Function at 0x9a07a0
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x1c34]
mov eax, 0x1c34
call fcn.00a91950
push 0xfffffffffffffffe
push 0xb165b0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1c30], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x1c3c]
mov dword [ebp - 0x28], eax
mov edi, dword [ebp + 0x1c44]
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
push 0
push 0
call fcn.0096a780
add esp, 8
call fcn.00968930
test eax, eax
je 0x9a083d
call fcn.00968790
test eax, eax
jne 0x9a0864
cmp dword [0xbda960], eax
jne 0x9a0864
mov dword [0xbda960], 1
mov esi, 0xb52b54
call fcn.0096ff90
jmp 0x9a0864
call fcn.00968d70
test eax, eax
je 0x9a0864
push 0xbdd2e8
push str.SecExecDebug
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.0099f700
mov byte [ebp + 0x1a28], 0
push 0x103
push 0
lea ecx, [ebp + 0x1a29]
push ecx
call fcn.00a7ffb0
mov byte [ebp + 0x1924], 0
push 0x103
push 0
lea edx, [ebp + 0x1925]
push edx
call fcn.00a7ffb0
mov byte [ebp + 0x1114], 0
push 0x103
push 0
lea eax, [ebp + 0x1115]
push eax
call fcn.00a7ffb0
mov byte [ebp + 0xe08], 0
push 0x103
push 0
lea ecx, [ebp + 0xe09]
push ecx
call fcn.00a7ffb0
add esp, 0x30
push 0xbda968
push str.RLog
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xbda968], 0
je 0x9a091b
test edi, edi
je 0x9a090c
cmp byte [edi], 0
je 0x9a090c
push edi
push str._MONSERV__Serv_WinMain_called___s_...
push 0
call fcn.0096a780
add esp, 0xc
jmp 0x9a091b
push str._MONSERV__Serv_WinMain_called__No_Params_...
push 0
call fcn.0096a780
add esp, 8
test edi, edi
je 0x9a0d07
push str._cleanupmysa
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9a0a21
mov byte [ebp + 0x1010], al
push 0x103
push eax
lea edx, [ebp + 0x1011]
push edx
call fcn.00a7ffb0
add esp, 0xc
lea ebx, [ebp + 0x1010]
call fcn.009541a0
cmp eax, 1
jne 0x9a1868
mov dword [ebp - 0x30], 0
mov ecx, 0xb55508
call fcn.00960910
cmp byte [0xb54ce8], 0
jne 0x9a09f1
mov eax, ebx
push eax
push str._sLOG_
push 0xb54ce8
call fcn.00a78f30
add esp, 0xc
xor ecx, ecx
mov edi, 0xb54ce8
call fcn.0095a6d0
cmp eax, 1
jne 0x9a09df
mov eax, edi
dec eax
jmp 0x9a09b0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x9a09b0
mov ecx, dword [str.MonVir.log]
mov dword [eax], ecx
mov edx, dword [0xaade1c]
mov dword [eax + 4], edx
mov cx, word [0xaade20]
mov word [eax + 8], cx
mov dl, byte [0xaade22]
mov byte [eax + 0xa], dl
jmp 0x9a09f1
push str.MonVir.log
push 0xb54ce8
call fcn.00a78f30
add esp, 8
lea eax, [ebp - 0x30]
push eax
push str.Debug
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, 0xb54ce8
mov edx, ecx
call fcn.00a6abd0
add esp, 4
jmp 0x9a1868
test edi, edi
je 0x9a0d07
push str._fscanprocess
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9a0c02
mov byte [ebp + 0xc00], al
push 0x103
push eax
lea edx, [ebp + 0xc01]
push edx
call fcn.00a7ffb0
add esp, 0xc
lea ebx, [ebp + 0xc00]
call fcn.009541a0
cmp eax, 1
jne 0x9a1868
mov ecx, 0xb55508
lea edx, [ebp + 0x1b2c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x9a0a80
lea ecx, [ebp + 0x1b2c]
call fcn.00960910
push str.CLFNOEYC.DAT
lea eax, [ebp + 0x1b2c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push 1
push 0
xor edx, edx
lea ecx, [ebp + 0x1b2c]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x9a1868
lea ecx, [ebp + 0x1b2c]
push ecx
call fcn.0089eae0
push 1
push 0
xor edx, edx
lea ecx, [ebp + 0x1b2c]
call fcn.0095a0f0
add esp, 0xc
test eax, eax
jne 0x9a0bf8
push 0xb55508
lea edx, [ebp + 0x171c]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
lea ecx, [ebp + 0x171c]
call fcn.00960910
push str.CLFNOEX.DA_
lea eax, [ebp + 0x171c]
push eax
call esi
lea eax, [ebp + 0x171c]
call fcn.0094dd20
push 0xb55508
lea ecx, [ebp + 0x171c]
push ecx
call edi
lea ecx, [ebp + 0x171c]
call fcn.00960910
push str.CLFNOEX.DAT
lea edx, [ebp + 0x171c]
push edx
call esi
lea eax, [ebp + 0x171c]
call fcn.0094dd20
push 0xb55508
lea eax, [ebp + 0x171c]
push eax
call edi
lea ecx, [ebp + 0x171c]
call fcn.00960910
push str.CLFNOEXA.DAT
lea ecx, [ebp + 0x171c]
push ecx
call esi
lea eax, [ebp + 0x171c]
call fcn.0094dd20
push 0xb55508
lea edx, [ebp + 0x171c]
push edx
call edi
lea ecx, [ebp + 0x171c]
call fcn.00960910
push str.CLFNOEXC.DAT
lea eax, [ebp + 0x171c]
push eax
call esi
lea eax, [ebp + 0x171c]
call fcn.0094dd20
push 0xb55508
lea ecx, [ebp + 0x171c]
push ecx
call edi
lea ecx, [ebp + 0x171c]
call fcn.00960910
push str.CLFNOEYA.DAT
lea edx, [ebp + 0x171c]
push edx
call esi
push 0
lea edi, [ebp + 0x171c]
lea ebx, [ebp + 0x1b2c]
call fcn.00980a90
add esp, 4
call fcn.009a0350
jmp 0x9a1868
test edi, edi
je 0x9a0d07
push str._csid
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9a0ca0
mov byte [ebp], al
push 0x3ff
push eax
lea eax, [ebp + 1]
push eax
call fcn.00a7ffb0
mov byte [ebp + 0x800], 0
push 0x3ff
push 0
lea ecx, [ebp + 0x801]
push ecx
call fcn.00a7ffb0
mov byte [ebp + 0x400], 0
push 0x3ff
push 0
lea edx, [ebp + 0x401]
push edx
call fcn.00a7ffb0
lea eax, [ebp + 0x400]
push eax
lea ecx, [ebp]
push ecx
lea edx, [ebp + 0x800]
push edx
call fcn.00988d00
add esp, 0x30
lea eax, [ebp + 0x800]
push eax
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, str.CSID
mov ecx, 0x80000002
call fcn.0094bd00
jmp 0x9a1868
test edi, edi
je 0x9a0d07
push str._defend
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9a0cc2
xor ecx, ecx
call 0x9cd630
jmp 0x9a1868
test edi, edi
je 0x9a0d07
push str._defendMWAV
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9a0ce7
mov ecx, str.MWAV
call 0x9cd630
jmp 0x9a1868
test edi, edi
je 0x9a0d07
push str._undefend
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x9a0d07
call 0x9cdb20
jmp 0x9a1868
xor ecx, ecx
xor edx, edx
call fcn.0097ceb0
mov esi, eax
test esi, esi
je 0x9a0d28
push esi
lea ecx, [ebp + 0xe08]
lea ebx, [ebp + 0x1114]
call fcn.0097b130
cmp dword [0xbda968], 0
je 0x9a0d67
push esi
push str._MONSERV__dwParentPid___u_
push 0
call fcn.0096a780
lea ecx, [ebp + 0x1114]
push ecx
push str._MONSERV__szParentAppName___s_
push 0
call fcn.0096a780
lea edx, [ebp + 0xe08]
push edx
push str._MONSERV__szParentFullPath___s_
push 0
call fcn.0096a780
add esp, 0x24
push 0
lea eax, [ebp + 0x1924]
push eax
xor esi, esi
call fcn.00972a20
add esp, 8
cmp byte [ebp + 0x1924], 0
je 0x9a1729
xor ecx, ecx
lea edi, [ebp + 0x1924]
call fcn.0095a6d0
test eax, eax
je 0x9a1729
mov ecx, edi
lea edx, [ebp + 0x1b2c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x9a0da4
lea ecx, [ebp + 0x1b2c]
call fcn.00960910
lea eax, [ebp + 0x1b2c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x9a0dc0
mov ecx, dword [str.win.ini]
mov dword [eax], ecx
mov edx, dword [0xaf2874]
mov dword [eax + 4], edx
push 0
push 0
xor edx, edx
lea ecx, [ebp + 0x1b2c]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x9a0e62
mov byte [ebp + 0xf0c], al
push 0x103
push eax
lea eax, [ebp + 0xf0d]
push eax
call fcn.00a7ffb0
lea ecx, [ebp + 0xf0c]
push ecx
lea ecx, [ebp + 0x1b2c]
call fcn.00962300
add esp, 0x10
test eax, eax
je 0x9a0e41
lea edx, [ebp + 0xf0c]
push edx
lea eax, [ebp + 0x1b2c]
push eax
push str._MONSERV__Renaming_wrong_WIN.INI___s__to___s_
push 0
call fcn.0096a780
add esp, 0x10
jmp 0x9a0e62
lea ecx, [ebp + 0x1b2c]
push ecx
push str._MONSERV__Deleting_wrong_WIN.INI___s_
push 0
call fcn.0096a780
add esp, 0xc
lea eax, [ebp + 0x1b2c]
call fcn.0094dd20
cmp dword [0xbda968], 0
je 0x9a0e81
lea edx, [ebp + 0x1924]
push edx
push str._MONSERV__szMyDir___s_
push 0
call fcn.0096a780
add esp, 0xc
mov eax, 0xb55508
call fcn.00954170
cmp eax, 1
je 0x9a0eeb
cmp byte [0xb55508], 0
jne 0x9a0eeb
mov byte [ebp + 0xd04], 0
push 0x103
push 0
lea eax, [ebp + 0xd05]
push eax
call fcn.00a7ffb0
push str._MONSERV__Unable_to_get_eScanInstallDir_
push 0
call fcn.0096a780
lea ecx, [ebp + 0xd04]
push ecx
mov ebx, 0xb55508
call 0x9ccdb0
lea edx, [ebp + 0xd04]
push edx
push str._MONSERV__eScan_Not_Present__Err:___s_
push 0
call fcn.0096a780
add esp, 0x24
jmp 0x9a1868
cmp dword [0xbda968], 0
je 0x9a0f08
push 0xb55508
push str._MONSERV__eScanInstallDir___s_
push 0
call fcn.0096a780
add esp, 0xc
lea ecx, [ebp + 0x1924]
call fcn.00960910
mov ecx, 0xb55508
call fcn.00960910
cmp byte [0xb54ce8], 0
jne 0x9a0f92
push 0xb55508
push str._sLOG_
push 0xb54ce8
call fcn.00a78f30
add esp, 0xc
xor ecx, ecx
mov edi, 0xb54ce8
call fcn.0095a6d0
cmp eax, 1
jne 0x9a0f80
mov eax, edi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x9a0f51
mov ecx, dword [str.MonVir.log]
mov dword [eax], ecx
mov edx, dword [0xaade1c]
mov dword [eax + 4], edx
mov cx, word [0xaade20]
mov word [eax + 8], cx
mov dl, byte [0xaade22]
mov byte [eax + 0xa], dl
jmp 0x9a0f92
push str.MonVir.log
push 0xb54ce8
call fcn.00a78f30
add esp, 8
mov eax, dword [ebp - 0x28]
mov dword [0xbda958], eax
mov ecx, dword [str.eScan_Monitor_Service]
mov dword [ebp + 0x1a28], ecx
mov edx, dword [0xae1a48]
mov dword [ebp + 0x1a2c], edx
mov ecx, dword [0xae1a4c]
mov dword [ebp + 0x1a30], ecx
mov edx, dword [0xae1a50]
mov dword [ebp + 0x1a34], edx
mov ecx, dword [0xae1a54]
mov dword [ebp + 0x1a38], ecx
mov dx, word [0xae1a58]
mov word [ebp + 0x1a3c], dx
push 0x72
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x9a102a
push 0x2f
push edi
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x9a102a
cmp dword [0xbda968], 0
je 0x9a101b
push str._MONSERV__CalledByWSC___TRUE
push 0
call fcn.0096a780
add esp, 8
mov dword [0xbdaf88], 1
jmp 0x9a12a4
call fcn.00968790
test eax, eax
jne 0x9a12a4
push 1
call fcn.0099ebe0
add esp, 4
test eax, eax
jne 0x9a12a4
call fcn.00968c50
cmp eax, 1
jne 0x9a12a4
xor esi, esi
mov dword [ebp - 0x38], esi
xor ebx, ebx
call fcn.0099fce0
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push str.AVRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
lea ecx, [ebp - 0x34]
push ecx
push str.ASRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x1c], ebx
je 0x9a10ad
cmp dword [ebp - 0x34], ebx
je 0x9a10ad
mov esi, 1
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x1c]
push edx
push str.FirewallRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x1c], 0
je 0x9a10d7
mov ebx, 1
test esi, esi
je 0x9a10e3
test ebx, ebx
jne 0x9a12a4
mov dword [ebp - 0x3c], 0
test edi, edi
je 0x9a111e
push str.remove
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x9a1112
push str._remove
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x9a111e
mov dword [ebp - 0x3c], 1
jmp 0x9a12a4
mov ebx, str.wscsvc
call fcn.009605b0
test eax, eax
je 0x9a12a4
mov ecx, ebx
call fcn.00954680
cmp eax, 1
jle 0x9a12a4
cmp eax, 3
je 0x9a12a4
push 1
push ebx
call fcn.00956740
add esp, 8
cmp eax, 1
jne 0x9a1293
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push str.DoNotSetSecurityStatus
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.0099fce0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x20]
push ecx
push str.AVRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
lea edx, [ebp - 0x24]
push edx
push str.ASRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x20], ebx
je 0x9a11e6
cmp dword [ebp - 0x24], ebx
je 0x9a11e6
cmp dword [ebp - 0x2c], ebx
je 0x9a11fa
call fcn.00968790
test eax, eax
jne 0x9a11fa
call fcn.00968c50
cmp eax, 1
jne 0x9a11fa
push 0xb55508
call 0x9ce600
add esp, 4
jmp 0x9a11fa
cmp dword [ebp - 0x2c], ebx
jne 0x9a11fa
push 0xb55508
push 1
call 0x9cdc10
add esp, 8
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x28]
push eax
push str.SecurityMode
mov ecx, str.SOFTWAREMicroWorldeConcealeConceal_FirewallCommon
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.0097f480
mov esi, eax
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x28], ebx
jbe 0x9a1238
cmp esi, 1
jne 0x9a1238
call fcn.0094d970
call fcn.0097f480
mov esi, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x20]
push ecx
push str.FirewallRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x20], ebx
jne 0x9a126e
cmp esi, 1
je 0x9a12a4
push 0xb55508
push 1
call 0x9ce1d0
add esp, 8
jmp 0x9a12a4
cmp esi, 1
jne 0x9a12a4
mov ecx, 0xb55508
call 0x9ce9e0
mov esi, str.FirewallRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0095f910
jmp 0x9a12a4
push 0
push 0
push fcn.0099fe40
call fcn.00a791b2
add esp, 0xc
mov dword [ebp - 0x54], str.eScan_Monitor_Service
mov dword [ebp - 0x50], 0x99f920
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
cmp edi, ebx
je 0x9a148b
push str.install
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x9a12e6
push str._install
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x9a12f6
lea ecx, [ebp + 0x1a28]
call fcn.0099ed00
jmp 0x9a1868
cmp edi, ebx
je 0x9a148b
push str.unreg
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x9a1322
push str._unreg
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x9a1329
call fcn.00968790
jmp 0x9a1386
cmp edi, ebx
je 0x9a148b
push str.remove
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x9a1355
push str._remove
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x9a13ae
xor edi, edi
mov ecx, str.eScan_Monitor_Service
call fcn.009620b0
cmp eax, 1
jne 0x9a1868
call fcn.0099f0e0
call fcn.00968790
test eax, eax
jne 0x9a1868
push 1
call fcn.0099ebe0
add esp, 4
test eax, eax
jne 0x9a1868
call fcn.00968c50
cmp eax, 1
jne 0x9a1868
push 0xb55508
call 0x9ce600
add esp, 4
jmp 0x9a1868
cmp edi, ebx
je 0x9a148b
push 0xabf440
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x9a13da
push str._start
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x9a1426
xor edi, edi
mov ecx, str.eScan_Monitor_Service
call fcn.009620b0
cmp eax, 1
jne 0x9a1868
push eax
push str.eScan_Monitor_Service
call fcn.00956740
add esp, 8
test eax, eax
jne 0x9a1868
mov ecx, str.eScan_Monitor_Service
call fcn.00960470
cmp eax, ebx
jne 0x9a1868
mov edi, str.Unable_To_Start_eScan_Monitor
call fcn.00960b20
jmp 0x9a1868
cmp edi, ebx
je 0x9a148b
push str.stop
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
je 0x9a144e
push str._stop
push edi
call fcn.00a7b8e4
add esp, 8
test eax, eax
jne 0x9a148b
xor edi, edi
mov ecx, str.eScan_Monitor_Service
call fcn.009620b0
cmp eax, 1
jne 0x9a1868
push eax
push str.eScan_Monitor_Service
call fcn.00956740
add esp, 8
cmp eax, 1
jne 0x9a1868
push eax
push ebx
push str.eScan_Monitor_Service
call fcn.00960020
jmp 0x9a1868
call fcn.00968d70
mov esi, eax
push str.services.exe
lea edx, [ebp + 0x1114]
push edx
call fcn.00a88f66
add esp, 8
xor ecx, ecx
call fcn.009790d0
test eax, eax
jne 0x9a171a
cmp esi, ebx
je 0x9a171a
cmp edi, ebx
je 0x9a1868
cmp byte [edi], al
je 0x9a1868
mov byte [ebp + 0x1218], al
push 0x103
push ebx
lea eax, [ebp + 0x1219]
push eax
call fcn.00a7ffb0
lea eax, [ebp + 0x1218]
call fcn.00954170
push ebx
push 0xaf29e0
push edi
call fcn.0095c8c0
add esp, 0x18
cmp eax, 0xffffffff
jne 0x9a151c
push ebx
push 0xaf29e4
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9a15c8
push ebx
push str._enable
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9a15c8
mov byte [ebp + 0x1b2c], 0
push 0x103
push 0
lea ecx, [ebp + 0x1b2d]
push ecx
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp + 0x1218]
push edx
lea eax, [ebp + 0x1b2c]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
lea ecx, [ebp + 0x1b2c]
call fcn.00960910
push str.reload.exe
lea ecx, [ebp + 0x1b2c]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push 0
push 0
xor edx, edx
lea ecx, [ebp + 0x1b2c]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x9a15d4
push 0xaf29f0
lea edx, [ebp + 0x1b2c]
push edx
call esi
push 0
push 0
lea eax, [ebp + 0x1b2c]
push eax
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
jmp 0x9a15d4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push str._update
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9a166a
mov byte [ebp + 0x1420], 0
push 0x103
push 0
lea ecx, [ebp + 0x1421]
push ecx
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp + 0x1218]
push edx
lea eax, [ebp + 0x1420]
push eax
call ebx
lea ecx, [ebp + 0x1420]
call fcn.00960910
push str.download.exe
lea ecx, [ebp + 0x1420]
push ecx
call esi
push 0
push 0
xor edx, edx
lea ecx, [ebp + 0x1420]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x9a1868
push eax
push eax
lea edx, [ebp + 0x1420]
push edx
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
jmp 0x9a1868
push 0
push str._launch
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9a1868
mov byte [ebp + 0x131c], 0
push 0x103
push 0
lea eax, [ebp + 0x131d]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp + 0x1218]
push ecx
lea edx, [ebp + 0x131c]
push edx
call ebx
lea ecx, [ebp + 0x131c]
call fcn.00960910
push str.escanpro.exe
lea eax, [ebp + 0x131c]
push eax
call esi
push 0
push 0
xor edx, edx
lea ecx, [ebp + 0x131c]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x9a1868
mov byte [ebp + 0x1820], al
push 0x103
push eax
lea ecx, [ebp + 0x1821]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0
push 0
lea edx, [ebp + 0x1820]
lea ecx, [ebp + 0x131c]
call fcn.0095d9e0
jmp 0x9a1868
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x9a1868
push str._MONSERV__Unable_to_get_szMyDir_
push 0
call fcn.0096a780
add esp, 8
jmp 0x9a1868
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1c30]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0x1c34
mov esp, ebp
pop ebp
ret 0x10