Function at 0x52f760
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x1b30]
mov eax, 0x1b30
call fcn.005e00d0
push 0xfffffffffffffffe
push 0x673d28
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1b2c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x1b38]
mov dword [ebp - 0x28], eax
mov edi, dword [ebp + 0x1b40]
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
call fcn.004f0f30
add esp, 8
call fcn.004f79d0
test eax, eax
je 0x52f7fc
call fcn.004d9930
test eax, eax
jne 0x52f823
cmp dword [0x752d84], ebx
jne 0x52f823
mov dword [0x752d84], 1
push 0x752ae8
call fcn.004da7f0
add esp, 4
jmp 0x52f823
call fcn.004d9b00
test eax, eax
je 0x52f823
push 0x75ec58
push 0x651398
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.0052e3a0
mov byte [ebp + 0x1924], bl
push 0x103
push ebx
lea ecx, [ebp + 0x1925]
push ecx
call fcn.005dfd60
mov byte [ebp + 0x1820], bl
push 0x103
push ebx
lea edx, [ebp + 0x1821]
push edx
call fcn.005dfd60
mov byte [ebp + 0x1410], bl
push 0x103
push ebx
lea eax, [ebp + 0x1411]
push eax
call fcn.005dfd60
mov byte [ebp + 0x130c], bl
push 0x103
push ebx
lea ecx, [ebp + 0x130d]
push ecx
call fcn.005dfd60
add esp, 0x30
push 0x752d8c
push str.RLog
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x752d8c], ebx
je 0x52f8ce
cmp edi, ebx
je 0x52f8c0
cmp byte [edi], bl
je 0x52f8c0
push edi
push str._MONSERV__Serv_WinMain_called___s_...
push ebx
call fcn.004f0f30
add esp, 0xc
jmp 0x52f8ce
push str._MONSERV__Serv_WinMain_called__No_Params_...
push ebx
call fcn.004f0f30
add esp, 8
cmp edi, ebx
je 0x52f9e1
push str._csid
push edi
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x52f971
mov byte [ebp + 0xc00], bl
push 0x3ff
push ebx
lea edx, [ebp + 0xc01]
push edx
call fcn.005dfd60
mov byte [ebp + 0x800], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x801]
push eax
call fcn.005dfd60
mov byte [ebp + 0x400], bl
push 0x3ff
push ebx
lea ecx, [ebp + 0x401]
push ecx
call fcn.005dfd60
lea edx, [ebp + 0x400]
push edx
lea eax, [ebp + 0xc00]
push eax
lea ecx, [ebp + 0x800]
push ecx
call fcn.004fd350
add esp, 0x30
lea edx, [ebp + 0x800]
push edx
push str.CSID
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
jmp 0x53054a
cmp edi, ebx
je 0x52f9e1
push str._defend
push edi
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x52f997
push 1
push ebx
call fcn.0054cde0
add esp, 8
jmp 0x53054a
cmp edi, ebx
je 0x52f9e1
push str._defendMWAV
push edi
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x52f9c1
push 1
push str.MWAV
call fcn.0054cde0
add esp, 8
jmp 0x53054a
cmp edi, ebx
je 0x52f9e1
push str._undefend
push edi
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x52f9e1
call fcn.0054d210
jmp 0x53054a
push ebx
call fcn.004f28b0
mov esi, eax
cmp esi, ebx
je 0x52fa01
lea eax, [ebp + 0x130c]
push eax
lea ecx, [ebp + 0x1410]
push ecx
push esi
call fcn.00515670
cmp dword [0x752d8c], ebx
je 0x52fa3c
push esi
push str._MONSERV__dwParentPid___u_
push ebx
call fcn.004f0f30
lea edx, [ebp + 0x1410]
push edx
push str._MONSERV__szParentAppName___s_
push ebx
call fcn.004f0f30
lea eax, [ebp + 0x130c]
push eax
push str._MONSERV__szParentFullPath___s_
push ebx
call fcn.004f0f30
add esp, 0x24
push ebx
push ebx
lea ecx, [ebp + 0x1820]
push ecx
call fcn.005098d0
add esp, 0xc
cmp byte [ebp + 0x1820], bl
je 0x5303ef
push ebx
lea edx, [ebp + 0x1820]
push edx
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x5303ef
lea ecx, [ebp + 0x1820]
lea edx, [ebp + 0x1a28]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x52fa80
lea eax, [ebp + 0x1a28]
push eax
call fcn.004e24e0
add esp, 4
lea eax, [ebp + 0x1a28]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x52faa0
mov ecx, dword [str.win.ini]
mov dword [eax], ecx
mov edx, dword [0x64ed7c]
mov dword [eax + 4], edx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1a28]
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x52fb3e
mov byte [ebp + 0x1208], bl
push 0x103
push ebx
lea ecx, [ebp + 0x1209]
push ecx
call fcn.005dfd60
lea edx, [ebp + 0x1208]
push edx
lea eax, [ebp + 0x1a28]
push eax
call fcn.004ee8d0
add esp, 0x14
test eax, eax
je 0x52fb1d
lea ecx, [ebp + 0x1208]
push ecx
lea edx, [ebp + 0x1a28]
push edx
push str._MONSERV__Renaming_wrong_WIN.INI___s__to___s_
push ebx
call fcn.004f0f30
jmp 0x52fb3b
lea eax, [ebp + 0x1a28]
push eax
push str._MONSERV__Deleting_wrong_WIN.INI___s_
push ebx
call fcn.004f0f30
lea ecx, [ebp + 0x1a28]
push ecx
call fcn.004e0670
add esp, 0x10
cmp dword [0x752d8c], ebx
je 0x52fb5b
lea edx, [ebp + 0x1820]
push edx
push str._MONSERV__szMyDir___s_
push ebx
call fcn.004f0f30
add esp, 0xc
push 0x208
push 0x6af4b8
call fcn.004f0410
add esp, 8
cmp eax, 1
je 0x52fbc8
cmp byte [0x6af4b8], bl
jne 0x52fbc8
mov byte [ebp + 0x1104], bl
push 0x103
push ebx
lea eax, [ebp + 0x1105]
push eax
call fcn.005dfd60
push str._MONSERV__Unable_to_get_eScanInstallDir_
push ebx
call fcn.004f0f30
lea ecx, [ebp + 0x1104]
push ecx
push 0x6af4b8
call fcn.0054c640
lea edx, [ebp + 0x1104]
push edx
push str._MONSERV__eScan_Not_Present__Err:___s_
push ebx
call fcn.004f0f30
add esp, 0x28
jmp 0x53054a
cmp dword [0x752d8c], ebx
je 0x52fbe3
push 0x6af4b8
push str._MONSERV__eScanInstallDir___s_
push ebx
call fcn.004f0f30
add esp, 0xc
lea eax, [ebp + 0x1820]
push eax
call fcn.004e24e0
push 0x6af4b8
call fcn.004e24e0
add esp, 8
cmp byte [0x6aec98], bl
jne 0x52fc72
push 0x6af4b8
push str._sLOG_
push 0x6aec98
call fcn.005dfb23
push ebx
push 0x6aec98
call fcn.004e8c10
add esp, 0x14
cmp eax, 1
jne 0x52fc60
mov eax, 0x6aec98
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x52fc31
mov ecx, dword [0x61b018]
mov dword [eax], ecx
mov edx, dword [0x61b01c]
mov dword [eax + 4], edx
mov cx, word [0x61b020]
mov word [eax + 8], cx
mov dl, byte [0x61b022]
mov byte [eax + 0xa], dl
jmp 0x52fc72
push 0x61b018
push 0x6aec98
call fcn.005dfb23
add esp, 8
mov eax, dword [ebp - 0x28]
mov dword [0x752d7c], eax
mov ecx, dword [0x63ef48]
mov dword [ebp + 0x1924], ecx
mov edx, dword [0x63ef4c]
mov dword [ebp + 0x1928], edx
mov ecx, dword [0x63ef50]
mov dword [ebp + 0x192c], ecx
mov edx, dword [0x63ef54]
mov dword [ebp + 0x1930], edx
mov ecx, dword [0x63ef58]
mov dword [ebp + 0x1934], ecx
mov dx, word [0x63ef5c]
mov word [ebp + 0x1938], dx
push 0x72
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
cmp edi, ebx
je 0x52fd05
push 0x2f
push edi
call fcn.005e0940
add esp, 8
test eax, eax
je 0x52fd05
cmp dword [0x752d8c], ebx
je 0x52fcf6
push str._MONSERV__CalledByWSC___TRUE
push ebx
call fcn.004f0f30
add esp, 8
mov dword [0x752d94], 1
jmp 0x52ff4e
call fcn.004d9930
test eax, eax
jne 0x52ff4e
push 1
call fcn.0052df50
add esp, 4
test eax, eax
jne 0x52ff4e
call fcn.004e2a90
cmp eax, 1
jne 0x52ff4e
xor esi, esi
xor edi, edi
push 2
call fcn.0052e520
add esp, 4
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x24]
push eax
push str.AVRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x24], ebx
je 0x52fd63
lea esi, [edi + 1]
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x24]
push ecx
push str.FirewallRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x24], ebx
je 0x52fd88
mov edi, 1
cmp esi, ebx
je 0x52fd94
cmp edi, ebx
jne 0x52ff4e
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x20], ebx
je 0x52fdcf
push str.remove
mov esi, dword [ebp - 0x20]
push esi
call fcn.005e324f
add esp, 8
test eax, eax
je 0x52fdc3
push str._remove
push esi
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x52fdcf
mov dword [ebp - 0x30], 1
jmp 0x52ff4e
push str.wscsvc
call fcn.005110b0
test eax, eax
je 0x52ff4e
push ebx
push ebx
push str.wscsvc
call fcn.00510980
add esp, 0xc
cmp eax, 1
jle 0x52ff4e
cmp eax, 3
je 0x52ff4e
push 1
push str.wscsvc
call fcn.004d8010
add esp, 8
cmp eax, 1
jne 0x52ff3f
mov dword [ebp - 0x2c], ebx
lea edx, [ebp - 0x2c]
push edx
push str.DoNotSetSecurityStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 4
call fcn.0052e520
add esp, 4
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push str.AVRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x1c], ebx
jne 0x52fe75
cmp dword [ebp - 0x2c], ebx
jne 0x52fe9a
push 0x6af4b8
push 1
call fcn.0054d2b0
add esp, 8
jmp 0x52fe9a
cmp dword [ebp - 0x2c], ebx
je 0x52fe9a
call fcn.004d9930
test eax, eax
jne 0x52fe9a
call fcn.004e2a90
cmp eax, 1
jne 0x52fe9a
push 0x6af4b8
call fcn.0054db90
add esp, 4
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x28]
push ecx
push str.SecurityMode
push str.SOFTWAREMicroWorldeConcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push ebx
call fcn.004dc220
add esp, 4
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x28], ebx
jbe 0x52fee1
cmp esi, 1
jne 0x52fee1
push ebx
call fcn.005105a0
push ebx
call fcn.004dc220
add esp, 8
mov esi, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x1c]
push edx
push str.FirewallRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x1c], ebx
jne 0x52ff17
cmp esi, 1
je 0x52ff4e
push 0x6af4b8
push 1
call fcn.0054d7d0
add esp, 8
jmp 0x52ff4e
cmp esi, 1
jne 0x52ff4e
push 0x6af4b8
call fcn.0054df10
add esp, 4
push str.FirewallRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
jmp 0x52ff4e
push ebx
push ebx
push fcn.0052e630
call fcn.005e07ac
add esp, 0xc
mov dword [ebp - 0x48], 0x63ef48
mov dword [ebp - 0x44], 0x52f370
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov esi, dword [ebp - 0x20]
cmp esi, ebx
je 0x53014e
push str.install
push esi
call fcn.005e324f
add esp, 8
test eax, eax
je 0x52ff91
push str._install
push esi
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x52ffa5
lea eax, [ebp + 0x1924]
push eax
call fcn.0052ec60
add esp, 4
jmp 0x53054a
cmp esi, ebx
je 0x53014e
push str.unreg
push esi
call fcn.005e324f
add esp, 8
test eax, eax
je 0x52ffd1
push str._unreg
push esi
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x52ffd8
call fcn.004d9930
jmp 0x530037
cmp esi, ebx
je 0x53014e
push str.remove
push esi
call fcn.005e324f
add esp, 8
test eax, eax
je 0x530004
push str._remove
push esi
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x53005f
push ebx
push 0x63ef48
call fcn.0050d920
add esp, 8
cmp eax, 1
jne 0x53054a
call fcn.0052e070
call fcn.004d9930
test eax, eax
jne 0x53054a
push 1
call fcn.0052df50
add esp, 4
test eax, eax
jne 0x53054a
call fcn.004e2a90
cmp eax, 1
jne 0x53054a
push 0x6af4b8
call fcn.0054db90
add esp, 4
jmp 0x53054a
cmp esi, ebx
je 0x53014e
push 0x620c24
push esi
call fcn.005e324f
add esp, 8
test eax, eax
je 0x53008b
push str._start
push esi
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x5300e7
push ebx
push 0x63ef48
call fcn.0050d920
add esp, 8
cmp eax, 1
jne 0x53054a
push eax
push 0x63ef48
call fcn.004d8010
add esp, 8
test eax, eax
jne 0x53054a
push ebx
push 0x63ef48
call fcn.00510e90
add esp, 8
cmp eax, ebx
jne 0x53054a
push 1
push str.Unable_To_Start_eScan_Monitor
push 0x63ef48
call fcn.004d8c40
add esp, 0xc
jmp 0x53054a
cmp esi, ebx
je 0x53014e
push str.stop
push esi
call fcn.005e324f
add esp, 8
test eax, eax
je 0x53010f
push str._stop
push esi
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x53014e
push ebx
push 0x63ef48
call fcn.0050d920
add esp, 8
cmp eax, 1
jne 0x53054a
push eax
push 0x63ef48
call fcn.004d8010
add esp, 8
cmp eax, 1
jne 0x53054a
push eax
push ebx
push 0x63ef48
call fcn.00510c30
jmp 0x53054a
call fcn.004d9b00
mov edi, eax
push str.services.exe
lea ecx, [ebp + 0x1410]
push ecx
call fcn.005f095a
add esp, 8
push ebx
call fcn.00503120
test eax, eax
jne 0x5303e0
cmp edi, ebx
je 0x5303e0
cmp esi, ebx
je 0x53054a
cmp byte [esi], bl
je 0x53054a
mov byte [ebp + 0x1514], bl
push 0x103
push ebx
lea edx, [ebp + 0x1515]
push edx
call fcn.005dfd60
push 0x104
lea eax, [ebp + 0x1514]
push eax
call fcn.004f0410
push ebx
push 0x6513e4
push esi
call fcn.004f5880
add esp, 0x20
cmp eax, 0xffffffff
jne 0x5301e4
push ebx
push 0x6513e0
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x53028d
push ebx
push str._enable
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x53028d
mov byte [ebp + 0x1a28], bl
push 0x103
push ebx
lea ecx, [ebp + 0x1a29]
push ecx
call fcn.005dfd60
add esp, 0xc
lea edx, [ebp + 0x1514]
push edx
lea eax, [ebp + 0x1a28]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
lea ecx, [ebp + 0x1a28]
push ecx
call fcn.004e24e0
add esp, 4
push str.reload.exe
lea edx, [ebp + 0x1a28]
push edx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1a28]
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x530299
push 0x6513d4
lea ecx, [ebp + 0x1a28]
push ecx
call esi
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push ebx
lea edx, [ebp + 0x1a28]
push edx
call fcn.00506de0
add esp, 0x1c
jmp 0x530299
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push str._update
mov eax, dword [ebp - 0x20]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x53032e
mov byte [ebp + 0x1618], bl
push 0x103
push ebx
lea ecx, [ebp + 0x1619]
push ecx
call fcn.005dfd60
add esp, 0xc
lea edx, [ebp + 0x1514]
push edx
lea eax, [ebp + 0x1618]
push eax
call edi
lea ecx, [ebp + 0x1618]
push ecx
call fcn.004e24e0
add esp, 4
push str.download.exe
lea edx, [ebp + 0x1618]
push edx
call esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1618]
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x53054a
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push ebx
lea ecx, [ebp + 0x1618]
push ecx
call fcn.00506de0
add esp, 0x1c
jmp 0x53054a
push ebx
push str._launch
mov edx, dword [ebp - 0x20]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x53054a
mov byte [ebp + 0x171c], bl
push 0x103
push ebx
lea eax, [ebp + 0x171d]
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [ebp + 0x1514]
push ecx
lea edx, [ebp + 0x171c]
push edx
call edi
lea eax, [ebp + 0x171c]
push eax
call fcn.004e24e0
add esp, 4
push str.escanpro.exe
lea ecx, [ebp + 0x171c]
push ecx
call esi
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp + 0x171c]
push edx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x53054a
mov byte [ebp + 0x1000], bl
push 0x103
push ebx
lea eax, [ebp + 0x1001]
push eax
call fcn.005dfd60
add esp, 0xc
push ebx
lea ecx, [ebp + 0x1000]
push ecx
lea edx, [ebp + 0x171c]
push edx
call fcn.00510c10
jmp 0x53054a
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x53054a
push str._MONSERV__Unable_to_get_szMyDir_
push ebx
call fcn.004f0f30
add esp, 8
jmp 0x53054a
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1b2c]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x1b30
mov esp, ebp
pop ebp
ret 0x10