Function at 0x86b4c0
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb16510
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0xd00
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0xcf0], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xce8], ebx
mov byte [ebp - 0x83c], bl
push 0x40f
push ebx
lea eax, [ebp - 0x83b]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov ecx, dword [0xb53f6c]
mov dword [ebp - 0xd10], ecx
push 0xffffffffffffffff
mov edx, dword [0xb55c24]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0xb567bc], edi
call fcn.0086a750
push edi
push esi
push str.InitializeAndLoadMonitor___s___u_
lea eax, [ebp - 0x83c]
push eax
call fcn.00a78f30
push ebx
mov edi, 1
push edi
lea ecx, [ebp - 0x83c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [0xb53f6c], ebx
jne 0x86b718
push esi
push str.Starting_Initialization___s_
lea edx, [ebp - 0x83c]
push edx
call fcn.00a78f30
push ebx
push edi
lea eax, [ebp - 0x83c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov eax, dword [0xb565a8]
cmp eax, ebx
je 0x86b5e7
push eax
push str.Waiting___u_secs__before_MSI_BdInitialize_and_then_going_to_next_step...
lea ecx, [ebp - 0x120]
push ecx
call fcn.00a78f30
push ebx
push edi
lea edx, [ebp - 0x120]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
call fcn.0095a9e0
cmp dword [0xb5417c], edi
jne 0x86b5f6
call fcn.008a3a80
jmp 0x86b5fb
call 0x8843f0
mov ebx, eax
mov eax, dword [0xb565a8]
test eax, eax
je 0x86b635
push ebx
push eax
push str.Waiting___u_secs__MSI_BdInitialize_finished__and_then_going_to_next_step__hr__0x_x_...
lea eax, [ebp - 0x120]
push eax
call fcn.00a78f30
push 0
push edi
lea ecx, [ebp - 0x120]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
call fcn.0095a9e0
test ebx, ebx
jge 0x86b6f4
push ebx
push str.Error:_Initialization_Failed._Return_Code:_0x_x
lea edx, [ebp - 0x83c]
push edx
call fcn.00a78f30
push 0
push edi
lea eax, [ebp - 0x83c]
push eax
push 0xb54ce8
call fcn.008808e0
push 0xaa1ac4
push 0xaa154c
mov ecx, str.MonitorStatus
call fcn.009591b0
push 0
push 0xaa154c
mov ecx, str.MonitorStatusExt
call fcn.009591b0
add esp, 0x2c
xor eax, eax
mov esi, str.MonitorStatus
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor esi, esi
cmp dword [0xb45d94], esi
je 0x86b6dd
call fcn.00968790
test eax, eax
jne 0x86b6dd
call fcn.00968d70
cmp eax, edi
jne 0x86b6d8
push esi
push edi
push str.Invoking_SetAVStatusToMonitorEnabled_For_Failed_Init
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0086d1d0
jmp 0x86b6dd
call fcn.0087afb0
mov dword [0xb3ddb4], esi
mov dword [0xb58c0c], esi
mov dword [0xb53f6c], esi
jmp 0x86c3cf
mov dword [0xb53f6c], edi
mov dword [0xb58c0c], edi
mov dword [ebp - 0xce8], edi
mov ecx, dword [0xb52000]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, 1
cmp dword [0xb53f6c], edi
jne 0x86bf40
cmp dword [0xb54178], 0
jne 0x86bf40
xor edi, edi
mov dword [ebp - 0xcec], edi
push edi
push 1
push 0xaaeafc
push 0xb54ce8
call fcn.008808e0
push esi
push str.Loading_File_Monitor___s_
lea edx, [ebp - 0x83c]
push edx
call fcn.00a78f30
push edi
push 1
lea eax, [ebp - 0x83c]
push eax
push 0xb54ce8
call fcn.008808e0
push 0xaae0f8
push 0xaa154c
mov ecx, str.MonitorStatus
call fcn.009591b0
push edi
push 0xaa154c
mov ecx, str.MonitorStatusExt
call fcn.009591b0
add esp, 0x3c
lea eax, [edi + 1]
mov esi, str.MonitorStatus
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb45d94], ebx
je 0x86b87f
call fcn.00968790
test eax, eax
jne 0x86b87f
call fcn.00968d70
cmp eax, 1
jne 0x86b87a
mov dword [ebp - 0xd08], ebx
lea ecx, [ebp - 0xd08]
push ecx
push str.DoNotSetSecurityStatus
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xb565a0], ebx
jne 0x86b809
cmp dword [ebp - 0xd08], ebx
je 0x86b85c
push 0xaa1ac4
push 0xaa154c
mov ecx, str.MonitorStatus
call fcn.009591b0
push ebx
push 0xaa154c
mov ecx, str.MonitorStatusExt
call fcn.009591b0
add esp, 0x10
xor eax, eax
mov esi, str.MonitorStatus
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0
push 1
push str.FORCIBLY_SETTING_MONITOR_STATUS_TO_0__A_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
push ebx
push 1
push str.Invoking_SetAVStatusToMonitorEnabled_For_Loading_Mon
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0086d1d0
jmp 0x86b87f
call fcn.0087afb0
cmp dword [0xb5417c], ebx
jne 0x86b8b7
push 1
push str.klif
call fcn.00956740
add esp, 8
push ebx
push 1
cmp eax, 1
jne 0x86b8a5
push str.Klif_Service_Present_And_Running
jmp 0x86b8aa
push str.Klif_Service_Not_Running
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.00968790
test eax, eax
jne 0x86ba60
mov dword [ebp - 0xcf8], 0xffffffff
mov dword [ebp - 0xd04], ebx
lea edx, [ebp - 0xcf8]
push edx
push str.WinOSValue
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
lea eax, [ebp - 0xd04]
push eax
push str.Win10Build
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.00968930
test eax, eax
je 0x86b955
mov dword [ebp - 0xce0], ebx
push 0x90
push ebx
lea ecx, [ebp - 0xcdc]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xce4], 5
xor edx, edx
lea ecx, [ebp - 0xce0]
call fcn.0094c480
mov edx, dword [ebp - 0xcd4]
mov dword [ebp - 0xcec], edx
mov edi, edx
jmp 0x86b97c
call fcn.00968840
test eax, eax
je 0x86b96a
mov dword [ebp - 0xce4], 4
jmp 0x86b97c
call fcn.009687b0
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0xcf8]
cmp eax, 0xffffffff
je 0x86b98f
cmp eax, dword [ebp - 0xce4]
jne 0x86b99b
cmp edi, ebx
je 0x86b9af
cmp dword [ebp - 0xd04], edi
je 0x86b9af
mov esi, str.FirewallDriverChecked
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0095f910
call fcn.009687b0
test eax, eax
jne 0x86b9c1
call fcn.00968840
test eax, eax
je 0x86ba31
mov dword [ebp - 0xcfc], ebx
lea eax, [ebp - 0xcfc]
push eax
push str.FirewallDriverChecked
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov ecx, dword [ebp - 0xcfc]
push ecx
push str.Starting_eScan_Firewall_Check_Status_Thread___u_...
lea edx, [ebp - 0x120]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x120]
push eax
push 0xb54ce8
call fcn.008808e0
push ebx
push ebx
push 0x85e840
call fcn.00a791b2
add esp, 0x28
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_2a
call fcn.0085df70
mov edi, dword [ebp - 0xcec]
mov eax, dword [ebp - 0xce4]
mov esi, str.WinOSValue
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
test edi, edi
je 0x86ba60
mov eax, edi
mov esi, str.Win10Build
mov ecx, 0x80000002
call fcn.0094be90
mov eax, dword [0xb565a8]
test eax, eax
je 0x86ba98
push eax
push str.Waiting___u_secs__before_MSI_BdLoadMonitorEx_and_then_going_to_next_step...
lea ecx, [ebp - 0x120]
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x120]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
call fcn.0095a9e0
mov edi, 1
cmp dword [0xb5417c], edi
jne 0x86baac
call fcn.008aeeb0
jmp 0x86bab1
call 0x884df0
mov esi, eax
mov eax, dword [0xb565a8]
test eax, eax
je 0x86baeb
push esi
push eax
push str.Waiting___u_secs___MSI_BdLoadMonitorEx_finished__and_then_going_to_next_step__hr__0x_x_...
lea eax, [ebp - 0x120]
push eax
call fcn.00a78f30
push 0
push edi
lea ecx, [ebp - 0x120]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
call fcn.0095a9e0
test esi, esi
jge 0x86bbb3
push esi
push str.Error:_Loading_Monitor_Failed._Result_Code:_0x_x
lea edx, [ebp - 0x83c]
push edx
call fcn.00a78f30
push 0
push edi
lea eax, [ebp - 0x83c]
push eax
push 0xb54ce8
call fcn.008808e0
push 0xaa1ac4
push 0xaa154c
mov ecx, str.MonitorStatus
call fcn.009591b0
push 0
push 0xaa154c
mov ecx, str.MonitorStatusExt
call fcn.009591b0
add esp, 0x2c
xor eax, eax
mov esi, str.MonitorStatus
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor esi, esi
cmp dword [0xb45d94], esi
je 0x86bba2
call fcn.00968790
test eax, eax
jne 0x86bba2
call fcn.00968d70
cmp eax, edi
jne 0x86bb9d
push esi
push edi
push str.Invoking_SetAVStatusToMonitorEnabled_For_Failed_Mon_Load
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0086d1d0
mov dword [0xb3ddb4], esi
mov dword [0xb54178], esi
jmp 0x86c3cf
call fcn.0087afb0
mov dword [0xb3ddb4], esi
mov dword [0xb54178], esi
jmp 0x86c3cf
mov dword [0xb54178], edi
push 0
push edi
push str.Success:_File_Monitor_Successfully_Loaded.
push 0xb54ce8
call fcn.008808e0
push 0
push edi
push 0xaaeafc
push 0xb54ce8
call fcn.008808e0
push 0xaae0f8
push 0xaa154c
mov ecx, str.MonitorStatus
call fcn.009591b0
push 0
push 0xaa154c
mov ecx, str.MonitorStatusExt
call fcn.009591b0
add esp, 0x30
mov eax, edi
mov esi, str.MonitorStatus
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb45d94], ebx
je 0x86bcbb
call fcn.00968d70
cmp eax, edi
jne 0x86bcbb
mov dword [ebp - 0xd00], ebx
lea ecx, [ebp - 0xd00]
push ecx
push str.DoNotSetSecurityStatus
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xb565a0], ebx
jne 0x86bc67
cmp dword [ebp - 0xd00], ebx
je 0x86bcbb
push 0xaa1ac4
push 0xaa154c
mov ecx, str.MonitorStatus
call fcn.009591b0
push ebx
push 0xaa154c
mov ecx, str.MonitorStatusExt
call fcn.009591b0
add esp, 0x10
xor eax, eax
mov esi, str.MonitorStatus
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0
push edi
push str.FORCIBLY_SETTING_MONITOR_STATUS_TO_0__B_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
cmp dword [ebp - 0xce8], ebx
je 0x86bea2
mov dword [ebp - 0xce4], 0x3c
mov edx, dword [0xb54194]
neg edx
sbb edx, edx
and edx, 0x3c
mov dword [ebp - 0xce4], edx
lea eax, [ebp - 0xce4]
push eax
push str.SendSessionEvents
mov ecx, str.SoftwareMicroWorldeScan_for_Windows
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0xce4], ebx
je 0x86be0e
mov dword [ebp - 0xce8], ebx
cmp byte [str.C:PROGRA2eScanESCAN.LAN], bl
jne 0x86bd54
push 0xb55508
push str._sESCAN.LAN
push str.C:PROGRA2eScanESCAN.LAN
call fcn.00a78f30
add esp, 0xc
push str.C:PROGRA2eScanESCAN.LAN
push 0x104
push str.Allowed
push 0xab045c
push 0xab0464
push str.SCANINST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0xce8]
push ecx
push str.LastNow
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.0094e910
mov ecx, dword [ebp - 0xce8]
cmp ecx, ebx
jbe 0x86be60
cmp eax, ecx
jae 0x86be42
mov byte [ebp - 0x42c], bl
push 0x103
push ebx
lea edx, [ebp - 0x42b]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [0xb3ddb4], edi
push 0x80000002
xor eax, eax
mov edi, str.SoftwareMicroWorldeScan_for_WindowsMwMonitorPidTmp
call fcn.0095fbe0
xor ebx, ebx
lea esi, [ebp - 0x42c]
call fcn.00985ed0
mov eax, esi
push eax
push str.PC_STARTUP___s_
lea ecx, [ebp - 0x120]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.eScan_Monitor
push str.Allowed
lea edx, [ebp - 0x120]
push edx
push 0xaa154c
push ebx
push 0x6b1
mov ecx, str.eScan_Monitor
call fcn.00982e00
jmp 0x86be77
mov dword [ebp - 0xcf4], ebx
lea eax, [ebp - 0xcf4]
push eax
push str.LastNow
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.0094e910
mov ecx, dword [ebp - 0xcf4]
cmp ecx, ebx
jbe 0x86be60
cmp eax, ecx
jb 0x86be60
mov esi, str.EPSNow
mov ebx, str.SoftwareMicroWorldDeviceControl
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov dword [0xb3ddb4], ebx
jmp 0x86be77
mov dword [0xb3ddb4], edi
push 0x80000002
xor eax, eax
mov edi, str.SoftwareMicroWorldeScan_for_WindowsMwMonitorPidTmp
call fcn.0095fbe0
cmp dword [0xb5659c], ebx
jne 0x86bea8
push 0xb55508
push ebx
push 0x9c9210
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_2b
call fcn.0085df70
jmp 0x86bea8
mov dword [0xb3ddb4], ebx
cmp dword [0xb567c0], ebx
jne 0x86bf2c
mov ecx, dword [0xb52008]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x86bf2c
mov byte [ebp - 0xc4c], bl
push 0x207
push ebx
lea edx, [ebp - 0xc4b]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0xa44], bl
push 0x207
push ebx
lea eax, [ebp - 0xa43]
push eax
call fcn.00a7ffb0
push 0x208
lea esi, [ebp - 0xc4c]
call fcn.00960b00
mov ecx, esi
push ecx
push str.Unable_to_set_MonEnabled_Event__Reason:__s
lea edx, [ebp - 0xa44]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0xa44]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x38
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xcf0], 1
jmp 0x86bfa3
push 0
push edi
push 0xaaeafc
push 0xb54ce8
call fcn.008808e0
push esi
push str.File_Monitor_Alive___s_
lea ecx, [ebp - 0x83c]
push ecx
call fcn.00a78f30
push 0
push edi
lea edx, [ebp - 0x83c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x2c
mov dword [0xb3ddb4], 0
cmp dword [0xb53f6c], edi
jne 0x86c3cf
cmp dword [0xb54178], edi
jne 0x86c3cf
mov dword [ebp - 0xcf0], edi
mov edi, 1
cmp dword [0xb56828], edi
jne 0x86c3cf
cmp dword [0xb5682c], edi
jne 0x86c3cf
mov byte [ebp - 0x224], 0
push 0x103
push 0
lea eax, [ebp - 0x223]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x328], 0
push 0x103
push 0
lea ecx, [ebp - 0x327]
push ecx
call fcn.00a7ffb0
add esp, 0x18
mov dword [0xb5682c], 0
push 0xb54190
push str.FileRightsValue
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.009a5f10
mov dword [0xb5418c], eax
push 0xb56934
push str.FileInfectorDetectedEx
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb8db58
push str.LogFilesCopiedToUSB
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x86c073
mov eax, dword [0xb8db58]
mov esi, str.LogFilesCopiedToUSB
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0xb391a4
push str.BlockFileRenamesToMultipleExtension
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x86c0a9
mov eax, dword [0xb391a4]
mov esi, str.BlockFileRenamesToMultipleExtension
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0xb8db5c
push str.NetworkSharesAccessControl
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x86c0ea
xor eax, eax
cmp dword [0xb54194], eax
setne al
mov dword [0xb8db5c], eax
mov esi, str.NetworkSharesAccessControl
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0
push str.NetworkSharesNoAccess
call fcn.0094c210
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x86c118
push 0xaa1543
push 0xaa21e4
mov edx, str.NetworkSharesNoAccess
mov ecx, 0x80000002
call fcn.0094bd00
push 0
push str.NetworkSharesReadOnlyAccess
call fcn.0094c210
add esp, 8
mov esi, eax
test esi, esi
jne 0x86c146
push 0xaa1543
push 0xaa21e4
mov edx, str.NetworkSharesReadOnlyAccess
mov ecx, 0x80000002
call fcn.0094bd00
test ebx, ebx
je 0x86c153
push ebx
call fcn.00a78fec
add esp, 4
test esi, esi
je 0x86c160
push esi
call fcn.00a78fec
add esp, 4
mov ebx, 4
cmp dword [0xb54190], ebx
je 0x86c17c
cmp dword [0xb56934], 0
je 0x86c17c
mov dword [0xb54190], ebx
mov al, byte [0xb8db58]
test bl, al
je 0x86c192
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt__Network_File_Operations_Monitoring_
jmp 0x86c20f
test al, 3
je 0x86c1a3
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt__DeleteFile_Operations_Monitoring_
jmp 0x86c20f
cmp dword [0xb391a4], 0
je 0x86c1b9
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt__Block_File_Renames_for_Ransomware_
jmp 0x86c20f
cmp dword [0xb8db5c], 0
je 0x86c1cf
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt__Network_Access_Control_
jmp 0x86c20f
cmp dword [0xb56934], 0
je 0x86c1e5
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt__File_Infectors_Detected_
jmp 0x86c20f
cmp dword [0xb45b64], 0
je 0x86c204
call fcn.0098f550
test eax, eax
je 0x86c204
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt__EndPoint_feature_Detected_
jmp 0x86c20f
push str.MWFSFLT
push edi
push str.Resuming_mwfsmflt...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb45b64], 0
je 0x86c232
call fcn.0098f550
test eax, eax
je 0x86c232
mov eax, edi
jmp 0x86c234
xor eax, eax
push eax
mov edx, dword [0xb391a4]
push edx
mov eax, dword [0xb8db5c]
push eax
mov ecx, dword [0xb8db58]
push ecx
mov edx, dword [0xb54190]
push edx
xor ecx, ecx
lea edx, [ebp - 0x224]
call fcn.009a5fb0
add esp, 0x14
test eax, eax
jne 0x86c296
lea eax, [ebp - 0x224]
push eax
push str._A_ChangeProtectionState_failed___s_
lea ecx, [ebp - 0x328]
push ecx
call fcn.00a78f30
push str.MWFSFLT
push edi
lea edx, [ebp - 0x328]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
test byte [0xb8db58], bl
jne 0x86c2b6
mov ecx, dword [0xbd0520]
mov eax, ecx
call fcn.00964530
test eax, eax
je 0x86c2b6
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [0xb5418c]
test esi, esi
je 0x86c2d2
push 0
push 0
call fcn.009ab000
add esp, 8
mov esi, dword [0xb5418c]
mov ebx, dword [0xb54190]
test ebx, ebx
jne 0x86c2e0
test esi, esi
je 0x86c349
mov dword [ebp - 0xd0c], 0
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea eax, [ebp - 0x11f]
push eax
call fcn.00a7ffb0
push esi
push ebx
push str._SENS__Adding_Processes_to_MWFSM_List_A____FR:_u__SFP:_u
lea ecx, [ebp - 0x120]
push ecx
call fcn.00a78f30
push str.MWFSFLT
push edi
lea edx, [ebp - 0x120]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [ebp - 0xd0c]
push eax
xor edx, edx
mov ecx, str.c:windows_system32_svchost.exe
call fcn.009a9e30
add esp, 0x30
call fcn.009ab720
push str.MWFSFLT
push edi
push str._SENS__Setting_List_Values_A_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [0xb54190]
push ecx
call fcn.009a6df0
cmp dword [0xb8db5c], 0
je 0x86c37f
push edi
call fcn.0086ace0
add esp, 4
cmp dword [0xb45d94], 0
je 0x86c3b7
call fcn.008836b0
mov dword [0xbd5784], eax
push edi
call fcn.0086af90
mov edx, dword [0xbd5784]
mov dword [0xbd5788], edx
push edi
call fcn.0086b0a0
add esp, 8
mov eax, dword [0xb5418c]
mov dword [0xbd578c], eax
push str.MWFSFLT
push edi
push str._SENS__Event_Sent__A_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor edi, edi
cmp dword [0xb567c0], edi
je 0x86c421
cmp dword [0xb54178], edi
je 0x86c3f2
mov ecx, dword [0xb52008]
push ecx
call fcn.008a2940
add esp, 4
jmp 0x86c407
push edi
push 1
push str._FSIG__Monitor_Load_Failed__Not_Loading_Full_Signatures.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov esi, str.ZTempLoad
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0095f910
mov dword [0xb567c0], edi
push edi
push 1
push str.Continuing_with_Init...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.0087af20
call fcn.008609c0
cmp dword [ebp - 0xd10], edi
jne 0x86c476
push edi
push 1
push str.Starting_Mysa_Cleanup...
push 0xb54ce8
call fcn.008808e0
push 1
call fcn.0086b3b0
push edi
push 1
push str.Mysa_Cleanup_done.
push 0xb54ce8
call fcn.008808e0
add esp, 0x24
mov dword [0xb567c4], 1
mov dword [0xb567bc], edi
mov edx, dword [0xb55c24]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x86c4ad
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0xcf0]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret