Function at 0x425170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66fe68
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x130], ebx
mov esi, 1
cmp dword [0x6b0544], esi
je 0x4255f3
cmp dword [0x67e110], ebx
je 0x42538a
push ebx
push 0x6147e0
call fcn.0050d920
mov esi, eax
push ebx
push 0x6147d4
call fcn.0050d920
add esp, 0x10
mov edi, eax
cmp esi, ebx
je 0x425216
cmp edi, ebx
je 0x425216
push ebx
push ebx
push 0x41f780
call fcn.005e07ac
push ebx
push eax
push str.AVM_1d
call fcn.00411ca0
add esp, 0x18
jmp 0x425304
call fcn.004d9930
test eax, eax
jne 0x425304
call fcn.004e2a90
cmp eax, 1
jne 0x425304
mov dword [ebp - 0x12c], ebx
call fcn.004d9950
test eax, eax
jne 0x425255
call fcn.004f78e0
test eax, eax
jne 0x425255
mov dword [ebp - 0x12c], 2
jmp 0x425270
lea eax, [ebp - 0x12c]
push eax
push str.FirewallDriverChecked
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x12c], 2
jae 0x425285
cmp esi, ebx
jne 0x425304
cmp edi, ebx
jne 0x425304
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
lea ecx, [ebp - 0x124]
push ecx
push str.FWDeRegistered
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea edx, [ebp - 0x128]
push edx
push str.FirewallRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x128], ebx
jne 0x4252f7
cmp dword [ebp - 0x124], ebx
jne 0x425304
mov dword [ebp - 0x124], 1
push 1
push str.FWDeRegistered
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6af4b8
call fcn.0054df10
add esp, 4
lea eax, [ebp - 0x124]
push eax
push str.SOFTWAREMicroWorldeScan_for_WindowsODS
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call esi
test eax, eax
jne 0x42532e
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x124]
push edx
push str.SOFTWAREMicroWorldeScan_for_WindowsBackup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x425352
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push 0x41fb50
call fcn.005e07ac
push ebx
push eax
push str.AVM_1e
call fcn.00411ca0
push ebx
push ebx
push 0x41fd60
call fcn.005e07ac
push ebx
push eax
push str.AVM_1f
call fcn.00411ca0
add esp, 0x30
mov esi, 1
call fcn.00431000
test eax, eax
je 0x425411
mov dword [0x67e10c], esi
push ebx
push ebx
push 0x41e280
call fcn.005e07ac
push ebx
push eax
push str.AVM_1g
call fcn.00411ca0
push ebx
push ebx
push 0x41ef10
call fcn.005e07ac
push ebx
push eax
push str.AVM_1h
call fcn.00411ca0
add esp, 0x30
call fcn.004d5950
test eax, eax
jne 0x425417
lea ecx, [ebp - 0x128]
push ecx
push str.ESStart
push str.SYSTEMCurrentControlSetServicesUSBSTOR
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x425417
push ebx
push ebx
push 0x41f3f0
call fcn.005e07ac
push ebx
push eax
push str.AVM_1j
call fcn.00411ca0
add esp, 0x18
jmp 0x425417
mov dword [0x67e10c], ebx
cmp dword [0x67e110], ebx
je 0x425424
call fcn.00430180
push ebx
push ebx
push 0x423070
call fcn.005e07ac
push ebx
push eax
push str.AVM_1k
call fcn.00411ca0
push ebx
push ebx
push 0x41de80
call fcn.005e07ac
push ebx
push eax
push str.AVM_1m
call fcn.00411ca0
push ebx
push ebx
push 0x41d470
call fcn.005e07ac
push ebx
push eax
push str.AVM_1mt
call fcn.00411ca0
add esp, 0x48
push ebx
push ebx
push 0x41c350
call fcn.005e07ac
push ebx
push eax
push str.AVM_1n
call fcn.00411ca0
push ebx
push ebx
push 0x41cc50
call fcn.005e07ac
push ebx
push eax
push str.AVM_1p
call fcn.00411ca0
push ebx
push ebx
push 0x4126b0
call fcn.005e07ac
push ebx
push eax
push str.AVM_1q
call fcn.00411ca0
add esp, 0x48
cmp dword [0x67e110], ebx
je 0x425525
call fcn.004d9cc0
test al, al
jne 0x4254d4
call fcn.004d9720
test eax, eax
je 0x425525
mov dword [0x6b078c], esi
lea edx, [ebp - 0x130]
push edx
push str.SafeModeLocked
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x130], esi
jne 0x425525
cmp dword [0x6b0790], ebx
jne 0x425525
call fcn.004f9630
push ebx
push ebx
push 0x41cfa0
call fcn.005e07ac
push ebx
push eax
push str.AVM_1r
call fcn.00411ca0
add esp, 0x18
cmp dword [0x6ae144], ebx
je 0x425578
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.005dfd60
push ebx
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push 0x60c81c
push str.server
push 0x60c810
call fcn.004efe40
add esp, 0x24
cmp byte [ebp - 0x120], 0x30
jne 0x425578
mov dword [0x6b0794], esi
push ebx
push ebx
push 0x421590
call fcn.005e07ac
push ebx
push eax
push str.AVM_1s
call fcn.00411ca0
add esp, 0x18
cmp dword [0x6b07b8], ebx
jne 0x4255f3
push ebx
push ebx
push 0x420260
call fcn.005e07ac
push ebx
push eax
push str.AVM_1t
call fcn.00411ca0
add esp, 0x18
cmp dword [0x67e110], ebx
je 0x4255f3
push ebx
push ebx
push 0x41ff80
call fcn.005e07ac
push ebx
push eax
push str.AVM_1u
call fcn.00411ca0
add esp, 0x18
jmp 0x4255f3
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret