Function at 0x867650
Capabilities:
Create thread
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb16550
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x498c
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x4954], esi
mov dword [ebp - 4], esi
cmp dword [0xbda968], esi
je 0x8676b1
push str._AVPMAPP__InitService___1
push esi
call fcn.0096a780
add esp, 8
push esi
mov ecx, 0xb5635c
call fcn.00962c70
cmp dword [0xb5635c], esi
je 0x869d76
cmp dword [0xbda968], esi
je 0x8676de
push str._AVPMAPP__InitService___2
push esi
call fcn.0096a780
add esp, 8
push esi
push 1
push 0xaae7c4
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00870060
cmp dword [0xbd04f4], esi
je 0x867715
push esi
push 1
push str._COREBD_THREADS_DISABLED...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb5659c], esi
je 0x867732
push esi
push 1
push str._AVPMAPP_THREADS_DISABLED...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbd0500], esi
je 0x8677cc
mov eax, dword [0xbd0504]
cmp eax, esi
jne 0x867765
cmp dword [0xbd0508], esi
jne 0x867761
cmp dword [0xbd050c], esi
jne 0x867761
push esi
push 1
push str._ALL_CALLBACKS_SET_TO_DUMMY...
jmp 0x8677bf
cmp eax, esi
je 0x86776f
push esi
push 1
push str._DC_FILE_SCAN_CALLBACK_Set_to_Original.
jmp 0x867777
push esi
push 1
push str._DC_FILE_SCAN_CALLBACK_SET_TO_DUMMY.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push esi
push 1
cmp dword [0xbd0508], esi
je 0x867796
push str._DC_REGISTRY_SCAN_CALLBACK_Set_to_Original.
jmp 0x86779b
push str._DC_REGISTRY_SCAN_CALLBACK_SET_TO_DUMMY.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push esi
push 1
cmp dword [0xbd050c], esi
je 0x8677ba
push str._DC_ProcessNotify_Set_to_Original.
jmp 0x8677bf
push str._DC_ProcessNotify_SET_TO_DUMMY.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbda968], esi
je 0x8677e2
push str._AVPMAPP__Into_regular_loggings...
push esi
call fcn.0096a780
add esp, 8
push esi
push 1
push str.Creating_File_Mappings
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0x758
mov ebx, dword [0xb5635c]
mov ecx, str.MwMonitor
call fcn.009630d0
mov dword [0xb5614c], eax
test eax, eax
je 0x869d63
cmp eax, 0xffffffff
je 0x869d63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x86784a
call fcn.0097ddb0
mov dword [0xb5614c], eax
test eax, eax
je 0x869d63
cmp eax, 0xffffffff
je 0x869d63
push 0x10
mov ebx, dword [0xb5635c]
mov ecx, str.MwMonitorRT
call fcn.009630d0
mov dword [0xb56254], eax
lea eax, [ebp - 0x49a4]
push eax
call fcn.0094e980
add esp, 4
xor ebx, ebx
cmp dword [0xb54184], 9
jae 0x8679c4
mov byte [ebp - 0x1570], bl
push 0x103
push ebx
lea ecx, [ebp - 0x156f]
push ecx
call fcn.00a7ffb0
push ebx
push 1
push str.Loading_Comm_Library
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
lea eax, [ebx + 1]
call fcn.00982240
mov esi, eax
mov dword [0xb565ac], esi
cmp esi, ebx
jne 0x8678da
push ebx
push 1
push str.Comm_Library_loading_failed_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8679a4
mov dword [ebp - 0x4974], ebx
mov dword [ebp - 0x4948], ebx
push 0x13c
push ebx
lea edx, [ebp - 0x4944]
push edx
call fcn.00a7ffb0
add esp, 0xc
push 0x207
push 0xb565b0
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call edi
push ebx
lea eax, [ebp - 0x4948]
push eax
lea edx, [ebp - 0x4974]
mov ecx, 0xb565b0
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x867950
lea ecx, [ebp - 0x4948]
mov edx, 0xb565b0
call fcn.0099c250
test eax, eax
jne 0x867950
push 6
mov esi, 0xb565b0
call fcn.00959ce0
add esp, 4
push 0x104
lea ecx, [ebp - 0x1570]
push ecx
push ebx
call edi
push ebx
lea edx, [ebp - 0x4948]
push edx
lea edx, [ebp - 0x4974]
lea ecx, [ebp - 0x1570]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8679a4
lea ecx, [ebp - 0x4948]
lea edx, [ebp - 0x1570]
call fcn.0099c250
test eax, eax
jne 0x8679a4
push 6
lea esi, [ebp - 0x1570]
call fcn.00959ce0
add esp, 4
push ebx
push 1
push str.Setting_AR_Entries
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0095e680
mov dword [ebp - 0x4994], ebx
call fcn.00a69fc0
push 0xb4545c
push str.ProtectKernel
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x867a01
mov eax, dword [0xb4545c]
mov esi, str.ProtectKernel
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb4545c], ebx
je 0x867b2f
push 0x80000002
lea eax, [ebp - 0x494c]
mov ecx, 1
mov edx, str.SoftwareAventail_VPN_Client
call fcn.0097f000
add esp, 4
test eax, eax
jne 0x867a59
mov eax, dword [ebp - 0x494c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0xb4545c], ebx
xor eax, eax
mov esi, str.ProtectKernel
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb4545c], ebx
je 0x867b2f
push 0x80000002
lea eax, [ebp - 0x494c]
mov ecx, 1
mov edx, str.SoftwarePlanit
call fcn.0097f000
add esp, 4
test eax, eax
jne 0x867ab1
mov ecx, dword [ebp - 0x494c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0xb4545c], ebx
xor eax, eax
mov esi, str.ProtectKernel
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb4545c], ebx
je 0x867b2f
mov byte [ebp - 0x4600], bl
push 0x7ff
push ebx
lea edx, [ebp - 0x45ff]
push edx
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x4600]
call fcn.0096e9c0
test eax, eax
je 0x867b01
mov dword [0xb4545c], ebx
xor eax, eax
mov esi, str.ProtectKernel
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb4545c], ebx
je 0x867b2f
cmp dword [0xb56804], ebx
je 0x867b2f
mov dword [0xb4545c], ebx
xor eax, eax
mov esi, str.ProtectKernel
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb5417c], ebx
je 0x867b3f
cmp dword [0xb56588], ebx
jne 0x867b5b
mov eax, dword [0xb2d47c]
mov edx, eax
inc eax
mov dword [0xb2d47c], eax
push 0x2710
push 2
call fcn.0099f230
add esp, 8
mov byte [ebp - 0x1a84], bl
push 0x103
push ebx
lea eax, [ebp - 0x1a83]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea edi, [ebp - 0x1a84]
call fcn.0093c2e0
cmp byte [ebp - 0x1a84], bl
je 0x867b9c
push ebx
push 1
mov ecx, edi
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x495c], ebx
lea edx, [ebp - 0x495c]
push edx
push str.ProPause
mov ecx, str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
mov edx, 0x80000002
call fcn.0094c0d0
cmp al, 1
jne 0x867d5d
cmp dword [ebp - 0x495c], ebx
je 0x867d5d
mov byte [ebp - 0x37e8], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x37e7]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x1160], bl
push 0x103
push ebx
lea ecx, [ebp - 0x115f]
push ecx
call fcn.00a7ffb0
add esp, 0x18
xor eax, eax
mov esi, str.ProPause
mov ebx, str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
mov ecx, 0x80000002
call fcn.0094be90
xor eax, eax
mov esi, str.ProPauseESPro
mov ecx, 0x80000002
call fcn.0094be90
call fcn.00880f20
call fcn.00a5bd90
call fcn.00a5bae0
push 0xb55508
lea edx, [ebp - 0x1160]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x1160]
call fcn.00960910
push str.eupdate.ini
lea eax, [ebp - 0x1160]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea ecx, [ebp - 0x1160]
push ecx
push 0x400
lea edx, [ebp - 0x37e8]
push edx
push 0xaa1543
push str.DoNotAllowDownload
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x37e8], 0
je 0x867ce8
push 0
push str.L0.
lea eax, [ebp - 0x37e8]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x867ce8
push 0x2c
lea ecx, [ebp - 0x37e8]
push ecx
mov ecx, str.L0.
call fcn.0098d4d0
push str.Config
lea esi, [ebp - 0x1160]
lea eax, [ebp - 0x37e8]
mov ebx, str.DoNotAllowDownload
call fcn.009584b0
add esp, 4
mov ecx, str.GlobalSecurity
call fcn.0097ddd0
mov dword [ebp - 0x494c], eax
lea edx, [ebp - 0x495c]
push edx
push str.BackUp
mov ecx, str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
mov edx, 0x80000002
call fcn.0094c0d0
cmp al, 1
jne 0x867d48
mov eax, dword [ebp - 0x495c]
mov esi, str.SecurityMode
mov ebx, str.SoftwareMicroWorldEconcealeConceal_FirewallCommon
mov ecx, 0x80000002
call fcn.0094be90
mov esi, dword [ebp - 0x494c]
cmp al, 1
jne 0x867d4e
test esi, esi
je 0x867d59
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x867d4e
mov esi, dword [ebp - 0x494c]
test esi, esi
je 0x867d59
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x867d63
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [0xb5417c], ebx
je 0x867d79
cmp dword [0xb56588], ebx
jne 0x867d95
mov eax, dword [0xb2d47c]
mov edx, eax
inc eax
mov dword [0xb2d47c], eax
push 0x2710
push 2
call fcn.0099f230
add esp, 8
push ebx
push 1
push str.Creating_AvpmApp_Events
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00869ed0
mov dword [ebp - 0x4954], eax
cmp eax, ebx
je 0x869cd4
mov byte [ebp - 0x1c8c], bl
push 0x103
push ebx
lea eax, [ebp - 0x1c8b]
push eax
call fcn.00a7ffb0
push ebx
push 1
push 0xaaeafc
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
push ebx
push 1
cmp dword [0xb5417c], ebx
je 0x867e0b
cmp dword [0xb45d94], ebx
je 0x867e04
push str.Microworld_Real_Time_File_Monitoring__DB_
jmp 0x867e10
push str.Microworld_Real_Time_File_Monitoring__AV_Plugin_Absent_
jmp 0x867e10
push str.Microworld_Real_Time_File_Monitoring__LK_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push ebx
push 1
push 0xaae7c4
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0094cfd0
mov dword [0xb1aa3c], eax
push 0xb55508
push str.C:PROGRA2eScanlicense.ini
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, str.C:PROGRA2eScanlicense.ini
call fcn.00960910
push str.license.ini
push str.C:PROGRA2eScanlicense.ini
call edi
push 0xb55508
push str.C:PROGRA2eScan_admin.ini
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, str.C:PROGRA2eScan_admin.ini
call fcn.00960910
push str.admin.ini
push str.C:PROGRA2eScan_admin.ini
call edi
cmp dword [0xb54194], ebx
je 0x867e9d
cmp dword [0xb567cc], ebx
je 0x867e9d
call fcn.00867340
push 0xb55508
push str.C:PROGRA2eScan_verinfo.ini
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, str.C:PROGRA2eScan_verinfo.ini
call fcn.00960910
push str.verinfo.ini
push str.C:PROGRA2eScan_verinfo.ini
call edi
push 1
push ebx
xor edx, edx
mov ecx, str.C:PROGRA2eScan_verinfo.ini
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x868375
mov byte [ebp - 0x634], bl
push 0x103
push ebx
lea ecx, [ebp - 0x633]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x32e4], bl
push 0x103
push ebx
lea edx, [ebp - 0x32e3]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x33e8], bl
push 0x103
push ebx
lea eax, [ebp - 0x33e7]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0xe54], bl
push 0x103
push ebx
lea ecx, [ebp - 0xe53]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x209c], bl
push 0x103
push ebx
lea edx, [ebp - 0x209b]
push edx
call fcn.00a7ffb0
push 0x104
lea eax, [ebp - 0x209c]
push eax
push 0xaa1543
mov edx, str.SNRM
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0x48
cmp byte [ebp - 0x209c], 0x31
jne 0x867f8b
mov dword [0xb567e8], 1
push 0x104
lea ecx, [ebp - 0x738]
push ecx
push 0xaa1543
mov edx, str.AppName
mov ecx, 0xaa154c
call fcn.00958d30
push ebx
push str.Rescuecom
lea edx, [ebp - 0x738]
push edx
call fcn.0095c8c0
add esp, 0x18
cmp eax, 0xffffffff
je 0x867fcf
mov dword [0xb567e4], 1
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea eax, [ebp - 0xe54]
push eax
push 0xaa1543
push str.GPDate
push str.General
call esi
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea ecx, [ebp - 0x634]
push ecx
push 0xaa1543
push str.Version
push str.General
call esi
cmp byte [ebp - 0x634], bl
je 0x868186
cmp byte [ebp - 0xe54], bl
je 0x86804b
lea edx, [ebp - 0xe54]
push edx
lea eax, [ebp - 0x634]
push eax
push str.eScan_Version:__s___s_
lea ecx, [ebp - 0x105c]
push ecx
call fcn.00a78f30
add esp, 0x10
jmp 0x868066
lea edx, [ebp - 0x634]
push edx
push str.eScan_Version:__s
lea eax, [ebp - 0x105c]
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x105c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea edx, [ebp - 0x32e4]
push edx
push 0xaa1543
push str.VersionLogged
push str.General
call esi
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea eax, [ebp - 0x33e8]
push eax
push 0xaa1543
push str.AppNameLogged
push str.General
call esi
cmp byte [ebp - 0xe54], bl
je 0x8680ed
lea ecx, [ebp - 0xe54]
push ecx
lea edx, [ebp - 0x634]
push edx
push 0xaaec0c
lea eax, [ebp - 0x105c]
push eax
call fcn.00a78f30
add esp, 0x10
jmp 0x868108
lea ecx, [ebp - 0x634]
push ecx
push 0xaa1544
lea edx, [ebp - 0x105c]
push edx
call fcn.00a78f30
add esp, 0xc
push 0xaaec14
lea eax, [ebp - 0x105c]
push eax
call edi
lea ecx, [ebp - 0x738]
push ecx
lea edx, [ebp - 0x105c]
push edx
call edi
push 0xb55918
push 0x104
lea eax, [ebp - 0x940]
push eax
push str.eScan_Configured
push 0xaaec2c
push 0xaaec30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.General
mov esi, str.C:PROGRA2eScan_verinfo.ini
lea eax, [ebp - 0x634]
mov ebx, str.VersionLogged
call fcn.009584b0
push str.General
lea eax, [ebp - 0x738]
mov ebx, str.AppNameLogged
call fcn.009584b0
add esp, 8
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xb55710
push 0xb55508
push str.eScan_Path:__s___s_
lea ecx, [ebp - 0x105c]
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x105c]
push edx
push 0xb54ce8
call fcn.008808e0
mov byte [ebp - 0x530], bl
push 0x103
push ebx
lea eax, [ebp - 0x52f]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x26b4], bl
push 0x103
push ebx
lea ecx, [ebp - 0x26b3]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x1264], bl
push 0x103
push ebx
lea edx, [ebp - 0x1263]
push edx
call fcn.00a7ffb0
add esp, 0x44
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea eax, [ebp - 0x1264]
push eax
push 0xaa1543
push str.ESPATCH_InstallDate
push str.General
call esi
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea ecx, [ebp - 0x530]
push ecx
push 0xaa1543
push str.ESPATCH
push str.General
call esi
cmp byte [ebp - 0x530], bl
je 0x868375
cmp byte [ebp - 0x1264], bl
je 0x86827c
lea edx, [ebp - 0x1264]
push edx
lea eax, [ebp - 0x530]
push eax
push str.Hotfix_Version:__s___s_
lea ecx, [ebp - 0x105c]
push ecx
call fcn.00a78f30
add esp, 0x10
jmp 0x868297
lea edx, [ebp - 0x530]
push edx
push str.Hotfix_Version:__s
lea eax, [ebp - 0x105c]
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x105c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push str.C:PROGRA2eScan_verinfo.ini
push 0x104
lea edx, [ebp - 0x26b4]
push edx
push 0xaa1543
push str.ESPVersionLogged
push str.General
call esi
lea eax, [ebp - 0x530]
lea ecx, [ebp - 0x26b4]
call fcn.0094c330
test eax, eax
je 0x868375
cmp byte [ebp - 0x1264], bl
je 0x868315
lea eax, [ebp - 0x1264]
push eax
lea ecx, [ebp - 0x530]
push ecx
push 0xaaec0c
lea edx, [ebp - 0x105c]
push edx
call fcn.00a78f30
add esp, 0x10
jmp 0x868330
lea eax, [ebp - 0x530]
push eax
push 0xaa1544
lea ecx, [ebp - 0x105c]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0xb55918
push 0x104
lea edx, [ebp - 0x940]
push edx
push str.Hotfix_Installed
push 0xaaecb8
push 0xaaec30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.General
mov esi, str.C:PROGRA2eScan_verinfo.ini
lea eax, [ebp - 0x530]
mov ebx, str.ESPVersionLogged
call fcn.009584b0
add esp, 4
xor ebx, ebx
call fcn.00970070
mov dword [0xb8db20], eax
lea eax, [ebp - 0x4950]
push eax
push str.ShowTrayIconOnTerminalClients
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8683bf
mov eax, 1
mov dword [ebp - 0x4950], eax
mov esi, str.ShowTrayIconOnTerminalClients
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea ecx, [ebp - 0x4950]
push ecx
push str.ShowTrayIcon
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8683ff
mov eax, 1
mov dword [ebp - 0x4950], eax
mov esi, str.ShowTrayIcon
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea edx, [ebp - 0x4950]
push edx
push str.VKBoardShortCutDisabled
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x86843c
mov dword [ebp - 0x4950], ebx
xor eax, eax
mov esi, str.VKBoardShortCutDisabled
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea eax, [ebp - 0x4950]
push eax
push str.PrintScreenDisabled
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x868479
mov dword [ebp - 0x4950], ebx
xor eax, eax
mov esi, str.PrintScreenDisabled
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea ecx, [ebp - 0x4950]
push ecx
push str.ShowTrayMenu
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8684b9
mov eax, 1
mov dword [ebp - 0x4950], eax
mov esi, str.ShowTrayMenu
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea edx, [ebp - 0x4950]
push edx
push str.DisableMenuItem
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8684f6
mov dword [ebp - 0x4950], ebx
xor eax, eax
mov esi, str.DisableMenuItem
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x1c8c]
push eax
push 0xaa1543
mov edx, str.ShowDesktopIcon
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
mov al, byte [ebp - 0x1c8c]
cmp al, bl
je 0x868559
sub al, 0x30
cmp al, 9
ja 0x868559
lea ecx, [ebp - 0x1c8c]
push ecx
call fcn.00a79090
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [0xb38bf4], eax
mov esi, str.ShowDesktopIcon
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push 0xb38bf4
push str.ShowDesktopIcon
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x868598
mov eax, 1
mov dword [0xb38bf4], eax
mov esi, str.ShowDesktopIcon
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
jmp 0x86859d
call fcn.00866a50
mov esi, str.OptimizeMemory
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0095f910
push 0xb436fc
push esi
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb43804
push str.MonitorPrintJobs
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x868609
xor eax, eax
cmp dword [0xb54194], ebx
setne al
mov dword [0xb43804], eax
mov esi, str.MonitorPrintJobs
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb54194], ebx
jne 0x868619
cmp dword [0xb43804], ebx
jne 0x868621
cmp dword [0xb56804], ebx
je 0x868627
mov dword [0xb43804], ebx
push 0xb54190
push str.FileRightsValue
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x86864e
mov dword [0xb54190], ebx
xor eax, eax
jmp 0x868693
cmp dword [0xb54190], ebx
je 0x8686bd
mov dword [ebp - 0x496c], ebx
lea edx, [ebp - 0x496c]
push edx
push str.FileRightsValueDefCh
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x496c], 2
je 0x8686bd
cmp dword [0xb54194], ebx
jne 0x86868e
mov dword [0xb54190], ebx
mov eax, dword [0xb54190]
mov esi, str.FileRightsValue
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov eax, 2
mov esi, str.FileRightsValueDefCh
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov esi, str.FileInfectorDetected
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0095f910
push 0xb56934
push str.FileInfectorDetectedEx
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, 4
cmp dword [0xb54190], eax
je 0x868704
cmp dword [0xb56934], ebx
je 0x868704
mov dword [0xb54190], eax
push 0xb8db58
push str.LogFilesCopiedToUSB
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x86873c
mov eax, dword [0xb8db58]
mov esi, str.LogFilesCopiedToUSB
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push 0xb391a4
push str.BlockFileRenamesToMultipleExtension
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x868774
mov eax, dword [0xb391a4]
mov esi, str.BlockFileRenamesToMultipleExtension
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb45d94], ebx
jne 0x868782
mov dword [0xb391a4], ebx
mov ebx, str.mwfsmfltr
call fcn.009605b0
mov dword [0xb56828], eax
call fcn.00a5bee0
mov dword [0xb45b64], eax
xor ebx, ebx
cmp dword [0xb56804], ebx
je 0x8687d3
push str.MWFSFLT
push 1
cmp dword [0xb56828], ebx
jne 0x8687bb
push str.MWFSM_Driver_will_Not_be_installed_as_this_is_Cluster_Server
jmp 0x8687c6
mov dword [0xb56828], ebx
push str.MWFSM_Driver_Forced_to_FALSE_as_this_is_Cluster_Server
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb56828], ebx
jne 0x868ade
cmp dword [0xb56804], ebx
jne 0x868ad2
mov al, byte [0xb8db58]
test al, 4
jne 0x86880c
cmp dword [0xb391a4], ebx
jne 0x86880c
cmp dword [0xb45b64], ebx
jne 0x86880c
test al, 3
je 0x868ad2
call fcn.009686d0
test eax, eax
je 0x868ad2
mov byte [ebp - 0x83c], bl
push 0x103
push ebx
lea eax, [ebp - 0x83b]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0xc4c], bl
push 0x103
push ebx
lea ecx, [ebp - 0xc4b]
push ecx
call fcn.00a7ffb0
add esp, 0x18
mov ecx, 0xb55508
lea edx, [ebp - 0x83c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x868857
lea ecx, [ebp - 0x83c]
call fcn.00960910
lea eax, [ebp - 0x83c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x868873
mov edx, dword [str.mwfsm_]
mov dword [eax], edx
mov cx, word [0xaaee8c]
mov word [eax + 4], cx
mov dl, byte [0xaaee8e]
mov byte [eax + 6], dl
xor ecx, ecx
lea edi, [ebp - 0x83c]
call fcn.0095a6d0
test eax, eax
je 0x868ad2
mov byte [ebp - 0x328], bl
push 0x103
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x42c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x42b]
push ecx
call fcn.00a7ffb0
add esp, 0x18
call fcn.00968110
test eax, eax
je 0x868957
mov byte [ebp - 0x27b8], bl
push 0x103
push ebx
lea edx, [ebp - 0x27b7]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x29c0], bl
push 0x103
push ebx
lea eax, [ebp - 0x29bf]
push eax
call fcn.00a7ffb0
mov ecx, edi
push ecx
push str._smwfsmfltx.sys
lea edx, [ebp - 0x27b8]
push edx
call fcn.00a78f30
mov eax, edi
push eax
push str._smwfsmflt.sys
lea ecx, [ebp - 0x29c0]
push ecx
call fcn.00a78f30
push ebx
lea edi, [ebp - 0x29c0]
lea ebx, [ebp - 0x27b8]
call fcn.00980a90
add esp, 0x34
xor ebx, ebx
lea edx, [ebp - 0x83c]
push edx
push str._smwfsmflt.inf
lea eax, [ebp - 0xc4c]
push eax
call fcn.00a78f30
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0xc4c]
call fcn.0095a0f0
add esp, 0x14
test eax, eax
jne 0x868b2c
push str.MWFSFLT
push 1
push str.Installing_MWFSMFLT_Driver...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0xc4c]
call fcn.009a2db0
mov ebx, str.mwfsmfltr
call fcn.009605b0
mov dword [0xb56828], eax
cmp byte [ebp - 0x42c], 0
je 0x8689ea
lea edx, [ebp - 0x42c]
push edx
push eax
push str.Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_._Err:__s
lea eax, [ebp - 0x328]
push eax
call fcn.00a78f30
add esp, 0x10
jmp 0x8689ff
push eax
push str.Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_
lea ecx, [ebp - 0x328]
push ecx
call fcn.00a78f30
add esp, 0xc
push str.MWFSFLT
push 1
lea edx, [ebp - 0x328]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb56828], 0
jne 0x868ad0
mov byte [ebp - 0x42c], 0
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0xc4c]
call fcn.009a3040
push str.MWFSFLT
push 1
push str.Again_Trying_To_Install_MWFSMFLT_Driver...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0xc4c]
call fcn.009a2db0
mov ebx, str.mwfsmfltr
call fcn.009605b0
mov dword [0xb56828], eax
cmp byte [ebp - 0x42c], 0
je 0x868aa0
lea ecx, [ebp - 0x42c]
push ecx
push eax
push str._A_Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_._Err:__s
lea edx, [ebp - 0x328]
push edx
call fcn.00a78f30
add esp, 0x10
jmp 0x868ab5
push eax
push str._A_Finished_Installing_MWFSMFLT_Driver__FileRightsDriverInstalled___u_
lea eax, [ebp - 0x328]
push eax
call fcn.00a78f30
add esp, 0xc
push str.MWFSFLT
push 1
lea ecx, [ebp - 0x328]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
cmp dword [0xb56828], ebx
je 0x868dc1
push 0x104
lea edx, [ebp - 0x940]
push edx
push 0xaa1543
mov edx, 0xaaf05c
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x940], 0x30
jne 0x868b64
push ebx
push 4
call fcn.0099b7b0
push ebx
mov ecx, str.eScanProtected
mov ebx, 0xb55508
call fcn.0095eb80
add esp, 0xc
xor ebx, ebx
jmp 0x868bf8
lea edx, [ebp - 0xc4c]
push edx
push str.File_Missing:__s
lea eax, [ebp - 0x328]
push eax
call fcn.00a78f30
push str.MWFSFLT
push 1
lea ecx, [ebp - 0x328]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x868ad2
mov dword [ebp - 0x4978], ebx
mov ecx, 0xb55508
lea edx, [ebp - 0x1980]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x868b75
lea ecx, [ebp - 0x1980]
call fcn.00960910
lea eax, [ebp - 0x1980]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x868b91
mov ecx, dword [str.eScanProtected.docx]
mov dword [eax], ecx
mov edx, dword [0xaaf0a8]
mov dword [eax + 4], edx
mov ecx, dword [0xaaf0ac]
mov dword [eax + 8], ecx
mov edx, dword [0xaaf0b0]
mov dword [eax + 0xc], edx
mov ecx, dword [0xaaf0b4]
mov dword [eax + 0x10], ecx
push ebx
push ebx
lea edx, [ebp - 0x4978]
lea ecx, [ebp - 0x1980]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x868bf8
cmp dword [ebp - 0x4978], ebx
jbe 0x868bf8
lea edx, [ebp - 0x1980]
push edx
push 2
call fcn.0099b7b0
add esp, 8
cmp dword [0xb56828], ebx
je 0x868dc1
call fcn.00968790
test eax, eax
je 0x868cc8
mov byte [ebp - 0x2bc8], bl
push 0x207
push ebx
lea eax, [ebp - 0x2bc7]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x2bc8]
push ecx
call fcn.0096cd00
cmp byte [ebp - 0x2bc8], bl
je 0x868cc8
mov eax, str.INFOTECH
lea ecx, [ebp - 0x2bc8]
call fcn.0094c330
test eax, eax
je 0x868c8c
push ebx
push str.icici
lea edx, [ebp - 0x2bc8]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x868c8c
lea eax, [ebp - 0x2bc8]
push eax
push str.NT_Domain:__s
lea ecx, [ebp - 0x37e8]
push ecx
call fcn.00a78f30
jmp 0x868caa
lea edx, [ebp - 0x2bc8]
push edx
push str.Forcing_FileRightsDriverInstalled_status_to_FALSE_as_Domain_is__s
lea eax, [ebp - 0x37e8]
push eax
call fcn.00a78f30
mov dword [0xb56828], ebx
add esp, 0xc
push str.MWFSFLT
push 1
lea ecx, [ebp - 0x37e8]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb56828], ebx
je 0x868dc1
mov byte [ebp - 0x23a8], bl
push 0x103
push ebx
lea edx, [ebp - 0x23a7]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x2dd0], bl
push 0x207
push ebx
lea eax, [ebp - 0x2dcf]
push eax
call fcn.00a7ffb0
push str.MWFSFLT
push 1
push str.Initializing_mwfsmflt...
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
lea ecx, [ebp - 0x23a8]
call fcn.009a5d40
test eax, eax
je 0x868d86
push str.MWFSFLT
push 1
push str.Success_Initializing_mwfsmflt...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, fcn.008808e0
test ecx, ecx
je 0x868d58
mov dword [fcn.008808e0], 0x8808e0
cmp byte [0xb54ce8], bl
je 0x868d7a
mov ecx, 0xb54ce8
mov edx, str.C:PROGRA2eScanLOGMonVir.log
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x868d70
mov dword [0xb5682c], 1
jmp 0x868dda
mov dword [0xb56828], ebx
lea edx, [ebp - 0x23a8]
push edx
push str.mwfs_Initialize_failed___s_
lea eax, [ebp - 0x2dd0]
push eax
call fcn.00a78f30
push str.MWFSFLT
push 1
lea ecx, [ebp - 0x2dd0]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x868dda
push str.MWFSFLT
push 1
push str.File_Rights_driver_is_not_installed
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb54194], ebx
jne 0x868def
test byte [0xb8db58], 0x80
je 0x86907d
push 0xb4390c
push str.SendSoftwareInstalledEvent
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x868e20
mov dword [0xb4390c], 1
mov eax, 1
jmp 0x868f73
cmp dword [0xb4390c], 2
jne 0x868f89
mov byte [ebp - 0x1368], bl
push 0x103
push ebx
lea edx, [ebp - 0x1367]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x146c], bl
push 0x103
push ebx
lea eax, [ebp - 0x146b]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x22a4], bl
push 0x103
push ebx
lea ecx, [ebp - 0x22a3]
push ecx
call fcn.00a7ffb0
add esp, 0x24
push 0xb55f40
push 0x104
lea edx, [ebp - 0x22a4]
push edx
push 0xaa1543
push str.HTTPHost
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [ebp - 0x146c]
call fcn.00956c70
test eax, eax
jne 0x868ed1
cmp byte [ebp - 0x146c], bl
je 0x868ecd
push ebx
mov eax, esi
push eax
lea ecx, [ebp - 0x22a4]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x868ed1
xor eax, eax
jmp 0x868ed6
mov eax, 1
mov dword [ebp - 0x498c], 0x104
cmp eax, ebx
jne 0x868f06
push str.LogMcst
lea eax, [ebp - 0x498c]
lea edi, [ebp - 0x1368]
mov ecx, str.SOFTWAREMicroWorldeScan_for_Windows
mov edx, 0x80000002
call fcn.0094c020
jmp 0x868f1c
lea ecx, [ebp - 0x146c]
lea edx, [ebp - 0x1368]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x868f12
cmp byte [ebp - 0x1368], bl
je 0x868f69
mov byte [ebp - 0x21a0], bl
push 0x103
push ebx
lea edx, [ebp - 0x219f]
push edx
call fcn.00a7ffb0
lea eax, [ebp - 0x1368]
push eax
push str.SoftwareMicroWorldeScan_for_Windows_s
lea ecx, [ebp - 0x21a0]
push ecx
call fcn.00a78f30
add esp, 0x18
push 0x80000002
xor eax, eax
lea edi, [ebp - 0x21a0]
call fcn.0095fbe0
mov eax, 1
mov dword [0xb4390c], eax
mov esi, str.SendSoftwareInstalledEvent
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push str.LanmanDependencyOnMonitor
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
cmp dword [0xb45d94], ebx
je 0x868ff6
push 0xb43a14
push str.LanmanDependencyOnMonitorEx
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x868ff6
cmp dword [0xb56810], ebx
jne 0x868fd9
cmp dword [0xb56804], ebx
jne 0x868fd9
mov eax, 1
jmp 0x868fdb
xor eax, eax
mov dword [0xb43a14], eax
mov esi, str.LanmanDependencyOnMonitorEx
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb43a14], 2
je 0x869015
cmp dword [0xb56810], ebx
jne 0x86900f
cmp dword [0xb56804], ebx
je 0x869015
mov dword [0xb43a14], ebx
mov dword [0xb8db18], ebx
push 0xb8db18
push str.MonitorLoadDelayInSecs
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xb43a14], 1
jne 0x86905f
cmp dword [0xb8db18], ebx
jne 0x86905f
call fcn.0099a6d0
push ebx
push 1
test eax, eax
je 0x869058
push str.Added_LanmanServer_Dependency_1_...
jmp 0x869070
push str.Unable_to_add_LanmanServer_Dependency_1_...
jmp 0x869070
call fcn.0099a860
test eax, eax
je 0x86907d
push ebx
push 1
push str.Removed_LanmanServer_Dependency_1_...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb5417c], ebx
je 0x86908d
cmp dword [0xb56588], ebx
jne 0x8690a9
mov eax, dword [0xb2d47c]
mov edx, eax
inc eax
mov dword [0xb2d47c], eax
push 0x2710
push 2
call fcn.0099f230
add esp, 8
push 0xb54188
push str.SyncTime
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8690e6
mov eax, 2
mov dword [0xb54188], eax
mov esi, str.SyncTime
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x4958], esi
mov eax, dword [0xb54188]
cmp eax, 1
je 0x8691e3
cmp eax, 2
je 0x86910a
cmp eax, 3
jne 0x8691ee
mov dword [ebp - 0x494c], ebx
mov byte [ebp - 0xa44], bl
push 0x103
push ebx
lea edx, [ebp - 0xa43]
push edx
call fcn.00a7ffb0
push str.SOFTWAREMicroWorldDeviceControlSchedule
lea eax, [ebp - 0xa44]
push eax
call fcn.00a78f30
add esp, 0x14
lea ecx, [ebp - 0x494c]
push ecx
push str.Enabled
lea ecx, [ebp - 0xa44]
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, dword [ebp - 0x494c]
cmp eax, ebx
jne 0x86919c
push str.SOFTWAREMicroWorldComponentWebScanCContentFilteringSchedule
lea edx, [ebp - 0xa44]
push edx
call fcn.00a78f30
add esp, 8
lea eax, [ebp - 0x494c]
push eax
push str.Enabled
lea ecx, [ebp - 0xa44]
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, dword [ebp - 0x494c]
cmp eax, ebx
je 0x8691ab
mov esi, 1
mov dword [ebp - 0x4958], esi
cmp eax, ebx
jne 0x8691ee
push str.SOFTWAREMicroWorldContentFilteringSchedule
lea ecx, [ebp - 0xa44]
push ecx
call fcn.00a78f30
add esp, 8
lea edx, [ebp - 0x494c]
push edx
push str.Enabled
lea ecx, [ebp - 0xa44]
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x494c], ebx
je 0x8691ee
mov esi, 1
mov dword [ebp - 0x4958], esi
cmp dword [0xb5417c], ebx
je 0x8691fe
cmp dword [0xb56588], ebx
jne 0x86921a
mov eax, dword [0xb2d47c]
mov edx, eax
inc eax
mov dword [0xb2d47c], eax
push 0x2710
push 2
call fcn.0099f230
add esp, 8
cmp esi, ebx
je 0x869255
cmp dword [0xb5659c], ebx
jne 0x869255
push ebx
push 1
push str.Started_TimeSync_Thread_1_...
push 0xb54ce8
call fcn.008808e0
push ebx
push ebx
push 0x9e4f40
call fcn.00a791b2
add esp, 0x1c
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1y
call fcn.0085df70
cmp dword [0xb4545c], ebx
jne 0x869294
cmp dword [0xb5659c], ebx
jne 0x869294
push ebx
push 1
push str.Started_Kernel_Pause_Thread...
push 0xb54ce8
call fcn.008808e0
push ebx
push ebx
push 0x86a280
call fcn.00a791b2
add esp, 0x1c
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1z
call fcn.0085df70
mov eax, dword [0xb436fc]
cmp eax, ebx
je 0x8692c8
push eax
push str.Memory_Optimization_Enabled__DWOM___u_
lea eax, [ebp - 0x940]
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x940]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8692dd
push ebx
push 1
push str.Memory_Optimization_Disabled
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov byte [ebp - 0x1b88], bl
push 0x103
push ebx
lea edx, [ebp - 0x1b87]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0xd50], bl
push 0x103
push ebx
lea eax, [ebp - 0xd4f]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x1f98], bl
push 0x103
push ebx
lea ecx, [ebp - 0x1f97]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x1e94], bl
push 0x103
push ebx
lea edx, [ebp - 0x1e93]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x39f0], bl
push 0x207
push ebx
lea eax, [ebp - 0x39ef]
push eax
call fcn.00a7ffb0
lea ecx, [ebp - 0x1e94]
push ecx
call fcn.009883d0
add esp, 0x40
push ebx
lea ecx, [ebp - 0x1b88]
call fcn.00987eb0
lea edx, [ebp - 0xd50]
push edx
lea ecx, [ebp - 0x1f98]
call fcn.00987eb0
cmp byte [ebp - 0xd50], bl
je 0x8693e1
push 0xaa1543
push str.Ver:
lea eax, [ebp - 0xd50]
push eax
call fcn.0095e130
push 0xaaf41c
push 0xaaf420
lea ecx, [ebp - 0xd50]
push ecx
call fcn.0095e130
lea edx, [ebp - 0x1e94]
push edx
lea eax, [ebp - 0xd50]
push eax
lea ecx, [ebp - 0x1b88]
push ecx
push str._s__s__Install_Date:__s_
lea edx, [ebp - 0x39f0]
push edx
call fcn.00a78f30
add esp, 0x2c
jmp 0x869403
lea eax, [ebp - 0x1e94]
push eax
lea ecx, [ebp - 0x1b88]
push ecx
push str._s__Install_Date:__s_
lea edx, [ebp - 0x39f0]
push edx
call fcn.00a78f30
add esp, 0x10
push ebx
push 1
lea eax, [ebp - 0x39f0]
push eax
push 0xb54ce8
call fcn.008808e0
mov byte [ebp - 0xb48], bl
push 0x103
push ebx
lea ecx, [ebp - 0xb47]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x2fd8], bl
push 0x207
push ebx
lea edx, [ebp - 0x2fd7]
push edx
call fcn.00a7ffb0
push 0x104
lea eax, [ebp - 0xb48]
push eax
push 0xaa1543
mov edx, str.AppName
mov ecx, 0xaa154c
call fcn.00958d30
push ebx
push str.Rescuecom
lea ecx, [ebp - 0xb48]
push ecx
call fcn.0095c8c0
add esp, 0x40
lea edx, [ebp - 0xb48]
lea ecx, [ebp - 0x2fd8]
push edx
cmp eax, 0xffffffff
mov eax, dword [0xb1aa3c]
push eax
je 0x8694aa
cmp dword [0xb54194], ebx
jne 0x8694a3
push str.eScan_Version:__u__RC__SOHO____s_
jmp 0x8694be
push str.eScan_Version:__u__RC__SMB_Corporate____s_
jmp 0x8694be
cmp dword [0xb54194], ebx
jne 0x8694b9
push str.eScan_Version:__u__SOHO____s_
jmp 0x8694be
push str.eScan_Version:__u__SMB_Corporate____s_
push ecx
call fcn.00a78f30
add esp, 0x10
push ebx
push 1
lea edx, [ebp - 0x2fd8]
push edx
push 0xb54ce8
call fcn.008808e0
mov dword [0xb56568], ebx
mov dword [ebp - 0x4954], ebx
mov dword [0xb54180], ebx
push 0xb56568
push ebx
push 0x86a380
call fcn.00a791b2
add esp, 0x1c
mov dword [0xb5656c], eax
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1u
call fcn.0085df70
cmp dword [0xb5656c], 0xffffffff
je 0x869d99
mov byte [ebp - 0x25b0], bl
push 0x207
push ebx
lea eax, [ebp - 0x25af]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x1980], bl
push 0x207
push ebx
lea ecx, [ebp - 0x197f]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x4808], bl
mov byte [ebp - 0x224], bl
push 0x207
push ebx
lea edx, [ebp - 0x223]
push edx
call fcn.00a7ffb0
add esp, 0x24
xor esi, esi
mov dword [ebp - 0x497c], esi
push 0x208
lea eax, [ebp - 0x1980]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x1980]
call fcn.00960910
cmp dword [0xb5417c], ebx
jne 0x8695b8
push str.Klif
lea ecx, [ebp - 0x1980]
push ecx
push str._sDrivers_s.sys
lea edx, [ebp - 0x25b0]
push edx
jmp 0x8695d0
push str.BdfsFltr
lea eax, [ebp - 0x1980]
push eax
push str._sDrivers_s.sys
lea ecx, [ebp - 0x25b0]
push ecx
call fcn.00a78f30
add esp, 0x10
call fcn.00968110
test eax, eax
je 0x86965d
lea edx, [ebp - 0x25b0]
push edx
call fcn.00959c40
add esp, 4
test eax, eax
je 0x869621
cmp dword [0xb5417c], ebx
jne 0x869612
push str.Klif
push str.Error:__s_Driver_ABSENT
lea eax, [ebp - 0x224]
push eax
jmp 0x8696ca
push str.BdfsFltr
push str.Error:__s_Driver_ABSENT
jmp 0x8696c3
mov esi, 1
mov dword [ebp - 0x497c], esi
cmp dword [0xb5417c], ebx
jne 0x86964a
push str.Klif
push str._s_Driver_Present
lea edx, [ebp - 0x224]
push edx
jmp 0x8696ca
push str.BdfsFltr
push str._s_Driver_Present
lea eax, [ebp - 0x224]
push eax
jmp 0x8696ca
lea ecx, [ebp - 0x25b0]
call fcn.00959b80
test eax, eax
jne 0x869693
cmp dword [0xb5417c], ebx
jne 0x869680
push str.Klif
push str.Error:__s_Driver_ABSENT
jmp 0x8696c3
push str.BdfsFltr
push str.Error:__s_Driver_ABSENT
lea edx, [ebp - 0x224]
push edx
jmp 0x8696ca
mov esi, 1
mov dword [ebp - 0x497c], esi
cmp dword [0xb5417c], ebx
jne 0x8696b9
push str.Klif
push str._s_Driver_Present
lea eax, [ebp - 0x224]
push eax
jmp 0x8696ca
push str.BdfsFltr
push str._s_Driver_Present
lea ecx, [ebp - 0x224]
push ecx
call fcn.00a78f30
add esp, 0xc
mov dword [ebp - 0x4964], ebx
xor edi, edi
mov dword [ebp - 0x4960], edi
cmp esi, ebx
je 0x869768
call fcn.00968110
test eax, eax
je 0x869728
lea edx, [ebp - 0x4964]
push edx
call fcn.009681c0
add esp, 4
cmp eax, ebx
je 0x86973b
lea ecx, [ebp - 0x25b0]
call fcn.0095a310
mov edi, eax
mov dword [ebp - 0x4960], edi
mov eax, dword [ebp - 0x4964]
push eax
call fcn.00968240
add esp, 4
jmp 0x86973b
lea ecx, [ebp - 0x25b0]
call fcn.0095a310
mov edi, eax
mov dword [ebp - 0x4960], edi
cmp esi, ebx
je 0x869768
push edi
push str.__Size:__d
lea ecx, [ebp - 0x1f98]
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x1f98]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 1
lea ecx, [ebp - 0x224]
push ecx
push 0xb54ce8
call fcn.008808e0
mov byte [ebp - 0x3bf8], bl
push 0x207
push ebx
lea edx, [ebp - 0x3bf7]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x3e00], bl
push 0x207
push ebx
lea eax, [ebp - 0x3dff]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x31e0], bl
push 0x207
push ebx
lea ecx, [ebp - 0x31df]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x1674], bl
push 0x103
push ebx
lea edx, [ebp - 0x1673]
push edx
call fcn.00a7ffb0
add esp, 0x40
mov edi, 0x104
mov dword [ebp - 0x4990], edi
mov byte [ebp - 0x940], bl
push 0x103
push ebx
lea eax, [ebp - 0x93f]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x1d90], bl
push 0x103
push ebx
lea ecx, [ebp - 0x1d8f]
push ecx
call fcn.00a7ffb0
mov byte [ebp - 0x28bc], bl
push 0x103
push ebx
lea edx, [ebp - 0x28bb]
push edx
call fcn.00a7ffb0
push ebx
lea eax, [ebp - 0x3e00]
push eax
lea esi, [ebp - 0x3bf8]
call fcn.00972a20
add esp, 0x2c
mov ecx, str.9.0.2.1669
lea edx, [ebp - 0x31e0]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x869853
cmp byte [ebp - 0x3bf8], bl
je 0x8698a2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x3bf8]
push ecx
call dword [sym.imp.USER32.dll_CharLowerA]
push eax
push str.AvpmApp_Path:___s__PID:__u_
lea edx, [ebp - 0x224]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x224]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp byte [ebp - 0x31e0], bl
je 0x8699df
mov byte [ebp - 0x1778], bl
push 0x103
push ebx
lea ecx, [ebp - 0x1777]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x4988], edi
mov dword [ebp - 0x4968], ebx
mov esi, 1
mov dword [ebp - 0x4984], esi
push str.MonitorVersion
lea eax, [ebp - 0x4988]
lea edi, [ebp - 0x1778]
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c020
cmp byte [ebp - 0x1778], bl
je 0x869953
lea eax, [ebp - 0x31e0]
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x86994b
mov edx, edi
push edx
push str.Earlier_AvpmApp_Version:___s_
lea eax, [ebp - 0x224]
push eax
call fcn.00a78f30
push ebx
push esi
lea ecx, [ebp - 0x224]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov dword [0xb5657c], esi
jmp 0x869953
xor esi, esi
mov dword [ebp - 0x4984], esi
lea edx, [ebp - 0x31e0]
push edx
push str.Current_AvpmApp_Version:___s_
lea eax, [ebp - 0x224]
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x224]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
cmp esi, ebx
je 0x8699a1
lea edx, [ebp - 0x31e0]
push edx
push 0xaa21e4
mov edx, str.MonitorVersion
mov ecx, 0x80000002
call fcn.0094bd00
lea eax, [ebp - 0x4968]
push eax
push str.MonitorBuild
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov eax, 0x685
cmp dword [ebp - 0x4968], eax
je 0x8699f8
mov esi, str.MonitorBuild
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
jmp 0x8699f8
push str.Monitor_Version_Unavailable_
push 0xaa21e4
mov edx, str.MonitorVersion
mov ecx, 0x80000002
call fcn.0094bd00
lea esi, [ebp - 0x28bc]
call fcn.009899d0
push 0x208
lea ebx, [ebp - 0x2dd0]
call fcn.00957fa0
mov esi, ebx
call fcn.00960950
mov ecx, ebx
push ecx
push str.AVS_Path:___s_
lea edx, [ebp - 0x224]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x224]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
lea ecx, [ebp - 0x4990]
lea edx, [ebp - 0x1674]
call fcn.00951c00
cmp byte [ebp - 0x1674], 0
je 0x869ab1
call fcn.009622a0
test eax, eax
je 0x869a7e
lea ecx, [ebp - 0x1674]
push ecx
push str.User:___s___ADMIN_
lea edx, [ebp - 0x224]
push edx
jmp 0x869a91
lea eax, [ebp - 0x1674]
push eax
push str.User:___s___NON_ADMIN_
lea ecx, [ebp - 0x224]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x224]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ecx, ecx
xor edx, edx
call fcn.0097ceb0
test eax, eax
je 0x869b09
push eax
lea ecx, [ebp - 0x1d90]
lea ebx, [ebp - 0x940]
call fcn.0097b130
cmp byte [ebp - 0x1d90], 0
je 0x869b09
lea eax, [ebp - 0x1d90]
push eax
push str.Parent_Process:___s_
lea ecx, [ebp - 0x224]
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x224]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov byte [ebp - 0x738], 0
push 0x103
push 0
lea eax, [ebp - 0x737]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x738]
call fcn.00983630
cmp byte [ebp - 0x738], 0
je 0x869b6a
lea ecx, [ebp - 0x738]
push ecx
push str.HostName:__s
lea edx, [ebp - 0x224]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x224]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov ebx, str.wscsvc
call fcn.009605b0
push 0
push 1
test eax, eax
jne 0x869b83
push str.WSC:_Windows_Security_Center_NOT_available.
jmp 0x869b88
push str.WSC:_Windows_Security_Center_available.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x4970], 0
xor esi, esi
call fcn.00968110
test eax, eax
je 0x869bbb
lea ecx, [ebp - 0x4970]
push ecx
call fcn.009681c0
add esp, 4
mov esi, eax
call fcn.008639f0
test esi, esi
je 0x869bd3
mov edx, dword [ebp - 0x4970]
push edx
call fcn.00968240
add esp, 4
push 0
push 1
cmp dword [0xb54194], 0
je 0x869c21
cmp dword [0xb567d4], 0
je 0x869bf0
push str.Edition:_SMB_Corporate__Secondary_Server_
jmp 0x869c26
cmp dword [0xb567cc], 0
je 0x869c10
cmp dword [0xb567d8], 0
je 0x869c09
push str.Edition:_SMB_Corporate__eScan_Client___Update_Agent_
jmp 0x869c26
push str.Edition:_SMB_Corporate__eScan_Client_
jmp 0x869c26
mov dword [0xb567d0], 1
push str.Edition:_SMB_Corporate__eScan_Primary_Server_
jmp 0x869c26
push str.Edition:_SOHO
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xb54184]
cmp eax, 9
jne 0x869c48
push 0
push 1
push str.VAL_SKELETON_CODE
jmp 0x869c76
cmp eax, 8
jne 0x869c58
push 0
push 1
push str.VAL_RETURN_WITHOUT_SCANNING_ADNC
jmp 0x869c76
cmp eax, 7
jne 0x869c68
push 0
push 1
push str.VAL_RETURN_WITHOUT_SCANNING_A
jmp 0x869c76
cmp eax, 6
jne 0x869c83
push 0
push 1
push str.VAL_DO_NOT_SET_FILTER_OPTION
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb5417c], 0
je 0x869c95
cmp dword [0xb56588], 0
jne 0x869cb1
mov eax, dword [0xb2d47c]
mov edx, eax
inc eax
mov dword [0xb2d47c], eax
push 0x7148
push 2
call fcn.0099f230
add esp, 8
mov eax, dword [0xb52018]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4954], 1
jmp 0x869d99
mov dword [ebp - 0x4980], ebx
xor esi, esi
call fcn.00968110
test eax, eax
je 0x869cf6
lea ecx, [ebp - 0x4980]
push ecx
call fcn.009681c0
add esp, 4
mov esi, eax
call fcn.008639f0
cmp esi, ebx
je 0x869d0e
mov edx, dword [ebp - 0x4980]
push edx
call fcn.00968240
add esp, 4
push ebx
push 1
push str.Error_Creating_AvpmApp_Events
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb5635c], ebx
je 0x869d35
mov esi, 0xb5635c
call fcn.009628f0
mov eax, dword [0xb5614c]
cmp eax, ebx
je 0x869d4b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0xb5614c], ebx
mov eax, dword [0xb56254]
cmp eax, ebx
je 0x869d99
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0xb56254], ebx
jmp 0x869d99
cmp dword [0xb5635c], 0
je 0x869d76
mov esi, 0xb5635c
call fcn.009628f0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x869da6
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x4954]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret