd19c]
push 0
push ecx
call fcn.00a7ffb0
mov ebx, dword [ebp - 0xdc28]
add esp, 0xc
lea edx, [ebp - 0xd19c]
push esi
push edx
call fcn.008bdef0
add esp, 8
test eax, eax
jne 0x8e3b99
push 0x103
push eax
mov byte [ebp - 0x4ac4], al
lea eax, [ebp - 0x4ac3]
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea esi, [ebp - 0x4ac4]
call fcn.00960b00
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8e3b81
mov ecx, esi
push ecx
mov edx, ebx
push edx
lea eax, [ebp - 0x19f4]
push str.GetFileInformation_Failed_For_The_File:__s.__s.
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc88], 0
je 0x8df752
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x8df752
cmp dword [ebp - 0xdc88], 0
je 0x8e3ba8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov dword [ebp - 4], 0xffffffff
mov ebx, 1
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e3bd2
push 0
push eax
push str.Pre_Point1
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xdc88], 0
cmp dword [0xb38014], ebx
jne 0x8e3d02
cmp dword [ebp + 0x20], 0x40
jne 0x8e3d11
cmp dword [ebp - 0xdc30], 4
jmp 0x8e3d09
cmp dword [ebp - 0xde68], 0
jne 0x8e3bb4
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e3c51
push 0
push eax
push str.GFAt__LOCAL_FILE_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0x140
lea eax, [ebp - 0xd19c]
push 0
push eax
mov dword [ebp - 4], 0xe
call fcn.00a7ffb0
mov ecx, dword [ebp - 0xdc38]
mov ebx, dword [ebp - 0xdc28]
add esp, 0xc
push ecx
lea edx, [ebp - 0xd19c]
push edx
call fcn.008bdef0
add esp, 8
test eax, eax
jne 0x8e3ba8
push 0x103
push eax
mov byte [ebp - 0x5b44], al
lea eax, [ebp - 0x5b43]
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea esi, [ebp - 0x5b44]
call fcn.00960b00
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8df752
mov ecx, esi
push ecx
mov edx, ebx
push edx
push str.GetFileInformation_Failed_For_The_File:__s.__s.
jmp 0x8e3a25
cmp dword [ebp - 0xdc30], 8
jne 0x8e3d11
mov dword [ebp - 0xdd9c], ebx
cmp byte [ebp - 0x3ac], 0
je 0x8e3d43
mov eax, 0xaaab9c
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e3d43
lea eax, [ebp - 0x3ac]
push eax
call fcn.00904ac0
add esp, 4
mov dword [ebp - 0xdd10], eax
mov edi, dword [ebp - 0xdd10]
test edi, edi
jne 0x8e3fe7
cmp dword [0xb8db50], edi
jne 0x8e3d65
cmp dword [0xb8db54], edi
je 0x8e3fbd
cmp dword [ebp - 0xdccc], 0xffffffff
jne 0x8e3fbd
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e3d90
push 0
push eax
push str.IsItSpecF_b_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0xdcc4]
push ecx
lea edx, [ebp - 0xdc90]
push edx
lea eax, [ebp - 0xdce4]
push eax
lea ecx, [ebp - 0xdd38]
push ecx
push 0
lea edx, [ebp - 0xdc70]
push edx
lea eax, [ebp - 0xdc54]
push eax
lea ecx, [ebp - 0xdc94]
push ecx
mov ecx, dword [ebp - 0xdd44]
lea edx, [ebp - 0xdc98]
push edx
mov edx, dword [ebp - 0xdd90]
lea eax, [ebp - 0xdcd4]
push eax
push ecx
push edx
mov edx, dword [ebp - 0xdcd0]
lea eax, [ebp - 0xdce0]
push eax
lea ecx, [ebp - 0xdcb0]
push ecx
push edx
lea eax, [ebp - 0xdc3c]
push eax
mov eax, dword [ebp - 0xdc38]
lea ecx, [ebp - 0xdcc8]
push ecx
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x184]
push edx
push eax
push ecx
call fcn.00911220
mov esi, dword [ebp - 0xdc54]
add esp, 0x50
cmp dword [0xbc27fc], 0
mov dword [ebp - 0xdccc], eax
je 0x8e3ea1
mov eax, dword [ebp - 0xdc90]
mov ecx, dword [ebp - 0xdc70]
lea edx, [ebp - 0x184]
push edx
mov edx, dword [ebp - 0xdc94]
push eax
mov eax, dword [ebp - 0xdc98]
push ecx
mov ecx, dword [ebp - 0xdcd4]
push esi
push edx
mov edx, dword [ebp - 0xdce0]
push eax
mov eax, dword [ebp - 0xdc3c]
push ecx
mov ecx, dword [ebp - 0xdcc8]
push edx
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x40
cmp dword [0xbd0534], 0
jne 0x8e3ef8
cmp dword [ebp - 0xdc70], 0
je 0x8e3ef8
cmp dword [ebp - 0xdc3c], 2
jne 0x8e3ef8
cmp dword [0xbc27fc], 0
je 0x8e3ef2
lea edx, [ebp - 0x19f4]
push str._B__Resetting_Value_of_IsItInfectibleFile_to_1_as_ScanAndroidAPK__0
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov dword [ebp - 0xdc3c], ebx
cmp dword [ebp - 0xdd28], 0
jne 0x8e3f50
cmp dword [ebp - 0xdcf4], 0
je 0x8e3f13
test esi, esi
jne 0x8e3f50
jmp 0x8e3fe7
test esi, esi
je 0x8e3fbd
cmp byte [ebp - 0x3ac], 0
je 0x8e3fbd
mov eax, 0xad2650
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e3f50
mov eax, 0xac8844
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e3fbd
cmp dword [0xbc27fc], 0
je 0x8e3f86
lea edx, [ebp - 0x19f4]
push str.Forcing_PopExt_to_SCRIPT_2_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov edx, dword [str.SCRIPT]
mov ax, word [0xad2674]
mov cl, byte [0xad2676]
mov dword [ebp - 0x184], edx
mov word [ebp - 0x180], ax
mov byte [ebp - 0x17e], cl
mov dword [ebp - 0xdc94], ebx
mov dword [ebp - 0xdc3c], ebx
mov dword [ebp - 0xdc98], ebx
cmp dword [ebp - 0xdc54], ebx
jne 0x8e3fe7
mov eax, 0xaaab9c
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e3fe7
cmp dword [0xb8db50], eax
je 0x8e3fe7
mov dword [ebp - 0xdc54], eax
cmp dword [ebp - 0xdc44], 0
jne 0x8e4310
cmp dword [ebp - 0xdc84], 0
jne 0x8e4310
cmp dword [ebp - 0xdea8], 0
jne 0x8e4023
mov esi, dword [ebp - 0xdc28]
call fcn.008ed640
mov dword [ebp - 0xdc84], eax
test eax, eax
jne 0x8e4310
cmp dword [0xb8db50], 0
je 0x8e4310
test edi, edi
jne 0x8e4040
cmp dword [ebp - 0xdc54], edi
je 0x8e4310
cmp dword [ebp - 0xdd9c], 0
je 0x8e4310
cmp dword [ebp - 0xdc90], 0
jne 0x8e4310
xor esi, esi
cmp byte [0xbf4680], 0
jne 0x8e40c6
mov ecx, 0xb56938
mov edx, 0xbf4680
nop
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x8e4070
mov ecx, 0xbf4680
call fcn.00960910
push str.spool_
push 0xbf4680
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00968110
test eax, eax
je 0x8e40c6
push 0xbf4680
push 0xbf4788
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._syswow64_
push str._system32_
push 0xbf4788
call fcn.0095e130
add esp, 0xc
mov ecx, 0xbf4680
call fcn.0094c3d0
mov ecx, dword [ebp - 0xdc28]
push eax
mov eax, 0xbf4680
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e4310
cmp byte [0xbf4788], 0
je 0x8e411b
mov ecx, 0xbf4788
call fcn.0094c3d0
mov ecx, dword [ebp - 0xdc28]
push eax
mov eax, 0xbf4788
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e4310
test esi, esi
jne 0x8e4310
push 0x207
lea edx, [ebp - 0x3a4b]
push esi
push edx
mov byte [ebp - 0x3a4c], 0
call fcn.00a7ffb0
mov eax, dword [0xbd0b34]
add esp, 0xc
test eax, eax
je 0x8e41fc
cmp byte [eax], 0
je 0x8e41fc
lea ecx, [ebp - 0xde08]
push ecx
mov dword [ebp - 0xde08], esi
push eax
mov bl, 0x2c
lea edi, [ebp - 0x3a4c]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0xde08], 0xffffffff
je 0x8e41f4
cmp byte [ebp - 0x3a4c], 0x21
je 0x8e419f
mov ecx, edi
call fcn.0094c3d0
mov ecx, dword [ebp - 0xdc28]
push eax
mov eax, edi
call fcn.0094c380
add esp, 4
jmp 0x8e41d9
lea ecx, [ebp - 0x3a4b]
call fcn.0094c3d0
mov ecx, dword [ebp - 0xdc28]
mov edi, eax
push edi
lea eax, [ebp - 0x3a4b]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8e41e1
mov edx, dword [ebp - 0xdc28]
lea eax, [edi + edx]
push 0x5c
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8e42cb
mov ecx, dword [0xbd0b34]
lea eax, [ebp - 0xde08]
push eax
push ecx
jmp 0x8e4163
test esi, esi
jne 0x8e42cb
cmp dword [0xb3dda4], 0
je 0x8e4288
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e4227
push 0
push eax
push str.Getting_Connected_Users...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0089e990
cmp dword [0xb3dda4], 0
je 0x8e4288
cmp dword [0xbd0680], 0
ja 0x8e4288
cmp dword [0xbc27fc], 0
je 0x8e4310
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x19f4]
push str.FILE:___s__ALLOWED_FROM_Network_Drive_ACCESS_as_Zero_Connected_Users.
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e4310
mov eax, dword [0xbd0680]
mov ecx, dword [ebp - 0xdc28]
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.FILE:___s__BLOCKED_FROM_Network_Drive_ACCESS__Users:_u_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0xdca0], 1
jmp 0x8e430d
cmp dword [0xbc27fc], 0
je 0x8e4310
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x3a4c]
push eax
lea ecx, [ebp - 0x19f4]
push str.FOLDER:___s__Excluded._So_allowing_access_of___s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
call fcn.00896380
cmp dword [ebp - 0xdc44], 0
jne 0x8e4525
cmp dword [ebp - 0xdc84], 0
jne 0x8e4525
cmp dword [ebp - 0xdca0], 0
jne 0x8e4525
cmp dword [0xb8db54], 0
je 0x8e4525
cmp dword [ebp - 0xdd10], 0
jne 0x8e435f
cmp dword [ebp - 0xdc54], 0
je 0x8e4525
mov ecx, dword [ebp - 0xdc28]
cmp byte [ecx + 1], 0x3a
jne 0x8e4525
xor eax, eax
mov edx, ecx
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov byte [ebp - 0x43], al
movsx eax, byte [edx]
push eax
lea ecx, [ebp - 0x4c]
push str._c:_
push ecx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x4c]
call fcn.00966890
cmp eax, 2
jne 0x8e4525
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x331c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.TMP3344.TMP
lea ecx, [ebp - 0x331c]
push ecx
mov byte [ebp - 0x3319], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x331c]
push 0xaa1578
push edx
call fcn.00a7932f
add esp, 8
test eax, eax
je 0x8e4525
push eax
call fcn.00a79e9e
add esp, 4
lea eax, [ebp - 0x331c]
call fcn.0094dd20
mov edi, dword [0xbd0b38]
mov esi, 1
test edi, edi
je 0x8e44de
cmp byte [edi], 0
je 0x8e44de
push 0x207
lea eax, [ebp - 0x6263]
push 0
push eax
mov byte [ebp - 0x6264], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0xdde0]
push ecx
mov dword [ebp - 0xdde0], 0
push edi
mov bl, 0x2c
lea edi, [ebp - 0x6264]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0xdde0], 0xffffffff
je 0x8e44da
mov eax, dword [ebp - 0xdc28]
push 0
mov edx, edi
push edx
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8e44c7
cmp dword [0xbc27fc], 0
je 0x8e4525
mov edx, dword [ebp - 0xdc28]
mov ecx, edi
push ecx
push edx
lea eax, [ebp - 0x19f4]
push str.FILE:__s_NOT_BLOCKED_FROM_USB_Drive_as_its_part_of_Exclusion___s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8e4525
mov ecx, dword [0xbd0b38]
lea eax, [ebp - 0xdde0]
push eax
push ecx
jmp 0x8e444e
test esi, esi
je 0x8e4525
cmp dword [0xbc27fc], 0
je 0x8e451f
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x19f4]
push str.FILE:__s_BLOCKED_FROM_USB_Drive
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdcac], esi
cmp dword [ebp - 0xdc9c], 0
je 0x8e47cd
cmp dword [ebp - 0xdc44], 0
jne 0x8e47cd
cmp dword [0xb56804], 0
jne 0x8e47cd
cmp dword [0xbd08cc], 0
je 0x8e47cd
mov ecx, dword [ebp - 0xdc28]
movsx eax, byte [0xbd5ab0]
movsx edx, byte [ecx]
sub eax, 0x20
sub edx, 0x20
cmp eax, edx
jne 0x8e47cd
push 0x103
lea eax, [ebp - 0x667b]
push 0
push eax
mov byte [ebp - 0x667c], 0
call fcn.00a7ffb0
mov esi, dword [ebp - 0xdc28]
add esp, 0xc
push 0
push str.startup
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e45c8
push 0
push str.tasks
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8e47cd
mov edx, dword [ebp - 0xdc30]
lea ecx, [ebp - 0x667c]
push ecx
push edx
call fcn.009b7aa0
add esp, 8
cmp eax, 2
je 0x8e4796
mov ecx, dword [0xbd08cc]
lea eax, [ebp - 0xde20]
xor esi, esi
push eax
mov dword [ebp - 0xde20], esi
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x6c9c]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0xde20], 0xffffffff
je 0x8e4687
mov ecx, edi
call fcn.0094c3d0
mov ecx, dword [ebp - 0xdc28]
push eax
mov eax, edi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8e4674
cmp dword [0xbc27fc], esi
je 0x8e468f
mov edx, dword [0xb3ddcc]
push edx
mov eax, edi
push eax
lea ecx, [ebp - 0x19f4]
push str._XSS__File_In_Startup_Task:___s___u_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8e468f
mov edx, dword [0xbd08cc]
lea ecx, [ebp - 0xde20]
push ecx
push edx
jmp 0x8e45fd
test esi, esi
je 0x8e47cd
cmp dword [0xb3ddcc], esi
je 0x8e47cd
mov eax, dword [ebp - 0xdc5c]
mov ecx, dword [ebp - 0xdca8]
mov dword [ebp - 0xd5d4], eax
mov dword [ebp - 0xd5d8], ecx
mov dword [ebp - 0xd5e4], esi
cmp dword [0xbc27fc], esi
je 0x8e46f9
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x19f4]
push str.Starting_MonitorFolderThread_for:__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbd04f4], esi
jne 0x8e47cd
lea eax, [ebp - 0xd5e4]
push eax
push 0
push 0x8dbda0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7k
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8e4786
push 0x103
lea ecx, [ebp - 0x4cd3]
push ebx
push ecx
mov byte [ebp - 0x4cd4], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_a3__fails_with_error__d
push esi
lea edx, [ebp - 0x4cd4]
push 0x104
push edx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea eax, [ebp - 0x4cd4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e47cd
cmp dword [ebp - 0xd5e4], 0
jne 0x8e47cd
call fcn.0094d150
jmp 0x8e4786
cmp dword [0xbc27fc], 0
je 0x8e47cd
lea ecx, [ebp - 0x19f4]
push str._XSS__Ignoring_startup_change.
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov edi, dword [ebp - 0xdc84]
test edi, edi
jne 0x8e4844
cmp dword [ebp - 0xdca0], edi
jne 0x8e4844
cmp dword [ebp - 0xdcac], edi
jne 0x8e4844
cmp dword [ebp - 0xdc44], edi
jne 0x8e4844
cmp dword [ebp - 0xdd78], edi
jne 0x8e4838
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e4814
push edi
push eax
push str._DLXCACHE__SearchCach
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0xdd18]
push ecx
lea edx, [ebp - 0xd19c]
push edx
mov edx, dword [ebp - 0xdc28]
lea ecx, [ebp - 0x3ac]
call fcn.008bc1d0
add esp, 8
jmp 0x8e483e
mov eax, dword [ebp - 0xdd80]
mov dword [ebp - 0xdc88], eax
mov eax, dword [0xbc27fc]
mov esi, 1
cmp dword [ebp - 0xdc88], esi
jne 0x8e48c7
test eax, eax
je 0x8e486f
push 0
push eax
push str.Already_Present_In_The_Cache.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdcf8], 0xffffffff
jne 0x8e48b7
mov ecx, dword [ebp - 0xdd64]
mov edi, dword [ebp - 0xdc30]
push 2
push ecx
mov ecx, dword [ebp - 0xdc28]
push edi
lea edx, [ebp - 0x3ac]
call fcn.00896020
add esp, 0xc
mov dword [ebp - 0xdcf8], eax
cmp eax, esi
jne 0x8e48b7
mov ecx, dword [ebp - 0xdc5c]
push 0
push edi
call 0x895350
add esp, 8
call fcn.00896390
mov dword [ebp - 0xdc4c], esi
jmp 0x8df752
test edi, edi
jne 0x8e4945
cmp dword [ebp - 0xdca0], edi
jne 0x8e4945
cmp dword [ebp - 0xdcac], edi
jne 0x8e4945
cmp dword [ebp - 0xdc44], edi
jne 0x8e4945
cmp dword [ebp - 0xdc90], edi
je 0x8e4917
test eax, eax
je 0x8e4907
push edi
push eax
push str.BLANKFILE____
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
mov dword [ebp - 0xdc4c], esi
jmp 0x8df752
test eax, eax
je 0x8e4930
push 0
push eax
push str.CLCache_Search
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [ebp - 0xdc28]
lea edi, [ebp - 0xd19c]
call fcn.009d8e00
mov edi, eax
jmp 0x8e494b
mov edi, dword [ebp - 0xdcbc]
mov ebx, dword [ebp - 0xdd18]
cmp edi, 2
jne 0x8e49bc
cmp ebx, 0x19
jae 0x8e4965
cmp ebx, 4
jbe 0x8e49bc
test bl, 1
je 0x8e49bc
cmp dword [0xbc27fc], 0
je 0x8e4907
push 0x103
lea edx, [ebp - 0x5513]
push 0
push edx
mov byte [ebp - 0x5514], 0
call fcn.00a7ffb0
add esp, 0xc
push ebx
push str.Present_In_CLCache__Also_SC___d_...
push 0xffffffffffffffff
lea eax, [ebp - 0x5514]
push 0x104
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x5514]
push edx
jmp 0x8e48fa
cmp dword [0xbc27fc], 0
je 0x8e4a54
push 0x103
lea eax, [ebp - 0x2df3]
push 0
push eax
mov byte [ebp - 0x2df4], 0
call fcn.00a7ffb0
add esp, 0xc
test edi, edi
jne 0x8e49f3
push ebx
push edi
push str.NOT_Present_In_CLCache__FAR___u__SC___u_...
jmp 0x8e4a28
cmp edi, esi
jne 0x8e4a07
push ebx
push esi
push str.NOT_Present__Data_does_not_match__In_CLCache__FAR___u__SC___u_...
lea edx, [ebp - 0x2df4]
push edx
jmp 0x8e4a2f
cmp edi, 2
jne 0x8e4a1c
push ebx
push edi
push str.SC___25._Not_computing_FARes__FAR___u__SC___u_...
lea eax, [ebp - 0x2df4]
push eax
jmp 0x8e4a2f
cmp edi, 3
jne 0x8e4a37
push ebx
push edi
push str.NOT_Present__Incorrect_Params__In_CLCache__FAR___u__SC___u_...
lea ecx, [ebp - 0x2df4]
push ecx
call fcn.00a78f30
add esp, 0x10
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x2df4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xd180], 0
mov esi, dword [ebp - 0xdc28]
mov edi, 1
jbe 0x8e4aaa
mov dword [ebp - 0xdc2c], 0xffffffff
jmp 0x8e4ab6
mov ecx, dword [ebp - 0xd17c]
mov dword [ebp - 0xdc2c], ecx
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e4afa
mov edx, dword [ebp - 0xdc2c]
push edx
push esi
lea eax, [ebp - 0x19f4]
push str.File:__s_FileSize_:__d
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [0xbc27fc]
add esp, 0x20
cmp byte [esi], 0x5c
jne 0x8e4b2b
cmp byte [esi + 1], 0x5c
jne 0x8e4b2b
cmp dword [0xb8e22c], edi
je 0x8e4bda
test eax, eax
je 0x8df752
push 0
push eax
push str.Exclude_Drive:_Not_Scanning_Network_Drives
push 0xb54ce8
jmp 0x8df74a
xor eax, eax
mov dword [ebp - 4], 0x12
push 2
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov byte [ebp - 0x37], al
lea eax, [ebp - 0x40]
push esi
push eax
mov byte [ebp - 0x40], 0
call fcn.00a7b9de
add esp, 0xc
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x3e], 0
call fcn.00960910
lea eax, [ebp - 0x40]
call fcn.00966890
cmp eax, 3
jne 0x8e4b90
cmp dword [0xb8e228], edi
je 0x8e4bda
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str.Exclude_Drive:_Not_Scanning_Fixed_Drives
push 0xb54ce8
jmp 0x8df74a
cmp eax, 2
jne 0x8e4bda
cmp dword [0xb8e224], edi
je 0x8e4bda
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str.Exclude_Drive:_Not_Scanning_Removable_Drives
push 0xb54ce8
jmp 0x8df74a
mov dword [ebp - 4], 0x14
mov esi, dword [ebp - 0xdc28]
lea edi, [ebp - 0x3ac]
call fcn.008bdbd0
test eax, eax
je 0x8e4c5e
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e4c14
push 0
push eax
push str.Previously_Renamed_File_Extention_Present._Skip_File_Scanning
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 1
cmp dword [0xb38014], eax
jne 0x8df752
mov dword [ebp - 0xdcf0], eax
mov dword [ebp - 0xdc4c], 0xd
jmp 0x8df752
lea ecx, [ebp - 0x3ac]
push 0xab99ec
push ecx
mov dword [ebp - 4], 0x16
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x8e4d19
lea edx, [ebp - 0x3ac]
push 0xab99f0
push edx
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x8e4d19
lea eax, [ebp - 0x3ac]
push 0xab99f4
push eax
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x8e4d19
lea ecx, [ebp - 0x3ac]
push 0xab99f8
push ecx
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x8e4d19
lea edx, [ebp - 0x3ac]
push 0xab99fc
push edx
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x8e4d19
lea eax, [ebp - 0x3ac]
push 0xab9a00
push eax
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x8e4d19
lea ecx, [ebp - 0x3ac]
push 0xab9a04
push ecx
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x8e4dea
push 0
push str.TrainF
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.Quaran
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.Queue
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.TEMPMAI
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.OUTCOP
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.OUTSMF
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.OUTSML
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push str.TEMPJET
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
push 0
push 0xab9a5c
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e4e16
lea edx, [ebp - 0x3ac]
push 0xab9a8c
push edx
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x8e4e70
push eax
push str.IN_
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8e4e70
cmp dword [0xbc27fc], 0
je 0x8df752
push esi
lea eax, [ebp - 0x19f4]
push str.File_Present_In_MWT_Exclude_Folders:__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
jmp 0x8df74a
xor ebx, ebx
mov dword [ebp - 4], 0x18
cmp dword [0xbc27fc], ebx
je 0x8e4eb8
mov eax, dword [ebp - 0xdc28]
push eax
lea ecx, [ebp - 0x19f4]
push str.Point_X1X___s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push ebx
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea esi, [ebp - 0x3ac]
lea edi, [ebp - 0x7cc]
call fcn.008dcc80
mov edi, eax
cmp edi, 1
je 0x8df752
cmp dword [ebp - 0xdccc], 0xffffffff
mov dword [ebp - 0xdd1c], ebx
mov dword [ebp - 0xdc40], ebx
jne 0x8e5149
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8e4f0a
push ebx
push eax
push str.IsItSpecF_c_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0xdcc4]
push ecx
lea edx, [ebp - 0xdc90]
push edx
lea eax, [ebp - 0xdce4]
push eax
mov ebx, dword [ebp - 0xdc38]
lea ecx, [ebp - 0xdd38]
push ecx
push 0
lea edx, [ebp - 0xdc70]
push edx
lea eax, [ebp - 0xdc54]
push eax
lea ecx, [ebp - 0xdc94]
push ecx
mov ecx, dword [ebp - 0xdd44]
lea edx, [ebp - 0xdc98]
push edx
mov edx, dword [ebp - 0xdd90]
lea eax, [ebp - 0xdcd4]
push eax
push ecx
push edx
mov edx, dword [ebp - 0xdcd0]
lea eax, [ebp - 0xdce0]
push eax
lea ecx, [ebp - 0xdcb0]
push ecx
push edx
lea eax, [ebp - 0xdc3c]
push eax
mov eax, dword [ebp - 0xdc28]
lea ecx, [ebp - 0xdcc8]
push ecx
lea edx, [ebp - 0x184]
push edx
push ebx
push eax
call fcn.00911220
mov esi, dword [ebp - 0xdc54]
add esp, 0x50
cmp dword [0xbc27fc], 0
mov dword [ebp - 0xdccc], eax
je 0x8e501c
mov edx, dword [ebp - 0xdc90]
mov eax, dword [ebp - 0xdc70]
lea ecx, [ebp - 0x184]
push ecx
mov ecx, dword [ebp - 0xdc94]
push edx
mov edx, dword [ebp - 0xdc98]
push eax
mov eax, dword [ebp - 0xdcd4]
push esi
push ecx
mov ecx, dword [ebp - 0xdce0]
push edx
mov edx, dword [ebp - 0xdc3c]
push eax
mov eax, dword [ebp - 0xdcc8]
push ecx
push edx
push eax
lea ecx, [ebp - 0x19f4]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x40
cmp dword [0xbd0534], 0
jne 0x8e5078
cmp dword [ebp - 0xdc70], 0
je 0x8e5078
cmp dword [ebp - 0xdc3c], 2
jne 0x8e5078
cmp dword [0xbc27fc], 0
je 0x8e506e
lea ecx, [ebp - 0x19f4]
push str._C__Resetting_Value_of_IsItInfectibleFile_to_1_as_ScanAndroidAPK__0
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov dword [ebp - 0xdc3c], 1
cmp dword [ebp - 0xdd28], 0
jne 0x8e50d4
cmp dword [ebp - 0xdcf4], 0
je 0x8e5093
test esi, esi
jne 0x8e50d4
jmp 0x8e514f
test esi, esi
je 0x8e514f
cmp byte [ebp - 0x3ac], 0
je 0x8e514f
mov eax, 0xad2650
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e50d4
mov eax, 0xac8844
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e514f
cmp dword [0xbc27fc], 0
je 0x8e510b
lea ecx, [ebp - 0x19f4]
push str.Forcing_PopExt_to_SCRIPT_4_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov al, byte [0xad2676]
mov ecx, dword [str.SCRIPT]
mov dx, word [0xad2674]
mov byte [ebp - 0x17e], al
mov eax, 1
mov dword [ebp - 0x184], ecx
mov word [ebp - 0x180], dx
mov dword [ebp - 0xdc94], eax
mov dword [ebp - 0xdc3c], eax
mov dword [ebp - 0xdc98], eax
jmp 0x8e514f
mov ebx, dword [ebp - 0xdc38]
xor esi, esi
cmp dword [ebp - 0xdc90], esi
je 0x8e51c6
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e51a2
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1g_
push 0xb54ce8
jmp 0x8df74a
cmp dword [ebp - 0xdc3c], esi
jne 0x8e5206
mov eax, 0xad30a4
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e51fe
mov eax, 0xad0ff0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e51fe
cmp dword [ebp - 0xdcc8], esi
je 0x8e5212
cmp edi, esi
jne 0x8df752
cmp dword [ebp - 0xdcc8], esi
jne 0x8e5568
push 3
mov eax, 0xad0ff0
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0xdc78], esi
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e52e5
push 3
mov eax, 0xad30a8
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e52e5
push 4
mov eax, str.html
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e52e5
push 4
mov eax, str.aspx
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e52e5
mov eax, 0xad17e8
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e52e5
mov eax, 0xad30bc
lea ecx, [ebp - 0x184]
call fcn.0094c3e0
test eax, eax
je 0x8e52e5
cmp dword [ebp - 0xdc3c], 2
je 0x8e52e5
mov eax, 0xad30c0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e52e5
mov eax, str.SCRIPT
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e6d9a
mov eax, 0xad30c4
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e6d9a
mov eax, 0xad30c8
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e6d9a
mov eax, 0xad30cc
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e6d9a
call fcn.008c19b0
mov edi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp edi, eax
ja 0x8e552d
mov eax, dword [ebp - 0xdc48]
cmp eax, 0xffffffff
jne 0x8e5378
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.00918670
add esp, 4
cmp eax, esi
je 0x8e5370
mov dword [ebp - 0xdc48], 1
jmp 0x8e5478
mov dword [ebp - 0xdc48], esi
jmp 0x8e5380
cmp eax, esi
jne 0x8e5478
cmp dword [ebp - 0xdc64], 0xffffffff
jne 0x8e5478
mov edi, dword [ebp - 0xdc30]
lea edx, [ebp - 0x9dc]
push edx
push edi
call fcn.009b77a0
add esp, 8
cmp eax, 2
jne 0x8e5472
cmp dword [0xbc27fc], esi
je 0x8e53e5
push edi
lea eax, [ebp - 0x19f4]
push str.WHITE_LISTED_PID_1_:__u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push esi
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x5b4], 0
jne 0x8e5445
cmp edi, 4
jbe 0x8e541b
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 0x208
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x5b4]
push eax
push edi
call fcn.009bb790
add esp, 0x1c
lea ecx, [ebp - 0x5b4]
push 0x5c
push ecx
call fcn.00a7aa50
add esp, 8
cmp eax, esi
jne 0x8e543e
lea edx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], edx
jmp 0x8e544d
inc eax
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], esi
je 0x8e5466
mov ecx, dword [ebp - 0xdc34]
cmp byte [ecx], 0
je 0x8e5466
mov eax, str.bdc.exe
call fcn.0094c330
test eax, eax
je 0x8e5472
mov dword [ebp - 0xdc64], 1
jmp 0x8e5478
mov dword [ebp - 0xdc64], esi
cmp dword [0xb52498], esi
jne 0x8e6d9a
mov ecx, dword [ebp - 0xdc64]
cmp ecx, esi
jne 0x8e54ce
cmp dword [ebp - 0xdc48], esi
jne 0x8e54ce
mov eax, dword [0xbc27fc]
cmp eax, esi
je 0x8e54b3
push esi
push eax
push str.Forcing_ArchScan_1_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], 1
mov dword [ebp - 0xdc74], esi
mov dword [ebp - 0xdc78], esi
jmp 0x8e700e
mov eax, dword [0xbc27fc]
cmp eax, esi
je 0x8e5516
cmp ecx, 1
jne 0x8e54f0
push esi
push eax
push str.NOT_Forcing_ArchScan_1__as_PID_Whitelisted
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
cmp eax, esi
je 0x8e5516
cmp dword [ebp - 0xdc48], 1
jne 0x8e5516
push esi
push eax
push str.NOT_Forcing_ArchScan_1__as_ObjExtn_in_LibreList
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], esi
mov dword [ebp - 0xdc74], esi
mov dword [ebp - 0xdc78], esi
jmp 0x8e6da7
cmp dword [0xbc27fc], esi
je 0x8e6d9a
call fcn.008c19b0
push eax
shr edi, 0xa
push edi
lea eax, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_1_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push esi
push ecx
lea edx, [ebp - 0x19f4]
push edx
jmp 0x8e6d8d
mov dword [ebp - 0xdc78], 1
cmp dword [0xb52498], esi
jne 0x8e6d9a
push 5
mov eax, 0xaba8a4
lea ecx, [ebp - 0x7cc]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e5668
push 3
mov eax, 0xad0ff0
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e5668
push 3
mov eax, 0xad30a8
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e5668
push 4
mov eax, str.html
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e5668
push 4
mov eax, str.aspx
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e5668
mov eax, 0xad17e8
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e5668
mov eax, 0xad30bc
lea ecx, [ebp - 0x184]
call fcn.0094c3e0
test eax, eax
je 0x8e5668
cmp dword [ebp - 0xdc3c], 2
je 0x8e5668
mov eax, 0xad30c0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e5668
mov eax, str.SCRIPT
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e58b4
call fcn.008c19b0
mov edi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp edi, eax
ja 0x8e5876
mov esi, dword [ebp - 0xdc48]
cmp esi, 0xffffffff
jne 0x8e56c3
lea eax, [ebp - 0x3ac]
push eax
call fcn.00918670
add esp, 4
test eax, eax
je 0x8e56b1
mov dword [ebp - 0xdc48], 1
mov esi, dword [ebp - 0xdc48]
jmp 0x8e57ca
mov dword [ebp - 0xdc48], 0
mov esi, dword [ebp - 0xdc48]
jmp 0x8e56cb
test esi, esi
jne 0x8e57ca
cmp dword [ebp - 0xdc64], 0xffffffff
jne 0x8e57ca
mov edi, dword [ebp - 0xdc30]
lea ecx, [ebp - 0x9dc]
push ecx
push edi
call fcn.009b77a0
add esp, 8
cmp eax, 2
jne 0x8e57c0
cmp dword [0xbc27fc], 0
je 0x8e5731
push edi
lea edx, [ebp - 0x19f4]
push str.WHITE_LISTED_PID_2_:__u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x5b4], 0
jne 0x8e5792
cmp edi, 4
jbe 0x8e5768
push 0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e578b
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8e579b
inc eax
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], 0
je 0x8e57b4
mov ecx, dword [ebp - 0xdc34]
cmp byte [ecx], 0
je 0x8e57b4
mov eax, str.bdc.exe
call fcn.0094c330
test eax, eax
je 0x8e57c0
mov dword [ebp - 0xdc64], 1
jmp 0x8e57ca
mov dword [ebp - 0xdc64], 0
xor edi, edi
cmp dword [0xb52498], edi
jne 0x8e58b4
mov ecx, dword [ebp - 0xdc64]
cmp ecx, edi
jne 0x8e581e
cmp esi, edi
jne 0x8e581e
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8e5803
push edi
push eax
push str.Forcing_ArchScan_2_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], 1
mov dword [ebp - 0xdc74], edi
mov dword [ebp - 0xdc78], edi
jmp 0x8e58b4
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8e5862
cmp ecx, 1
jne 0x8e5840
push edi
push eax
push str.NOT_Forcing_ArchScan_2__as_PID_Whitelisted
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8e5862
cmp esi, 1
jne 0x8e5862
push edi
push eax
push str.NOT_Forcing_ArchScan_2__as_ObjExtn_in_LibreList
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], edi
mov dword [ebp - 0xdc74], edi
mov dword [ebp - 0xdc78], edi
jmp 0x8e58b4
cmp dword [0xbc27fc], esi
je 0x8e58b4
call fcn.008c19b0
push eax
shr edi, 0xa
push edi
lea edx, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_2_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push esi
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, dword [ebp - 0xdc28]
cmp byte [eax], 0x5c
jne 0x8e58dd
cmp byte [eax + 1], 0x5c
jne 0x8e58dd
cmp dword [0xbd0528], 0
jne 0x8e58dd
mov dword [ebp - 0xdd3c], 1
jmp 0x8e6aea
cmp dword [ebp - 0xdc44], 0
jne 0x8e6aea
mov esi, dword [ebp - 0xdc2c]
xor edi, edi
mov dword [ebp - 0xdd88], edi
cmp esi, 0x600000
jb 0x8e5947
cmp dword [0xbd0528], edi
jne 0x8e5947
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e5b31
mov dword [ebp - 0xdcbc], esi
fild dword [ebp - 0xdcbc]
test esi, esi
jge 0x8e5936
fadd qword [0xb0baa8]
fcomp qword [0xb0bb80]
fnstsw ax
test ah, 5
jp 0x8e5b31
mov eax, 0xad28a0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e59af
mov eax, 0xad28a4
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e59af
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e59af
mov eax, 0xad28a8
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e59af
mov eax, 0xad28ac
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e5a6e
push 0
lea edx, [ebp - 0x7cc]
push str.xlsx.
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e5a49
push 0
lea eax, [ebp - 0x7cc]
push str.docx.
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e5a49
push 0
lea ecx, [ebp - 0x7cc]
push str..daa
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e5a49
push 0
lea edx, [ebp - 0x7cc]
push str.pdf.
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e5a49
push 0
lea eax, [ebp - 0x7cc]
push str.exe.
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e5a49
lea esi, [ebp - 0x7cc]
call fcn.00905840
test eax, eax
je 0x8e5a6e
mov eax, dword [0xbc27fc]
mov edi, 1
mov dword [ebp - 0xdd88], edi
test eax, eax
je 0x8e5afe
push 0
push eax
push str.ForceScanArj_set__F_
jmp 0x8e5af1
mov eax, 0xaaabac
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e5aac
cmp dword [ebp - 0xdc2c], 0x40000
jae 0x8e5aac
mov eax, dword [0xbc27fc]
mov edi, 1
mov dword [ebp - 0xdd88], edi
test eax, eax
je 0x8e5afe
push 0
push eax
push str.ForceScanArj_set__F1_
jmp 0x8e5af1
mov eax, 0xad28a0
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e5afe
mov ecx, dword [ebp - 0xdc2c]
push ecx
mov ecx, ebx
call fcn.00924ec0
add esp, 4
test eax, eax
je 0x8e5afe
mov eax, dword [0xbc27fc]
mov edi, 1
mov dword [ebp - 0xdd88], edi
test eax, eax
je 0x8e5afe
push 0
push eax
push str.ForceScanArj_set__G_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e5b31
lea edx, [ebp - 0xdd88]
push 0x44
push edx
lea ecx, [ebp - 0xddc4]
mov esi, ebx
call fcn.008dd2a0
mov edi, dword [ebp - 0xdd88]
add esp, 8
cmp dword [0xbc27fc], 0
mov esi, dword [ebp - 0xdc2c]
je 0x8e5b92
mov ecx, dword [0xbd0528]
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 0xdc78]
push ecx
cmp esi, 0x600000
sbb edx, edx
neg edx
push edx
push esi
push eax
lea ecx, [ebp - 0x19f4]
push str.bArch_u__dwObjSize_u___u___BlockPwdProt:_u__PopExt__s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x1c
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdc78], 0
je 0x8e6d9a
cmp esi, 0x600000
jb 0x8e5bef
cmp dword [0xbd0528], 0
jne 0x8e5bef
mov eax, 0xad289c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e6aea
mov ecx, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test ecx, ecx
jge 0x8e5bde
fadd qword [0xb0baa8]
fcomp qword [0xb0bb80]
fnstsw ax
test ah, 5
jp 0x8e6aea
mov eax, 0xac5f5c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e5c92
lea esi, [ebp - 0x184]
call fcn.00975880
test eax, eax
jne 0x8e5c92
mov eax, 0xad21c4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
mov eax, 0xad21c8
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
mov eax, 0xad330c
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
mov eax, 0xad279c
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
mov eax, 0xad2794
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
mov eax, 0xad2798
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
mov eax, 0xad28a0
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8e5c92
test edi, edi
je 0x8e6aea
xor esi, esi
mov eax, 0xac5f5c
lea ecx, [ebp - 0x184]
mov dword [ebp - 0xdc7c], esi
call fcn.0094c330
test eax, eax
jne 0x8e5fb3
mov edx, dword [0xbd0528]
mov edi, dword [ebp - 0xdc28]
lea eax, [ebp - 0xdde8]
push eax
mov dword [ebp - 0xdde8], edx
lea ecx, [ebp - 0xddf0]
push ecx
lea edx, [ebp - 0xdc7c]
push edx
push ebx
lea eax, [ebp - 0xdd1c]
push eax
push edi
lea ecx, [ebp - 0xdcc0]
lea edx, [ebp - 0xde10]
mov dword [ebp - 0xde10], esi
mov dword [ebp - 0xddf0], esi
call fcn.009300c0
mov esi, eax
mov eax, dword [ebp - 0xdde8]
add esp, 0x18
mov dword [ebp - 0xdc40], esi
cmp eax, 0xff
je 0x8e5d21
xor eax, eax
mov dword [ebp - 0xdde8], eax
jmp 0x8e5d2b
mov dword [ebp - 0xdc44], 2
cmp dword [0xbc27fc], 0
je 0x8e5d8e
mov ecx, dword [ebp - 0xddf0]
mov edx, dword [ebp - 0xdcc0]
push eax
mov eax, dword [ebp - 0xdcc4]
push ecx
mov ecx, dword [ebp - 0xdc7c]
push edx
mov edx, dword [ebp - 0xde10]
push eax
mov eax, dword [ebp - 0xdd1c]
push ecx
push edx
push eax
push esi
lea ecx, [ebp - 0x19f4]
push str.ZC_2_:__d_PwdProt:__d__PIFSCR:__u__OneExe:__u__FFExe:__u__TDoc:__u__Abn:__u__Bin:_0x_x
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x38
cmp esi, 0xffffffff
jne 0x8e5dad
cmp dword [ebp - 0xdcc4], 0
je 0x8e5dad
mov esi, 1
mov dword [ebp - 0xdd1c], 0
jmp 0x8e5dee
cmp byte [ebp - 0x3ac], 0
je 0x8e5dfa
lea ecx, [ebp - 0x3ac]
push 0xad26d0
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8e5dfa
cmp esi, 0xffffffff
je 0x8e5dfa
lea edx, [esi - 2]
cmp edx, 3
ja 0x8e5dfa
cmp dword [ebp - 0xdd1c], eax
jne 0x8e5dfa
mov esi, 1
mov dword [ebp - 0xdc60], esi
mov dword [ebp - 0xdc7c], esi
mov dword [ebp - 0xdc40], esi
cmp dword [ebp - 0xde10], 0
je 0x8e5eeb
cmp dword [0xbc27fc], 0
je 0x8e5e56
mov eax, dword [ebp - 0xdc2c]
mov ecx, dword [0xb3ddc8]
mov edx, dword [ebp - 0xdcdc]
push eax
push ecx
push edx
lea eax, [ebp - 0x19f4]
push str.EMC_4____u_BlockSus___u__dwObjSize___u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdcdc], 0
je 0x8e5ec7
cmp dword [0xb3ddc8], 0
je 0x8e5ec7
mov eax, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test eax, eax
jge 0x8e5e7e
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x8e5ec7
push edi
lea ecx, [ebp - 0x19f4]
push str.Suspicious_Attachment:_s____BLOCKING_1_
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc44], 1
jmp 0x8e5f7c
mov eax, 1
cmp esi, eax
jne 0x8e5f7c
mov dword [ebp - 0xdc60], eax
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc7c], eax
jmp 0x8e61f4
cmp esi, 1
je 0x8e5ef9
cmp esi, 0xffffffff
jne 0x8e5f7c
cmp dword [ebp - 0xdd1c], 0
je 0x8e5f0b
cmp byte [0xbd0540], 0
je 0x8e5f7c
cmp dword [ebp - 0xddf0], 0
jne 0x8e5f23
lea esi, [ebp - 0x7cc]
call fcn.00905840
test eax, eax
je 0x8e5f76
cmp dword [0xbc27fc], 0
je 0x8e5f5a
lea eax, [ebp - 0x19f4]
push str.ZC_1B____Reserved_Name_in_ZIP___Setting_infected
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov eax, 1
mov dword [ebp - 0xdc60], eax
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc7c], eax
jmp 0x8e61f4
mov esi, dword [ebp - 0xdc40]
cmp dword [ebp - 0xdc7c], 0
jne 0x8e61eb
cmp esi, 1
jne 0x8e5fa4
cmp dword [ebp - 0xdd1c], 0
je 0x8e5fa4
cmp dword [ebp - 0xdcc4], 0
jne 0x8e61f4
mov dword [ebp - 0xdc40], 0
jmp 0x8e6aea
mov eax, 0xad00ac
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e67d2
mov eax, 0xad275c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e67d2
mov eax, 0xad2794
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e6015
mov ecx, ebx
call fcn.009250d0
cmp eax, esi
je 0x8e6aea
mov dword [ebp - 0xdc40], 1
jmp 0x8e6213
mov eax, 0xad2798
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e604b
mov eax, dword [ebp - 0xdc28]
call fcn.008dcf30
test eax, eax
je 0x8e6aea
mov dword [ebp - 0xdc40], 1
jmp 0x8e6213
mov eax, 0xad279c
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e62a7
cmp dword [0xbc27fc], esi
mov esi, dword [ebp - 0xdc2c]
je 0x8e60a7
mov eax, dword [ebp - 0xdc9c]
push esi
push eax
lea ecx, [ebp - 0x19f4]
push str.ISP_ARCH_C1_:_FBS_u__dwObjSize_u
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc9c], 0
jne 0x8e6267
xor edi, edi
push 0x103
lea ecx, [ebp - 0x3843]
push edi
push ecx
mov dword [ebp - 0xde30], edi
mov byte [ebp - 0x3844], 0
call fcn.00a7ffb0
mov edx, dword [0xbd0528]
add esp, 0xc
mov dword [ebp - 0xddf8], edx
xor esi, esi
mov dword [ebp - 0xde3c], edi
call fcn.00968110
cmp eax, edi
je 0x8e6106
lea eax, [ebp - 0xde3c]
push eax
call fcn.009681c0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0xdc28]
lea ecx, [ebp - 0x3844]
push ecx
lea edx, [ebp - 0xdc7c]
push edx
push eax
lea edx, [ebp - 0xddf8]
lea ecx, [ebp - 0xde30]
call fcn.00925a30
add esp, 0xc
cmp eax, edi
je 0x8e6156
cmp dword [ebp - 0xdc7c], edi
je 0x8e6156
cmp dword [ebp - 0xde30], edi
jne 0x8e6156
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
jmp 0x8e61b4
cmp byte [ebp - 0x3844], 0
je 0x8e61b4
cmp dword [ebp - 0xde30], edi
jne 0x8e6182
cmp dword [ebp - 0xdcc4], edi
je 0x8e6182
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
jmp 0x8e61b4
lea ecx, [ebp - 0x3844]
push ecx
lea edx, [ebp - 0x19f4]
push str._ACE__ErMsg2:_s
push edx
call fcn.00a78f30
add esp, 0xc
push edi
push 1
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xddf8], 0xff
je 0x8e61c8
mov dword [ebp - 0xddf8], edi
jmp 0x8e61d2
mov dword [ebp - 0xdc44], 2
cmp esi, edi
je 0x8e61e5
mov ecx, dword [ebp - 0xde3c]
push ecx
call fcn.00968240
add esp, 4
mov esi, dword [ebp - 0xdc40]
cmp esi, 1
jne 0x8e6aea
cmp dword [ebp - 0xdd1c], 0
je 0x8e6213
cmp byte [0xbd0540], 0
jne 0x8e6213
cmp dword [ebp - 0xdcc4], 0
je 0x8e6aea
mov ebx, 1
mov dword [ebp - 0xdc60], ebx
call fcn.008c19b0
mov esi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp esi, eax
ja 0x8e6aaa
mov edi, dword [ebp - 0xdc48]
cmp edi, 0xffffffff
jne 0x8e6910
lea eax, [ebp - 0x3ac]
push eax
call fcn.00918670
add esp, 4
test eax, eax
je 0x8e68fe
mov dword [ebp - 0xdc48], ebx
mov edi, ebx
jmp 0x8e6a14
cmp esi, 0x190
jae 0x8e628e
push esi
mov ecx, ebx
call fcn.00924fc0
add esp, 4
test eax, eax
je 0x8e6aea
mov dword [ebp - 0xdc40], 1
jmp 0x8e6213
mov dword [ebp - 0xdd3c], 1
mov dword [ebp - 0xdc40], 0xffffffff
jmp 0x8e6aea
lea esi, [ebp - 0x184]
call fcn.00975880
test eax, eax
je 0x8e6511
push 0x103
lea edx, [ebp - 0x29d3]
push 0
push edx
mov byte [ebp - 0x29d4], 0
call fcn.00a7ffb0
mov cl, byte [ebp - 0x183]
mov eax, dword [0xbd0528]
xor ebx, ebx
sub cl, 0x30
add esp, 0xc
mov dword [ebp - 0xde40], ebx
mov dword [ebp - 0xdd4c], eax
cmp cl, 2
ja 0x8e62fd
mov ebx, 1
cmp dword [ebp - 0xdc9c], 0
je 0x8e6418
mov ecx, dword [ebp - 0xdc38]
lea edx, [ebp - 0xdd4c]
push edx
mov edx, dword [ebp - 0xdc5c]
lea eax, [ebp - 0xde40]
push eax
push 2
push ecx
push edx
lea ecx, [ebp - 0xdc7c]
lea edx, [ebp - 0x29d4]
call fcn.00923c30
mov edi, dword [ebp - 0xdd4c]
add esp, 0x14
mov esi, eax
cmp edi, 0xff
je 0x8e6356
xor edi, edi
mov dword [ebp - 0xdd4c], edi
jmp 0x8e6360
mov dword [ebp - 0xdc44], 2
cmp dword [0xbc27fc], 0
je 0x8e63a6
mov ecx, dword [ebp - 0xdc7c]
lea eax, [ebp - 0x29d4]
push eax
push edi
push ecx
push esi
lea edx, [ebp - 0x19f4]
push str.ISP_ARCH_D_:_rv_u__OneExe_u__Bin:0x_x__ErMsg:__s_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
test esi, esi
je 0x8e63d6
cmp dword [ebp - 0xde40], 0
jne 0x8e63c0
cmp dword [ebp - 0xdc7c], 0
jne 0x8e63c0
test ebx, ebx
je 0x8e63d6
mov eax, 1
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
jmp 0x8e6488
cmp byte [ebp - 0x29d4], 0
je 0x8e6488
push 0
lea edx, [ebp - 0x29d4]
push str.7z_Error
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8e6488
mov dword [ebp - 0xdd3c], 1
mov dword [ebp - 0xdc40], 0xffffffff
jmp 0x8e6488
push 0
lea eax, [ebp - 0xdd4c]
push eax
mov eax, dword [ebp - 0xdc5c]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xdc7c]
push ecx
lea edx, [ebp - 0x29d4]
push edx
push eax
push 0
call fcn.00919ec0
add esp, 0x28
test eax, eax
je 0x8e6466
cmp dword [ebp - 0xdc7c], 0
je 0x8e6466
mov eax, 1
mov dword [ebp - 0xdc60], eax
mov dword [ebp - 0xdc40], eax
mov edi, dword [ebp - 0xdd4c]
cmp edi, 0xff
je 0x8e647e
xor edi, edi
mov dword [ebp - 0xdd4c], edi
jmp 0x8e6488
mov dword [ebp - 0xdc44], 2
cmp dword [0xbc27fc], 0
je 0x8e61e5
cmp dword [ebp - 0xdc9c], 0
je 0x8e64c4
mov edx, dword [ebp - 0xdc7c]
mov eax, dword [ebp - 0xdc40]
lea ecx, [ebp - 0x29d4]
push ecx
push edi
push edx
push 0
push eax
push str.ZC_2aS____d__PwdProt___d__OneExe_d__Bin:_0x_x__ErMsg:__s_
lea ecx, [ebp - 0x19f4]
push ecx
jmp 0x8e64e8
mov eax, dword [ebp - 0xdc7c]
mov ecx, dword [ebp - 0xdc40]
lea edx, [ebp - 0x29d4]
push edx
push edi
push eax
push 0
push ecx
push str.ZC_2aN____d__PwdProt___d__OneExe_d__Bin:_0x_x__ErMsg:__s_
lea edx, [ebp - 0x19f4]
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x1c
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e61e5
mov eax, 0xad21c4
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e6754
mov ecx, dword [ebp - 0xdc38]
mov eax, ecx
xor edi, edi
call fcn.00964530
mov ebx, eax
test ebx, ebx
je 0x8e654b
push 1
push edi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
mov edx, dword [ebp - 0xdc38]
mov ecx, dword [ebp - 0xdc28]
call fcn.00923f90
cmp dword [0xbc27fc], 0
mov esi, eax
je 0x8e6598
push esi
lea edx, [ebp - 0x19f4]
push str.CAB_B____d
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp esi, 1
jne 0x8e6735
push 0x207
lea edx, [ebp - 0x605b]
push 0
push edx
mov byte [ebp - 0x605c], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0xdc38]
mov ecx, dword [ebp - 0xdc28]
add esp, 0xc
push eax
lea edx, [ebp - 0x605c]
call fcn.00924230
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8e6619
lea ecx, [ebp - 0x605c]
push ecx
lea edx, [ebp - 0x19f4]
push str.EMC_5__FirstFileInCab:__s_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x605c], 0
je 0x8e6735
push 0
lea edx, [ebp - 0x605c]
push 0xad283c
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8e665f
mov eax, dword [ebp - 0xdc2c]
push eax
lea ecx, [ebp - 0x605c]
push ecx
call fcn.00919660
add esp, 8
test eax, eax
je 0x8e6735
cmp dword [0xbc27fc], 0
mov eax, 1
mov dword [ebp - 0xdc7c], eax
mov dword [ebp - 0xdc40], eax
mov dword [ebp - 0xdc60], eax
je 0x8e66c3
mov edx, dword [ebp - 0xdc2c]
mov eax, dword [0xb3ddc8]
mov ecx, dword [ebp - 0xdcdc]
push edx
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.EMC_5____u_BlockSus___u__dwObjSize___u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdcdc], 0
je 0x8e6735
cmp dword [0xb3ddc8], 0
je 0x8e6735
mov edx, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test edx, edx
jge 0x8e66eb
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x8e6735
mov eax, dword [ebp - 0xdc28]
push eax
lea ecx, [ebp - 0x19f4]
push str.Suspicious_Attachment:_s____BLOCKING_1a_
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc44], 1
test ebx, ebx
je 0x8e61e5
mov eax, dword [ebp - 0xdc38]
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x8e61e5
mov eax, dword [ebp - 0xdc2c]
cmp eax, 0x190
jae 0x8e678e
push eax
mov ecx, ebx
call fcn.00924fc0
add esp, 4
test eax, eax
je 0x8e6aea
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov dword [ebp - 0xdc40], 1
jmp 0x8e6213
test edi, edi
je 0x8e6aea
lea eax, [ebp - 0xdc3c]
call fcn.008dd470
mov eax, dword [0xbc27fc]
mov dword [ebp - 0xdc40], 1
test eax, eax
je 0x8e6213
push 0
push eax
push str.ForceScanArj_set__FINAL_F_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e6213
push 0x103
lea ecx, [ebp - 0x3c5b]
push 0
push ecx
mov byte [ebp - 0x3c5c], 0
call fcn.00a7ffb0
mov edx, dword [0xbd0528]
add esp, 0xc
mov eax, 0xad00ac
lea ecx, [ebp - 0x184]
mov dword [ebp - 0xde44], 0
mov dword [ebp - 0xddc0], edx
call fcn.0094c330
mov edx, dword [ebp - 0xdc5c]
mov esi, eax
neg esi
lea eax, [ebp - 0xddc0]
push eax
sbb esi, esi
lea ecx, [ebp - 0xde44]
push ecx
neg esi
push esi
push ebx
push edx
lea ecx, [ebp - 0xdc7c]
lea edx, [ebp - 0x3c5c]
call fcn.00923c30
mov edi, eax
mov eax, dword [ebp - 0xddc0]
add esp, 0x14
cmp eax, 0xff
je 0x8e6861
xor eax, eax
mov dword [ebp - 0xddc0], eax
jmp 0x8e686b
mov dword [ebp - 0xdc44], 2
cmp dword [0xbc27fc], 0
je 0x8e68b2
mov edx, dword [ebp - 0xdc7c]
lea ecx, [ebp - 0x3c5c]
push ecx
push eax
push edx
push edi
lea eax, [ebp - 0x19f4]
push str.ISP_ARCH_C_:_rv_u__OneExe_u__Bin:0x_x__ErMsg:__s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
test edi, edi
je 0x8e6aea
cmp dword [ebp - 0xde44], 0
jne 0x8e68ef
cmp dword [ebp - 0xdc7c], 0
jne 0x8e68ef
cmp dword [0xbd4a7c], 0
je 0x8e6aea
cmp byte [ebp - 0x3ac], 0
jne 0x8e6aea
cmp esi, 1
jne 0x8e6aea
mov dword [ebp - 0xdc40], 1
jmp 0x8e6213
mov dword [ebp - 0xdc48], 0
mov edi, dword [ebp - 0xdc48]
jmp 0x8e6918
test edi, edi
jne 0x8e6a14
cmp dword [ebp - 0xdc64], 0xffffffff
jne 0x8e6a14
mov esi, dword [ebp - 0xdc30]
lea ecx, [ebp - 0x9dc]
push ecx
push esi
call fcn.009b77a0
add esp, 8
cmp eax, 2
jne 0x8e6a0a
cmp dword [0xbc27fc], 0
je 0x8e697e
push esi
lea edx, [ebp - 0x19f4]
push str.WHITE_LISTED_PID_4_:__u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x5b4], 0
jne 0x8e69e0
cmp esi, 4
jbe 0x8e69b5
push 0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x8d4]
push eax
push 0x208
lea ecx, [ebp - 0x9dc]
push ecx
lea edx, [ebp - 0x5b4]
push edx
push esi
call fcn.009bb790
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push 0x5c
push eax
call fcn.00a7aa50
add esp, 8
test eax, eax
jne 0x8e69d8
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], ecx
jmp 0x8e69e9
add eax, ebx
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], 0
je 0x8e6a02
mov ecx, dword [ebp - 0xdc34]
cmp byte [ecx], 0
je 0x8e6a02
mov eax, str.bdc.exe
call fcn.0094c330
test eax, eax
je 0x8e6a0a
mov dword [ebp - 0xdc64], ebx
jmp 0x8e6a14
mov dword [ebp - 0xdc64], 0
xor esi, esi
cmp dword [0xb52498], esi
jne 0x8e6aea
mov ecx, dword [ebp - 0xdc64]
cmp ecx, esi
jne 0x8e6a64
cmp edi, esi
jne 0x8e6a64
mov eax, dword [0xbc27fc]
cmp eax, esi
je 0x8e6a4d
push esi
push eax
push str.Forcing_ArchScan_3_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], ebx
mov dword [ebp - 0xdc74], esi
mov dword [ebp - 0xdc78], esi
jmp 0x8e700e
mov eax, dword [0xbc27fc]
cmp eax, esi
je 0x8e5516
cmp ecx, ebx
jne 0x8e6a89
push esi
push eax
push str.NOT_Forcing_ArchScan_3__as_PID_Whitelisted
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
cmp eax, esi
je 0x8e5516
cmp edi, ebx
jne 0x8e5516
push esi
push eax
push str.NOT_Forcing_ArchScan_3__as_ObjExtn_in_LibreList
jmp 0x8e5509
cmp dword [0xbc27fc], 0
je 0x8e6aea
call fcn.008c19b0
push eax
shr esi, 0xa
push esi
lea edx, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_3_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc78], 0
je 0x8e6d9a
cmp dword [ebp - 0xdc44], 0
jne 0x8e6d9a
mov eax, str.Encoded_VBS
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e6b58
mov eax, str.EXE_XORCrypt
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e6b58
mov eax, str.EXE_EncPk
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
je 0x8e6b58
mov eax, 0xad36a8
lea ecx, [ebp - 0x184]
call fcn.0094c330
test eax, eax
jne 0x8e6d9a
call fcn.008c19b0
mov esi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp esi, eax
ja 0x8e6d59
mov esi, dword [ebp - 0xdc48]
cmp esi, 0xffffffff
jne 0x8e6bad
lea edx, [ebp - 0x3ac]
push edx
call fcn.00918670
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x8e6ba3
mov dword [ebp - 0xdc48], 1
mov esi, dword [ebp - 0xdc48]
jmp 0x8e6caf
mov dword [ebp - 0xdc48], ebx
mov esi, ebx
jmp 0x8e6bb7
xor ebx, ebx
cmp esi, ebx
jne 0x8e6caf
cmp dword [ebp - 0xdc64], 0xffffffff
jne 0x8e6caf
mov edi, dword [ebp - 0xdc30]
lea eax, [ebp - 0x9dc]
push eax
push edi
call fcn.009b77a0
add esp, 8
cmp eax, 2
jne 0x8e6ca9
cmp dword [0xbc27fc], ebx
je 0x8e6c1c
push edi
lea ecx, [ebp - 0x19f4]
push str.WHITE_LISTED_PID_5_:__u
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push ebx
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x5b4], 0
jne 0x8e6c7c
cmp edi, 4
jbe 0x8e6c52
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x8d4]
push edx
push 0x208
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0x5b4]
push ecx
push edi
call fcn.009bb790
add esp, 0x1c
lea edx, [ebp - 0x5b4]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
jne 0x8e6c75
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], eax
jmp 0x8e6c84
inc eax
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], ebx
je 0x8e6c9d
mov ecx, dword [ebp - 0xdc34]
cmp byte [ecx], 0
je 0x8e6c9d
mov eax, str.bdc.exe
call fcn.0094c330
test eax, eax
je 0x8e6ca9
mov dword [ebp - 0xdc64], 1
jmp 0x8e6caf
mov dword [ebp - 0xdc64], ebx
cmp dword [0xb52498], ebx
jne 0x8e6d9a
mov ecx, dword [ebp - 0xdc64]
cmp ecx, ebx
jne 0x8e6d01
cmp esi, ebx
jne 0x8e6d01
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8e6ce6
push ebx
push eax
push str.Forcing_ArchScan_4_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], 1
mov dword [ebp - 0xdc74], ebx
mov dword [ebp - 0xdc78], ebx
jmp 0x8e701b
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8e6d45
cmp ecx, 1
jne 0x8e6d23
push ebx
push eax
push str.NOT_Forcing_ArchScan_4__as_PID_Whitelisted
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8e6d45
cmp esi, 1
jne 0x8e6d45
push ebx
push eax
push str.NOT_Forcing_ArchScan_4__as_ObjExtn_in_LibreList
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], ebx
mov dword [ebp - 0xdc74], ebx
mov dword [ebp - 0xdc78], ebx
jmp 0x8e6da7
cmp dword [0xbc27fc], 0
je 0x8e6d9a
call fcn.008c19b0
push eax
shr esi, 0xa
push esi
lea ecx, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_4_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc68], 0
jne 0x8e700e
push 5
mov eax, 0xaba8a4
lea ecx, [ebp - 0x7cc]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8e700e
xor edi, edi
cmp dword [ebp - 0xdc44], edi
jne 0x8e70b3
call fcn.008c19b0
mov esi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp esi, eax
ja 0x8e6fcf
mov eax, dword [ebp - 0xdc48]
cmp eax, 0xffffffff
jne 0x8e6e1d
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.00918670
add esp, 4
cmp eax, edi
je 0x8e6e15
mov dword [ebp - 0xdc48], 1
jmp 0x8e6f1d
mov dword [ebp - 0xdc48], edi
jmp 0x8e6e25
cmp eax, edi
jne 0x8e6f1d
cmp dword [ebp - 0xdc64], 0xffffffff
jne 0x8e6f1d
mov esi, dword [ebp - 0xdc30]
lea edx, [ebp - 0x9dc]
push edx
push esi
call fcn.009b77a0
add esp, 8
cmp eax, 2
jne 0x8e6f17
cmp dword [0xbc27fc], edi
je 0x8e6e8a
push esi
lea eax, [ebp - 0x19f4]
push str.WHITE_LISTED_PID_6_:__u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push edi
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x5b4], 0
jne 0x8e6eea
cmp esi, 4
jbe 0x8e6ec0
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 0x208
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x5b4]
push eax
push esi
call fcn.009bb790
add esp, 0x1c
lea ecx, [ebp - 0x5b4]
push 0x5c
push ecx
call fcn.00a7aa50
add esp, 8
cmp eax, edi
jne 0x8e6ee3
lea edx, [ebp - 0x5b4]
mov dword [ebp - 0xdc34], edx
jmp 0x8e6ef2
inc eax
mov dword [ebp - 0xdc34], eax
cmp dword [ebp - 0xdc34], edi
je 0x8e6f0b
mov ecx, dword [ebp - 0xdc34]
cmp byte [ecx], 0
je 0x8e6f0b
mov eax, str.bdc.exe
call fcn.0094c330
test eax, eax
je 0x8e6f17
mov dword [ebp - 0xdc64], 1
jmp 0x8e6f1d
mov dword [ebp - 0xdc64], edi
cmp dword [0xb52498], edi
jne 0x8e701b
mov ecx, dword [ebp - 0xdc64]
cmp ecx, edi
jne 0x8e6f73
cmp dword [ebp - 0xdc48], edi
jne 0x8e6f73
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8e6f58
push edi
push eax
push str.Forcing_ArchScan_5_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], 1
mov dword [ebp - 0xdc74], edi
mov dword [ebp - 0xdc78], edi
jmp 0x8e701b
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8e6fbb
cmp ecx, 1
jne 0x8e6f95
push edi
push eax
push str.NOT_Forcing_ArchScan_5__as_PID_Whitelisted
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8e6fbb
cmp dword [ebp - 0xdc48], 1
jne 0x8e6fbb
push edi
push eax
push str.NOT_Forcing_ArchScan_5__as_ObjExtn_in_LibreList
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc68], edi
mov dword [ebp - 0xdc74], edi
mov dword [ebp - 0xdc78], edi
jmp 0x8e701b
cmp dword [0xbc27fc], edi
je 0x8e701b
call fcn.008c19b0
push eax
shr esi, 0xa
push esi
lea eax, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_5_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push edi
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc44], 0
jne 0x8e70b3
cmp dword [ebp - 0xdc2c], 0xffffffff
jne 0x8e70b3
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7046
push 0
push eax
push str.Skipping_Scan__FSize___1_...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e708f
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1h_
push 0xb54ce8
jmp 0x8df74a
mov esi, dword [ebp - 0xdc50]
cmp dword [esi*4 + 0xbc280c], 0
mov edi, dword [ebp - 0xdc44]
je 0x8e721e
test edi, edi
jne 0x8e7257
mov eax, dword [ebp - 0xdcc0]
cmp eax, 0x379
je 0x8e70f1
cmp eax, 0x1bd
je 0x8e70f1
cmp dword [ebp - 0xddc4], edi
je 0x8e7107
cmp dword [ebp - 0xdc68], 0
je 0x8e7107
mov ebx, 1
mov dword [ebp - 0xdc74], ebx
jmp 0x8e710c
mov ebx, 1
cmp dword [ebp - 0xdc68], ebx
jne 0x8e7227
mov eax, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test eax, eax
jge 0x8e712e
fadd qword [0xb0baa8]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 0x41
jp 0x8e7154
cmp dword [ebp - 0xdc60], ebx
jne 0x8e7154
cmp dword [0xbc27fc], 0
je 0x8e718f
push esi
push str._ARCH__Forcing_Archive_Scan_on_ScanCon__d__FC1_
jmp 0x8e7163
cmp dword [0xbc27fc], 0
je 0x8e718f
push esi
push str._ARCH__Forcing_Archive_Scan_on_ScanCon__d_
lea ecx, [ebp - 0x19f4]
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [esi*4 + 0xbc280c]
push ebx
push 0x1a
push ecx
mov dword [ebp - 0xdd84], ebx
call dword [0xb8da8c]
mov edx, dword [esi*4 + 0xbc280c]
add esp, 0xc
push ebx
push 0x1b
push edx
call dword [0xb8da8c]
mov eax, dword [0xb392ac]
mov ecx, dword [esi*4 + 0xbc280c]
add esp, 0xc
push eax
push 0x28
push ecx
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8e71f6
mov edx, dword [esi*4 + 0xbc280c]
push ebx
push 0xff0
push edx
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xb8db48], 0
jne 0x8e7208
cmp dword [ebp - 0xdc74], 0
je 0x8e7227
mov eax, dword [esi*4 + 0xbc280c]
push ebx
push 0x57
push eax
call dword [0xb8da8c]
add esp, 0xc
jmp 0x8e7223
mov ebx, 1
test edi, edi
jne 0x8e725c
push 3
mov eax, 0xad3908
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8e725c
cmp dword [ebp - 0xdccc], 0x24
jne 0x8e725c
cmp dword [ebp + 0x20], 0x40
jne 0x8e725c
mov dword [ebp - 0xdd30], ebx
jmp 0x8e725c
mov ebx, 1
cmp dword [0xbc27fc], 0
je 0x8e72c6
mov ecx, dword [ebp - 0xdc74]
mov edx, dword [ebp - 0xdd30]
mov eax, dword [ebp - 0xdddc]
push ecx
mov ecx, dword [ebp - 0xdc68]
push edx
mov edx, dword [ebp - 0xdc3c]
push eax
push ecx
mov ecx, dword [ebp - 0xdccc]
push edx
lea eax, [ebp - 0x184]
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.FType:___d__Ext:___s__Inf:___d__FAS:___d__Scr:___d__STM:___d__FDS:___d_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x24
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdccc], 0
je 0x8e7480
cmp dword [ebp - 0xdc3c], 0
jne 0x8e7480
cmp dword [ebp - 0xdc78], ebx
je 0x8e7480
cmp dword [ebp - 0xdc68], ebx
je 0x8e7480
cmp dword [ebp - 0xdc84], ebx
je 0x8e7480
cmp dword [ebp - 0xdca0], ebx
je 0x8e7480
cmp dword [ebp - 0xdcac], ebx
je 0x8e7480
test edi, edi
jne 0x8e7480
cmp dword [ebp - 0xdd30], edi
jne 0x8e7480
cmp dword [ebp - 0xdcf8], 0xffffffff
mov esi, ebx
jne 0x8e737a
mov edx, dword [ebp - 0xdd64]
mov edi, dword [ebp - 0xdc30]
mov ecx, dword [ebp - 0xdc28]
push 4
push edx
push edi
lea edx, [ebp - 0x3ac]
call fcn.00896020
add esp, 0xc
mov dword [ebp - 0xdcf8], eax
cmp eax, ebx
jne 0x8e737a
mov ecx, dword [ebp - 0xdc5c]
push 0
push edi
call 0x895350
add esp, 8
push 3
mov eax, 0xad3908
lea ecx, [ebp - 0x3ac]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8e73b6
cmp dword [ebp - 0xdccc], 0x24
jne 0x8e73b6
xor esi, esi
cmp dword [0xb38014], ebx
jne 0x8e73b6
mov dword [ebp - 0xdc4c], 0xd
mov dword [ebp - 0xdcf0], ebx
cmp dword [0xbc27fc], 0
je 0x8e73fe
mov eax, dword [ebp - 0xdc4c]
mov ecx, dword [ebp - 0xdc40]
push eax
push esi
push ecx
lea edx, [ebp - 0x19f4]
push str.Skipping_Scan...__FC___d__CT___d__dwBd___d_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdc40], 0xffffffff
je 0x8df752
test esi, esi
je 0x8df752
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 0
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e745c
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1_
push 0xb54ce8
jmp 0x8df74a
mov dword [ebp - 4], 0xffffffff
cmp dword [0xb8e230], 2
mov ebx, dword [ebp - 0xdc2c]
mov edi, 1
je 0x8e7b53
mov eax, dword [0xb52498]
test eax, eax
jne 0x8e7d39
cmp dword [ebp - 0xdc78], edi
jne 0x8e796e
cmp dword [0xbc27fc], eax
je 0x8e74f6
push ebx
lea edx, [ebp - 0x3ac]
push edx
lea eax, [ebp - 0x19f4]
push str._GUI_Option_Not_Set__Archive_File_With_Extension___s__And_Size__d
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdccc], 0xffffffff
mov dword [ebp - 4], 0x1a
jne 0x8e7781
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7528
push 0
push eax
push str.IsItSpecF_d_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea eax, [ebp - 0xdcc4]
push eax
lea ecx, [ebp - 0xdc90]
push ecx
lea edx, [ebp - 0xdce4]
push edx
lea eax, [ebp - 0xdd38]
push eax
push 0
lea ecx, [ebp - 0xdc70]
push ecx
lea edx, [ebp - 0xdc54]
push edx
lea eax, [ebp - 0xdc94]
push eax
mov eax, dword [ebp - 0xdd44]
lea ecx, [ebp - 0xdc98]
push ecx
mov ecx, dword [ebp - 0xdd90]
lea edx, [ebp - 0xdcd4]
push edx
push eax
push ecx
mov ecx, dword [ebp - 0xdcd0]
lea edx, [ebp - 0xdce0]
push edx
lea eax, [ebp - 0xdcb0]
push eax
push ecx
lea edx, [ebp - 0xdc3c]
push edx
mov edx, dword [ebp - 0xdc38]
lea eax, [ebp - 0xdcc8]
push eax
mov eax, dword [ebp - 0xdc28]
lea ecx, [ebp - 0x184]
push ecx
push edx
push eax
call fcn.00911220
mov esi, dword [ebp - 0xdc54]
add esp, 0x50
cmp dword [0xbc27fc], 0
mov dword [ebp - 0xdccc], eax
je 0x8e763a
mov edx, dword [ebp - 0xdc90]
mov eax, dword [ebp - 0xdc70]
lea ecx, [ebp - 0x184]
push ecx
mov ecx, dword [ebp - 0xdc94]
push edx
mov edx, dword [ebp - 0xdc98]
push eax
mov eax, dword [ebp - 0xdcd4]
push esi
push ecx
mov ecx, dword [ebp - 0xdce0]
push edx
mov edx, dword [ebp - 0xdc3c]
push eax
mov eax, dword [ebp - 0xdcc8]
push ecx
push edx
push eax
lea ecx, [ebp - 0x19f4]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x40
cmp dword [0xbd0534], 0
jne 0x8e7692
cmp dword [ebp - 0xdc70], 0
je 0x8e7692
cmp dword [ebp - 0xdc3c], 2
jne 0x8e7692
cmp dword [0xbc27fc], 0
je 0x8e768c
lea ecx, [ebp - 0x19f4]
push str._D__Resetting_Value_of_IsItInfectibleFile_to_1_as_ScanAndroidAPK__0
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov dword [ebp - 0xdc3c], edi
cmp dword [ebp - 0xdd28], 0
jne 0x8e7713
cmp dword [ebp - 0xdcf4], 0
je 0x8e76d6
test esi, esi
jne 0x8e7713
jmp 0x8e7781
test esi, esi
je 0x8e7781
cmp byte [ebp - 0x3ac], 0
je 0x8e7781
mov eax, 0xad2650
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e7713
mov eax, 0xac8844
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e7781
cmp dword [0xbc27fc], 0
je 0x8e774a
lea ecx, [ebp - 0x19f4]
push str.Forcing_PopExt_to_SCRIPT_5_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov ecx, dword [str.SCRIPT]
mov dx, word [0xad2674]
mov al, byte [0xad2676]
mov dword [ebp - 0x184], ecx
mov word [ebp - 0x180], dx
mov byte [ebp - 0x17e], al
mov dword [ebp - 0xdc94], edi
mov dword [ebp - 0xdc3c], edi
mov dword [ebp - 0xdc98], edi
cmp dword [ebp - 0xdc90], 0
jne 0x8e77c8
cmp dword [ebp - 0xdc3c], 0
jne 0x8e77bc
cmp dword [ebp - 0xdc68], edi
je 0x8e77bc
cmp dword [ebp - 0xdc84], edi
je 0x8e77bc
cmp dword [ebp - 0xdca0], edi
je 0x8e77bc
cmp dword [ebp - 0xdcac], edi
je 0x8e77bc
cmp dword [ebp - 0xdc44], 0
je 0x8e77c8
mov dword [ebp - 4], 0xffffffff
jmp 0x8e789b
cmp dword [ebp - 0xdd3c], 0
jne 0x8e7848
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e781e
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
cmp dword [0xbc27fc], 0
je 0x8df752
mov ecx, dword [0xbc27fc]
push 0
push ecx
push str._DLXCACHE__Inserted_in_CacheTree_1a_
push 0xb54ce8
jmp 0x8df74a
cmp dword [0xbc27fc], 0
je 0x8df752
mov edx, dword [0xbc27fc]
push 0
push edx
push str._DLXCACHE__NOT_Inserted_in_CacheTree_1a____DoNotCacheLocally
push 0xb54ce8
jmp 0x8df74a
cmp dword [ebp - 0xdc84], 1
je 0x8e7b48
cmp dword [ebp - 0xdca0], 1
je 0x8e7b48
cmp dword [ebp - 0xdcac], 1
je 0x8e7b48
cmp dword [ebp - 0xdc44], 0
jne 0x8e7b48
call fcn.008c19b0
shl eax, 0xa
cmp dword [ebp - 0xdc2c], eax
jbe 0x8e7b48
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7901
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e794a
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1b_
push 0xb54ce8
jmp 0x8df74a
cmp dword [0xbc27fc], 0
je 0x8e79ad
push ebx
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x19f4]
push str._GUI_Option_Not_Set__Non_Archive_File_With_Extension___s__And_Size__d
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc84], 0
jne 0x8e7b48
cmp dword [ebp - 0xdca0], 0
jne 0x8e7b48
cmp dword [ebp - 0xdcac], 0
jne 0x8e7b48
cmp dword [ebp - 0xdc44], 0
jne 0x8e7b48
call fcn.008c19b0
shl eax, 0xa
cmp dword [ebp - 0xdc2c], eax
jbe 0x8e7b48
cmp dword [0xbc27fc], 0
je 0x8e7a3b
call fcn.008c19b0
mov ecx, dword [ebp - 0xdc2c]
push eax
shr ecx, 0xa
push ecx
lea edx, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov dword [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xdc28]
push 0
lea edx, [ebp - 0x3ac]
call fcn.008bb810
add esp, 4
test eax, eax
jne 0x8e7b23
lea eax, [ebp - 0x3ac]
call fcn.008bdb90
test eax, eax
jne 0x8e7b0a
cmp dword [ebp - 0xdc3c], eax
jne 0x8e7b0a
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7a9d
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e7ae6
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1c_
push 0xb54ce8
jmp 0x8df74a
cmp dword [0xbc27fc], 0
je 0x8e7b41
mov edx, dword [0xbc27fc]
push 0
push edx
push str.Recently_ModifiedFile_With_Versionable_Resource.
jmp 0x8e7b34
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7b41
push 0
push eax
push str.Present_In_StrongIncludeList.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0xdc2c]
mov edi, 1
cmp dword [ebp - 0xdccc], 0xffffffff
jne 0x8e808e
cmp dword [ebp - 0xddfc], 0
jne 0x8e808e
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7b8b
push 0
push eax
push str.IsItSpecF_E_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0xdcc4]
push ecx
lea edx, [ebp - 0xdc90]
push edx
lea eax, [ebp - 0xdce4]
push eax
lea ecx, [ebp - 0xdd38]
push ecx
push 0
lea edx, [ebp - 0xdc70]
push edx
lea eax, [ebp - 0xdc54]
push eax
lea ecx, [ebp - 0xdc94]
push ecx
mov ecx, dword [ebp - 0xdd44]
lea edx, [ebp - 0xdc98]
push edx
mov edx, dword [ebp - 0xdd90]
lea eax, [ebp - 0xdcd4]
push eax
push ecx
push edx
mov edx, dword [ebp - 0xdcd0]
lea eax, [ebp - 0xdce0]
push eax
lea ecx, [ebp - 0xdcb0]
push ecx
push edx
lea eax, [ebp - 0xdc3c]
push eax
mov eax, dword [ebp - 0xdc38]
lea ecx, [ebp - 0xdcc8]
push ecx
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x184]
push edx
push eax
push ecx
call fcn.00911220
mov esi, dword [ebp - 0xdc54]
add esp, 0x50
cmp dword [0xbc27fc], 0
je 0x8e7c96
mov eax, dword [ebp - 0xdc90]
mov ecx, dword [ebp - 0xdc70]
lea edx, [ebp - 0x184]
push edx
mov edx, dword [ebp - 0xdc94]
push eax
mov eax, dword [ebp - 0xdc98]
push ecx
mov ecx, dword [ebp - 0xdcd4]
push esi
push edx
mov edx, dword [ebp - 0xdce0]
push eax
mov eax, dword [ebp - 0xdc3c]
push ecx
mov ecx, dword [ebp - 0xdcc8]
push edx
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x40
cmp dword [0xbd0534], 0
jne 0x8e7ced
cmp dword [ebp - 0xdc70], 0
je 0x8e7ced
cmp dword [ebp - 0xdc3c], 2
jne 0x8e7ced
cmp dword [0xbc27fc], 0
je 0x8e7ce7
lea edx, [ebp - 0x19f4]
push str._E__Resetting_Value_of_IsItInfectibleFile_to_1_as_ScanAndroidAPK__0
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov dword [ebp - 0xdc3c], edi
cmp dword [ebp - 0xdd28], 0
jne 0x8e8021
cmp dword [ebp - 0xdcf4], 0
je 0x8e7fe4
test esi, esi
jne 0x8e8021
jmp 0x8e808e
cmp eax, edi
jne 0x8e7b53
cmp dword [ebp - 0xdc78], edi
jne 0x8e7e5b
cmp dword [0xbc27fc], 0
je 0x8e7d8c
push ebx
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x19f4]
push str._GUI_Option_Set_Archive_File_With_Extension___s__And_Size__d
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xdc84], 0
jne 0x8e7b53
cmp dword [ebp - 0xdca0], 0
jne 0x8e7b53
cmp dword [ebp - 0xdcac], 0
jne 0x8e7b53
cmp dword [ebp - 0xdc44], 0
jne 0x8e7b53
call fcn.008c19b0
shl eax, 0xa
cmp ebx, eax
jbe 0x8e7b53
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7dee
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e7e37
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1d_
push 0xb54ce8
jmp 0x8df74a
cmp dword [0xbc27fc], 0
je 0x8e7ea0
push ebx
lea ecx, [ebp - 0x3ac]
push ecx
lea edx, [ebp - 0x19f4]
push str._GUI_Option_Set__Non_Archive_File_With_Extension___s__And_Size__d
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x10
test eax, eax
je 0x8e7ea0
push 0
push eax
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0xdc84], 0
jne 0x8e7b53
cmp dword [ebp - 0xdca0], 0
jne 0x8e7b53
cmp dword [ebp - 0xdcac], 0
jne 0x8e7b53
cmp dword [ebp - 0xdc44], 0
jne 0x8e7b53
call fcn.008c19b0
shl eax, 0xa
cmp ebx, eax
jbe 0x8e7b53
mov dword [ebp - 4], 0x1e
mov ecx, dword [ebp - 0xdc28]
push 0
lea edx, [ebp - 0x3ac]
call fcn.008bb810
add esp, 4
test eax, eax
jne 0x8e7fb3
lea eax, [ebp - 0x3ac]
call fcn.008bdb90
test eax, eax
jne 0x8e7fb3
cmp dword [ebp - 0xdc3c], eax
jne 0x8e7fb3
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e7f46
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8df752
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e7f8f
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8df752
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1e_
push 0xb54ce8
jmp 0x8df74a
mov dword [ebp - 4], 0xffffffff
jmp 0x8e7b53
test esi, esi
je 0x8e808e
cmp byte [ebp - 0x3ac], 0
je 0x8e808e
mov eax, 0xad2650
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
je 0x8e8021
mov eax, 0xac8844
lea ecx, [ebp - 0x3ac]
call fcn.0094c330
test eax, eax
jne 0x8e808e
cmp dword [0xbc27fc], 0
je 0x8e8057
lea edx, [ebp - 0x19f4]
push str.Forcing_PopExt_to_SCRIPT_6_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov edx, dword [str.SCRIPT]
mov ax, word [0xad2674]
mov cl, byte [0xad2676]
mov dword [ebp - 0x184], edx
mov word [ebp - 0x180], ax
mov byte [ebp - 0x17e], cl
mov dword [ebp - 0xdc94], edi
mov dword [ebp - 0xdc3c], edi
mov dword [ebp - 0xdc98], edi
cmp dword [ebp - 0xdc84], 0
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xdc8c], 0
jne 0x8e815f
cmp dword [ebp - 0xdca0], 0
jne 0x8e815f
cmp dword [ebp - 0xdcac], 0
jne 0x8e815f
cmp dword [ebp - 0xdc44], 0
jne 0x8e815f
cmp dword [ebp - 0xdc90], 0
je 0x8e815f
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8e3691
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00896380
mov ecx, dword [ebp - 0xdc28]
push 1
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e8129
push ebx
call fcn.00a78fec
add esp, 4
call fcn.00896390
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e3691
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_1f_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdc4c], 1
jmp 0x8df752
cmp dword [0xbc27fc], 0
je 0x8e81a0
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x19f4]
push str.Waiting_on_NAVEx__DetExt:__s_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896380
cmp dword [0xbd0b18], 0
jne 0x8e81b8
mov edi, 0xbd0b18
call fcn.0091cbd0
xor edi, edi
cmp ebx, 0xa00000
mov ebx, dword [ebp - 0xdc28]
jae 0x8e81e9
mov esi, ebx
call fcn.00966c80
test eax, eax
je 0x8e81e9
cmp dword [0xbd0af4], edi
je 0x8e81e9
cmp dword [0xbd06b8], 2
jne 0x8e81e9
mov edi, 1
cmp dword [0xbc27fc], 0
je 0x8e8252
push 0x103
lea eax, [ebp - 0x4ee3]
push 0
push eax
mov byte [ebp - 0x4ee4], 0
call fcn.00a7ffb0
mov ecx, dword [0xbd06b8]
mov edx, dword [0xbd0af4]
mov eax, dword [0xbd0b18]
add esp, 0xc
push edi
push ecx
push edx
push eax
lea ecx, [ebp - 0x4ee4]
push str.NAVEx_Locked__dwMS___ld__InfFile___d__CSExt___d__ComputeMD5___d_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x4ee4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
call fcn.00896390
cmp byte [ebp - 0x1afc], 0
jne 0x8e834c
cmp dword [ebp - 0xdda0], 0
jne 0x8e834c
test edi, edi
je 0x8e834c
xor edi, edi
cmp dword [0xb3df20], 1
jne 0x8e8299
cmp dword [ebp - 0xdc70], edi
jne 0x8e8294
cmp dword [ebp - 0xdce4], edi
je 0x8e8299
mov edi, 1
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [ebp - 0xdd10], 1
mov dword [ebp - 0xdc8c], eax
je 0x8e83dd
mov eax, 1
cmp dword [ebp - 0xdc54], eax
je 0x8e83dd
cmp dword [ebp - 0xdcb0], 0
jne 0x8e83dd
test edi, edi
jne 0x8e83dd
mov dword [ebp - 0xde9c], eax
cmp dword [0xbc27fc], edi
je 0x8e8334
push 0x3ff
lea ecx, [ebp - 0xa04b]
push edi
push ecx
mov byte [ebp - 0xa04c], 0
call fcn.00a7ffb0
add esp, 0xc
push ebx
lea edx, [ebp - 0xa04c]
push str.NonExec_NoHash:___s_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push edi
push eax
lea ecx, [ebp - 0xa04c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov byte [ebp - 0x28cc], 0
mov byte [ebp - 0x1afc], 0
mov dword [ebp - 0xdda0], 1
mov ebx, dword [ebp - 0xdcb0]
mov eax, 1
cmp dword [ebp - 0xdd10], eax
je 0x8e84a2
cmp dword [ebp - 0xdc54], eax
je 0x8e84a2
test ebx, ebx
jne 0x8e84a2
cmp byte [ebp - 0x1afc], bl
je 0x8e8750
cmp dword [0xbc27fc], ebx
je 0x8e883e
push 0x3ff
lea edx, [ebp - 0x9a43]
push ebx
push edx
mov byte [ebp - 0x9a44], bl
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp - 0xdc8c], ebx
jbe 0x8e8465
mov eax, dword [ebp - 0xdd04]
mov ecx, dword [ebp - 0xdc28]
push eax
push ecx
lea edx, [ebp - 0x9a44]
push str.NonExec_HC:__s___u_ms_
push edx
call fcn.00a78f30
add esp, 0x10
jmp 0x8e8480
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e83fb
push 0
push eax
push str.Computing_Hash_A_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb8db40], 0
je 0x8e8422
mov ecx, dword [ebp - 0xdc38]
lea edx, [ebp - 0xdd7c]
push edx
lea eax, [ebp - 0x28cc]
push eax
push ecx
lea edx, [ebp - 0x1afc]
push edx
jmp 0x8e8434
mov eax, dword [ebp - 0xdc38]
push 0
push 0
push eax
lea ecx, [ebp - 0x1afc]
push ecx
push ebx
call fcn.008bdff0
add esp, 0x14
test eax, eax
je 0x8e8334
cmp byte [ebp - 0x1afc], 0
je 0x8e8334
call esi
sub eax, dword [ebp - 0xdc8c]
mov dword [ebp - 0xdd04], eax
jmp 0x8e834c
mov eax, dword [ebp - 0xdc28]
push eax
lea ecx, [ebp - 0x9a44]
push str.NonExec_HC:__s
push ecx
call fcn.00a78f30
add esp, 0xc
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x9a44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e8750
xor esi, esi
cmp dword [ebp - 0xdd84], esi
jne 0x8e857f
test ebx, ebx
je 0x8e857f
mov ecx, dword [ebp - 0xdc2c]
add ecx, 0xffff0fff
cmp ecx, 0x9ffe
ja 0x8e857f
lea edx, [ebp - 0x7cc]
push 0x2e
push edx
call fcn.00a7a2c0
mov edi, eax
add esp, 8
test edi, edi
je 0x8e857f
push 5
mov eax, 0xaba8a4
lea ecx, [ebp - 0x7cc]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8e8514
mov eax, str..exe.part
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x8e857f
mov ecx, dword [ebp - 0xdc38]
call fcn.00925550
test eax, eax
je 0x8e857f
mov dword [ebp - 0xdc68], 1
mov dword [ebp - 0xdc74], 0
mov edi, dword [ebp - 0xdc50]
cmp dword [edi*4 + 0xbc280c], 0
je 0x8e86e3
cmp dword [ebp - 0xdc68], 1
jne 0x8e86e3
cmp dword [0xbc27fc], 0
je 0x8e864e
push edi
test esi, esi
je 0x8e861d
push str._ARCH___UCL__Forcing_Archive_Scan_on_ScanCon__d_
lea eax, [ebp - 0x19f4]
push eax
jmp 0x8e8629
cmp dword [ebp - 0xdc68], 0
jne 0x8e8537
cmp dword [ebp - 0xdd84], 0
jne 0x8e86e3
test ebx, ebx
je 0x8e86e3
mov eax, 0xad30bc
lea ecx, [ebp - 0x184]
call fcn.0094c3e0
test eax, eax
je 0x8e85be
cmp dword [ebp - 0xdc3c], 2
jne 0x8e86e3
call fcn.008c19b0
mov esi, dword [ebp - 0xdc2c]
shl eax, 0xa
cmp esi, eax
ja 0x8e85e0
mov esi, 1
mov dword [ebp - 0xdc68], esi
jmp 0x8e852d
call fcn.008c19b0
push eax
shr esi, 0xa
push esi
lea eax, [ebp - 0x19f4]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_UCL_2_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8e86e3
push str._ARCH___EIC__Forcing_Archive_Scan_on_ScanCon__d_
lea ecx, [ebp - 0x19f4]
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [edi*4 + 0xbc280c]
push 1
push 0x1a
push ecx
mov dword [ebp - 0xdd84], 1
call dword [0xb8da8c]
mov edx, dword [edi*4 + 0xbc280c]
add esp, 0xc
push 1
push 0x1b
push edx
call dword [0xb8da8c]
mov eax, dword [0xb392ac]
mov ecx, dword [edi*4 + 0xbc280c]
add esp, 0xc
push eax
push 0x28
push ecx
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8e86bc
mov edx, dword [edi*4 + 0xbc280c]
push 1
push 0xff0
push edx
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xb8db48], 0
jne 0x8e86ce
cmp dword [ebp - 0xdc74], 0
je 0x8e86e3
mov eax, dword [edi*4 + 0xbc280c]
push 1
push 0x57
push eax
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8e883e
push 0x3ff
lea ecx, [ebp - 0xa44b]
push 0
push ecx
mov byte [ebp - 0xa44c], 0
call fcn.00a7ffb0
mov edx, dword [ebp - 0xdc54]
mov eax, dword [ebp - 0xdd10]
mov ecx, dword [ebp - 0xdc28]
add esp, 0xc
push ebx
push edx
push eax
push ecx
lea edx, [ebp - 0xa44c]
push str.Reg_Exec:__s__FIV:_u__IAE:_u__PE:_u_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0xa44c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
cmp dword [0xbc27fc], 0
je 0x8e883e
cmp byte [ebp - 0x1afc], 0
je 0x8e883e
push 0x3ff
lea edx, [ebp - 0x7feb]
push 0
push edx
mov byte [ebp - 0x7fec], 0
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp - 0xdc8c], 0
jbe 0x8e87c9
mov eax, dword [ebp - 0xdd04]
mov ecx, dword [ebp - 0xdc28]
push ecx
lea edx, [ebp - 0x7fec]
push eax
cmp eax, 0x64
jbe 0x8e87b9
push 0xad3f6c
push edx
call fcn.00a78f30
add esp, 0x10
jmp 0x8e87dd
push str.Hash_Computed___u____s_
push edx
call fcn.00a78f30
add esp, 0x10
jmp 0x8e87dd
lea eax, [ebp - 0x7fec]
push str.Hash_Computed...
push eax
call fcn.00a78f30
add esp, 8
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x7fec]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x28cc], 0
je 0x8e883e
mov eax, dword [ebp - 0xdd7c]
push eax
lea ecx, [ebp - 0x28cc]
push ecx
lea edx, [ebp - 0x7fec]
push str.GCRHash_:__s__OL:_d_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x7fec]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
call fcn.00896380
cmp byte [ebp - 0x1afc], 0
je 0x8e8a5e
cmp dword [ebp - 0xdc84], 0
jne 0x8e8a5e
cmp dword [ebp - 0xdca0], 0
jne 0x8e8a5e
cmp dword [ebp - 0xdcac], 0
jne 0x8e8a5e
cmp dword [ebp - 0xdc44], 0
jne 0x8e8a5e
lea edi, [ebp - 0x1afc]
call fcn.008bd890
mov dword [ebp - 0xdcbc], eax
cmp eax, 1
jne 0x8e8a5e
push 0x207
lea edx, [ebp - 0x9233]
push 0
push edx
mov byte [ebp - 0x9234], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x902b]
push 0
push eax
mov byte [ebp - 0x902c], 0
call fcn.00a7ffb0
add esp, 0xc
mov ecx, 0xb8dff8
lea edx, [ebp - 0x8a14]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8e88e3
lea ecx, [ebp - 0x8a14]
call fcn.00960910
lea ecx, [ebp - 0x1afc]
push ecx
lea edx, [ebp - 0x8a14]
push edx
lea eax, [ebp - 0xb05c]
push 0xac9b30
push eax
call fcn.00a78f30
mov eax, dword [0xb3ddd0]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x8e892e
call fcn.0091ded0
mov dword [0xb3ddd0], eax
test eax, eax
je 0x8e899b
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0xb05c]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8e899b
lea ecx, [ebp - 0x1afc]
push ecx
mov ecx, dword [ebp - 0xdc2c]
push eax
mov eax, dword [ebp - 0xdc38]
lea edx, [ebp - 0xd19c]
push edx
push eax
push 0
push ecx
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x7cc]
push edx
lea eax, [ebp - 0x3ac]
push eax
push 0
push 0xb8dff8
push 1
push ecx
lea ecx, [ebp - 0x902c]
lea edx, [ebp - 0x9234]
call fcn.0091ce30
add esp, 0x30
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8e89f9
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xdc28]
push 0
push 0
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e89db
push ebx
call fcn.00a78fec
add esp, 4
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e89fe
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_2_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbc27fc]
cmp dword [ebp - 0xdcbc], 1
jne 0x8e8a1c
test eax, eax
je 0x8e368c
push 0
push eax
push str.Already_Present_In_The_HCache.
jmp 0x8e367f
xor ecx, ecx
cmp ecx, 1
jne 0x8e368c
test eax, eax
je 0x8e368c
push ecx
push eax
push str.Present_In_The_Global_Reg_Cache.
jmp 0x8e367f
call fcn.00896390
mov ebx, dword [ebp - 0xdc28]
mov esi, 1
mov dword [ebp - 4], 0x22
call fcn.00896380
cmp dword [ebp - 0xdd74], 0xffffffff
jne 0x8e8a9c
mov edi, dword [ebp - 0xdc28]
lea ebx, [ebp - 0xdd98]
call fcn.008bd470
mov dword [ebp - 0xdd74], eax
mov ebx, edi
cmp dword [ebp - 0xdd74], 0
je 0x8e8ae5
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e8ac3
push 0
push eax
push str.Already_Present_In_The_Infected_Cache.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
xor edx, edx
cmp dword [0xb38014], esi
sete dl
lea edx, [edx*8 + 2]
mov dword [ebp - 0xdc4c], edx
jmp 0x8df752
call fcn.00896390
cmp byte [ebp - 0x1afc], 0
je 0x8e8b0c
lea eax, [ebp - 0x1afc]
push eax
lea ecx, [ebp - 0x2124]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x8e8c0a
mov cl, byte [ebx]
cmp cl, 0x5c
jne 0x8e8b18
cmp byte [ebx + 1], cl
je 0x8e8b2e
cmp dword [0xbd0af4], 0
je 0x8e8b2e
cmp dword [0xbd06b8], 2
jne 0x8e8b2e
xor eax, eax
jmp 0x8e8b30
mov eax, esi
cmp dword [ebp - 0xdda0], 0
jne 0x8e8c0a
test eax, eax
jne 0x8e8c0a
cmp dword [ebp - 0xdc2c], 0xa00000
jae 0x8e8c0a
xor edi, edi
cmp cl, 0x5c
jne 0x8e8b89
cmp byte [ebx + 1], cl
jne 0x8e8b89
mov eax, dword [ebp - 0xdc38]
call fcn.00964530
test eax, eax
jne 0x8e8b89
push eax
push eax
push eax
lea edx, [ebp - 0x19f4]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8e8b89
mov edi, esi
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e8ba7
push 0
push eax
push str.Computing_Hash_B_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [ebp - 0xdc38]
push 0
push 0
push edx
lea eax, [ebp - 0x2124]
push eax
push ebx
call fcn.008bdff0
add esp, 0x14
test eax, eax
jne 0x8e8c00
cmp dword [0xbc27fc], eax
je 0x8e8c00
push ebx
lea ecx, [ebp - 0x19f4]
push str.Error_getting_hash_of__s_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp edi, esi
jne 0x8e8c0a
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.00896380
push 0x103
lea ecx, [ebp - 0x5933]
push 0
push ecx
mov byte [ebp - 0x5934], 0
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x2124], 0
je 0x8e9293
cmp dword [0xb8db24], 0
jne 0x8e9293
cmp dword [ebp - 0xdd10], 0
mov ecx, dword [ebp - 0xdc54]
jne 0x8e8c75
test ecx, ecx
jne 0x8e8c75
cmp dword [ebp - 0xdcb0], ecx
jne 0x8e8c75
cmp dword [ebp - 0xdc70], ecx
jne 0x8e8c75
cmp dword [ebp - 0xdce4], ecx
je 0x8e9293
mov eax, dword [ebp - 0xdc84]
test eax, eax
jne 0x8e921c
cmp dword [ebp - 0xdca0], eax
jne 0x8e921c
cmp dword [ebp - 0xdcac], eax
jne 0x8e921c
cmp dword [ebp - 0xdc44], eax
jne 0x8e921c
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e8cc5
push 0
push eax
push str.Searching_Clnsigns...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea edx, [ebp - 0x5934]
lea ecx, [ebp - 0x2124]
call fcn.00a51fd0
test eax, eax
je 0x8e8f8c
cmp dword [0xbc27fc], 0
je 0x8e8d1f
lea edx, [ebp - 0x5934]
push edx
lea eax, [ebp - 0x19f4]
push str.CS_:__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0x207
lea eax, [ebp - 0x8e23]
push 0
push eax
mov byte [ebp - 0x8e24], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x8603]
push 0
push ecx
mov byte [ebp - 0x8604], 0
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x1afc], 0
je 0x8e8e21
xor edi, edi
cmp dword [0xbc27fc], edi
je 0x8e8d78
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [0xb3ddd0]
cmp eax, 0xffffffff
jne 0x8e8d8c
call fcn.0091ded0
mov dword [0xb3ddd0], eax
test eax, eax
je 0x8e8e21
mov ecx, dword [ebp - 0xdc38]
lea edx, [ebp - 0x1afc]
push edx
mov edx, dword [ebp - 0xdc2c]
push 0
lea eax, [ebp - 0xd19c]
push eax
push ecx
push 0
push edx
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0x3ac]
push ecx
push 0
push 0xb8dff8
push esi
push ebx
lea ecx, [ebp - 0x8604]
lea edx, [ebp - 0x8e24]
call fcn.0091ce30
add esp, 0x30
cmp dword [0xbc27fc], 0
je 0x8e8e21
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
push eax
lea edx, [ebp - 0x19f4]
push str._BK_Inserted_into_Bkup_Tree___d_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8e8e7f
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xdc28]
push 0
push 1
mov edx, ebx
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e8e61
push ebx
call fcn.00a78fec
add esp, 4
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e8e7f
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_5_Permanent_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [ebp - 0xdc28]
push edx
lea ecx, [ebp - 0xdf48]
call fcn.00901fd0
lea eax, [ebp - 0xd19c]
push eax
lea ecx, [ebp - 0xdf48]
push ecx
lea ebx, [ebp - 0xe35c]
mov byte [ebp - 4], 0x23
call fcn.00902500
lea ebx, [ebp - 0xe200]
mov byte [ebp - 4], 0x24
call fcn.00902f00
mov eax, ebx
lea esi, [ebp - 0xdef4]
mov byte [ebp - 4], 0x25
call fcn.009020b0
mov esi, ebx
call fcn.00a703e0
lea esi, [ebp - 0xe35c]
call fcn.00a703e0
lea ecx, [ebp - 0xdf48]
mov byte [ebp - 4], 0x22
call fcn.0085d1a0
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e8f0d
push 0
push eax
push str.Inserted_in_CLCache_5a_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0xd19c]
push edx
call fcn.009d8730
add esp, 4
push 0xbd60dc
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0xbd60dc]
cmp eax, 0x14
jl 0x8e8f69
call fcn.009d8660
call fcn.009d8540
mov eax, dword [0xbc27fc]
mov dword [0xbd60dc], 0
test eax, eax
je 0x8e8f69
push 0
push eax
push str.CLCache_File_Written_5a_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00896390
lea ecx, [ebp - 0x2124]
push ecx
call fcn.009dbe70
add esp, 4
mov dword [ebp - 0xdc4c], 1
jmp 0x8df752
push 0xb52e14
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 0x2124]
push edx
lea ecx, [ebp - 0xdf2c]
call fcn.00901fd0
mov eax, dword [0xbe4cf4]
mov ecx, dword [0xbe4cdc]
or dword [ebp - 0xdce8], 1
lea edx, [ebp - 0xdeec]
push edx
lea ebx, [ebp - 0xdf2c]
mov dword [ebp - 0xded8], eax
mov dword [ebp - 0xdedc], ecx
call fcn.00902040
lea esi, [ebp - 0xdedc]
mov edi, eax
call fcn.009c1390
test al, al
je 0x8e9002
mov eax, dword [ebp - 0xdd18]
cmp eax, 0x19
jae 0x8e8ffe
cmp eax, 4
jbe 0x8e9002
test al, 1
je 0x8e9002
mov bl, 1
jmp 0x8e9004
xor bl, bl
test byte [ebp - 0xdce8], 1
je 0x8e9018
lea ecx, [ebp - 0xdf2c]
call fcn.0085d1a0
push 0xb52e14
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x8e9173
mov eax, 0x140
call fcn.00966e40
mov ebx, eax
test ebx, ebx
je 0x8e908d
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xdc28]
push 0
push 0
mov edx, ebx
mov ecx, edi
call fcn.008bd050
add esp, 8
test eax, eax
jne 0x8e906d
push ebx
call fcn.00a78fec
add esp, 4
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e9093
push 0
push eax
push str._DLXCACHE__Inserted_in_CacheTree_5a_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e9093
mov edi, dword [ebp - 0xdc28]
push edi
lea ecx, [ebp - 0xdf10]
call fcn.00901fd0
lea eax, [ebp - 0xd19c]
push eax
lea ecx, [ebp - 0xdf10]
push ecx
lea ebx, [ebp - 0xe4b8]
mov byte [ebp - 4], 0x26
call fcn.00902500
lea ebx, [ebp - 0xe0a4]
mov byte [ebp - 4], 0x27
call fcn.00902f00
mov eax, ebx
lea esi, [ebp - 0xdee4]
mov byte [ebp - 4], 0x28
call fcn.009020b0
mov esi, ebx
call fcn.00a703e0
lea esi, [ebp - 0xe4b8]
call fcn.00a703e0
lea ecx, [ebp - 0xdf10]
mov byte [ebp - 4], 0x22
call fcn.0085d1a0
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e911b
push 0
push eax
push str.Inserted_in_CLCache_5c_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea edx, [ebp - 0xd19c]
push edx
mov ecx, edi
call fcn.009d8730
add esp, 4
push 0xbd60dc
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0xbd60dc]
cmp eax, 0x14
jl 0x8e368c
call fcn.009d8660
call fcn.009d8540
mov eax, dword [0xbc27fc]
mov dword [0xbd60dc], 0
test eax, eax
je 0x8e368c
push 0
push eax
push str.CLCache_File_Written_5d_
jmp 0x8e367f
call fcn.00896390
cmp dword [0xb3df20], 1
jne 0x8e9298
cmp dword [ebp - 0xdcb0], 0
jne 0x8e91ad
cmp dword [ebp - 0xdc54], 0
jne 0x8e91ad
cmp dword [ebp - 0xdc70], 0
jne 0x8e91ad
cmp dword [ebp - 0xdce4], 0
je 0x8e9298
cmp dword [ebp - 0xdcb0], 0
mov eax, 1
mov dword [ebp - 0xdd54], eax
jne 0x8e91ca
cmp dword [ebp - 0xdc54], 0
je 0x8e91de
cmp dword [ebp - 0xdd38], 0
jne 0x8e91de
mov dword [ebp - 0xdd68], eax
jmp 0x8e9298
mov dword [ebp - 0xdd68], 0
jmp 0x8e9298
mov edx, dword [ebp - 0xdc70]
test edx, edx
jne 0x8e922e
cmp dword [ebp - 0xdce4], edx
je 0x8e9293
test eax, eax
jne 0x8e9293
cmp dword [ebp - 0xdca0], eax
jne 0x8e9293
cmp dword [ebp - 0xdcac], eax
jne 0x8e9293
cmp dword [ebp - 0xdc44], eax
jne 0x8e9293
cmp dword [0xb3df20], esi
jne 0x8e9293
mov eax, dword [ebp - 0xdcb0]
test eax, eax
jne 0x8e926c
test ecx, ecx
jne 0x8e926c
test edx, edx
jne 0x8e926c
cmp dword [ebp - 0xdce4], edx
je 0x8e9293
mov dword [ebp - 0xdd54], esi
test eax, eax
jne 0x8e927a
test ecx, ecx
je 0x8e9289
cmp dword [ebp - 0xdd38], 0
mov dword [ebp - 0xdd68], esi
je 0x8e9293
mov dword [ebp - 0xdd68], 0
call fcn.00896390
mov dword [ebp - 4], 0xffffffff
cmp dword [0xb8db4c], 2
jne 0x8e92ec
cmp dword [0xbf488c], 0
jne 0x8e92d1
push 0
push 1
push str._MONITOR_SET_FOR_SKIP_ONLY_SCANS_2_...
push 0xb54ce8
mov dword [0xbf488c], 1
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb38014]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xd
mov dword [ebp - 0xdc4c], eax
jmp 0x8df752
cmp byte [ebp - 0x7cc], 0
je 0x8e94ca
mov eax, dword [0xbd0b4c]
mov dword [ebp - 0xdd70], 0
test eax, eax
je 0x8e9311
cmp byte [eax], 0
jne 0x8e9341
mov ecx, dword [ebp - 0xdc2c]
mov edx, dword [ebp - 0xdc54]
push ecx
push edx
lea edi, [ebp - 0xdd70]
lea ebx, [ebp - 0x7cc]
lea esi, [ebp - 0x3ac]
call fcn.008bc060
add esp, 8
test eax, eax
je 0x8e94ca
xor esi, esi
call fcn.00896380
cmp dword [ebp - 0xdd70], esi
jne 0x8e93d5
mov eax, dword [0xbd0b4c]
cmp eax, esi
je 0x8e93d5
cmp byte [eax], 0
je 0x8e93d5
lea ecx, [ebp - 0xdcfc]
push ecx
push eax
mov bl, 0x2c
lea edi, [ebp - 0x9644]
mov dword [ebp - 0xdcfc], esi
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0xdcfc], 0xffffffff
je 0x8e93da
lea ecx, [ecx]
lea edx, [ebp - 0x7cc]
push edx
lea eax, [ebp - 0x9644]
push eax
call fcn.0090ae90
mov esi, eax
add esp, 8
test esi, esi
jne 0x8e93da
mov edx, dword [0xbd0b4c]
lea ecx, [ebp - 0xdcfc]
push ecx
push edx
mov bl, 0x2c
lea edi, [ebp - 0x9644]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0xdcfc], 0xffffffff
jne 0x8e9390
jmp 0x8e93da
mov esi, 1
call fcn.00896390
test esi, esi
je 0x8e94ca
cmp dword [ebp - 0xdd84], 0
jne 0x8e94ca
mov esi, dword [ebp - 0xdc50]
cmp dword [esi*4 + 0xbc280c], 0
mov edi, 1
mov dword [ebp - 0xdc74], edi
mov dword [ebp - 0xdc68], edi
je 0x8e94ca
cmp dword [0xbc27fc], 0
je 0x8e9454
push esi
lea eax, [ebp - 0x19f4]
push str._ARCH___FAS__Forcing_Archive_Scan_on_ScanCon__d_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [esi*4 + 0xbc280c]
push edi
push 0x1a
push eax
call dword [0xb8da8c]
mov ecx, dword [esi*4 + 0xbc280c]
add esp, 0xc
push edi
push 0x1b
push ecx
call dword [0xb8da8c]
mov edx, dword [0xb392ac]
mov eax, dword [esi*4 + 0xbc280c]
add esp, 0xc
push edx
push 0x28
push eax
call dword [0xb8da8c]
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8e94b6
mov ecx, dword [esi*4 + 0xbc280c]
push edi
push 0xff0
push ecx
call dword [0xb8da8c]
add esp, 0xc
mov edx, dword [esi*4 + 0xbc280c]
push edi
push 0x57
push edx
call dword [0xb8da8c]
add esp, 0xc
mov eax, dword [ebp - 0xdc50]
xor esi, esi
cmp dword [eax*4 + 0xbc280c], esi
je 0x8df752
mov dword [ebp - 0xdc48], esi
mov dword [ebp - 0xdc6c], 1
mov dword [ebp - 0xdd5c], esi
mov dword [ebp - 0xdc8c], esi
mov dword [ebp - 0xdc88], esi
mov dword [ebp - 0xdcb8], esi
mov dword [ebp - 0xdd20], esi
mov dword [ebp - 0xdd80], esi
mov dword [ebp - 0xdd78], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x207
lea ecx, [ebp - 0x1e0b]
push esi
push ecx
mov dword [ebp - 0xdd30], eax
mov byte [ebp - 0x1e0c], 0
call fcn.00a7ffb0
mov edi, dword [ebp - 0xdc50]
mov ebx, edi
imul ebx, ebx, 0xa00
add esp, 0xc
push 0xa00
mov dword [ebp - 0xdd34], esi
lea esi, [ebx + 0xbc2890]
push 0
push esi
mov dword [ebp - 4], 0x2a
call fcn.00a7ffb0
mov edx, dword [ebp - 0xdc84]
mov ecx, dword [ebp - 0xdca0]
mov eax, 1
mov dword [ebx + 0xbc3268], eax
mov dword [ebx + 0xbc3254], edx
mov edx, dword [ebp - 0xdcac]
mov dword [ebx + 0xbc3258], ecx
mov dword [ebx + 0xbc325c], edx
mov ecx, dword [ebp - 0xdc44]
mov edx, dword [ebp - 0xdd10]
mov dword [ebx + 0xbc3260], ecx
add esp, 0xc
xor ecx, ecx
mov dword [ebx + 0xbc3248], ecx
mov dword [ebx + 0xbc3218], edx
mov edx, dword [ebp - 0xdc54]
mov dword [ebx + 0xbc3224], edx
mov edx, dword [ebp - 0xdd68]
mov dword [ebx + 0xbc321c], edx
mov edx, dword [ebp - 0xdd54]
mov dword [ebx + 0xbc3220], edx
mov edx, dword [ebp - 0xdca8]
mov dword [ebx + 0xbc28ac], edx
mov edx, dword [ebp - 0xdc38]
mov dword [ebx + 0xbc28b0], edx
mov edx, dword [ebp - 0xdc30]
mov dword [ebx + 0xbc28b4], edx
mov edx, dword [ebp - 0xd19c]
mov dword [ebx + 0xbc3230], ecx
mov ecx, dword [ebp - 0xdd94]
mov dword [esi], ecx
mov ecx, dword [ebp - 0xdc2c]
mov dword [ebx + 0xbc28a4], edx
mov edx, dword [ebp - 0xdc68]
mov dword [ebx + 0xbc28a8], ecx
mov ecx, dword [ebp - 0xdc74]
mov dword [ebx + 0xbc3228], eax
mov dword [ebx + 0xbc3238], edx
mov edx, dword [ebp - 0xdddc]
mov dword [ebx + 0xbc323c], ecx
mov ecx, dword [ebp - 0xddf4]
mov dword [ebx + 0xbc322c], eax
mov eax, dword [ebp - 0xddec]
mov byte [ebx + 0xbc3271], 0
mov byte [ebx + 0xbc3272], 0
mov byte [ebx + 0xbc3273], 0
mov byte [ebx + 0xbc3274], 0
mov dword [ebx + 0xbc3278], edx
mov edx, dword [ebp - 0xdcd4]
mov dword [ebx + 0xbc324c], eax
mov eax, dword [ebp - 0xdc94]
mov dword [ebx + 0xbc3250], ecx
mov dword [ebx + 0xbc327c], edx
mov ecx, dword [ebp - 0xdc70]
mov edx, dword [ebp - 0xdc98]
mov dword [ebx + 0xbc3288], eax
mov eax, dword [ebp - 0xddfc]
mov dword [ebx + 0xbc3264], ecx
mov dword [ebx + 0xbc3280], edx
mov dword [ebx + 0xbc3284], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xdd04]
mov edx, dword [ebp - 0xdc9c]
mov dword [ebx + 0xbc2898], eax
mov dword [ebx + 0xbc289c], ecx
xor eax, eax
mov dword [ebx + 0xbc3244], eax
mov dword [ebx + 0xbc3240], eax
mov eax, dword [edi*4 + 0xbc280c]
mov dword [ebx + 0xbc328c], edx
mov dword [ebx + 0xbc28a0], eax
lea edi, [ebx + 0xbc2cc8]
mov ecx, 0x50
lea esi, [ebp - 0xd19c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x1afc]
push ecx
lea edx, [ebx + 0xbc29bc]
push edx
call esi
lea eax, [ebp - 0x2124]
push eax
lea ecx, [ebx + 0xbc2ac0]
push ecx
call esi
lea edx, [ebp - 0x28cc]
push edx
lea eax, [ebx + 0xbc2bc4]
push eax
call esi
mov ecx, dword [ebp - 0xdc28]
push 0x40f
push ecx
lea edx, [ebx + str.C:Program_FilesAccessDataFTK_Imager_ad_globals.dll]
push edx
call fcn.00a7b9de
mov edi, dword [ebp - 0xdc28]
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8e97b6
push edi
lea eax, [ebp - 0x19f4]
push str.Scanning_File:__s
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
xor ebx, ebx
push ebx
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8e97b8
xor ebx, ebx
cmp byte [str.C:PROGRA2eScanLOGFScanned.log], 0
je 0x8e9a17
push 0x103
lea eax, [ebp - 0x27c3]
push ebx
push eax
mov byte [ebp - 0x27c4], 0
call fcn.00a7ffb0
mov esi, dword [ebp - 0xdc50]
mov edx, dword [esi*4 + 0xbc280c]
add esp, 0xc
lea ecx, [ebp - 0xde80]
push ecx
push 0x1a
push edx
mov dword [ebp - 0xde80], ebx
mov dword [ebp - 0xde48], ebx
mov dword [ebp - 0xde4c], ebx
call dword [0xb8da90]
mov ecx, dword [esi*4 + 0xbc280c]
add esp, 0xc
lea eax, [ebp - 0xde48]
push eax
push 0x1b
push ecx
call dword [0xb8da90]
mov eax, dword [esi*4 + 0xbc280c]
add esp, 0xc
lea edx, [ebp - 0xde4c]
push edx
push 0x57
push eax
call dword [0xb8da90]
add esp, 0xc
cmp dword [ebp - 0xde80], ebx
je 0x8e987a
lea eax, [ebp - 0x27c4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8e9856
mov ecx, dword [str._ARCH_]
mov dx, word [0xad4250]
mov dword [eax], ecx
mov cl, byte [0xad4252]
mov word [eax + 4], dx
mov byte [eax + 6], cl
cmp dword [ebp - 0xde48], ebx
je 0x8e98b4
lea eax, [ebp - 0x27c4]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8e9890
mov edx, dword [str._MAIL_]
mov cx, word [0xad4258]
mov dword [eax], edx
mov dl, byte [0xad425a]
mov word [eax + 4], cx
mov byte [eax + 6], dl
cmp dword [ebp - 0xde4c], ebx
je 0x8e98e7
lea eax, [ebp - 0x27c4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8e98c3
mov ecx, dword [str._DEEP_]
mov dx, word [0xad4260]
mov dword [eax], ecx
mov cl, byte [0xad4262]
mov word [eax + 4], dx
mov byte [eax + 6], cl
cmp byte [ebp - 0x27c4], 0
jne 0x8e991b
lea eax, [ebp - 0x27c4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8e98f7
mov edx, dword [str._NORM_]
mov cx, word [0xad4268]
mov dword [eax], edx
mov dl, byte [0xad426a]
mov word [eax + 4], cx
mov byte [eax + 6], dl
cmp byte [ebp - 0x5b4], 0
mov esi, dword [ebp - 0xdc30]
jne 0x8e9968
cmp esi, 4
jbe 0x8e9957
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 0x208
lea edx, [ebp - 0x9dc]
push edx
lea eax, [ebp - 0x5b4]
push eax
push esi
call fcn.009bb790
add esp, 0x1c
lea ecx, [ebp - 0x5b4]
push 0x5c
push ecx
call fcn.00a7aa50
add esp, 8
cmp esi, 4
ja 0x8e9999
mov edx, dword [ebp - 0xdc2c]
mov eax, dword [ebp - 0xdd18]
push edx
push edi
push eax
lea ecx, [ebp - 0x27c4]
push ecx
lea edx, [ebp - 0x19f4]
push str._s_C:_u___s___lu___SYSTEM_
push edx
call fcn.00a78f30
add esp, 0x18
jmp 0x8e9a00
cmp byte [ebp - 0x5b4], 0
push esi
je 0x8e99d6
mov ecx, dword [ebp - 0xdc2c]
mov edx, dword [ebp - 0xdd18]
lea eax, [ebp - 0x5b4]
push eax
push ecx
push edi
push edx
lea eax, [ebp - 0x27c4]
push eax
lea ecx, [ebp - 0x19f4]
push str._s_C:_u___s___lu____s:_u_
push ecx
call fcn.00a78f30
add esp, 0x20
jmp 0x8e9a00
mov edx, dword [ebp - 0xdc2c]
mov eax, dword [ebp - 0xdd18]
push edx
push edi
push eax
lea ecx, [ebp - 0x27c4]
push ecx
lea edx, [ebp - 0x19f4]
push str._s_C:_u___s___lu___PID:_u_
push edx
call fcn.00a78f30
add esp, 0x1c
push ebx
push 1
lea eax, [ebp - 0x19f4]
push eax
push str.C:PROGRA2eScanLOGFScanned.log
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xdc28]
xor edi, edi
cmp dword [0xb3acec], 2
ja 0x8e9fe3
cmp byte [eax], 0x5c
jne 0x8e9fe3
cmp byte [eax + 1], 0x5c
jne 0x8e9fe3
mov esi, 0x2c
mov dword [ebp - 4], esi
mov dword [ebp - 0xdde4], edi
mov dword [ebp - 0xdda8], edi
cmp byte [eax], 0x5c
mov dword [ebp - 0xdcbc], edi
jne 0x8e9aea
cmp byte [eax + 1], 0x5c
jne 0x8e9aea
mov byte [ebp - 4], 0x2d
mov eax, dword [0xbf4264]
cmp eax, edi
je 0x8e9a8a
call fcn.00981220
cmp eax, 1
je 0x8e9a95
push edi
call fcn.009861f0
mov dword [0xbf4264], eax
mov dword [ebp - 4], esi
jmp 0x8e9aea
push 0x63c
xor ebx, ebx
lea ecx, [ebp - 0xdc24]
push ebx
push ecx
call fcn.00a7ffb0
mov ecx, dword [ebp - 0xdc28]
add esp, 0xc
lea edx, [ebp - 0xdc1c]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8e9b10
mov eax, dword [ebp - 0xdc38]
mov ecx, dword [ebp - 0xdc50]
mov edx, dword [ecx*4 + 0xbc280c]
mov dword [ebp - 0xd604], eax
mov eax, dword [0xbf4264]
mov dword [ebp - 0xd5f0], eax
mov eax, ecx
imul eax, eax, 0xa00
mov dword [ebp - 0xdc24], edx
mov edx, dword [ebp - 0xdd94]
mov dword [ebp - 0xd5f4], edx
lea edx, [eax + 0xbc2890]
mov dword [ebp - 0xdcd0], eax
mov eax, dword [0xbc27fc]
mov dword [ebp - 0xd600], ebx
mov dword [ebp - 0xd5fc], 1
mov dword [ebp - 0xd5f8], ebx
mov byte [ebp - 0xd80c], 0
mov dword [ebp - 0xd5ec], ebx
mov dword [ebp - 0xdc20], edx
mov dword [ecx*4 + 0xbd04bc], ebx
cmp eax, ebx
je 0x8e9bb1
push ebx
push eax
push str.Creating_Scanning_Thread
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea eax, [ebp - 0xdde4]
push eax
push ebx
lea ecx, [ebp - 0xdc24]
push ecx
push 0x8db170
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xdd24], eax
cmp eax, ebx
jne 0x8e9c3a
push 0x104
lea esi, [ebp - 0x7bec]
call fcn.00960b00
add esp, 4
mov edx, esi
push edx
lea eax, [ebp - 0x19f4]
push str.CreateThread_Fails._Reason:__s
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0xdc48], 0xc0000000
mov ebx, dword [ebp - 0xdc48]
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0xdc28]
add esp, 0x10
jmp 0x8ea56d
mov ebx, dword [ebp - 0xdde4]
push str.SCAN_THRD_4a
or esi, 0xffffffff
call fcn.0085df20
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8e9c91
mov edx, dword [ebp - 0xdde4]
push edx
lea eax, [ebp - 0x19f4]
push str.Scanning_Thread_Created_Successfully__Tid___d_.
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
jmp 0x8e9ca0
mov eax, dword [ebp - 0xdcd0]
cmp byte [eax + 0xbc3270], 0
jne 0x8e9cfe
call fcn.0094d150
inc esi
cmp esi, 0x64
jbe 0x8e9ca0
xor esi, esi
cmp dword [0xb3acec], 2
ja 0x8e9cd4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1fbd0
ja 0x8e9cf9
mov edx, dword [ebp - 0xdd24]
lea ecx, [ebp - 0xdda8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x8e9ca0
cmp dword [ebp - 0xdda8], 0x103
je 0x8e9ca0
mov edi, 0x102
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8e9d32
mov ecx, dword [ebp - 0xdcd0]
cmp byte [ecx + 0xbc3270], 1
push 0
push eax
jne 0x8e9d20
push str.Scan_CallbackStarted__True.
jmp 0x8e9d25
push str.Scan_CallbackStarted__False.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [ebp - 0xdcd0]
cmp byte [edx + 0xbc3270], 1
jne 0x8e9d5f
cmp dword [0xb3acec], 2
jbe 0x8e9dff
mov eax, dword [ebp - 0xdd24]
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp edi, 0x102
jne 0x8e9f5d
mov eax, dword [ebp - 0xdd24]
lea edx, [ebp - 0xdda8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x8e9d94
cmp dword [ebp - 0xdda8], 0x103
jne 0x8e9f5d
mov eax, dword [ebp - 0xd5ec]
mov edi, 1
test eax, eax
je 0x8e9da5
mov esi, 0xea60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 0xdcbc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xdcbc]
cmp eax, 0x2bf20
jae 0x8e9d5f
mov ecx, dword [ebp - 0xdd24]
push 0
push esi
push ecx
call ebx
mov edi, eax
cmp edi, 0x102
jne 0x8e9f5d
mov eax, dword [ebp - 0xd600]
mov ecx, dword [ebp - 0xd5fc]
mov dword [ebp - 0xdc48], eax
mov dword [ebp - 0xdc6c], ecx
cmp byte [ebp - 0xd80c], 0
je 0x8e9f9a
lea ecx, [ebp - 0xd80c]
lea edx, [ebp - 0x1e0c]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8e9f90
lea edx, [ebp - 0xdd24]
push edx
call fcn.00985290
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0xdc48]
mov edi, dword [ebp - 0xdc28]
jmp 0x8ea56d
cmp byte [eax], 0x5c
mov dword [ebp - 0xdd7c], edi
mov dword [ebp - 0xdcfc], edi
jne 0x8ea10a
cmp byte [eax + 1], 0x5c
jne 0x8ea10a
mov eax, dword [str.NETSCAN]
mov ecx, dword [0xad45f8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xdc38]
mov dword [ebp - 0x30], ecx
call fcn.00964530
test eax, eax
jne 0x8ea11b
push edi
push edi
push edi
lea edx, [ebp - 0x19f4]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8ea069
mov eax, dword [0xbc27fc]
cmp eax, edi
je 0x8ea05a
push edi
push eax
push str.IMPERSONATE:_SUCCESS
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xdcfc], 1
jmp 0x8ea11b
mov ecx, dword [0xbc27fc]
cmp ecx, edi
je 0x8ea08d
push edi
push ecx
push str.IMPERSONATE:_FAILURE__Will_get_and_pass_EXPLORER_PID_
push 0xb54ce8
call fcn.008808e0
mov ecx, dword [0xbc27fc]
add esp, 0x10
mov eax, dword [0xbf4264]
cmp eax, edi
je 0x8ea0a6
call fcn.00981220
cmp eax, 1
je 0x8ea0c9
mov ecx, dword [0xbc27fc]
cmp ecx, edi
je 0x8ea0be
push edi
push ecx
push str.GETTING_Explorer_PID
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push edi
call fcn.009861f0
mov dword [0xbf4264], eax
cmp dword [0xbc27fc], edi
je 0x8ea11b
mov edx, dword [0xbf4264]
push edx
lea eax, [ebp - 0x19f4]
push str.ExplorerPID_a_:_u
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push edi
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8ea11b
mov eax, dword [str.LOCSCAN]
mov ecx, dword [0xad467c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov eax, 1
cmp dword [0xb8db00], eax
jne 0x8ea133
mov dword [ebp - 0xdd7c], eax
call fcn.00896380
mov dword [ebp - 4], 0x30
cmp dword [0xbc27fc], edi
je 0x8ea2a5
cmp dword [0xbd06a0], 0
je 0x8ea2a5
mov edx, dword [ebp - 0xdc9c]
push edx
lea eax, [ebp - 0x19f4]
xor esi, esi
push str._SMART__FileBeingSaved:_u_
push eax
mov dword [ebp - 0xdd70], esi
mov dword [ebp - 0xdce8], esi
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
mov edi, edi
cmp ebx, dword [0xb3acec]
jae 0x8ea241
mov edx, dword [ebx*4 + 0xbc280c]
lea ecx, [ebp - 0xde54]
push ecx
push 0x1389
push edx
mov dword [ebp - 0xde5c], esi
mov dword [ebp - 0xde54], esi
call dword [0xb8da90]
mov ecx, dword [ebx*4 + 0xbc280c]
add esp, 0xc
lea eax, [ebp - 0xde5c]
push eax
push 0xfee
push ecx
call dword [0xb8da90]
mov eax, dword [ebp - 0xde54]
add esp, 0xc
cmp eax, esi
jbe 0x8ea1ec
add dword [ebp - 0xdce8], eax
mov dword [ebp - 0xdd70], 1
mov edx, dword [ebp - 0xde5c]
push edx
push eax
push ebx
lea eax, [ebp - 0x7ae4]
push str._SkF__u____u__u__
push eax
call fcn.00a78f30
lea eax, [ebp - 0x7ae4]
add esp, 0x14
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8ea211
lea edi, [ebp - 0x19f4]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8ea223
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc ebx
xor esi, esi
jmp 0x8ea180
cmp dword [ebp - 0xdd70], esi
je 0x8ea27f
mov ecx, dword [ebp - 0xdce8]
push ecx
lea edx, [ebp - 0x9f0]
push str._SMART_u_
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x9f0]
push eax
lea ecx, [ebp - 0x19f4]
push str._SMART_
push ecx
call fcn.0095e130
add esp, 0xc
mov edx, dword [0xbc27fc]
push esi
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
xor eax, eax
add esp, 0x10
cmp eax, esi
jne 0x8ea911
mov edx, dword [ebp - 0xdc38]
test edx, edx
je 0x8ea775
xor eax, eax
jne 0x8ea775
xor esi, esi
mov dword [0xb8da60], 1
mov dword [ebp - 0xde6c], eax
mov dword [ebp - 0xdd04], 5
cmp dword [0xb3ddc4], esi
je 0x8ea2fd
mov eax, dword [ebp - 0xdc28]
lea ecx, [ebp - 0xde6c]
push ecx
mov ecx, dword [ebp - 0xdc2c]
push eax
call fcn.008dcd10
add esp, 8
mov esi, eax
cmp dword [0xbc27fc], 0
mov edi, dword [ebp - 0xdc50]
je 0x8ea41d
mov edx, dword [edi*4 + 0xbc280c]
lea ecx, [ebp - 0xddb4]
push ecx
xor ebx, ebx
push 0x1a
push edx
mov dword [ebp - 0xddb4], ebx
mov dword [ebp - 0xdda4], ebx
mov dword [ebp - 0xddac], ebx
call dword [0xb8da90]
mov ecx, dword [edi*4 + 0xbc280c]
add esp, 0xc
lea eax, [ebp - 0xdda4]
push eax
push 0x1b
push ecx
call dword [0xb8da90]
mov eax, dword [edi*4 + 0xbc280c]
add esp, 0xc
lea edx, [ebp - 0xddac]
push edx
push 0x57
push eax
call dword [0xb8da90]
add esp, 0xc
cmp esi, ebx
je 0x8ea3d4
cmp dword [0xb8daac], ebx
je 0x8ea3ad
cmp dword [0xbd0524], ebx
jne 0x8ea3ad
mov ecx, dword [ebp - 0xddac]
mov edx, dword [ebp - 0xdda4]
mov eax, dword [ebp - 0xddb4]
push ecx
push edx
push eax
lea ecx, [ebp - 0x34]
push ecx
push str.__s__Scan_Obj_Buffer_Ex__Arch_u__Eml_u__Deep_u_
lea edx, [ebp - 0x19f4]
push edx
jmp 0x8ea3f9
mov eax, dword [ebp - 0xddac]
mov ecx, dword [ebp - 0xdda4]
mov edx, dword [ebp - 0xddb4]
push eax
push ecx
push edx
lea eax, [ebp - 0x34]
push eax
push str.__s__Scan_Obj_Buffer__Arch_u__Eml_u__Deep_u_
lea ecx, [ebp - 0x19f4]
push ecx
jmp 0x8ea3f9
mov edx, dword [ebp - 0xddac]
mov eax, dword [ebp - 0xdda4]
mov ecx, dword [ebp - 0xddb4]
push edx
push eax
push ecx
lea edx, [ebp - 0x34]
push edx
push str.__s__Scan_Obj_by_Handle__Arch_u__Eml_u__Deep_u_
lea eax, [ebp - 0x19f4]
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x18
push ebx
push ecx
lea edx, [ebp - 0x19f4]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test esi, esi
je 0x8ea698
cmp dword [0xb8daac], 0
mov eax, dword [ebp - 0xdc2c]
mov dword [ebp - 0xde64], eax
je 0x8ea4b8
cmp dword [0xbd0524], 0
jne 0x8ea4b8
xor ebx, ebx
lea esp, [esp]
cmp ebx, dword [ebp - 0xdd04]
jae 0x8ea51d
lea ecx, [ebp - 0xdd34]
push ecx
lea edx, [ebp - 0xdd5c]
push edx
mov edx, dword [ebp - 0xdc2c]
lea eax, [ebp - 0xdc6c]
push eax
mov eax, dword [ebp - 0xdc5c]
push 0
lea ecx, [ebp - 0xde64]
push ecx
mov ecx, dword [edi*4 + 0xbc280c]
push edx
push 0
push eax
push esi
push ecx
call dword [0xb8daac]
add esp, 0x28
mov dword [ebp - 0xdc48], eax
cmp eax, 0xc0000010
jne 0x8ea51d
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x8ea450
xor ebx, ebx
lea ebx, [ebx]
cmp ebx, dword [ebp - 0xdd04]
jae 0x8ea51d
lea edx, [ebp - 0xdd34]
push edx
lea eax, [ebp - 0xdd5c]
push eax
mov eax, dword [ebp - 0xdc2c]
lea ecx, [ebp - 0xdc6c]
push ecx
mov ecx, dword [edi*4 + 0xbc280c]
push 0
lea edx, [ebp - 0xde64]
push edx
push eax
push 0
push esi
push ecx
call dword [0xb8daa8]
add esp, 0x24
mov dword [ebp - 0xdc48], eax
cmp eax, 0xc0000010
jne 0x8ea51d
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x8ea4c0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea edx, [ebp - 0xde6c]
push edx
call fcn.00985290
mov dword [0xb8da60], 0
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0xdc28]
mov ebx, dword [ebp - 0xdc48]
mov esi, 1
cmp dword [ebp - 0xdd7c], esi
jne 0x8ea55f
call fcn.00896390
cmp dword [ebp - 0xdcfc], esi
jne 0x8ea56d
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [ebp - 0xdc50]
imul esi, esi, 0xa00
cmp dword [esi + 0xbc3268], 3
jne 0x8ea592
mov dword [ebp - 0xdc48], 0
mov ebx, dword [ebp - 0xdc48]
cmp byte [ebp - 0x1afc], 0
movzx edx, byte [esi + 0xbc3274]
mov dword [ebp - 0xdeb4], edx
jne 0x8ea5c5
cmp byte [esi + 0xbc29bc], 0
lea eax, [esi + 0xbc29bc]
je 0x8ea5c5
push eax
lea eax, [ebp - 0x1afc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x2124], 0
jne 0x8ea5eb
cmp byte [esi + 0xbc2ac0], 0
lea eax, [esi + 0xbc2ac0]
je 0x8ea5eb
push eax
lea ecx, [ebp - 0x2124]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x28cc], 0
jne 0x8ea611
cmp byte [esi + 0xbc2bc4], 0
lea eax, [esi + 0xbc2bc4]
je 0x8ea611
push eax
lea edx, [ebp - 0x28cc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x8eab71
cmp ebx, 0xc0000010
jg 0x8eaa33
je 0x8ea9df
xor esi, esi
cmp dword [ebp - 0xdcfc], esi
jne 0x8ea710
mov edi, dword [ebp - 0xdc38]
mov ebx, dword [ebp - 0xdc50]
mov edi, edi
cmp esi, dword [ebp - 0xdd04]
jae 0x8ea530
mov eax, dword [0xbf4264]
push eax
lea ecx, [ebp - 0xdd34]
push ecx
mov ecx, dword [ebx*4 + 0xbc280c]
lea edx, [ebp - 0xdd5c]
push edx
lea eax, [ebp - 0xdc6c]
push eax
push 0
push 0
push edi
push ecx
call dword [0xb8daa4]
add esp, 0x20
mov dword [ebp - 0xdc48], eax
cmp eax, 0xc0000010
jne 0x8ea530
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x8ea6b0
cmp esi, dword [ebp - 0xdd04]
jae 0x8ea530
push 0
lea edx, [ebp - 0xdd34]
push edx
mov edx, dword [ebp - 0xdc38]
lea eax, [ebp - 0xdd5c]
push eax
mov eax, dword [ebp - 0xdc50]
lea ecx, [ebp - 0xdc6c]
push ecx
mov ecx, dword [eax*4 + 0xbc280c]
push 0
push 0
push edx
push ecx
call dword [0xb8daa4]
add esp, 0x20
mov dword [ebp - 0xdc48], eax
cmp eax, 0xc0000010
jne 0x8ea530
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x8ea710
mov edx, dword [ebp - 0xdc5c]
push edx
call fcn.00a7c96a
mov esi, eax
add esp, 4
test esi, esi
je 0x8ea53a
xor eax, eax
mov dword [ebp - 0xdcbc], 5
mov edi, 0xc8
mov dword [0xb8da60], 1
cmp dword [0xbc27fc], eax
je 0x8ea862
mov ebx, dword [ebp - 0xdc50]
mov ecx, dword [ebx*4 + 0xbc280c]
mov dword [ebp - 0xde84], eax
mov dword [ebp - 0xde38], eax
mov dword [ebp - 0xde74], eax
lea eax, [ebp - 0xde84]
push eax
push 0x1a
push ecx
call dword [0xb8da90]
mov eax, dword [ebx*4 + 0xbc280c]
add esp, 0xc
lea edx, [ebp - 0xde38]
push edx
push 0x1b
push eax
call dword [0xb8da90]
mov edx, dword [ebx*4 + 0xbc280c]
add esp, 0xc
lea ecx, [ebp - 0xde74]
push ecx
push 0x57
push edx
call dword [0xb8da90]
mov eax, dword [ebp - 0xde74]
mov ecx, dword [ebp - 0xde38]
mov edx, dword [ebp - 0xde84]
add esp, 0xc
push eax
push ecx
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x19f4]
push str.__s__Scan_Obj_by_Name__Arch_u__Eml_u__Deep_u_
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
xor ebx, ebx
cmp ebx, dword [ebp - 0xdcbc]
jae 0x8ea8f9
cmp dword [ebp - 0xdcfc], 0
push 0
jne 0x8ea8ac
mov ecx, dword [0xbf4264]
push ecx
lea edx, [ebp - 0xdd34]
push edx
mov edx, dword [ebp - 0xdc50]
lea eax, [ebp - 0xdd5c]
push eax
mov eax, dword [edx*4 + 0xbc280c]
lea ecx, [ebp - 0xdc6c]
push ecx
push 0
push esi
push 0
push eax
jmp 0x8ea8d6
push 0
lea ecx, [ebp - 0xdd34]
push ecx
mov ecx, dword [ebp - 0xdc50]
lea edx, [ebp - 0xdd5c]
push edx
mov edx, dword [ecx*4 + 0xbc280c]
lea eax, [ebp - 0xdc6c]
push eax
push 0
push esi
push 0
push edx
call dword [0xb8da98]
add esp, 0x24
mov dword [ebp - 0xdc48], eax
cmp eax, 0xc0000010
jne 0x8ea8f9
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x8ea864
push esi
mov dword [0xb8da60], 0
call fcn.00a78fec
add esp, 4
jmp 0x8ea53a
cmp dword [0xbc27fc], esi
je 0x8ea53a
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x19f4]
push str.__s__Scan_Obj___IGNORED
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push esi
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8ea53a
cmp ebx, 0xc000001d
je 0x8eab31
cmp dword [0xbc27fc], 0
je 0x8eabeb
cmp byte [edi], 0x5c
jne 0x8eab98
cmp byte [esi + 0xbc3273], 1
jne 0x8eac3f
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8ecec4
push 0
push eax
push str.UnicodeToAnsi_Failed._Exiting_Callback
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb38014]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xd
mov dword [ebp - 0xdc4c], eax
mov dword [ebp - 0xdcf0], 1
jmp 0x8df752
cmp dword [0xb8db4c], edx
jne 0x8ecf1f
cmp dword [0xbf4678], ebx
jne 0x8ecf1f
push ebx
push 1
push str._MONITOR_SET_FOR_SKIP_ALL_SCANS_1_...
push 0xb54ce8
mov dword [0xbf4678], edx
call fcn.008808e0
mov ecx, dword [0xbc27fc]
mov eax, dword [0xb38014]
add esp, 0x10
cmp ecx, ebx
je 0x8ddf9c
cmp dword [0xb56814], ebx
je 0x8ecf4e
push ebx
push ecx
push str.Monitor_to_be_unloaded...
push 0xb54ce8
call fcn.008808e0
mov ecx, dword [0xbc27fc]
mov eax, dword [0xb38014]
add esp, 0x10
cmp dword [0xb567c0], ebx
je 0x8ddf9c
cmp ecx, 2
jne 0x8ddf9c
push ebx
push ecx
push str.Full_Signature_Load_Not_Complete_
jmp 0x8ddf8a
push 0x103
lea eax, [ebp - 0x3003]
push ebx
push eax
mov byte [ebp - 0x3004], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x352b]
push ebx
push ecx
mov byte [ebp - 0x352c], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [ebp - 0x352c]
call fcn.00960a40
add esp, 4
cmp dword [ebp - 0xdc28], ebx
je 0x8ed003
mov eax, dword [ebp - 0xdc28]
cmp byte [eax], bl
je 0x8ed003
mov edx, esi
push edx
push eax
lea eax, [ebp - 0x3004]
push str.Unable_to_CloseHandle_for___s_.__s
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x3004]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8df84b
lea edx, [ebp - 0x352c]
push edx
lea eax, [ebp - 0x3004]
push str.Unable_to_CloseHandle___s
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x3004]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8df84b
cmp dword [0xb567c0], ebx
je 0x8ed077
cmp eax, 2
jne 0x8ed399
push 0x103
lea ecx, [ebp - 0x222b]
push ebx
push ecx
mov byte [ebp - 0x6c], bl
mov dword [ebp - 0x6b], ebx
mov dword [ebp - 0x67], ebx
mov dword [ebp - 0x63], ebx
mov dword [ebp - 0x5f], ebx
mov dword [ebp - 0x5b], ebx
mov dword [ebp - 0x57], ebx
mov dword [ebp - 0x53], ebx
mov word [ebp - 0x4f], bx
mov byte [ebp - 0x4d], bl
mov byte [ebp - 0x222c], bl
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp - 0xdc4c], ebx
jne 0x8ed0d9
mov ecx, 8
mov esi, str.FILTER_VERDICT_NO_PRIOR_VERDICT
lea edi, [ebp - 0x222c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xddb8]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x8ed0ea
mov eax, dword [ebp - 0xdc4c]
lea ecx, [ebp - 0x222c]
call fcn.008db0d0
mov edx, dword [ebp - 0xdc2c]
fild dword [ebp - 0xdc2c]
test edx, edx
jge 0x8ed100
fadd qword [0xb0baa8]
sub esp, 8
lea eax, [ebp - 0x6c]
fstp qword [esp]
push eax
call fcn.008dce90
add esp, 0xc
cmp dword [0xbc27fc], ebx
je 0x8ed25a
cmp edi, ebx
jbe 0x8ed1ee
call esi
sub eax, edi
cmp eax, 0xfa0
jbe 0x8ed17a
call esi
sub eax, edi
push eax
cmp dword [ebp - 0xdcec], ebx
jne 0x8ed15a
mov eax, dword [ebp - 0xdca8]
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x222c]
push edx
push eax
push str._____d__Out_of_Flt_Clbk_4____s____s___u_ms_
jmp 0x8ed1be
mov ecx, dword [ebp - 0xdca8]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x222c]
push eax
push ecx
push str._____d__Out_of_Flt_Clbk_4_SUEX____s____s___u_ms_
lea edx, [ebp - 0x19f4]
push edx
jmp 0x8ed1c5
call esi
sub eax, edi
push eax
cmp dword [ebp - 0xdcec], ebx
jne 0x8ed1a7
mov edx, dword [ebp - 0xdca8]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x222c]
push ecx
push edx
push str.___d__Out_of_Flt_Clbk_4____s____s___u_ms_
lea eax, [ebp - 0x19f4]
push eax
jmp 0x8ed1c5
mov eax, dword [ebp - 0xdca8]
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x222c]
push edx
push eax
push str.___d__Out_of_Flt_Clbk_4_SUEX____s____s___u_ms_
lea ecx, [ebp - 0x19f4]
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0x18
push ebx
push edx
lea eax, [ebp - 0x19f4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8ed399
cmp dword [ebp - 0xdcec], ebx
jne 0x8ed228
mov eax, dword [ebp - 0xdca8]
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x222c]
push edx
push eax
lea ecx, [ebp - 0x19f4]
push str.___d__Out_of_Flt_Clbk_4____s____s__Start_Time_unavailable_
push ecx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push ebx
push eax
jmp 0x8ed342
mov ecx, dword [ebp - 0xdca8]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x222c]
push eax
push ecx
lea edx, [ebp - 0x19f4]
push str.___d__Out_of_Flt_Clbk_4_SUEX____s____s__Start_Time_unavailable_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push ebx
push eax
jmp 0x8ed342
cmp dword [ebp - 0xdc28], ebx
je 0x8ed3ac
cmp dword [ebp - 0xdcec], ebx
jne 0x8ed399
cmp edi, ebx
jbe 0x8ed358
call esi
mov esi, eax
sub esi, edi
mov eax, dword [0xbd06b0]
jne 0x8ed290
cmp eax, 2
je 0x8ed399
cmp eax, 2
jbe 0x8ed29d
cmp esi, eax
jb 0x8ed399
cmp eax, 0x64
jne 0x8ed311
cmp byte [0xbf4998], bl
jne 0x8ed2e2
push 0xbf4998
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0xbf4998
call fcn.00960910
push str.TFILE.BAT
push 0xbf4998
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 0xbf4998
call fcn.0094dd20
mov edx, dword [ebp - 0xdc28]
push edx
lea eax, [ebp - 0x9c4c]
push str._copy___s__b_NUL
push eax
call fcn.00a78f30
lea ecx, [ebp - 0x9c4c]
add esp, 0xc
push ecx
mov ecx, 0xbf4998
call fcn.0095b850
add esp, 4
mov ecx, dword [ebp - 0xdc28]
push esi
lea edx, [ebp - 0x6c]
push edx
mov edx, dword [ebp - 0xdca8]
lea eax, [ebp - 0x222c]
push eax
push ecx
push edx
lea eax, [ebp - 0x19f4]
push str.___d___s___s____s___u_ms_
push eax
call fcn.00a78f30
add esp, 0x1c
push ebx
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8ed399
mov ecx, dword [ebp - 0xdc28]
lea edx, [ebp - 0x6c]
push edx
mov edx, dword [ebp - 0xdca8]
lea eax, [ebp - 0x222c]
push eax
push ecx
push edx
lea eax, [ebp - 0x19f4]
push str.___d___s___s____s__Start_Time_unavailable_
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x19f4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov eax, dword [ebp - 0xdc28]
cmp eax, ebx
je 0x8ed3ac
push eax
call fcn.00a78fec
add esp, 4
mov eax, dword [ebp - 0xdcb4]
cmp eax, ebx
je 0x8ed3c5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0xbd5dc4]
test edx, edx
jle 0x8ed400
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0xbd5dc4
call esi
mov eax, dword [0xbd633c]
cmp eax, ebx
je 0x8ed400
cmp dword [ebp - 0xde14], ebx
jne 0x8ed400
mov eax, dword [eax + 4]
test eax, eax
jle 0x8ed400
mov ecx, dword [0xbd633c]
add ecx, 4
push ecx
call esi
mov edx, dword [ebp - 0xdc50]
mov eax, dword [ebp - 0xdc4c]
mov dword [edx*4 + 0xb8db8c], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret